ML072070251
| ML072070251 | |
| Person / Time | |
|---|---|
| Site: | Technical Specifications Task Force |
| Issue date: | 07/25/2007 |
| From: | Kobetz T NRC/NRR/ADRO/DIRS/ITSB |
| To: | Technical Specifications Task Force |
| Schulten C. S., NRR/DIRS, 415-1192 | |
| Shared Package | |
| ML072070202 | List: |
| References | |
| TAC MD5249, TSTF-493, Rev 2 | |
| Download: ML072070251 (16) | |
Text
TSTF-493, Rev. 2 Page 1 1.0 Description During public meetings and as part of license amendments, the NRC staff has been discussing the use technical specifications (TSs) allowable values (AVs) to meet the requirements of 10 CFR 50.36(c)(1)(ii)(A) for Limiting Safety System Settings (LSSS). Many licensees use AVs as the as-found LSSS. This means that licensees perform periodic surveillance requirements (SRs) and use the Allowable Value (AV) to verify that the safety limit (SL) is protected and that the channel is operable. If the AV is exceeded during periodic surveillance testing, the instrument is declared inoperable because there is not adequate assurance that the instrument will perform its safety function, and appropriate TS-required action must be taken.
10 CFR 50.36(c)(1)(ii)(A) requires that TSs include LSSSs for variables that have significant safety functions. For variables on which a SL has been placed, the LSSS must be chosen to initiate automatic protective action to correct abnormal situations before the SL is exceeded. Many licensees have TSs that specifyspecifies an AV as the LSSSs. During periodic surveillances, no actions are required by TSs (e.g., resetting) as long as the results indicate that the as-found instrument setting is conservative with respect to the AV. Many licensees rely on administrative controls to reset the instrument trip setpoint to the [Limiting Trip Setpoint (LTSP)] or to a value more conservative than LTSP (e.g., Nominal Trip Setpoint ) at the conclusion of periodic testing, but these controls are given in documents other than the TSs. However, if the instrument setting is not left within the setting tolerance of the [LTSP] or a value that is conservative with respect to the [LTSP], then there may not be assurance that the SL will be protected until the next periodic surveillance because instrument drift and other changes in setpoint can occur. These uncertainties are accounted for in the calculation of the [LTSP]. It is the NRC staffs position that the [LTSP] protects the SL.
Limiting trip setpoint (LTSP)
The LTSP is the limiting setting for the channel trip setpoint considering all credible instrument errors associated with the instrument channel. The LTSP is the limiting value to which the channel must be reset at the conclusion of periodic testing to ensure the SL will not be exceeded if a design basis event occurs before the next periodic surveillance or calibration.
Nominal trip setpoint (NTSP)
The NTSP is the trip setpoint value selected by the licensee for plant operations. The NTSP must be equal to or more conservative than the LTSP.
Allowable value (AV)
An AV is a limiting value of an instrument channel as-found trip setpoint setting used during surveillance testing.
The [LTSP] is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit and thus ensuring that the SL would not be exceeded. As such, the [LTSP] accounts for uncertainties in setting the device (e.g., calibration), uncertainties in how the device might actually perform (e.g.,
repeatability), changes in the point of action of the device over time (e.g., drift during
TSTF-493, Rev. 2 Page 2 surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, setting the protective device at the
[LTSP] and resetting the device to the [LTSP] following periodic testing ensures that SLs are not exceeded. As such, the [LTSP] meets the definition of a LSSS. It is the NRC staffs position that the [LTSP] is the LSSS required by10 CFR 50.36(c)(1)(ii)(A) to protect the SL.
In addition, 10 CFR 50.36(c)(1)(ii)(A) requires a licensee to take appropriate action if it is determined that the automatic safety system does not function as required to protect the SL.
If the channel is set to a nominal trip setpoint that is more conservative than the [LTSP] then abnormally large changes in the setpoint have to occur between surveillance test intervals to indicate the channel is malfunctioning. Such setpoint changes may not exceed the AV because of the added conservatism between the LTSP and the nominal trip setpoint..
Under these conditions, operators consulting the TSs might conclude that the instrument is operable because the as-found trip setpoint is more conservative than the AV, even though the instrument is not functioning as predicted by the instrument setpoint methodology and may not be capable of protecting the SL.
As one measure of instrument operability, the NRC staff expects licensees to verify during testing or calibration that the change in the measured trip setpoint since the last test or calibration is within predefined limits (double-sided acceptance criteria band) and to take appropriate actions if the change is outside these limits. The acceptance criteria band should be derived from the licensees setpoint methodology, including use of generic or plant-specific data. If the as-found trip setpoint exceeds the AV in TSs the channel is inoperable and the associated action requirements are followed. If the change in the measured trip setpoint exceeds the predefined limits but the measured trip setpoint is conservative with respect to the AV, and the licensee determines during the surveillance that the instrument channel is functioning as expected and can reset the channel to within the setting tolerance (amount by which as-left setting value is permitted to differ from nominal trip setpoint) of the nominal trip setpoint, then the licensee may restore the channel to service and the condition is entered into the licensees corrective action program for further evaluation. However, if during the surveillance the change in the measured trip setpoint exceeds the predefined limits and the licensee cannot determine that the instrument channel is functioning as required, then the instrument is declared inoperable and the associated TS actions are followed. It is NRC staffs position that verifying that the as-found trip setpoint is within the acceptance band limits during test or calibration is part of the determination that an instrument is functioning as required.
10 CFR 50.36(c)(1)(ii)(A) also contains requirements for a general class of LSSSs; LSSSs related to variables having significant safety functions but which do not protect SLs. All plant operating licenses have TSs for LSSSs that are not related to SLs. For these LSSSs, 10 CFR 50.36(c)(1)(ii)(A) also requires that a licensee take appropriate action if it is determined that the automatic safety system does not function as required. Additionally, 10 CFR Part 50, Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," requires safety-related structures, systems, and components must also perform satisfactorily in service, i.e., the settings must initiate automatic protective actions consistent with the design basis. At the completion of surveillance testing, resetting the trip setpoint to within the setting tolerance of the LTSP or to a value more conservative than the LTSP would ensure that LSSSs for instrument functions not related to SLs perform their specified safety functions. Additionally, when evaluating the as-found trip setpoint, operability should be determined based on the plant-specific setpoint methodology, (including consideration of the expected uncertainties in the instrument setpoint
TSTF-493, Rev. 2 Page 3 determination) to ensure that automatic protective devices will perform their specified safety function.
The proposed change revises SRs Surveillance Requirements (SR)s to address NRC concerns that the tTechnical sSpecification (TS) requirements for Limiting Safety System Settings (LSSSs) that protect the Rreactor Ccore Safety Limits or the Reactor Coolant System (RCS) Pressure pressure boundary Safety Limit Safety Limits (herein referred to as "SL-LSSS"), may not be fully in compliance with the intent of 10 CFR 50.36. TSTF-493 provides a readily adoptable approach to ensure that the TSs conform to the requirements of 10 CFR 50.36.
Specifically, the NRC is concerned that the existing Surveillance Requirements do not provide adequate assurance that instruments will always actuate safety functions at the point assumed in the applicable safety analysis. W hile the industry does not share the NRC's concern, this Traveler represents a compromise agreement to address the issue.
2.0 Proposed Change The location of Notes used to identify potential SL-LSSS in this TSTF varies depending on the format of the vendor TS. Two Notes are added to the Surveillance Requirements associated with potential SL-LSSS Functions in the Surveillance Requirements column in the specification's Function table. If the specification does not contain a Function table with a Surveillance Requirements column, the Notes are added to the table's Allowable Value column. If the specification does not include a Function table, then the Notes are added to the applicable Surveillance Requirement.
Notes are added to SRs that verify trip setpoint settings. Surveillance requirement s having notes will varyies due to vendor-specific testing requirements. In NUREG-1430, 1432, 1433, and 1434, the Notes are added to the Channel Calibration Surveillance Requirements, and to Channel Functional Test Surveillance Requirements that verify trip setpoints. In NUREG-1431, the Notes are added to the Channel Calibration, Channel Operational Test (COT), and Trip Actuation Device Operation Test (TADOT) Surveillance Requirements that verify trip setpoints.
The two Notes added to surveillance requirements are:
Note 1:
If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.
Note 2:
The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the [Limiting Trip Setpoint (LTSP) or Nominal Trip Setpoint (NTSP)] at the completion of the surveillance; otherwise, the channel shall be declared inoperable. Setpoints more conservative than the [LTSP or NTSP] are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the Surveillance procedures to confirm channel performance. The [Limiting Trip Setpoint or Nominal Trip Setpoint] and the]
methodologies used to determine the as-found and the as-left tolerances are specified in [the Bases][insert the name of a document controlled under 10 CFR
TSTF-493, Rev. 2 Page 4 50.59 such as the Technical Requirements Manual or any document incorporated into the facility FSAR].
In NUREG-1430, 1432, 1433, and 1434, the Technical Specifications Function tables contain the Allowable Value. These specifications are referred to as having the "single column" format. In NUREG-1431, the option is given to list only the Allowable Value or to list the Allowable Value and the [Nominal Trip Setpoint (NTSP)]. This is referred to as the "multiple columncolumns" format and in this presentation,presentation; the [NTSP] is the LSSS. Those plants that utilize the "multiple column" format are not required to incorporate the NTSP value in the last sentence in Note 2 because any change to the value requires prior NRC review and the values cannot be changed by the licensee under 10 CFR 50.59.
For plants that specify the [NTSP] or [LTSP] instead of the Allowable Value, the same restrictions apply and the identification of the [LTSP] or [NTSP] in the last sentence in Note 2 is not required.
Notes 1 and 2 are applied to Functions which are Safety Limit Limiting Safety System Settings (SL-LSSS), considering the definition and exclusion criteria given below.
SL-LSSS are defined as:
"Trip Setpoints for Functions which provide automatic trips that directly protect against violating the Reactor Ccore Safety Limits and the Reactor Coolant System (RCS) pressure boundary Safety Limits during anticipated operational occurrences (AOOs) are Safety Limit Limiting Safety System Settings (SL-LSSS). Permissive and interlock setpoints allow bypass of trips when they are not required by the Safety Analysis. These permissives and interlocks ensure that the starting conditions are consistent with the safety analysis, before preventative or mitigating actions occur. Because these permissives or interlocks are only one of multiple conservative starting assumptions for the accident analysis, they are generally considered as nominal values without regard to measurement accuracy, (i.e. the value indicated is sufficiently close to the necessary value to ensure proper operation of the safety systems to turn the AOO. Therefore permissives and interlocks are not considered to be SL-LSSS.
Notes 1 and 2 are applied to the indicated sSurveillances requirements for all SL-LSSS Functions unless one or more of the following exclusions apply:
1.
Notes 1 and 2 are not applied to SL-LSSS Functions which utilize mechanical components to sense the trip setpoint or to manual initiation circuits (the latter are not explicitly modeled in the accident analysis). Examples of mechanical components are limit switches, float switches, proximity detectors, manual actuation switches, and other such devices that are normally only checked on a "go/no go" basis. Note 1 requires a comparison of the periodic surveillance requirement results to provide an indication of channel (or individual device) performance. This comparison is not valid for most mechanical components. While it is possible to verify that a limit switch functions at a point of travel, a change in the surveillance result probably indicates that the switch has moved, not that the input/output relationship has changed. Therefore, a comparison of surveillance requirement results would not provide an indication of the channel or component performance.
2.
Notes 1 and 2 are not applied to Technical Specifications associated with mechanically operated safety relief valves. The performance of these components is already
TSTF-493, Rev. 2 Page 5 controlled (i.e., trended with as-left and as-found limits) under the ASME Section XI testing program.
3.
Notes 1 and 2 are not applied to SL-LSSS Functions and Surveillances which test only digital components. For purely digital components, such as actuation logic circuits and associated relays, there is no expected change in result between surveillance performances other than measurement and test errors (M&TE) and, therefore, comparison of Surveillance results does not provide an indication of channel or component performance.
An evaluation of the potential SL-LSSS Functions resulted in Notes 1 and 2 being applied to the Functions shown in the TS markups. Each licensee proposing to fully adopt this TSTF must review the the potential SLpotential SL-LSSS Functions to identify which of theof the identified functions are SLare SL-LSSS according to the definition of SL-LSSS and their plant specific safety analysis. The two TSTF Notes are not required to be applied to any of the listed Functions which meet any of the exclusion criteria or are not SL-LSSS based on the plant specific design and analysis.
The Bases are revised to reflect the addition of the Notes to the applicable SL-LSSS Functions. The Bases are also revised to define the term "Limiting Trip Setpoint," and to discuss the relationship of the LSSS to other values, such as the Allowable Value, [NTSP],
and [LTSP]. The Bases provide details on the implementation of the requirements described in the Notes and the relationship between the as-found value and Function Operability. W here necessary to provide context for the other changes, a description of the use of [LTSP] and Allowable Value is added to the Specification Bases, similar to the discussion in the reactor trip system Specification Bases.
Throughout this document and the proposed TS changes, the terms "Limiting Trip Setpoint" and "Nominal Trip Setpoint" and their abbreviations, "LTSP" and "NTSP" are shown in brackets (e.g., "[LTSP]"). A Reviewer's Note is added to the Bases indicating that the term "Limiting Trip Setpoint" may be replaced in the Technical Specifications and in the Bases by a term (e.g. NTSP) consistent with the plant-specific setpoint methodology.
3.0 Background Plant protective systems are designed to initiate reactor trips (scrams) or other protective actions when before selected unit parameters exceed Analytical Limits assumed in the safety analysis in order to prevent violation of the rReactor Ccore Safety Limits and RCS Pressure Safety Limit s from postulated Anticipated Operational Occurrences (AOOs). The Rreactor Ccore Safety Limits and RCS Pressure Safety Limits ensure the integrity of the are determined based on protecting reactor core and RCS are maintained.
The instrumentation required by the Technical Specifications has been designed to assure that the applicable safety analysis limits will not be exceeded during AOOs. This is achieved by specifying [LTSPs ] in terms of parameters directly monitored by the applicable instrumentation systems for LSSSs, as well as specifying Limiting Conditions for Operation (LCOs) on other plant parameters and equipment.
TSTF-493, Rev. 2 Page 6 10 CFR 50.36(c)(1) states:
"(1) Safety limits, limiting safety system settings, and limiting control settings."
"(i)(A) Safety limits for nuclear reactors are limits upon important process variables that are found to be necessary to reasonably protect the integrity of certain of the physical barriers that guard against the uncontrolled release of radioactivity. If any safety limit is exceeded, the reactor must be shut down."
"(ii)(A) Limiting safety system settings for nuclear reactors are settings for automatic protective devices related to those variables having significant safety functions. W here a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded. If, during operation, it is determined that the automatic safety system does not function as required, the licensee shall take appropriate action, which may include shutting down the reactor."
Safety analysis calculations provide a conservative analysis of postulated events to demonstrate that the applicable plant limits are not exceeded. For AOOs, the event limits include the rReactor Ccore Safety Limits and RCS Pressure Safety Limits.
The "Allowable Value" is more conservative than the Analytical Limit to account for applicable instrument measurement errors consistent with the plant specific setpoint methodology. If during testing, the actual instrumentation setting is less conservative than the Allowable Value, the channel is declared inoperable and actions must be taken consistent with the Technical Specification requirement.
The "[LTSP]" is more conservative than the Allowable Value and is the nominal value to which the instrument channel is adjusted to actuate. It is impossible to set a physical instrument channel to an exact value, so a calibration tolerance is established around the trip setpoint[LTSP]. Therefore, the trip setpoint[LTSP] is considered a nominal value and the instrument adjustment is considered successful if the as-left instrument setting is within the tolerance (a range of values) around the [LTSP]).
The "[Limiting Trip Setpoint (LTSP)]" is the limiting setting for the channel trip setpoint (TSP) considering all credible instrument errors associated with the instrument channel. The
[LTSP] is the least conservative value (with an as-left tolerance) to which the channel may must be reset at the conclusion of periodic testing to ensure that the Safety Limit (SL) will not be exceeded during an AOO before the next periodic surveillance or calibration.
The "Nominal Trip Setpoint (NTSP)" is the Limiting Trip Setpoint with margin added. The
[NTSP] is always equal to or more conservative than the [LTSP].
In September 2002, during review of a plant-specific license amendment request, the NRC expressed a concern that the Allowable Values calculated using some methods in the industry standard ISA-S67.04-1994 Part II "Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation," (Reference 1) could be non-conservative depending upon the evaluation of instrument performance history and the as-left requirements of the calibration procedures which have an adverse effect on equipment operability. In the intervening period, the industry and the NRC have worked together to develop requirements that will ensure that instrument channels will actuate safety systems
TSTF-493, Rev. 2 Page 7 to perform their preventive or mitigation functions as assumed in the accident analysis. The complete history is described in Appendix A.
The industry group on setpoint methods proposed NRC determined that seven concepts needed to be addressed to ensure that the instrument channels will function as required.
These concepts (paraphrased from an NEI to NRC letter dated May 18, 2005, therefore brackets are not used) are:
1.
The LTSP must be calculated consistent with the plant-specific methodology. The LTSP is the expected value for the trip. The as-left and as-found values may be less conservative than the LTSP by predefined tolerances (which are factored into the trip setpoint calculation).
2.
The as-found trip setpoint must be verified to be within predefined double-sided limits that are based on the actual expected errors between calibrations. Finding the as-found trip setpoint outside these limits warrants additional evaluation and potential corrective action, as necessary, to ensure continued performance of the specified safety function.
Normally, the as-found tolerance will be equivalent to the errors verified during the surveillance (e.g. Reference Accuracy (RA), drift, and measurement and test equipment (M&TE) accuracy/errors.)
3.
The Nominal Trip Setpoint must be reset or left within the as-left tolerance at the end of every surveillance that requires setpoint verification. The ability to reset the setpoint represents continued confidence that the channel can perform its intended safety function. The as-left tolerance may include the reference accuracy, M&TE accuracy and readability uncertainties.
4.
The Nominal Trip Setpoint may be set more conservative than the LTSP. If the Nominal Trip Setpoint is set more conservative than the LTSP, the as-found and as-left tolerances will be maintained around the more conservative Nominal Trip Setpoint 5.
The Allowable Value (defined as the least conservative acceptable as-found surveillance value of the [LTSP]) defines the maximum possible value for process measurement at which the Analytical Limit is protected. The Allowable Value verifies that the Analytical Limit and Safety Limit are still protected at the time of the surveillance. Since OPERABILITY of the instrument channel is determined at the time of the surveillance performance, the fact that the tested trip point occurred conservative to the Allowable Value and the setpoint is reset to the [LTSP] (within the as-left tolerance), and that the channel's response evaluated, ensures that at that point in time the channel would have functioned to protect the Analytical Limit and is OPERABLE. W ith the implementation of these concepts, calculation of the Allowable Value using any of the ISA S67.04 Part II methods is acceptable. The Allowable Value is documented in the Technical Specifications and is in accordance with the normal rules of the Improved Standard Technical Specifications and is consistent with current practices.
6.
For those W estinghouse NSSS plants whose plant-specific Technical Specifications contain Allowable Value and Nominal Trip Setpoint columns, the Nominal Trip Setpoint identified in the Technical Specifications is expected to be the NTSP for the channel.
7.
W hen a channel's as-found value is conservative to the Allowable Value but the setpoint is outside the as-found tolerance, the channel may be degraded and may not conform to
TSTF-493, Rev. 2 Page 8 the assumptions in the design basis calculation. Prior to returning the channel to service, there shall be a determination utilizing available information to ensure that the channel can perform as expected. For example, this determination may include an evaluation of magnitude of change per unit time, response of instrument for reset, previous history, etc., to provide confidence that the channel will perform its specified safety function. This determination, combined with resetting the trip setpoint to within the as-left tolerance, permits the channel to be returned to service.
Each of these items is addressed by the proposed changes. Items 1 through 6 result in changes to the Technical Specifications or Bases. To address Item 7, the revised Bases require that when a channel's as-found value is outside the as-found tolerance, the potentially degraded instrument must be entered into the licensee's corrective action program. The corrective action program evaluation is expected to be performed promptly to validate the determination that was performed prior to returning the channel to service and to confirm that the channel is Operable and performing as expected. The licensee's corrective action program will be used to track or trend these instruments.
4.0 Technical Analysis The proposed change satisfies the NRC's concerns through the addition of Notes to the Technical Specification SL-LSSS Functions and changes to the Technical Specification Bases.
Addition of Notes 1 and 2 to the SL-LSSS Functions There are two Notes added to the Technical Specifications to address the concepts described in the Background section.
Note 1states:
"If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service."
Setpoint calculations determine an [LTSP] based on the Analytical Limit, which ensures that trips will occur prior to the process parameter exceeding the Safety Limit as required by the Safety Analysis calculations. These setpoint calculations may also calculate an allowable limit of change expected (as-found tolerance) between performance of the surveillance tests that monitor the trip setpoint value. The least conservative value of the as-found instrument setting that a channel can have during calibration without a required Technical Specification action is the Allowable Value. Finding a plant setting less conservative than the Allowable Value (AV) indicates that there may not be sufficient margin to the Analytical Limit. Current Channel Calibrations, Channel Functional Tests (with setpoint verification), Trip Unit Calibrations, COTs, and TADOTs (with setpoint verification) are performed to demonstrate compliance with the Allowable Values in the Technical Specifications. W hen the measured as-found setpoint is non-conservative with respect to the Allowable Value, the channel is inoperable and the actions identified in the Technical Specifications must be taken.
Verification that the trip setting is conservative with respect to the AV when a Surveillance is performed does not necessarily verify proper operation of the channel instruments in the
TSTF-493, Rev. 2 Page 9 future. Although the channel was Operable during the previous surveillance interval, when channel performance is outside the performance predicted by the plant setpoint calculations, the design basis for the channel may not be met, and proper operation of the channel on a future demand is not assured. Note 1 will formalize the establishment of an as-found tolerance for each appropriate channel. This as-found tolerance will exist around the [LTSP]
or around any more conservative setpoint that the plant chooses to implement. The tolerance will ensure that channel operation is consistent with the assumptions or design inputs used in the setpoint calculations and that there is a high confidence of acceptable channel performance in the future. Because the tolerance is two sided, changes in channel performance that are conservative will also be detected and evaluated for possible effects on expected performance.
Implementation of Note 1 requires the licensee to calculate an as-found tolerance. One acceptable method of calculating the as-found tolerance is the Square Root Sum of the Squares (SRSS) combination of either a) Reference Accuracy (RA), Measurement and Test Equipment (M&TE) error, M&TE readability (M&TEr) and projected drift, or b) as-left tolerance and the projected drift (assuming that as-left tolerance is < SRSS combination of RA, M&TE error, M&TEr). Different methods of calculating the as-found tolerance (including the inclusion of additional uncertainties (e.g., normal radiation effect, temperature effect between calibrations, capillary tubing error) may be acceptable. Alternate methods must result in an as-found tolerance that is small enough to detect abnormal channel performance. Any additional uncertainties included in the as-found tolerance calculation must be justified.
Verification that the measured setpoint is within the as-found tolerance is determined by calculating the difference between the current as-found value and the [Limiting Trip Setpoint]
or by calculating the difference between the current as-found value and the previous as-left value. In order to use the as-found minus [LTSP] methodology, the as-left tolerance must be less than or equal to the SRSS combination of the RA, M&TE, and M&TE readability.
The methodology used to determine the as-found and as-left tolerance must be stated in the document controlled under 10 CFR 50.59 referenced in Note 2, as described below.
The Bases state that a determination that the instrument is functioning as required must be performed prior to returning the channel to service (within the capabilities of the technician performing the testing) when the channel is found conservative with respect to the Allowable Value but outside the predefined tolerance (as-found tolerance). This determination will consider whether the instrument is degraded or is capable of being reset and performing its specified safety function. If the channel is determined to be functioning as required, (i.e., the channel can be adjusted to within the as-left tolerance and is determined to be functioning normally based on the determination performed prior to returning the channel to service),
then the licensee must also perform an independent prompt verification that the instrument is functioning as required.
During the process of checking the setpoint there are four possible results in best case to worst case order:
1.
The setpoint is found within the as-left tolerance; the results are recorded in the procedure, and the Technical Specifications require no further action.
TSTF-493, Rev. 2 Page 10 2.
The setpoint is outside the as-left tolerance but within the as-found tolerance; the setpoint is reset to within the as-left tolerance, and the Technical Specifications require no further action.
3.
The setpoint is found conservative to the Allowable Value but outside the as-found tolerance. In this case the channel is Operable a degraded condition has been identified and the channel's as-found condition will be entered into the Corrective Action Program for further evaluation., Tthe setpoint is must be reset to the [LTSP] (within the as-left tolerance), and the channel's response evaluated. If the channel is functioning as required and expected to pass the next surveillance, then the channel is Operable and can be restored to service at the completion of the surveillance. A prompt verification of the channel's condition will may need to be performed after the surveillance. After the surveillance is completed, if additional information is needed to confirm the reasonable expectation that the channel is operable. the channel's as-found condition will be entered into the Corrective Action Program for further evaluation. If the channel is not functioning as required, the channel is inoperable since degraded because it may not pass its next surveillance test.
4.
The setpoint is found non-conservative to the Allowable Value; the channel is inoperable until the setpoint is reset to the [LTSP] (within the as-left tolerance), and any evaluations necessary to return the channel to service are completed.
Note 2 states:
"The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the [Limiting Trip Setpoint (LTSP) or Nominal Trip Setpoint (NTSP)] at the completion of the surveillance; otherwise, the channel shall be declared inoperable.
Setpoints more conservative than the [LTSP or NTSP] are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the Surveillance procedures to confirm channel performance. The [Limiting Trip Setpoint or Nominal Trip Setpoint and the] methodologies used to determine the as-found and the as-left tolerances are specified in [a document controlled under 10 CFR 50.59]."
Setpoint calculations assume that the instrument setpoint is left at the [LTSP] within a specific as-left tolerance (e.g., 25 psig + 2 psig). A tolerance is necessary because no device perfectly measures the process. Additionally, it is not possible to read and adjust a setting to an absolute value due to the readability and/or accuracy of the test instruments or the ability to adjust potentiometers. The as-left tolerance is normally as small as possible considering the tools and ALARA concerns of the calibration. The as-left tolerance is always considered in the setpoint calculation. Failure to set the actual plant trip setpoint to the [LTSP] (or more conservative than the [LTSP]), and within the as-left tolerance, would invalidate the assumptions in the setpoint calculation because any subsequent instrument drift would not start from the expected as-left setpoint.
The NRC Staff is concerned that some plants may have used as-left tolerances much larger than necessary for proper reading and adjustment of the channels. In this situation, the large tolerances could prevent or mask detection of instrument degradation or failure.
However, large as-left tolerances do have the advantage of minimizing the number of times that a channel must be adjusted, and can provide a true indication of long term instrument performance if the results are trended using "as-found minus as-left" techniques.
TSTF-493, Rev. 2 Page 11 Implementation of Note 2 may require some licensees to recalculate the as-left tolerance for some channels to ensure that realistic values are used that do not mask instrument performance.
10 CFR 50.36(c)(1)(ii)(A) requires that the LSSS be included in Technical Specifications.
The [LTSP] is the LSSS required by 10 CFR 50.36(c)(1)(ii)(A). The Allowable Value may still be the only value included in the Technical Specifications to indicate the least conservative value that the as-found setpoint may have during testing. However, iIn this case the [LTSP] values must be contained in a document controlled under 10 CFR 50.59, such as the UFSAR, and the title of this document must be identified in Note 2 in order to satisfy the 10 CFR 50.36 requirement that the LSSS be in the Technical Specifications.
Additionally, to ensure proper use of the Allowable Value, [Limiting Trip Setpoints,] and actual plant trip setpoints, the methodology for calculating the as-left and as-found tolerances, as discussed above, must also be included in a document controlled under 10 CFR 50.59 listed in Note 2.
For TS with a multiple column format which lists the [NTSP] (as shown as an option in NUREG-1431), the last sentence of Note 2 is modified to remove the requirement that the
[NTSP] be identified in a 10 CFR 50.59 controlled document. If the [NTSP] is specified in the Technical Specifications, any change to the [NTSP] requires prior NRC review and approval. As a result, it is not necessary for the [NTSP] to be specified in a document controlled under 10 CFR 50.59. It will still be necessary to identify the methodologies used to determine the as-found and the as-left tolerances in a document controlled under 10 CFR 50.59 and identify this document in Note 2.
Addition of the Definition of "Limiting Safety System Setting" to the Bases The Technical Specifications Bases previously defined the Allowable Value as representing the LSSS in the Specifications because this is the value that verified that the Analytical Limit is protected during surveillance testing. This revision designates the [Limiting Trip Setpoint or the Nominal Trip Setpoint] as the Limiting Safety System Setting. This setpoint ensures that the Safety Limit is protected.
Addition of the Definition of "Limiting Trip Setpoint" to the Bases The term "[Limiting Trip Setpoint]" is added as generic terminology for the setpoint value calculated by means of the plant-specific setpoint methodology documented in a document controlled under 10 CFR 50.59, such as the UFSAR. The trip setpoint (field setting) may be more conservative than the Limiting or Nominal Trip Setpoint, but for the purpose of Technical Specifications compliance with 10 CFR 50.36, the plant-specific value for the LSSS must be in the specifications or contained in a document controlled under 10 CFR 50.59.
The application of the plant setpoint methodology defines the [LTSP] is defined as the LSSS in accordance with 10 CFR 50.36. Instead of referencing the title of the document that contains the [LTSPs] in Note 2, it is also acceptable to list the [LTSPs] directly in the Technical Specifications, and revise Note 2 to only identify the title of the document that describes the methodology for determining the as-found and as-left tolerances.
TSTF-493, Rev. 2 Page 12 Addition of the Definition of "Safety Limit Limiting Safety System Setting (SL-LSSS)" to the Bases
TSTF-493, Rev. 2 Page 13 The term "Safety Limit Limiting Safety System Setting (SL-LSSS)" is added as generic terminology to identify Trip Setpoints for Functions which provide automatic trips that directly protect the Safety Limits for the rReactor Ccore Safety Limits or the and for RCS Ppressure Safety Limit boundary during Anticipated Operational Occurrences. Permissive and interlock Functions are not SL-LSSS functions because they do not function as part of the reactor trip or ESF automatic actuation systems and are not explicitly modeled in the accident analyses.
5.0 Regulatory Analysis 5.1 No Significant Hazards Consideration The TSTF has evaluated whether or not a significant hazards consideration is involved with the proposed generic change by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:
1.
Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?
Response: No.
The proposed change clarifies the requirements for instrumentation to ensure the instrumentation will actuate as assumed in the safety analysis. Instruments are not an assumed initiator of any accident previously evaluated. As a result, the proposed change will not increase the probability of an accident previously evaluated. The proposed change will ensure that the instruments actuate as assumed to mitigate the accidents previously evaluated. As a result, the proposed change will not increase the consequences of an accident previously evaluated.
Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.
2.
Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?
Response: No.
The change does not involve a physical alteration of the plant (i.e., no new or different type of equipment will be installed) or a change in the methods governing normal plant operation. The change does not alter assumptions made in the safety analysis but ensures that the instruments behave as assumed in the accident analysis. The proposed change is consistent with the safety analysis assumptions.
Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.
3.
Does the proposed change involve a significant reduction in a margin of safety?
Response: No.
TSTF-493, Rev. 2 Page 14 The proposed change clarifies the requirements for instrumentation to ensure the instrumentation will actuate as assumed in the accident analysis. No change is made to the accident analysis assumptions and no margin of safety is reduced as part of this change.
Therefore, the proposed change does not involve a significant reduction in a margin of safety.
Based on the above, the TSTF concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.
5.2 Applicable Regulatory Requirements / Criteria 10 CFR 50.36(c)(1)(ii)(A) states, "Limiting safety system settings for nuclear reactors are settings for automatic protective devices related to those variables having significant safety functions. W here a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded. If, during operation, it is determined that the automatic safety system does not function as required, the licensee shall take appropriate action, which may include shutting down the reactor."
The proposed change clarifies the Technical Specification requirements to ensure that the automatic protection action will function as required to correct the abnormal situation before a safety limit is exceeded.
General Design Criteria (GDC) 13, "Instrumentation and Control," states, "Instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems.
Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges."
General Design Criteria (GDC) 20, " ProtectionProtection System Functions," states, "The protection system shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety."
The proposed change revises the Technical Specifications to enhance the controls used to maintain the variables and systems within the prescribed operating ranges, in order to ensure that automatic protection actions occur as necessary to initiate the operation of systems and components important to safety as assumed in the accident analysis.
TSTF-493, Rev. 2 Page 15 In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the approval of the proposed change will not be inimical to the common defense and security or to the health and safety of the public.
6.0 Environmental6.0 Environmental Considerations A review has determined that the proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement.
However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.
7.0 References7.0 References
- 1. Instrument Society of America (ISA) Recommended Practice ISA-S67.04, Part II, 1994 "Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation."
2.
Letter from NEI (Alexander Marion) to NRC (James Lyons) dated May 18 2005 Titled, th "Instrumentation, Systems, and Automation Society S67.04 Methods for Determining Trip Setpoints and Allowable Values for Safety-Related Instrumentation."
3.
Letter from NRC (Bruce Boger) to Alexander Marion (NEI) dated August 23, 2005 Titled, Instrumentation, Systems, and Automation Society S67.04 Methods for Determining Trip Setpoints and Allowable Values for Safety-Related Instrumentation.
4.
Regulatory Issue Summary 06-017, dated August 24, 2006, Titled, NRC Staff Position on the Requirements of 10 CFR 50.36, Technical Specifications, Regarding Limiting Safety System Settings During Periodic Testing and Calibration of Instrument Channels.
TSTF-493, Rev. 2 INSERTS INSERT 1 If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.
INSERT 2 The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the [Limiting Trip Setpoint (LTSP) or Nominal Trip Setpoint (NTSP)] at the completion of the surveillance; otherwise, the channel shall be declared inoperable.
Setpoints more conservative than the [LTSP or NTSP] are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the Surveillance procedures to confirm channel performance. The [Limiting Trip Setpoint or Nominal Trip Setpoint and the] methodologies used to determine the as-found and the as-left tolerances are specified in [a document controlled under 10 CFR 50.59].
Appendix A TSTF-493 History