ML18036A790

Proposed Tech Specs Re Upgrade to Reactor and Refuel Zone Radiation Monitoring Sys

ML18036A790
Person / Time
Site:	Browns Ferry
Issue date:	07/23/1992
From:	TENNESSEE VALLEY AUTHORITY
To:
Shared Package
ML18036A789	List: ML18036A787 ML18036A790
References
NUDOCS 9207290145
Download: ML18036A790 (89)

Text

ENCLOSURE 1 PROPOSED TECHNICAL SPECIFICATION CHANGE BROWNS FERRY NUCLEAR PLANT UNITS 1, 2, AND 3 (TVA BFNP TS 316) 9207290145 920723 PDR -ADOCK 05000259 PDR

t ~ 1

~ f I' (I

PROPOSED TECHNICAL SPECIFICATION CHANGE BROWNS FERRY NUCLEAR PLANT UNIT 1 (TVA BFNP TS 316)

UNIT 1 EFFECTIVE PAGE LIST REMOVE INSERT 1.0-9 1.0-9 3.2/4.2-8 3.2/4.2-8 3.2/4.2-9 3.2/4.2-9 3.2/4.2-13 3.2/4.2-13 3.2/4.2-13a 3.2/4.2-13b 3.2/4.2-41 3.2/4.2-41 3.2/4.2-60 3.2/4.2-60 3.2/4.2-61 3.2/4.2-61 3.2/4.2-68 3.2/4.2-68 3.2/4.2-69 3.2/4.2-69 3.2/4.2-73 3.2/4.2-73

l I 1

~

lp. ~ho ic A.logic is an arrangement of relays, contacts, and other components that produces a decision output.

and produces decision outputs to the actuation logic.

(b) Actuation A logic that .receives signals (either from initiation logic or channels) and produces decision outputs to accomplish a protective action.

Channel Calibration Shall be the adjustment, as necessary, of the channel output such that it responds with necessary range and accuracy to known values of the parameters which the channel monitors. The channel calibration shall encompass the entire channel including alarm and/or trip functions and shall include the channel functional test. The channel calibration may be performed by any series of sequential, overlapping or total channel steps such that the entire channel is calibrated. Non-calibratable components shall be excluded from this requirement, but will be included in channel functional test and source check.

12. Channel Functional Test Shall be:

a. Analog/Digital Channels the injection of a simulated signal into the channel as close to the sensor as practicable to verify OPERABILITY including alarm and/or trip functions.

b. Bistable Channels the injection of a simulated signal into the sensor to verify OPERABILITY including alarm and/or trip functions.

13. Source Check Shall be the qualitative assessment of channel response when the channel sensor is exposed to a radioactive source or multiple of sources.

BFN 1.0-9 Unit 1

TABLE 3.2.A (Continued)

PRIHARY CONTAINHENT AND REACTOR BUILDING ISOLATION INSTRUHENTATION gP a~ Hinimum No.

Instrument Channels Operable P r Tri 1 11 Fn in Tri Lev 1 in Action 1 R rk Instrument Channel 3 times normal rated 1. Above trip setting High Radiation Hain Steam full power background (13) initiates Hain Steam Line Line Tunnel (6) Isolation Instrument Channel- > 825 psig (4) 1. Below trip setting Low Pressure Hain Steam initiates Hain Steam Line Line Isolation 2(3) Instrument Channel < 140% of rated steam flow 1. Above trip setting High Flow Hain Steam Line initiates Hain Steam Line Isolation 2(12) Instrument Channel < 200'F 1. Above trip setting Hain Steam Line Tunnel initiates Hain Steam High Temperature Line Isolation.

4O 2(14) Instrument Channel 160 - 180'F l. Above trip setting Reactor Water Cleanup initiates Isolation System Floor Drain of Reactor Water High Temperature Cleanup Line from I Reactor and Reactor co Mater Return Line.

Instrument Channel- 160 - 1800F 1. Same as above Reactor Mater Cleanup System Space High Temperature 1(15) Instrument Channel < 100 mr/hr or downscale 1. 1 upscale channel or Reactor Building 2 downscale channels will Ventilation High a. Initiate SGTS Radiation Reactor 2one b. Isolate reactor zone and refueling floor.

c. Close atmosphere control system.

TABLE 3.2.A (Continued)

PRIMARY CONTAINHENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable er Tri s1 ll Fun i n Tri Level Set in Acin 1 R ark 1(15) Instrument Channel < 100 mr/hr or downscale F 1. 1 upscale channel or Reactor Building 2 downscale channels will Ventilation High a. Initiate SGTS Radiation Refueling Zone b. Isolate refueling floor

c. Close atmosphere control system.

2(7) (B) Instrument Channel >2000 cfm and < 4000 cfm H and Below 2000 cfm airflow R.H.

SGTS Flow - Train A (A or F) heaters shall be shut off.

R. H. Heaters 2(7) (B) Instrument Channel >2000 cfm and < 4000 cfm H and Below 2000 cfm airflow R H SGTS Flow - Train B (A or F) heaters shall be shut off.

R. H. Heaters 2(7) (B) Instrument Channel >2000 cfm and < 4000 cfm H and Below 2000 cfm airflow R.H.

SGTS Flow Train C (A or F) heaters shall be shut off.

R. H. Heaters Reactor Building Isolation 0 < t < 2 secs. HorF 1. Below trip setting prevents Timer (refueling floor) spurious trips and system perturbations from initiating isolation.

Reactor Building Isolation 0 < t < 2 secs. GorA 1. Below trip setting prevents Timer (reactor zone) or H spurious trips and system perturbations from initiating isolation.

2(10) Group 1 (Initiating) Logic N/A 1. Refer to Table 3.7.A for list of valves.

T

~ OTES FOR TABLE 2 A (Cont'd) 4~ Only required in RUN MODE (interlocked with Mode Switch).

5. Deleted

6. Channel shared by RPS and Primary Containment 6c Reactor Vessel Isolation Control System. A channel failure may be a channel failure in each system.

7 ~ A train is considered a trip system.

8. Two out of three SGTS trains required. A failure of more than one will require actions A and F.

9. Deleted

10. Refer to Table 3.7.A and its notes for a listing of Isolation Valve Groups and their initiating signals.'

A channel may be placed in an inoperable status for up to four hours for required surveillance without placing the trip system in the tripped condition provided at least one OPERABLE channel in the same trip system is monitoring that parameter. For the Reactor Building Ventilation system, one channel may be inoperable for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance, as long as the downscale trip of the inoperable channel is placed in the tripped condition.

u. A channel contains four sensors, all of which must be OPERABLE for the channel to be OPERABLE.

Power operations permitted for up to 30 days with 15 of the 16 temperature switches OPERABLE.

In the event that normal ventilation is unavailable in the main steam line tunnel, the high temperature channels may be bypassed for a period of not to exceed four hours. During periods when normal ventilation is not available, such as during the performance of secondary containment leak rate tests, the control room indicators of the affected space temperatures shall be monitored for indications of small steam leaks. In the event of rapid increases in temperature (indicative of steam line break), the operator shall promptly close the main steam line isolation valves.

13. The nominal setpoints for alarm and reactor trip (1.5 and 3.0 times background, respectively) are established based on the normal background at full power. The allowable setpoints for alarm and reactor trip are 1.2-1.8 and 2.4-3.6 times background, respectively.

BFN 3.2/4.2-13 Unit 1

~ . OTES FOR TABLE 3 2 A (Cont'd)

14. Requires two inAependent 'channels from each physical location; there are two locations.

15. There is a RBVRM trip function for the refueling zone and a RBVRM trip function for the reactor zone. Each trip function is composed of two divisional trip systems. Each trip system has one channel for each zone. Each channel contains two sensors, both of which must be OPERABLE for the channel to be OPERABLE. A channel downscale/inoperable trip occurs when either of the sensors are indicating less than the low radiation setpoint or are inoperable. A channel upscale trip occurs when both of the sensors are indicating higher than the high radiation setpoint. Only one channel upscale trip is required for trip function initiation. Two channel downscale trips in a zone are required for trip function initiation.

BFN 3.2/4.2-13a Unit 1

THIS PAGE INTENTIONALLY.LEFT BLANK BFN 3.2/4.2-13b

(

Unit 1

TABLE 4.2.A (Cont'd)

SURVEILLANCE RE(UIREMENTS FOR PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION

~Fn i on Func ional T alibra ion Fr n In rum n h k Instrument Channel once/3 months (27) once/operating cycle None Main Steam Line Tunnel High Temperature Instrument Channel- (1) (31) once/18 months once/day (8)

Reactor Building Ventilation High Radiation Reactor Zone Instrument Channel (1) (31) once/18 Months once/day (8)

Reactor Building Ventilation High Radiation - Refueling Zone Instrument Channel- (4) N/A SGTS Train A Heaters Instrument Channel- (4) N/A SGTS Train 8 Heaters Instrument Channel- (4) N/A.

SGTS Train C Heaters Reactor Building Isolation (4) once/operating cycle N/A Timer (refueling floor)

Reactor Building Isolation (4) once/operating cycle N/A Timer (reactor zone)

NOTES FOR TABLES 4 2 A THROUGH 4 2 L exce t 4 2 D AND 4 2 K (Cont'd)

14. (Deleted)

15. The flow bias comparator will be tested by putting one flow unit in "Test" (producing 1/2 scram) and adjusting the test input to obtain comparator rod block. The flow bias upscale will be verified by observing a local upscale trip light during operation and verified that it will produce a rod block during the operating cycle.

16. Performed during operating cycle. Portions of the logic is checked more frequently during functional tests of the functions that produce a rod block.

17. This calibration consists of removing the function from service and performing an electronic calibration of the channel.

18. Functional teat is limited to the condition where secondary containment integrity is not required as specified in Sections 3.7.C.2 and 3.7.C.3.

19. Functional test is limited to the time where the SGTS is required to meet the requirements of Section 4.7.C.l.a.

20. Calibration of the comparator requires the inputs from both recirculation loops to be interrupted, thereby removing the flow bias signal to the APRM and RBM and scramming the reactor. This calibration can only be performed during an outage.

21. Logic test is limited to the time where actual operation of the equipment is permissible.

22. (Deleted)

23. (Deleted)

24. This instrument check consists of comparing the thermocouple readings for all valves for consistence and for nominal expected values (not required during refueling outages).

25. During each refueling outage, all acoustic monitoring channels shall be calibrated. This calibration includes verification of accelerometer response due to mechanical excitation in the vicinity of the sensor.

BFN 3.2/4.2-60 Unit 1

OTES FOR TABLES 4 2 A THROUGH 4 2 L exce t 4 2 D AND 4 2 K (Cont'd)

26. This instrument check consists of comparing the background signal levels for all valves for consistency and for nominal expected values (not required during refueling outages).

27. Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify OPERABILITY of the trip and alarm functions.

h

28. Calibration consists of the adjustment of the primary sensor and associated components so that they correspond within acceptable range and accuracy to known values of the parameter which the channel monitors, including adjustment of the electronic trip circuitry, so that its output relay changes state at or more conservatively than the analog equivalent of the trip level setting.

29. The functional test frequency decreased to once/3 months to reduce challenges to relief valves per NUREG-0737, Item II.K.3.16.

30. Calibration shall consist of an electronic calibration of the channel, not including the detector, for range decades above 10 R/hr and a one-point source check of the detector below 10 R/hr with an installed or portable gamma source.

31. Functional testing for the Reactor Building Ventilation Radiation Monitoring System (RBVRMS) shall consist of verifying the High Voltage Power Supply (HVPS) voltage at the Sensor and Convertors (detectors) is within its design limits. A channel functional test as defined in Section 1.0, "Definitions" shall be performed once per 18 months as part of the RBVRM channel calibration.

BFN 3.2/4.2-61 Unit 1

I I ~

3' BASES (Cont'd)

The APRM rod block-function is flow biased and prevents a significant reduction in MCPR, especially during operation at reduced flow. The APRM provides gross core protection; i.e., limits the gross core power increase from withdrawal of control rods in the normal withdrawal sequence. The trips are set so that MCPR is maintained greater than 1.07 rod block function provides local protection of the core; i.e.,

'he RBM the prevention of critical power in a local region of the core, for a single rod withdrawal error from a limiting control rod pattern.

If the IRM channels are in the worst condition of allowed bypass, the sealing arrangement is such that for unbypassed IRM channels, a rod block signal is generated before the detected neutrons flux has increased by more than a factor of 10.

A downscale indication is an indication the instrument has failed or the instrument is not sensitive enough. In either case the instrument will not respond to changes in control rod motion and thus, control rod motion is prevented.

The'efueling interlocks also operate one logic channel, and are required for safety only when the mode switch is in the refueling position.

For effective emergency core cooling for small pipe breaks, the HPCI system must function since reactor pressure does not decrease rapid enough to allow either core spray or LPCI to operate in time. The automatic pressure relief function is provided as a backup to the HPCI in the event the HPCI does not operate. The arrangement of the tripping contacts is such as to provide this function when necessary and minimize spurious operation. The trip settings given in the specification are adequate to assure the above criteria are met. The specification preserves the effectiveness of the system during periods of maintenance, testing, or calibration, and also minimizes the risk of inadvertent operation; i.e., only one instrument channel out of service.

Two post treatment off-gas radiation monitors are provided and, when their trip point is reached, cause an isolation of the off-gas line.

Isolation is initiated when both instruments reach their high trip point or one has an upscale trip and the other a downscale trip or both have a downscale trip.

Both instruments are required for trip but the instruments are set so that the instantaneous stack release rate limit given in Specification 3.8 is not exceeded.

Too radiation monitors are provided for each unit which initiate Primary Containment Isolation (Group 6 isolation valves) Reactor Building Isolation and operation of the Standby Gas Treatment System. These instrument channels monitor the radiation in the reactor zone ventilation exhaust ducts and in the refueling zone.

BFN 3.2/4.2-6S Unit 1

~ ~ 1 3' BASES (Cont'd)

Trip setting of 100 mr/hr for the monitors in the refueling zone are based upon initiating normal ventilation isolation and SGTS operation so that none of the activity released during the refueling accident leaves the Reactor Building via the normal ventilation path but rather all the activity is processed by the SGTS.

The allowed inoperable time of 4 hours for functional testing or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance (with the downscale trip of the inoperable channel in the tripped condition) of the Reactor Building Ventilation system is based upon a Probabilistic Risk Assessment (PRA).

The assessment considered the failures, relay failures and the probability of an accident occurring for which the RBVRMs are required to operate.

Flow integrators and sump fill rate and pump out rate timers are used to determine leakage in the drywell. A system whereby the time interval to fill a known volume will be utilized to provide a backup. An air sampling system is also provided to detect leakage inside the primary containment (See Table 3.2.E).

'For 'each'arameter monitored, as listed in Table 3.2.F, there are two channels of instrumentation except as noted. By comparing readings between the two channels, a near continuous surveillance of instrument performance is available. Any deviation in readings will initiate an early recalibration, thereby maintaining the quality of the instrument readings.

Instrumentation is provided for isolating the control room and initiating a pressurizing system that processes outside air before supplying it to the control room. An accident signal that isolates primary containment will also automatically isolate the control room and initiate the emergency pressurization system. In addition, there are radiation monitors in the normal ventilation system that will isolate the control room and initiate the emergency pressurization system. Activity required to cause automatic actuation is about one mRem/hr.

Because of the constant surveillance and control exercised by TVA over the Tennessee Valley, flood levels of large magnitudes can be predicted in advance of their actual occurrence. In all cases, full advantage will be taken of advance warning to take appropriate action whenever reservoir levels above normal pool are predicted. Therefore, during flood conditions, the plant will be permitted to operate until water begins to run across the top of the pumping station at elevation 565. Seismically qualified, redundant level switches each powered from a separate division of power are 'provided at the pumping station to give main control room indication of this condition. At that time an orderly shutdown of the plant will be initiated, although surges even to a depth of several feet over the pumping station deck will not cause the loss of the main condenser circulating water pumps.

BFH 3.2/4.2-69 Unit 1

~ g

t. ~

A.2 gASES (Cont'd)

The conclusions to .be drawn are these:

1. A 1-out-of-n system may be treated the same as a single channel in terms of choosing a test interval; and

2. more than one channel should not be bypassed for testing at any one time.

The radiation monitors in the reactor and refueling zones which initiate building isolation and standby .gas treatment operation are arranged such that two sensors high (above the high level setpoint) in a single channel or one sensor downscale (below low level setpoint) or inop in two channels in the same zone will initiate a trip function. The functional testing frequency is based on a Probabilistic Risk Assessment and system drift characteristics of the Reactor Building Ventilation Radiation Monitors. The calibration frequency is based upon the drift of the radiation monitors.

The off-gas post treatment monitors are connected in a 2-out-of-2 logic arrangement. Based on experience with instruments of similar design, a testing interval of once every three months has been found adequate.

The automatic pressure relief instrumentation can be considered to be a 1-out-of-2 logic system and the discussion above applies also.

The criteria for ensuring the reliability and accuracy of the radioactive gaseous effluent instrumentation is listed in Table 4.2.K.

The criteria for ensuring the reliability and accuracy of the radioactive liquid effluent instrumentation is listed in Table 4.2.D.

BFN 3.2/4.2-73 Unit 1

~ ~

PROPOSED TECHNICAL SPECIFICATION CHANGE BROVVNS FERRY NUCLEAR PLANT UNIT 2 (TVA BFNP TS 316)

~ ~

UNIT 2 EFFECTIVE PAGE LIST REMOVE INSERT 1.0-9 1.0-9 3.2/4.2-8 3.2/4.2-8 3.2/4.2-9 3.2/4.2-9 3.2/4.2-13 3.2/4.2-13 3.2/4.2-13a 3.2/4.2-13b 3.2/4.2-41 3.2/4.2-41 3.2/4.2-60 3.2/4.2-60 3.2/4.2-61 3.2/4.2-61 3.2/4.2-69 3.2/4.2-69 3.2/4.2-70 3.2/4.2-70 3.2/4.2-71 3.2/4.2-71 3.2/4.2-72 3.2/4.2-72 3.2/4.2-73 3.2/4.2-73 3.2/4.2-73a 3.2/4.2-73a

lc. ~Lo ic A. logic'is an arrangement of relays, contacts, and other components that produces a decision output.

and produces decision outputs to the actuation logic.

(b) Actuation A logic that. receives signals (either from initiation logic or channels) and produces decision outputs to accomplish a protective action.

Channel Calibration Shall be the adjustment, as necessary, of the channel output such that it responds with necessary range and accuracy to known values of the parameters which the channel monitors. The channel calibration shall encompass the entire channel including alarm and/or trip functions and shall include the channel functional test. The channel calibration may be performed by any series of sequential, overlapping or total channel steps such that the entire channel is calibrated. Non-calibratable components shall be excluded from this requirement, but will be included in channel functional test and source check.

12. Channel Functional Test Shall be:

a. Analog/Digital Channels the injection of a simulated signal into the channel as close to the sensor as practicable to verify OPERABILITY including alarm and/or trip functions.

b. Bistable Channels the injection of a simulated signal into the sensor to verify OPERABILITY including alarm and/or trip functions.

13. Source Check Shall be the qualitative assessment of channel response when the channel sensor is exposed to a radioactive source or multiple of sources.

BFN 1.0-9 Unit 2

TABLE 3.2.A (Continued)

PRIMARY CONTAINHENT AND REACTOR BUILDING ISOLATION INSTRUHENTATION Hinimum No.

Instrument Channels Operable PrTri 1 11 Fun ti n Tri L v 1 S tin A i n 1 R mark Instrument Channel 3 times normal rated l. Above trip setting High Radiation Main Steam full power background (13) initiates Hain Steam Line Line Tunnel (6) Isolation Instrument Channel- > 825 psig (4) 1. Below trip setting Low Pressure Hain Steam initiates Hain Steam Line Line Isolation (PIS-1-72, 76, 82, 86) 2(3) Instrument Channel < 1':OX of rated steam flow l. Above trip setting High Flow Hain Steam Line initiates Hain Stem (PdIS-1-13A-D, 25A-D, Line Isolation 36A-D, SOA-D) 2(12) Instrument Channel- < 200'F l. Above trip setting Hain Steam Line Tunnel initiates Hain Steam High Temperature Line Isolation.

1(14) Instrument Channel < 100 mr/hr or downscale l. 1 upscale channel or Reactor Building 2 downscale channels will

,Ventilation High a. Initiate SGTS Radiation Reactor Zone b. Isolate reactor zone and refueling floor.

c. Close atmosphere control system.

~ ~

TABLE 3.2.A (Continued)

PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Minimum No.

Instrument Channels Operable Fun i on Tri Lv 1 in Ac ion 1 R ark 1(14) Instrument Channel < 100 mr/hr or downscale F l. 1 upscale channel or Reactor Building 2 downscale channels will Ventilation High a. Initiate SGTS Radiation Refueling Zone b. Isolate refueling floor

c. Close atmosphere control system.

2(7) (8) Instrument Channel >2000 cfm and < 4000 cfm H and Below 2000 cfm airflow R.H.

SGTS Flow Train A (A or F) heaters shall be shut off.

R. H. Heaters 2(7) (8) Instrument Channel >2000 cfm and < 4000 cfm H and Below 2000 cfm airflow R.H.

SGTS Flow Train 8 (A or F) heaters shall be shut off.

R. H. Heaters 2(7) (8) Instrument Channel >2000 cfm and < 4000 cfm H and Below 2000 cfm airflow R.H.

SGTS Flow Train C (A or F) heaters shall be shut off.

R. H. Heaters Reactor Building Isolation 0 < t < 2 secs. HorF l. Below trip setting prevents Timer (refueling floor) spurious trips and system perturbations from initiating isolation.

Reactor Building Isolation 0 < t < 2 secs. GorA 1. Below trip setting prevents Timer (reactor zone) or H spurious trips and system perturbati ons from ini ti ating isolation.

2(10) Group 1 (Initiating) Logic N/A 1. Refer to Table 3.7.A for list of valves.

~ ~

I

~ 'TES FOR TABLE 2 A (Cont'd)

4. Only required in RUN MODE (interlocked with Mode Switch).

5. Deleted

6. "

Channel shared by RPS and Primary Containment Ec Reactor Vessel Isolation Control System. A channel failure may be a channel failure in each system.

7. A train is considered a trip system.

8. Two out of three SGTS trains required. A failure of more than one will require actions A and F.

9. Deleted

10. Refer to Table 3.7.A and its notes for a listing of Isolation Valve Groups and their initiating signals.

A channel may be placed in an inoperable status for up to four hours for required surveillance without placing the trip system in the tripped condition provided at least one OPERABLE channel in the same trip system is monitoring that parameter. For the Reactor Building Ventilation system, one channel may be inoperable for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance, as long as the downscale trip of the inoperable channel is placed in the tripped condition.

12. A channel contains four sensors, all of which must be OPERABLE for the channel to be OPERABLE.

Power operations permitted for up to 30 days with 15 of the 16 temperature switches OPERABLE.

In the event that normal ventilation is unavailable in the main steam line tunnel, the high temperature channels may be bypassed for a period of not to exceed four hours. During periods when normal ventilation is not available, such as during the performance of secondary containment leak rate tests, the control room indicators of the affected space temperatures shall be monitored for indications of small steam leaks. In the event of rapid increases in temperature (indicative of steam line break), the operator shall promptly close the main steam line isolation valves.

13. The nominal setpoints for alarm and reactor trip (1.5 and 3.0 times background, respectively) are established based on the normal background at full power. The allowable setpoints for alarm and reactor trip are 1.2-1.8 and 2.4-3.6 times background, respectively.

BFN 3.2/4.2-13 Unit 2

~ ~

OTES FOR TABLE 2 A (Cont'd)

14. There is a RBVRM trip function for the refueling zone and a RBVRM trip function for the reactor zone. Each trip function is composed of two divisional trip systems. Each trip system has one channel for each zone. Each channel contains two sensors, both of which must be OPERABLE for the channel to be OPERABLE. A channel downscale/inoperable trip occurs when either of the sensors are indicating less than the low radiation setpoint or are inoperable. A .channel upscale trip occurs when both of the sensors are indicating higher than the high radiation setpoint. Only one channel upscale trip is required for trip function initiation. Two channel downscale trips in a zone are required for trip function initiation.

BFN 3.2/4.2-13a Unit 2

~ ~

I ~ ~

THIS PAGE INTENTIONALLY.LEFT BLANK BFN 3.2/4.2-13b Unit 2

~ ~

TABLE 4.2.A (Cont'd)

SURVEILLANCE RE(}UIREHENTS FOR PRIHARY CONTAINHENT AND REACTOR BUILOING ISOLATION INSTRUHENTATION

~nnn ti n Fun i nal T st Calibra i n Fr u n In tr men heck Instrument Channel once/3 months (27) once/operating cycle None Hain Steam Line Tunnel High Temperature Instrument Channel (1) (32) once/18 months once/day (8)

Reactor Building Ventilation High Radiation - Reactor Zone Instrument Channel (1) (32) once/18 Honths once/day (8)

Reactor Building Ventilation High Radiation Refueling Zone Instrument Channel- (4) N/A SGTS Train A Heaters Instrument Channel- (4) N/A SGTS Train 8 Heaters Instrument Channel- (4) N/A ~

SGTS Train C Heaters Reactor Building Isolation (4) once/operating cycle N/A Timer (refueling floor)

Reactor Building Isolation (4) once/operating cycle N/A Timer (reactor zone)

NOTES FOR TABLES 4 2 A THROUGH 4 2 L exce t 4 2 D AND 4.2.K (Cont'd)

14. (Deleted)

15. The flow bias comparator will be tested by putting one flow unit in "Test" (producing 1/2 scram) and adjusting the test input to obtain comparator rod block. The flow bias upscale will be verified by observing a local upscale trip light during operation and verified that it will produce a rod block during the operating cycle.

16. Performed during operating cycle. Portions of the logic is checked more frequently during functional tests of the functions that produce a rod block.

17. This calibration consists of removing the function from service and performing an electronic calibration of the channel.

18. Functional test is limited to the condition where secondary containment integrity is not required as specified in Sections 3.7.C.2 and 3.7.C.3.

19. Functional test is limited to the time where the SGTS is required to meet.

the requirements of Section 4.7.C.l.a.

20. Calibration of the comparator requires the inputs from both recirculation loops to be interrupted, thereby removing the flow bias signal to the APRM and RBM and scramming the reactor. This calibration can only be performed during an outage.

21. Logic test is limited to the time where actual operation of the equipment is permissible.

22. (Deleted)

23. (Deleted)

24. This instrument check consists of comparing the thermocouple readings for all valves for consistence and for nominal expected values (not required during refueling outages).

25. During each refueling outage, all acoustic monitoring channels shall be calibrated. This calibration includes verification of accelerometer response due to mechanical excitation in the vicinity of the sensor.

BFN 3.2/4.2-60 Unit 2

~

'i ~

OTES FOR TABLES 4 2 A THROUGH 4 2 26.

L exce t 4 2 D AND 4 2 K (Cont'd)

This instrument check consists of comparing the background signal levels for all valves for consistency and for nominal expected values (not required during refueling outages).

27. Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify OPERABILITY of the trip and alarm functions.

28. Calibration consists of the adjustment of the primary sensor and associated components so that they correspond within acceptable range and accuracy to known values of the parameter which the channel monitors, including adjustment of the electronic trip circuitry, so that its output relay changes state at or more conservatively than the analog equivalent of the trip level setting. I

29. The functional test frequency decreased to once/3 months to reduce challenges to relief valves per NUREG-0737, Item II.K.3.16.

30. Calibration shall consist of an electronic calibration of the channel, not including the detector, for range decades above 10 R/hr and a one-point source check of the detector below 10 R/hr with an installed or portable gamma source.

31. Functional Tests shall be performed once/3months.

32. Functional testing for the Reactor Building Ventilation Radiation Monitoring System (RBVRMS) shall consist of verifying the High Voltage Power Supply (HVPS) voltage at the Sensor and Convertors (detectors) is within its design limits. A channel functional test as defined in Section 1.0, "Definitions" shall be performed once per 18 months as part of the RBVRM channel .calibration.

BFN 3.2/4.2-61 Unit 2

~2 BASES (Cont'd) adequate to assure the above criteria are met. The specification preserves the effectiveness of the system during periods of maintenance, testing, or calibration, and also minimizes the risk of inadvertent operation; i.e., only one instrument channel out of service.

Two post treatment off-gas radiation monitors are provided and, when their trip point is reached, cause an isolation of the off-gas line. orIsolation is initiated when both instruments reach their high trip point one has an upscale trip and the other a downscale trip or both have a downscale trip.

Both instruments are required for trip but the instruments are set so that the instantaneous stack release rate limit given in Specification 3.8 is not exceeded.

Two radiation monitors are provided for each unit which initiate Primary Containment Isolation (Group 6 isolation valves) Reactor Building Isolation and operation of the Standby Gas Treatment System. These instrument channels monitor the radiation in the reactor zone ventilation, exhaust ducts and in the refueling zone.

Trip setting of 100 mr/hr for the monitors in the refueling zone are based upon initiating normal ventilation isolation and SGTS operation so that none of the activity released during the refueling accident leaves the Reactor Building via the normal ventilation path but rather all the activity is processed by the SGTS.

The allowed inoperable time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance (with the downscale trip of the inoperable channel in the tripped condition) of the Reactor Building Ventilation system is based upon a Probabilistic Risk Assessment (PRA). The assessment considered the failures, relay failures and the probability of an accident occurring for which the RBVRMs are required to operate.

Flow integrators and sump fill rate and pump out rate timers are used to determine leakage in the drywell. A system whereby the time interval to fill a known volume will be utilized to provide a backup.

system is also provided to detect leakage inside the An air sampling primary containment (See Table 3.2.E).

For each parameter monitored, as listed in Table 3.2.F, there are two channels of instrumentation except as noted. By comparing readings between the two channels, a near continuous surveillance of instrument performance is available. Any deviation in readings will initiate an early recalibration, thereby maintaining the quality of the instrument readings.

BFN 3.2/4.2-69 Unit 2

3.2 ~BAS S (Cont'd)

Instrumentation is= provided for isolating the control room and initiating a pressurizing system that processes outside air before supplying it to the control room. An accident signal that isolates primary containment will also automatically isolate the control room and initiate the emergency pressurization system. In addition, there are radiation monitors in the normal ventilation system that will isolate the control room and initiate the emergency pressurization system. Activity required to cause automatic actuation is about one mRem/hr.

Because of the constant surveillance and control exercised by TVA over the Tennessee Valley, flood levels of large magnitudes can be predicted in advance of their actual occurrence. In all cases, full advantage will be taken of advance warning to take appropriate action whenever reservoir levels above normal pool are predicted. Therefore, during flood conditions, the plant will be permitted to operate until water begins to run across the top of the pumping station at elevation 565. Seismically qualified, redundant level switches'each powered from a separate division of power are provided at the pumping station to give main control room indication of this condition. At that time an orderly shutdown of the plant will be initiated, although surges even to a depth of several feet

"'over"the- pumping station deck will not cause the loss of the main condenser circulating water pumps.

The OPERABILITY of the meteorological instrumentation ensures that sufficient meteorological data is available for estimating potential radiation dose to the public as a result of routine or accidental release of radioactive materials to the atmosphere. This capability is required to evaluate the need for initiating protective measures to protect the health and safety of the public.

The OPERABILITY of the seismic instrumentation ensures that sufficient capability is available to promptly determine the seismic response of those features important to safety. This capability is required to permit comparison of the measured response to that used in the design basis for Browns Ferry Nuclear Plant and to determine whether the plant can continue to be operated safely. The instrumentation provided is consistent with specific portions of the recommendations of Regulatory Guide 1.12 "Instrumentation for Earthquakes."

The radioactive gaseous effluent instrumentation is provided to monitor and control, as applicable, the releases of radioactive materials in gaseous effluents during actual or potential releases of gaseous effluents. The alarm/trip setpoints for these instruments will be calculated in accordance with guidance provided in the ODCN to ensure that the alarm/trip will occur prior to exceeding the limits of 10 CFR Part 20. This instrumentation also includes provisions for monitoring the concentration of potentially explosive gas mixtures in the off-gas holdup system. The OPERABILITY and use of this instrumentation is consistent with the requirements of General Design Criteria 60, 63, and 64 of Appendix A to 10 CFR Part 50.

BFH 3.2/4.2-70 [

Unit 2

~

r 4a s

3~ BASES (Cont'd)

The radioactivd liquid effluent instrumentation is provided to monitor and control, as applicable, the releases of radioactive materials in liquid effluents during actual or potential releases of liquid effluents. The alarm/trip setpoints for these instruments shall be calculated in accordance with guidance provided in the ODCM to ensure that the alarm/trip will occur prior to exceeding the limits of 10 CFR Part 20 Appendix B, Table II, Column 2. .The OPERABILITY and use of this instrumentation is consistent with the requirements of General Design Criteria 60, 63, and 64 of Appendix A to 10 CFR Part 50.

ATWS/RPT, Anticipated Transients without Scram/Recirculation Pump Trip system provides a means of limiting the consequences of the unlikely occurrence of a failure to scram during an ATWS event. The response of the plant to this postulated event (ATWS/RPT) follows the BWR Owners Group Report by General Electric NEDE-31096-P-A and the accompanying NRC Staff Safety Evaluation Report.

ATWS/RPT utilizes the engineered safety feature (ESF) master/slave analog trip units (ATU) which consists of four level and four pressuresystems channels total. The initiating logic consists of two independent trip each consisting of two reactor dome high pressure channels and two reactor vessel low level channels. A coincident trip of either two low levels or two high pressures in the same trip system causes initiation of ATWS/RPT. This signal from either trip system opens one of two EOC (end-of-cycle) breakers in series (the other system opens the other breaker) between the pump motor and the Motor Generator set driving each recirculation pump. Both systems are completely redundant such that only one trip system is necessary to perform the ATWS/RPT function. Power comes from the 250 VDC shutdown boards.

Setpoints for reactor dome high pressure and reactor vessel low level are such that a normal Reactor Protection System scram and accompanying recirculation pump trip would occur before or coincident with the trip by ATWS/RPT.

4.2 BASES The instrumentation listed in Tables 4.2.A through 4.2.F will be functionally tested and calibrated at regularly scheduled intervals. The same design reliability goal as the Reactor Protection System of 0.99999 generally applies for all applications of (1-out-of-2) X (2) logic.

Therefore, on-off sensors are tested once/3 months, and bistable trips associated with analog sensors and amplifiers are tested once/week.

BFN 3.2/4.2-71 Unit 2

~

) I

~

4.2 BASES (Cont'd)

Those instruments which, when tripped, result in a rod block have their contacts arranged in a 1-out-of-n logic, and all are capable of being bypassed. For such a tripping arrangement with bypass capability provided, there is an optimum test interval that should be maintained in order to maximize the reliability of a given channel (7). This takes account of the fact that testing degrades reliability and the optimum interval between tests is approximately given by:

Where: i= the optimum interval between tests.

t = the time the trip contacts are disabled from performing their function while the test is in progress.

r = the expected failure rate of the relays.

To test the trip relays requires that the channel be bypassed, the test made, and the system returned to its initial state. It is assumed this task requires an estimated 30 minutes to complete in a thorough and workmanlike manner and that the relays have a failure rate of 10 failures per hour. Using this data and the above operation, the optimum test interval is:

~20. 5

= lxlo3 10

= 40 days For additional mar in a test interval of once er month will be used initiall The sensors and electronic apparatus have not been included here as these are analog devices with readouts in the control room and the sensors and electronic apparatus can be checked by comparison with other like instruments. The checks which are made on a daily basis are adequate to

-.assure,.OPERABILITY of the sensors and electronic apparatus, and the test interval given above provides for optimum testing of the relay circuits.

The above calculated test interval optimizes each individual channel, considering it to be independent of all others. As an example, assume that there are two channels with an individual technician assigned to each. Each technician tests his channel at the optimum frequency, but the two technicians are not allowed to communicate so that one can advise the other that his channel is under test. Under these conditions, it is possible for both channels to be under test simultaneously. Now, assume that the technicians are required to communicate and that two channels- are never tested at the same time.

BFN 3.2/4.2-72 Unit 2

I

~

)

4.2 BASES (Cont'd)

(7) UCRL-50451, Improving Availability and Readiness of Field Equipment Through Periodic Inspection, Be+amin Epstein, Albert Shiff, July 16, 1968, page 10, Equation (24), Lawrence Radiation Laboratory.

Forbidding simultaneous testing improves the availability of the system over that which would be achieved by testing each channel independently.

These one-out-of-n trip systems will be tested one at a time in order to take advantage of this inherent improvement in availability.

Optimizing each channel independently may not truly optimize the system considering the overall rules of system operation. However, true system optimization is a complex problem. The optimums are broad, not sharp, and optimizing the individual channels is generally adequate for the system.

The formula given above minimizes the unavailability of a single channel which must be bypassed during testing. The minimization of the unavailability is illustrated by Curve No. 1 of Figure 4.2-1 which assumes that a channel has a failure rate of O.l x 10 /hour and 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is required to test it. The unavailability is a minimum at a test interval i, of 3.16 x 10 hours.

If two similar channels are used in a 1-out-of-2 configuration, the test interval for minimum unavailability changes as a function of the rules for testing. The simplest case is to test each one independent of the other.

In this case, there is assumed to be a finite probability that both may be bypassed at one time. This case is shown by Curve No. 2. Note that the unavailability is lower as expected for a redundant system and the minimum occurs at the same test interval. Thus, if the two channels are tested independently, the equation above yields the test interval for minimum unavailability.

A more usual case is that the testing is not done independently. If both channels are bypassed and tested at the same time, the result is shown in Curve No. 3. Note that the minimum occurs at about 40,000 hours, much longer than for cases 1 and 2. Also, the minimum is not nearly as low as Case 2 which indicates that this method of testing does not take full advantage of the redundant channel. Bypassing both channels for simultaneous testing should be avoided.

The most likely case would be to stipulate that one channel be bypassed, tested, and restored, and then immediately following, the second channel be bypassed, tested, and restored. This is shown by Curve No. 4. Note that there is no true minimum. The curve does have a definite knee and very little reduction in system unavailability is achieved by testing at a shorter interval than computed by the equation for a single channel.

BFN 3.2/4.2-73 Unit 2

4.2 BASES (Cont'd)

The best test procedure of all those examined is to perfectly stagger the tests. That is, if the test interval is four months, test one or the other channel every two months. This is shown in Curve No. 5. The difference between Cases 4 and 5 is negligible. There may be other arguments, however, that more strongly support the perfectly staggered tests, including reductions in human error.

The conclusions to be drawn are these:

1. A 1-out-of-n system may be treated the same as a single channel in terms of choosing a test interval; and

2. more than one channel should not be bypassed for testing at any one time.

The radiation monitors in the reactor and refueling zones which initiate building isolation and standby gas treatment operation are arranged such that two sensors high (above the high level setpoint) in a single channel or one sensor downscale (below low level setpoint) or inop in two channels, in the same zone will initiate a trip function. The functional testing frequency is based on a Probabilistic Risk Assessment and system drift characteristics of the Reactor Building Ventilation Radiation Monitors.

The calibration frequency is based upon the drift of the radiation monitors.

The off-gas post treatment monitors are connected in a 2-out-of-2 logic arrangement. Based on experience with instruments of similar design, a testing interval of once every three months has been found adequate.

The automatic pressure relief instrumentation can be considered to be a 1-out-of-2 logic system and the discussion above applies also.

The criteria for ensuring the reliability and accuracy of the radioactive gaseous effluent instrumentation is listed in Table 4.2.K.

The criteria for ensuring the reliability and accuracy of the radioactive liquid effluent instrumentation is listed in Table 4.2.D.

BFN 3.2/4.2-73a Unit 2

PROPOSED TECHNICAL SPECIFICATION CHANGE BROWNS FERRY NUCLEAR PLANT UNIT 3 (TVA BFNP TS 316)

UNIT 3 EFFECTIVE PAGE LIST REMOVE INSERT 1.0-9 1.0-9 3.2/4.2-8 3.2/4.2-8 3.2/4.2-9 3.2/4.2-9 3.2/4.2-13 3.2/4.2-13 3.2/4.2-13a 3.2/4.2-13b 3.2/4.2-40 3.2/4.2-40 3.2/4.2-59 3.2/4.2-59 3.2/4.2-60 3.2/4.2-60 3.2/4.2-67 3.2/4.2-67 3.2/4.2-68 3.2/4.2-68 3.2/4.2-72 3.2/4.2-72

1.0

~('0.

~

~Lo ic A logic is an arrangement of relays, contacts, and other components that produces a decision output.

(a) Initiatin A logic that receives signals from channels and produces decision outputs to the actuation logic.

(b) Actuation A logic that .receives signals (either from initiation logic or channels) and produces decision outputs to accomplish a protective action.

Channel Calibration Shall be the adjustment, as necessary, of the channel output such that it responds with necessary range and accuracy to known values of the parameters which the channel monitors. The channel calibration shall encompass the entire channel including alarm and/or trip functions and shall include the channel functional test. The channel calibration may be performed by any series of sequential, overlapping or total channel steps such that the entire channel is calibrated. Non-calibratable components shall be excluded from .

this requirement, but will be included in channel functional test and source check.

12. Channel Functional Test Shall be:

a. Analog/Digital Channels the injection of a simulated signal into the channel as close to the sensor as practicable to verify OPERABILITY including alarm and/or trip functions.

b. Bistable Channels the injection of a simulated signal into the sensor to verify OPERABILITY including alarm and/or trip functions.

13. Source Check Shall be the qualitative assessment of channel response when the channel sensor is exposed to a radioactive source or multiple of sources.

BFN 1.0-9 Unit 3

TABLE 3.2.A (Continued)

PRIHARY CONTAINHENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION Hinimum No.

Instrument Channels Operable Pr Tri Ss 1 11 Fn in Tri L v 1 t in A i n 1 R m rk Instrument Channel 3 times normal rated l. Above trip setting High Radiation Hain Steam full power background (13) initiates Hain Steam Line Line Tunnel (6) Isolation Instrument Channel- > 825 psig (4) l. Below trip setting Low Pressure Hain Steam initiates Hain Steam Line Line Isolation 2(3) Instrument Channel < 140K of rated steam flow 1. Above trip setting High Flow Hain Steam Line initiates Hain Steam Line Isolation 2(12) Instrument Channel < 200'F l. Above trip setting Hain Steam Line Tunnel initiates Hain Steam High Temperature Line Isolation.

2(14) Instrument Channel 160 180'F C l. Above trip setting Reactor Mater Cleanup initiates Isolation System Floor Drain of Reactor Mater High Temperature Cleanup Line from Reactor and Reactor Mater Return Line.

Instrument Channel 160 - 1800F 1. Same as above Reactor Water Cleanup System Space High Temperature 1(15) Instrument Channel- < 100 mr/hr or downscale l. 1 upscale channel or Reactor Building 2 downscale channels will Ventilation High a. Initiate SGTS Radiation Reactor Zone b. Isolate reactor zone and refueling floor.

c. Close atmosphere control system.

TABLE 3.2.A (Continued)

PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUHENTATION Minimum No.

Instrument Channels Operable er Tri 1 11 Fun ti n Tri Lv 1 e in Ac ion 1 R ark 1(15) Instrument Channel < 100 mr/hr or downscale F 1. 1 upscale channel or Reactor Building 2 downscale channels will Ventilation High a. Initiate SGTS Radiation - Refueling Zone b. Isolate refueling floor

c. Close atmosphere control system.

2(7) (B) Instrument Channel >2000 cfm and < 4000 cfm H and Below 2000 cfm airflow R.H.

SGTS Flow Train A (A or F) heaters shall be shut off.

R. H. Heaters 2(7) (B) Instrument Channel >2000 cfm and < 4000 cfm H and Below 2000 cfm airflow R.H.

SGTS Flow - Train B (A or F) heaters shall be shut off.

R. H. Heaters 2(7) (B) Instrument Channel >2000 cfm and < 4000 cfm H and Below 2000 cfm airflow R.H.

SGTS Flow Train C (A or F) heaters shall be shut off.

R. H. Heaters Reactor Building Isolation 0 < t < 2 secs. HorF 1. Below trip setting prevents Timer (refueling floor) spurious trips and system perturbations from initiating isolation.

Reactor Building Isolation 0 < t < 2 secs. GorA 1. Below trip setting prevents Timer (reactor zone) or H spurious trips and system perturbations from initiating isolation.

2(10) Group 1 (Initiating) Logic N/A 1. Refer to Table 3.7.A for list of valves.

OTES FOR TABLE 2 A (Cont'd) 4~ Only required in RUN MODE (interlocked with Mode Switch).

5. Deleted

6. Channel shared by RPS and Primary Containment 6 Reactor Vessel Isolation Control System. A channel failure may be a channel failure in each system.

7 ~ A train is considered a trip system.

8. Two out of three SGTS trains required. A failure of more than one will require actions A and F.

9. Deleted

10. Refer'o Table 3.7.A and its notes for a listing of Isolation Valve Groups and their initiating signals.

A channel may be placed in an inoperable status for up to four hours for required surveillance without placing the trip system in the tripped condition provided at least one OPERABLE channel in the same trip system is monitoring that parameter. For the Reactor Building Ventilation system, one channel may be inoperable for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance, as long as the downscale trip of the inoperable channel is placed in the tripped condition.

12. A channel contains four sensors, all of which must be OPERABLE for the channel to be OPERABLE.

Power operations permitted for up to 30 days with 15 of the 16 temperature switches OPERABLE.

In the event that normal ventilation is unavailable in the main steam line tunnel, the high temperature channels may be bypassed for a period of not to exceed four hours. During periods when normal ventilation is not available, such as during the performance of secondary containment leak rate tests, the control room indicators of the affected space temperatures shall be monitored for indications of small steam leaks. In the event of rapid increases in temperature (indicative of steam line break), the operator shall promptly close the main steam line isolation valves.

13. The nominal setpoints for alarm and reactor trip (1.5 and 3.0 times background, respectively) are established based on the normal background at full power. The allowable setpoints for alarm and reactor trip are 1.2-1.8 and 2.4-3.6 times background, respectively.

BFN 3.2/4.2-13 Unit 3

0 NOTES FOR TABLE 2 A (Cont'd)

14. Requires two independent channels from each physical location; there are two locations.

15. There is a RBVRM trip function for the refueling zone and a RBVRM trip function for the reactor zone. Each trip function is composed of two divisional trip systems. Each trip system has one channel for each zone. Each channel contains two sensors, both of which must be OPERABLE for the channel to be OPERABLE. A channel downscale/inoperable trip occurs when either of the sensors are indicating less than the low radiation setpoint or are inoperable. A channel upscale trip occurs when both of the sensors are indicating higher than the high radiation setpoint. Only one channel upscale trip is required for trip function initiation. Two channel downscale trips in a zone are required for trip function initiation.

BFN 3.2/4.2-13a Unit 3

THIS PAGE INTENTIONALLYLEFT BLANK BFN 3.2/4.2-13b Unit 3

TABLE 4.2.A SURVEILLANCE REgUIREHENTS FOR PRIHARY CONTAINNENT AND REACTOR BUILOING ISOLATION INSTRUHENTATION

~Fnr~in F n i nal T s alibra i n Fr u n In r ment h k Instrument Channel- once/3 months (27) once/operating cycle None Hain Steam Line Tunnel High Temperature Instrument Channel (1) (3O) once/18 months once/day (8)

Reactor Building Ventilation High Radiation Reactor Zone Instrument Channel (1) (3O) once/18 Honths once/day (8)

Reactor Building Ventilation High Radiation Refueling Zone Instrument Channel- (4) N/A SGTS Train A Heaters Instrument Channel- (4) N/A SGTS Train 8 Heaters Instrument Channel- (4) N/A ~

SGTS Train C Heaters Reactor Bui1 ding Is ol ati on (4) once/operating cycle N/A Timer (refueling floor)

Reactor Building Isolation (4) once/operating cycle N/A Timer (reactor zone)

OTES FOR TABLES 4.2 A THROUGH 4.2.L exce t 4 2 D A 4 2 (Cont'd)

14. (Deleted)

15. The flow bias comparator will be tested by putting one flow unit in "Test" (producing 1/2 scram) and adjusting the test input to obtain comparator rod block. The flow bias upscale will be verified by observing a local upscale trip light during operation and verified that it will produce a rod block during the operating cycle.

16. Performed during operating cycle. Portions of the logic is checked more frequently during functional tests of the functions that produce a rod block.

17. This calibration consists of removing the function from service and performing an electronic calibration of the channel.

18. Functional test is limited to the condition where secondary containment integrity is not required as specified in Sections 3.7.C.2 and 3.7.C.3.

19. Functional test is limited to the time where the SGTS is required to meet the requirements of Section 4.7.C.l.a.

20. Calibration of the comparator requires the inputs from both recirculation loops to be interrupted, thereby removing the flow bias signal to the APRM and RBM and scramming the reactor. This calibration can only be performed during an outage.

21. Logic test is limited to the time where actual operation of the equipment is permissible.

22. (Deleted)

23. (Deleted)

24. This instrument check consists of comparing the thermocouple readings for all valves for consistence and for nominal expected values (not required during refueling outages).

25. During each refueling outage, all acoustic monitoring channels shall be calibrated. This calibration includes verification of accelerometer response due to mechanical excitation in the vicinity of the sensor.

BFN 3.2/4.2-59 Unit 3

OTES FOR TABLES 4 2 A THROUGH 4.2.L exce t 4 2 D AND 4 2 K (Cont'd)

26. This instrument, check consists of comparing the background signal levels for all valves for consistency and for nominal expected values (not required during refueling outages).

27. Functional test frequency decreased to once/3 months to reduce the challenges to relief valves per NUREG-0737, Item II.K.3.16.

28. Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify OPERABILITY of the trip and alarm functions.

29. Calibration consists of the adjustment of the primary sensor and associated components so that they correspond within acceptable range and accuracy to known values of the parameter which the channel monitors, including adjustment of the electronic trip circuitry, so its output relay changes state at or more conservatively than the analog equivalent of the trip level setting.

30. Functional testing for the Reactor Building Ventilation Radiation Monitoring System (RBVRMS) shall consist of verifying the High Voltage Power Supply (HVPS) voltage at the Sensor and Convertors (detectors) is within its design limits. A channel functional test as defined in Section 1.0, "Definitions" shall be performed once per 18 months as part of the RBVRM channel calibration.

BFN 3.2/4.2-60 Unit 3

3.2 BASES (Cont'd)

The APRM rod block function is flow biased and prevents a significant reduction in MCPR, especially during operation at reduced flow. The APRM provides gross core protection; i.e., limits the gross core power increase from withdrawal of control rods in the normal withdrawal sequence. The trips are set so that MCPR is maintained greater than 1.07.

The RBM rod block function provides 1ocal protection .of the core; i.e.,

the prevention of critical power in a local region of the core, for a single rod withdrawal error from a limiting control rod pattern.

If the IRM channels are in the worst condition of allowed bypass, the sealing arrangement is such that for unbypassed IRM channels, a rod block signal is generated before the detected neutrons flux has increased by more than a factor of 10.

A downscale indication is an indication the instrument has failed or the instrument is not sensitive enough." In either case the instrument will not respond to changes in control rod motion and thus, control rod motion is prevented.

The refueling interlocks also operate one logic channel, and are required for safety only when the mode switch is in the refueling position.

For effective emergency core cooling for small pipe breaks, the HPCI system must function since reactor pressure does not decrease rapid enough to allow either core spray or LPCI to operate in time. The automatic pressure relief function is provided as a backup to the HPCI in the event the HPCI does not operate. The arrangement of the tripping contacts is such as to provide this function when necessary and minimize spurious operation. The trip settings given in the specification are adequate to assure the above criteria are met. The specification preserves the effectiveness of the system during periods of maintenance, testing, or calibration, and also minimizes the risk of inadvertent operation; i.e., only one instrument channel out of service.

Two post" treatment off-gas radiation monitors are provided and, when their trip point is reached, cause an isolation of the off-gas line.

Isolation is initiated when both instruments reach their high trip point or one has an upscale trip and the other a downscale trip or both have a downscale trip.

Both instruments are required for trip but the instruments are set so that the instantaneous stack release rate limit given in Specification 3.8 is not exceeded.

Two radiation monitors are provided for each unit which initiate Primary Containment Isolation (Group 6 isolation valves) Reactor Building Isolation and operation of the Standby Gas Treatment System. These instrument channels monitor the radiation in the reactor zone ventilation exhaust ducts and in the refueling zone.

BFN 3.2/4.2-67 Unit 3

0

3.2 BASES (Cont'd)

Trip setting of 100 mr/hr for the monitors in the refueling zone are based upon initiating normal ventilation isolation and SGTS operation so that none of the activity released during the 'refueling accident leaves the Reactor Building via the normal ventilation path but rather all the activity is processed by the SGTS.

The allowed inoperable time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance (with the downscale trip of the inoperable channel in the tripped condition) of the Reactor Building Ventilation system is based upon a Probabilistic Risk Assessment (PRA).

The assessment considered the failures, relay failures and the probability of an accident occurring for which the RBVRMs are required to operate.

Flow integrators and sump fill rate and pump out rate timers are used to A system whereby the time interval to determine leakage in the drywell.

fill a known volume will be utilized to provide a backup.

sampling system is also provided to detect leakage inside An air the primary containment (See Table 3.2.E).

For'ach parameter monitored, as listed in Table 3.2.F, there are two channels of instrumentation except as noted. By comparing readings between the two channels, a near continuous surveillance of instrument performance is available. Any deviation in readings will initiate an early recalibration, thereby maintaining the quality of the instrument readings.

Instrumentation is provided for isolating the control room and initiating a pressurizing system that processes outside air before supplying it to the control room. An accident signal that isolates primary containment will also automatically isolate the control room and initiate the emergency pressurization system. In addition, there are radiation monitors in the normal ventilation system that will isolate the control room and initiate the emergency pressurization system. Activity required to cause automatic actuation is about one mRem/hr.

Because of the constant surveillance and control exercised by TVA over the Tennessee Valley, flood levels of large magnitudes can be predicted in advance of their actual occurrence. In all cases, full advantage will be taken of advance warning to take appropriate action whenever reservoir levels above normal pool are predicted. Therefore, during flood conditions, the plant will be permitted to operate until water begins to run across the top of the pumping station at elevation 565. Seismically qualified, redundant level switches each powered from a separate division of power are provided at the pumping station to give main control room indication of this condition. At that time an orderly shutdown of the plant will be initiated, although surges even to a depth of several feet over the pumping station deck will not cause the loss of the main condenser circulating water pumps.

BFN 3.2/4.2-68 Unit 3

~ 4.2 BASES (Cont'd)

The conclusions to.be drawn are these:

l. A l-out-of-n system may be treated the same as a single channel in terms of choosing a test interval; and

2. more than one channel should not be bypassed for testing at any one time.

The radiation monitors in the reactor and refueling zones which initiate building isolation and standby-gas treatment operation are arranged such that two sensors high (above the high level setpoint) in a single channel or one sensor downscale (below low level setpoint) or inop in two channels in the same zone will initiate a trip function. The functional testing frequency is based on a Probabilistic Risk Assessment and system drift characteristics of the Reactor Building Ventilation Radiation Monitors. The calibration frequency is based upon the drift of the radiation monitors.

The off-gas post treatment monitors are connected in a 2-out-of-2 logic arrangement. Based on experience with instruments of similar design, a testing interval of once every three months has been found adequate.

The automatic pressure relief instrumentation can be considered to be a l-out-of-2 logic system and the discussion above applies also.

The criteria for ensuring the reliability and accuracy of the radioactive gaseous effluent instrumentation is listed in Table 4.2.K.

The criteria for ensuring the reliability and accuracy of the radioactive liquid effluent instrumentation is listed in Table 4.2.D.

BFN 3.2/4.2-72 Unit 3

ENCLOSURE 2 DESCRIPTION AND iXUSTIFICATION BROWNS FERRY NUCLEAR PLANT (BFN)

REASON FOR CHANGE The proposed changes to the technical specifications are being made to reflect changes introduced by the implementation of design change W11179 which removes the existing analog Refuel Zone and Reactor Building Ventilation Radiation Monitoring (RBVRM) systems and replaces them with digital equipment that is manufactured by General Electric (GE). The digital equipment is part of the GE Nuclear Measurement Analysis and Control (NUMAC) line of equipment. The RBVRM is a subsystem of the Radiation Monitoring System (System 90), and provides logic signals for the initiation of Primary Containment Isolation System (PCIS Group 6), Standby Gas Treatment, and the Control Room Emergency Ventilation System.

This modification will also reduce the number of RBVRMS spurious trips attributed to noise signals and equipment failure. Human error in maintenance and testing of the RBVRMS will be reduced through longer calibration intervals, the use of digital display menu driven software, and a simpler front panel design which incorporates human factor guidelines. The NUMAC RBVRMS provides improved noise immunity, accuracy, resolution, and instrument drift rates over the presently installed instrumentation.

DESCRIPTION OF THE PROPOSED CHANGE Note: Changes apply to all units unless specified otherwise.

Existin TS The existing TS Section 1.0, DEFINITIONS, page 1.0-9, definition 12.a., states:

"12. Channel Functional Test -Shall be:

a. Analog Channels the injection of a simulated signal into the channel as close to the sensor as practicable to verify OPERABILITY including alarm and/or trip functions."

I lkll l4 W%, 5 4, J .~ Jl, ~ 8 8~ H ~ J ~ . l l~Ai

ENCLOSURE 2 Continued Pro osed TS Chan e The proposed TS change will revise definition 12.a. to read:

"12. Channel Functional Test Shall be:

a. Analog/Digital Channels JUSTIFICATION FOR THE PROPOSED CHANGE The modification involves both the conversion of the present analog system to a digital-microprocessor based system and the introduction of additional sensors on each instrumentation loop.

The upgrade from analog to digital devices improves such system

...parameters-as..channel accuracy, drift and loop calibration. The means of testing a digital channel is no different from the means of testing an analog channel. The only difference is in the way the data from the sensor is transmitted. This change to the system parameters, therefore, does not decrease nuclear safety.

2. The e xisting TS Table 3.2.A., PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION, under column "Minimum No. Instrument Channels Operable Per Trip Sys (1)

(11), last entry, page 3.2/4.2-8 states: "1". Also, under the "Remarks" column, last entry, page 3.2/4.2-8 states:

"1. 1 upscale or 2 downscale will Pro osed TS Chan e The proposed TS change will revise the "1" entry by adding "(14)"

to Unit 2 and "(15)" to Units 1 and 3 as a note reference. Also, the "Remarks" column, last entry will be revised to read:

"1. 1 upscale channel or 2 downscale channels will

E

~

y <i or < 'Lt Ae) ~

~ ~cp

ENCLOSURE 2 Continued JUSTIFICATION FOR THE PROPOSED CHANGE By adding a new note (14 for Unit 2 and 15 for Units 1 and 3) which explains the effect on the logic operation of the new sensor configuration, the upscale instrument trip setpoints will not change. The technical specification limit (100 mR/hr) will not change. Nuclear safety vill therefore not be decreased.

Also, the addition of the words "channel" and "channels" under the last entry for the "Remarks" column will clarify the trips.

Existin TS

...3....,.The -existing,TS Table 3.2.A., PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION, under column "Minimum No. Instrument Channels Operable Per Trip Sys (1)

(11), first entry, page 3.2/4.2-9 states:"1(9)". Also, t

under the "Remarks" column, first entry, page 3.2/4.2-9 states:

"1. 1 upscale or 2 downscale will Pro osed TS Chan e The proposed TS change will revise the "1(9)" entry by deleting the (9) note and adding the "(14)" as a note reference to Unit 2 and "(15)" as a note reference to Units 1 and 3. Also, the "Remarks" column, first entry vill be

. revised to read:

"1. 1 upscale channel or 2 downscale channels will JUSTIFICATION FOR THE PROPOSED CHANGE By adding a new note (14 for Unit 2 and 15 for Units 1 and 3) which explains the effect on the logic operation of the new sensor configuration, the upscale instrument trip setpoints will not change. The technical specification limit (100 mR/hr) vill not change. Nuclear safety will therefore not be decreased.

Also, the addition of the words "channel" and "channels" under the last entry for the "Remarks" column will clarify the trips.

t 0

C .I ~C~ y

ENCLOSURE 2 Continued Existin TS

4. The existing TS NOTES FOR TABLE 3.2.A note number 11, page 3.2/4.2-13 states:

A channel may be placed in an inoperable status for up to four hours for required surveillance without placing the trip system in the tripped condition provided at least one OPERABLE channel in the same trip system is monitoring that parameter."

Pro osed TS Chan e The proposed TS change will revise Note 11 to read:

A channel may be placed in an inoperable status for up to four hours for required surveillance without placing the trip system in the tripped condition provided at least one OPERABLE channel in the same trip system is monitoring that parameter. For the Reactor Building Ventilation system, one channel may be inoperable for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance, as long as the downscale trip of the inoperable channel is placed in the tripped condition."

JUSTIFICATION FOR THE PROPOSED CHANGE

....... The allowed..Reactor Building Ventilation system inoperative times of 4 hours for functional testing or for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for calibration and maintenance, as long as the downscale trip of the inoperative channel is placed in the tripped condition, is based upon a Probabilistic Risk Assessment (PRA). The PRA considered the NUMAC failures, relay failures and the probability of an accident occurring for which the NUMAC RBVRMs are required to operate.

~ ~

~ '\

1" $ , a Ar'~

0

ENCLOSURE 2 Conti ued Pro osed TS Chan e

5. The proposed change will add Note 14 for Unit 2 and Note 15 for Units 1 and. 3 to the "NOTES FOR TABLE 3.2.A" on page 3.2/4.2-13.

The proposed Note 14 for Unit 2 and Note 15 for Units 1 and 3 will read:

"There is a RBVRM trip function for the refueling zone and a RBVRM trip function for the reactor zone. Each trip function is composed of two divisional trip systems. Each trip system has one channel for each zone. Each channel contains two sensors, both of which must be operable for the channel to be operable. -A.channel downscale/inoperable trip occurs when either of the sensors are indicating less than the low radiation setpoint or are inoperable. A channel upscale trip occurs when both of the sensors are indicating higher than t

the high radiation setpoint. Only one channel upscale trip is required for trip function initiation. Two channel downscale trips in a zone are required for trip function initiation."

JUSTIFICATION FOR THE PROPOSED CHANGE DCN W11179 doubled the number of detectors changing the system configuration. Note 15 for Units 1 and 3 and note 14 for Unit 2 were added to explain the impact to the- logic operation of the new system configuration.

Existin TS

6. The existing TS Table 4.2.A., SURVEILLANCE REQUIREMENTS FOR PRIMARY CONTAINMENT AND REACTOR BUILDING ISOLATION INSTRUMENTATION, under column "Functional Test" second and third entries, page.2/4.2-41 for Units 1 and 2, and page 3.2/4.2-40 for Unit 3 states: "(1) (22)".

Also, under column "Calibration Fre uenc ", second and third entries, page 3.2/4.2-41 for Units 1 and 2, and page 3.2/4.2-40 for Unit 3 states: "once/3 months".

l

'I 'I p%1 I

s 0

~

~

ENCLOSURE 2 Continued Pro osed TS Chan e The proposed TS change will revise the "(1) (22)" entries by deleting the "(22)" and adding Note 31 for Unit 1, Note 32 for Unit 2, and Note 30 for Unit 3.

Also, the "Calibration Fre uenc " column entries will be revised to delete the "3 months" and add "18 months".

JUSTIFICATION FOR THE PROPOSED CHANGE Note 22 was deleted because this note repeated the allowed out of service times for calibrating maintenance and functional testing.

These times are now more appropriately listed in Table 3.2.A.

Note 11.

The change in calibration frequency to once per 18 months is based upon calculation of the RBVRM drift for this period, given the requirement that the HVPS voltage be verified once per month.

The calculation has determined that the NUMAC RBVRM setpoint will not exceed the allowable value of 100 mR/hr during the period of one operating cycle.

Existin TS

7. The existing TS NOTES FOR TABLES 4.2.A THROUGH 4.2.L exce t 4.2.D AND 4.2.K, Note 22, page 3.2/4.2-60 for Units 1 and 2; and, page 3.2/4.2-59 for Unit 3 states:

"22.;,. One channel of either the reactor zone or refueling zone Reactor Building Ventilation Radiation Monitoring System may be administratively bypassed for a period not to exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for functional testing and calibration."

Pro osed TS Chan e The proposed TS change will delete Note 22.

4

<<0 Sb

~ a 1

h4 *

~ 4I A T4 I \ V4

" " H1 't1 P pw ~~

I p

ENCLOSURE 2 Continued JUSTIFICATION FOR THE PROPOSED CHANGE Note 22 was deleted because this note .repeated the.-allowed out of service times for calibrating maintenance and 'functional testing.

These times are now more appropriately listed in Table 3.2.A.

Note 11.

Pro osed TS Chan e

8. The proposed TS for NOTES FOR TABLES 4.2.A THROUGH 4.2.L exce t 4.2.D AND 4.2.K will add a new note to all three units: Note 31 for Unit 1, page 3.2/4.2-61; Note 32 for Unit 2, Page 3.2/4.2-61'nd, Note 30 for Unit 3, page 3.2/4.2-60.

........,...,~.,:~The,;new..note..for all units will read:

"Functional testing for the Reactor Building Ventilation Radiation Monitoring System (RBVRMS) shall consist of verifying the High Voltage Power Supply (HVPS) voltage at the Sensor and Convertors (detectors) is within its design limits. A channel functional test as defined in Section 1.0, "Definitions" shall be performed once per 18 months as part of the RBVRM channel calibration."

JUSTIFICATION FOR THE PROPOSED CHANGE Note 31 for Unit 1, Note 32 for Unit 2, and Note 30 for Unit 3 were added to clarify the functional testing requirements of the NUMAC RBVRM system. The detector Geiger Muller tubes use a bias

,...~,-....,voltage..for gamma.ray detection, and the detector accuracy is dependent on the value of this voltage. The NUMAC RBVRM chassis incorporates diagnostic routines that will detect a grossly out of range bias voltage, but will not provide detection of bias voltage values that would be outside that analyzed for the once per cycle calibration frequency. This will ensure that the RBVRM drift does not exceed that requirement allowed by the 100 mR/hr allowable is necessary to limit the value. In addition, this out of service time allowed for the bias voltage check/adjustment to support the risk assessment of the NUMAC RBVRM. The vendor, GE, recommends that the HVPS be checked once per month. If the HVPS doesn't drift outside of an accepted range, the counting efficiency will be within the design tolerances.

0 t "

> 1,i + e g g

~

~ *I "; s ~ wi i

~ ~ a= ~,r.h

ENCLOSURE 2 Continued Pro osed TS Chan e

9. The proposed TS change would revise Section 3.2 BASES, Unit 1, paragraph 9, first sentence, page 3.2/4.2-68; Unit 2, paragraph 4, first sentence, page 3.2/4.2-69; and, Unit 3, paragraph 9, first sentence, page 3.2/4.2-67 by deleting the first word "Four" and by adding the word "Two".

The proposed change would revise Section 3.2 BASES, Unit 1, paragraph 1, after the first sentence, page 3.2-4.2-69; Unit 2, paragraph 5, after the first sentence, page 3.2/4.2-69; and Unit 3, paragraph 1, after the first sentence, page

,3.2/4.2-68 byadding the following:

"The allowed inoperable time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for functional testing or 24 hours for calibration and maintenance (with the downscale trip of the inoperable channel in the tripped condition) of the Reactor Building Ventilation system is based upon a Probabilistic Risk Assessment (PRA). The

~ assessment considered the failures, relay failures and the probability of an accident occurring for which the RBVRMs are required to operate."

Pro osed Chan e

10. The proposed change will revise the 4.2 BASES by deleting the first two sentences of Unit 1, paragraph 2, page

.+3.2/4'.2-..73,;.by, deleting the. first two .sentences of Unit 2, paragraph 6, page 3.2/4.2-73; and, by deleting the first two sentences of Unit 3, paragraph 2, page 3.2/4.2-72 by adding the following:

"The radiation monitors in the reactor and refueling zones which initiate building isolation and standby gas treatment operation are arranged such that two sensors high (above the high level setpoint) in a single channel or one sensor downscale (below low level setpoint) or inop in two channels in the same zone will initiate a trip function. The functional testing frequency is based drift on a Probabilistic Risk Assessment and system characteristics of the Reactor Building Ventilation Radiation Monitors. The calibration frequency is based upon the drift of the radiation monitors."

The remainder of the paragraph, sentences three and four, will become a separate paragraph.

~ ~ ~

1 ~

1 ++ -)l ~

I ~

4

,, ~ 4A'

ENCLOSURE 3 DETERMINATIONOF NO SIGNIFICANT HAZARDS CONSIDERATION BROWNS FERRY NUCLEAR PLANT (BFN)

UNITS 1, 2 AND 3 D cri ti n of the Pro osed T Chan e The proposed TS changes affects Units 1, 2 and 3 at BFN. Design Change W11179 replaces the existing analog Reactor Building Ventilation Radiation Monitoring (RBVRM) system with digital sensors and computerized software based monitors that are made by General Electric and are a part of their NUMAC line of equipment. The RBVRM monitors radiation in two zones, the Reactor Zone and the Refuel Zone. When radiation is detected in one of the zones a group 6 Primary Containment Isolation Signal (PCIS) and Standby Gas Treatment are initiated to prevent the inadvertent release of radiation in excess of the 10 CFR part 100 limits.

The proposed changes affect 1.0 Definitions by adding "digital" to the "Channel Functional Test Definition ", Table 3.2.A notes by adding to an existing note explaining the allowed inoperative times for one channel of the RBVRM system and by adding a new note explaining the effect on the logic operation of the new sensor configuration. It also affects Table 3.2.A by referencing the new note and by adding the word channel/channels in the remarks section to clarify the trips. Table 4.2.A is affected by changing the Calibration Frequency to once/18 months; by deleting note 22; and, by adding Note 31 for Unit 1, Note 32 for Unit 2, and Note 30 for Unit 3 which defines functional testing for the RBVRM's.

The 3.2 Bases is affected by changing the number of RBVRM monitors from four to two and by adding the basis for the revised allowed out of service times for calibration, functional testing and maintenance of the RBVRM's; and, the change affects 4.2 Bases adding a basis for the functional test and calibration frequencies.

Ba i for Pr no i nificant Haz rd n ide ti niDetermination NRC has provided standards for determining whether a s gnificant hazards consideration .

exists as stated in 10 CFR 50.92(c). A proposed amendment to an operating license involves no significant hazards consideration considerations if operation of the facility in accordance with the proposed amendment would not (1) involve a significant increase in the probability or consequences of an accident previously evaluated, or (2) create the possibility of a new or different kind of accident from an accident previously evaluated or (3) involve a significant reduction in margin of safety.

1. The proposed amendment does not involve a significant increase in the probability or consequences of an accident previously evaluated.

~ ~

ENCLOSURE 3 DETERMINATIONOF NO SIGNIFICANT HAZARD HAZARDS CONSIDERATION BROWNS FERRY NUCLEAR PLANT (BFN)

UNITS 1, 2 AND 3 (Continued)

The replacement GE NUMAC equipment is more reliable, accurate and less likely to spuriously actuate than the existing equipment. The existing equipment has experienced 40 equipment failures, initiated 8 PCIS isolations, and has been the cause of 12 Licensee Event Reports in the last 4 years. The NUMAC radiation monitor has a design Mean Time Before Failure (MTBF) of 7.5 years which is a significant improvement over the existing system.

The RBVRM system mitigates the release of radiation through the ventilation system following either a refueling accident in the refuel zone or an unspecified airborne radiation release in the reactor zone. Since the replacement equipment is more accurate

., and reliable, the consequences of an accident will not be increased.

2. The proposed amendment does not create the possibility of a new or different kind of accident from an accident previously evaluated.

The NUMAC RBVRM system, as a member of the GE NUMAC product family line, has been designed to improve the overall system reliability and availability. The equipment possesses an automatic self-test feature that checks essential instrument functions and detects most faults at a module level. Faults can therefore be detected, logged and alarmed. Additional features, such as dynamic coupling of outputs and watchdog timers, aid in the detection and prevention of failures. These new equipment characteristics do not impact plant safety since the devices and accompanying logic of the PCIS system, receiving input from the NUMAC RBVRM system, has not changed.

Similar members of the NUMAC product family line have been reviewed by the NRC and accepted for use in safety system application. Reference NEDO-30883-A and NEDO-31439-A. The steps taken for the RBVRM hardware qualification and software validation and verification were designed by a similar programs as those used in the NRC reviewed programs in the referenced NEDOs.

The NUMAC product line has been in use for over 6 years at many plants. TVA is not aware of any NUMAC radiation monitor that has experienced common mode failure or mid-scale failure.

The BFN specific RBVRM application of the NUMAC has been subjected to rigorous Electromagnetic Interference Tests and Software Verification and Validation Tests without any system failures.

• 'L eg

'4

~ It

'I I ~

ENCLOSURE 3 DETERMINATIONOF NO SIGNIFICANT HAZARDS CONSIDERATION BROWNS H~22RY NUCLEAR PLANT (BFN)

UNITS 1, 2 AND 3 (Continued)

BFN's application of the NUMAC is described in detail in the NUMAC RBVRM licensing report.

The NUMAC RBVRM is designed so that critical output trips fail in a safe condition, i.e., PCIS, SBGT, and CREV initiation, not only on a loss of power, but also on any failure that results in the loss of continued and correct communication messages from the essential microcomputer. The possibility of a new or different kind of accident from an accident previously evaluated is not created because the new and the old system design both fail in a safe condition and because no new failure types occurred during EMI/Software testing nor during the years of operational experience of the NUMAC's.

3. The proposed amendment does not involve a significant reduction in margin of safety.

The allowed value for the RBVRM system trip setting is 100mR/hr of gamma radiation in the exhaust of the Reactor Zone ventilation system or on the Refuel Floor. Neither this TS change nor DCN W11179 change the allowable value of the RBVRM high radiation trip setting. Therefore the existing margin of safety is not impacted.

The change in calibration frequency to once per 18 months and the allowed out of service time for the NUMAC RBVRM's has been evaluated for drift characteristics and analyzed by a probabilistic risk assessment (PRA). The assessment determined that the calibration frequency and the allowed out of service times do not involve a significant reduction in the margin of safety.

The NUMAC RBVRM provides improved channel accuracy and resolution by a factor of two by the use of automatic calibration and digital processing/display and noise reduction features. Instrument drift rate is reduced by at least a factor of four with the incorporation of automatic gain and zero features.

The NUMAC RBVRM does not impact the existing margin of safety, but rather enhances the accuracy of the instruments measuring the radiological conditions and initiating the trip. Neither the design change nor the proposed TS amendment involves a significant reduction in the margin of safety.

0

~ 8 t),

I I

0,