Text

Technical Specification Bases B 3.3.1, Reactor Protective System (RPS) Instrumentation-Operating
	ML16258A077
Person / Time
Site:	Calvert Cliffs
Issue date:	09/08/2016
From:	; Exelon Generation Co
To:	; Office of Nuclear Reactor Regulation
Shared Package
ML16258A079	List: ML16258A060; ML16258A072; ML16258A073; ML16258A074; ML16258A075; ML16258A076; ML16258A077; ML16258A078; ML16258A080; ML16258A081; ML16258A082; ML16258A083; ML16258A084;
References
	Download: ML16258A077 (181)
	v • d • e

RPS Instrumentation-Operating B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protective System (RPS) Instrumentation-Operating BASES BACKGROUND The RPS initiates a reactor trip to protect against violating the core specified acceptable fuel design limits and breaching the reactor coolant pressure boundary during anticipated operational occurrences (AOOs). By tripping the reactor, the RPS also assists the Engineered Safety Features (ESF) systems in mitigating accidents.

The protective systems have been designed to ensure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as Limiting Conditions for Operation (LCOs) on other reactor system parameters and equipment performance.

The LSSS, defined in this Specification as the Allowable Value, in conjunction with the LCOs, establishes the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During AOOs, which are those events expected to occur one or more times during the plant life, the acceptable limits are:

The departure from nucleate boiling ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling;

Fuel centerline melting shall not occur; and

The Reactor Coolant System (RCS) pressure SL of 2750 psia shall not be exceeded.

Maintaining the parameters within the above values ensures that the offsite dose will be within Reference 2, 10 CFR Parts 50 and 100, criteria during AOOs.

Accidents are events that are analyzed even though they are not expected to occur during the plant life. The acceptable limit during accidents is that the offsite dose shall be maintained within the acceptance criteria given in the Reference 1, Chapter 14.

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-1 Revision 2

RPS Instrumentation-Operating B 3.3.1 BASES The RPS is segmented into four interconnected modules.

These modules are:

Measurement channels;

Bistable trip units;

RPS logic; and

Reactor trip circuit breakers (RTCBs).

This LCO addresses measurement channels and bistable trip units. It also addresses the automatic bypass removal channel for those trips with operating bypasses. The RPS logic and RTCBs are addressed in LCO 3.3.3.

An instrument channel consists of the measurement channel and bistable trip unit for one channel of one Function.

The role of each of these modules in the RPS, including those associated with the logic and RTCBs, is discussed below.

Measurement Channels Measurement channels, consisting of field transmitters or process sensors and associated instrumentation, provide a measurable electronic signal based upon the physical characteristics of the parameter being measured.

The Power Range excore nuclear instrumentation drawers, Thermal Margin/Low Pressure (TM/LP) trip calculators, and Axial Power Distribution (APD) trip calculators, are considered components in the measurement channels. The power range nuclear instruments (NIs) provide average power and subchannel deviation signals. The wide range NIs provide a Rate of Change of Power-High trip. Two decades of overlap are provided between the power range NIs and the wide range NIs. Three RPS trip functions use a power level designated as Q power as an input. Q power is the higher of NI power and primary calorimetric power ('T power) based on RCS hot leg and cold leg temperatures. Trip functions using Q power as an input include the Power Level-High, TM/LP, and the APD trips.

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-2 Revision 2

RPS Instrumentation-Operating B 3.3.1 BASES The TM/LP and APD trip calculators provide the complex signal processing necessary to calculate the TM/LP trip setpoint, Asymmetric Steam Generator Transient (ASGT) trip setpoint, APD trip setpoint, Power Level-High trip setpoint, and Q power calculation.

The excore NI drawers (wide range and power range) and the TM/LP and APD trip calculators are mounted in the RPS cabinet, with one channel of each in each of the four RPS bays.

Four measurement channels with electrical and physical separation are provided for each parameter used in the direct generation of trip signals. These are designated Channels A through D. Measurement channels provide input to one or more RPS bistables within the same RPS channel. In addition, some measurement channels may also be used as inputs to Engineered Safety Features Actuation System (ESFAS) sensor modules, and most provide indication in the Control Room. Measurement channels used as an input to the RPS are never used for control functions.

When a measurement channel monitoring a parameter exceeds a predetermined setpoint, indicating an unsafe condition, the bistable in the bistable trip unit monitoring the parameter in that measurement channel will trip. Tripping two or more bistable trip units monitoring the same parameter de-energizes matrix logic, which in turn de-energizes the trip path logic. This causes all eight RTCBs to open, interrupting power to the control element assemblies (CEAs),

allowing them to fall into the core.

Three of the four instrument channels are necessary to meet the redundancy and testability as described in Reference 1, Appendix 1C. The fourth channel provides additional flexibility by allowing one channel to be removed from service (trip bypass) for maintenance or testing, while still maintaining a minimum two-out-of-three logic. Thus, even with a channel inoperable, no single additional failure in the RPS can either cause an inadvertent trip or prevent a required trip from occurring.

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-3 Revision 2

RPS Instrumentation-Operating B 3.3.1 BASES Since no single failure will either cause or prevent a protective system actuation, and no protective channel feeds a control channel, this arrangement meets the requirements of Reference 1, Section 7.2.2 and Reference 3.

Many of the RPS Function trips are generated by comparing a single measurement to a fixed bistable setpoint. Certain Functions, however, make use of more than one measurement to provide a trip. The following trips use multiple measurement channel inputs:

Steam Generator Level-Low Trip This trip uses the lower of the two steam generator levels as an input to a common bistable.

Steam Generator Pressure-Low Trip This trip uses the lower of the two steam generator pressures as an input to a common bistable.

Power Level-High Trip The Power Level-High trip uses Q power as its only input. Q power is the higher of NI power and 'T power. Q power has a trip setpoint that tracks power levels downward so that the trip setpoint is always within a fixed increment above current power, subject to a minimum value.

On power increases, the trip setpoint remains fixed unless manually reset, at which point the trip setpoint increases to the new setpoint, which is a fixed increment above Q power at the time of reset, and the trip setpoint is subject to a maximum value. Thus, during power escalation, the trip setpoint must be repeatedly reset to avoid a reactor trip.

TM/LP and ASGT Trip Q power is only one of several inputs to the TM/LP trip. Other inputs include internal AXIAL SHAPE INDEX (ASI) and cold leg temperature based on the higher of two cold leg resistance temperature detectors. The TM/LP trip setpoint is a complex function of these CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-4 Revision 2

RPS Instrumentation-Operating B 3.3.1 BASES inputs and represents a minimum acceptable RCS pressure to be compared to actual RCS pressure in the TM/LP trip unit.

Steam generator pressure is also an indirect input to the TM/LP trip via the ASGT. This Function provides a reactor trip when the secondary pressure in either steam generator exceeds that of the other generator by greater than a fixed amount. The trip is implemented by biasing the TM/LP trip setpoint upward so as to ensure TM/LP trip if an ASGT is detected.

APD-High Trip Q power and subchannel deviation are inputs to the APD trip. The APD trip setpoint is a function of Q power, being more restrictive at higher power levels. It provides a reactor trip if actual ASI exceeds the APD trip setpoint.

Bistable Trip Units Bistable trip units, mounted in the RPS cabinet, receive an analog input from the measurement channels, compare the analog input to trip setpoints, and provide contact output to the matrix logic. They also provide local trip indication and remote annunciation.

There are four channels of bistable trip units, designated A through D, for each RPS Function, one for each measurement channel. Bistable output relays de-energize when a trip occurs.

The contacts from these bistable relays are arranged into six coincidence matrices, comprising the matrix logic. If bistables monitoring the same parameter in at least two bistable trip unit channels trip, the matrix logic will generate a reactor trip (two-out-of-four logic).

Some of the RPS measurement channels provide contact outputs to the RPS, so the comparison of an analog input to a trip setpoint is not necessary. In these cases, the bistable trip unit is replaced with an auxiliary trip unit. The auxiliary trip units provide contact multiplication so the CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-5 Revision 2

RPS Instrumentation-Operating B 3.3.1 BASES single input contact opening can provide multiple contact outputs to the matrix logic, as well as trip indication and annunciation.

Trip Functions employing auxiliary trip units include the Loss of Load trip and the APD trip.

The APD trip, described above, is a complex function in which the actual trip comparison is performed within the APD calculator. Therefore the APD trip unit employs a contact input from the APD calculator.

All RPS trips, with the exception of the Loss of Load trip, generate a pretrip alarm as the trip setpoint is approached.

The trip setpoints used in the bistable trip units are based on the analytical limits stated in Reference 1, Chapter 14, except for the APD and Loss of Load Functions, which are not credited in safety analyses. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account in the respective analytical limits. To allow for calibration tolerances, instrumentation uncertainties, instrument channel drift, and severe environment errors (for those RPS channels that must function in harsh environments, as defined by Reference 2, 10 CFR 50.49) RPS trip setpoints are conservatively adjusted with respect to the analytical limits. In the case of the TM/LP trip, there is also an additional adjustment for cold leg temperature differences.

A detailed description of the methodology used to calculate the trip setpoints, including their explicit uncertainties, is provided in Reference 4. The nominal trip setpoint entered into the bistable is more conservative than that specified by the Allowable Value. A channel is inoperable if its actual setpoint is not within its required Allowable Value.

Setpoints in accordance with the Allowable Value will ensure that SLs of Chapter 2.0 are not violated during AOOs and the consequences of DBAs will be acceptable, providing the plant is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed.

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-6 Revision 12

RPS Instrumentation-Operating B 3.3.1 BASES Note that in the accompanying LCO 3.3.1, the Allowable Values of Table 3.3.1-1 are the LSSS.

RPS Logic The RPS logic, addressed in LCO 3.3.3, consists of both matrix and trip path logic and employs a scheme that provides a reactor trip when bistables in any two of the four channels sense the same input parameter trip signal.

This is called a two-out-of-four trip logic. This logic and the RTCB configuration are shown in Figure B 3.3.1-1.

Bistable relay contact outputs from the four bistable trip unit channels are configured into six logic matrices. Each logic matrix checks for a coincident trip in the same parameter in two bistable trip unit channels. The matrices are designated the AB, AC, AD, BC, BD, and CD matrices to reflect the bistable trip unit channels being monitored.

Each logic matrix contains four normally energized matrix relays. When a coincidence is detected, consisting of a trip in the same Function in the two channels being monitored by the logic matrix, all four matrix relays de-energize.

The logic matrix relay contacts are arranged into trip paths, with one of the four matrix relays in each matrix opening contacts in one of the four trip paths. Each trip path provides power to one of the four normally energized RTCB control relays (K1, K2, K3, and K4). Thus, the trip paths each have six contacts in series, one from each matrix, performing a logical OR function by opening the RTCBs if any one or more of the six logic matrices indicate a coincidence condition.

Each trip path is responsible for opening one set of two of the eight RTCBs. When de-energized, the RTCB control relays (K-relays) interrupt power to the breaker undervoltage trip coils and simultaneously apply power to the shunt trip coils on each of the two breakers. Actuation of either the undervoltage or shunt trip coil is sufficient to open the RTCB and interrupt power from the motor generator (MG) sets to the control element drive mechanisms (CEDMs).

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-7 Revision 12

RPS Instrumentation-Operating B 3.3.1 BASES When a coincidence occurs in two RPS instrument channels from one Function, all four matrix relays in the affected matrix de-energize. This, in turn, de-energizes all four RTCB control relays, which simultaneously de-energize the undervoltage and energize the shunt trip coils in all eight RTCBs, tripping them open.

Matrix logic refers to the matrix power supplies, trip channel bypass contacts, and interconnecting matrix wiring between bistable and auxiliary trip units, up to but not including the matrix relays. Contacts in the bistable and auxiliary trip units are excluded from the matrix logic definition, since they are addressed separately.

The trip path logic consists of the trip path power source, matrix relays and their associated contacts, and all interconnecting wiring through the K-relay contacts in the RTCB control circuitry.

It is possible to change the two-out-of-four RPS logic to a two-out-of-three logic for a given input parameter, in one channel at a time, by trip bypassing select portions of the matrix logic. Trip bypassing a bistable trip unit effectively shorts the bistable relay contacts in the three matrices associated with that instrument channel. Thus, the bistables will function normally, producing normal trip indication and annunciation, but a reactor trip will not occur unless two additional instrument channels indicate a trip condition. Trip bypassing can be simultaneously performed on any number of parameters in any number of Functions, providing each parameter is bypassed in only one instrument channel per function at a time. Administrative controls prevent simultaneous trip bypassing of the same parameter in more than one instrument channel. Trip bypassing is normally employed during maintenance or testing.

In addition to the trip bypasses, there are also operating bypasses on select RPS trips. Some of these operating bypasses are enabled manually, others automatically, in all four RPS instrument channels for a Function when plant conditions do not warrant the specific trip function protection. All operating bypasses are automatically CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-8 Revision 12

RPS Instrumentation-Operating B 3.3.1 BASES removed when enabling bypass conditions are no longer satisfied. Trip Functions with operating bypasses include Rate of Change of Power-High, Reactor Coolant Flow-Low, Steam Generator Pressure-Low, APD-High, TM/LP, and Steam Generator Pressure Difference trips. The Loss-of-Load, Rate of Change of Power-High, and APD-High trips operating bypasses are automatically enabled and disabled.

RTCBs The reactor trip switchgear, addressed in LCO 3.3.3 and shown in Figure B 3.3.1-1, consists of eight RTCBs, which are operated in four sets of two breakers (four RTCB channels, including shunt trip coils and undervoltage coils). Power input to the reactor trip switchgear comes from two full capacity MG sets operated in parallel such that the loss of either MG set does not de-energize the CEDMs. There are two separate CEDM power supply buses, each bus powering half of the CEDMs. Power is supplied from the MG sets to each bus via two redundant trip paths. This ensures that a fault or the opening of a breaker in one trip path (i.e., for testing purposes) will not interrupt power to the CEDM buses.

Each of the four trip paths consists of two RTCBs in series.

The two RTCBs within a trip path are actuated by separate trip paths.

The eight RTCBs are operated as four sets of two breakers (four RTCB channels, including shunt trip coils and undervoltage coils). Each set of two RTCBs is opened by the same K-relay. This arrangement ensures that power is interrupted to both CEDM buses, thus preventing trip of only half of the CEAs (a half trip). Any one inoperable RTCB in a RTCB channel (set of two breakers) will make the entire RTCB channel inoperable.

Each set of RTCBs is operated by either a manual trip push button or an RPS actuated K-relay. There are four manual trip push buttons, arranged in two sets of two, as shown in Figure B 3.3.1-1. Depressing both push buttons in either set will result in a reactor trip.

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-9 Revision 12

RPS Instrumentation-Operating B 3.3.1 BASES When a manual trip is initiated using the control room push buttons, the RPS trip paths and K-relays are bypassed, and the RTCB undervoltage and shunt trip coils are actuated independent of the RPS.

A manual trip channel includes the push button and interconnecting wiring to both RTCBs necessary to actuate both the undervoltage and shunt trip coils but excludes the K-relay contacts and their interconnecting wiring to the RTCBs, which are considered part of the trip path logic.

Functional testing of the RPS instrument and logic channels, from bistable input through the opening of individual sets of RTCBs, can be performed either at power or shutdown and is normally performed on a quarterly basis. Reference 1, Section 7.2 explains RPS testing in more detail.

APPLICABLE Most of the analyzed accidents and transients can be SAFETY ANALYSES detected by one or more RPS Functions. The accident analysis contained in Reference 1, Chapter 14 takes credit for most RPS trip Functions. Some Functions not specifically credited in the accident analysis are part of the Nuclear Regulatory Commission (NRC)-approved licensing basis for the plant. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. Other Functions, such as the Loss of Load trip, are purely equipment protective, and their use minimizes the potential for equipment damage.

The specific safety analyses applicable to each protective Function are identified below:

1. Power Level-High Trip The Power Level-High trip provides reactor core protection against positive reactivity excursions that are too rapid for a Pressurizer Pressure-High or TM/LP trip to protect against. The following events require Power Level-High trip protection:

Uncontrolled CEA withdrawal event;

Excess load; and

CEA ejection event.

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-10 Revision 12

RPS Instrumentation-Operating B 3.3.1 BASES The first two events are AOOs, and fuel integrity is maintained. The third is an accident, and limited fuel damage may occur.

2. Rate of Change of Power-High Trip The Rate of Change of Power-High trip is used to trip the reactor when excore logarithmic power, measured by the wide range logarithmic neutron flux monitors, indicates an excessive rate of change. The Rate of Change of Power-High trip Function minimizes transients for events such as a born dilution event, continuous CEA withdrawal, or CEA ejection from subcritical conditions. Because of this Function, such events are assured of having much less severe consequences than events initiated from critical conditions. The trip is automatically bypassed when NUCLEAR INSTRUMENT POWER is

< 1E-4% RTP, when poor counting statistics may lead to erroneous indication. It is also bypassed at

> 12% RTP, where other RPS trips provide protection from these events. The automatic bypass removal feature ensures that the Rate of Change of Power-High trip is enabled when reactor power is between 1E-4% and 12% RTP. With the RTCBs open, the Rate of Change of Power-High trip is not required to be OPERABLE; however, at least two wide range logarithmic neutron flux monitor channels are required by LCO 3.3.12 to be OPERABLE. Limiting Condition for Operation 3.3.12 ensures the wide range logarithmic neutron flux monitor channels are available to detect and alert the operator to a boron dilution event.

3. Reactor Coolant Flow-Low Trip The Reactor Coolant Flow-Low trip provides protection during the following events:

Loss of RCS flow;

Loss of non-emergency AC power; and

Reactor coolant pump (RCP) seized rotor.

The loss of RCS flow and of non-emergency AC power events are AOOs where fuel integrity is maintained.

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-11 Revision 31

RPS Instrumentation-Operating B 3.3.1 BASES The RCP seized rotor is an accident where fuel damage may result.

4. Pressurizer Pressure-High Trip The Pressurizer Pressure-High trip, in conjunction with pressurizer safety valves and main steam safety valves, provides protection against overpressure conditions in the RCS during the following events:

Loss of Feedwater Flow;

Control Element Assembly Ejection;

Loss of Load; and

Feedwater Line Break (FWLB).

5. Containment Pressure-High Trip The Containment Pressure-High trip prevents exceeding the containment design pressure during certain loss of coolant accidents (LOCAs) or FWLB accidents. It ensures a reactor trip prior to, or concurrent with, a LOCA, thus assisting the ESFAS in the event of a LOCA or Main Steam Line Break (MSLB). Since these are accidents, SLs may be violated. However, the consequences of the accident will be acceptable.

6. Steam Generator Pressure-Low Trip The Steam Generator Pressure-Low trip provides protection against an excessive rate of heat extraction from the steam generators, which would result in a rapid uncontrolled cooldown of the RCS. This trip is needed to shut down the reactor and assist the ESFAS in the event of an MSLB or a large FWLB. Since these are accidents, SLs may be violated. However, the consequences of the accident will be acceptable.

7. Steam Generator 1 and 2 Level-Low Trip The Steam Generator 1 Level-Low and Steam Generator 2 Level-Low trips are required for the loss of normal feedwater and ASGT events.

The Steam Generator Level-Low trip ensures that low DNBR, high local power density, and the RCS pressure CALVERT CLIFFS - UNIT 1 B 3.3.1-12 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES SLs are maintained during normal operation and AOOs, and, in conjunction with the ESFAS, the consequences of the Feedwater System pipe break accident will be acceptable.

8. APD-High Trip The APD-High trip ensures that excessive axial peaking, such as that due to axial xenon oscillations, will not cause fuel damage. It ensures that neither a DNBR less than the SL, nor a peak linear heat rate that corresponds to the temperature for fuel centerline melting, will occur. This trip is the primary protection against fuel centerline melting. While no event specifically credits the Axial Flux Offset trip, the ASI limits established by this trip provide ASI limits for safety and setpoint analyses.

9. Thermal Margin

a. TM/LP Trip The TM/LP trip prevents exceeding the DNBR SL during AOOs and aids the ESFAS during certain accidents. The following events require TM/LP trip protection:

RCS depressurization (inadvertent safety or power-operated relief valves opening);

Steam generator tube rupture; and

LOCA accident.

The first event is an AOOs, and fuel integrity is maintained. The second and third events are accidents, and limited fuel damage may occur, although only the LOCA is expected to result in fuel damage. The trip is initiated whenever the RCS pressure signal drops below a minimum value (Pmin) or a computed value (Pvar) as described below, whichever is higher. The setpoint is a Function of Q power, ASI, and reactor inlet (cold leg) temperature.

The minimum value of reactor coolant flow rate, the maximum AZIMUTHAL POWER TILT (Tq), and the CALVERT CLIFFS - UNIT 1 B 3.3.1-13 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES maximum CEA deviation permitted for continuous operation are assumed in the generation of this trip signal. In addition, CEA group sequencing in accordance with LCO 3.1.7 is assumed. Finally, the maximum insertion of CEA banks that can occur during any AOO prior to a Power Level-High trip is assumed.

b. ASGT The ASGT provides protection for those AOOs associated with secondary system malfunctions that result in asymmetric primary coolant temperatures.

The most limiting event is closure of a single main steam isolation valve (MSIV). Asymmetric Steam Generator Transient is provided by comparing the secondary pressure in both steam generators in the TM/LP trip calculator. If the pressure in either exceeds that in the other by the trip setpoint, a TM/LP trip will result.

10. Loss of Load The Loss of Load trip causes a trip when operating above 15% of RTP. This trip provides turbine protection, reduces the severity of the ensuing transient, and helps avoid the lifting of the main steam safety valves during the ensuing transient, thus extending the service life of these valves. No credit was taken in the accident analyses for operation of this trip. Its functional capability is required to enhance overall plant equipment service life and reliability.

Operating Bypasses The operating bypasses are addressed in footnotes to Table 3.3.1-1. They are not otherwise addressed as specific table entries.

The automatic bypass removal features must function as a backup to manual actions for all trips credited in safety analyses to ensure the trip Functions are not operationally bypassed when the safety analysis assumes the Functions are not bypassed. The RPS operating bypasses are:

CALVERT CLIFFS - UNIT 1 B 3.3.1-14 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES Zero power mode bypass (ZPMB) removal of the TM/LP, ASGT, and reactor coolant low flow trips when NUCLEAR INSTRUMENT POWER is < 1E-4% RTP. This bypass is manually enabled below the specified setpoint to permit low power testing. The wide range NI Level 1 bistable in the wide range drawer provides a signal to auxiliary logic, which then permits manual bypassing below the setpoint and removes the bypass above the setpoint.

Power rate of change bypass removal ? The Rate of Change of Power-High trip is automatically bypassed at < 1E-4% RTP, as sensed by the wide range NI Level 1 bistable, and at

> 12% RTP by the linear range NI Level 1 bistable, mounted in their respective NI drawers (Reference 5). Automatic bypass removal is also effected by these bistables when conditions are no longer satisfied. The automatic bypass removal feature ensures that the Rate of Change of Power-High trip is enabled when reactor power is between 1E-4% and 12% RTP.

Loss of Load and APD-High trip bypass removal ? The Loss of Load and APD-High trips are automatically bypassed when at

< 15% RTP as sensed by the linear range NI Level 1 bistable.

The bypass is automatically removed by this bistable above the setpoint. This same bistable is used to bypass the Rate of Change of Power-High trip.

Steam Generator Pressure-Low trip bypass removal. The Steam Generator Pressure-Low trip is manually enabled below the pretrip setpoint. The permissive signal is removed, and the bypass automatically removed, when the Steam Generator Pressure-Low trip is above the pretrip setpoint.

The RPS instrumentation satisfies 10 CFR 50.36(c)(2)(ii),

Criterion 3.

LCO The LCO requires all instrumentation performing an RPS Function to be OPERABLE. Failure of any required portion of the instrument channel renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. The specific criteria for determining channel OPERABILITY differ slightly between Functions. These CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-15 Revision 31

RPS Instrumentation-Operating B 3.3.1 BASES criteria are discussed on a Function-by-Function basis below.

Actions allow trip channel bypass of individual instrument channels, but administrative controls prevent operation with a second channel in the same Function bypassed. Plants are restricted to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months in a trip bypass condition before either restoring the Function to four channel operation (two-out-of-four logic) or placing the channel in trip (one-out-of-three logic).

Only the Allowable Values are specified for each RPS trip Function in the LCO. Nominal trip setpoints are established for the Functions via the plant-specific procedures. The nominal setpoints are selected to ensure the plant parameters do not exceed the Allowable Value if the bistable trip unit is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable, provided that operation and testing are consistent with the assumptions of the plant-specific setpoint calculations. Each nominal trip setpoint is more conservative than the analytical limit assumed in the safety analysis in order to account for instrument channel uncertainties appropriate to the trip Function. These uncertainties are defined in Reference 4.

The nominal trip setpoint entered into a bistable is more conservative than that specified by the Allowable Value. A channel is inoperable if its actual setpoint is not within its required Allowable Value.

The following Bases for each trip Function identify the above RPS trip Function criteria items that are applicable to establish the trip Function OPERABILITY.

1. Power Level-High Trip This LCO requires all four instrument channels of the Power Level-High trip to be OPERABLE in MODEs 1 and 2.

The Allowable Value is high enough to provide an operating envelope that prevents unnecessary Power Level-High trips during normal plant operations. The Allowable Value is low enough for the system to CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-16 Revision 31

RPS Instrumentation-Operating B 3.3.1 BASES maintain a margin to unacceptable fuel cladding damage should a CEA ejection accident occur.

The Power Level-High trip setpoint is operator adjustable and can be set at a fixed increment above the indicated THERMAL POWER level. Operator action is required to increase the trip setpoint as THERMAL POWER is increased. The trip setpoint is automatically decreased as THERMAL POWER decreases.

The trip setpoint has a maximum and a minimum setpoint.

Adding to this maximum value the possible variation in trip setpoint due to calibration and instrument errors, the maximum actual steady state THERMAL POWER level at which a trip would be actuated is 110.3% RTP (112% RTP for over-cooling events), which is the value used in the safety analyses.

To account for these errors, the safety analysis minimum value is 40% RTP. The 10% step increase in trip setpoint is a maximum value assumed in the safety analysis. There is no uncertainty applied to the step in the safety analyses.

2. Rate of Change of Power-High Trip This LCO requires four instrument channels of Rate of Change of Power-High trip to be OPERABLE in MODEs 1 and 2.

The high power rate of change trip serves as a backup to the administratively-enforced startup rate limit.

The accident analyses implicitly credit the trip as justification for not explicitly analyzing certain events initiated from subcritical conditions. For events initiated from critical conditions, the trip is not credited in the accident analyses.

3. Reactor Coolant Flow-Low Trip This LCO requires four instrument channels of Reactor Coolant Flow-Low trip to be OPERABLE in MODEs 1 and 2.

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-17 Revision 43

RPS Instrumentation-Operating B 3.3.1 BASES The trip may be manually bypassed when NUCLEAR INSTRUMENT POWER falls below 1E-4% RTP. This operating bypass is part of the ZPMB circuitry, which also bypasses the TM/LP trip and provides a 'T power block signal to the Q power select logic. The ZPMB allows low power physics testing at reduced RCS temperatures and pressures. It also allows heatup and cooldown with shutdown CEAs withdrawn.

This trip is set high enough to maintain fuel integrity during a loss of flow condition. The setting is low enough to allow for normal operating fluctuations from offsite power. Reactor Coolant System flow is maintained above design flow by LCO 3.4.1.

4. Pressurizer Pressure-High Trip This LCO requires four instrument channels of Pressurizer Pressure-High trip to be OPERABLE in MODEs 1 and 2.

The Allowable Value is set high enough to allow for pressure increases in the RCS during normal operation (i.e., plant transients) not indicative of an abnormal condition. The setting is below the lift setpoint of the pressurizer safety valves and low enough to initiate a reactor trip when an abnormal condition is indicated. The analysis setpoint includes allowance for harsh environment, where appropriate.

The Pressurizer Pressure-High trip concurrent with power-operated relief valve operation avoids unnecessary operation of the pressurizer safety valves (Reference 5).

5. Containment Pressure-High Trip This LCO requires four instrument channels of Containment Pressure-High trip to be OPERABLE in MODEs 1 and 2.

The Allowable Value is high enough to allow for small pressure increases in Containment, expected during CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-18 Revision 34

RPS Instrumentation-Operating B 3.3.1 BASES normal operation (i.e., plant heatup) that are not indicative of an abnormal condition. The setting is low enough to initiate a reactor trip to prevent containment pressure from exceeding design pressure following a DBA.

6. Steam Generator Pressure-Low Trip This LCO requires four instrument channels of Steam Generator Pressure-Low trip per steam generator to be OPERABLE in MODEs 1 and 2.

The Allowable Value is sufficiently below the full load operating value for steam pressure so as not to interfere with normal plant operation, but still high enough to provide the required protection in the event of excessive steam demand. Since excessive steam demand causes the RCS to cool down, resulting in positive reactivity addition to the core in the presence of a negative moderator temperature coefficient, a reactor trip is required to offset that effect.

For Unit 1, a large Feedwater line break can reach the Steam Generator Pressure-Low trip prior to reaching the Pressurizer Pressure-High trip.

The analysis setpoint value includes harsh environment uncertainties, where appropriate.

The Function may be manually bypassed as steam generator pressure is reduced during controlled plant shutdowns. This operating bypass is permitted at a preset steam generator pressure. The bypass, in conjunction with the ZPMB, allows testing at low temperatures and pressures, and heatup and cooldown with the shutdown CEAs withdrawn. From a bypass condition, the trip will be automatically reinstated as steam generator pressure increases above the preset pressure.

CALVERT CLIFFS - UNIT 1 B 3.3.1-19 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES

7. Steam Generator Level-Low Trip This LCO requires four instrument channels of Steam Generator Level - Low per steam generator to be OPERABLE in MODEs 1 and 2.

The Allowable Value is sufficiently below the normal operating level for the steam generators so as not to cause a reactor trip during normal plant operations.

The trip setpoint is high enough to ensure a reactor trip signal is generated to prevent operation with the steam generator water level below the minimum volume required for adequate heat removal capacity, and ensures that the pressure of the RCS will not exceed its SL. The specified setpoint, in combination with the Auxiliary Feedwater Actuation System (AFAS),

ensures that sufficient water inventory exists in both steam generators to remove decay heat following a Loss of Main Feedwater Flow event.

8. APD-High Trip This LCO requires four instrument channels of APD-High trip to be OPERABLE in MODE 1, NUCLEAR INSTRUMENT POWER t 15% RTP.

The Allowable Value curve was derived from an analysis of many axial power shapes with allowances for instrumentation inaccuracies and the uncertainty associated with the excore to incore ASI relationship.

The APD-High trip is automatically bypassed at

< 15% RTP, as measured by the NIs, where it is not required for reactor protection (Reference 5).

9. Thermal Margin

a. TM/LP Trip This LCO requires four instrument channels of TM/LP trip to be OPERABLE in MODEs 1 and 2.

The Allowable Value includes allowances for equipment response time, measurement uncertainties, processing error, and a further CALVERT CLIFFS - UNIT 1 B 3.3.1-20 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES allowance to compensate for the time delay associated with providing effective termination of the occurrence that exhibits the most rapid decrease in margin to the SLs.

This trip may be manually bypassed when NUCLEAR INSTRUMENT POWER falls below 1E-4% RTP. This operating bypass is part of the ZPMB circuitry, which also bypasses the Reactor Coolant Flow-Low trip and provides a 'T power block signal to the Q power select logic (Reference 5). The ZPMB allows low power physics testing at reduced RCS temperatures and pressures. It also allows heatup and cooldown with shutdown CEAs withdrawn.

b. ASGT This LCO requires four instrument channels of ASGT to be OPERABLE in MODEs 1 and 2.

The Allowable Value is high enough to avoid trips caused by normal operation and minor transients, but ensures DNBR protection in the event of DBAs. The difference between the Allowable Value and the analysis setpoint allows for instrument uncertainty.

The trip may be manually bypassed when NUCLEAR INSTRUMENT POWER falls below 1E-4% RTP as part of the ZPMB circuitry operating bypass. The Steam Generator Pressure Difference is subject to the ZPMB, since it is an input to the TM/LP trip and is not required for protection at low power levels (Reference 5).

10. Loss of Load The LCO requires four Loss of Load instrument channels to be OPERABLE in MODE 1, NUCLEAR INSTRUMENT POWER t 15% RTP.

CALVERT CLIFFS - UNIT 1 B 3.3.1-21 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES The Loss of Load trip is automatically bypassed when NUCLEAR INSTRUMENT POWER falls below 15%, as measured by NIs, to allow loading the turbine.

Bypasses The LCO on automatic bypass removal features requires that the automatic bypass removal feature of all four operating bypass channels be OPERABLE for each RPS Function with an operating bypass in the MODEs addressed in the specific LCO for each Function. All four automatic bypass removal features must be OPERABLE to ensure that none of the four RPS instrument channels are inadvertently bypassed.

The LCO applies to the automatic bypass removal feature only. If the bypass channel is failed so as to prevent entering a bypass condition, operation may continue.

APPLICABILITY This LCO is applicable in accordance with Table 3.3.3-1.

Most RPS trip functions are required to be OPERABLE in MODEs 1 and 2 because the reactor is critical in these MODEs. The trips are designed to take the reactor subcritical, maintaining the SLs during AOOs and assisting the ESFAS in providing acceptable consequences during accidents. Exceptions are addressed in footnotes to the table. Exceptions to this APPLICABILITY are:

The APD-High and Loss-of-Load trips are only applicable in MODE 1, NUCLEAR INSTRUMENT POWER t 15% RTP because they are automatically bypassed at < 15% RTP, as measured by NIs, where they are no longer needed.

The Rate of Change of Power-High trip, RPS logic, RTCBs, and manual trip are also required in MODEs 3, 4, and 5, with the RTCBs closed, to provide protection for boron dilution and CEA withdrawal events. The Rate of Change of Power-High trip in these lower MODEs is addressed in LCO 3.3.2. The RPS logic in MODEs 1, 2, 3, 4, and 5 is addressed in LCO 3.3.3.

Most trip functions are not required to be OPERABLE in MODEs 3, 4, and 5. In MODEs 3, 4, and 5, the emphasis is placed on return to power events. The reactor is protected in these MODEs by ensuring adequate SHUTDOWN MARGIN (SDM).

CALVERT CLIFFS - UNIT 1 B 3.3.1-22 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES ACTIONS The most common causes of instrument channel inoperability are outright failure or drift of the bistable trip unit or measurement channel sufficient to exceed the tolerance allowed by Reference 4. Typically, the drift is found to be small which, at worst, results in a delay of actuation rather than a total loss of Function. This determination is generally made during the performance of a CHANNEL CALIBRATION when the process instrument is set up for adjustment to bring it to within specification. Sensor Drift could also be identified during the CHANNEL CHECKS.

CHANNEL FUNCTIONAL TESTs identify bistable trip unit drift.

If the trip setpoint is less conservative than the Allowable Value in Table 3.3.1-1, the instrument channel is declared inoperable immediately, and the appropriate Condition(s) must be entered immediately.

In the event that either an instrument channels trip setpoint is found nonconservative with respect to the Allowable Value or the transmitter, instrument loop, signal processing electronics, RPS bistable trip unit, or applicable automatic bypass removal feature when bypass is in effect, is found inoperable, then all affected Functions provided by that channel must be declared inoperable, and the plant must enter the Condition for the particular protection Function affected.

When the number of inoperable instrument channels in a trip Function exceeds that specified in any related Condition associated with the same trip Function, the plant is outside the safety analysis. Therefore, LCO 3.0.3 is immediately entered, if applicable, in the current MODE of operation.

A Note has been added to the ACTIONS to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function. The Completion Times of each inoperable Function will be tracked separately for each Function, starting from the time the Condition was entered.

A.1, A.2.1, and A.2.2 Condition A applies to the failure of a single instrument channel in any RPS automatic trip Function. Reactor CALVERT CLIFFS - UNIT 1 B 3.3.1-23 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES Protective System coincidence logic is normally two-out-of-four.

If one RPS bistable trip unit or associated measurement channel is inoperable, startup or power operation is allowed to continue, providing the inoperable bistable trip unit is placed in bypass or trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (Required Action A.1).

The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allotted to restore, bypass, or trip the instrument channel is sufficient to allow the operator to take all appropriate actions for the failed channel, while ensuring that the risk involved in operating with the failed channel is acceptable.

The failed instrument channel is restored to OPERABLE status or is placed in trip within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months (Required Action A.2.1 or Required Action A.2.2). Required Action A.2.1 restores the full capability of the Function.

Required Action A.2.2 places the Function in a one-out-of-three configuration. In this configuration, common cause failure of dependent channels cannot prevent a trip.

The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is based on operating experience, which has demonstrated that a random failure of a second instrument channel occurring during the 48-hour period is a low probability event.

B.1 and B.2 Condition B applies to the failure of two instrument channels in any RPS automatic trip Function.

Required Action B.1 provides for placing one inoperable channel in bypass and the other channel in trip within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This Completion Time is sufficient to allow the operator to take all appropriate actions for the failed channels, while ensuring that the risk involved in operating with the failed channels is acceptable. With one channel of protective instrumentation bypassed, the RPS Function is in a two-out-of-three logic; but with another channel failed, the RPS Function may be CALVERT CLIFFS - UNIT 1 B 3.3.1-24 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES operating in a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected.

To correct the problem, the second channel is placed in trip. This places the RPS Function in a one-out-of-two logic. If any of the other OPERABLE channels receives a trip signal, the reactor will trip.

One instrument channel should be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months for reasons similar to those stated under Condition A. After one channel is restored to OPERABLE status, the provisions of Condition A still apply to the remaining inoperable channel. Therefore, the channel that is still inoperable after completion of Required Action B.2 must be placed in trip if more than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months have elapsed since the initial channel failure.

C.1 and C.2 The excore detectors are used to generate the internal ASI used as an input to the TM/LP and APD-High trips. Incore detectors provide a more accurate measurement of ASI. If one or more excore channels cannot be calibrated to match incore detectors, power is restricted or reduced during subsequent operations because of increased uncertainty associated with using uncalibrated excore channels.

The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is adequate to perform the Surveillance Requirement (SR) while minimizing the risk of operating in an unsafe condition.

D.1, D.2.1, D.2.2.1, and D.2.2.2 Condition D applies to one automatic bypass removal feature inoperable. If the automatic bypass removal feature for any operating bypass channel cannot be restored to OPERABLE status, the associated RPS channel may be considered OPERABLE only if the bypass is not in effect. Otherwise, the affected RPS channel must be declared inoperable, as in Condition A, and the bypass either removed or the automatic bypass removal feature repaired. The Bases for Required Actions and Completion Times are the same as discussed for Condition A.

CALVERT CLIFFS - UNIT 1 B 3.3.1-25 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES E.1, E.2.1, and E.2.2 Condition E applies to two inoperable automatic bypass removal features. If the automatic bypass removal features cannot be restored to OPERABLE status, the associated RPS channel may be considered OPERABLE only if the bypasses are not in effect. Otherwise, the affected RPS channels must be declared inoperable, as in Condition B, and the bypasses either removed or the automatic bypass removal features repaired. Also, Required Action E.2.2 provides for the restoration of the one affected RPS channel to OPERABLE status within the rules of Completion Time specified under Condition B. Completion Times are consistent with Condition B.

F.1 Condition F is entered when the Required Action and associated Completion Time of Condition A, B, C, D, or E are not met for the APD-High trip and Loss-of-Load trip Functions.

If the Required Actions associated with these Conditions cannot be completed within the required Completion Times, the reactor must be brought to a MODE in which the Required Actions do not apply. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to reduce THERMAL POWER to < 15% RTP is reasonable, based on operating experience, to decrease power to < 15%

RTP from full power conditions in an orderly manner and without challenging plant systems.

G.1 Condition G is entered when the Required Action and associated Completion Time of Condition A, B, C, D, or E are not met except for the APD-High trip and Loss-of-Load trip Functions.

If the Required Actions associated with these Conditions cannot be completed within the required Completion Times, the reactor must be brought to a MODE in which the Required Actions do not apply. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to be in MODE 3 is reasonable, based on operating experience, for reaching the required MODE from full power CALVERT CLIFFS - UNIT 1 B 3.3.1-26 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The SRs for any particular RPS Function are found in the SR REQUIREMENTS column of Table 3.3.1-1 for that Function. Most Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION.

SR 3.3.1.1 Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one instrument channel to a similar parameter on other channels.

It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument channel drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a qualitative assessment of the instrument channel combined with the instrument channel uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limits. CHANNEL CHECKS are performed on the wide range logarithmic neutron flux monitor for the Rate of Change of Power-High trip Function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.2 A daily calibration (heat balance) is performed when THERMAL POWER is t 15%. The daily calibration shall consist of adjusting the nuclear power calibrate potentiometers to agree with the calorimetric calculation if the absolute difference is > 1.5%. The 'T power calibrate CALVERT CLIFFS - UNIT 1 B 3.3.1-27 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES potentiometers are then used to null the nuclear power -'T power indicators on the RPS Calibration and Indication Panel. Performance of the daily calibration ensures that the two inputs to the Q power measurement are indicating accurately with respect to the much more accurate secondary calorimetric calculation. The heat balance addresses overall gain of the instruments and does not include ASI.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Frequency is modified by a Note indicating that once the unit reaches 15%

RTP, 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is the maximum time allowed for completing this Surveillance. The secondary calorimetric is inaccurate at lower power levels. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows time for plant stabilization, data-taking, and instrument calibration.

A second Note indicates the daily calibration may be suspended during PHYSICS TESTS. This ensures that calibration is proper both preceding and following physics testing at each plateau, recognizing that during testing, changes in power distribution and RCS temperature may render the calibration inaccurate.

SR 3.3.1.3 It is necessary to calibrate the excore power range channel upper and lower subchannel amplifiers such that the internal ASI used in the TM/LP trip and APD-High trip Functions reflects the true core power distribution as determined by the incore detectors. A Note indicates that once the unit reaches 20% RTP, 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is the maximum time allowed for completion of this Surveillance. The Surveillance is required to be performed prior to operation above 90% RTP.

Uncertainties in the excore and incore measurement process make it impractical to calibrate when THERMAL POWER is

< 20% RTP. The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows time for plant stabilization, data-taking, and instrument calibration. Requiring the SR prior to operations above 90%

RTP is because of the increased uncertainties associated with using uncalibrated excore detectors. If the excore channels are not properly calibrated to agree with the incore detectors, power is restricted during subsequent operations because of increased uncertainty associated with using uncalibrated excore channels. The Surveillance CALVERT CLIFFS - UNIT 1 B 3.3.1-28 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.4 A CHANNEL FUNCTIONAL TEST is performed on each RPS instrument channel, except Loss of Load and Rate of Change of Power, to ensure the entire channel will perform its intended function when needed. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specification tests at least once per refueling interval with applicable extensions.

In addition to reference voltage power supply tests, the RPS CHANNEL FUNCTIONAL TEST consists of three overlapping tests as described in Reference 1, Section 7.2. These tests verify that the RPS is capable of performing its intended function, from bistable input through the RTCBs. They include:

Bistable Tests The bistable setpoint must be found to trip within the Allowable Values specified in the LCO and left set consistent with the assumptions of Reference 4. As-found values must also be recorded and reviewed for consistency with the assumptions of the frequency extension analysis.

The requirements for this review are outlined in Reference 8.

A test signal is substituted as the input in one instrument channel at a time to verify that the bistable trip unit trips within the specified tolerance around the setpoint.

This is done with the affected RPS channel bistable trip unit bypassed. Any setpoint adjustment shall be consistent with the assumptions of Reference 4.

Matrix Logic Tests Matrix logic tests are addressed in LCO 3.3.3. This test is performed one matrix at a time. It verifies that a coincidence in the two instrument channels for each Function CALVERT CLIFFS - UNIT 1 B 3.3.1-29 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES removes power from the matrix relays. During testing, power is applied to the matrix relay test coils and prevents the matrix relay contacts from assuming their de-energized state. This test will detect any short circuits around the bistable contacts in the coincidence logic, such as may be caused by faulty bistable relay or trip bypass contacts.

Trip Path Tests Trip path logic tests are addressed in LCO 3.3.3. These tests are similar to the matrix logic tests, except that test power is withheld from one matrix relay at a time, allowing the trip path circuit to de-energize, opening the affected set of RTCBs. The RTCBs must then be closed prior to testing the other three trip path circuits, or a reactor trip may result.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.5 A CHANNEL CALIBRATION of the excore power range channels ensures that the channels are reading accurately and within tolerance. The SR verifies that the channel responds to a measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be performed consistent with the plant-specific SRs.

The as-found and as-left values must also be recorded and reviewed for consistency with the assumptions of the Frequency extension analysis. The requirements for this review are outlined in Reference 8.

A Note is added stating that the neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal (Reference 7). Slow changes in detector sensitivity are compensated for by performing the calorimetric calibration (SR 3.3.1.2) and the linear subchannel gain check (SR 3.3.1.3). In addition, associated CALVERT CLIFFS - UNIT 1 B 3.3.1-30 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES control room indications are continuously monitored by the operators.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.6 A CHANNEL FUNCTIONAL TEST on the Loss of Load, and Rate of Change of Power channels is performed prior to a reactor startup to ensure the entire channel will perform its intended function if required. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specification tests at least once per refueling interval with applicable extensions. The Loss of Load sensor cannot be tested during reactor operation without causing reactor trip. The Power Rate of Change-High trip Function is required during startup operation and is bypassed when shut down or > 12% RTP.

SR 3.3.1.7 Surveillance Requirement 3.3.1.7 is a CHANNEL FUNCTIONAL TEST similar to SR 3.3.1.4, except SR 3.3.1.7 is applicable only to Functions with automatic bypass removal features. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specification tests at least once per refueling interval with applicable extensions. Proper operation of operating bypasses are critical during plant startup because the bypasses must be in place to allow startup operation and must be removed at the appropriate points during power ascent to enable certain reactor trips. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Once the operating bypasses are removed, the bypasses must not fail in such a way that the associated trip Function gets CALVERT CLIFFS - UNIT 1 B 3.3.1-31 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES inadvertently bypassed. This feature is verified by the trip Function CHANNEL FUNCTIONAL TEST, SR 3.3.1.4.

Therefore, further testing of the automatic bypass removal feature after startup is unnecessary.

SR 3.3.1.8 Surveillance Requirement 3.3.1.8 is the performance of a CHANNEL CALIBRATION.

CHANNEL CALIBRATION is a check of the instrument channel, including the sensor. The SR verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument channel drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be performed consistent with Reference 4.

The as-found and as-left values must also be recorded and reviewed for consistency with the assumptions of the frequency extension analysis. The requirements for this review are outlined in Reference 6.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The SR is modified by a Note to indicate that the neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift, and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the calorimetric calibration (SR 3.3.1.2) and the linear subchannel gain check (SR 3.3.1.3).

SR 3.3.1.9 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. Response time testing acceptance CALVERT CLIFFS - UNIT 1 B 3.3.1-32 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES criteria are included in Reference 1, Section 7.2. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Testing may be performed in one measurement or in overlapping segments, with verification that all components are tested.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Reference 9 provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the reference.

Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

Instrument loop or test cables and wiring add an insignificant response time and can be ignored.

A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimum drift, and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.3).

REFERENCES 1. Updated Final Safety Analysis Report

2. Title 10 Code of Federal Regulations

3. Institute of Electrical and Electronic Engineers (IEEE)

No. 279, Proposed IEEE Criteria for Nuclear Power Plant Protection Systems, August 1968

4. CCNPP Setpoint File

5. Letter from Mr. R. E. Denton (BGE) to NRC Document Control Desk, dated June 6, 1995, License Amendment Request: Extension of Instrument Surveillance Intervals CALVERT CLIFFS - UNIT 1 B 3.3.1-33 Revision 57

RPS Instrumentation-Operating B 3.3.1 BASES

6. Combustion Engineering Topical Report CEN-327, RPS/ESFAS Extended Test Interval Evaluation dated June 2, 1986, including Supplement 1, March 3, 1989

7. Letter from Mr. D. G. McDonald (NRC) to Mr. R. E. Denton (BGE), dated October 19, 1995, Issuance of Amendments for Calvert Cliffs Nuclear Power Plant, Unit No. 1 (TAC No. M92479) and Unit No. 2 (TAC No. M92480)

8. Calvert Cliffs Procedure EN-4-104, Surveillance Testing

9. Combustion Engineering Owners Group Topical Report CE NPSD 1167-A, Revision 2, Elimination of Pressure Sensor Response Time Testing Requirements, July 3, 2000 CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-34 Revision 55

RPS Instrumentation-Operating B 3.3.1 BASES Figure B 3.3.1-1 Functional Diagram of the Two-Out-of-Four Logic and RTCB Configuration CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-35 Revision 55

RPS Instrumentation-Operating B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protective System (RPS) Instrumentation-Operating BASES BACKGROUND The RPS initiates a reactor trip to protect against violating the core specified acceptable fuel design limits and breaching the reactor coolant pressure boundary during anticipated operational occurrences (AOOs). By tripping the reactor, the RPS also assists the Engineered Safety Features (ESF) systems in mitigating accidents.

The protective systems have been designed to ensure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as Limiting Conditions for Operation (LCOs) on other reactor system parameters and equipment performance.

The LSSS, defined in this Specification as the Allowable Value, in conjunction with the LCOs, establishes the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During AOOs, which are those events expected to occur one or more times during the plant life, the acceptable limits are:

The departure from nucleate boiling ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling;

Fuel centerline melting shall not occur; and

The Reactor Coolant System (RCS) pressure SL of 2750 psia shall not be exceeded.

Maintaining the parameters within the above values ensures that the offsite dose will be within Reference 2, 10 CFR Parts 50 and 100, criteria during AOOs.

Accidents are events that are analyzed even though they are not expected to occur during the plant life. The acceptable limit during accidents is that the offsite dose shall be maintained within the acceptance criteria given in the Reference 1, Chapter 14.

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-1 Revision 2

RPS Instrumentation-Operating B 3.3.1 BASES The RPS is segmented into four interconnected modules.

These modules are:

Measurement channels;

Bistable trip units;

RPS logic; and

Reactor trip circuit breakers (RTCBs).

This LCO addresses measurement channels and bistable trip units. It also addresses the automatic bypass removal channel for those trips with operating bypasses. The RPS logic and RTCBs are addressed in LCO 3.3.3.

An instrument channel consists of the measurement channel and bistable trip unit for one channel of one Function.

The role of each of these modules in the RPS, including those associated with the logic and RTCBs, is discussed below.

Measurement Channels Measurement channels, consisting of field transmitters or process sensors and associated instrumentation, provide a measurable electronic signal based upon the physical characteristics of the parameter being measured.

The Power Range excore nuclear instrumentation drawers, Thermal Margin/Low Pressure (TM/LP) trip calculators, and Axial Power Distribution (APD) trip calculators, are considered components in the measurement channels. The power range nuclear instruments (NIs) provide average power and subchannel deviation signals. The wide range NIs provide a Rate of Change of Power-High trip. Two decades of overlap are provided between the power range NIs and the wide range NIs. Three RPS trip functions use a power level designated as Q power as an input. Q power is the higher of NI power and primary calorimetric power ('T power) based on RCS hot leg and cold leg temperatures. Trip functions using Q power as an input include the Power Level-High, TM/LP, and the APD trips.

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-2 Revision 2

RPS Instrumentation-Operating B 3.3.1 BASES The TM/LP and APD trip calculators provide the complex signal processing necessary to calculate the TM/LP trip setpoint, Asymmetric Steam Generator Transient (ASGT) trip setpoint, APD trip setpoint, Power Level-High trip setpoint, and Q power calculation.

The excore NI drawers (wide range and power range) and the TM/LP and APD trip calculators are mounted in the RPS cabinet, with one channel of each in each of the four RPS bays.

Four measurement channels with electrical and physical separation are provided for each parameter used in the direct generation of trip signals. These are designated Channels A through D. Measurement channels provide input to one or more RPS bistables within the same RPS channel. In addition, some measurement channels may also be used as inputs to Engineered Safety Features Actuation System (ESFAS) sensor modules, and most provide indication in the Control Room. Measurement channels used as an input to the RPS are never used for control functions.

When a measurement channel monitoring a parameter exceeds a predetermined setpoint, indicating an unsafe condition, the bistable in the bistable trip unit monitoring the parameter in that measurement channel will trip. Tripping two or more bistable trip units monitoring the same parameter de-energizes matrix logic, which in turn de-energizes the trip path logic. This causes all eight RTCBs to open, interrupting power to the control element assemblies (CEAs),

allowing them to fall into the core.

Three of the four instrument channels are necessary to meet the redundancy and testability as described in Reference 1, Appendix 1C. The fourth channel provides additional flexibility by allowing one channel to be removed from service (trip bypass) for maintenance or testing, while still maintaining a minimum two-out-of-three logic. Thus, even with a channel inoperable, no single additional failure in the RPS can either cause an inadvertent trip or prevent a required trip from occurring.

CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-3 Revision 2

RPS Instrumentation-Operating B 3.3.1 BASES Since no single failure will either cause or prevent a protective system actuation, and no protective channel feeds a control channel, this arrangement meets the requirements of Reference 1, Section 7.2.2 and Reference 3.

Many of the RPS Function trips are generated by comparing a single measurement to a fixed bistable setpoint. Certain Functions, however, make use of more than one measurement to provide a trip. The following trips use multiple measurement channel inputs:

Steam Generator Level-Low Trip This trip uses the lower of the two steam generator levels as an input to a common bistable.

Steam Generator Pressure-Low Trip This trip uses the lower of the two steam generator pressures as an input to a common bistable.

Power Level-High Trip The Power Level-High trip uses Q power as its only input. Q power is the higher of NI power and 'T power. Q power has a trip setpoint that tracks power levels downward so that the trip setpoint is always within a fixed increment above current power, subject to a minimum value.

On power increases, the trip setpoint remains fixed unless manually reset, at which point the trip setpoint increases to the new setpoint, which is a fixed increment above Q power at the time of reset, and the trip setpoint is subject to a maximum value. Thus, during power escalation, the trip setpoint must be repeatedly reset to avoid a reactor trip.

TM/LP and ASGT Trip Q power is only one of several inputs to the TM/LP trip. Other inputs include internal AXIAL SHAPE INDEX (ASI) and cold leg temperature based on the higher of two cold leg resistance temperature detectors. The TM/LP trip setpoint is a complex function of these CALVERT CLIFFS - UNITS 1 & 2 B 3.3.1-4 Revision 2

RPS Instrumentation-Operating B 3.3.1 BASES inputs and represents a minimum acceptable RCS pressure to be compared to actual RCS pressure in the TM/LP trip unit.

Steam generator pressure is also an indirect input to the TM/LP trip via the ASGT. This Function provides a reactor trip when the secondary pressure in either steam generator exceeds that of the other generator by greater than a fixed amount. The trip is implemented by biasing the TM/LP trip setpoint upward so as to ensure TM/LP trip if an ASGT is detected.

APD-High Trip Q power and subchannel deviation are inputs to the APD trip. The APD trip setpoint is a function of Q power, being more restrictive at higher power levels. It provides a reactor trip if actual ASI exceeds the APD trip setpoint.