ML072120100
| ML072120100 | |
| Person / Time | |
|---|---|
| Site: | Technical Specifications Task Force |
| Issue date: | 07/25/2007 |
| From: | Kobetz T NRC/NRR/ADRO/DIRS/ITSB |
| To: | Technical Specifications Task Force |
| Schulten C. S., NRR/DIRS, 415-1192 | |
| Shared Package | |
| ML072070202 | List: |
| References | |
| TAC MD5249, TSTF-493, Rev 2 | |
| Download: ML072120100 (14) | |
Text
B 3.3 INSTRUMENTATION B 3.3.4.1 End of Cycle Recirculation Pump Trip (EOC-RPT) Instrumentation BASES BACKGROUND The EOC-RPT instrumentation initiates a recirculation pump trip (RPT) to reduce the peak reactor pressure and power resulting from turbine trip or generator load rejection transients to provide additional margin to core thermal MCPR Safety Limits (SLs).
The need for the additional negative reactivity in excess of that normally inserted on a scram reflects end of cycle reactivity considerations. Flux shapes at the end of cycle are such that the control rods may not be able to ensure that thermal limits are maintained by inserting sufficient negative reactivity during the first few feet of rod travel upon a scram caused by Turbine Control Valve (TCV) Fast Closure, Trip Oil Pressure -
Low, or Turbine Stop Valve Closure, Trip Oil Pressure - Low (TSV). The physical phenomenon involved is that the void reactivity feedback due to a pressurization transient can add positive reactivity at a faster rate than the control rods can add negative reactivity.
This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters and equipment performance. The subset of LSSS that directly protect against violating the Rreactor Ccore Safety Limits or the and Reactor Coolant System (RCS) Ppressure boundary sSafety Llimits during anticipated operational occurrences (AOOs) are referred to as Safety Limit LSSS (SL-LSSS)
Technical Specifications are required by 10 CFR 50.36 to contain LSSS defined by the regulation as "...settings for automatic protective devices...so chosen that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded." 10 CFR 50.36(c)(1)(ii)(A) requires that TSs include LSSSs for variables that have significant safety functions. For variables on which a SL has been placed, the LSSS must be chosen to initiate automatic protective action to correct abnormal situations before the SL is exceeded. The Analytical Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protective devices must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.
REVIEW ER'S NOTE ----------------------------------
The term "Limiting Trip Setpoint (LTSP)" is generic terminology for the setpoint value calculated by means of the plant-specific setpoint methodology documented in a document controlled under 10 CFR 50.59.
The term Limiting Trip Setpoint indicates that no additional margin has been added between the Analytical Limit and the calculated trip setting.
BW R/6 STS B 3.3.4.1-1 Rev. 3.0, 03/31/04
W here margin is added between the Analytical Limit and trip setpoint, the term Nominal Trip Setpoint (NTSP) is preferred. The trip setpoint (field setting) may be more conservative than the Limiting or Nominal Trip Setpoint. W here the [LTSP] is not documented in SR 3.3.4.1.3 for the purpose of compliance with 10 CFR 50.36, the plant-specific term for the Limiting or Nominal Trip Setpoint must be cited in Note 2 of the SR table.
The brackets indicate plant-specific terms may apply, as reviewed and approved by the NRC. The as-found and as-left tolerances will apply to the actual setpoint implemented in the Surveillance procedures to confirm channel performance.
Licensees are to insert the name of the document(s) controlled under 10 CFR 50.59 that contain the [LTSP] and the methodology for calculating the as-left and as-found tolerances, for the phrase "[a document controlled under 10 CFR 50.59]" in the specifications.
BASES BACKGROUND (continued)
The [Limiting Trip Setpoint (LTSP)] is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit and thus ensuring that the SL would not be exceeded. As such, the [LTSP] accounts for uncertainties in setting the device (e.g., calibration), uncertainties in how the device might actually perform (e.g., repeatability), changes in the point of action of the device over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the
[LTSP] ensures that SLs are not exceeded. As such, the [LTSP] meets the definition of an SL-LSSS (Ref. 1).
Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as "...being capable of performing its safety function(s)." Use of the [LTSP] to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as-found" value of a protective device setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the [LTSP] due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the [LTSP] and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as-found" setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the BW R/6 STS B 3.3.4.1-2 Rev. 3.0, 03/31/04
device to the [LTSP] to account for further drift during the next surveillance interval.
However, there is also some point beyond which the device would have not been able to perform its function due, for example, to greater than expected drift. The Allowable Value specified in Table 3.3.1.1-1 is the least conservative value of the as-found setpoint that a channel can have during testing such that a channel is OPERABLE if the trip setpoint is found conservative with respect to the Allowable Value during the CHANNEL CALIBRATION. Note that, although a channel is OPERABLE under these circumstances, the setpoint must be left adjusted to a value within the established as-left tolerance of the [LTSP] and confirmed to be operating within the statistical allowances of the uncertainty terms assigned in the setpoint calculation. As such, the Allowable Value differs from the [LTSP] by an amount equal to [or greater than] the as-found tolerance value. In this manner, the actual setting of the device ensures that a SL is not BASES BACKGROUND (continued) exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.
If the actual setting of the device is found to be conservative with respect to the Allowable Value but is beyond the as-found tolerance band, then this condition indicates that the instrument is degraded and is not performing in accordance with the setpoint methodology assumptions.
This condition must be entered into the plant corrective action program, the trip setpoint must be left adjusted to a value within the as-left tolerance band, and an immediate determination of operability decision must be made.
If the actual setting of the device is found to be non-conservative with respect to the Allowable Value the device would be considered inoperable from a Technical Specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
If the actual setting of the device is found to be non-conservative with respect to the Allowable Value, the device would be considered inoperable from a Technical Specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
The EOC-RPT instrumentation as shown in Reference 1 is comprised of sensors that detect initiation of closure of the TSVs, or fast closure of the TCVs, combined with relays, logic circuits, and fast acting circuit breakers that interrupt the power from the recirculation pump motor generator (MG) set generators to each of the recirculation pump motors. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. W hen the setpoint is BW R/6 STS B 3.3.4.1-3 Rev. 3.0, 03/31/04
exceeded, the channel output relay actuates, which then outputs an EOC-RPT signal to the trip logic. W hen the RPT breakers trip open, the recirculation pumps coast down under their own inertia. The EOC-RPT has two identical trip systems, either of which can actuate an RPT.
Each EOC-RPT trip system is a two-out-of-two logic for each Function; thus, either two TSV Closure, Trip Oil Pressure - Low or two TCV Fast Closure, Trip Oil Pressure - Low signals are required for a trip system to actuate. If either trip system actuates, both recirculation pumps will trip.
There are two EOC-RPT breakers in series per recirculation pump. One trip system trips one of the two EOC-RPT breakers for each recirculation pump and the second trip system trips the other EOC-RPT breaker for each recirculation pump.
BASES APPLICABLE The TSV Closure, Trip Oil Pressure - Low and the TCV Fast Closure, Trip SAFETY Oil Pressure - Low Functions are designed to trip the recirculation pumps ANALYSES, LCO, in the event of a turbine trip or generator load rejection to mitigate the and APPLICABILITY neutron flux, heat flux and pressurize transients, and to increase the margin to the MCPR SL. The analytical methods and assumptions used in evaluating the turbine trip and generator load rejection, as well as other safety analyses that assume EOC-RPT, are summarized in References 2, 3, and 4.
To mitigate pressurization transient effects, the EOC-RPT must trip the recirculation pumps after initiation of initial closure movement of either the TSVs or the TCVs. The combined effects of this trip and a scram reduce fuel bundle power more rapidly than does a scram alone, resulting in an increased margin to the MCPR SL. Alternatively, MCPR limits for an inoperable EOC-RPT as specified in the COLR are sufficient to mitigate pressurization transient effects. The EOC-RPT function is automatically disabled when turbine first stage pressure is < [40%] RTP.
EOC-RPT instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Limiting Trip Setpoints that directly protect against violating the rReactor cCore Safety Limits or the Reactor Coolant System (RCS) pPressure boundary Safety Limits during anticipated operational occurrences (AOOs) are Safety Limit-Limiting Safety System Settings (SL-LSSS).
Permissive and interlock setpoints allow bypass of trips when they are not required by the Safety Analysis. These permissives and interlocks ensure that the starting conditions are consistent with the safety analysis, before preventative or mitigating actions occur. Because these permissives or interlocks are only one of multiple conservative starting assumptions for the accident analysis, they are generally considered as nominal values without regard to measurement accuracy, (i.e. the value indicated is sufficiently close to the necessary value to ensure proper operation of the safety systems to turn the AOO). Therefore permissives and interlocks are not considered to be SL-LSSS.
The OPERABILITY of the EOC-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have a required number of OPERABLE channels in each trip system, with their setpoints conservative with respect towithin the specified Allowable BW R/6 STS B 3.3.4.1-4 Rev. 3.0, 03/31/04
Value LTSP of SR 3.3.4.1.3. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the associated EOC-RPT breakers. Each channel (including the associated EOC-RPT breakers) must also respond within its assumed response time.
Allowable Values are specified for each EOC-RPT Function specified in the LCO. The Allowable Value specified in SR 3.3.4.1.3 is the least conservative value of the as-found setpoint that a channel can have during testing such that a channel is OPERABLE if the trip setpoint is found conservative with respect to the Allowable Value during the CHANNEL CALIBRATION. Note that, although a channel is OPERABLE under these circumstances, the setpoint must be left adjusted to a value within the as-left tolerance of the [LTSP] and confirmed to be operating within the statistical allowances of the uncertainty terms assigned in the setpoint calculation. As such, the Allowable Value differs from the [LTSP]
by an amount equal to [or greater than] the as-found tolerance value. In this manner, the actual setting of the device ensures that an SL is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.
If the actual setting of the device is found to be conservative with respect to the Allowable Value but is beyond the as-found tolerance band, then this condition indicates that the instrument is degraded and is not performing in accordance with the setpoint methodology assumptions.
This condition must be entered into the plant corrective action program, the trip setpoint must be left adjusted to a value within the as-left tolerance band, and an immediate determination of operability decision must be made.
If the actual setting of the device is found to be non-conservative with respect to the Allowable Value, the device would be considered inoperable from a Technical Specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
[Limiting Trip Setpoints] are specified in [a document controlled under 10 CFR 50.59].Nominal trip setpoints are specified in the setpoint calculations. A channel is inoperable if its actual trip setpoint is not conservative with respect towithin its required Allowable Value. The LTSPs nominal setpoints are selected to ensure the actual setpoints are conservative with respect to the as-found tolerance band do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS.
After each calibration the trip setpoint should be reset to within the as-left band around the [LTSP].
Operation with a trip setpoint less conservative than the nominal trip setpoint, but conservative with respect towithin its Allowable Value, is acceptable. [Limiting Trip Setpoints]Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., TSV electrohydraulic control (EHC) pressure), and when the measured output value of the process parameter exceeds the setpoint, the associated BW R/6 STS B 3.3.4.1-5 Rev. 3.0, 03/31/04
device (e.g., trip unit) changes state. The analytical limits are derived from the limiting values of the process BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) parameters obtained from the safety analysis. The Allowable Values are derived from the analytical limits, corrected for calibration, process, and some of the instrument errors. The [Limiting Trip Setpoints]trip setpoints are then determined accounting for the remaining instrument errors (e.g.,
drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.
The specific Applicable Safety Analysis, LCO, and Applicability discussions are listed below on a Function by Function basis.
Alternately, since this instrumentation protects against a MCPR SL violation with the instrumentation inoperable, modifications to the MCPR limits (LCO 3.2.2) may be applied to allow this LCO to be met. The MCPR penalty for the Condition EOC-RPT inoperable is specified in the COLR.
Turbine Stop Valve Closure, Trip Oil Pressure - Low Closure of the TSVs and a main turbine trip result in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, an RPT is initiated on TSV Closure, Trip Oil Pressure - Low in anticipation of the transients that would result from closure of these valves. EOC-RPT decreases reactor power and aids the reactor scram in ensuring the MCPR SL is not exceeded during the worst case transient.
Closure of the TSVs is determined by measuring the EHC fluid pressure at each stop valve. There is one pressure transmitter associated with each stop valve, and the signal from each transmitter is assigned to a separate trip channel. The logic for the TSV Closure, Trip Oil Pressure -
Low Function is such that two or more TSVs must be closed to produce an EOC-RPT. This Function must be enabled at THERMAL POW ER
$ 40% RTP. This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure; therefore, to consider this Function OPERABLE, the turbine bypass valves must remain shut at THERMAL POW ER $ 40% RTP. Four channels of TSV Closure, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal. The TSV Closure, Trip Oil Pressure - Low Allowable Value is selected high enough to detect imminent TSV closure.
BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
BW R/6 STS B 3.3.4.1-6 Rev. 3.0, 03/31/04
This protection is required, consistent with the safety analysis assumptions, whenever THERMAL POW ER is $ 40% RTP with any recirculating pump in fast speed. Below 40% RTP or with the recirculation in slow speed, the Reactor Vessel Steam Dome Pressure -
High and the Average Power Range Monitor (APRM) Fixed Neutron Flux
- High Functions of the Reactor Protection System (RPS) are adequate to maintain the necessary safety margins.
The automatic enable setpoint is feedwater temperature dependent as a result of the subcooling changes that affect the turbine first stage pressure/reactor power relationship. For operation with feedwater temperature $ 420°F, an Allowable Value setpoint of # 26.9% of control valves wide open turbine first stage pressure is provided for the bypass function. The Allowable Value setpoint is reduced to # 22.5% of control valve wide open turbine first stage pressure for operation with a feedwater temperature between 370°F and 420°F.
TCV Fast Closure, Trip Oil Pressure - Low Fast closure of the TCVs during a generator load rejection results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, an RPT is initiated on TCV Fast Closure, Trip Oil Pressure - Low in anticipation of the transients that would result from the closure of these valves. The EOC-RPT decreases reactor power and aids the reactor scram in ensuring that the MCPR SL is not exceeded during the worst case transient.
Fast closure of the TCVs is determined by measuring the EHC fluid pressure at each control valve. There is one pressure transmitter associated with each control valve, and the signal from each transmitter is assigned to a separate trip channel. The logic for the TCV Fast Closure, Trip Oil Pressure - Low Function is such that two or more TCVs must be closed (pressure transmitter trips) to produce an EOC-RPT. This Function must be enabled at THERMAL POW ER $ 40% RTP. This is normally accomplished automatically by pressure transmitters sensing turbine first stage pressure; therefore, to consider this Function OPERABLE, the turbine bypass valves must remain shut at THERMAL POW ER $ 40% RTP. Four channels of TCV Fast Closure, Trip Oil Pressure - Low, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal. The TCV Fast Closure, Trip Oil Pressure - Low Allowable Value is selected high enough to detect imminent TCV fast closure.
BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
This protection is required consistent with the analysis, whenever the THERMAL POW ER is $ 40% RTP with any recirculating pump in fast speed. Below 40% RTP or with recirculation pumps in slow speed, the Reactor Vessel Steam Dome Pressure - High and the APRM Fixed Neutron Flux - High Functions of the RPS are adequate to maintain the necessary safety margins. The turbine first stage pressure/reactor power BW R/6 STS B 3.3.4.1-7 Rev. 3.0, 03/31/04
relationship for the setpoint of the automatic enable is identical to that described for TSV closure.
ACTIONS -----------------------------------REVIEW ERS NOTE-----------------------------------
Certain LCO Completion Times are based on approved topical reports. In order for a licensee to use the times, the licensee must justify the Completion Times as required by the staff Safety Evaluation Report (SER) for the topical report.
A Note has been provided to modify the ACTIONS related to EOC-RPT instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable EOC-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable channels.
As such, a Note has been provided that allows separate Condition entry for each inoperable EOC-RPT instrumentation channel.
A.1 and A.2 W ith one or more required channels inoperable, but with EOC-RPT trip capability maintained (refer to Required Action B.1 and B.2 Bases), the EOC-RPT System is capable of performing the intended function.
However, the reliability and redundancy of the EOC-RPT instrumentation is reduced such that a single failure in the remaining trip system could result in the inability of the EOC-RPT System to perform the intended function. Therefore, only a limited time is allowed to restore compliance with the LCO. Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of an EOC-RPT, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is allowed to restore the inoperable channels (Required Action A.1) [or apply the EOC-RPT BASES ACTIONS (continued) inoperable MCPR limit]. Alternately, the inoperable channels may be placed in trip (Required Action A.2) since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. As noted in Required Action A.2, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable breaker, since this may not adequately compensate for the inoperable breaker (e.g., the breaker may be inoperable such that it will not open). If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an RPT), or if the inoperable channel is the result of an inoperable breaker, Condition C must be entered and its Required Actions taken.
BW R/6 STS B 3.3.4.1-8 Rev. 3.0, 03/31/04
B.1 and B.2 Required Actions B.1 and B.2 are intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not maintaining EOC-RPT trip capability. A Function is considered to be maintaining EOC-RPT trip capability when sufficient channels are OPERABLE or in trip, such that the EOC-RPT System will generate a trip signal from the given Function on a valid signal and both recirculation pumps can be tripped. This requires two channels of the Function, in the same trip system, to each be OPERABLE or in trip, and the associated EOC-RPT breakers to be OPERABLE or in trip. Alternatively, Required Action B.2 requires the MCPR limit for inoperable EOC-RPT, as specified in the COLR, to be applied. This also restores the margin to MCPR assumed in the safety analysis.
The 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Completion Time is sufficient for the operator to take corrective action, and takes into account the likelihood of an event requiring actuation of the EOC-RPT instrumentation during this period. It is also consistent with the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Completion Time provided in LCO 3.2.2, Required Action A.1, since this instrumentation's purpose is to preclude a MCPR violation.
BASES ACTIONS (continued)
C.1 and C.2 W ith any Required Action and associated Completion Time not met, THERMAL POW ER must be reduced to < 40% RTP within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.
Alternately, the associated recirculation pump may be removed from service since this performs the intended function of the instrumentation.
The allowed Completion Time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is reasonable, based on operating experience, to reduce THERMAL POW ER to < 40% RTP from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE -----------------------------------REVIEW ERS NOTE-----------------------------------
REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a licensee to use these Frequencies, the licensee must justify the Frequencies as required by the staff SER for the topical report.
REVIEW ERS NOTE ------------------------------------
The Notes in SR 3.3.4.1.2 and SR 3.3.4.1.3 requiring reset of the channel to a predefined as-left tolerance and the verification of the as-found tolerance are only associated with SL-LSSS values.
Notes 1 and 2 are applied to the setpoint verification Surveillances for all SL-LSSS Functions unless one or more of the following exclusions apply:
BW R/6 STS B 3.3.4.1-9 Rev. 3.0, 03/31/04
- 1. Notes 1 and 2 are not applied to SL-LSSS Functions which utilize mechanical components to sense the trip setpoint or to manual initiation circuits (the latter are not explicitly modeled in the accident analysis). Examples of mechanical components are limit switches, float switches, proximity detectors, manual actuation switches, and other such devices that are normally only checked on a "go/no go" basis. Note 1 requires a comparison of the periodic surveillance requirement results to provide an indication of channel (or individual device) performance. This comparison is not valid for most mechanical components. W hile it is possible to verify that a limit switch functions at a point of travel, a change in the surveillance result probably indicates that the switch has moved, not that the input/output relationship has changed. Therefore, a comparison of surveillance requirement results would not provide an indication of the channel or component performance.
- 2. Notes 1 and 2 are not applied to Technical Specifications associated with mechanically operated safety relief valves. The performance of these components is already controlled (i.e., trended with as-left and as-found limits) under the ASME Section XI testing program.
- 3. Notes 1 and 2 are may not applyied to SL-LSSS Functions and Surveillances which test only digital components. For purely digital components, such as actuation logic circuits and associated relays, there is no expected change in result between surveillance performances other than measurement and test errors (M&TE) and, therefore, justification is needed to confirm that comparison of Surveillance results does not provide an indication of channel or component performance.
An evaluation of the potential SL-LSSS Functions resulted in Notes 1 and 2 being applied to the Functions shown in the TS markups. Each licensee proposing to fully adopt this TSTF must review the the potential SL-LSSS Functions to identify which of the identified functions are SL-LSSS according to the definition of SL-LSSS and their plant specific safety analysis. The two TSTF Notes are not required to be applied to any of the listed Functions which meet any of the exclusion criteria or are not SL-LSSS based on the plant specific design and analysis.
The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, provided the associated Function maintains EOC-RPT trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 5) assumption of the average time required to perform channel surveillance.
That analysis demonstrated that the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> testing allowance does not significantly reduce the probability that the recirculation pumps will trip when necessary.
BW R/6 STS B 3.3.4.1-10 Rev. 3.0, 03/31/04
SR 3.3.4.1.1 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.
The Frequency of 92 days is based on reliability analysis (Ref. 5).
BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.4.1.2 The calibration of trip units provides a check of the actual trip setpoints.
The channel must be declared inoperable if the setting is discovered to be less conservative than the Allowable Value specified in SR 3.3.4.1.3. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyondconservative with respect to the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.
The Frequency of 92 days is based on assumptions of the reliability analysis (Ref. 5) and on the methodology included in the determination of the trip setpoint.
SR 3.3.4.1.2 for SL-LSSS functions is modified by two Notes. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value.
Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with safety analysis setpoint methodology assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. These channels will also be identified in the Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition for continued OPERABILITY.
The second Note requires that the as-left setting for the instrument be returned to within the as-left tolerance of the [LTSP]. W here a setpoint more conservative than the [LTSP] is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.
If the as-left instrument setting cannot be returned to a setting within the BW R/6 STS B 3.3.4.1-11 Rev. 3.0, 03/31/04
as-left tolerance of the [LTSP], then the instrument channel shall be declared inoperable.
The second Note also requires that [LTSP] and the methodologies for calculating the as-left and the as-found tolerances be in [a document controlled under 10 CFR 50.59].
SR 3.3.4.1.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.
The Frequency is based upon the assumption of an 18 month calibration interval, in the determination of the magnitude of equipment drift in the setpoint analysis.
SR 3.3.4.1.3 for SL-LSSS functions is modified by two Notes. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value.
Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with safety analysis setpoint methodology assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. These channels will also be identified in the Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition for continued OPERABILITY.
The second Note requires that the as-left setting for the instrument be returned to within the as-left tolerance of the [LTSP]. W here a setpoint more conservative than the [LTSP] is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.
If the as-left instrument setting cannot be returned to a setting within the as-left tolerance of the [LTSP], then the instrument channel shall be declared inoperable.
The second Note also requires that [LTSP] and the methodologies for calculating the as-left and the as-found tolerances be in [a document controlled under 10 CFR 50.59].
SR 3.3.4.1.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers is included as a part of this test, overlapping the LOGIC SYSTEM FUNCTIONAL TEST, to provide complete testing of the associated safety function. Therefore, if a breaker is incapable of operating, the associated instrument channel would also be inoperable.
BW R/6 STS B 3.3.4.1-12 Rev. 3.0, 03/31/04
BASES SURVEILLANCE REQUIREMENTS (continued)
The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance test when performed at the 18 month Frequency.
SR 3.3.4.1.5 This SR ensures that an EOC-RPT initiated from the TSV Closure, Trip Oil Pressure - Low and TCV Fast Closure, Trip Oil Pressure - Low Functions will not be inadvertently bypassed when THERMAL POW ER is
$ 40% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodologies are incorporated into the actual setpoint. Because main turbine bypass flow can affect this setpoint nonconservatively (THERMAL POW ER is derived from first stage pressure), the main turbine bypass valves must remain closed at THERMAL POW ER $ 40% RTP to ensure that the calibration remains valid. If any bypass channel's setpoint is nonconservative (i.e., the Functions are bypassed at $ 40% RTP either due to open main turbine bypass valves or other reasons), the affected TSV Closure, Trip Oil Pressure - Low and TCV Fast Closure, Trip Oil Pressure - Low Functions are considered inoperable. Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel considered OPERABLE.
The Frequency of 18 months has shown that channel bypass failures between successive tests are rare.
SR 3.3.4.1.6 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The EOC-RPT SYSTEM RESPONSE TIME acceptance criteria are included in Reference 6.
A Note to the Surveillance states that breaker interruption time may be assumed from the most recent performance of SR 3.3.4.1.7. This is allowed since the time to open the contacts after energization of the trip coil and the arc suppression time are short and do not appreciably change, due to the design of the breaker opening device and the fact that the breaker is not routinely cycled.
BASES SURVEILLANCE REQUIREMENTS (continued)
EOC-RPT SYSTEM RESPONSE TIME tests are conducted on an 18 month STAGGERED TEST BASIS. Response times cannot be BW R/6 STS B 3.3.4.1-13 Rev. 3.0, 03/31/04
determined at power because operation of final actuated devices is required. Therefore, the 18 month Frequency is consistent with the typical industry refueling cycle and is based upon plant operating experience, which shows that random failures of instrumentation components that cause serious response time degradation, but not channel failure, are infrequent occurrences.
SR 3.3.4.1.7 This SR ensures that the RPT breaker interruption time (arc suppression time plus time to open the contacts) is provided to the EOC-RPT SYSTEM RESPONSE TIME test. The 60 month Frequency of the testing is based on the difficulty of performing the test and the reliability of the circuit breakers.
REFERENCES 1. FSAR, Figure [ ] (EOC-RPT instrumentation logic).
- 2. FSAR, Section [5.2.2].
- 3. FSAR, Sections [15.1.1], [15.1.2], and [15.1.3].
- 4. FSAR, Sections [5.5.16.1] and [7.6.10].
- 5. GENE-770-06-1, "Bases for Changes To Surveillance Test Intervals And Allowed Out-Of-Service Times For Selected Instrumentation Technical Specifications," February 1991.
- 6. FSAR, Section [5.5.16.2].
BW R/6 STS B 3.3.4.1-14 Rev. 3.0, 03/31/04