Text

License Amendment Request Associated with the Digital Control Rod Drive System (Crdcs) Modification, Technical Specification Change (TSC) Number 2003-09
	ML040290115
Person / Time
Site:	Oconee
Issue date:	01/15/2004
From:	Rosalyn Jones; Duke Power Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML040290115 (96)
	v • d • e

Duke R. A. JONES EPower, Vice President A Duke Energy Company Duke Power 29672 / Oconee Nuclear Site 7800 Rochester Highway Seneca, SC 29672 864 885 3158 864 885 3564 fax January 15, 2004 U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Attention: Document Control Desk

Subject:

Oconee Nuclear Station Docket Numbers 50-269, 270, and 287 License Amendment Request associated with the Digital Control Rod Drive Control System (CRDCS)

Modification Technical Specification Change (TSC) Number 2003-09 Pursuant to Title 10, Code of Federal Regulations (CFR),

Part 50, Section 90 (10 CFR 50.90), Duke Energy Corporation (Duke) proposes to amend Appendix A, Technical Specifications, for Facility Operating Licenses DPR-38, DPR-47 and DPR-55 for Oconee Nuclear Station (ONS), Units 1, 2, and 3. This amendment is needed to support installation of a Digital CRDCS. The proposed License Amendment Request (LAR) revises the Technical Specifications (TS) associated with the Control Rod Drive (CRD) Trip Devices.

The existing relay based CRDCS is being upgraded to a solid-state programmable Digital CRDCS to resolve obsolescence and age-related degradation issues. This upgrade replaces the CRD/ Reactor Trip Breakers, the electronics and controls contained in the CRD cabinets located in the Cable room and the Operator Control Panel (OCP) located in the Control Room. Duke expects these changes to enhance the reliability of the CRDCS through the extended life of Oconee Nuclear Station.

Duke proposes to revise Technical Specification 3.3.4, "Control Rod Drive (CRD) Trip Devices," to add requirements associated with the Digital CRDCS. Since ONS Technical Specifications are common to all three units, Notes will be used to indicate the applicable requirement for each unit based on the status of the modification. The proposed change to TS 3.3.4 adds a Limiting Condition for Operation vAA 1 www.duke-energy.com

U. S. Nuclear Regulatory Commission January 15, 2004 Page 2 (LCO) and ACTIONS for the new configuration. After completion of the modification on all three units, Duke will submit a Technical Specification change to remove the obsolete requirements related to the existing Control Rod Drive Control System.

The revised Technical Specification pages are included in . Attachment 2 contains the markup of the current Technical Specification pages. The Technical Justification for the amendment request is included in . Attachments 4 and 5 contain the No Significant Hazards Consideration Evaluation and the Environmental Impact Analysis, respectively.

The proposed changes to the Technical Specifications have been reviewed and approved by the Plant Operations Review Committee and Nuclear Safety Review Board.

Duke plans to implement this modification first on Unit 3 during the fall 2004 refueling outage. Approval of this proposed LAR is requested by September 30, 2004, to support this implementation schedule. A 90-day implementation period is requested for the Technical Specification change.

Implementation of these changes will not result in an undue risk to the health and safety of the public.

UFSAR changes necessary to reflect approval of this submittal will be made in accordance 10 CFR 50.71(e).

Pursuant to 10 CFR 50.91, a copy of this proposed amendment is being sent to the South Carolina Department of Health and Environmental Control for review, and as deemed necessary and appropriate, subsequent consultation with the NRC staff.

If there are any additional questions, please contact Boyd Shingleton at (864) 885-4716.

Veryt yours, R. . es, Vice President Oconee Nuclear Site

U. S. Nuclear Regulatory Commission January 15, 2004 Page 3 cc: Mr. L. N. Olshan, Project Manager Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop 0-14 H25 Washington, D. C. 20555 Mr. L. A. Reyes, Regional Administrator U. S. Nuclear Regulatory Commission - Region II Atlanta Federal Center 61 Forsyth St., SW, Suite 23T85 Atlanta, Georgia 30303 Mr. M. C. Shannon Senior Resident Inspector Oconee Nuclear Station Mr. Henry Porter, Director Division of Radioactive Waste Management

.Bureau of Land and Waste Management Department of Health & Environmental Control 2600 Bull Street Columbia, SC 29201

U. S. Nuclear Regulatory Commission January 15, 2004 Page 4 R. A. Jones, being duly sworn, states that he is Vice President, Oconee Nuclear Site, Duke Energy Corporation, that he is authorized on the part of said Company to sign and file with the U. S. Nuclear Regulatory Commission this revision to the Renewed Facility Operating License Nos. DPR-38, DPR-47, DPR-55; and that all the statements and matters set forth herein are true and correct to the best of his knowledg R. A. one , Vice President Ocon e lear Site scribed and sworn to before me this / Vday of 2004 No ary Public My Commission Expires:

N - ~ 2- -

ATTACHMENT 1 TECHNICAL SPECIFICATION Remove Page Insert Page 3.3 .4-1 3.3.4-1 3.3.4-2 3.3.4-2 3.3.4-3 3.3.4-3 TECHNICAL SPECIFICATION BASES B 3.1.4 B 3.1.4-9 B 3.1.4 B 3.1.4-9 B 3.1.6 B 3.1.6-4 B 3.1.6 B 3.1.6-4 B 3.1.7-2 B 3.1.7-2 B 3.3.1 B 3.3.1-25 B 3.3.1-2 - B 3.3.1-25 B 3.3.2-1 B 3.3.2-1 B 3.3.3 B 3.3.3-4 B 3.3.3 B 3.3.3-4 B 3.3.4 B 3.3.4-6 B 3.3.4-1 - B 3.3.4-7

CRD Trip Devices 3.3.4 3.3 INSTRUMENTATION 3.3.4 Control Rod Drive (CRD) Trip Devices LCO 3.3.4 a. Four AC CRD trip breakers shall be OPERABLE for Unit(s) with the Control Rod Drive Control System Digital Upgrade complete.

b. The following CRD trip devices shall be OPERABLE for Unit(s) with the CRCDS Digital Upgrade not complete:

1. Two AC CRD trip breakers;

2. Two DC CRD trip breaker pairs; and

3. Eight electronic trip assembly (ETA) relays APPLICABILITY: MODES 1 and 2, MODES 3, 4, and 5 when any CRD trip breaker is in the closed position and the CRD System is capable of rod withdrawal.

ACTIONS

NOTE-------------

Separate Condition entry is allowed for each CRD trip device.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more CRD A.1 Trip the CRD trip 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months trip breakers diverse breaker.

trip Functions inoperable OR OR A.2 Remove power from 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months the CRD trip breaker.

One or more required DC CRD breaker pair diverse trip Functions inoperable.

(continued)

OCONEE UNITS 1, 2, & 3 3.3.4-1 Amendment Nos. I

CRD Trip Devices 3.3.4 CONDITION REQUIRED ACTION COMPLETION TIME B. One or more CRD B.1 Trip the CRD trip 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months I trip breakers breaker.

inoperable for reasons other than OR Condition A.

B.2 Remove power from 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR the CRD trip breaker.

One or more required DC CRD breaker pairs inoperable for reasons other than Condition A.

C. One or more C.1 Transfer affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months required ETA relays CONTROL ROD group inoperable. to power supply with OPERABLE ETA relays.

OR C.2 Trip corresponding AC 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months CRD trip breaker(s).

(continued)

OCONEE UNITS 1, 2, & 3 3.3.4-2 Amendment Nos. I

CRD Trip Devices 3.3.4 CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met in AND MODE 1, 2, or 3.

D.2.1 Open all CRD trip 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months breakers.

OR D.2.2 Remove power from all 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months CRD trip breakers.

E. Required Action and E.1 Open all CRD trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion breakers.

Time not met in MODE 4 or 5. OR E.2 Remove power from all 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months CRD trip breakers.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.4.1 Perform CHANNEL FUNCTIONAL TEST. 31 days OCONEE UNITS 1, 2, & 3 3.3.4-3 Amendment Nos. I

CONTROL ROD Group Alignment Limits B 3.1.4 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.4 CONTROL ROD Group Alignment Limits BASES BACKGROUND The OPERABILITY (e.g., trippability) of the CONTROL RODS is an initial condition assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment is an initial condition assumption in the safety analysis that directly affects core power distributions and assumptions of SDM. An inoperable CONTROL ROD that is unable to respond to positioning signals from the Rod Drive Control System may still meet its SDM capabilities if it is capable of responding to a valid trip signal (i.e., inoperable but trippable). It would, however, have the potential to adversely affect core power distribution due to its inability to maintain itself within the group average. An inoperable CONTROL ROD which is not "trippable" would satisfy neither the capacity to supply SDM requirements nor the ability to maintain itself in alignment with the group to assure acceptable core power distribution.

The applicable criteria for these design requirements are ONS Design Criteria (Ref. 1) and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plants" (Ref. 2).

Mechanical or electrical failures may cause a CONTROL ROD to become inoperable or to become misaligned from its group. CONTROL ROD inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available CONTROL ROD worth for reactor shutdown. Therefore, CONTROL ROD alignment and OPERABILITY are related to core operation within design power peaking limits and the core design requirement of a minimum SDM.

Limits on CONTROL ROD alignment and OPERABILITY have been established, and all CONTROL ROD positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.

CONTROL RODS are moved by their control rod drive mechanisms (CRDMs). Each CRDM moves its rod 3/4 inch for one revolution of the roller nut assembly, but at different rates og and run) depending on the signal I output from the Rod Drive Control System (RDCS).

OCONEE UNITS 1, 2, & 3 B 3.1.4-1 Amendment Nos. I

CONTROL ROD Group Alignment Limits B 3.1.4 BASES BACKGROUND The CONTROL RODS are arranged into rod groups that are radially (continued) symmetric. Therefore, movement of the CONTROL RODS does not introduce radial asymmetries in the core power distribution. The CONTROL RODS provide required negative reactivity worth for immediate reactor shutdown upon a reactor trip. The regulating rods provide reactivity control during normal operation and transients, and their movement is normally governed by the Integrated Control System.

The axial position of CONTROL RODS is indicated by two separate and independent systems, which are the relative position indicator transducers and the absolute position indicator transducers (see LCO 3.1.7, "Position Indicator Channels").

For Unit(s) with CRDCS digital upgrade not complete, the relative position I indicator transducer is a potentiometer coupled to a pulse stepping motor that is driven by electrical pulses from the RDCS. For Unit(s) with CRDCS digital upgrade complete, the relative position indication is processed by a Programable Logic Controller (PLC) which counts sequential electrical pulses sent to the CRD motor stator. There is one relative position transducer (absolute position or relative position is selectable for display on one position indication meter) for.each CONTROL ROD drive. Individual rods in a group (for Unit(s) with the CRDCS digital upgrade not complete, when aligned to the same power supply), receive the same signal to move; therefore, the counters for all rods in a group should normally indicate the same position. The Relative Position Indicator System is considered highly precise (one rotation of the roller nut assembly will result in 3/4 inch in rod I motion). However, if a rod does not move for each demand pulse, the counter (for Unit(s) with CRDCS digital upgrade not complete) or PLC (for Unit(s) with CRDCS digital upgrade complete) will still count the pulse and incorrectly reflect the position of the stuck (or mechanically constrained) rod.

The Absolute Position Indicator System provides an accurate indication of actual CONTROL ROD position, but at a lower precision than the relative position indicators. This system is based on analog signals from a series I of reed switches.

I APPLICABLE CONTROL ROD misalignment and inoperability are analyzed in the SAFETY ANALYSES safety analysis (Ref. 3). The criteria for addressing CONTROL ROD inoperability or misalignment are that:

a. There shall be no violations of:

1. specified acceptable fuel design limits, or

2. Reactor Coolant System (RCS) pressure boundary damage; and OCONEE UNITS 1, 2, & 3 B 3.1.4-2 Amendment Nos. I

CONTROL ROD Group Alignment Limits B 3.1.4 BASES APPLICABLE b. The core must remain subcritical after accident transients, except SAFETY ANALYSES for a main steam line break (MSLB). The analysis results for a (continued) MSLB with a coincident failure of the most reactive rod to insert results in a return to criticality.

Two types of misalignment are distinguished. During movement of a CONTROL ROD group, one rod may stop moving, while the other rods in the group continue. This condition may cause excessive power peaking.

The second type of misalignment occurs when one CONTROL ROD drops partially or fully into the reactor core. With ICS in manual, this event causes an initial power reduction followed by a return towards the original power due to positive reactivity feedback from the negative moderator temperature coefficient. Increased peaking during the power increase may result in excessive local linear heat rates (LHRs).

The accident analysis and reload safety evaluations define regulating rod position limits that ensure the required SDM can always be achieved if the maximum worth CONTROL ROD is stuck fully withdrawn (Ref. 3). If a CONTROL ROD is stuck in or dropped in, continued operation is permitted.

The Required Action statements in the LCOs provide conservative reductions in THERMAL POWER and verification of SDM to ensure continued operation remains within the bounds of the safety analysis (Ref. 3).

The CONTROL ROD group alignment limits satisfy Criterion 2 of 10 CFR 50.36 (Ref. 4).

LCO The limits on CONTROL ROD group alignment, safety rod position, and APSR alignment, together with the limits on regulating rod position, AXIAL POWER IMBALANCE, and OPT, ensure the reactor will operate within the fuel design criteria. The Required Actions in these LCOs ensure that deviations from the alignment limits will either be corrected or that THERMAL POWER will be adjusted, so that excessive local LHRs will not occur and the requirements on SDM and ejected rod worth are preserved.

The limit for individual CONTROL ROD misalignment is 6.5% (9 inches) deviation from the group average position. This value is established, based on the distance between reed switches, with additional allowances for uncertainty in the equipment used to determine this value. For the purpose of complying with this LCO, the position of a misaligned rod is not included in the calculation of the rod group average position.

Failure to meet the requirements of this LCO may produce unacceptable power peaking factors and LHRs, or unacceptable SDM or ejected rod worth, all of which may constitute initial conditions inconsistent with the safety analysis.

OCONEE UNITS 1, 2, & 3 B 3.1.4-3 Amendment Nos. I

CONTROL ROD Group Alignment Limits B 3.1.4 BASES (continued)

APPLICABILITY The requirements on CONTROL ROD OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which significant neutron (or fission) power is generated, and the OPERABILITY (i.e., trippability) and alignment of rods have the potential to affect the safety of the unit. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the reactor is shut down and resultant local power peaking would not exceed fuel design limits. In MODES 3, 4, 5 and 6, the OPERABILITY of the CONTROL RODS has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the RCS. See LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," for SDM in MODES 3, 4, and 5, and LCO 3.9.1, "Boron Concentration," for boron concentration requirements during MODE 6.

ACTIONS A.1 For Unit(s) with CRDCS digital upgrade not complete, alignment of the I inoperable or misaligned CONTROL ROD may be accomplished by either moving the single CONTROL ROD to the group average position, or by moving the remainder of the group to the position of the single inoperable or misaligned CONTROL ROD. Either action can be used to restore the CONTROL RODS to a radially symmetric pattem. For Unit(s) with CRDCS digital upgrade complete, alignment of the inoperable or misaligned CONTROL ROD must be accomplished by moving the single CONTROL ROD to the group average position to restore the CONTROL RODS to a radially symmetric pattern. However, this must be done without violating the CONTROL ROD group sequence, overlap, and position limits of LCO 3.2.1, "Regulating Rod Position Limits," given in the COLR.

THERMAL POWER must also be restricted, as necessary, to the value allowed by the position limits of LCO 3.2.1. The required Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is acceptable because local xenon redistribution during this short interval will not cause a significant increase in LHR. For Unit(s) with CRDCS digital upgrade not complete, the option of inserting the group to the position of the misaligned rod is not available if a safety rod is I

misaligned, since the limits of LCO 3.1.5, "Safety Rod Position Limits,"

would be violated.

A.2.1 .1 Compliance with Required Actions of Condition A allows for continued power operation with one CONTROL ROD declared inoperable due to inoperable position indication but trippable, or misaligned from its group average position. These Required Actions comprise the final alternate for Condition A.

OCONEE UNITS 1, 2, & 3 B 3.1.4-4 Amendment Nos. I

CONTROL ROD Group Alignment Limits B 3.1.4 BASES ACTIONS A.2.1.1 (continued)

If realignment of the CONTROL ROD to the group average or alignment of the group to the misaligned CONTROL ROD (for Unit(s) with CRDCS digital upgrade not complete) is not completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (Required Action A.1 not met), the rod shall be considered inoperable. Since the rod may be inserted farther than the group average position for a long time, SDM must be evaluated. Ensuring the SDM meets the minimum requirement specified in the COLR within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter is adequate to determine that SDM requirements are met.

A.2.1 .2 Restoration of the required SDM requires increasing the RCS boron concentration, since the CONTROL ROD may remain misaligned and not be providing its normal negative reactivity on tripping. RCS boration must occur as described in Bases Section 3.1.1. The required Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to initiate boration is reasonable, based on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to complete the action. This allows the operator sufficient time for aligning the required valves and starting the boric acid pumps. Boration will continue until the required SDM is restored.

A.2.2 Reduction of THERMAL POWER to < 60% ALLOWABLE THERMAL POWER ensures that local LHR increases, due to a misaligned rod, will not cause the core design criteria to be exceeded. The required Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months allows the operator sufficient time for reducing THERMAL POWER.

A.2.3 Reduction of the nuclear overpower trip setpoints, based on flux and f lux/flow imbalance, to

65.5% ALLOWABLE THERMAL POWER, after THERMAL POWER has been reduced to 60% ALLOWABLE THERMAL POWER, maintains both core protection and an operating margin at reduced power similar to that at RTP. The required Completion Time of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months allows the operator 8 additional hours after completion of the THERMAL POWER reduction in Required Action A.2.2.1 to adjust the trip setpoints.

OCONEE UNITS 1, 2, & 3 B 3.1.4-5 Amendment Nos. I

CONTROL ROD Group Alignment Limits B 3.1.4 BASES ACTIONS A.2.4 (continued)

The existing CONTROL ROD configuration must not cause an ejected rod to exceed the limit of 0.18% Ak/k at RTP, 0.36% Ak/k at 80% RTP, or 0.7% Ak/k at zero power. This evaluation may require a computer calculation of the maximum ejected rod worth based on nonstandard configurations of the CONTROL ROD groups. The evaluation must determine the ejected rod worth for the duration of time that operation is expected to continue with a misaligned rod. Should fuel cycle conditions at some later time become more bounding than those at the time of the rod misalignment, additional evaluation will be required to verify the continued acceptability of operation. The required Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is acceptable because LHRs are limited by the THERMAL POWER reduction and sufficient time is provided to perform the required evaluation.

B.1 If the Required Actions and associated Completion Times for Condition A are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, for reaching MODE 3 from RTP in an orderly manner and without challenging unit systems.

C.1.1 More than one trippable CONTROL ROD becoming inoperable or misaligned, or both inoperable but trippable and misaligned from their group average position, is not expected and may violate the minimum SDM requirement. Therefore, SDM must be evaluated. Ensuring the SDM meets the minimum requirement within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allows the operator adequate time to determine the SDM.

C.1.2 If the SDM is less than the limit, then the restoration of the required SDM requires increasing the RCS boron concentration to provide negative reactivity. RCS boration must occur as described in Bases Section 3.1.1.

The required Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for initiating boration is reasonable, based on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to OCONEE UNITS 1, 2, & 3 B 3.1.4-6 Amendment Nos. I

CONTROL ROD Group Alignment Limits B 3.1.4 BASES ACTIONS C.1.2 (continued) complete the action. This allows the operator sufficient time for aligning the required valves and starting the boric acid pumps. Boration will continue until the required SDM is restored. If more than one trippable CONTROL ROD is inoperable or misaligned from their group average position, continued operation of the reactor may cause the misalignment to increase, as the regulating rods insert or withdraw to control reactivity. If the CONTROL ROD misalignment increases, local power peaking may also increase, and local LHRs will also increase if the reactor continues operation at THERMAL POWER. The SDM is decreased when one or more CONTROL RODS become inoperable at a given THERMAL POWER level, or if one or more CONTROL RODS become misaligned by insertion from the group average position.

Therefore, it is prudent to place the reactor in MODE 3. LCO 3.1.4 does not apply in MODE 3 since excessive power peaking cannot occur. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, for reaching MODE 3 from RTP in an orderly manner and without challenging unit systems.

D.1.1 and D.1.2 When one or more rods are untrippable, the SDM may be adversely affected. Under these conditions, it is important to determine the SDM and, if it is less than the required value, initiate boration until the required SDM is recovered. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is adequate for determining SDM and, if necessary, for initiating emergency boration to restore SDM.

In this situation, SDM verification must include the worth of the untrippable rod as well as a rod of maximum worth.

D.2 If the untrippable rod(s) cannot be restored to OPERABLE status, the unit must be brought to a MODE or condition in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

OCONEE UNITS 1, 2 & 3 B 3.1 .4-7 Amendment Nos. I

CONTROL ROD Group Alignment Limits B 3.1.4 BASES ACTIONS D.2 (continued)

The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.1.4.1 REQUIREMENTS Verification that individual CONTROL RODS are aligned within 6.5% of their group average height limits at a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency allows the operator to detect a rod that is beginning to deviate from its expected position. The specified Frequency takes into account other CONTROL ROD position information that is continuously available to the operator in the control room, so that during actual CONTROL ROD motion, deviations can immediately be detected.

SR 3.1.4.2 Verifying each CONTROL ROD is OPERABLE would require that each rod be tripped. However, in MODES 1 and 2, tripping each CONTROL ROD could result in radial tilts. Exercising each individual CONTROL ROD every 92 days provides increased confidence that all rods continue to be OPERABLE without exceeding the alignment limit, even if they are not regularly tripped. Moving each CONTROL ROD by an amount in any direction sufficient to demonstrate the absence of mechanical binding will not cause radial or axial power tilts, or oscillations, to occur. The 92 day Frequency takes into consideration other information available to the operator in the control room and SR 3.1.4.1, which is performed more frequently and adds to the determination of OPERABILITY of the rods.

Between required performances of SR 3.1.4.2 (determination of CONTROL ROD OPERABILITY by movement), if a CONTROL ROD(S) is discovered to be immovable, but is determined to be trippable and aligned, the CONTROL ROD(S) is considered to be OPERABLE. At any time, if a CONTROL ROD(S) is immovable, a determination of the trippability (OPERABILITY) of the CONTROL ROD(S) must be made, and appropriate action taken.

SR 3.1.4.3 Verification of CONTROL ROD drop time allows the operator to determine that the maximum CONTROL ROD drop time permitted is consistent with the assumed CONTROL ROD drop time used in the safety analysis. The OCONEE UNITS 1, 2, & 3 B 3.1.4-8 Amendment Nos. I

CONTROL ROD Group Alignment Limits B 3.1.4 BASES SURVEILLANCE SR 3.1.4.3 (continued)

REQUIREMENTS (continued) rod drop time given in the safety analysis is 1.66 seconds at reactor coolant full flow conditions and < 1.40 seconds at no flow conditions to 3/4 insertion (Ref. 5). The zone reference lights (for Unit(s) with CRDCS digital upgrade not complete) or switch (for Unit(s) with CRDCS digital upgrade complete) will activate at % insertion to give an indication of the CONTROL ROD drop I

time and CONTROL ROD location. Measuring CONTROL ROD drop times, prior to reactor criticality after reactor vessel head removal, ensures that the reactor internals and CRDM will not interfere with CONTROL ROD motion or CONTROL ROD drop time. This Surveillance is performed during a unit outage, due to the unit conditions needed to perform the SR and the potential for an unplanned unit transient if the Surveillance were performed with the reactor at power.

This testing is normally performed with all reactor coolant pumps operating to simulate a reactor trip under actual conditions.

REFERENCES 1. UFSAR, Section 3.1.

2. 10 CFR 50.46.

3. UFSAR, Chapter 15.

4. 10 CFR 50.36.

5. UFSAR, Section 15.7.3.

OCONEE UNITS 1 2 3 B 3.1.4-9 Amendment Nos. I

APSR Alignment Limits B 3.1.6 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 AXIAL POWER SHAPING ROD (APSR) Alignment Limits BASES BACKGROUND The OPERABILITY of the APSRs and APSR alignment are initial condition assumptions in the safety analysis that directly affect core power distributions. The applicable criteria for these power distribution design requirements are ONS Design Criteria (Ref. 1), and 10 CFR 50.46, NAcceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors" (Ref. 2).

Mechanical or electrical failures may cause an APSR to become inoperable or to become misaligned from its group. APSR inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution. Therefore, APSR alignment and OPERABILITY are related to core operation within design power peaking limits.

Limits on APSR alignment and OPERABILITY have been established, and all APSR positions are monitored and controlled during power operation to ensure that the power distribution limits defined by the design peaking limits are preserved.

APSRs are moved by their control rod drive mechanisms (CRDMs). Each CRDM moves its rod 3/4 inch for one revolution of the roller nut assembly, I but at different rates og and run) depending on the signal output from the Rod Control Drive System.

The APSRs are arranged into a group that is radially symmetric.

Therefore, movement of the APSRs does not introduce radial asymmetries in the core power distribution. The APSRs, which are used to assist in control of the axial power distribution, are positioned manually and do not trip.

APPLICABLE There are no explicit safety analyses associated with mis-aligned APSRs.

SAFETY ANALYSES However, alignment of the APSRs is required to prevent inducing a QUADRANT POWER TILT. The LCOs governing APSR misalignment are provided because the power distribution analysis supporting LCO 3.2.1, LCO 3.2.2, and LCO 3.2.3 assumes the rods are aligned.

During movement of an APSR group, one rod may stop moving while the other rods in the group continue. This condition may cause excessive OCONEE UNITS 1 2 3 B 3.1.6-1 Amendment Nos. I

APSR Alignment Limits B 3.1.6 BASES APPLICABLE power peaking. The reload safety evaluations define APSR alignment SAFETY ANALYSES limits that allow APSRs to be positioned anywhere within the operating I (continued) band and the increase in local LHR is within the design limits. The Required Actions provide a conservative approach to ensure that continued operation remains within the bounds of the safety analysis. No safety analyses take credit for movement of the APSRs.

The APSR alignment limits satisfy Criterion 2 of 10 CFR 50.36 (Ref. 3).

LCO The limits on CONTROL ROD group alignment, safety rod position, and APSR alignment, together with the limits on regulating rod position, AXIAL POWER IMBALANCE, and QPT, ensure the reactor will operate within the fuel design criteria. The Required Action in this LCO ensures deviations from the alignment limits will be adjusted so that excessive local LHRs will not occur.

The limit for individual APSR misalignment is 6.5% (9 inches) deviation from the group average position. This value is established based on the distance between reed switches, with additional allowances for uncertainty in the equipment used to determine this value.

Failure to meet the requirements of this LCO may produce unacceptable power peaking factors, and LHRs, which may constitute initial conditions inconsistent with the safety analysis.

APPLICABILITY The requirements on APSR OPERABILITY and alignment are applicable in MODES 1 and 2, when the APSRs are not fully withdrawn because these are the only MODES in which significant neutron (or fission) power is generated, and the OPERABILITY and alignment of APSRs have the potential to affect the safety of the unit. OPERABILITY and alignment of the APSRs are not required when they are fully withdrawn because they do not influence core power peaking. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the reactor is shut down and excessive local LHRs cannot occur from APSR misalignment.

ACTIONS A.1 The ACTIONS described below are required if one APSR is declared inoperable due to inoperable position indication or is misaligned. The unit is not allowed to operate with more than one inoperable or misaligned APSR. This would require the reactor to be placed in MODE 3, in accordance with LCO 3.0.3.

OCONEE UNITS 1, 2, & 3 B 3.1.6-2 Amendment Nos. I

APSR Alignment Limits B 3.1.6 BASES ACTIONS A.1 (continued)

For Unit(s) with the CRDCS digital upgrade not complete, an alternative to realigning a single inoperable or misaligned APSR to the group average position is to align the remainder of the APSR group to the position of the inoperable or misaligned APSR. This restores the alignment requirements.

Deviations up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months will not cause significant xenon redistribution to occur.

The reactor may continue in operation with the APSR inoperable or misaligned if the limits on AXIAL POWER IMBALANCE are surveilled within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to determine if the AXIAL POWER IMBALANCE is still within limits. Also, since any additional movement of the APSRs may result in additional imbalance, Required Action A.1 also requires the AXIAL POWER IMBALANCE surveillance to be performed again within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after each APSR movement. The required Completion Time of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months will not cause significant xenon redistribution to occur.

B.1 The unit must be brought to a MODE in which the LCO does not apply if the Required Actions and associated Completion Times cannot be met. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, for reaching MODE 3 from RTP in an orderly manner and without challenging unit systems. In MODE 3, APSR alignment limits are not required because the reactor is not generating significant THERMAL POWER and excessive local LHRs cannot occur from APSR misalignment.

SURVEILLANCE SR 3.1.6.1 REQUIREMENTS Verification at a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency that individual APSR positions are within 6.5% of the group average height limits allows the operator to detect an APSR beginning to deviate from its expected position. In addition, APSR position is continuously available to the operator in the control room so that during actual APSR motion, deviations can immediately be detected.

OCONEE UNITS 1,2, &3 B 3.1.6-3 Amendment Nos. I

APSR Alignment Limits B 3.1.6 BASES (continued)

REFERENCES 1. UFSAR, Section 3.1.

2. 10 CFR 50.46.

3. 10 CFR 50.36.

OCONEE UNITS 1, 2, & 3 B 3.1.6-4 Amendment Nos. I

Position Indicator Channels B 3.1.7 BASES BACKGROUND Switch contacts close when a permanent magnet mounted on the (continued) upper end of each CONTROL ROD and APSR assembly (CRA) leadscrew extension comes near. As the leadscrew and CONTROL ROD or APSR move, the switches operate sequentially, producing an analog voltage proportional to position. Other reed switches included in the same tube with the absolute position indicator matrix provide full in and full out limit indications, and absolute position indications at 0%, 25%,

50%, 75%, and 100% travel. This series of seven indicators are called zone reference indicators. For Unit(s) with CRDCS digital upgrade not complete, the relative position indicator transducer is a potentiometer, driven by a pulse stepping motor that produces a signal proportional to CONTROL ROD or APSR position, based on the electrical pulse steps that drive the CRDM. For Unit(s) with CRDCS digital upgrade complete, the relative position indication is processed by a Programmable Logic Controller (PLC) that produces a signal proportional to CONTROL ROD or APSR position, based on the electrical pulse steps that drive the CRDM.

The type R4C absolute position indicator design is used. The type R4C (redundant four channel) absolute position indicator transducer has two parallel sets of voltage divider circuits made up of 36 resistors each, connected in series (channels A and B). One end of 36 reed switches is connected at a junction between each of the resistors of the two parallel circuits. The reed switches making up each circuit are offset, such that the switches for channel.A are staggered with the switches for channel B. The type R4C is designed such that either two or three reed switches are closed in the vicinity of the magnet. By its design, the type R4C absolute position indicator provides redundancy, with the two - three sequence of pickup and drop out of reed switches to enable a continuity of position signal when a single reed switch fails to close.

CONTROL ROD and APSR position indicating readout devices located in the control room consist of single rod position meters on a position indication panel. A selector switch permits either relative or absolute position indication to be displayed. Indicator lights are provided on the position indication panel to indicate when each CONTROL ROD or APSR is fully withdrawn, fully inserted, or enabled, and whether a rod position asymmetry alarm condition is present. Alternate indicators show full insertion, full withdrawal, and under control for each CONTROL ROD and APSR group.

OCONEE UNITS 1, 2, & 3 B 3.1.7-2 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES BACKGROUND RPS Overview (continued)

The RPS consists of four separate redundant protective channels that receive inputs of neutron flux, RCS pressure, RCS flow, RCS temperature, RCS pump status, reactor building (RB) pressure, main feedwater (MFW) pump status, and turbine status.

Figure 7.1, UFSAR, Chapter 7 (Ref. 1), shows the arrangement of a typical RPS protective channel. A protective channel is composed of measurement channels, a manual trip channel, a reactor trip module (RTM), and control rod drive (CRD) trip devices. LCO 3.3.1 provides requirements for the individual measurement channels. These channels encompass all equipment and electronics from the point at which the measured parameter is sensed through the bistable relay contacts in the trip string. LCO 3.3.2, "Reactor Protective System (RPS) Manual Reactor Trip," LCO 3.3.3, "Reactor Protective System (RPS) - Reactor Trip Module (RTM)," and LCO 3.3.4, "control rod Drive (CRD) Trip Devices," discuss the remaining RPS elements.

The RPS instrumentation measures critical unit parameters and compares these to predetermined setpoints. If the setpoint is exceeded, a channel trip signal is generated. The generation of any two trip signals in any of the four RPS channels will result in the trip of the reactor.

For Unit(s) with the Control Rod Drive Control System (CRDCS) digital upgrade not complete, the Reactor Trip System (RTS) contains multiple CRD trip devices; two AC trip breakers, two DC trip breaker pairs, and eight electronic trip assembly (ETA) relays. The system has two separate paths (or channels), with each path having one AC breaker in series with a pair of DC breakers and functionally in series with four ETA relays in parallel.

Each path provides independent power to the CRDs. Either path can provide sufficient power to operate all CRDs. Two separate power paths to the CRDs ensure that a single failure that opens one path will not cause an unwanted reactor trip.

For Unit(s) with the CRDCS digital upgrade complete, the RTS consists of four AC Trip Breakers arranged in two parallel combinations of two breakers each. Each path provides independent power to the CRD motors. Either path can provide sufficient power to operate all CRD's.

Two separate power paths to the CRD's ensure that a single failure that opens one path will not cause an unwanted reactor trip.

OCONEE UNITS 1, 2, & 3 B 3.3.1-2 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES BACKGROUND RPS Overview (continued)

The RPS consists of four independent protective channels, each containing an RTM. The RTM receives signals from its own measurement channels that indicate a protective channel trip is required. The RTM transmits this signal to its own two-out-of-four trip logic and to the two-out-of-four logic of the RTMs in the other three RPS channels. Whenever any two RPS channels transmit channel trip signals, the RTM logic in each channel actuates to remove 120 VAC power from its associated CRD trip device.

For Unit(s) with the CRDCS digital upgrade not complete, the reactor is tripped by opening circuit breakers and energizing ETA relays that interrupt the control power supply to the CRDs. Six breakers are installed to increase reliability and allow testing of the trip system. A one-out-of-two taken twice logic is used to interrupt power to the rods.

For Units(s) with the CRDCS digital upgrade complete, the reactor is tripped by opening the reactor trip breakers.

The RPS has three bypasses: a shutdown bypass, a dummy bistable and an RPS channel bypass. Shutdown bypass allows the withdrawal of safety rods for SDM availability and rapid negative reactivity insertion during unit cooldowns or heatups. The dummy bistable is used to bypass one or more functions (bistable trips) associated with one RPS Channel. The RPS Channel bypass allows one entire RPS channel to be taken out of service for maintenance and testing. Test circuits in the trip strings allow complete testing of all RPS trip functions.

The RPS operates from the instrumentation channels discussed next. The specific relationship between measurement channels and protective channels differs from parameter to parameter. Three basic configurations are used:

a. Four completely redundant measurements (e.g., reactor coolant flow) with one channel input to each protective channel;

b. Four channels that provide similar, but not identical, measurements (e.g., power range nuclear instrumentation where each RPS channel monitors a different quadrant), with one channel input to each protective channel; and

c. Redundant measurements with combinational trip logic outside of the protective channels and the combined output provided to each protective channel (e.g., main feedwater pump trip instrumentation).

OCONEE UNITS 1 2 3 B 3.3.1-3 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES BACKGROUND RPS Overview (continued)

These arrangements and the relationship of instrumentation channels to trip Functions are discussed next to assist in understanding the overall effect of instrumentation channel failure.

Power Range Nuclear Instrumentation Power Range Nuclear Instrumentation channels provide inputs to the following trip Functions:

1. Nuclear Overpower

a. Nuclear Overpower - High Setpoint;

b. Nuclear Overpower - Low Setpoint;

7. Reactor Coolant Pump to Power;

8. Nuclear Overpower Flux/Flow Imbalance;

9. Main Turbine Trip (Hydraulic Fluid Pressure); and

10. Loss of Main Feedwater (LOMFW) Pumps (Hydraulic Oil Pressure).

The power range instrumentation has four linear level channels, one for each core quadrant. Each channel feeds one RPS protective channel.

Each channel originates in a detector assembly containing two uncompensated ion chambers. The ion chambers are positioned to represent the top half and bottom half of the core. The individual currents from the chambers are fed to individual linear amplifiers. The summation of the top and bottom is the total reactor power. The difference of the top minus the bottom neutron signal is the measured AXIAL POWER IMBALANCE for the associated core quadrant.

OCONEE UNITS 1, 2, & 3 B 3.3.1-4 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES BACKGROUND Reactor Coolant System Outlet Temperature (continued)

The Reactor Coolant System Outlet Temperature provides input to the following Functions:

2. RCS High Outlet Temperature; and

5. RCS Variable Low Pressure.

The RCS Outlet Temperature is measured by two resistance elements in each hot leg, for a total of four. One temperature detector is associated with each protective channel.

Reactor Coolant System Pressure The Reactor Coolant System Pressure provides input to the following Functions:

3. RCS High Pressure;

4. RCS Low Pressure;

5. RCS Variable Low Pressure; and

11. Shutdown Bypass RCS High Pressure.

The RPS inputs of reactor coolant pressure are provided by two pressure transmitters in each hot leg, for a total of four. One sensor is associated with each protective channel.

Reactor Building Pressure The Reactor Building Pressure measurements provide input only to the Reactor Building High Pressure trip, Function 6. There are four RB High Pressure sensors, one associated with each protective channel.

OCONEE UNITS 1, 2, & 3 B 3.3.1-5 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES BACKGROUND Reactor Coolant Pump Power Monitoring (continued)

Reactor coolant pump power monitors are inputs to the Reactor Coolant Pump to Power trip, Function 7. Each RCP, operating current, and voltage is measured by four current transformers and four potential transformers driving four underpower relays. Each power monitoring channel consists of an underpower relay. One channel for each pump is associated with each protective channel.

Reactor Coolant System Flow The Reactor Coolant System Flow measurements are an input to the Nuclear Overpower Flux/Flow Imbalance trip, Function 8. The reactor coolant flow inputs to the RPS are provided by eight high accuracy differential pressure transmitters, four on each loop, which measure flow through calibrated flow tubes. One flow input in each loop is associated with each protective channel.

Main Turbine Automatic Stop Oil Pressure Main Turbine Automatic Stop Oil Pressure is an input to the Main Turbine Trip (Hydraulic Fluid Pressure) reactor trip, Function 9. Each of the four protective channels receives turbine status information from one of the four pressure switches monitoring main turbine automatic stop oil pressure. An open indication will be provided to the RPS on a turbine trip. Contact buffers in each protective channel continuously monitor the status of the contact inputs and initiate an RPS trip when a main turbine trip is indicated.

Feedwater Pump Hydraulic Oil Pressure Feedwater Pump Hydraulic Oil Pressure is an input to the Loss of Main Feedwater Pumps (Hydraulic Oil Pressure) trip, Function 10. Hydraulic Oil pressure is measured by four switches on each feedwater pump. One switch on each pump, connected in series with a switch on the other MFW pump, is associated with each protective channel.

OCONEE UNITS 1,2, &3 B 3.3.1-6 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES BACKGROUND RPS Bypasses (continued)

The RPS is designed with three types of bypasses: dummy bistable, channel bypass and shutdown bypass.

The dummy bistable provides a method of placing one or more functions in a RPS protective channel in a bypassed condition, the channel bypass provides a method of placing all Functions in one RPS protective channel in a bypassed condition, and shutdown bypass provides a method of leaving the safety rods withdrawn during cooldown and depressurization of the RCS. Each bypass is discussed next.

Dummy Bistable The dummy bistable is used to bypass one or more functions (bistable trips) associated with one RPS Channel. A dummy bistable is used if a parameter in an RPS channel fails and causes that channel to trip. Dummy bistables may be used in only one RPS channel at a time. Also, if an RPS channel is bypassed, no other RPS channel may contain a dummy bistable. Inserting a dummy bistable in the place of a failed (tripped) bistable allows the RPS channels to be reset, thus allowing the remainder of the functions in that RPS channel to be returned to service. This is more conservative than manually bypassing the entire RPS channel. For an RPS channel with a dummy bistable installed, only the affected function(s) is inoperable. The installation of the STAR hardware in the nuclear overpower flux/flow imbalance trip string requires the use of jumpers to bypass the trip string. The installation of these jumpers does not require the removal of the STAR processor module, therefore, the protective channel is not forced into a tripped condition.

Channel Bypass A channel bypass provision is provided to allow for maintenance and testing of the RPS. The use of channel bypass keeps the protective channel trip relay energized regardless of the status of the instrumentation channel of the bistable relay contacts. To place a protective channel in channel bypass, the other three channels must not be in channel bypass or otherwise inoperable (e.g., a dummy bistable installed). This can be verified by observing alarms/indicator lights. This is administratively controlled by having only one manual bypass key available for each unit.

All RPS trips are reduced to a two-out-of-three logic in channel bypass.

OCONEE UNITS 1 2 3 B 3.3.1-7 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES BACKGROUND Shutdown Bypass (continued)

During unit cooldown and heatup, it is desirable to leave the safety rods at least partially withdrawn to provide shutdown capabilities in the event of unusual positive reactivity additions (moderator dilution, etc.).

However, the unit is also depressurized as coolant temperature is decreased. If the safety rods are withdrawn and coolant pressure is decreased, an RCS Low Pressure trip will occur at 1800 psig and the rods will fall into the core. To avoid this, the protective system allows the operator to bypass the low pressure trip and maintain shutdown capabilities. During the cooldown and depressurization, the safety rods are inserted prior to the low pressure trip of 1800 psig. The RCS pressure is decreased to less than 1720 psig, then each RPS channel is placed in shutdown bypass.

In shutdown bypass, a normally closed contact opens when the operator closes the shutdown bypass key switch (status shall be indicated by a light). This action bypasses the RCS Low Pressure trip, Nuclear Overpower Flux/Flow Imbalance trip, Reactor Coolant Pump to Power trip, and the RCS Variable Low Pressure trip, and inserts a new RCS High Pressure, 1720 psig trip. The operator can now withdraw the safety rods for additional rapidly insertable negative reactivity.

The insertion of the new high pressure trip performs two functions. First, with a trip setpoint of 1720 psig, the bistable prevents operation at normal system pressure, 2155 psig, with a portion of the RPS bypassed. The second function is to ensure that the bypass is removed prior to normal operation. When the RCS pressure is increased during a unit heatup, the safety rods are inserted prior to reaching 1720 psig. The shutdown bypass is removed, which returns the RPS to normal, and system pressure is increased to greater than 1800 psig. The safety rods are then withdrawn and remain at the full out condition for the rest of the heatup.

In addition to the Shutdown Bypass RCS High Pressure trip, the high flux trip setpoint is administratively reduced to < 5% RTP prior to placing the RPS in shutdown bypass. This provides a backup to the Shutdown Bypass RCS High Pressure trip and allows low power physics testing while preventing the generation of any significant amount of power.

OCONEE UNITS 1, 2, & 3 B 3.3.1 -8 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES BACKGROUND Module Interlock and Test Trip Relay (continued)

Each channel and each trip module is capable of being individually tested.

When a module is placed into the test mode, it causes the test trip relay to open and to indicate an RPS channel trip. Under normal conditions, the channel to be tested is placed in bypass before a module is tested. Each trip module is electrically interlocked to the other three trip modules.

Removal of a trip module will indicate a tripped channel in the remaining trip modules.

Trip Setpoints/Allowable Value The Allowable Value and trip setpoint are based on the analytical limits stated in UFSAR, Chapter 15 (Ref. 2). The selection of the Allowable Value and associated trip setpoint is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those RPS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 3), the Allowable Values specified in Table 3.3.1-1 in the accompanying LCO are conservative with respect to the analytical limits to account for all known uncertainties for each channel. The actual trip setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a CHANNEL FUNCTIONAL TEST. One example of such a change in measurement error is drift during the Surveillance Frequency. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes. The trip setpoints are the nominal values at which the bistables are set. Any bistable is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CALIBRATION accuracy. A detailed description of the methodology used to determine the Allowable Value, trip setpoints, and associated uncertainties is provided in Reference 4.

Setpoints in accordance with the Allowable Value ensure that the limits of Chapter 2.0, "Safety Limits," in the Technical Specifications are not violated during anticipated transients and that the consequences of accidents will be acceptable, providing the unit is operated from within the LCOs at the onset of the anticipated transient or accident and the equipment functions as designed. Note that in LCO 3.3.1 the Allowable Values listed in Table 3.3.1-1 for Functions 1 through 8 and 11 are the LSSS.

OCONEE UNITS 1, 2, & 3 B 3.3.1-9 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES BACKGROUND Trio Setpoints/Allowable Value (continued)

Each channel can be tested online to verify that the setpoint accuracy is within the specified allowance requirements. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. Surveillances for the channels are specified in the SR section.

APPLICABLE Each of the analyzed accidents and transients that require a reactor trip to SAFETY ANALYSES, meet the acceptance criteria can be detected by one or more RPS LCO, and Functions. The accident analysis contained in the UFSAR, Chapter 15 APPLICABILITY (Ref. 2), takes credit for most RPS trip Functions. Functions not specifically credited in the accident analysis were qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit.

These Functions are high RB pressure, high RCS temperature, turbine trip, and loss of main feedwater. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. These Functions also serve as backups to Functions that were credited in the safety analysis.

The LCO requires all instrumentation performing an RPS Function to be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. The three channels of each Function in Table 3.3.1 - 1 of the RPS instrumentation shall be OPERABLE during its specified Applicability to ensure that a reactor trip will be actuated if needed. Additionally, during shutdown bypass with any CRD trip breaker closed, the applicable RPS Functions must also be available. This ensures the capability to trip the withdrawn CONTROL RODS exists at all times that rod motion is possible. The trip Function channels specified in Table 3.3.1 -1 are considered OPERABLE when all channel components necessary to provide a reactor trip are functional and in service for the required MODE or Other Specified Condition listed in Table 3.3.1-1.

Only the Allowable Values are specified for each RPS trip Function in the LCO. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoint measured by CHANNEL FUNCTIONAL TESTS does not exceed the Allowable Value if the bistable is performing as required. A trip setpoint found less conservative than the nominal trip setpoint, but within its Allowable Value, is considered OPERABLE with respect to the uncertainty allowances assumed for the applicable surveillance interval provided that operation, testing and subsequent calibration are consistent with the assumptions of the setpoint calculations. Each Allowable Value specified is more OCONEE UNITS 1 2 3 B 3.3.1 -10 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES APPLICABLE conservative than instrument uncertainties appropriate to the trip Function.

SAFETY ANALYSES, These uncertainties are defined in Reference 4.

LCO, and APPLICABILITY For most RPS Functions, the Allowable Value in conjunction with the (continued) nominal trip setpoint ensure that the departure from nucleate boiling (DNB),

center line fuel melt, or RCS pressure SLs are not challenged. Cycle specific values for use during operation are contained in the COLR.

Certain RPS trips function to indirectly protect the SLs by detecting specific conditions that do not immediately challenge SLs but will eventually lead to challenge if no action is taken. These trips function to minimize the unit transients caused by the specific conditions. The Allowable Value for these Functions is selected at the minimum deviation from normal values that will indicate the condition, without risking spurious trips due to normal fluctuations in the measured parameter.

The Allowable Values for bypass removal Functions are stated in the Applicable MODE or Other Specified Condition column of Table 3.3.1 -1.

The safety analyses applicable to each RPS Function are discussed next.

1. Nuclear Overpower

a. Nuclear Overpower - HiQh Setpoint The Nuclear Overpower - High Setpoint trip provides protection for the design thermal overpower condition based on the measured out of core neutron leakage flux.

The Nuclear Overpower - High Setpoint trip initiates a reactor trip when the neutron power reaches a predefined setpoint at the design overpower limit. Because THERMAL POWER lags the neutron power, tripping when the neutron power reaches the design overpower will limit THERMAL POWER to prevent exceeding acceptable fuel damage limits.

Thus, the Nuclear Overpower - High Setpoint trip protects against violation of the DNBR and fuel centerline melt SLs.

However, the RCS Variable Low Pressure, and Nuclear Overpower Flux/Flow Imbalance, provide more direct protection. The role of the Nuclear Overpower - High Setpoint trip is to limit reactor THERMAL POWER below the highest power at which the other two trips are known to provide protection.

OCONEE UNITS 1, 2, & 3 B 3.3.1 -1 1 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES APPLICABLE The Nuclear Overpower - High Setpoint trip also provides SAFETY ANALYSES, transient protection for rapid positive reactivity excursions LCO, and during power operations. These events include the rod APPLICABILITY withdrawal accident and the rod ejection accident. By (continued) providing a trip during these events, the Nuclear Overpower -

High Setpoint trip protects the unit from excessive power levels and also serves to limit reactor power to prevent violation of the RCS pressure SL.

Rod withdrawal accident analyses cover a large spectrum of reactivity insertion rates (rod worths), which exhibit slow and rapid rates of power increases. At high reactivity insertion rates, the Nuclear Overpower - High Setpoint trip provides the primary protection. At low reactivity insertion rates, the high pressure trip provides primary protection.

b. Nuclear Overpower - Low Setpoint Prior to initiating shutdown bypass, the Nuclear Overpower - Low Setpoint trip must be reduced to < 5% RTP.

The low power setpoint, in conjunction with the lower Shutdown Bypass RCS High Pressure setpoint, ensure that the unit is protected from excessive power conditions when other RPS trips are bypassed.

The setpoint Allowable Value was chosen to be as low as practical and still lie within the range of the out of core instrumentation.

2. RCS High Outlet Temperature The RCS High Outlet Temperature trip, in conjunction with the RCS Low Pressure and RCS Variable Low Pressure trips, provides protection for the DNBR SL. A trip is initiated whenever the reactor vessel outlet temperature approaches the conditions necessary for DNB. Portions of each RCS High Outlet Temperature trip channel are common with the RCS Variable Low Pressure trip. The RCS High Outlet Temperature trip provides steady state protection for the DNBR SL.

The RCS High Outlet Temperature trip limits the maximum RCS temperature to below the highest value for which DNB protection by the Variable Low Pressure trip is ensured. The trip setpoint OCONEE UNITS 1, 2, & 3 B 3.3.1 -12 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES APPLICABLE 2. RCS High Outlet Temperature (continued)

SAFETY ANALYSES, LCO, and Allowable Value is selected to ensure that a trip occurs before hot leg APPLICABILITY temperatures reach the point beyond which the RCS Low Pressure and Variable Low Pressure trips are analyzed. Above the high temperature trip, the variable low pressure trip need not provide protection, because the unit would have tripped already. The setpoint Allowable Value does not reflect errors induced by harsh environmental conditions that the equipment is expected to experience because the trip is not required to mitigate accidents that create harsh conditions in the RB.

3. RCS High Pressure The RCS High Pressure trip works in conjunction with the pressurizer and main steam relief valves to prevent RCS overpressurization, thereby protecting the RCS High Pressure SL The RCS High Pressure trip has been credited in the transient analysis calculations for slow positive reactivity insertion transients (rod withdrawal transients and moderator dilution). The rod withdrawal transient covers a large spectrum of reactivity insertion rates and rod worths that exhibit slow and rapid rates of power increases. At high reactivity insertion rates, the Nuclear Overpower

- High Setpoint trip provides the primary protection. At low reactivity insertion rates, the RCS High Pressure trip provides the primary protection.

The setpoint Allowable Value is selected to ensure that the RCS High Pressure SL is not challenged during steady state operation or slow power increasing transients. The setpoint Allowable Value does not reflect errors induced by harsh environmental conditions because the equipment is not required to mitigate accidents that create harsh conditions in the RB.

4. RCS Low Pressure The RCS Low Pressure trip, in conjunction with the RCS High Outlet Temperature and Variable Low Pressure trips, provides protection for the DNBR SL. A trip is initiated whenever the system pressure approaches the conditions necessary for DNB. The RCS Low Pressure trip provides DNB low pressure limit for the RCS Variable Low Pressure trip.

OCONEE UNITS 1 2 3 B3.3.1-13 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES APPLICABLE 4. RCS Low Pressure (continued)

SAFETY ANALYSES, LCO, and The RCS Low Pressure setpoint Allowable Value is selected to APPLICABILITY ensure that a reactor trip occurs before RCS pressure is reduced (continued) below the lowest point at which the RCS Variable Low Pressure trip is analyzed. The RCS Low Pressure trip provides protection for primary system depressurization events and has been credited in the accident analysis calculations for small break loss of coolant accidents (LOCAs). Harsh RB conditions created by small break LOCAs cannot affect performance of the RCS pressure sensors and transmitters within the time frame for a reactor trip. Therefore, degraded environmental conditions are not considered in the Allowable Value determination.

5. RCS Variable Low Pressure The RCS Variable Low Pressure trip, in conjunction with the RCS High Outlet Temperature and RCS Low Pressure trips, provides protection for the DNBR SL. A trip is initiated whenever the system parameters of pressure and temperature approach the conditions necessary for DNB. The RCS Variable Low Pressure trip provides a floating low pressure trip based on the RCS High Outlet Temperature within the range specified by the RCS High Outlet Temperature and RCS Low Pressure trips.

The RCS Variable Low Pressure setpoint Allowable Value is selected to ensure that a trip occurs when temperature and pressure approach the conditions necessary for DNB while operating in a temperature pressure region constrained by the low pressure and high temperature trips. The RCS Variable Low Pressure trip is assumed for transient protection in the main steam line break analysis. The setpoint allowable value does not include errors induced by the harsh environment, because the trip actuates prior to the harsh environment.

6. Reactor Building High Pressure The Reactor Building High Pressure trip provides an early indication of a high energy line break (HELB) inside the RB. By detecting changes in the RB pressure, the RPS can provide a reactor trip before the other system parameters have varied significantly. Thus, this trip acts to minimize accident consequences. It also provides a backup for RPS trip instruments exposed to an RB HELB environment.

OCONEE UNITS 1, 2, & 3 B 3.3.1-14 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES APPLICABLE 6. Reactor Building High Pressure (continued)

SAFETY ANALYSES, LCO, and The Allowable Value for RB High Pressure trip is set at the lowest APPLICABILITY value consistent with avoiding spurious trips during normal operation.

(continued) The electronic components of the RB High Pressure trip are located in an area that is not exposed to high temperature steam environments during HELB transients inside containment. The components are exposed to high radiation conditions. Therefore, the determination of the setpoint Allowable Value accounts for errors induced by the high radiation.

7. Reactor Coolant Pump to Power The Reactor Coolant Pump to Power trip provides protection for changes in the reactor coolant flow due to the loss of multiple RCPs.

Because the flow reduction lags loss of power indications due to the inertia of the RCPs, the trip initiates protective action earlier than a trip based on a measured flow signal.

The Reactor Coolant Pump to Power trip has been credited in the accident analysis calculations for the loss of more than two RCPs.

The Allowable Value for the Reactor Coolant Pump to Power trip setpoint is selected to prevent normal power operation unless at least three RCPs are operating. RCP status is monitored by power transducers on each pump. These relays indicate a loss of an RCP on underpower. The underpower setpoint is selected to reliably trip on loss of voltage to the RCPs. Neither the reactor power nor the pump power setpoint account for instrumentation errors caused by harsh environments because the trip Function is not required to respond to events that could create harsh environments around the equipment.

8. Nuclear Overpower Flux/Flow Imbalance The Nuclear Overpower Flux/Flow Imbalance trip provides steady state protection for the power imbalance SLs. A reactor trip is initiated prior to the core power, AXIAL POWER IMBALANCE, and reactor coolant flow conditions exceeding the DNB or fuel centerline temperature limits.

OCONEE UNITS 1, 2, & 3 B 3.3.1-15 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES APPLICABLE 8. Nuclear Overpower Flux/Flow Imbalance (continued)

SAFETY ANALYSES, LCO, and This trip supplements the protection provided by the Reactor Coolant APPLICABILITY Pump to Power trip, through the power to flow ratio, for loss of reactor coolant flow events. The power to flow ratio provides direct protection for the DNBR SL for the loss of one or more RCPs and for locked RCP rotor accidents.

The power to flow ratio of the Nuclear Overpower Flux/Flow Imbalance trip also provides steady state protection to prevent reactor power from exceeding the allowable power when the primary system flow rate is less than full four pump flow. Thus, the power to flow ratio prevents overpower conditions similar to the Nuclear Overpower trip. This protection ensures that during reduced flow conditions the core power is maintained below that required to begin DNB.

The Allowable Value is selected to ensure that a trip occurs when the core power, axial power peaking, and reactor coolant flow conditions indicate an approach to DNB or fuel centerline temperature limits.

By measuring reactor coolant flow and by tripping only when conditions approach an SL, the unit can operate with the loss of one pump from a four pump initial condition at power levels at least as low as approximately 80% RTP. The Allowable Value for the Function is given in the unit COLR because the cycle specific core peaking changes affect the Allowable Value.

9. Main Turbine TriD (Hydraulic Fluid Pressure)

The Main Turbine Trip Function trips the reactor when the main turbine is lost at high power levels. The Main Turbine Trip Function provides an early reactor trip in anticipation of the loss of heat sink associated with a turbine trip. The Main Turbine Trip Function was added to the B&W designed units in accordance with NUREG-0737 (Ref. 5) following the Three Mile Island Unit 2 accident. The trip lowers the probability of an RCS power operated relief valve (PORV) actuation for turbine trip cases. This trip is activated at higher power levels, thereby limiting the range through which the Integrated Control System must provide an automatic runback on a turbine trip.

Each of the four turbine hydraulic fluid pressure switches feeds one protective channel through buffers that continuously monitor the status of the contacts.

OCONEE UNITS 1, 2, & 3 B 3.3.1-1 6 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES APPLICABLE 9. Main Turbine Trip (Hydraulic Fluid Pressure) (continued)

SAFETY ANALYSES, LCO, and For the Main Turbine Trip (Hydraulic Fluid Pressure) bistable, the APPLICABILITY Allowable Value of 800 psig is selected to provide a trip whenever (continued) main turbine hydraulic fluid pressure drops below the normal operating range. To ensure that the trip is enabled as required by the LCO, the reactor power bypass is set with an Allowable Value of 30% RTP. The turbine trip is not required to protect against events that can create a harsh environment in the turbine building.

Therefore, errors induced by harsh environments are not included in the determination of the setpoint Allowable Value.

10. Loss of Main Feedwater Pumps (Hydraulic Oil Pressure)

The Loss of Main Feedwater Pumps (Hydraulic Oil Pressure) trip provides a reactor trip at high power levels when both MFW pumps are lost. The trip provides an early reactor trip in anticipation of the loss of heat sink associated with the LOMF. This trip was added in accordance with NUREG-0737 (Ref. 5) following the Three Mile Island Unit 2 accident. This trip provides a reactor trip at high power levels for a LOMF to minimize challenges to the PORV.

For the feedwater pump hydraulic oil pressure bistables, the Allowable Value of 75 psig is selected to provide a trip whenever feedwater pump hydraulic oil pressure drops below the normal operating range. To ensure that the trip is enabled as required by the LCO, the reactor power bypass is set with an Allowable Value of 2% RTP. The Loss of Main Feedwater Pumps (Hydraulic Oil Pressure) trip is not required to protect against events that can create a harsh environment in the turbine building. Therefore, errors caused by harsh environments are not included in the determination of the setpoint Allowable Value.

11. Shutdown Bvpass RCS High Pressure The RPS Shutdown Bypass RCS High Pressure is provided to allow for withdrawing the CONTROL RODS prior to reaching the normal RCS Low Pressure trip setpoint. The shutdown bypass provides trip protection during deboration and RCS heatup by allowing the operator to at least partially withdraw the safety groups of CONTROL RODS. This makes their negative reactivity available to terminate inadvertent reactivity excursions. Use of the shutdown bypass trip OCONEE UNITS 1, 2, & 3 B 3.3.1-17 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES APPLICABLE 11. Shutdown Bypass RCS High Pressure (continued)

SAFETY ANALYSES, LCO, and requires that the neutron power trip setpoint be reduced to 5% of full APPLICABILITY power or less. The Shutdown Bypass RCS High Pressure trip forces a reactor trip to occur whenever the unit switches from power operation to shutdown bypass or vice versa. This ensures that the CONTROL RODS are all inserted before power operation can begin.

The operator is required to remove the shutdown bypass, reset the Nuclear Overpower - High Power trip setpoint, and again withdraw the safety group rods before proceeding with startup.

Accidents analyzed in the UFSAR, Chapter 15 (Ref. 2), do not describe events that occur during shutdown bypass operation, because the consequences of these events are enveloped by the events presented in the UFSAR.

During shutdown bypass operation with the Shutdown Bypass RCS High Pressure trip active with a setpoint of < 1720 psig and the Nuclear Overpower - Low Setpoint set at or below 5% RTP, the trips listed below can be bypassed. Under these conditions, the Shutdown Bypass RCS High Pressure trip and the Nuclear Overpower - Low Setpoint trip act to prevent unit conditions from reaching a point where actuation of these Functions is necessary.

1.a Nuclear Overpower - High Setpoint;

3. RCS High Pressure;

4. RCS Low Pressure;

5. RCS Variable Low Pressure;

7. Reactor Coolant Pump to Power; and

8. Nuclear Overpower Flux/Flow Imbalance.

The Shutdown Bypass RCS High Pressure Function's Allowable Value is selected to ensure a trip occurs before producing THERMAL POWER.

OCONEE UNITS 1, 2, & 3 B 3.3.1 -18 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES APPLICABLE General Discussion SAFETY ANALYSES, LCO, and The RPS satisfies Criterion 3 of 10 CFR 50.36 (Ref. 8). In MODES 1 APPLICABILITY and 2, the following trips shall be OPERABLE because the reactor can be (continued) critical in these MODES. These trips are designed to take the reactor subcritical to maintain the SLs during anticipated transients and to assist the ESPS in providing acceptable consequences during accidents.

1a. Nuclear Overpower - High Setpoint;

2. RCS High Outlet Temperature;

3. RCS High Pressure;

4. RCS Low Pressure;

5. RCS Variable Low Pressure;

6. Reactor Building High Pressure;

7. Reactor Coolant Pump to Power; and

8. Nuclear Overpower Flux/Flow Imbalance.

Functions 1, 3, 4, 5, 7, and 8 just listed may be bypassed in MODE 2 when RCS pressure is below 1720 psig, provided the Shutdown Bypass RCS High Pressure and the Nuclear Overpower - Low setpoint trip are placed in operation. Under these conditions, the Shutdown Bypass RCS High Pressure trip and the Nuclear Overpower - Low setpoint trip act to prevent unit conditions from reaching a point where actuation of these Functions is necessary.

The Main Turbine Trip (Hydraulic Fluid Pressure) Function is required to be OPERABLE in MODE 1 at 2 30% RTP. The Loss of Main Feedwater Pumps (Hydraulic Oil Pressure) Function is required to be OPERABLE in MODE 1 and in MODE 2 at Ž 2% RTP. Analyses presented in BAW-1 893 (Ref. 6) have shown that for operation below these power levels, these trips are not necessary to minimize challenges to the PORVs as required by NUREG-0737 (Ref. 5).

Because the safety function of the RPS is to trip the CONTROL RODS, the RPS is not required to be OPERABLE in MODE 3, 4, or 5 if either the reactor trip breakers are open, or the CRD System is incapable of rod withdrawal. Similarly, the RPS is not required to be OPERABLE in MODE 6 because the CONTROL RODS are normally decoupled from the CRDs.

OCONEE UNITS 1, 2, & 3 B 3.3.1-19 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES APPLICABLE General Discussion (continued)

SAFETY ANALYSES, LCO, and However, in MODE 2, 3, 4, or 5, the Shutdown Bypass RCS High Pressure APPLICABILITY and Nuclear Overpower - Low setpoint trips are required to be OPERABLE if the CRD trip breakers are closed and the CRD System is capable of rod withdrawal. Under these conditions, the Shutdown Bypass RCS High Pressure and Nuclear Overpower - Low setpoint trips are sufficient to prevent an approach to conditions that could challenge SLs.

ACTIONS Conditions A and B are applicable to all RPS protective Functions. If a channel's trip setpoint is found nonconservative with respect to the required Allowable Value in Table 3.3.1-1, or the transmitter, instrument loop, signal processing electronics or bistable is found inoperable, the channel must be declared inoperable and Condition A entered immediately.

When an RPS channel is manually tripped, the functions that were inoperable prior to tripping remain inoperable. Other functions in the same channel that were OPERABLE prior to tripping remain OPERABLE.

A.1 For Required Action A.1, if one or more Functions in a required protective channel becomes inoperable, the affected protective channel must be placed in trip. This Required Action places all RPS Functions in a one-out-of-two logic configuration. The "non-required" channel is placed in bypass when the required inoperable channel is placed in trip to prevent bypass of a second required channel. In this configuration, the RPS can still perform its safety functions in the presence of a random failure of any single Channel. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is sufficient time to perform Required Action A.1.

B.1 Required Action B.1 directs entry into the appropriate Condition referenced in Table 3.3.1-1. The applicable Condition referenced in the table is Function dependent. If the Required Action and the associated Completion Time of Condition A are not met or if more than two channels are inoperable, Condition B is entered to provide for transfer to the appropriate subsequent Condition.

OCONEE UNITS 1, 2, & 3 B 3.3.1-20 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES ACTIONS C.A and C.2 (continued)

If the Required Action and associated Completion Time of Condition A are not met and Table 3.3.1-1 directs entry into Condition C, the unit must be brought to a MODE in which the specified RPS trip Functions are not required to be OPERABLE. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and to open all CRD trip breakers without challenging unit systems.

D.1 If the Required Action and associated Completion Time of Condition A are not met and Table 3.3.1-1 directs entry into Condition D, the unit must be brought to a MODE in which the specified RPS trip Functions are not required to be OPERABLE. To achieve this status, all CRD trip breakers must be opened. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to open CRD trip breakers without challenging unit systems.

E.1 If the Required Action and associated Completion Time of Condition A are not met and Table 3.3.1-1 directs entry into Condition E, the unit must be brought to a MODE in which the specified RPS trip Function is not required to be OPERABLE. To achieve this status, THERMAL POWER must be reduced < 30% RTP. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach 30% RTP from full power conditions in an orderly manner without challenging unit systems.

F.1 If the Required Action and associated Completion Time of Condition A are not met and Table 3.3.1-1 directs entry into Condition F, the unit must be brought to a MODE in which the specified RPS trip Function is not required to be OPERABLE. To achieve this status, THERMAL POWER must be reduced < 2% RTP. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach 2% RTP from full power conditions in an orderly manner without challenging unit systems.

OCONEE UNITS 1, 2, & 3 B 3.3.1-21 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES (continued)

SURVEILLANCE The SRs for each RPS Function are identified by the SRs REQUIREMENTS column of Table 3.3.1-1 for that Function. Most Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION testing.

The SRs are modified by a Note. The Note directs the reader to Table 3.3.1-1 to determine the correct SRs to perform for each RPS Function.

SR 3.3.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; therefore, it is key in verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. If the channels are normally off scale during times when surveillance is required, the CHANNEL CHECK will only verify that they are off scale in the same direction. Off scale low current loop channels are verified to be reading at the bottom of the range and not failed downscale.

The Frequency, equivalent to once every shift, is based on operating experience that demonstrates channel failure is rare. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal but more frequent checks of channel OPERABILITY during normal operational use of the displays associated with the LCO's required channels.

For Functions that trip on a combination of several measurements, such as the Nuclear Overpower Flux/Flow Imbalance Function, the CHANNEL CHECK must be performed on each input.

OCONEE UNITS 1, 2, & 3 B 3.3.1-22 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.2 REQUIREMENTS (continued) This SR is the performance of a heat balance calibration for the power range channels every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months when reactor power is > 15% RTP. The heat balance calibration consists of a comparison of the results of the calorimetric with the power range channel output. The outputs of the power range channels are normalized to the calorimetric. If the calorimetric exceeds the Nuclear Instrumentation System (NIS) channel output by 2%

RTP, the NIS is not declared inoperable but must be adjusted. If the NIS channel cannot be properly adjusted, the channel is declared inoperable. A Note clarifies that this Surveillance is required to be performed only if reactor power is 2 15% RTP and that 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed for performing the first Surveillance after reaching 15% RTP. At lower power levels, calorimetric data are less accurate.

The power range channel's output shall be adjusted consistent with the calorimetric results if the calorimetric exceeds the power range channel's output by Ž 2% RTP. The value of 2% is adequate because this value is assumed in the safety analyses of UFSAR, Chapter 15 (Ref. 2). These checks and, if necessary, the adjustment of the power range channels ensure that channel accuracy is maintained within the analyzed error margins. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is adequate, based on unit operating experience, which demonstrates the change in the difference between the power range indication and the calorimetric results rarely exceeds a small fraction of 2% in any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period. Furthermore, the control room operators monitor redundant indications and alarms to detect deviations in channel outputs.

SR 3.3.1.3 A comparison of power range nuclear instrumentation channels against incore detectors shall be performed at a 31 day Frequency when reactor power is 2 15% RTP. A Note clarifies that 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed for performing the first Surveillance after reaching 15% RTP. If the absolute value of imbalance error is 2 2% RTP, the power range channel is not inoperable, but an adjustment of the measured imbalance to agree with the incore measurements is necessary. The Imbalance error calculation is adjusted for conservatism by applying a correlation slope (CS) value to the error calculation formula. This ensures that the value of the APIO is > API,.

The CS value is listed in the COLR and is cycle dependent. If the power range channel cannot be properly recalibrated, the channel is declared inoperable. The calculation of the Allowable Value envelope assumes a OCONEE UNITS 1, 2, & 3 B 3.3.1-23 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES (continued)

SURVEILLANCE SR 3.3.1.3 (continued)

REQUIREMENTS difference in out of core to incore measurements of 2.0%. Additional inaccuracies beyond those that are measured are also included in the setpoint envelope calculation. The 31 day Frequency is adequate, considering that long term drift of the excore linear amplifiers is small and bumup of the detectors is slow. Also, the excore readings are a strong function of the power produced in the peripheral fuel bundles, and do not represent an integrated reading across the core. The slow changes in neutron flux during the fuel cycle can also be detected at this interval.

SR 3.3.1.4 A CHANNEL FUNCTIONAL TEST is performed on each required RPS channel to ensure that the entire channel will perform the intended function.

Setpoints must be found within the Allowable Values specified in Table 3.3.1-1. Any setpoint adjustment shall be consistent with the assumptions of the current setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in BAW-1 0167 (Ref. 7).

The Frequency of 45 days on a STAGGERED TEST BASIS is consistent with the calculations of Reference 7 that indicate the RPS retains a high level of reliability for this test interval.

SR 3.3.1.5 A Note to the Surveillance indicates that neutron detectors are excluded from CHANNEL CALIBRATION. This Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure virtually instantaneous response.

OCONEE UNITS 1, 2, & 3 B 3.3.1-24 Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES (continued)

SURVEILLANCE SR 3.3.1.5 (continued)

REQUIREMENTS A CHANNEL CALIBRATION is a complete check of the instrument channel, including the sensor. The test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift to ensure that the instrument channel remains operational between successive tests. CHANNEL CALIBRATION shall find that measurement errors and bistable setpoint errors are within the assumptions of the setpoint analysis. CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the setpoint analysis.

Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the resistance temperature detectors (RTD)sensors is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element.

The Frequency is justified by the assumption of an 18 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

REFERENCES 1. UFSAR, Chapter 7.

2. UFSAR, Chapter 15.

3. 10 CFR 50.49.

4. EDM-102, Instrument Setpoint/Uncertainty Calculations.'

5. NUREG-0737, "Clarification of TMI Action Plan Requirements,"

November 1979.

6. BAW-1 893, "Basis for Raising Arming Threshold for Anticipating Reactor Trip on Turbine Trip,' October 1985.

7. BAW-1 0167, May 1986.

8. 10 CFR 50.36.

OCONEE UNITS 1, 2, & 3 B 3.3.1-25 Amendment Nos. I

RPS Manual Reactor Trip B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Reactor Protective System (RPS) Manual Reactor Trip BASES BACKGROUND The RPS Manual Reactor Trip provides the operator with the capability to trip the reactor from the control room. Manual trip is provided by a trip push button on the main control board. This push button operates four electrically independent switch contacts, one for each train. This trip is independent of the automatic trip system. As shown in Figures 7.1 and 7.1 a, UFSAR, Chapter 7 (Ref. 1), power for the control rod drive (CRD) I breaker undervoltage coils and contactor coils comes from the reactor trip modules (RTMs). The manual trip switch contacts are located between the RTM output and the breaker undervoltage coils. Opening of the trip switch I contacts opens the lines to the breakers, tripping them. The switch contacts also energize the breaker shunt trip mechanisms. There is a separate switch contact in series, with the output of each of the four RTMs.

All trip switch contacts are actuated through a mechanical linkage from a I single push button.

APPLICABLE The Manual Reactor Trip ensures that the control room operator can SAFETY ANALYSES initiate a reactor trip at any time. The Manual Reactor Trip Function is required as a backup to the automatic trip functions and allows operators to shut down the reactor.

The Manual Reactor Trip Function satisfies Criterion 3 of 10 CFR 50.36 (Ref. 2).

LCO The LCO on the RPS Manual Reactor Trip requires that the trip shall be OPERABLE whenever the reactor is critical or any time any control rod breaker is closed and rods are capable of being withdrawn, including shutdown bypass. This enables the operator to terminate any event that in the operators judgment requires protective action, even if no automatic trip condition exists.

The Manual Reactor Trip Function is composed of four electrically independent trip switch contacts sharing a common mechanical push button.

OCONEE UNITS 1 2 3 B 3.3.2-1 C&Amendment Nos. I

RPS- RTM B 3.3.3 BASES (continued)

ACTIONS A.1.1. A.1.2, and A.2 When an RTM is inoperable, the associated CRD trip breaker must then be placed in a condition that is equivalent to a tripped condition for the RTM.

Required Action A.1.1 or Required Action A.1.2 requires this either by tripping the CRD trip breaker or by removing power to the CRD trip device.

For Unit(s) with the Control Rod Drive Control System (CRDCS) digital upgrade not complete, tripping one RTM or removing power opens one set of CRD trip devices. For Unit(s) with the CRDCS digital upgrade complete, tripping one RTM or removing power opens one of the CRD trip devices, which will result in the loss of one of the parallel power supplies to the digital CRDCS. Power to hold CONTROL RODS in position is still provided via the parallel CRD trip device(s) (for Unit(s) with the CRDCS digital upgrade not complete) or CRD power supply (for Unit(s) with the CRDCS digital upgrade complete). Therefore, a reactor trip will not occur until a second protection channel trips.

To ensure the trip signal is registered in the other channels; Required Action A.2 requires that the inoperable RTM be removed from the cabinet.

This action causes the electrical interlocks to indicate a tripped channel in the remaining three RTMs. Operation in this condition is allowed indefinitely because the actions put the RPS into a one-out-of-three configuration. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is sufficient time to perform the Required Actions.

B.1. B.2.1. and B.2.2 Condition B applies If two or more RTMs are inoperable or If the Required Action and associated Completion Time of Condition A are not met in MODE 1, 2, or 3. In this case, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 with all CRD trip breakers open or with power from all CRD trip breakers removed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.

OCONEE UNITS 1 2 3 B 3.3.3-3 Amendment Nos. I

RPS - RTM B 3.3.3 BASES ACTIONS C.1 and C.2 (continued)

Condition C applies if two or more RTMs are inoperable or if the Required Action and associated Completion Time of Condition A are not met in MODE 4 or 5. In this case, the unit must be placed in a MODE in which the LCO does not apply. This is done by opening all CRD trip breakers or removing power from all CRD trip breakers. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to open all CRD trip breakers or remove power from all CRD trip breakers without challenging unit systems.

SURVEILLANCE SR 3.3.3.1 REQUIREMENTS The SRs include performance-of a CHANNEL FUNCTIONAL TEST every 31 days. This test shall verify the OPERABILITY of the RTM and its ability to receive and properly respond to channel trip and reactor trip signals.

The Frequency of 31 days is based on operating experience, which has demonstrated that failure of more than one channel of a given function in any 31 day interval is a rare event.

Testing in accordance with this SR is normally performed on a rotational basis, with one RTM being tested each week. Testing one RTM each week reduces the likelihood of the same systematic test errors being introduced into each redundant RTM.

REFERENCES 1. UFSAR, Chapter 7.

2. 10 CFR 50.36.

OCONEE UNITS 1, 2, & 3 B 3.3.3-4 Amendment Nos. I

CRD Trip Devices B 3.3.4 B 3.3 INSTRUMENTATION B 3.3.4 Control Rod Drive (CRD) Trip Devices BASES BACKGROUND The Reactor Protective System (RPS) contains multiple CRD trip devices:

four AC trip breakers for Unit(s) with Control Rod Drive Control System (CRDCS) digital upgrade complete or two AC trip breakers, two DC trip breaker pairs and eight electronic trip assembly (ETA) relays for Unit(s) with the CRDCS digital upgrade not complete. For Unit(s) with the CRDCS digital upgrade not complete, the system has two separate paths (or channels), with each path having one AC breaker in series with a pair of DC breakers and functionally in series with four ETA relays in parallel. For Unit(s) with the CRDCS digital upgrade complete, the system has two separate paths (or channels), with each path having two AC breakers in series. In either case, each path provides independent power to the CRDs.

Also, in either case, either path can provide sufficient power to operate the entire CRD System.

For Unit(s) with the CRDCS digital upgrade complete, Figure 7.1, UFSAR, Chapter 7 (Ref. 1), illustrates the configuration of Reactor Protection *.. I Z

System (RPS) Reactor Trip Modules (RTM's) and the trip breakers. For ..- .

Unit(s) with the CRDCS digital upgrade not complete, Figure 7.1a, UFSAR, Chapter 7 (Ref. 1), illustrates the configuration of the CRD trip devices. To trip the reactor, power to the CRDs must be removed. Loss of power causes the CRD mechanisms to release the CONTROL RODS, which then fall by gravity into the core.

Power to CRDs is supplied from two separate sources through the AC trip circuit breakers. For Unit(s) with the CRDCS digital upgrade complete, these breakers are designated A, B, C, and D and their undervoltage (trip) coils are powered by RPS channels A, B, C, and D, respectively. For Unit(s) with the CRDCS digital upgrade not complete, these breakers are designated A and B, and their undervoltage trip coils are powered by RPS channels A and B, respectively. From the circuit breakers, the CRD power travels through voltage regulators and stepdown transformers. For Unit(s)

OCONEE UNITS 1, 2, & 3 B 3.3.4-1 Amendment Nos. I

CRD Trip Devices B 3.3.4 BASES BACKGROUND with the CRDCS digital upgrade complete, these devices in turn supply (continued) redundant buses that feed the SRPS. For Unit(s) with the CRDS digital upgrade not complete, these devices in turn supply redundant buses that feed the DC power supplies and the regulating rod, APSR and auxiliary power supplies.

For Unit(s) with the CRDS digital upgrade not complete, the DC power supplies rectify the AC input and supply power to hold the safety rods in their fully withdrawn position. One of the redundant power sources supplies phase A; the other, phase CC. Either phase being energized is sufficient to hold the rod. Two breakers are located on the output of each power supply. Each breaker controls half of the power to two of the four safety rod groups. The undervoltage trip coils on the two circuit breakers on the output of one of the power supplies is controlled by RPS channel C.

The other two breakers are controlled by RPS channel D..

For Unit(s) with the CRDS digital upgrade not complete, in addition to the DC power supplies, the redundant buses also supply power to the regulating rod, APSR and auxiliary power supplies. These power supplies contain silicon controlled rectifiers (SCRs) that are gated on and off to provide power to, and remove power from, the phases of the CRD mechanisms. The gating control signal for these SCRs is supplied through the closed contacts of the ETA relays. These contacts are referred to as E and F contactors, and are controlled by the C and D RPS channels respectively The following applies to Unit(s) with the CRDS digital upgrade not complete:

The AC breaker and DC breakers are in series in one of the power supplies; whereas, the redundant AC breaker and DC breakers are in series in the other power supply to the CONTROL RODS. The logic required to cause a reactor trip is the opening of a circuit breaker in each of the redundant power supplies. (The pair of DC circuit breakers on the output of the power supply are treated as one breaker.) This is known as a one-out-of-two taken twice logic. The following examples illustrate the operation of the reactor trip circuit breakers.

a. If the A AC circuit breaker opens:

1. the input power to associated DC power supply is lost, and

2. the SCR supply from the associated power source is lost.

OCONEE UNITS 1, 2, & 3 B 3.3.4-2 Amendment Nos. I

CRD Trip Devices B 3.3.4 BASES BACKGROUND b. If the D DC circuit breaker(s) and F contactors open:

(continued)

1. the output of the DC power supply is lost, and

2. when the F contactor opens, SCR gating power is lost.

c. The combination of (a) and (b) causes a reactor trip.

The following applies to Unit(s) with the CRDS digital upgrade complete:

Two AC breakers (A and C) are in series to feed one redundant train of the SRPS, whereas the other two series AC breakers (B and D)feed the other redundant train of the SRPS. The minimum required logic required to cause a reactor trip is the opening of a circuit breaker in each parallel path to the SRPS. This is known as a one-out-of-two taken twice logic. The following examples illustrate the operation of the reactor trip circuit breakers.

a. If the A or C circuit breaker opens input power to one train of the SRPS's is lost.

b. If in addition, the B or D circuit breaker opens input power to the other train of the SRPS's is lost, which will result in the dropping of all rods (except APSR's) into the core.

The logic developed within the RPS Reactor Trip Modules will result in all AC breakers tripping if any two RPS channels receive a trip signal.

In summary, two tripped RPS channels will cause a reactor trip. For example, a reactor trip occurs if RPS channel B senses a low Reactor Coolant System (RCS) pressure condition and if RPS channel C senses a variable low RCS pressure condition. When the channel B bistable relay de-energizes, the channel trip relay de-energizes and opens its associated contacts. The same thing occurs in channel C, except the variable lower pressure bistable relay de-energizes the channel C trip relay. When the output logic relays in channel B and C de-energize, the B and C OCONEE UNITS 1, 2, & 3 B 3.3.4-3 Amendment Nos. I

CRD Trip Devices B 3.3.4 BASES BACKGROUND contacts in the trip logic of each channel's reactor trip module (RTM) open (continued) causing an undervoltage to each trip breaker. All trip breakers (for Unit(s) with the digital CRDCS upgrade complete) or all trip breakers and the ETA relay contactors open (for Unit(s) with the digital CRDCS upgrade not complete), and power is removed from all CRD mechanisms. All rods fall into the core, resulting in a reactor trip.

APPLICABLE Accident analyses rely on a reactor trip for protection of reactor core SAFETY ANALYSES integrity, reactor coolant pressure boundary integrity, and reactor building OPERABILITY. A reactor trip must occur when needed to prevent accident consequences from exceeding those calculated in the accident analyses. The CONTROL ROD position limits ensure that adequate rod worth is RODS will trip when required. More detailed descriptions of the applicable accident analyses are found in the Bases for each of the individual RPS trip Functions in LCO 3.3.1, Reactor Protective System (RPS) Instrumentation."

The CRD trip devices satisfy Criterion 3 of CFR 50.36 (Ref. 2).

LCO The LCO requires all of the specified CRD trip devices to be OPERABLE.

Failure of any required CRD trip device renders a portion of the RPS inoperable and reduces the reliability of the affected Functions. Without reliable CRD reactor trip circuit breakers and associated support circuitry, a reactor trip may not reliably occur when initiated either automatically or manually.available upon reactor trip to shut down the reactor to the required SDM. Further, OPERABILITY of the CRD trip devices ensures that all CONTROL All required CRD trip devices shall be OPERABLE to ensure that the reactor remains capable of being tripped any time it is critical.

OPERABILITY is defined as the CRD trip device being able to receive a reactor trip signal and to respond to this trip signal by interrupting power to the CRDs. Both of the CRD trip breaker's diverse trip devices and the breaker itself must be functioning properly for the breaker to be OPERABLE.

For Unit(s) with the CRDCS upgrade not complete, both ETA relays I associated with each of the three regulating rod groups and the two ETA relays associated with the auxiliary power supply must be OPERABLE to satisfy the LCO. The ETA relays associated with the APSR power supply OCONEE UNITS 1, 2, & 3 B 3.3.4-4 Amendment Nos. I

CRD Trip Devices B 3.3.4 BASES LCO are not required to be OPERABLE because the APSRs are not designed (continued) to fall into the core upon initiation of a reactor trip.

Requiring all breakers and ETA relays (for Unit(s) with the CRDCS upgrade not complete) to be OPERABLE ensures that at least one device in each of the two power paths to the CRDs will remain OPERABLE even with a I

single failure.

APPLICABILITY The CRD trip devices shall be OPERABLE in MODES 1 and 2, and in MODES 3, 4, and 5 when any CRD trip breaker is in the closed position and the CRD System is capable of rod withdrawal.

The CRD trip devices are designed to ensure that a reactor trip would occur if needed. Since this condition can exist in all of these MODES, the CRD trip devices shall be OPERABLE.

ACTIONS A Note has been added to the ACTIONS indicating separate Condition entry is allowed for each CRD trip device.

A.1 and A.2 Condition A represents reduced redundancy in the CRD trip Function. For Unit(s) with the CRDCS Upgrade complete, Condition A applies when one diverse trip Function (undervoltage or shunt trip device) is inoperable in one or more CRD trip breaker(s). For Unit(s) with the CRDCS Upgrade not complete, Condition A applies when:

One diverse trip Function (undervoltage or shunt trip device) is inoperable In one or more CRD trip breaker(s) or breaker pair; or

One diverse trip Function is inoperable in both DC trip breakers associated with one protective channel. In this case, the inoperable trip Function does not need to be the same for both breakers.

If one of the diverse trip Functions on a CRD trip breaker (or breaker pair for Unit(s) with the CRDCS Upgrade not complete) becomes inoperable, actions must be taken to preclude the inoperable CRD trip device from I

preventing a reactor trip when needed. This is done by manually tripping OCONEE UNITS 1, 2, & 3 B 3.3.4-5 Amendment Nos. I

CRD Trip Devices B 3.3.4 BASES ACTIONS A.1 and A.2 (continued) the inoperable CRD trip breaker or by removing power from the inoperable CRD trip breaker. Either of these actions places the affected CRDs in a one-out-of-two trip configuration, which precludes a single failure from preventing a reactor trip. The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time has been shown to be acceptable through operating experience.

B.1 and B.2 Condition B represents a loss of redundancy for the CRD trip Function.

Condition B applies when both diverse trip Functions are inoperable in one or more trip breaker(s ) (or breaker pair for Unit(s) with the CRDCS Upgrade not complete).

Required Action B.1 and Required Action B.2 are the same as Required Action A.1 and Required Action A.2, but the Completion Time is shortened.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time allowed to trip or remove power from the CRD trip breaker allows the operator to take all the appropriate actions for the inoperable breaker and still ensures that the risk involved is acceptable.

C.1 and C.2 Condition C does not apply to Unit(s) with the CRDCS digital upgrade complete. Condition C represents a loss of redundancy for the CRD trip Function. Condition C applies when one or more ETA relays are inoperable. The preferred action is to restore the ETA relay to OPERABLE status. If this cannot be done, the operator can perform one of two actions to eliminate reliance on the failed ETA relay. This first option is to switch the affected CONTROL ROD group to an alternate power supply. This removes the failed ETA relay from the trip sequence, and the unit can operate indefinitely. The second option is to trip the corresponding AC CRD trip breaker. This results in the safety function being performed, thereby eliminating the failed ETA relay from the trip sequence. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is sufficient to perform the Required Action.

D.1, D.2.1, and D.2.2 With the Required Action and associated Completion Time of Condition A, B, or C not met in MODE 1, 2, or 3, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3, with all CRD trip breakers open or with power from all CRD trip breakers removed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time OCONEE UNITS 1, 2, & 3 B 3.3.4-6 Amendment Nos. I

CRD Trip Devices B 3.3.4 BASES (continued)

ACTIONS D.1. D.2.1, and D.2.2 (continued) of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.

E.1 and E.2 With the Required Action and associated Completion Time of Condition A, B, or C not met in MODE 4 or 5, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, all CRD trip breakers must be opened or power from all CRD trip breakers removed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to open all CRD trip breakers or remove power from all CRD trip breakers without challenging unit systems.

SURVEILLANCE SR 3.3.4.1 REQUIREMENTS SR 3.3.4.1 is to perform a CHANNEL FUNCTIONAL TEST every 31 days.

This test verifies the OPERABILITY of the trip devices by actuation of the end devices. Also, this test independently verifies the undervoltage and shunt trip mechanisms of the trip breakers. The Frequency of 31 days is based on operating experience, which has demonstrated that failure of more than one channel of a given function in any 31 day interval is a rare event.

REFERENCES 1. UFSAR, Chapter 7.

2. 10 CFR 50.36.

OCONEE UNITS 1, 2, & 3 B 3.3.4-7 Amendment Nos. I

ATTACHMENT 2 MARKUP OF TECHNICAL SPECIFICATION

CRD Trip Devices 3.3.4

a. Four AC CRD trip breakers shall be OPERABLE for Unit(s) with the ControlRod 3.3 INSTRUMENTATION Drive Control System Digital Upgrade I1nmnlatea 3.3.4 Control Rod Drive (CRD) Trip Devices - . I LCO 3.3.4 The following CRD trip devices shall be OPERABLS E7J-~ Two AC CRD trip breakers;

[D Two DC CRD trip breaker pairs; and EI1-0 Eight electronic trip assembly (ETA) relays.

for Unit(s) with the CRDCS Digital Upgrade not complete APPLICABILITY: MODES 1 and 2, MODES 3, 4, and 5 when any CRD trip breaker is in the closed position and the CRD System is capable of rod withdrawal.

ACTIONS

--------------------------------------------- NOTE-----------------------------------------------------

Separate Condition entry is allowed for each CRD trip device.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more CRD trip A.1 Trip the CRD trip 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months breaker a r breaker.

re p Functions inoperable. OR A.2 Remove power from 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months the CRD trip breaker.

(continued)

OR One or more required DC CRD breaker pair diverse trip Functions inoperable.

OCONEE UNITS 1, 2,& 3 3.3.4-1 Amendment Nos. 0, 3 , &oo

CRD Trip Devices 3.3.4 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One or more CRD trip B.1 Trip the CRD trip 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months breaker.

brakinope bIeN a r OR reasons other than OR those in Condition A. One or more required DC B.2 Remove power from 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months CRD breaker pairs inoperable for reasons the CRD trip breaker.

t I I 10~~~~~~~~~~

other than those in Condition A.

C. One or mor ET *C.1 Transfer affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months relays inoperable. CONTROL ROD group to power supply with

- required OPERABLE ETA relays.

OR C.2 Trip corresponding AC 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months CRD trip breaker(s).

I.

D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met in AND MODE 1, 2, or 3.

D.2.1 Open all CRD trip 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months breakers.

OR D.2.2 Remove power from all 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months CRD trip breakers.

(continued)

OCONEE UNITS 1,.2, & 3 3.3.4-2 Amendment Nos. ,3 , & 00l

CRD Trip Devices 3.3.4 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Required Action and E.1 Open all CRD trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion breakers.

Time not met in MODE 4 or 5. OR E.2 Remove power from all 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months CRD trip breakers.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.4.1 Perform CHANNEL FUNCTIONAL TEST. 31 days OCONEE UNITS 1, 2, & 3 3.3.4-3 Amendment Nos.1306, 396, & 00 J

CONTROL ROD Group Alignment Limits B 3.1.4 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.4 CONTROL ROD Group Alignment Limits BASES BACKGROUND The OPERABILITY (e.g., trippability) of the CONTROL RODS is an initial condition assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment is an initial condition assumption in the safety analysis that directly affects core power distributions and assumptions of SDM. An inoperable CONTROL ROD that is unable to respond to positioning signals from the Rod Drive Control System may still meet its SDM capabilities if it is capable of responding to a valid trip signal (i.e., inoperable but trippable). It would, however, have the potential to adversely affect core power distribution due to its inability to maintain itself within the group average. An inoperable CONTROL ROD which is not mtrippable" would satisfy neither the capacity to supply SDM requirements nor the ability to maintain itself in alignment with the group to assure acceptable core power distribution.

The applicable criteria for these design requirements are ONS Design Criteria (Ref. 1)and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Ught Water Nuclear Power Plants" (Ref. 2).

Mechanical or electrical failures may cause a CONTROL ROD to become inoperable or to become misaligned from its group. CONTROL ROD inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available CONTROL ROD worth for reactor shutdown. Therefore, CONTROL ROD alignment and OPERABILITY are related to core operation within design power peaking limits and the core design requirement of a minimum SDM.

Limits on CONTROL ROD alignment and OPERABILITY have been established, and all CONTROL ROD positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.

roller nut assembly CONTROL RODS are moved by their control rod drive mechanisms I (CRDMs). Each CRDM moves its rod 3 inch for one revolution of the adscr wl but at different rates og and run) depending on the signal output from the Rod Drive Control System (RDCS).

OCONEE UNITS 1, 2, & 3 B 3.1.4-1 Amendment Nos. 00,Adoo o

CONTROL ROD Group Alignment Limits D e A transducer (absolute position or relative position s Ds;5. .4 BASES selectable for display on one position Indication meter)

BACKGROUND The CONTROL RODS are arranged into rod groups that are radially (continued) symmetric. Therefore, movement of the CONTROL RODS does not introduce radial asymmetries in the core power distribution. The CONTROL RODS provide required negative reactivity worth for immediate For Unit(s) with reactor shutdown upon a reactor trip. The regulating rods provide reactivity CRDCS digital control during normal operation and transients, and their movement is upgrade not normally governed by the Integrated Control System.

complete, The axial position of CONTROL RODS is indicated by two separate and independent systems, which are the relative position indicator transducers (for Unit(s) with and the absolute position indicator transducers (see LCO 3.1.7, "Position DRDCS digital Indicator Channels").

upgrade not complete, when 'he relative position indicator transducer is a potentiom aligned to the pulse stepping motor that is driven b ses rom the RDCS same power Th 4rp m ne relative position r each CONTROL ROD drive.\

supply), Individual rods in a grou w n all igne o thsa e pger spply, I ar I. IrwT~trsW ruV

..4L I receive the same signal to move; therefore, the counters for all rods ina LJIIIUkJ WILII group should normally indicate the same position. The Relative Position CRDCS digital upgrade Indicator System is considered highly precise (one rotation of the complete, the I adcrWs3hinch in rod motion). However, if a rod does not move for relative position each demand pulse, the counteivill still count the pulse and incorrectly Indication is reflect the position of theod. lll processed by a Programmable Logic Controller The Absolute Position Indicator System provides an accurate indication of (PLC) which actual CONTROL ROD position, but at a lower precision than the relative counts sequential position indicators. This system is based on i nalog signals from electrical pulses a series of reed switches. l roller nut assembly will result In lI-Il sent to the CRD I

-JI motor stator.

APPLICABLE CONTROL ROD misalignment and inoperability are analyzed in the SAFETY ANALYSES safety analysis (Ref. 3). The criteria for addressing CONTROL ROD inoperability or misalignment are that: I fn I n1tre ..Ath f%1C Hr%01 -- A- -- A I vIWl %llliL0 "Ali %1nu0%0- uIyUM UUyl~ ALu complete) or PLC (for Unit(s) with CRDCS

a. There shall be no violations of: digital upgrade complete)

1. specified acceptable fuel design limits, or

2. Reactor Coolant System (RCS) pressure boundary damage; and

b. The core must remain subcritical after accident transients, except for a main steam line break (MSLB). The analysis results for a MSLB with a coincident failure of the most reactive rod to insert results in a return to criticality.

OCONEE UNITS 1, 2, & 3 B 3.1.4-2 JI3ASES REYI*0N DAED 7/0f/00 IAmendment Nos. , ,&

CONTROL ROD Group Alignment Limits B 3.1.4 BASES (continued)

APPLICABILITY The requirements on CONTROL ROD OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which significant neutron (or fission) power is generated, and the OPERABILITY (i.e., trippability) and alignment of rods have the potential to affect the safety of the unit. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the reactor is shut down and resultant local power peaking would not exceed fuel design limits. In MODES 3, 4, 5 and 6, the OPERABILITY of the CONTROL RODS has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the RCS. See LCO 3.1.1, SHUTDOWN MARGIN (SDM), for SDM in MODES 3, 4, and 5, and LCO 3.9.1, "Boron Concentration," for boron concentration requirements during MODE 6.

ACTIONS A.1 For Unit(s) with the CRDCS digital upgrade not complete,

'<Aignentof the inoperable or misaligned CONTROL ROD may e accomplished by either moving the single CONTROL ROD to the group average position, or by moving the remainder of the group to the position of For Unit(s) with CRDCS the single inoperable or misaligned CONTROL ROD. Either action can be digital upgrade used to restore the CONTROL RODS to a radially symmetric pattem. e complete, alignment of However, this must be done without violating the CONTROL ROD group the inoperable or misaligned CONTROL sequence, overlap, and position limits of LCO 3.2.1, "Regulating Rod ROD must be Position Limits," given in the COLR. THERMAL POWER must also be accomplished by restricted, as necessary, to the value allowed by the position limits of moving the single LCO 3.2.1. The required Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is acceptable because CONTROL ROD to the local xenon redistribution durinn this short interval will no Iause a group average position to restore the significant increase in LHR. tion of inserting the roup to the CONTROL RODS to a position of the misaligned rod is not available if a safety rod is misaligned, radially symmetric since the limits of LCO 3.1.5, "Safety Rod Position Limits," would be pattern. violated.

A.2.1 .1 Compliance with Required Actions of Condition A allows for continued power operation with one CONTROL ROD declared inoperable due to inoperable position indication but trippable, or misaligned from its group average position. These Required Actions comprise the final alternate for Condition A.

If realignment of the CONTROL RODto the group average or alignment of the group to the misaligned CONTROL ROD is not completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (Required Action A.1 not met), the rod shall be considered inoperable.

Since the rod may be inserted farther than the group average position for a (for Unit(s) with CRDCS digital upgrade not complete)

OCONEE UNITS 1 2 3 B 3.1.4-4 Amendment Nosj1360.300 bw 1

CONTROL ROD Group Alignment Limits B 3.1.4 BASES ACTIONS A.2.4 (continued)

The existing CONTROL ROD configuration must not cause an ejected rod to exceed the limit of 0.18% Ak/k at RTP, 0.36% Ak/k at 80% RTP, or 0.7% Ak/k at zero power. This evaluation may require a computer calculation of the maximum ejected rod worth based on nonstandard configurations of the CONTROL ROD groups. The evaluation must determine the ejected rod worth for the duration of time that operation is expected to continue with a misaligned rod. Should fuel cycle conditions at some later time become more bounding than those at the time of the rod misalignment, additional evaluation will be required to verify the continued acceptability of operation. The required Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is acceptable because LHRs are limited by the THERMAL POWER reduction and sufficient time is provided to perform the required evaluation.

B.1 If the Required Actions and associated Completion Times for Condition A are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, for reaching MODE 3 from RTP in an orderly manner and without challenging unit systems.

C.1.1 More than one trippable CONTROL ROD becoming inoperable or misaligned, or both inoperable but trippable and misaligned from their group average position, is not expected and may violate the minimum SDM requirement. Therefore, SDM must be evaluated. Ensuring the SDM meets the minimum requirement within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allows the operator adequate time to determine the SDM.

C.1.2 If the SDM is less than the limit, then the restoration of the required SDM requires increasing the RCS boron concentration to provide negative reactivity. RCS boration must occur as described in Bases Section 3.1.1.

The required Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for initiating boration is reasonable, based on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to OCONEE UNITS 1, 2, & 3 B 3.1.4-6 Amendment Nos. , 3 33 I

CONTROL ROD Group Alignment Limits B 3.1.4 BASES ACTIONS D.2 (continued)

The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.1.4.1 REQUIREMENTS Verification that individual CONTROL RODS are aligned within 6.5% of their group average height limits at a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency allows the operator to detect a rod that is beginning to deviate from its expected position. The specified Frequency takes into account other CONTROL ROD position information that is continuously available to the operator in the control room, so that during actual CONTROL ROD motion, deviations can immediately be detected.

SR 3.1.4.2 Verifying each CONTROL ROD is OPERABLE would require that each rod be tripped. However, in MODES 1 and 2, tripping each CONTROL ROD could result in radial tilts. Exercising each individual CONTROL ROD every 92 days provides increased confidence that all rods continue to be OPERABLE without exceeding the alignment limit; even if they are not regularly tripped. Moving each CONTROL ROD bya a ut n mechanical direction sufficient to demonstrate the absence of Ltiing will not cause radial or axial power tilts, or oscillations, to occur. The 92 day Frequency takes into consideration other Information available to the operator in the control room and SR 3.1.4.1, which is performed more frequently and adds to the determination of OPERABILITY of the rods.

Between required performances-of SR 3.1.4.2 (determination of CONTROL ROD OPERABILITY by movement), if a CONTROL ROD(S) is discovered to be immovable, but is determined to be trippable and aligned, the CONTROL ROD(S) is considered to be OPERABLE. At any time, if a CONTROL ROD(S) is immovable, a determination of the trippability (OPERABILITY) of the CONTROL ROD(S) must be made, and appropriate action taken.

SR 3.1.4.3 Verification of CONTROL ROD drop time allows the operator to determine that the maximum CONTROL ROD drop time permitted is consistent with the assumed CONTROL ROD drop time used in the safety analysis. The OCONEE UNITS 1, 2, & 3 B 3.1.4-83 Amendment Nos. 96, P60, 30

CONTROL ROD Group Alignment Limits B 3.1.4 BASES SURVEILLANCE SR 3.1.4.3 (continued)

REQUIREMENTS (continued) rod drop time given in the safety analysis is 1.66 seconds at reactor coolant 1-full flow conditions and < 1.40 seconds at no flow conditions to /4 insertion (for Unit(s) with CRDCS (Ref. 5). The zone reference lightsPwill activate at 3/4 insertion to give an digital upgrade not indication of the CONTROL ROD drop time and CONTROL ROD location.

complete) or switch (for Measuring CONTROL ROD drop times, prior to reactor criticality after Unit(s) with CRDCS digital upgrade complete) reactor vessel head removal, ensures that the reactor internals and CRDM will not interfere with CONTROL ROD motion or CONTROL ROD drop time. This Surveillance is performed during a unit outage, due to the unit conditions needed to perform the SR and the potential for an unplanned unit transient if the Surveillance were performed with the reactor at power.

This testing is normally performed with all reactor coolant pumps operating to simulate a reactor trip under actual conditions.

REFERENCES 1. UFSAR, Section 3.1.

2. 10 CFR 50.46.

3. UFSAR, Chapter 15.

4. 10 CFR 50.36.

5. UFSAR, Section 15.7.3.

OCONEE UNITS 1, 2, & 3 B 3.1.4-9 Amendment Nos.130, Xo,, 3A0 I

APSR Alignment Limits B3.1.6 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 AXIAL POWER SHAPING ROD (APSR) Alignment Limits BASES BACKGROUND The OPERABILITY of the APSRs and APSR alignment are initial condition assumptions in the safety analysis that directly affect core power distributions. The applicable criteria for these power distribution design requirements are ONS Design Criteria (Ref. 1), and 10 CFR 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors' (Ref. 2).

Mechanical or electrical failures may cause an APSR to become inoperable or to become misaligned from its group. APSR inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution. Therefore, APSR alignment and OPERABILITY are

-related to core operation within design power peaking limits.

Limits on APSR alignment and OPERABILITY have been established, and all APSR positions are monitored and controlled during power operation to ensure that the power distribution limits defined by the design peaking %t ~i limits are preserved.

APSRs are moved by their control rod drive mechanisms CRDMs). Each roller nut CRDM moves its rod 3/4 inch for one revolution of th a cr but at I assembly different rates (og and run) depending on the signal output ro the Rod Control Drive System.

The APSRs are arranged into a group that is radially symmetric.

Therefore, movement of the APSRs does not introduce radial asymmetries in the core power distribution. The APSRs, which are used to assist in control of the axial power distribution, are positioned manually-and do not trip.

APPLICABLE There are no explicit safety analyses associated with mis-aligned APSRs.

SAFETY ANALYSES However, alignment of the APSRs is required to prevent inducing a QUADRANT POWER TILT. The LCOs governing APSR misalignment are provided because the power distribution analysis supporting LCO 3.2.1, LCO 3.2.2, and LCO 3.2.3 assumes the rods are aligned.

During movement of an APSR group, one rod may stop moving while the other rods in the group continue. This condition may cause excessive power peaking. The reload safety evaluations define APSR alignment OCONEE UNITS 1, 2, & 3 B 3.1.6-1 Amendment Nos[0, 0 O a60] 0

APSR Alignment Limits B 3.1.6 BASES APPLICABLE Dimits that allow APSRs to be positioned anywhere within the operating SAFETY ANALYSES band and the increase in local LHR is within the design limits. The

(continued) Required Actions provide a conservative approach to ensure that continued operation remains within the bounds of the safety analysis. No safety analyses take credit for movement of the APSRs.

The APSR alignment limits satisfy Criterion 2 of 10 CFR 50.36 (Ref. 3).

LCO The limits on CONTROL ROD group alignment, safety rod position, and APSR alignment, together with the limits on regulating rod position, AXIAL POWER IMBALANCE, and QPT, ensure the reactor will operate within the fuel design criteria. The Required Action in this LCO ensures deviations from the alignment limits will be adjusted so that excessive local LHRs will not occur.

The limit for individual APSR misalignment is 6.5% (9 inches) deviation from the group average position. This value is established based on the distance between reed switches, with additional allowances for uncertainty in the equipment used to determine this value.

Failure to meet the requirements' of this LCO may produce unacceptable power peaking factors, and LHRs, which may constitute initial conditions inconsistent with the safety analysis.

APPLICABILITY The requirements on APSR OPERABILITY and alignment are applicable in MODES 1 and 2, when the APSRs are not fully withdrawn because these are the only MODES in which significant neutron (or fission) power is generated, and the OPERABILITY and alignment of APSRs have the potential to affect the safety of the unit. OPERABILITY and alignment of the APSRs are not required when they are fully withdrawn because they do not influence core power peaking. In MODES 3,4, 5, and 6, the alignment limits do not apply because the reactor is shut down and excessive local LHRs cannot occur from APSR misalignment.

ACTIONS A.1 The ACTIONS described below are required iHone APSR is declared inoperable due to inoperable position indication or is misaligned. The unit is not allowed to operate with more than one inoperable or misaligned APSR. This would require the reactor to be placed in MODE 3, In accordance with LCO 3.0.3.

OCONEE UNITS 1 2 3 B 3.1.6-2 Amendment Nos( 0,,00A 60I

APSR Alignment Limits B 3.1.6 BASES ACTIONS A.1 (continued)

For Unit(s) with the - *-n alternative to realigning a single inoperable or misaligned APSR to the CRDCS digital upgrade group average position is to align the remainder of the APSR group to the not complete, position of the inoperable or misaligned APSR. This restores the alignment requirements. Deviations up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months will not cause significant xenon redistribution to occur.

The reactor may continue in operation with the APSR inoperable or misaligned if the limits on AXIAL POWER IMBALANCE are surveilled within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to determine if the AXIAL POWER IMBALANCE is still within limits. Also, since any additional movement of the APSRs may result in additional imbalance, Required Action A.1 also requires the AXIAL POWER IMBALANCE surveillance to be performed again within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after each APSR movement. The required Completion Time of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months will not cause significant xenon redistribution to occur.

B.1 The unit must be brought to a MODE in which the LCO does not apply if the Required Actions and associated Completion Times cannot be met. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, for Teaching MODE 3 from RTP in an orderly manner and without challenging unit systems. In MODE 3, APSR alignment limits are not required because the reactor is not generating significant THERMAL POWER and excessive local LHRs cannot occur from APSR misalignment.

SURVEILLANCE .-. SR 3.1.6.1 REQUIREMENTS Verification at a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency that individual APSR positions are within 6.5% of the group average height limits allows the operator to detect an APSR beginning to deviate from its expected position. In addition, APSR position is continuously available to the operator in the control room so that during actual APSR motion, deviations can immediately be detected.

OCONEE UNITS 1, 2, & 3 B 3.1.6-3 Amendment Nos.[3 ,f0,

,Z 3o0

Position Indicator Channels B 3.1.7 BACKGROI JND Switch contacts close when a permanent magnet mounted on the (continued, upper enCONTROL ROD and APSR assembly (CRA) leadscrew

_ extension comes near. As the leadscrew and CONTROL ROD or APSR For Unit(s) move, the switches operate sequentially, producing an analog voltage with CRDCS proportional to position. Other reed switches included in the same tube digital upgrade with the absolute position indicator matrix provide full in and full out limit not complete, indications, and absolute position indications at 0%, 25%, 50%, 75%,

and100% traavel. This series of seven indicators are called zone reference indicators. ihe relative position indicator transducer is a potentiometer, driven by a pulse stepping motor that produces a signal proportional to For Unit(s) with CONTROL ROD or APSR position, bsed nthe electrical pulse steps that CRDCS digital drive the CRDM. I The upgrade complete The relative position indicatior is processed by a Programmable divIer couit made of 48 resist rs of equalxalue con ted in ries Logic Controller {One e of 48 reeswitches is 96nnected a junction etween ach o (PLC) that the fisistors, so at as the m net mount d on the le dscrew oves, produces a signal eiker one or o reed switches are i i c of the agnet proportional to The type R4C (redundant four channel) absolute positiniicator CONTROL ROD or transducer has two parallel sets of voltage divider circuits made up of APSR position, 36 resistors each, connected in series (channels A and B). One end of based on the 36 reed switches is connected at a junction between each of the resistors electrical pulse of the two parallel circuits. The reed switches making up each circuit are steps that drive thre offset, such that the switches for channel A are staggered with the switche CRDM. for channel B. The type R4C is designed such that either two or three ree switches are closed in the vicinity of the magnet. By its design, the design is used type R4C absolute position indicator provides redundancy, with the two three sequence of pickup and drop out of reed switches to enable a continuity of position signal when a single reed switch fails to close. L:

CONTROL ROD and APSR position indicating readout devices located in the control room consist of single rod position meters on a position indication panel. A selector switch permits either relative or absolute position indication to be displayed. Indicator lights are provided on the position indication panel to indicate when each CONTROL ROD or APSR is fully withdrawn, fully inserted, or enabled, and whether a rod position asymmetry alarm condition is present. Atemate indicators show full insertion, full withdrawal, and under control for each CONTROL ROD and APSR group.

B3.1.7-2 [B,6 ESRISONAATEV06/24J2 II OCONEE UNITS OCONEE 1 2 &3 UNITS 1,2, 3 B 3.1.7-2 190E I r

IAmendment Nos.

RPS Instrumentation B 3.3.1 BASES BACKGROUND RPS Overview (continued)

The RPS consists of four separate redundant protective channels that receive inputs of neutron flux, RCS pressure, RCS flow, RCS temperature, RCS pump status, reactor building (RB) pressure, main feedwater (MFW) pump status, and turbine status.

Figure 7.1, UFSAR, Chapter 7 (Ref. 1), shows the arrangement of a typical RPS protective channel. A protective channel is composed of measurement channels, a manual trip channel, a reactor trip module (RTM), and control rod drive (CRD) trip devices. LCO 3.3.1 provides requirements for the individual measurement channels. These channels encompass all equipment and electronics from the point at which the measured parameter is sensed through the bistable relay contacts in the trip string. LCO 3.3.2, Reactor Protective System (RPS) Manual Reactor Trip," LCO 3.3.3, Reactor Protective System (RPS) - Reactor Trip Module (RTM)," and LCO 3.3.4, control rod Drive (CRD) Trip Devices." discuss the remaining RPS elements. For Unit(s) with the Control Rod Drive Control System (CRDCS) digital upgrade not complete, The RPS instrumentation me res criical ui parameters and compares these to predetermined setpoints. If the setpoint is exceeded, a channel For Unit(s) with the CRDCS trip signal is generated. The generation of any two trip signals in any of the digital upgrade complete, four RPS channels will result in the trip of the reactor.

the RTS consists of four AC Trip Breakers arranged In X two parallel combinations of ;[he Reactor Trip System (RTS) contains multiple CRD trip devices; two AC two breakers each. Each trip breakers, two DC trip breaker pairs, and eight electronic trip assembly path provides Independent (ETA) relays. The system has two separate paths (or channels), with each power to the CRD motors. path having one AC breaker in series with a pair of DC breakers and EIther path can provide functionally in series with four ETA relays in parallel. Each path provides sufficient power to operate all CRDs. Two separate independent power to the CRDs. Either path can provide sufficient power power paths to the CRD's to operate all CRDs. Two separate power paths to the CRDs ensure that a ensure that a single failure single failure that opens one path will not cause an unwanted reactor trip.

that opens one path will not -

cause an unwanted reactor The RPS consists of four independent protective channels, each containing trip, an RTM. The RTM receives signals from its own measurement channels that indicate a protective channel trip is required. The RTM transmits this signal to its own two-out-of-four trip logic and to the two-out-of-four logic of the RTMs in the other three RPS channels. Whenever any two RPS channels transmit channel trip signals, the RTM logic in each channel actuates to remove 120 VAC power from its associated CRD trip device.

OCONEE UNITS 1, 2, & 3 B 3.3.1-2 BASR6 REVISI9O DATED OX$X/03l Amendment Nos. .

RPS Instrumentation B 3.3.1 BASES BACKGROUND RPS Overview (continued) j For Unit(s) with the CRDCS digital upgrade not complete, For Units(s) with the Vfhe reactor is tripped by opening circuit breakers andETA relays that CRDCS digital upgrade interrupt the control power supply to the CRDs. Six breakers are installed complete, the reactor s to increase reliability and allow testing of the trip system. A one-out-of-two tripped by opening the taken twice logic is used to interrupt power to the rods. eri reactor trip breakers. energizing The RPS has three bypasses: a shutdown bypass, a dummy bistable and an RPS channel bypass. Shutdown bypass allows the withdrawal of safety rods for SDM availability and rapid negative reactivity insertion during unit cooldowns or heatups. The dummy bistable is used to bypass one or more functions (bistable trips) associated with one RPS Channel. The RPS Channel bypass allows one entire RPS channel to be taken out of service for maintenance and testing. Test circuits in the trip strings allow complete testing of all RPS trip/unctions.

The RPS operates from the instrumentation channels discussed next. The specific relationship between measurement channels and protective channels differs from parameter to parameter. Three basic configurations are used:

a. Four completely redundant measurements (e.g., reactor coolant flow) with one channel input to each protective channel;

b. Four channels that provide similar, but not identical, measurements (e.g., power range nuclear instrumentation where each RPS channel monitors a different quadrant), with one channel input to each protective channel; and

c. Redundant measurements with combinational trip logic outside of the protective channels and the combined output provided to each protective channel (e.g., main feedwater pump trip instrumentation).

These arrangements and the relationship of instrumentation channels to trip Functions are discussed next to assist in understanding the overall effect of instrumentation channel failure.

Power Ranae Nuclear Instrumentation Power Range Nuclear Instrumentation channels provide inputs to the following trip Functions:

1. Nuclear Overpower OCONEE UNITS 1, 2, & 3 B 3.3.1-3 [BASHfi REVISI71i DATED X)YXXIO3 l l Amendment Nos. I

RPS Instrumentation B 3.3.1 BASES BACKGROUND Power Range Nuclear Instrumentation (continued)

a. Nuclear Overpower - High Setpoint;

b. Nuclear Overpower- Low Setpoint;

7. Reactor Coolant Pump to Power; 8.. Nuclear Overpower Flux/Flow Imbalance;

9. Main Turbine Trip (Hydraulic Fluid Pressure); and

10. Loss of Main Feedwater (LOMFW) Pumps (Hydraulic Oil Pressure).

The power range instrumentation has four linear level channels, one for each core quadrant. Each channel feeds one RPS protective channel.

Each channel originates in a detector assembly containing two uncompensated ion chambers. The ion chambers are positioned to represent the top half and bottom half of the core. The individual currents from the chambers are fed to individual linear amplifiers. The summation of the top and bottom is the total reactor power. The difference of the top minus the bottom neutron signal is the measured AXIAL POWER IMBALANCE for the associated core quadrant.

Reactor Coolant System Outlet TemDerature The Reactor Coolant System Outlet Temperature provides input to the following Functions:

2. RCS High Outlet Temperature; and

5. RCS Variable Low Pressure.

The RCS Outlet Temperature is measured by two resistance elements in each hot leg, for a total of four. One temperature detector is associated with each protective channel.

OCONEE UNITS 1, 2, & 3 B3.3.1-4 IBAS REVISIy 4 DATED ) 4 XX/03l ient Nos. .

RPS Manual Reactor Trip B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Reactor Protective System (RPS) Manual Reactor Trip BASES BACKGROUND The RPS Manual Reactor Trip provides the operator with the capability to trip the reactor from the control room. Manual trip is provided by a trip push button on the main control board. This push button operates four electrically independent switch contacts, one for each train. This trig independent of the automatic trip system. As shown in Figure 7. UFSAR, Chapter 7 (Ref. 1), power for the control rod drive (CRD) breaker undervoltage coils and contactor coils comes from the reactor trip modules (RTMs). The manual trip switch contacts are located between the RTM output and the breaker undervoltage coils. Opening of thdswitch contacts opens the lines to the breakers, tripping them. The switch contacts also energize the breaker shunt trip mechanisms. There is a separate switch trip contact in series, with the output of each of the four RTMs. Al witc contacts are actuated through a mechanical linkage from a single push button.

APPLICABLE The Manual Reactor Trip ensures that the control room operator can SAFETY ANALYSES initiate a reactor trip at any time. The Manual Reactor Trip Function is required as a backup to the automatic trip functions and allows operators to shut down the reactor.

The Manual Reactor Trip Function satisfies Criterion 3 of 10 CFR 50.36 (Ref. 2).

LCO The LCO on the RPS Manual Reactor Trip requires that the trip shall be OPERABLE whenever the reactor is critical or any time any control rod breaker is closed and rods are capable of being withdrawn, including shutdown bypass. This enables the operator to terminate any event that in the operator's judgment requires protective action, even if no automatic trip condition exists.

The Manual Reactor Trip Function is composed of four electrically independent trip switch contacts sharing a common mechanical push button.

OCONEE UNITS 1, 2, & 3 B 3.3.2-1 Amendment Nos. *0b, 60, 3_01

/ - RTM

~~~~~~~~RPS

/~~~~~~~~~~~~~ 3.3.3

/ ~~~~~~~~~~For Unit(s) with the Control Rod Dve Control ACTIONS A.1.1 .2. and A.2 System (CRDCS) digital upgrade not complete, For Unit(s therth When an RTM is inoperable, the associated CRD trip breaker must then be complete, tripping one placed in a condition that is equivalent to a tripped condition for the RTM.

RTM or removing power Required Action A.1.1 or Required Action A.1.2 requires this either by opens one of the CRD trip tripping the CRD trip breaker or by removing power to the CRD trip device.

devices, which will result ripping one RTM or removing power opens one set of CRD trip devices.

inthe loss of one of the Power to hold CONTROL ROD s still provided via the parallel CRD the digital CRDCS. f a cori will not occur until a second protection channel trips.

/______ (for Unit(s) with the CRDCS digital upgrade not complete) or CRD power supply (for Unit(s) with the CRDCS digital upgrade complete)

Inposition To ensure the trip signal is registered in te otner channels, Kequirec Action A.2 requires that the inoperable RTM be removed from the cabinet.

This action causes the electrical interlocks to indicate a tripped channel in the remaining three RTMs. Operation inthis condition is allowed indefinitely because the actions put the RPS into a one-out-of-three configuration. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is sufficient time to perform the Required Actions.

B.1. B.2.1. and B.2.2 Condition B applies if two or more RTMs are inoperable or if the Required Action and associated Completion Time of Condition A are not met in MODE 1, 2, or 3. Inthis case, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 with all CRD trip breakers open or with power from all CRD trip breakers removed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.

C.1 and C.2 Condition C applies if two or more RTMs are inoperable or if the Required Action and associated Completion Time of Condition A are not met in MODE 4 or 5. Inthis case, the unit must be placed in a MODE in which the LCO does not apply. This is done by opening all CRD trip breakers or removing power from all CRD trip breakers. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to open all CRD trip breakers or remove power from all CRD trip breakers without challenging unit systems.

B 3.3.3-3 Amendment Nosi 6o, 3gb, &$oo I OCONEE UNITS 2 &3 1 2, UNITS I, 3 B 3.3.3-3 Amendment Nos[ '-X0' 30, 0001

CRD Trip Devices For Unit(s) with the CRDCS digital upgrade complete, the system has two separate paths (or B 3.3.4 channels), with each path having two AC breakers In series. In either case, B 3.3 INSTRUMENTATION four AC trip breakers for Unit(s) with Control Rod Drive Control System (CRDCS) digital upgrade complete or B 3.3.4 Control Rod Drive (CRD) Trip Devices for Unit(s) with the CRD0S digital upgrade not complete. For BASES /~

I Unit(s) with the CRDCS digital upgrade not complete, lBACKGROUNID The Reactor Protective System (RPS) contains multiple CRD trip devices:1 Also, In

/ two AC trip breakers, two DC trip breaker pairs, and eight electronic trip either assembly (ETA) relayk he system has two separate paths (or channels), case

\ with each path having one AC breaker in series with a pair of DC breakers and functionally in series with four ETA relays in parallel.+gach path provides independent power to the CRDsltither path cai provide sufficient power to operate the entire CRD System.

UFSAR, Chapter 7 (Ref. 1), illustrates the configuration of CRD trip devices. To trip the reactor, power to the CRDs must be removed.

Loss of power causes the CRD mechanisms to release the CONTROL RODS, which then fall by gravity into the core.

Power to CRDs is supplied from two separate sources through the AC trip circuit breakers. hese breakers are designated A and B, and their undervoltage trip coils are powered by RPS channels A and B, respectively.

For Unit(s) with the From the circuit breakers, :the CRD power travels through voltage CRDCS digital upgrade complete, Figure 7.1, regulators and stepdown transformersti'hese devices in turn supply UFSAR, Chapter 7 (Ref. redundant buses that feed the DC power supplies and the regulating rod, 1), Illustrates the APSR and auxiliary power supplies. For Unit(s) with the CRDCS digital upgrade not complete, configuration of Reactor Protection System (RPS) lShe DC power supplies rectify the AC input and supply power to hold the Reactor Trip Modules (RTM's) and the trip safety rods in their fully withdrawn position. One of the redundant power breakers. For Unit(s) sources supplies phase A; the other, phase CC. Either phase being with the CRDCS digital energized is sufficient to hold the rod. Two breakers are located on the upgrade not complete, output of each power supply. Each breaker controls half of the power to Figure 7.1a two of the four safety rod groups. The undervoltage trip coils on the two circuit breakers on the output of one of the power supplies is controlled by For Unit(s) with the CRDCS RP cnhannel Cl The nther tw hrekersar rnntrnllerd bh RP; channl f/

-. 1 . .. - - / I digital upgrade complete, addition to the DC power supplies, the redundant buses also supply these breakers are power to the regulating rod, APSR and auxiliary power supplies. These designated A, B, C, and D and their undervoltage (trip) power supplies contain silicon controlled rectifiers (SCRs) that are gated on coils are powered by RPS and off to provide power to, and remove power from, the phases of the channels A, B, C, and D, CRD mechanisms. The gating control signal for these SCRs is supplied respectively. For Unit(s) through the closed contacts of the ETA relays. These contacts are referred with the CRDCS digital to as E and F contactors, and are controlled by the C and D RPS channels upgrade not complete, respectively.

For Unit(s) with the CRDCS digital upgrade complete, these devices In turn supply redundant buses that feed the SRPS. For Unit(s) with the CRDS digital upgrade not complete, OCONEE UNITS 1 2 & 33 UNITS 1,2, B 3.3.4-1 B 3.3.4-1 Amendment Nos Amendment Nost3o,30/,& db 1396, so/& 3,0t j

BACKGROUND The AC breaker and DC breakers are in series in one of the power (continued) supplies; whereas, the redundant AC breaker and DC breakers are in The foflowing applies to Unit(s) with the series in the other power supply to the CONTROL RODS. The logic CRDS digital upgrade complete: required to cause a reactor trip is the opening of a circuit breaker in each of Two AC breakers (A and C) are In series to the redundant power supplies. (The pair of DC circuit breakers on the feed one redundant train of the SRPS, output of the power supply are treated as one breaker.) This is known as a whereas the other two series AC breakers one-out-of-two taken twice logic. The following examples illustrate the (B and D) feed the other redundant train of operation of the reactor trip circuit breakers.

the SRPS. The minimum required logic required to cause a reactor trip Is the opening of a circuit breaker In each parallel a. If the A AC circuit breaker opens:

path to the SRPS. This Is known as a one-out-of-two taken twice logic. The following examples Illustrate the operation

1. the input power to associated DC power supply is lost, and of the reactor trip circuit breakers.

2. the SCR supply from the associated power source is lost.

a. If the A or C circuit breaker opens Input power to one train of the SRPS's Is lost. b. If the D DC circuit breaker(s) and F contactors open:

b. If In addition, the B or D circuit 1. the output of the DC power supply is lost, and breaker opens input power to the other train of the SRPS's Islost.

which wll result In the dropping of 2. when the F contactor opens, SCR gating power is lost.

all rods (except APSR's) Into the core.

c. The combination of (a) and (b) causes a reactor trip.

The logic developed within the RPS Reactor Trip Modules will result In all AC breakers In summary, two tripped RPS channels will cause a reactor trip. For tripping if any two RPS channels receive a example, a reactor trip occurs if RPS channel B senses a low Reactor' tip signal.

Coolant System (RCS) pressure condition and if RPS channel C senses a variable low RCS pressure condition. When the channel B bistable relay de-energizes, the channel trip relay de-energizes and opens its associated contacts. The same thing occurs in channel C, except the variable lower pressure bistable relay de-energizes the channel C trip relay. When the output logic relays in channel B and C de-energize, the B and C contacts in the trip logic of each channel's reactor trip module (RTM) open causing an undervoltage to each trip breaker. All trip breakersynd the ETA relay contactors opera and power is removed from all CRD mechanisms. All rods fall into the core, resulting in a reactor trip.

I APPLICABLE Accident analyses rely on a reactor trip for protection of reactor core SAFETY ANALYSES integrity, reactor coolant pressure boundary integrity, and reactor building OPERABILITY. A reactor trip must occur when needed to prevent accident consequences from exceeding those calculated in the accident analyses.

The CONTROL ROD position limits ensure that adequate rod worth is-(for Unit(s) with the digital CRDCS I I upgrade not complete) l (for Unit(s) with the digital CRDCS upgrade complete) or all trip breakers OCONEE UNITS 1 2 3 B 3.3.4-2 Amendment Nosf96 30& 7 3,06O

CRD Trip Devices B 3.3.4 BASES APPLICABLE available upon reactor trip to shut down the reactor to the required SDM.

SAFETY ANALYSES Further, OPERABILITY of the CRD trip devices ensures that all CONTROL (continued) RODS will trip when required. More detailed descriptions of the applicable accident analyses are found in the Bases for each of the individual RPS trip Functions in LCO 3.3.1, Reactor Protective System (RPS)

Instrumentation."

The CRD trip devices satisfy Criterion 3 of CFR 50.36 (Ref. 2).

LCO The LCO requires all of the specified CRD trip devices to be OPERABLE.

Failure of any required CRD trip device renders a portion of the RPS inoperable and reduces the reliability of the affected Functions. Without reliable CRD reactor trip circuit breakers and associated support circuitry, a reactor trip may not reliably occur when initiated either automatically or manually.

All required CRD trip devices shall be OPERABLE to ensure that the reactor remains capable of being tripped any time it is critical.

OPERABILITY is defined as the CRD trip device being able to receive a reactor trip signal and to respond to this trip signal by interrupting power to the CRDs. Both of the CRD trip breaker's diverse trip devices and the breaker itself must be functioning properly for the breaker to be For Unit(s) with the OPERABLE.

CRDCS upgrade not complete, ETA relays associated with each of the three regulating rod groups and the two ETA relays associated with the auxiliary power supply must be OPERABLE to satisfy the LCO. The ETA relays associated with the APSR power supply are not required to be OPERABLE because the APSRs are (for Unit(s) with the not designed to fall into the core upon initiation of a reactor trip.

CRDCS upgrade not complete)

Requiring all breakers and ETA relaysto be OPERABLE ensures that at least one device in each of the two power paths to the CRDs will remain OPERABLE even with a single failure.

APPLICABILITY The CRD trip devices shall be OPERABLE in MODES 1 and 2, and in MODES 3,4, and 5 when any CRD trip breaker is in the closed position and the CRD System is capable of rod withdrawal.

The CRD trip devices are designed to ensure that a reactor trip would occur if needed. Since this condition can exist in all of these MODES, the CRD trip devices shall be OPERABLE.

OCONEE UNITS 1, 2, & 3 B 3.3.4-3 Amendment Nos.430)309/,& 396j

CRD Trip Devices B 3.3.4 BASES (continued)

ACTIONS A Note has been added to the ACTIONS indicating separate Condition For Unit(s) with the entry is allowed for each CRD trip device.

CRDCS Upgrade complete, Condition A.1 and A.2 A applies when: One diverse trip Function Condition A represents reduced redundancy inthe CRD trip Function.

(undervoltage or Condition A applies when:

shunt trip device) is inoperable in one or

One diverse trip Function (undervoltage or shunt trip device) is more CRD trip inoperable in one or more CRD trip breaker(s) or breaker pair; or breaker(s). For Unit(s) with the . One diverse trip Function is inoperable in both DC trip breakers CRDCS Upgrade associated with one protective channel. In this case, the inoperable trip not complete, Function does not need to be the same for both breakers.

, ~~~ air If one of the diverse trip Functions on a CRD trip b (or breaker pair for becomes inoperable, actions must be taken to preclude the inoperable Unit(s) with the CRD trip device from preventing a reactor trip when needed. This is done CRDCS Upgrade not by manually tripping the inoperable CRD trip breaker or by removing power complete) from the inoperable CRD trip breaker. Either of these actions places the affected CRDs in a one-out-of-two trip configuration, which precludes a single failure from preventing a reactor trip. The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time has been shown to be acceptable through operating experience.

B.1 and B.2 Condition B represents a loss of redundancy for the CRD trip Function.

(or breaker pair for Condition B applies when both diverse trip Functions are inoperable in one Unit(s) with the or more trip breaker(s o re er as.

CRDCS Upgrade not complete) Required Action B.1 and Required Action B.2 are the same as Required Action A.1 and Required Action A.2, but the Completion Time is shortened.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time allowed to trip or remove power from the CRD trip breaker allows the operator to take all the appropriate actions for the inoperable breaker and still ensures that the risk involved is acceptable.

tC.1 and C.2 [CRDCS digital upgrade complete.l Condition C represents a loss of redundancy for the CRD trip Function.

Condition C applies when one or more ETA relays are inoperable. The preferred action is to restore the ETA relay to OPERABLE status. If this cannot be done, the operator can perform one of two actions to eliminate OCONEE UNITS 1,2, & 3 B 3.3.4-4 Amendment Nost3f, 30g,& 3O

January 15, 2004 Attachment 3 Technical Justification

January 15, 2004 Page 1 Attachment 3 Technical Justification Overview The existing relay based Control Rod Drive Control System (CRDCS) (refer to Figure 1 on page 10 for simplified diagram) is being upgraded to a solid-state programmable digital CRDCS to resolve obsolescence and age-related degradation issues.

A Technical Specification change is needed to reflect the new design.

This upgrade replaces the Control Rod Drive (CRD)/ Reactor Trip Breakers (RTBs), the electronics and controls contained in the CRD cabinets located in the Cable Room, and the Operator Control Panel (OCP) located in the Control Room.

These changes will address equipment obsolescence and enhance the reliability of the CRDCS through the extended life of Oconee Nuclear Station.

Duke requests the NRC to review and approve the Technical Specification change associated with the modification. Duke is implementing the modification using the 10 CFR 50.59 process.

Modification Details Description of New Control Rod Drive/Reactor Trip Breaker Design A reactor trip is initiated on both the old and new systems by removing power from the Control Rod Drive Mechanisms (CRDMs). The advantage of this design is that the only safety related components required are the CRDMs, which must be designed to release the Control Rods when power is removed, and the CRD/RTBs, which must open on command to remove power from the CRDMs.

The new digital Control Rod Drive Control System (CRDCS) will be powered from two independent power supplies. Each of these power supplies will connect to the digital CRDCS via two RTBs connected in series (refer to Figure 2 on page 11 for simplified diagram). This arrangement of parallel feeds,

January 15, 2004 Page 2 each with redundant breakers, operates in a one out of two taken twice configuration to interrupt power to the CRDMs.

This configuration is designed such that a single failure of any breaker, either in the open or closed position, will not cause or prevent a reactor trip.

These Reactor Trip Breakers (RTBs)(designated A, B, C and D) are actuated via Reactor Protective System (RPS) Channels A, B, C and D, respectively, and are considered Class E. The safety function of these breakers is to open upon command from the RPS. This action is performed by the RPS de-energizing a normally energized under voltage (UV) coil contained within the breaker resulting in the breaker opening. A diverse trip of the breakers is initiated in the RPS which de-energizes a relay which in turn energizes the shunt trip coils of these breakers which also results in the breaker opening Channel Independence The RPS is designed with four independent and redundant channels, each connected to one of four AC RTBs. The acceptability of the independence and redundancy of the RPS is assumed since this system will not be changed per this modification. The four replacement RTBs will be housed in two vertical assemblies of four cubicles each. The design function of the first vertical is to interrupt the train A power to the digital CRDCS and will consist of RTBs A and C connected in series. The design function of the second vertical is to interrupt train B power to the digital CRDCS and will consist of RTBs B and D connected in series.

Physical and electrical separation is maintained via the breaker assemblies being mounted in individual cubicles of the two Train related verticals. These verticals have been seismically qualified. Electrical separation between channels (breakers) is maintained by routing the RPS cabling to the breakers via conduit once it enters the vertical assemblies.

Since the under voltage trip assembly (UVTA) is actuated by cabling that runs external to the breaker cabinets, the effect of open and short circuited conductors was considered.

Either an open or short circuited conductor will result in a loss of voltage to the UVTA resulting in a breaker trip.

January 15, 2004 Page 3 Single Failure Criteria As a part of a protection system, the RTBs must meet IEEE-279,'Criteria for Protection Systems for Nuclear Power Plants". Also utilized during the design of the RTB replacement were IEEE-379, "Standard Application of the Single Failure Criterion to Nuclear Power Generating Class E Systems", USNRC Regulatory Guide (RG) 1.53, "Application of the Single Failure Criterion to Nuclear Power Plant Protection Systems." and USNRC RG 1.75, "Physical Independence of Electric Systems."

During normal operation all four of these breakers will be closed. When the RPS detects a condition necessitating a reactor trip, each RPS channel will send a trip signal to its respective RTB. Once this occurs there are only two possible responses from the reactor trip breaker assemblies, i.e., the breaker trips (the proper response) or the breaker does not trip (i.e., the single failure). This ensures that given a single RTB failure, the safety function of removing power to the CRDM's will be accomplished. There are no credible common cause or common mode failures that have been identified as part of the single failure analysis performed on the RTBs that would prevent this response. One common cause failure considered as part of the design was a seismic event that would result in a loss of geometry of the breaker cubicles. RTB failure to trip due to this type of common mode failure is precluded by the seismic qualification of the switchgear. A second cause of a common mode failure would be exposure to a harsh environment. This is not considered credible due the location of the breaker assemblies. A third common cause failure could be the result of EMI or RFI. This is not considered credible since the UVTA is inherently a low impedance device and thus not susceptible to this class of failure. Also the breakers do not use any embedded analog or digital devices to perform their trip function.

January 15, 2004 Page 4 Design Criteria The breakers are designed to meet the following criteria:

Rated for 600VAC (+/- 10%)

Rated for 600 Amp continuous

Maximum open time 80 ms

22,000 Amps fault at 635 VAC

UV coil dropout at minimum of 30% and pickup at maximum of 85% of rated voltage

Shunt trip shall operated correctly over the range of 88.7 to 134.6 VAC

Qualified life of breakers is to be 40 years without component replacement

Cyclic life shall be a minimum of 1500 cycles

Operating temperature range of 32 to 130 degrees F

Operating relative humidity range of 5% to 95%

Seismic Category l as defined by USNRC RG 1.29 "Seismic Design Classification"

Seismically qualified in accordance with IEEE 344-1975 and USNRC RG 1.100

ANSI C37.13 "Low voltage AC power circuit breakers and AC power circuit protectors"

ANSI C37.16 "Preferred ratings, related requirements and application recommendations for Low voltage Power Circuit Breakers and AC power Circuit Protectors"

ANSI C37.19 "Safety Requirements for Low Voltage AC Power Circuit Breakers and Switchgear Assemblies"

ANSI C37.50 "Test Procedures for Low Voltage AC Power Circuit Breakers used in Enclosures."

The new design is considered better than existing design in that the new Cutler Hammer DS II breakers are manufactured using a well developed and proven design. The breaker trip mechanism used is the same as contained in the Westinghouse DS I series breakers widely used as RTBs in the United States. The DS II trip breakers are an updated version of the successful line of DS I breakers. These new qualified breakers will be used to replace the original, obsolete, and increasingly difficult to maintain General Electric AK-15 and AK-25 breakers. Overall reliability of the system will be

January 15, 2004 Page 5 increased with the new equipment. The design function of the new equipment mimics the original and accomplishes the same function of removing power from the CRDM's, given a single failure, and drops all of the rods in the core. The existing design uses a larger parts count of active components (two AC breakers, four DC breakers and four Electronic Trip Assemblies) to accomplish the design basis requirements of the system. The new system is a much improved design, utilizing only four AC breakers, and reduced parts count, thereby reducing the susceptibility of the system to equipment failures and improving reliability. The number of breakers is reduced from 6 to 4 and the Electronic Trip Assemblies are removed.

This design is similar to the design currently used at Davis Besse. The Davis Besse design is shown as more reliable than the Oconee design in BAW-10167A, Supplement 3, "Justification for Increasing Reactor Trip System On-line Test Intervals."

The NRC Safety Evaluation Report for this topical was transmitted to Framatome Technologies, Inc. by letter dated January 7, 1998.

Description of Diverse Scram System (DSS) Design Duke reviewed commitments related to Anticipated Transient Without Scram (ATWS) design requirements and confirmed that implementation of the digital CRDCS will not negatively impact ATWS systems at Oconee. Duke provided the final design description for ATWS modification by letter dated August 30, 1989. The NRC provided the safety evaluation for the ATWS design by letter November 29, 1989.

The sensor and logic portions of the ATWS Mitigating System Actuation Circuitry (AMSAC)/DSS system will not be changed by this modification. The actuation portion of the DSS subsystem, which is contained within the digital CRDCS system, will change. The primary design requirement of the DSS system is that it be diverse from the RPS. The digital CRDCS will initiate a reactor trip, when commanded by DSS, by removing the gating pulses from the silicon controlled rectifiers (SCRs) that create the DC power necessary to energize the CRDM stators. None of the PLC's, solid state relays or single rod power supplies used to implement this

January 15, 2004 Page 6 function are used for any purpose in the RPS. The new DSS actuation design will be better than the current design in that it will use highly reliable triple modular redundant equipment to drop all of the control rods into the core. The current system uses obsolete and increasingly maintenance intensive original equipment to drop a portion of the rods into the core (groups 5, 6, and 7) upon actuation by DSS.

Reason for Modification The existing relay based CRDCS is being upgraded to a solid-state programmable digital CRDCS to resolve obsolescence, increased maintenance, and age-related degradation issues.

This modification will ensure reliable operation through the remainder of ONS license.

The new Trip Breaker arrangement allows direct correlation between the four Reactor Protection System (RPS) Trip Channels (A, B, C, and D) and the four new AC Trip Breakers (A, B, C, and D). This eliminates the present split between two 600 VAC Trip Breakers, four 120 VDC Trip Breakers (to the DC Hold Supply), and ten non-lE (non-safety) 120 VAC relays for the five redundant Group Power Supply Electronic Trip Assemblies. The new equipment does not use discrete Electronic Trip Assemblies, since they are no longer needed to address a single failure of an AC breaker as was the case on the old CRDCS. The digital CRDCS will allow for simplified surveillance testing, improved spare parts condition, a more direct safety analysis, and less overall exposure to failure due to industry proven reliability of TMR style solid-state devices.

The digital CRDCS eliminates the need for a static DC Hold Supply, four DC Trip Breakers, five Group Power Supplies (three Regulating, one APSR, and one Auxiliary), ETA's and a generally cumbersome array of clamping contactors, synchronizing circuits, transfer relays, stepping motors, ratcheting hardware, and otherwise technically obsolete and aging equipment. Hence, the reduction in parts count and the expectation of improved reliability is projected. The potential for operational missteps at the Operator Control Panel during rod transfer operations will be eliminated due to the elimination of power transfer requirements.

January 15, 2004 Page 7 A complete re-design of the Control Rod Drive System, including many new and improved control philosophies, has been made to ensure that the new design will improve reliability. Some of the enhancements are as follows:

The new system will provide a more reliable method of pulling safety rods by utilizing redundant fully functional power supplies and control for each rod (e.g.

safety, regulating and APSR).

The new design will allow the number of RTBs to be reduced from 6 to 4 and the existing ETA relays to be eliminated. On the new system the breakers will be aligned one for one with their respective RPS channels.

The new system will be designed with adequate redundancy to ensure that no credible single failure will either initiate or prevent a Reactor Trip Confirm output to trip the Turbine and Lockout the Generator and via an anticipatory trip to RPS, and trip the reactor.

The command logic of the CRDCS will be improved by using triple redundant processors. All input/output (I/O) will be processed via triple redundant I/O modules. The processing of position information will be performed independently from the command functions. Each triple-redundant processor will have an installed triple-redundant spare processor. All I/O modules can be 'Hot Swapped' without loss of function.

The logic on the new system will be enhanced to reduce unnecessary unit runbacks by requiring a loss of an out limit or an in limit on any control rod and receipt of an asymmetric rod fault.

The determination of Control Rod position indication will be greatly enhanced by using logic that will automatically select from two position indication inputs. This feature ensures the best value for position is used by processing data from three position indication inputs. The operator may manually select any

January 15, 2004 Page 8 input. Currently position indication is determined by manually selecting input from one of two indications.

Description of the Technical Specification Change and Technical Justification The proposed Technical Specification change revises TS 3.3.4 and TS Bases 3.1.4, 3.1.6, 3.1.7, and 3.3.4.

TS 3.3.4 - Control Rod Drive (CRD) Trip Devices The Limiting Condition for Operation (LCO) is partitioned into two parts to specify requirements based on the status of the CRDCS Digital Upgrade for each Oconee Unit. LCO 3.3.4.a requires that four AC CRD trip breakers be operable for Unit(s) with the Digital CRDCS Upgrade complete. LCO 3.3.4.b retains the existing requirements for Unit(s) with the CRDCS Digital Upgrade not complete. LCO Conditions A and B are modified to specify the Condition based on the status of the CRDCS Digital Upgrade. For Unit(s) with the CRDCS Digital Upgrade complete the Condition associated with a DC CRD trip breaker pair is eliminated since the breaker pairs are replaced with an AC trip breaker. This is accomplished by dividing the Condition into two parts with the second part only applying to Unit(s) with the CRDCS Digital Upgrade not complete. The Required Action and Completion Time associated with each Condition remains the same. For Unit(s) with the CRDCS Digital Upgrade complete, LCO Condition C no longer applies since the new system will not contain ETA's.

The associated Technical Specification Bases were revised to reflect the changes to the Technical Specifications.

After completion of the modification on all three units, Duke will request a Technical Specification change to remove obsolete requirements.

TS B 3.3.1, Reactor Protective System Instrumentation; TS B 3.3.2, Reactor Protective System Manual Trip; TS B 3.3.3, Reactor Protective System Reactor Trip Module; TS B 3.1.4, CONTROL ROD Group Alignment imits; TS B 3.1.6, Axial Power Shaping Rod (APSR) Alignment Limits; and TS B 3.1.7, Position Indicator Channels

January 15, 2004 Page 9 TS B 3.3.1, TS B 3.3.2, TS B 3.3.3, B 3.1.4, TS B 3.1.6 and TS B 3.1.7 are revised to reflect the design of Unit(s) with the CRDCS Digital Upgrade complete. This is accomplished by using the appropriate qualifiers where applicable (e.g., for Unit(s) with the CRDCS Digital Upgrade complete). A few minor clarifications were made to the existing TS Bases.

After completion of the modification on all three units, Duke will change the Bases appropriately to remove information related to CRDCS that existed prior to implementation of the DCRDCS modification.

January 15, 2004 Attachment 3 Page 10 FIGURE 1 EXISTING CRDCS A Train Reactor Trip Switch B Train AC AC Breaker Breaker Unit 10 RPS A RPS B Unit 11 600 VAC, 30 600 VAC, 30P RPS C RPS D 120 VAC, 60 120 VAC, 60 C D DC DC Breakers Breakers

January 15, 2004 Attachment 3 Page 11 FIGURE 2 NEW DCRDCS A Train Reactor Trip Switch B Train A - RPS A B C ---- RPS C .RPS D - - D 600 VAC, 30) 600 VAC, 340 NM AM I.

SRPS A 120 VAC, 60P Control TMR Controller (PLC) Control 120 VAC, 60)

SRPS B (69) Gate Gate l Drive (69) 125 VDC 60P Drive, 125 VDC 60)

I.

E Trip I

i J -- I i I F Trip I pSS A DSS B 4 Pole, 6 0D CRDM Stepping Motor (69)

January 15, 2004 ATTACHMENT 4 NO SIGNIFICANT HAZARDS CONSIDERATION

January 15, 2004 Page 1 Attachment 4 No Significant Hazards Consideration Pursuant to 10 CFR 50.91, Duke Energy Corporation (Duke) has made the determination that this amendment request involves a No Significant Hazards Consideration by applying the standards established by the NRC regulations in 10 CFR 50.92.

This ensures that operation of the facility in accordance with the proposed amendment would not:

(1) Involve a significant increase in the probability or consequences of an accident previously evaluated:

The proposed LAR modifies the Technical Specifications to incorporate new TS requirements associated with the new Digital Control Rod Drive Control System (CRDCS) configuration. The proposed LAR will continue to ensure that the CRD trip devices will be operable to ensure that the reactor remains capable of being tripped at any time it is critical. Reliable CRD reactor trip circuit breakers and associated support circuitry provides assurance that a reactor trip will occur when initiated.

The planned modification upgrades the existing CRDCS to a solid-state programmable Digital CRDCS using Single Rod Power Supplies (SRPS) assigned to each of 69 Control Rod Drives (CRD). The new components will have the same seismic and quality group qualifications as the existing components in the CRDCS system. The Digital CRDCS modification will enhance the reliability of the system by resolving age-related degradation issues and replacing obsolete equipment. Therefore, the proposed LAR does not involve a significant increase in the probability or consequences of an accident previously evaluated.

(2) Create the possibility of a new or different kind of accident from any kind of accident previously evaluated:

The proposed LAR modifies the Technical Specifications to incorporate new TS requirements associated with the new DCRDCS configuration. The systems affected by implementing the proposed changes to the TS are not assumed to initiate design basis accidents. Rather, the systems affected by the changes are used to mitigate the

January 15, 2004 Page 2 consequences of an accident that has already occurred.

The proposed TS changes do not affect the mitigating function of these systems. The reliability of the mitigating systems will be improved by implementation of the Digital CRDCS Upgrade. Consequently, these changes do not alter the nature of events postulated in the Safety Analysis Report nor do they introduce any unique precursor mechanisms. Therefore, the proposed amendment will not create the possibility of a new or different kind of accident from any accident previously evaluated.

(3) Involve a significant reduction in a margin of safety.

The proposed TS changes do not unfavorably affect any plant safety limits, set points, or design parameters.

The changes also do not unfavorably affect the fuel, fuel cladding, RCS, or containment integrity. Therefore, the proposed TS change, which adds TS requirements associated with the digital CRDCS upgrade, do not involve a significant reduction in the margin of safety.

Duke has concluded, based on the above, that there are no significant hazards considerations involved in this amendment request.

January 15, 2004 ATTACHMENT 5 ENVIRONMENTAL ASSESSMENT

January 15, 2004 Page 1 ATTACHMENT 5 Environmental Assessment Pursuant to 10 CFR 51.22(b), an evaluation of the license amendment request (LAR) has been performed to determine whether or not it meets the criteria for categorical exclusion set forth in 10 CFR 51.22(c)9 of the regulations.

The LAR does not involve:

1) A significant hazards consideration.

This conclusion is supported by the determination of no significant hazards contained in Attachment 4.

2) A significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

This LAR will not change the types or amounts of any effluents that may be released offsite.

3) A significant increase in the individual or cumulative occupational radiation exposure.

This LAR will not increase the individual or cumulative occupational radiation exposure.

In summary, this LAR meets the criteria set forth in 10 CFR 51.22 (c)9 of the regulations for categorical exclusion from an environmental impact statement.

v t e Letter Sequence Request
TAC:MC1785, (Open)
Initiation Request, Request Acceptance... Administration Meeting, Meeting Questions Answers Results Approval... Other: ML042820458, ML043080290
MONTHYEAR2004-02-25 [Table View]

ML040290115

Text

Subject:

Navigation menu

Search