ML072120091
| ML072120091 | |
| Person / Time | |
|---|---|
| Site: | Technical Specifications Task Force |
| Issue date: | 07/25/2007 |
| From: | Kobetz T NRC/NRR/ADRO/DIRS/ITSB |
| To: | Technical Specifications Task Force |
| Schulten C. S., NRR/DIRS, 415-1192 | |
| Shared Package | |
| ML072070202 | List: |
| References | |
| TAC MD5249, TSTF-493, Rev 2 | |
| Download: ML072120091 (41) | |
Text
RPS Instrumentation B 3.3.1.1 B 3.3 INSTRUMENTATION B 3.3.1.1 Reactor Protection System (RPS) Instrumentation BASES BACKGROUND The RPS initiates a reactor scram when one or more monitored parameters exceed their specified limit, to preserve the integrity of the fuel cladding and the Reactor Coolant System (RCS), and minimize the energy that must be absorbed following a loss of coolant accident (LOCA). This can be accomplished either automatically or manually.
The protection and monitoring functions of the RPS have been designed to ensure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters, and equipment performance. The subset of LSSS that directly protect against violating the Rreactor Ccore Safety Limits and or the Reactor Coolant System (RCS) pPressure boundary sSafety lLimits during anticipated operational occurrences (AOOs) are referred to as Safety Limit LSSS (SL-LSSS).
10 CFR 50.36(c)(1)(ii)(A) requires that TSs include LSSSs for variables that have significant safety functions. For variables on which a SL has been placed, the LSSS must be chosen to initiate automatic protective action to correct abnormal situations before the SL is exceeded.
Technical Specifications are required by 10 CFR 50.36 to contain LSSS defined by the regulation as "...settings for automatic protective devices...so chosen that automatic protective action will correct the abnormal situation before a Safety Limit (SL) is exceeded." The AnalyticAnalytical Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a SLan SL is not exceeded. Any automatic protection action that occurs on reaching the AnalyticAnalytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protective devices must be chosen to be more conservative than the AnalyticAnalytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
The trip setpoint is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytic Limit and thus ensuring that the SL would not be exceeded. As such, the trip setpoint accounts for uncertainties in setting the device (e.g., calibration), uncertainties in how the device might actually perform (e.g., repeatability), changes in the point of action of the device over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the trip setpoint plays an important role in ensuring that SLs BW R/6 STS B 3.3.1.1-1 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 are not exceeded. As such, the trip setpoint meets the definition of an LSSS (Ref. 1) and could be used to meet the requirement that they be contained in the Technical Specifications.
BW R/6 STS B 3.3.1.1-2 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES BACKGROUND (continued)
Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as "...being capable of performing its safety function(s)." For automatic protective devices, the required safety function is to ensure that a SL is not exceeded and therefore the LSSS as defined by 10 CFR 50.36 is the same as the OPERABILITY limit for these devices. However, use of the trip setpoint to define OPERABILITY in Technical Specifications and its corresponding designation as the LSSS required by 10 CFR 50.36 would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as found" value of a protective device setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the trip setpoint due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the trip setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as found" setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the device to the trip setpoint to account for further drift during the next surveillance interval.
REVIEW ER'S NOTE ------------------------------------
The term "Limiting Trip Setpoint (LTSP)" is generic terminology for the setpoint value calculated by means of the plant-specific setpoint methodology documented in a document controlled under 10 CFR 50.59.
The term Limiting Trip Setpoint indicates that no additional margin has been added between the Analytical Limit and the calculated trip setting.
W here margin is added between the Analytical Limit and trip setpoint, the term Nominal Trip Setpoint (NTSP) is preferred. The trip setpoint (field setting) may be more conservative than the Limiting or Nominal Trip Setpoint. W here the [LTSP] is not documented in a column in Table 3.3.1.1-1 for the purpose of compliance with 10 CFR 50.36, the plant-specific term for the Limiting or Nominal Trip Setpoint must be cited in Note b of Table 3.3.1.1-1. The brackets indicate plant-specific terms may apply, as reviewed and approved by the NRC. The as-found and as-left tolerances will apply to the actual setpoint implemented in the Surveillance procedures to confirm channel performance.
Licensees are to insert the name of the document(s) controlled under 10 CFR 50.59 that contain the [LTSP] and the methodology for calculating the as-left and as-found tolerances, for the phrase "[a document controlled under 10 CFR 50.59]" in the specifications.
BW R/6 STS B 3.3.1.1-3 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 Use of the trip setpoint to define "as found" OPERABILITY and its designation as the LSSS under the expected circumstances described above would result in actions required by both the rule and Technical Specifications that are clearly not warranted. However, there is also some point beyond which the device would have not been able to perform its function due, for example, to greater than expected drift. This value needs to be specified in the Technical Specifications in order to define OPERABILITY of the devices and is designated as the Allowable Value which, as stated above, is the same as the LSSS.
The Allowable Valuable specified in Table 3.3.1-1 serves as the LSSS such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value. As such, the Allowable Value differs from the trip setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this BW R/6 STS B 3.3.1.1-4 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES BACKGROUND (continued) manner, the actual setting of the device will still meet the LSSS definition and ensure that a SL is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval. If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a Technical Specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required. Note that, although the channel is "OPERABLE" under these circumstances, the trip setpoint should be left adjusted to a value within the established trip setpoint calibration tolerance band, in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.
The [Limiting Trip Setpoint (LTSP)] is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit and thus ensuring that the SL would not be exceeded. As such, the [LTSP] accounts for uncertainties in setting the device (e.g., calibration), uncertainties in how the device might actually perform (e.g., repeatability), changes in the point of action of the device over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the
[LTSP] ensures that SLs are not exceeded. As such, the [LTSP] meets the definition of an SL-LSSS (Ref. 1).
Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as "...being capable of performing its safety function(s)." Use of the [LTSP] to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as-found" value of a protective device setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the [LTSP] due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the [LTSP] and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as-found" setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the device to the [LTSP] to account for further drift during the next surveillance interval.
BW R/6 STS B 3.3.1.1-5 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 However, there is also some point beyond which the device would have not been able to perform its function due, for example, to greater than expected drift. The Allowable Value specified in Table 3.3.1.1-1 is the least conservative value of the as-found setpoint that a channel can have during testing such that a channel is OPERABLE if the trip setpoint is found conservative with respect to the Allowable Value during the BASES BACKGROUND (continued)
CHANNEL CALIBRATION. Note that, although a channel is OPERABLE under these circumstances, the setpoint must be left adjusted to a value within the established as-left tolerance of the [LTSP] and confirmed to be operating within the statistical allowances of the uncertainty terms assigned in the setpoint calculation. As such, the Allowable Value differs from the [LTSP] by an amount equal to [or greater than] the as-found tolerance value. In this manner, the actual setting of the device ensures that an SL is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.
If the actual setting of the device is found to be conservative with respect to the Allowable Value but is beyond the as-found tolerance band, then this condition indicates that the instrument is degraded and is not performing in accordance with the setpoint methodology assumptions.
This condition must be entered into the plant corrective action program, the trip setpoint must be left adjusted to a value within the as-left tolerance band, and an immediate determination of operability decision must be made.
If the actual setting of the device is found to be non-conservative with respect to the Allowable Value the channel device would be considered inoperable from a Technical Specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
The RPS, as shown in the FSAR, Figure [ ] (Ref. 2), includes sensors, relays, bypass circuits, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters. The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level, reactor vessel pressure, neutron flux main steam line isolation valve position, turbine control valve (TCV) fast closure, trip oil pressure low, turbine stop valve (TSV) trip oil pressure low, drywell pressure and scram discharge volume (SDV) water level, as well as reactor mode switch in shutdown position and manual scram signals.
There are at least four redundant sensor input signals from each of these parameters (with the exception of the reactor mode switch in shutdown scram signal). Most channels include electronic equipment (e.g., trip BW R/6 STS B 3.3.1.1-6 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 units) that compares measured input signals with pre-established setpoints. W hen the setpoint is exceeded, the channel output relay actuates, which then outputs an RPS trip signal to the trip logic.
Table B 3.3.1.1-1 summarizes the diversity of sensors capable of initiating scrams during anticipated operating transients typically analyzed.
The RPS is comprised of two independent trip systems (A and B), with two logic channels in each trip system (logic channels A1 and A2, B1 and B2), as shown in Reference 2. The outputs of the logic channels in a trip system are combined in a one-out-of-two logic so either channel can trip the associated trip system. The tripping of both trip systems will produce a reactor scram. This logic arrangement is referred to as one-out-of-two taken twice logic. Each trip system can be reset by use of a reset switch. If a full scram occurs (both trip systems trip), a relay prevents reset of the trip systems for 10 seconds after the full scram signal is received. This 10 second delay on reset ensures that the scram function will be completed.
Two scram pilot valves are located in the hydraulic control unit (HCU) for each control rod drive (CRD). Each scram pilot valve is solenoid operated, with the solenoids normally energized. The scram pilot valves control the air supply to the scram inlet and outlet valves for the associated CRD. W hen either scram pilot valve solenoid is energized, air pressure holds the scram valves closed and, therefore, both scram pilot valve solenoids must be de-energized to cause a control rod to scram. The scram valves control the supply and discharge paths for the CRD water during a scram. One of the scram pilot valve solenoids for each CRD is controlled by trip system A, and the other solenoid is controlled by trip system B. Any trip of trip system A in conjunction with any trip in trip system B results in de-energizing both solenoids, air bleeding off, scram valves opening, and control rod scram.
The backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by the RPS.
Additionally, the RPS System controls the SDV vent and drain valves such that when both trip systems trip, the SDV vent and drain valves close to isolate the SDV.
BASES APPLICABLE The actions of the RPS are assumed in the safety analyses of SAFETY References 3, 4, and 5. The RPS initiates a reactor scram when and APPLICABILITY ANALYSES, LCO, monitored parameter values exceed the Allowable Values specified by the setpoint methodology and listed in Table 3.3.1.1-1 to preserve the integrity of the fuel cladding, the reactor coolant pressure boundary (RCPB), and the containment by minimizing the energy that must be absorbed following a LOCA.
RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Functions not specifically credited in the accident analysis are retained for BW R/6 STS B 3.3.1.1-7 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.
Limiting Trip Setpoints that directly protect against violating the Rreactor cCore Safety Limits or the Reactor Coolant System (RCS) pPressure boundary Safety Limits during anticipated operational occurrences (AOOs) are Safety Limit-Limiting Safety System Settings (SL-LSSS).
Permissive and interlock setpoints allow bypass of trips when they are not required by the Safety Analysis. These permissives and interlocks ensure that the starting conditions are consistent with the safety analysis, before preventative or mitigating actions occur. Because these permissives or interlocks are only one of multiple conservative starting assumptions for the accident analysis, they are generally considered as nominal values without regard to measurement accuracy, (i.e. the value indicated is sufficiently close to the necessary value to ensure proper operation of the safety systems to turn the AOO). Therefore permissives and interlocks are not considered to be SL-LSSS.
The OPERABILITY of the RPS is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.1.1-1.
Each Function must have a required number of OPERABLE channels per RPS trip system, with their setpoints within the specified conservative with respect to the Allowable Value,set within the setting tolerance of the
[LTSPs], where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Each channel must also respond within its assumed response time.
BW R/6 STS B 3.3.1.1-8 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 Allowable Values are specified for each RPS Function specified in Table 3.3.1.1-1. [Limiting Trip Setpoints] are specified in [a document controlled under 10 CFR 50.59 such as the UFSAR]. The [LTSPs] are selected to ensure that the actual setpoints are conservative with respect to the as-found tolerance band Allowable Value between successive CHANNEL CALIBRATIONS. After each calibration the trip setpoint should be reset to within the as-left band around the [LTSP].Operation with a trip setpoint less conservative than its [LTSP], but conservative with respect to its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is non-conservative with respect to its required Allowable Value.
The Allowable Value specified in Table 3.3.1.1-1 is the least conservative value of the as-found setpoint that the channel can have when tested, such that a channel is OPERABLE if the as-found setpoint is conservative with respect to the Allowable Value during the CHANNEL CALIBRATION.
As such, the Allowable Value differs from the [LTSP] by an amount
[greater than or] equal to the expected instrument channel uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device ([LTSP]) will ensure that a SL is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.
Note that, although the channel is OPERABLE under these circumstances, the trip setpoint must be left adjusted to a value within the as-left tolerance, in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned (as-found criteria).
If the actual setting of the device is found to be conservative with respect to the Allowable Value but is beyond the as-found tolerance band, then this condition indicates that the instrument is degraded and is not performing in accordance with the setpoint methodology assumptions.
This condition must be entered into the plant corrective action program, the trip setpoint must be left adjusted to a value within the as-left tolerance band, and an immediate determination of operability decision must be made.
If the actual setting of the device is found to be non-conservative with respect to the Allowable Value, the channel device would be considered inoperable. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
[Limiting Trip Setpoints] are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytical limits are derived from the limiting values of the process parameters obtained BW R/6 STS B 3.3.1.1-9 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 from the safety analysis. The Allowable Values are derived from the analytical limits, corrected for calibration, process, and some of the instrument errors. The [LTSPs] are then determined, accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
The OPERABILITY of scram pilot valves and associated solenoids, backup scram valves, and SDV valves, described in the Background section, are not addressed by this LCO.
BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Allowable Values are specified for each RPS Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations.
The nominal setpoints are selected to ensure that the actual setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.
Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined, accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
The OPERABILITY of scram pilot valves and associated solenoids, backup scram valves, and SDV valves, described in the Background section, are not addressed by this LCO.
The individual Functions are required to be OPERABLE in the MODES specified in the Table that may require an RPS trip to mitigate the consequences of a design basis accident or transient. To ensure a reliable scram function, a combination of Functions is required in each MODE to provide primary and diverse initiation signals.
BW R/6 STS B 3.3.1.1-10 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 RPS is required to be OPERABLE in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies.
Control rods withdrawn from a core cell containing no fuel assemblies do not affect the reactivity of the core and therefore are not required to have the capability to scram. Provided all other control rods remain inserted, the RPS function is not required. In this condition, the required SDM (LCO 3.1.1) and refuel position one-rod-out interlock (LCO 3.9.2) ensure that no event requiring RPS will occur. During normal operation in BW R/6 STS B 3.3.1.1-11 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
MODES 3 and 4, all control rods are fully inserted and the Reactor Mode Switch Shutdown Position control rod withdrawal block (LCO 3.3.2.1) does not allow any control rod to be withdrawn. Under these conditions, the RPS function is not required to be OPERABLE.
The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.
1.a. Intermediate Range Monitor (IRM) Neutron Flux - High The IRMs monitor neutron flux levels from the upper range of the source range monitors (SRMs) to the lower range of the average power range monitors (APRMs). The IRMs are capable of generating trip signals that can be used to prevent fuel damage resulting from abnormal operating transients in the intermediate power range. In this power range, the most significant source of reactivity change is due to control rod withdrawal.
The IRM provides diverse protection for the rod withdrawal limiter (RW L),
which monitors and controls the movement of control rods at low power.
The RW L prevents the withdrawal of an out of sequence control rod during startup that could result in an unacceptable neutron flux excursion (Ref. 6). The IRM provides mitigation of the neutron flux excursion. To demonstrate the capability of the IRM System to mitigate control rod withdrawal events, generic analyses have been performed (Ref. 7) to evaluate the consequences of control rod withdrawal events during startup that are mitigated only by the IRM.
This analysis, which assumes that one IRM channel in each trip system is bypassed, demonstrates that the IRMs provide protection against local control rod withdrawal errors and results in peak fuel energy depositions below the 170 cal/gm fuel failure threshold criterion.
The IRMs are also capable of limiting other reactivity excursions during startup, such as cold water injection events, although no credit is specifically assumed.
The IRM System is divided into two groups of IRM channels, with four IRM channels inputting to each trip system. The analysis of Reference 7 assumes that one channel in each trip system is bypassed. Therefore, six channels with three channels in each trip system are required for IRM OPERABILITY to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This trip is active in each of the 10 ranges of the IRM, which must be selected by the operator to maintain the neutron flux within the monitored level of an IRM range.
BW R/6 STS B 3.3.1.1-12 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The analysis of Reference 7 has adequate conservation to permit an IRM Allowable Value of 120 divisions of a 125 division scale.
The Intermediate Range Monitor Neutron Flux - High Function must be OPERABLE during MODE 2 when control rods may be withdrawn and the potential for criticality exists. In MODE 5, when a cell with fuel has its control rod withdrawn, the IRMs provide monitoring for and protection against unexpected reactivity excursions. In MODE 1, the APRM System, the RW L, and the Rod Pattern Controller (RPC) provide protection against control rod withdrawal error events and the IRMs are not required.
1.b. Intermediate Range Monitor - Inop This trip signal provides assurance that a minimum number of IRMs are OPERABLE. Anytime an IRM mode switch is moved to any position other than "Operate," the detector voltage drops below a preset level, or a module is not plugged in, an inoperative trip signal will be received by the RPS unless the IRM is bypassed. Since only one IRM in each trip system may be bypassed, only one IRM in each RPS trip system may be inoperable without resulting in an RPS trip signal.
This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.
Six channels of Intermediate Range Monitor - Inop with three channels in each trip system are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.
Since this Function is not assumed in the safety analysis, there is no Allowable Value for this Function.
This Function is required to be OPERABLE when the Intermediate Range Monitor Neutron Flux - High Function is required.
2.a. Average Power Range Monitor Neutron Flux - High, Setdown The APRM channels receive input signals from the local power range monitors (LPRM) within the reactor core to provide an indication of the power distribution and local power changes. The APRM channels average these LPRM signals to provide a continuous indication of BW R/6 STS B 3.3.1.1-13 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) average reactor power from a few percent to greater than RTP. For operation at low power (i.e., MODE 2), the Average Power Range Monitor Neutron Flux - High, Setdown Function is capable of generating a trip signal that prevents fuel damage resulting from abnormal operating transients in this power range. For most operation at low power levels, the Average Power Range Monitor Neutron Flux - High, Setdown Function will provide a secondary scram to the Intermediate Range Monitor Neutron Flux - High Function because of the relative setpoints.
W ith the IRMs at Range 9 or 10, it is possible that the Average Power Range Monitor Neutron Flux - High, Setdown Function will provide the primary trip signal for a corewide increase in power.
No specific safety analyses take direct credit for the Average Power Range Monitor Neutron Flux - High, Setdown Function. However, this Function indirectly ensures that, before the reactor mode switch is placed in the run position, reactor power does not exceed 25% RTP (SL 2.1.1.1) when operating at low reactor pressure and low core flow. Therefore, it indirectly prevents fuel damage during significant reactivity increases with THERMAL POW ER < 25% RTP.
The APRM System is divided into two groups of channels with three APRM channel inputs to each trip system. The system is designed to allow one channel in each trip system to be bypassed. Any one APRM channel in a trip system can cause the associated trip system to trip. Six channels of Average Power Range Monitor Neutron Flux - High, Setdown, with three channels in each trip system are required to be OPERABLE to ensure that no single failure will preclude a scram from this Function on a valid signal. In addition, to provide adequate coverage of the entire core, at least 11 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the four axial levels at which the LPRMs are located.
The Allowable Value is based on preventing significant increases in power when THERMAL POW ER is < 25% RTP.
The Average Power Range Monitor Neutron Flux - High, Setdown Function must be OPERABLE during MODE 2 when control rods may be withdrawn, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since the potential for criticality exists. In MODE 1, the Average Power Range Monitor Neutron Flux - High Function provides protection against reactivity transients and the RW L and RPC protect against control rod withdrawal error events.
BW R/6 STS B 3.3.1.1-14 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 2.b. Average Power Range Monitor Flow Biased Simulated Thermal Power - High The Average Power Range Monitor Flow Biased Simulated Thermal Power - High Function monitors neutron flux to approximate the THERMAL POW ER being transferred to the reactor coolant. The APRM neutron flux is electronically filtered with a time constant representative of the fuel heat transfer dynamics to generate a signal proportional to the THERMAL POW ER in the reactor. The trip level is varied as a function of recirculation drive flow (i.e., at lower core flows the setpoint is reduced proportional to the reduction in power experienced as core flow is reduced with a fixed control rod pattern) but is clamped at an upper limit that is always lower than the Average Power Range Monitor Fixed Neutron Flux - High Function Allowable Value. The Average Power Range Monitor Flow Biased Simulated Thermal Power - High Function provides protection against transients where THERMAL POW ER increases slowly (such as the loss of feedwater heating event) and protects the fuel cladding integrity by ensuring that the MCPR SL is not exceeded. During these events, the THERMAL POW ER increase does not significantly lag the neutron flux response and, because of a lower trip setpoint, will initiate a scram before the high neutron flux scram. For rapid neutron flux increase events, the THERMAL POW ER lags the neutron flux and the Average Power Range Monitor Fixed Neutron Flux -
High Function will provide a scram signal before the Average Power Range Monitor Flow Biased Simulated Thermal Power - High Function setpoint is exceeded.
The APRM System is divided into two groups of channels with four APRM inputs to each trip system. The system is designed to allow one channel in each trip system to be bypassed. Any one Average Power Range Monitor channel in a trip system can cause the associated trip system to trip. Six channels of Average Power Range Monitor Flow Biased Simulated Thermal Power - High, with three channels in each trip system arranged in one-out-of-three logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. In addition, to provide adequate coverage of the entire core, at least 11 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the four axial levels at which the LPRMs are located. Each APRM channel receives one total drive flow signal representative of total core flow. The recirculation loop drive flow signals are generated by eight flow units. One flow unit from each recirculation loop is provided to each APRM channel. Total drive flow is determined by each APRM by summing up the flow signals provided to the APRM from the two recirculation loops.
BW R/6 STS B 3.3.1.1-15 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The clamped Allowable Value is based on analyses that take credit for the Average Power Range Monitor Flow Biased Simulated Thermal Power - High Function for the mitigation of the loss of feedwater heater event. The THERMAL POW ER time constant of < 7 seconds is based on the fuel heat transfer dynamics and provides a signal that is proportional to the THERMAL POW ER.
The Average Power Range Monitor Flow Biased Simulated Thermal Power - High Function is required to be OPERABLE in MODE 1 when there is the possibility of generating excessive THERMAL POW ER and potentially exceeding the SL applicable to high pressure and core flow conditions (MCPR SL). During MODES 2 and 5, other IRM and APRM Functions provide protection for fuel cladding integrity.
2.c. Average Power Range Monitor Fixed Neutron Flux - High The APRM channels provide the primary indication of neutron flux within the core and respond almost instantaneously to neutron flux increases.
The Average Power Range Monitor Fixed Neutron Flux - High Function is capable of generating a trip signal to prevent fuel damage or excessive RCS pressure. For the overpressurization protection analysis of Reference 3, the Average Power Range Monitor Fixed Neutron Flux -
High Function is assumed to terminate the main steam isolation valve (MSIV) closure event and, along with the safety/relief valves (S/RVs),
limits the peak reactor pressure vessel (RPV) pressure to less than the ASME Code limits. The control rod drop accident (CRDA) analysis (Ref. 8) takes credit for the Average Power Range Monitor Fixed Neutron Flux - High Function to terminate the CRDA.
The APRM System is divided into two groups of channels with four APRM channels inputting to each trip system. The system is designed to allow one channel in each trip system to be bypassed. Any one APRM channel in a trip system can cause the associated trip system to trip. Six channels of Average Power Range Monitor Fixed Neutron Flux - High with three channels in each trip system arranged in a one-out-of-three logic are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. In addition, to provide adequate coverage of the entire core, at least 11 LPRM inputs are required for each APRM channel, with at least two LPRM inputs from each of the four axial levels at which the LPRMs are located.
The Allowable Value is based on the Analytical Limit assumed in the CRDA analyses.
BW R/6 STS B 3.3.1.1-16 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The Average Power Range Monitor Fixed Neutron Flux - High Function is required to be OPERABLE in MODE 1 where the potential consequences of the analyzed transients could result in the SLs (e.g., MCPR and RCS pressure) being exceeded. Although the Average Power Range Monitor Fixed Neutron Flux - High Function is assumed in the CRDA analysis that is applicable in MODE 2, the Average Power Range Monitor Neutron Flux
- High, Setdown Function conservatively bounds the assumed trip and, together with the assumed IRM trips, provides adequate protection.
Therefore, the Average Power Range Monitor Fixed Neutron Flux - High Function is not required in MODE 2.
2.d. Average Power Range Monitor - Inop This signal provides assurance that a minimum number of APRMs are OPERABLE. Anytime an APRM mode switch is moved to any position other than Operate, an APRM module is unplugged, the electronic operating voltage is low, or the APRM has too few LPRM inputs (< 11), an inoperative trip signal will be received by the RPS, unless the APRM is bypassed. Since only one APRM in each trip system may be bypassed, only one APRM in each trip system may be inoperable without resulting in an RPS trip signal. This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.
Four channels of Average Power Range Monitor - Inop with two channels in each trip system are required to be OPERABLE to ensure that no single failure will preclude a scram from this Function on a valid signal.
There is no Allowable Value for this Function.
This Function is required to be OPERABLE in the MODES where the APRM Functions are required.
- 3. Reactor Vessel Steam Dome Pressure - High An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This causes the neutron flux and THERMAL POW ER transferred to the reactor coolant to increase, which could challenge the integrity of the fuel cladding and the RCPB. No specific safety analysis takes direct credit for this Function. However, the Reactor Vessel Steam Dome Pressure -
High Function initiates a scram for transients that results in a pressure increase, counteracting the pressure increase by rapidly reducing core BW R/6 STS B 3.3.1.1-17 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) power. For the overpressurization protection analysis of Reference 3, the reactor scram (the analyses conservatively assume scram on the Average Power Range Monitor Fixed Neutron Flux - High signal, not the Reactor Vessel Steam Dome Pressure-High signal), along with the S/RVs, limits the peak RPV pressure to less than the ASME Section III Code limits.
High reactor pressure signals are initiated from four pressure transmitters that sense reactor pressure. The Reactor Vessel Steam Dome Pressure
- High Allowable Value is chosen to provide a sufficient margin to the ASME Section III Code limits during the event.
Four channels of Reactor Vessel Steam Dome Pressure - High Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. The Function is required to be OPERABLE in MODES 1 and 2 when the RCS is pressurized and the potential for pressure increase exists.
- 4. Reactor Vessel W ater Level - Low, Level 3 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, a reactor scram is initiated at Level 3 to substantially reduce the heat generated in the fuel from fission. The Reactor Vessel W ater Level - Low, Level 3 Function is assumed in the analysis of the recirculation line break (Ref. 4). The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the Emergency Core Cooling Systems (ECCS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
Reactor Vessel W ater Level - Low, Level 3 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.
Four channels of Reactor Vessel W ater Level - Low, Level 3 Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.
The Reactor Vessel W ater Level - Low, Level 3 Allowable Value is selected to ensure that, for transients involving loss of all normal feedwater flow, initiation of the low pressure ECCS at RPV W ater Level 1 will not be required.
BW R/6 STS B 3.3.1.1-18 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
The Function is required in MODES 1 and 2 where considerable energy exists in the RCS resulting in the limiting transients and accidents. ECCS initiations at Reactor Vessel W ater Level - Low Low, Level 2 and Low Low Low, Level 1 provide sufficient protection for level transients in all other MODES.
- 5. Reactor Vessel W ater Level - High, Level 8 High RPV water level indicates a potential problem with the feedwater level control system, resulting in the addition of reactivity associated with the introduction of a significant amount of relatively cold feedwater.
Therefore, a scram is initiated at Level 8 to ensure that MCPR is maintained above the MCPR SL. The Reactor Vessel W ater Level -
High, Level 8 Function is one of the many Functions assumed to be OPERABLE and capable of providing a reactor scram during transients analyzed in Reference 4. It is directly assumed in the analysis of feedwater controller failure, maximum demand (Ref. 5).
Reactor Vessel W ater Level - High, Level 8 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel W ater Level - High, Level 8 Allowable Value is specified to ensure that the MCPR SL is not violated during the assumed transient.
Four channels of the Reactor Vessel W ater Level - High, Level 8 Function, with two channels in each trip system arranged in a one-out-of-two logic, are available and are required to be OPERABLE when THERMAL POW ER is $ 25% RTP to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. W ith THERMAL POW ER < 25% RTP, this Function is not required since MCPR is not a concern below 25% RTP.
- 6. Main Steam Isolation Valve - Closure MSIV closure results in loss of the main turbine and the condenser as a heat sink for the Nuclear Steam Supply System and indicates a need to shut down the reactor to reduce heat generation. Therefore, a reactor scram is initiated on a Main Steam Isolation Valve - Closure signal before the MSIVs are completely closed in anticipation of the complete loss of the normal heat sink and subsequent overpressurization transient.
However, for the overpressurization protection analysis of Reference 3, the Average Power Range Monitor Fixed Neutron Flux - High Function, along with the S/RVs, limits the peak RPV pressure to less than the BW R/6 STS B 3.3.1.1-19 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
ASME Code limits. That is, the direct scram on position switches for MSIV closure events is not assumed in the overpressurization analysis.
Additionally, MSIV closure is assumed in the transients analyzed in Reference 5 (e.g., low steam line pressure, manual closure of MSIVs, high steam line flow). The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the ECCS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.
MSIV closure signals are initiated from position switches located on each of the eight MSIVs. Each MSIV has two position switches; one inputs to RPS trip system A while the other inputs to RPS trip system B. Thus, each RPS trip system receives an input from eight Main Steam Isolation Valve - Closure channels, each consisting of one position switch. The logic for the Main Steam Isolation Valve - Closure Function is arranged such that either the inboard or outboard valve on three or more of the main steam lines (MSLs) must close in order for a scram to occur.
The Main Steam Isolation Valve - Closure Allowable Value is specified to ensure that a scram occurs prior to a significant reduction in steam flow, thereby reducing the severity of the subsequent pressure transient.
Sixteen channels of the Main Steam Isolation Valve - Closure Function with eight channels in each trip system are required to be OPERABLE to ensure that no single instrument failure will preclude the scram from this Function on a valid signal. This Function is only required in MODE 1 since, with the MSIVs open and the heat generation rate high, a pressurization transient can occur if the MSIVs close. In MODE 2, the heat generation rate is low enough so that the other diverse RPS functions provide sufficient protection.
- 7. Drywell Pressure - High High pressure in the drywell could indicate a break in the RCPB. A reactor scram is initiated to minimize the possibility of fuel damage and to reduce the amount of energy being added to the coolant and the drywell.
The Drywell Pressure - High Function is a secondary scram signal to Reactor Vessel W ater Level - Low, Level 3 for LOCA events inside the drywell. This Function was not specifically credited in the accident analysis, but itThe value is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.
BW R/6 STS B 3.3.1.1-20 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.
Four channels of Drywell Pressure - High Function, with two channels in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. The Function is required in MODES 1 and 2 where considerable energy exists in the RCS, resulting in the limiting transients and accidents.
8.a, 8.b. Scram Discharge Volume W ater Level - High The SDV receives the water displaced by the motion of the CRD pistons during a reactor scram. Should this volume fill to a point where there is insufficient volume to accept the displaced water, control rod insertion would be hindered. Therefore, a reactor scram is initiated when the remaining free volume is still sufficient to accommodate the water from a full core scram. However, even though the two types of Scram Discharge Volume W ater Level - High Functions are an input to the RPS logic, no credit is taken for a scram initiated from these Functions for any of the design basis accidents or transients analyzed in the FSAR. However, they are retained to ensure that the RPS remains OPERABLE.
SDV water level is measured by two diverse methods. The level in each of the two SDVs is measured by two float type level switches and two transmitters and trip units for a total of eight level signals. The outputs of these devices are arranged so that there is a signal from a level switch and a transmitter and trip unit to each RPS logic channel. The level measurement instrumentation satisfies the recommendations of Reference 9.
The Allowable Value is chosen low enough to ensure that there is sufficient volume in the SDV to accommodate the water from a full scram.
Four channels of each type of Scram Discharge Volume W ater Level -
High Function, with two channels of each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from these Functions on a valid signal. These Functions are required in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn. At all other times, this Function may be bypassed.
BW R/6 STS B 3.3.1.1-21 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
- 9. Turbine Stop Valve Closure, Trip Oil Pressure - Low Closure of the TSVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated at the start of TSV closure in anticipation of the transients that would result from the closure of these valves. The Turbine Stop Valve Closure, Trip Oil Pressure - Low Function is the primary scram signal for the turbine trip event analyzed in Reference 5. For this event, the reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the End of Cycle Recirculation Pump Trip (EOC-RPT) System, ensures that the MCPR SL is not exceeded.
Turbine Stop Valve Closure, Trip Oil Pressure - Low signals are initiated by the electrohydraulic control (EHC) fluid pressure at each stop valve.
Two independent pressure transmitters are associated with each stop valve. One of the two transmitters provides input to RPS trip system A; the other, to RPS trip system B. Thus, each RPS trip system receives an input from four Turbine Stop Valve Closure, Trip Oil Pressure - Low channels, each consisting of one pressure transmitter. The logic for the Turbine Stop Valve Closure, Trip Oil Pressure - Low Function is such that three or more TSVs must be closed to produce a scram.
This Function must be enabled at THERMAL POW ER $ 40% RTP. This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure; therefore, to consider this Function OPERABLE, the turbine bypass valves must remain shut at THERMAL POW ER $ 40% RTP. The setpoint is feedwater temperature dependent as a result of the subcooling changes that affect the turbine first stage pressure/reactor power relationship. For RTP operation with feedwater temperature $ 420°F, an allowable setpoint of # 26.9% of control valve wide open turbine first stage pressure is provided by the bypass function.
The allowable setpoint is reduced to # 22.5% of control valve wide open turbine first stage pressure for RTP operation with feedwater temperature
> 370°F and < 420°F.
The Turbine Stop Valve Closure, Trip Oil Pressure - Low Allowable Value is selected to be high enough to detect imminent TSV closure thereby reducing the severity of the subsequent pressure transient.
BW R/6 STS B 3.3.1.1-22 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Eight channels of Turbine Stop Valve Closure, Trip Oil Pressure - Low Function, with four channels in each trip system, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function even if one TSV should fail to close. This Function is required, consistent with analysis assumptions, whenever THERMAL POW ER is $ 40% RTP. This Function is not required when THERMAL POW ER is < 40% RTP since the Reactor Vessel Steam Dome Pressure - High and the Average Power Range Monitor Fixed Neutron Flux - High Functions are adequate to maintain the necessary safety margins.
- 10. Turbine Control Valve Fast Closure, Trip Oil Pressure - Low Fast closure of the TCVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated on TCV fast closure in anticipation of the transients that would result from the closure of these valves. The Turbine Control Valve Fast Closure, Trip Oil Pressure - Low Function is the primary scram signal for the generator load rejection event analyzed in Reference 5. For this event, the reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the EOC-RPT System, ensures that the MCPR SL is not exceeded.
Turbine Control Valve Fast Closure, Trip Oil Pressure - Low signals are initiated by the EHC fluid pressure at each control valve. There is one pressure transmitter associated with each control valve, the signal from each transmitter being assigned to a separate RPS logic channel. This Function must be enabled at THERMAL POW ER $ 40% RTP. This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure; therefore, to consider this Function OPERABLE, the turbine bypass valves must remain shut at THERMAL POW ER $ 40% RTP. The basis for the setpoint of this automatic bypass is identical to that described for the Turbine Stop Valve Closure, Trip Oil Pressure - Low Function.
The Turbine Control Valve Fast Closure, Trip Oil Pressure - Low Allowable Value is selected high enough to detect imminent TCV fast closure.
BW R/6 STS B 3.3.1.1-23 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Four channels of Turbine Control Valve Fast Closure, Trip Oil Pressure -
Low Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This Function is required, consistent with the analysis assumptions, whenever THERMAL POW ER is $ 40% RTP. This Function is not required when THERMAL POW ER is < 40% RTP since the Reactor Vessel Steam Dome Pressure - High and the Average Power Range Monitor Fixed Neutron Flux - High Functions are adequate to maintain the necessary safety margins.
- 11. Reactor Mode Switch - Shutdown Position The Reactor Mode Switch - Shutdown Position Function provides signals, via the manual scram logic channels, that are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.
The reactor mode switch is a single switch with four channels, each of which inputs into one of the RPS logic channels.
There is no Allowable Value for this Function since the channels are mechanically actuated based solely on reactor mode switch position.
Four channels of Reactor Mode Switch - Shutdown Position Function, with two channels in each trip system, are available and required to be OPERABLE. The Reactor Mode - Switch Shutdown Position Function is required to be OPERABLE in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.
- 12. Manual Scram The Manual Scram push button channels provide signals, via the manual scram logic channels, to each of the four RPS logic channels that are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis.
BW R/6 STS B 3.3.1.1-24 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
There is one Manual Scram push button channel for each of the four RPS logic channels. In order to cause a scram it is necessary that at least one channel in each trip system be actuated.
There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.
Four channels of Manual Scram with two channels in each trip system arranged in a one-out-of-two logic, are available and required to be OPERABLE in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.
ACTIONS -----------------------------------REVIEW ERS NOTE-----------------------------------
Certain LCO Completion Times are based on approved topical reports. In order for a licensee to use the times, the licensee must justify the Completion Times as required by the staff Safety Evaluation Report (SER) for the topical report.
A Note has been provided to modify the ACTIONS related to RPS instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RPS instrumentation channels provide appropriate compensatory measures for separate, inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RPS instrumentation channel.
A.1 and A.2 Because of the diversity of sensors available to provide trip signals and the redundancy of the RPS design, an allowable out of service time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> has been shown to be acceptable (Ref. 10) to permit restoration of any inoperable channel to OPERABLE status. However, this out of service time is only acceptable provided the associated Function's inoperable channel is in one trip system and the Function still maintains RPS trip capability (refer to Required Actions B.1, B.2, and C.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within BW R/6 STS B 3.3.1.1-25 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES ACTIONS (continued) the allowable out of service time, the channel or the associated trip system must be placed in the tripped condition per Required Actions A.1 and A.2. Placing the inoperable channel in trip (or the associated trip system in trip) would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel (or trip system) in trip (e.g., as in the case where placing the inoperable channel in trip would result in a full scram), Condition D must be entered and its Required Action taken.
B.1 and B.2 Condition B exists when, for any one or more Functions, at least one required channel is inoperable in each trip system. In this condition, provided at least one channel per trip system is OPERABLE, the RPS still maintains trip capability for that Function, but cannot accommodate a single failure in either trip system.
Required Actions B.1 and B.2 limit the time the RPS scram logic for any Function would not accommodate single failure in both trip systems (e.g.,
one-out-of-one and one-out-of-one arrangement for a typical four channel Function). The reduced reliability of this logic arrangement was not evaluated in Reference 10 for the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Completion Time. W ithin the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowance, the associated Function will have all required channels either OPERABLE or in trip (or in any combination) in one trip system.
Completing one of these Required Actions restores RPS to an equivalent reliability level as that evaluated in Reference 10, which justified a 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowable out of service time as presented in Condition A. The trip system in the more degraded state should be placed in trip or, alternatively, all the inoperable channels in that trip system should be placed in trip (e.g., a trip system with two inoperable channels could be in a more degraded state than a trip system with four inoperable channels, if the two inoperable channels are in the same Function while the four inoperable channels are all in different Functions). The decision as to which trip system is in the more degraded state should be based on prudent judgment and current plant conditions (i.e., what MODE the plant is in). If this action would result in a scram or recirculation pump trip, it is permissible to place the other trip system or its inoperable channels in trip.
BW R/6 STS B 3.3.1.1-26 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES ACTIONS (continued)
The 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Completion Time is judged acceptable based on the remaining capability to trip, the diversity of the sensors available to provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of a scram.
Alternately, if it is not desired to place the inoperable channels (or one trip system) in trip (e.g., as in the case where placing the inoperable channel or associated trip system in trip would result in a scram [or RPT]),
Condition D must be entered and its Required Action taken.
C.1 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same trip system for the same Function result in the Function not maintaining RPS trip capability. A Function is considered to be maintaining RPS trip capability when sufficient channels are OPERABLE or in trip (or the associated trip system is in trip), such that both trip systems will generate a trip signal from the given Function on a valid signal. For the typical Function with one-out-of-two taken twice logic and the IRM and APRM Functions, this would require both trip systems to have one channel OPERABLE or in trip (or the associated trip system in trip). For Function 6 (Main Steam Isolation Valve - Closure), this would require both trip systems to have each channel associated with the MSIVs in three MSLs (not necessarily the same MSLs for both trip systems), OPERABLE or in trip (or the associated trip system in trip).
For Function 9 (Turbine Stop Valve Closure, Trip Oil Pressure - Low), this would require both trip systems to have three channels, each OPERABLE or in trip (or the associated trip system in trip).
The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.
BW R/6 STS B 3.3.1.1-27 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES ACTIONS (continued)
D.1 Required Action D.1 directs entry into the appropriate Condition referenced in Table 3.3.1.1-1. The applicable Condition specified in the Table is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed.
Each time an inoperable channel has not met any Required Action of Condition A, B, or C, and the associated Completion Time has expired, Condition D will be entered for that channel and provides for transfer to the appropriate subsequent Condition.
E.1, F.1, G.1, and H.1 If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. The Completion Times are reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems. In addition, the Completion Time of Required Action E.1 is consistent with the Completion Time provided in LCO 3.2.2, "MINIMUM CRITICAL POW ER RATIO (MCPR)."
I.1 If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are, therefore, not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted.
SURVEILLANCE -----------------------------------REVIEW ERS NOTE-----------------------------------
REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a licensee to use these Frequencies, the licensee must justify the Frequencies as required by the staff SER for the topical report.
BASES SURVEILLANCE REQUIREMENTS (continued)
BW R/6 STS B 3.3.1.1-28 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1
REVIEW ERS NOTE ------------------------------------
The Notes in Table 3.3.1.1-1 requiring reset of the channel to a predefined as-left tolerance and the verification of the as-found tolerance are only associated with SL-LSSS values. Therefore, the Notes are applied to specific SRs for the associated functions in the SR column only. The Notes may be placed at the top of the Allowable Value column in the Table and applied to all Functions with allowable values in the table.
REVIEW ERS NOTE ------------------------------------
Notes 1 and 2 are applied to the setpoint verification Surveillances for all SL-LSSS Functions unless one or more of the following exclusions apply:
- 1. Notes 1 and 2 are not applied to SL-LSSS Functions which utilize mechanical components to sense the trip setpoint or to manual initiation circuits (the latter are not explicitly modeled in the accident analysis). Examples of mechanical components are limit switches, float switches, proximity detectors, manual actuation switches, and other such devices that are normally only checked on a "go/no go" basis. Note 1 requires a comparison of the periodic surveillance requirement results to provide an indication of channel (or individual device) performance. This comparison is not valid for most mechanical components. W hile it is possible to verify that a limit switch functions at a point of travel, a change in the surveillance result probably indicates that the switch has moved, not that the input/output relationship has changed. Therefore, a comparison of surveillance requirement results would not provide an indication of the channel or component performance.
- 2. Notes 1 and 2 are not applied to Technical Specifications associated with mechanically operated safety relief valves. The performance of these components is already controlled (i.e., trended with as-left and as-found limits) under the ASME Section XI testing program.
- 3. Notes 1 and 2 are may not applyied to SL-LSSS Functions and Surveillances which test only digital components. For purely digital components, such as actuation logic circuits and associated relays, there is no expected change in result between surveillance performances other than measurement and test errors (M&TE) and, therefore, justification is needed to confirm that comparison of Surveillance results does not provide an indication of channel or component performance.
An evaluation of the potential SL-LSSS Functions resulted in Notes 1 and 2 being applied to the Functions shown in the TS markups. Each licensee proposing to fully adopt this TSTF must review the the potential SL-LSSS Functions to identify which of the identified functions are SL-LSSS according to the definition of SL-LSSS and their plant specific safety analysis. The two TSTF Notes are not required to be applied to any BW R/6 STS B 3.3.1.1-29 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 of the listed Functions which meet any of the exclusion criteria or are not SL-LSSS based on the plant specific design and analysis.
As noted at the beginning of the SRs, the SRs for each RPS instrumentation Function are located in the SRs column of Table 3.3.1.1-1.
The Surveillances are modified by a Note to indicate that, when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the RPS reliability analysis (Ref. 10) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> testing allowance does not significantly reduce the probability that the RPS will trip when necessary.
SR 3.3.1.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift on one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.
The agreement criteria includes an expectation of one decade of overlap when transitioning between neutron flux instrumentation. The overlap between SRMs and IRMs must be demonstrated prior to withdrawing SRMs from the fully inserted position since indication is being transitioned from the SRMs to the IRMs. This will ensure that reactor power will not be increased into a neutron flux region without adequate indication. The overlap between IRMs and APRMs is of concern when reducing power into the IRM range (entry into MODE 2 from MODE 1). On power BW R/6 STS B 3.3.1.1-30 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued) increases, the system design will prevent further increases (by initiating a rod block) if adequate overlap is not maintained. Overlap between IRMs and APRMs exists when sufficient IRMs and APRMs concurrently have onscale readings such that the transition between MODE 1 and MODE 2 can be made without either APRM downscale rod block or IRM upscale rod block. Overlap between SRMs and IRMs similarly exists when, prior to withdrawing the SRMs from the fully inserted position, IRMs are above mid-scale on Range 1 before SRMs have reached the upscale rod block.
If overlap for a group of channels is not demonstrated (e.g., IRM/APRM overlap), the reason for the failure of the Surveillance should be determined and the appropriate channels(s) declared inoperable. Only those appropriate channels that are required in the current MODE or condition should be declared inoperable.
The Frequency is based upon operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.
SR 3.3.1.1.2 To ensure that the APRMs are accurately indicating the true core average power, the APRMs are calibrated to the reactor power calculated from a heat balance. LCO 3.2.4, "Average Power Range Monitor (APRM) Gain and Setpoints," allows the APRMs to be reading greater than actual THERMAL POW ER to compensate for localized power peaking. W hen this adjustment is made, the requirement for the APRMs to indicate within 2% RTP of calculated power is modified to require the APRMs to indicate within 2% RTP of calculated MFLPD. The Frequency of once per 7 days is based on minor changes in LPRM sensitivity, which could affect the APRM reading between performances of SR 3.3.1.1.6.
A restriction to satisfying this SR when < 25% RTP is provided that requires the SR to be met only at $ 25% RTP because it is difficult to accurately maintain APRM indication of core THERMAL POW ER consistent with a heat balance when < 25% RTP. At low power levels, a high degree of accuracy is unnecessary because of the large inherent margin to thermal limits (MCPR and APLHGR). At $ 25% RTP, the BW R/6 STS B 3.3.1.1-31 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued)
Surveillance is required to have been satisfactorily performed within the last 7 days in accordance with SR 3.0.2. A Note is provided which allows an increase in THERMAL POW ER above 25% if the 7 day Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after reaching or exceeding 25% RTP. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.
SR 3.3.1.1.3 The Average Power Range Monitor Flow Biased Simulated Thermal Power - High Function uses the recirculation loop drive flows to vary the trip setpoint. This SR ensures that the total loop drive flow signals from the flow unit used to vary the setpoint are appropriately compared to a calibrated flow signal and therefore the APRM Function accurately reflects the required setpoint as a function of flow. Each flow signal from the respective flow unit must be # 105% of the calibrated flow signal. If the flow unit signal is not within the limit, the APRMs that receive an input from the inoperable flow unit must be declared inoperable.
The Frequency of 7 days is based on engineering judgment, operating experience, and the reliability of this instrumentation.
SR 3.3.1.1.4 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
BW R/6 STS B 3.3.1.1-32 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued)
As noted, SR 3.3.1.1.4 is not required to be performed when entering MODE 2 from MODE 1 since testing of the MODE 2 required IRM and APRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This allows entry into MODE 2 if the 7 day Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after entering MODE 2 from MODE 1.
Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.
A Frequency of 7 days provides an acceptable level of system average unavailability over the Frequency interval and is based on reliability analysis (Ref. 10).
SR 3.3.1.1.5 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. In accordance with Reference 10, the scram contacts must be tested as part of the Manual Scram Function. A Frequency of 7 days provides an acceptable level of system average availability over the Frequency and is based on the reliability analysis of Reference 10. (The Manual Scram Function's CHANNEL FUNCTIONAL TEST Frequency was credited in the analysis to extend many automatic scram Functions' Frequencies.)
SR 3.3.1.1.6 LPRM gain settings are determined from the local flux profiles measured by the Traversing Incore Probe (TIP) System. This establishes the relative local flux profile for appropriate representative input to the APRM System. The 1000 MW D/T Frequency is based on operating experience with LPRM sensitivity changes.
BW R/6 STS B 3.3.1.1-33 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.1.1.7 and SR 3.3.1.1.10 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The 92 day Frequency of SR 3.3.1.1.7 is based on the reliability analysis of Reference 10.
The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency.
SR 3.3.1.1.8 The calibration of trip units provides a check of the actual trip setpoints.
The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.1.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond conservative with respect to the Allowable Value, the channel performance is still within the requirements of the plant safety analysis.
Under these conditions, the setpoint must be readjusted to be equal to or more conservative thanthe [LTSP] within the as-left tolerance as accounted for in the appropriate setpoint methodology.
The Frequency of 92 days for SR 3.3.1.1.8 is based on the reliability analysis of Reference 10.
BW R/6 STS B 3.3.1.1-34 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.1.1.8 for SL-LSSS are modified by two Notes as identified in Table 3.3.1.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with safety analysis setpoint methodology assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. These channels will also be identified in the Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition for continued OPERABILITY. The second Note requires that the as-left setting for the instrument be returned to within the as-left tolerance of the [LTSP].
W here a setpoint more conservative than the [LTSP] is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left instrument setting cannot be returned to a setting within the as-left tolerance of the [LTSP], then the instrument channel shall be declared inoperable.
The second Note also requires that [LTSP] and the methodologies for calculating the as-left and the as-found tolerances be in [a document controlled under 10 CFR 50.59].
SR 3.3.1.1.9 and SR 3.3.1.1.11 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to the [LTSP] within the as-left tolerance to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
Note 1 states that neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices, with minimal drift, and because of the difficulty of simulating a meaningful signal. Changes in neutron detector sensitivity are compensated for by performing the 7 day calorimetric calibration (SR 3.3.1.1.2) and the 1000 MW D/T LPRM calibration against the TIPs (SR 3.3.1.1.6). A second Note is provided that requires the APRM and IRM SRs to be performed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of entering MODE 2 from MODE 1. Testing of the MODE 2 APRM and IRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This Note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2. Twelve hours is BW R/6 STS B 3.3.1.1-35 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 based on operating experience and in consideration of providing a reasonable time in which to complete the SR.
The Frequency of SR 3.3.1.1.9 is based upon the assumption of a 184 day calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. The Frequency of SR 3.3.1.1.11 is based on the assumption of an 18 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.
SRs 3.3.1.1.9 and 3.3.1.1.11 for SL-LSSS functions is modified by two Notes as identified in Table 3.3.1.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with safety analysis setpoint methodology assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. These channels will also be identified in the Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition for continued OPERABILITY. The second Note requires that the as-left setting for the instrument be returned to within the as-left tolerance of the [LTSP]. W here a setpoint more conservative than the
[LTSP] is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left instrument setting cannot be returned to a setting within the as-left tolerance of the [LTSP],
then the instrument channel shall be declared inoperable.
The second Note also requires that [LTSP] and the methodologies for calculating the as-left and the as-found tolerances be in [a document controlled under 10 CFR 50.59].
SR 3.3.1.1.12 The Average Power Range Monitor Flow Biased Simulated Thermal Power - High Function uses an electronic filter circuit to generate a signal proportional to the core THERMAL POW ER from the APRM neutron flux signal. This filter circuit is representative of the fuel heat transfer dynamics that produce the relationship between the neutron flux and the core THERMAL POW ER. The filter time constant must be verified to ensure that the channel is accurately reflecting the desired parameter.
The Frequency of 18 months is based on engineering judgment and reliability of the components.
BW R/6 STS B 3.3.1.1-36 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.1.1.13 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The functional testing of control rods, in LCO 3.1.3, "Control Rod OPERABILITY," and SDV vent and drain valves, in LCO 3.1.8, "Scram Discharge Volume (SDV) Vent and Drain Valves," overlaps this Surveillance to provide complete testing of the assumed safety function.
The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency.
SR 3.3.1.1.14 This SR ensures that scrams initiated from the Turbine Stop Valve Closure, Trip Oil Pressure - Low and Turbine Control Valve Fast Closure, Trip Oil Pressure - Low Functions will not be inadvertently bypassed when THERMAL POW ER is $ 40% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodology are incorporated into the actual setpoint. Because main turbine bypass flow can affect this setpoint nonconservatively (THERMAL POW ER is derived from turbine first stage pressure), the main turbine bypass valves must remain closed at THERMAL POW ER $ 40% RTP to ensure that the calibration remains valid.
If any bypass channel setpoint is nonconservative (i.e., the Functions are bypassed at $ 40% RTP, either due to open main turbine bypass valve(s) or other reasons), then the affected Turbine Stop Valve, Trip Oil Pressure
- Low and Turbine Control Valve Fast Closure, Trip Oil Pressure - Low Functions are considered inoperable. Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel is considered OPERABLE.
The Frequency of 18 months is based on engineering judgment and reliability of the components.
BW R/6 STS B 3.3.1.1-37 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.1.1.15 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The RPS RESPONSE TIME acceptance criteria are included in Reference 11.
RPS RESPONSE TIME may be verified by actual response time measurements in any series of sequential, overlapping, or total channel measurements.
[-----------------------------------REVIEW ERS NOTE----------------------------------
The following Bases are applicable for plants adopting NEDO-32291-A and/or Supplement 1.
However, the sensors for Functions 3, 4, and 5 are allowed to be excluded from specific RPS RESPONSE TIME measurement if the conditions of Reference 12 are satisfied. If these conditions are satisfied, sensor response time may be allocated based on either assumed design sensor response time or the manufacturer's stated design response time.
W hen the requirements of Reference 12 are not satisfied, sensor response time must be measured. Furthermore, measurement of the instrument loops response times for Functions 3, 4, and 5 is not required if the conditions of Reference 13 are satisfied.]
As noted, neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time.
RPS RESPONSE TIME tests are conducted on an 18 month STAGGERED TEST BASIS. Note 2 requires STAGGERED TEST BASIS Frequency to be determined based on 4 channels per trip system, in lieu of the 8 channels specified in Table 3.3.1.1-1 for the MSIV Closure Function. This Frequency is based on the logic interrelationships of the various channels required to produce an RPS scram signal. Therefore, staggered testing results in response time verification of these devices every 18 months. The 18 month Frequency is consistent with the typical industry refueling cycle and is based upon plant operating experience, which shows that random failures of instrumentation components causing serious time degradation, but not channel failure, are infrequent.
BW R/6 STS B 3.3.1.1-38 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 BASES REFERENCES 1. Regulatory Guide 1.105, Revision 3, "Setpoints for Safety-Related Instrumentation."
- 2. FSAR, Figure [ ].
- 3. FSAR, Section [5.2.2].
- 4. FSAR, Section [6.3.3].
- 5. FSAR, Chapter [15].
- 6. FSAR, Section [15.4.1].
- 7. NEDO-23842, "Continuous Control Rod W ithdrawal in the Startup Range," April 18, 1978.
- 8. FSAR, Section [15.4.9].
- 9. Letter, P. Check (NRC) to G. Lainas (NRC), "BW R Scram Discharge System Safety Evaluation," December 1, 1980.
- 10. NEDO-30851-P-A, "Technical Specification Improvement Analyses for BW R Reactor Protection System," March 1988.
- 11. FSAR, Table [ ].
[12. NEDO-32291-A, "System Analyses For the Elimination of Selected Response Time Testing Requirements," October 1995.
- 13. NEDO-32291-A, Supplement 1, "System Analyses for The Elimination of Selected Response Time Testing Requirements,"
October 1999.]
BW R/6 STS B 3.3.1.1-39 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1 Table B 3.3.1.1-1 (page 1 of 1)
RPS Instrumentation Sensor Diversity Scram Sensors for Initiating Events RPV Variables Anticipatory Fuel Initiation Events (a) (b) (c) (d) (e) (f) (g)
MSIV Closure x x x x Turbine Trip (w/bypass) x x x x Generator Trip (w/bypass) x x x Pressure Regulator Failure x x x x x (primary pressure decrease)
(MSIV closure trip)
Pressure Regulator Failure x x x (primary pressure decrease)
(Level 8 trip)
Pressure Regulator Failure x x (primary pressure increase)
Feedwater Controller Failure x x x x (high reactor water level)
Feedwater Controller Failure x x x (low reactor water level)
Loss of Condenser Vacuum x x x x Loss of AC Power (loss of x x x x transformer)
Loss of AC Power (loss of x x x x x x grid connections)
(a) Reactor Vessel Steam Dome Pressure - High (b) Reactor Vessel W ater Level - High, Level 8 (c) Reactor Vessel W ater Level - Low, Level 3 (d) Turbine Control Valve Fast Closure (e) Turbine Stop Valve - Closure (f) Main Steam Isolation Valve - Closure (g) Average Power Range Monitor Neutron Flux - High BW R/6 STS B 3.3.1.1-40 Rev. 3.0, 03/31/04
RPS Instrumentation B 3.3.1.1
REVIEW ERS NOTE--------------------------------------------
This Table for illustration purposes only.
BW R/6 STS B 3.3.1.1-41 Rev. 3.0, 03/31/04