ML082250026
| ML082250026 | |
| Person / Time | |
|---|---|
| Site: | Surry  |
| Issue date: | 09/17/2008 |
| From: | NRC/NRR/ADRO/DORL/LPLII-1 |
| To: | |
| Lingam, Siva NRR/DORL 415-1564 | |
| Shared Package | |
| ML082250008 | List: |
| References | |
| TAC MD6812, TAC MD6813 | |
| Download: ML082250026 (30) | |
Text
3. This renewed license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations: 10 CFR Part 20, Section 30.34 of 10 CFR Part 30, Section 40.41 of 10 CFR Part 40, Sections 50.54 and 50.59 of 10 CFR Part 50, and Section 70.32 of 10 CFR Part 70; and is subject to all applicable provisions of the Act and the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified below:
A. Maximum Power Level The licensee is authorized to operate the facility at steady state reactor core power levels not in excess of 2546 megawatts (thermal).
B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 261, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance With the Technical Specifications.
C. Reports The licensee shall make certain reports in accordance with the requirements of the Technical Specifications.
D. Records The licensee shall keep facility operating records in accordance with the requirements of the Technical Specifications.
E. Deleted by Amendment 65 F. Deleted by Amendment 71 G. Deleted by Amendment 227 H. Deleted by Amendment 227 I. Fire Protection The licensee shall implement and maintain in effect the provisions of the approved -fire-protection-program as-described-in-the-Updated Final -Safety-Analysis Report and as approved in the SER dated September 19, 1979, (and Supplements dated May 29, 1980, October 9, 1980, December 18, 1980, February 13, 1981, December 4, 1981, April 27, 1982, November 18, 1982, January 17, 1984, February 25, 1988, and SURRY UNIT 1 Renewed License No. DPR-32 E. Pursuant to the Act and 10 CFR Parts 30 and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.
- 3. This renewed license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations: 10 CFR Part 20, Section 30.34 of 10 CFR Part 30, Section 40.41 of 10 CFR Part 40, Sections 50.54 and 50.59 of 10 CFR Part 50, and Section 70.32 of 10 CFR Part 70; and is subject to all applicable provisions of the Act and the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified below:
A. Maximum Power Level The licensee is authorized to operate the facility at steady state reactor core power levels not in excess of 2546 megawatts (thermal).
B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No.
261
, are hereby incorporated in this renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.
C. Reports The licensee shall make certain reports in accordance with the requirements of the Technical Specifications.
D. Records The licensee shall keep facility operating records in accordance with the requirements of the Technical Specifications.
E. Deleted by Amendment 54 F. Deleted by Amendment 59 and Amendment 65 G. Deleted by Amendment 227 H. Deleted by Amendment 227 SURRY - UNIT 2 Renewed License No. DPR-37
TS 2.2-2 The nominal settings of the power-operated relief valves at 2335 psig, the reactor high pressure trip at 2380 psig and the safety valves at 2485 psig are established to assure never reaching the Reactor Coolant System pressure safety limit. The initial hydrostatic test has been conducted at g toassue th inegrity the
.Coolant System.
- 1) TFSARSection4
- 2) UFSAR Section 4.3 Amendment Nos. 261 and 261
TS 2.3-1 2.3 LIMITING SAFETY SYSTEM SETTINGS, PROTECTIVE INSTRUMENTATION Applicability Applies to trip and permissive settings for instruments monitoring reactor power; and reactor coolant pressure, temperature, and flow; and pressurizer level.
Obiective To provide for automatic protective action in the event that the principal process variables approach a safety limit.
Specification A. Protective instrumentation settings for reactor trip shall be as follows:
- 1. Startup Protection (a) High flux, power range (low set point) - < 25% of rated power.
(b) High flux, intermediate range (high set point) - current equivalent to < 40% of full power.
(c) High flux, source range (high set point) - Neutron flux < 1.51 x 105 counts/sec.
- 2. Core Protection (a) High flux, power range (high set point) - < 109% of rated power.
Amendment Nos. 261 and 261
TS 2.3-2 (b) High pressurizer pressure - _<2380 psig.
(c) Low pressurizer pressure - > 1875 psig.
(d) Overtemperature AT I
( + tl*fA)
,,T _,,To.KIr -K2,'--'"s
" (T-T') + K(P -P')-fAl where AT0 Indicated AT at rated thermal power, TF T
Average coolant temperature, *F T'
573.0°F P = Pressurizer pressure, psig P'= 2235 psig K1 = 1.135 K2 = 0.01072 K3 = 0.000566 Al = qt - qb, where qt and qb are the percent power in the top and bottom halves of the core respectively, and q, + qb is total core power in percent of rated power f(AI) = function of AI, percent of rated core power as shown in Figure 2.3-1 t1 > 29.7 seconds t2 < 4.4 seconds The channel's maximum Trip Setpoint shall not exceed its computed Trip Setpoint by more than 2.0% of the AT span. (Note that 2.0% of the AT span is equal to 3.0% AT Power.)
(e) Overpower AT AT<5 ATO[K 4 - K
"( t3" t
s KT6 T - T') - f(A)]
-~~~~~
- t3 jw.-oT-w -
Amendment Nos. 261 and 261
TS 2.3-3 where ATo = Indicated AT~at rated thermal power, 'F T = Average coolant temperature, *F T'= Average coolant temperature measured at nominal conditions and rated power, 'F K4 = A constant = 1.089 K5 = 0 for decreasing average temperature A constant, for increasing average temperature 0.02/°F K6 = 0 for T < T'
= 0.001086 for T > T' f(AI) as defined in (d) above
't3 > 9.0 seconds The channel's maximum Trip Setpoint shall not exceed its computed Trip Setpoint by more than 2.0% of the AT span. (Note that 2.0% of the AT span is equal to 3.0% of AT Power.)
(f) Low reactor coolant loop flow - >91% of normal indicated loop flow as measured at elbow taps in each loop (g) Low reactor coolant pump motor frequency - > 57.5 Hz (h) Reactor coolant pump under voltage - > 70% of normal voltage
- 3. Other reactor trip settings (a) High pressurizer water level - 5 89.12% of span (b) Low-low steam generator water level - _> 16% of narrow range instrument span (c) Low steam generator water level - > 19% of narrow range instrument span in coincidence with steam/feedwater mismatch flow - < 1.0 x 106 lbs/hr (d) Turbine trip (e) Safety injection - Trip settings for Safety Injection are detailed in TS Section 3.7.
Amendment Nos. 261 and 261
TS 2.3-4 B. Protective instrumentation settings for reactor trip interlocks shall be as follows:
- 1. The reactor trip on low pressurizer pressure, high pressurizer level, turbine trip, and low reactor coolant flow for two or more loops shall be unblocked prior to or when power increases to 11 % of rated power.
- 2. The single loop loss of flow reactor trip shall be unblocked prior to or when the power range nuclear flux increases to 37% of rated power.
- 3. The power range"high flux, low setpoint trip and the intermediate range high flux, high setpoint trip shall be unblocked prior to or when power decreases to 7% of rated power.
- 4. The source range high flux, high setpoint trip shall be unblocked prior to or when the intermediate range nuclear flux decreases to 5 x O"11 amperes.
Basis The power range reactor trip low setpoint provides protection in the power range for a power excursion beginning from low power. This trip value was used in the safety analysis.() The Source Range High Flux Trip provides reactor core protection during shutdown (COLD SHUTDOWN, INTERMEDIATE SHUTDOWN, and HOT SHUTDOWN) when the reactor trip breakers are closed and reactor power is below the permissive P-6. The Source and Intermediate Range trips in addition to the Power Range trips provide core protection during reactor startup when the reactor is critical. The Source Range channels will initiate a reactor trip at about 1.51 x 105 counts per second unless manually blocked when P-6 becomes active. The Intermediate Range channels will initiate a reactor trip at a current level proportional to < 40% of RATED POWER unless manually blocked when P-10 becomes active. In the accident analyses, bounding transient analysis results are based on reactivity excursions from an initially critical condition, where the Source Range trip is assumed to be blocked. Accidents initiated form a subcritical condition would produce less severe results, since the Source Range trip would provide core protection at a lower power level. No credit is taken for operation of the Intermediate Range High Flux trip. However, its functional capability is required by this specification to enhance the overall reliability of the Reactor Protection System.
The high and low pressurizer pressure reactor trips limit the pressure range in which reactor operation is permitted. The high pressurizer pressure reactor trip is also a backup to the pressurizer code safety valves for overpressure protection, and is therefore set lower than the set pressure for these valves (2485 psig). The low pressurizer pressure reactor trip also trips the reactor in the unlikely event of a loss-of-coolant accident.(3 )
Amendment Nos. 26 1 and 261
TS 2.3-5 vr......
AP reactor trip provid* cre.o r.
,,,,.,t,,
againstDNB for al! combinations of pressiire, power, coolant temperature, and axial power distribution, provided -fflý-that the transient is slow with respect to piping transit delays from the core to the temperature detectors (about 3 seconds), and pressure is within the range between high and low pressure reactor trips.
With normal axial power distribution, the reactor trip limit, with allowance for errors,(2) is always below the core safety limit as shown on TS Figure 2.1-1. If axial peaks are greater than design, as indicated by the difference between top and bottom power range nuclear detectors, the reactor limit is automatically reduced.t 4 )(s)
The overpower and overtemperature protection system setpoints have been revised to include effects of fuel densification on core safety limits and to apply to 100% of design flow. The revised setpoints in the Technical Specifications will ensure that the combination of power, temperature, and pressure will not exceed the revised core safety limits as shown in Figures 2.1-1 through 2.1-3. The reactor is prevented from reaching the overpower limit condition by action of the nuclear overpower and overpower AT trips. The overpower limit criteria is that core power be prevented from reaching a value at which fuel pellet centerline melting would occur. The overpower protection system set points include the effects of fuel densification.
In order to operate with a reactor coolant loop out of service (two-loop operation) and with the stop valves of the inactive loop either open or closed, the overtemperature AT trip setpoint calculation has to be modified by the adjustment of the variable K1. This adjustment, based on limits of two-loop operation, provides sufficient margin to DNB for the aforementioned transients during two loop operation. The required adjustment and subsequent mandatory calibrations are made in the protective system racks by qualified technicians* in the same manner as adjustments before initial startup and normal calibrations for three-loop operation.
The-overpower-AT reactor-trip-prevents-power density-anywhere-in-the-core-from-exceeding-H-8 %
of design power density as discussed Section 7 and specified in Section 14.2.2 of the FSAR and includes corrections for axial power distribution, change in density and heat capacity of water with temperature, and dynamic compensation for piping delays from the core to the loop temperature detectors. The specified setpoints meet this requirement and include allowance for instrument errors.(2)
Refer to Technical Report EE-01 16 for justification of the dynamic limits (time constants) for the Overtemperature AT and Overpower AT Reactor Trip functions.
As used here, a qualified technician means a technician who meets the requirements of ANS-3.
He shall have a minimum of two years of working experience in his speciality and at least one year of related technical training.
Amendment Nos. 261 and 261
TS 2.3-6 The In-flow rperr*.- trip pr-tects thecore ag a inrr-the event of a sudden-loss-of-power to -
one or more reactor coolant pumps. The undervoltage-readto-r-trip pfrtectsga*in-st a de*rease in Reactor Coolant System flow caused by a loss of voltage to the reactor coolant pump busses. The underfrequency reactor trip (opens RCP supply breakers and) protects against a decrease in Reactor Coolant System flow caused by a frequency decay on the reactor coolant pump busses.
The undervoltage and underfrequency reactor trips are expected to occur prior to the low flow trip setpoint being reached for low flow events caused by undervoltage or underfrequency, respectively. The accident analysis conservatively ignores the undervoltage and underfrequency trips and assumes reactor protection is provided by the low flow trip. The undervoltage and underfrequency reactor trips are retained as backup protection.
The high pressurizer water level reactor trip protects the pressurizer safety valves against water relief. Approximately 1125 ft3 of water corresponds to 89.12% of span. The specified setpoint allows margin for instrument error(7) and transient level overshoot beyond this trip setting so that the trip function prevents the water level from reaching the safety valves.
The low-low steam generator water level reactor trip protects against loss of feedwater flow accidents. The specified setpoint assures that there will be sufficient water inventory in the steam generators at the time of trip to allow for starting delays for the Auxiliary Feedwater System.(7 )
The specified reactor trips are blocked at low power where they are not required for protection and would otherwise interfere with normal unit operations. The prescribed setpoint above which these trips are unblocked assures their availability in the power range where needed.
Above 11% power, an automatic reactor trip will occur if two or more reactor coolant pumps are lost. Above 37%, an automatic reactor trip will occur if any pump is lost or de-energized. This latter-trip will-prevent-the, minimum-value-of the -DNBR-from-going below-the applicable design.
as a result of the decrease of Reactor Coolant System flow associated with the loss of a single reactor coolant pump.
Although not necessary for, core protection, other reactor trips provide additional protection. The steam/feedwater flow mismatch which is coincident with a low steam generator water level is designed for and provides protection from a sudden loss of the reactor's heat sink. Upon the actuation of the safety injection circuitry, the reactor is tripped to decrease the severity of the accident condition. Upon turbine trip, at greater than 11 % power, the reactor is tripped to reduce the severity of the ensuing transient.
AmendmentNos. 261 and 261
TS 2.3-7 Permissive P-7 is made up of input signals from Turbine First Stage Pressure and NIS Power Range. Signals to the P-7 and P-10 permissives are supplied from the same bistables in the NIS Power Range drawers. P-7 and P-10 will both enable and block functions from the "trip" and "reset" points of these bistables. The calibration procedures for the NIS Power Range bistables set the nominal trip setpoints associated with the two permissives such that they will trip whenever the measured reactor power level reaches 10% power (increasing). When two out of four of the NIS Power Range channels trip or if one of the two Turbine First Stage Pressure channels trip the following occurs:
" Permissive P-7 allows reactor trip on the following: low flow, reactor coolant pump breakers open in more than one loop, undervoltage (RCP busses), underfrequency (RCP busses),
turbine trip, pressurizer low pressure, and pressurizer high pressure.
" Permissive P-10 allows manual block of intermediate range reactor trip, allows manual block of power range (low setpoint) reactor trip, allows manual block of intermediate range rod stop (P-l), and automatically blocks source range reactor trip (P-6) and provides an input to P-7.
The "trip" and "reset" of a bistable cannot be the same point. It is physically not possible. There must be a deadband between the "trip" and "reset" points. The calibration procedures for the NIS Power Range bistables set the nominal reset points for the two permissives such that they reset whenever the measured reactor power level reaches 8% power (decreasing). The P-7 input from Turbine First Stage Pressure is set to reset at 8.8% Turbine Load (decreasing). When three out of four of the NIS Power Range channels reset or if two out of the two Turbine First Stage Pressure channels reset the following occurs:
- Permissive P-7 blocks reactor trip on the following: low flow, reactor coolant pump breakers open in more than one loop, undervoltage, underfrequency, turbine trip, pressurizer low pressure, and pressurizer high pressure.
When three out of four of the NIS Power Range channels reset the following occurs:
- Permissive P-10 defeats automatically the manual block of intermediate range reactor trip, defeats automatically the manual block of power range (low setpoint) reactor trip, and defeats automatically the manual block of intermediate range rod stop (P-1).
Amendment Nos. 261 and 261
TS 2.3-8 There are no specific Safety Analysis Limits associated with Permissives P-7 and P-10. However, they are "Assumed Available" by Nuclear Analysis and Fuel. Since P-7 and P-10 are permissives for functions with Safety Analysis Limits, for conservatism, they will be treated as if they had a Limiting Safety System Setting. In order to account for instrumentation errors, 1% of reactor power is added to the P-7 and P-10 safety functions. This results in a Limiting Safety System Setting for the P-7 enable interlock of I 1% of reactor power. The Limiting Safety System Setting for the P-I10 (defeat block) interlock is 7% of reactor power.
The methodology for determining the Limiting Safety System Settings (LSSS) found in TS 2.3 was developed in Technical Report EE-01 16. The Limiting Safety System Setting must be chosen so that automatic protective action will correct an abnormal situation before the safety limit is exceeded. At Surry Power Station the Allowable Value (AV) serves as the Limiting Safety System Setting such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value during the Channel Functional Test (which is also referred to as the Channel Operational Test or COT). As such, the Allowable Value differs from the Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition and ensure that the Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval. If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a Technical Specification perspective. This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
Technical Report EE-01 16 verifies that Surry's methodology for determining Allowable Values is in agreement with the intent of ISA Standard S67.04, Methods I and 2. In addition, it is Dominion's position that the Analytical Limit will be protected if:
I.
the distance between the Trip Setpoint and the Analytical Limit is equal to or greater than the Total Loop Uncertainty for that channel and
- 2.
the distance between the Allowable Value and the Analytical Limit is equal to or greater than the non-COT error components of the Total Loop Uncertainty and
- 3.
the distance between the Trip Setpoint and the Allowable Value is equal to the COT error components of the Total Loop Uncertainty without any excessive margin included.
Amendment Nos. 261 and 261
TS 2.3-9 1
Both the Trip Setpoint and the Allowable Value must be properly established in order to adequately protect the Analytical Limit.
References (1)
UFSAR Section 14.2.1 (2)
UFSAR Section 14.2 (3)
UFSAR Section 14.5 (4)
UFSAR Section 7.2 (5)
UFSAR Section 3.2.2 (6)
UFSAR Section 14.2.9 (7)
UFSAR Section 7.2 Amendment Nos. 261 and 261
TS 3.1-2
- b.
If an unscheduled loss of one or more reactor coolant pumps occurs while operating below 11% RATED POWER (P-7) and results in less than two pumps in service, the affected plant shall be shutdown and the reactor made subcritical by inserting all control banks into the core. The shutdown rods may remain withdrawn.
- c.
When the average reactor coolant loop temperature is greater than 350'F, the following conditions shall be met:
- 1.
At least two reactor coolant loops shall be OPERABLE.
- 2.
At least one reactor coolant loop shall be in operation.
- d.
When the average reactor coolant loop temperature is less than or equal to 350'F, the following conditions shall be met:
I.
A minimum of two non-isolated loops, consisting of any combination of reactor coolant loops or residual heat removal loops, shall be OPERABLE, except as specified below:
(a) One RHR loop may be inoperable for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing provided the other RHR loop is OPERABLE and in operation.
(b)
During REFUELING OPERATIONS the residual heat removal loop may be removed from operation as specified in TS 3.1O.A.4.
- 2.
At least one reactor coolant loop or one residual heat removal loop shall be in operation, except as specified in Specification 3.1O.A.4.
AmendmentNos. 261 and 261
TS 3.1-4a
- 6.
Relief Valves Two power operated relief valves (PORVs) and their associated block valves shall be OPERABLE* whenever the Reactor Coolant System average temperature is > 350'F.
- a.
With one or both PORVs inoperable but capable of being manually cycled, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> either restore the PORV(s) to OPERABLE status or close the associated block valve(s) and maintain power to the associated block valve(s).
Otherwise, be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce Reactor Coolant System average temperature to < 350'F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
- b.
With one PORV inoperable and not capable of being manually cycled, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> either restore the PORV to OPERABLE status or capable of being manually cycled or close the associated block valve and remove power from the block valve. In addition, restore the PORV to OPERABLE status or capable of being manually cycled within the following 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Otherwise, be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce Reactor Coolant System average temperature to < 350'F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
- c.
With both PORVs inoperable and not capable of being manually cycled, within I hour restore at least I PORV to OPERABLE status or capable of being manually cycled. Otherwise, close the associated block valves and remove power from the block valves. In addition, be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce Reactor Coolant System average temperature to
< 350°F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
Automatic actuation capability may be blocked when Reactor Coolant System pressure is below 2010 psig.
Amendment Nos. 261 and 261
TS 3.7-4 Instrumentation has been provided to sense accident conditions and to initiate operation of the Engineered Safety Features.
Safety Injection System Actuation Protection against a loss-of-coolant or steam line break accident is provided by automatic actuation of the Safety Injection System (SIS) which provides emergency cooling and" reduction of reactivity.
The loss-of-coolant accident is characterized by depressurization of the Reactor Coolant System and rapid loss of reactor coolant to the containment. The engineered safeguards instrumentation has been designed to sense these effects of the loss-of-coolant accident by detecting low pressurizer pressure to generate signals actuating the SIS active phase. The SIS active phase is also actuated by a high containment pressure signal brought about by loss of high enthalpy coolant to the containment. This actuation signal acts as a backup to the low pressurizer pressure actuation of the SIS and also adds diversity to protect against loss of coolant.
Signals are also provided to actuate the SIS upon sensing the effects of a steam line break accident. Therefore, SIS actuation following a steam line break is designed to occur upon sensing high differential steam pressure between the steam header and steam generator line or upon sensing high steam line flow in coincidence with low reactor coolant average temperature or low steam line pressure.
The increase in the extraction of RCS heat following a steam line break results in reactor coolant temperature and pressure reduction. For this reason, protection against a steam line break accident is also provided by low pressurizer pressure actuating safety injection.
Protection is also provided for a steam line break in the containment by actuation of SIS upon sensing high containment pressure.
Amendment Nos. 261 and 261
TS 3.7-6 reduces thnscqucnccs o a sa in uebrea, iide-u: L, con.ain,,int by stopping-th-e entry of feedwater.
Auxiliary Feedwater System Actuation The automatic initiation of auxiliary feedwater flow to the steam generators by instruments identified in Table 3.7-2 ensures that the Reactor Coolant System decay heat can be removed following loss of main feedwater flow. This is consistent with the requirements of the "TMI-2 Lessons Learned Task. Force Status Report," NUREG-0578, item 2.1.7.b.
Setting Limits
- 1. The high containment pressure limit is set at about 8% of design containment pressure.
Initiation of safety injection protects against loss of coolant(2) or steam line break(3) accidents as discussed in the safety analysis.
- 2. The high-high containment pressure limit is set at about 21 % of design containment pressure. Initiation of containment spray and steam line isolation protects against large loss-of-coolant(2). or steam line break accidents( 3 ) as discussed in the safety analysis.
- 3. The pressurizer low pressure setpoint for safety injection actuation is set substantially below system operating pressure limits. However, it is sufficiently high to protect against a loss-of-coolant accident as shown in the safety analysis.(2) The setting limit (in units of psig) is based on nominal atmospheric pressure.
- 4. The steam line high differential pressure limit is set well below the differential pressure expected in the event of a large steam line break accident as shown in the W a y
- 5. The high steam line flow differential pressure setpoint is constant at 40% full flow between no load and 20% load and increasing linearly to 110% of full flow at full load in order to protect against large steam line break accidents. The coincident low Tag setting limit for SIS and steam line isolation initiation is set below its HOT SHUTDOWN value. The coincident steam line pressure setting limit is set below the full load operating pressure. The safety analysis shows that these settings prov'ide protection in the event of a large steam line break, Amendment Nos. 261 and 261
TS 3.7-7 The rnettiodology for detertininig thleSittingLimits(SL) foor-d-in TS317 was developed in Technical Report EE-01 I16. The-Setingi-Limits musthe -ch6soei so that automatic protective action will correct an abnormal situation before the safety limit is exceeded. At Surry Power Station the Allowable Value (AV) serves as the Setting Limit such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value during the Channel Functional Test (which is also referred to as the Channel Operational Test or COT). As such, the Allowable Value differs from the Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the Setting Limit definition and ensure that the Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval. If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a Technical Specification perspective.
This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
Technical Report EE-01 16 verifies that Surry's methodology for determining Allowable Values is in agreement with the intent of ISA Standard S67.04, Methods I and 2. In addition, it is Dominion's position that the Analytical Limit will be protected if:
I.
the distance between the Trip Setpoint and the Analytical Limit is equal to or greater than the Total Loop Uncertainty for that channel and
- 2.
the distance between the Allowable Value and the Analytical Limit is equal to or greater than the non-COT error components of the Total Loop Uncertainty And
- 3.
the distance-between-the-Trip Setpoint-and-theAAllowable Value-is-equal to-the-COT error components of the Total Loop Uncertainty without any excessive margin included.
Both the Trip Setpoint and the Allowable Value must be properly established in order to adequately protect the Analytical Limit.
Amendment Nos.
261 and 261
TS 3.7-7a I
Accident Monitoring Instrumentation The primary purpose of accident monitoring instrumentation is to display unit parameters that provide information required by the control room operators during and following accident conditions. In response to NUREG-0737 and Regulatory Guide (RG) 1.97, Revision 3, a programmatic approach was developed in defining the RG 1.97-required equipment for Surry. The Surry RG 1.97 program review examined existing instrumentation with respect to the RG 1.97 design-and qualification requirements. The operability of RG 1.97 instrumentation ensures that sufficient information is available on selected unit parameters to monitor and assess unit status and response during and following an accident. The availability of accident monitoring instrumentation is important so that the consequences of corrective actions can be observed and the need for and magnitude of further actions can be determined.
RG 1.97 applied a graded approach to post-accident indication by using a matrix.of variable types versus variable categories. RG 1.97 delineates design and qualification criteria for the instrumentation used to measure five variable types (Types A, B, C, D, and E). These criteria are divided into three separate categories (Categories 1, 2, and 3),
providing a graded approach that depended on the importance to safety of the measurement of a specific variable. Category I variables, listed in Table 3.7-6, are defined as follows:
Category 1 - are the key variables deemed risk significant because they are needed to:
0 Determine whether other systems important to safety are performing their intended functions,
- Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release, and
- Provide-information regarding-the release._ of radioactive-materials. to allow early indication of the need to initiate action necessary to protect the public and to estimate the magnitude of any impending threat.
The RG 1.97 criteria on redundancy requirements apply to Category 1 variables only and address single-failure criteria and supporting features, including power sources.
Failures of the instrumentation, its supporting features, and/or its power source resulting in less than the required number of channels necessitate entry into the required actions.
Amendment Nos. 261 and 261
TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Minimum TotNi Number OPERABLE Channels Permissible Functional Unit OfIChannels Channels To Trip Bypass Conditions Operator Action
- 1. Manual 2
2 1
1
- 2. Nuclear Flux Power Range*
4 3
2 Low trip setting at P-10 2
- 3. Nuclear Flux Intermediate Range*
2 2
1 P-10 3
- 4. Nuclear Flux Source Range*
P-6
- a. Below P Note A 2
2 1
4
- b. Shutdown - Note B 2
1 0
5
- 5. Overtemperature AT*
3 2
2 6,
- 6. Overpower AT**
3 2
2 6
- 7. Low Pressurizer Pressure*
3 2
2 P-7
- 8. Hi Pressurizer Pressure*
3 2
2 6
Note A -With the reactor trip breakers closed and the control rod drive system capable of rod withdrawal.
Note B - With the reactor trip breakers open.
- There is a Safety Analysis Limit associated with this Reactor Trip function. If during calibration the setpoint is found to be conservative !with respect to the Limiting Safety System Setting but outside its predefined calibration tolerance, then the channel 0
shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration N) tolerances are specified in a document controlled under 10 CFR 50.59.
- If during calibration the setpoint is found to be conservative with respect to the Limiting Safety System Setting but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning theichannel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.
C Lý
TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Functional Unit
- 9.
Pressurizer-Hi Water Level*
- 10. Low Flow*:
- 11. Turbine Trip
- a. Stop valve closure i
- b. Low fluid oil pressure
- 12. Lo-Lo Steam Generator Water Level*
- 13. Underfrequ;ncy 4KV Bus
- 14. Undervoltage 4KV Bus
- 16. Reactor Coolant Pump Breaker Position Total Number Of Channels 3
3/loop 4
3.
3/loop 3-I/bus 3-1/bus 2
Minimum OPERABLE Channels 2
2/loop in each operating loop 1
2 2/loop in each operating loop 2
2 2
Channels To Trip 2
2/loop in any operating loop 2/loop in any 2 operating loops 4
2 2/loop in any operating loops 2
2 I
Permissible Bypass Conditions Operator Action P-7 7
P-8 7
II P-7 P-7 P-7 P-7
.P-7 P-8 P-7 7
7 7
6 7
7 91 99 z
N~)
0.)
I/breaker 1/breaker per operating loop 12 There is a Sa fety Analysis Limit associated with this Reactor Trip function. If during calibration the setpoint is found to be conservative! with respect to the Limiting Safety System Setting but outside its predefined calibration tolerance, then the channel shall be brotught back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.
- If during calibration the setpoint is found to be conservative with respect to the Limiting Safety System Setting but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.
-i
Functional Unit
- 17. Low steam generator water**
level with steam/feedwater flow mismatch
- 18. a. Reactor T~iip Breakers
- b. Reactor Tip Bypass Breakers - Note C
- 19. Automatic Trip Logic
- 20. Reactor Trip System Interlocks - Note D
- a. Intermediate range neutron flux, P-6
- b. Low power reactor trips block, P-7 Power range neutron flux, P-10
'. nd1 TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Minimum Total Number OPERABLE Channels Of Channels Channels To Trip 2/loop-level and 1/loop-level 1/loop-lev 2/loop-flow and 2/loop-coinciden mismatch flow mismatch with 1I/1oo or 2/loop-level flow and I/loop-flow mismatch mismatch in same loc 2
2 1
el t
p-1p Permissible Bypass Conditions Operator Action 6
I I 2
2, 2
4 I
I 2
2 3
2 8
11 13 13 Nz 0ý Turbine impulse pressure 2
2 1
- c. Power range neutron flux, P-8*
4 3
2
- d. Power range neutron flux, P-10 4
3 2
- e. Turbine inmpulse pressure 2
2 1
I Note C - With the Reactor Trip Breaker open for surveillance testing in accordance with Specification Table 4.1-1 (Item 30)
Note D - Reactor Trip System Interlocks are described in Table 4.1-A i
13 13 13 13
- There is a Safety Analysis Limit associated with this Reactor Trip function. If during calibration the setpoint is found to be conservative *vith respect to the Limiting Safety System Setting but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.
- If during calibration the setpoint is found to be conservative with respect to the Limiting Safety System Setting but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.
--i
TS 3.7-14 TABLE 3.7-i (Continued)
- 4.
The QUADRANT POWER TILT shall be determined to be within the limit when above 75 percent of RATED POWER with one Power Range Channel inoperable by using the moveable incore detectors to confirm that the normalized symmetric power distribution, obtained from 2 sets of 4 symmetric thimble locations or a full-core flux map, is consistent with the indicated QUADRANT POWER TILT at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement, be in at least HOT SHUTDOWN within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> ACTION 3.
With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement and with the THERMAL POWER level:
- a.
Below the P-6 (Block of Source Range Reactor Trip) setpoint, restore the inoperable channel to OPERABLE status prior to increasing THERMAL POWER above the P-6 Setpoint.
- b.
Above the P-6 (Block of Source Range Reactor Trip) setpoint, but below 7% of -RATED POWER, decrease-power below P-6 or, increase THERMAL POWER above I I% of RATED POWER within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
- c.
Above 11% of RATED POWER, POWER OPERATION may continue.
Amendment Nos. 261 and 261
TABLE 3.7-2 ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Total Minimum Number OPERABLE Channels Of Channels Channels TO Thp Permissible Bypass Conditions Functional Unit
- 1. SAFETY INJECTION (SI)
- a. Manual 2
2 1
- b. High containment pressure*
4 3
3
- c. High differential pressure between 3/steam line 2/steam line 2/steam line Primary pressure less than any steam line and the steam on any steam 2010 psig, except when reactor is header*
line critical i
- d. Pressurizer low-low pressure*
- e. High stearm flow in 2/3 steam lines coincident with low Tavg or low steam line pressure*
- 1) Steam line flow*
- 2) Tavg*
- 3) Steam line pressure*
- f. Automatic actuation losic 3
2/steamn line 2
1/steam line 2
Primary pressure less than 2010 psig, except when reactor is critical 1/steam line Reactor coolant Tavg less than 5450 any two lines during heatup and cooldown I/loop any Reactor coolant Tavg less than 5450 two loops during heatup and cooldown 1/line any two Reactor coolant Tavg less than 545' loops during heatup and cooldown 1
Operator Actions 21 17 20 20 20 20 20 14 CD z
0 N.)
N~)
l/loop 1/loop any two loops 1/line 1/line any two loops 2
2
- There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within I
.I its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.
I
__3 00
TABLE 3.7-2 (Continued)
ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Total Number Of Channels Minimum OPERABLE Channels Functional Unit
- 2.
- a. Manual
- b. High containment pressure (Hi-Hi)*
- c. Automatic actuation logic
- a. Steam generator water level low-low*
- 1) Start rmotor driven pumps
- 2) Starts turbine driven pump
- b. RCP undeivoltage starts turbine driven pump
- c. Safety injection - start motor driven pumps
- d. Station blaickout - start motor driven pumps Channels To Trip Permissible Bypass Conditions Operator Actions I set 4
2 3/steam generator 3/steam generator 1 set 3
2 I set 3
1 15 17 14 I
2/steam 2/steam generator generator any 1 generator 2/steam 2/steam generator generator any 2 generators 20 20 20 24 0.
N-)
N-)
3 2
2 See #1 above (all SI initiating functions and requirements)
I/bus I/bus 2
2 transfer 2 transfer buses/unit buses/unit
- Must actuate 2 switches simultaneously 7i There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the, Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.
I chjý
TABLE 3.7-2 (Continued)
ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Total Number OPERABLE Functional Unit
- 3.
AUXILIARY FEEDWATER (continued)'
- e. Trip of main feedwater pumps - start motor driven
- pumps,
- f. Automatic actuation logic
- 4. LOSS OF POWER
- a. 4.16 kv emergency bus undervoltage (loss of voltage)
- b. 4.16 kv emergency bus undervoltage (de aded voltage)
- 5.
NON-ESSENTIAL SERVICE WATER ISOLATION
- a. Low intake canal level*
- b. Automatic actuation logic
- 6. ENGINEERED SAFEGAURDS ACTUATION INTERLOCKS - Note A
- a. Pressurizer pressure, P-II
- b. Low-low Ta,., P-12
- c. Reactor trip, P4
- 7.
RECIRCULATION MODE TRANSFER,
- a. RWST Level - Low-Low*
- b. Automatic Actuation Logic and Actuation Relays
- 8.
RECIRCULATION SPRAY
- a. RWST Level - Low Coincident with High High Containment Pressure*
- b. Automatic Actuation Logic and Actuation Relays Of Channels Channels Channels To Trip Permissible Bypass Conditions Operator' Actions 2/MFW pump 2
3/bus 3/bus 4"
2 3
3 2
4 2
I/MFW pump 2
2/bus 2/bus 3
2 2
2 2
3 2
3 2-1 each MFW pump 1
2/bus 2/bus 3
1 2
2 1
2 1
2 24, 22 26; 26' 201 141 I I 23 23 24, 25 14 Z
0 I
4 2
20 14 2
r,) Note A - Engineered Safeguards Actuation Interlocks are described in Table 4.1-A CLz N)~
- There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative With respect to the S&ting Limit but outside itsl predefimed calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.
t~3
Functional i
TABLE 3.7-3 INSTRUMENT OPERATING CONDITIONS FOR ISOLATION FUNCTIONS Total Minimum Number OPERABLE Channels Permissib Unit Of Channels Channels To Trip Bypass Cond
)LATION Jle itions Operator Actions
- a. Phase I
- 1) Safety, Injection (SI)
- 2) Automatic initiation logic
- 3) Manual
- b. Phase 2
- 1) High containment pressure*
I
- 2) Automatic actuation logic
- 3) Manual
- c. Phase 3
- 1) High containment pressure (Hi-HI setpoiOt)*
- 2) Automatic actuation logic
- 3) Manual
- 2. STEAMLINE ISOLATION
- a. High steam flow in 2/3 lines coincident with 2/3 ldw Tav or 2/3 low stearn pressurcs*f a
0 Must actuate 2 switches simultaneously See Item #1, Table 3.7-2 (all SI initiating functions and requirements) 2 2
4 2
2 2
2 3
2 2
1 3
1 1
3 C
14 21 17 14 21 17 14 15 4
2 1 set 3
2 1 set 1
1 set*
z N)
Ca See Item #1.e Table 3.7-2 for operability requirements There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.
I "I
TABLE 3.7-3 (Continued)
INSTRUMENT, OPERATING CONDITIONS FOR ISOLATION FUNCTIONS Functional Unit STEAMLINE ISOLATION (continued)
- b. High containment pressure (Hi-Hi setpoint)*1
- c. Manual
- d. Automatic actuation logic Total Number Of Channels 4
Minimum OPERABLE Channels 3
Channels To Trip Permissible Bypass Conditions Operator Actions 3
17 21 22 I
l/steamline l/steamline 1/steamline 2
2 1
- 3. TURBINE TRIP AND FEEDWATER ISOLATION
- a. Steam generator water-level high-high*
- b. Automatic actuation logic and actuation relay i
& deactivated or isolated by manual valves.
3/steam 2/steam 2/in any one generator generator steam generator z
N) 01ý 20 22 I
2 2
I See Item #1 Table 3.7-2 (all SI initiating functions and requirements)
- There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be. conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.
C,)
TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No.
Functional Unit I
High Containment Pressure (High Containment Pressure Signal)*
2 High-Higfi Containment Pressure (High-High Containment Pressure Signals)* I 3
Pressurizer Low-Low Pressure*
4 High Differential Pressure Between Steam Line and the Steam Line Header*
Channel Action a) Safety Injection b) Containment Vacuum Pump Trip c) High Press. Containment. Isolation d) Safety Injection Containment Isolation e) F.W. Line Isolation a) Containment Spray b) Recirculation Spray c) Steam Line Isolation d) High-High Press. Containment Isolation a) Safety Injection b) Safety Injection Containment Isolation c) F.W. Line Isolation a) Safety Injection b) Safety Injection Containment Isolation c) F.W. Line Isolation Setting Limit
_< 18.5 psia
< 24 psia
> 1,770 psig
<135 psid
< 40% (at zero load) of full steam flow
< 40% (at 20% load) of full steam flow
< 110% (at full load) of full steam flow 5
High Steam Flow in 2/3 Steam Lines*
a) Safety Injection z
Q0 N) b) Steam Line Isolation c) Safety Injection Containment Isolation d) F.W. Line Isolation Coincident with Low Tavg or
>541 )F Tavg Low Steam Line Pressure*
Ž510 psig steam line pressure
- There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within, its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a I
c document controlled under 10 CFR 50.59.
I 3
t./2
-,,4
TABLE 3.7-4 ENGINEERED SAFETYiFEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING NF.
Functional Unit 6
- a. Steam Generator Water Level Low-L ow*
- b. RCP U1ndervoltage
- c. Safety Injection
- d. Station Blackout
- e. Main Feedwater Pump Tip 1
7 LOSS OF POWER
- a. 4.16 K-r Emergency Bus Undervoltage (Loss of Voltage)
- b. 4.16 KV Emergency Bus Undervdltage (Degraded Voltage) 8 NON-ESSENTIAL SERVICE WATER ISOLATION
- a. Low Intake Canal Level*
9 RECIRCUJLATION MODE TRANSFER
- a. RWST Level-Low-Low*
10 TURBINE TRIP AND FEEDWATER ISOLATION
- a. Steam Generator Water Level High-High*
11 RWST Leel Low (coincident with High High Containment Pressure)*
Channel Action Aux. Feedwater Initiation S/G Blowdown Isolation Aux. Feedwater Initiation Aux. Feedwater Initiation Aux. Feedwater Initiation Aux. Feedwater Initiation Emergency Bus Separation and Diesel start Emergency Bus Separation and Diesel start Isolation of Service Water flow to non-essential loads Initiation of Recirculation Mode Transfer System Turbine Trip Feedwater Isolation Recirculation Spray Pump Start Setting Limit
> 16.0% narrow range
Ž70% nominal All S.I. setpoints
Ž:46.7% nominal N.A.
Ž2975 volts and *< 3265 volts with a 2 (+5, -0.1) second time delay
> 3830 volts and < 3881 volts with a 60 (+/-3.0) second time delay (Non CLS, Non SI) 7 (+/-0.35) second time delay (CLS or SI Conditions) 23 feet-5.85 inches
_ 12.7%
< 14.3%
- 76% narrow range
Ž59%
- 61%
I z
0 C',
N) 0-I I
II There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but ou6ide its predefined calibration tolerance, then the channel shall be brought back to within its predefmed calibration tolerance before !returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.
-3
,ON
TABLE 4.1 -1 (Continued)
MINIMUM FREQUENCIES FOR CHECK, CALIBRATIONS AND TEST OF INSTRUMENT CHANNELS i
Channel Description 1
- 39. Steam/Feedwater Flow and Low S/G Water Level
- 40. Intake Canal Low (See Footnote 1)
- 41. Turbine Trip and Feedwater Isolation
- a. Steam generator water level high
- b. Automatic actuation logic and actuationi relay
- 42. Reactor Trio System Interlocks
- a. Intermediate range neutron flux, P-6
- b. Low reac tor trips block, P-7
- c. Power range neutron flux, P-8
- d. Power range neutron flux, P-10
- e. Turbine t mpulse pressure Check Calibrate Test Remarks S
R D
R is R
N.A.
R Q(M)
- 1) The provisions of Specification 4.0.4 are not applicable M(l),
- 1) Logic Test Q(2)
- 2) Channel Electronics Test Q
M(l)
- 1) Automatic actuation logic only, actuation relays tested each refueling R(2)
- 1) Neutron detectors may be excluded from the calibration
- 2) The provisions of Specification 4.0.4 are not applicable.
R(2)
R(2)
R(2)
R
,N.A.
R(I)
N.A.
R(1)
N.A.
R(l)
N.A.
R(1) iN.A.
R CD z
N)
Cý Footnote 1:
Check Calibration Tests Consists of verifying for an indicated intake canal level greater than 23'-5.85" that all four low level sensor channel alarms are not in an alarm state.
Consists of uncovering the level'sensor and measuring the time response and voltage signals for the immersed and dry conditions. It also verifies the proper action of instrument channel from sensor to electronics to channel output.relays and.
annunciator. Only the two available sensors on the shutdown unit would be tested.
- 1) The logic test verifies the thr ee out of four logic development for each train by using the channel test switches for that train.
- 2) Channel electronics test verifies that electronics module responds properly to a superimposed differential millivolt signal I
which is equivalent to the sen~sor detecting a "dry" condition..
I 00o ar