Text

COL Docs - Transmittal of Information for Jan. 24th Tech Exch Meeting Pms TS Surveillance LAR - Non-Proprietary Information
	ML19022A312
Person / Time
Site:	Vogtle
Issue date:	01/22/2019
From:	; NRC
To:	; NRC/NRO/DLSE/LB4
References
	Download: ML19022A312 (88)
	v • d • e

Vogtle PEmails From: Hoellman, Jordan Sent: Tuesday, January 22, 2019 11:51 AM To: Vogtle PEmails

Subject:

Transmittal of Information for Jan. 24th Tech Exch Meeting re: PMS TS Surveillance LAR

- Non-Proprietary Information Attachments: 20190124_APP-GW-GLR-185_Non-Prop.pdf; 20190124 TechExch Slides - PMS TS SR LAR.pdf; 20190124_SVP_SV0_005390_Affidavit and Req for Withholding.pdf Forwarding to ADAMS to support the January 24, 2019 public meeting discussion.

From: Haggerty, Neil [1]

Sent: Thursday, January 17, 2019 6:49 PM To: Patel, Chandu <Chandu.Patel@nrc.gov>; Hoellman, Jordan <Jordan.Hoellman2@nrc.gov>

Cc: Sparkman, Wesley A. <WASPARKM@southernco.com>; Agee, Stephanie Y. <SYAGEE@southernco.com>; Arafeh, Yasmeen N. <YNARAFEH@southernco.com>

Subject:

[External_Sender] Transmittal of Information for Jan. 24th Tech Exch Meeting re: PMS TS Surveillance LAR -

Non-Proprietary Information This message provides the non-Proprietary Information that will be used for the Technical Exchange Meeting on the Protection and Safety Monitoring (PMS) Technical Specifications (TS) Surveillance License Amendment Request (LAR).

The following non-proprietary information is provided:

20190124_APP-GW-GLR-185_Non-Prop.pdf

20190124 TechExch Slides - PMS TS SR LAR.pdf (provides the slides that will be presented during the January 24th meeting)

20190124_SVP_SV0_005390_Affidavit and Req for Withholding.pdf (supports the request to withhold proprietary information from the Public)

The attachments to this message may be provided to the Public prior to the January 24th meeting.

SNC has provided the Proprietary information in a separate email, for distribution to NRC Staff in preparation of the meeting.

Please contact Mr. Wesley A. Sparkman at (205) 992-5061 if you have any questions/comments regarding this information.

Thank you, Neil Haggerty Neil Haggerty l Southern Nuclear Operating Company Nuclear Development Regulatory Affairs - VEGP 3&4 Licensing SNC-Inverness: 205.992.7047 l office: 301.874.8537 l mobile: 240.566.2442 1

x2nhagge@southernco.com neil.haggerty@excelservices.com This e-mail and any attachments thereto are intended only for the use by the addressee(s) named herein and may contain proprietary and confidential information. If you have received this e-mail in error, please immediately notify me by telephone and permanently delete the original and any copy of any e-mail and any printout thereof.

2

Hearing Identifier: Vogtle_COL_Docs_Public Email Number: 407 Mail Envelope Properties (SN6PR0901MB236624DBF2E2B1C60BF5E5A8D5980)

Subject:

Transmittal of Information for Jan. 24th Tech Exch Meeting re: PMS TS Surveillance LAR - Non-Proprietary Information Sent Date: 1/22/2019 11:50:49 AM Received Date: 1/22/2019 11:50:58 AM From: Hoellman, Jordan Created By: Jordan.Hoellman2@nrc.gov Recipients:

"Vogtle PEmails" <Vogtle.PEmails@nrc.gov>

Tracking Status: None Post Office: SN6PR0901MB2366.namprd09.prod.outlook.com Files Size Date & Time MESSAGE 2298 1/22/2019 11:50:58 AM 20190124_APP-GW-GLR-185_Non-Prop.pdf 561208 20190124 TechExch Slides - PMS TS SR LAR.pdf 1090367 20190124_SVP_SV0_005390_Affidavit and Req for Withholding.pdf 638488 Options Priority: Standard Return Notification: No Reply Requested: No Sensitivity: Normal Expiration Date:

Recipients Received:

January 17, 2019 SVP_SV0_005383 SV0-GW-GLR-185, Revision 0 PagePage 2 69 of 129 Preliminary Information to Support NRC Technical Exchange Meeting on Protection and Safety Monitor System Surveillance Reduction Introduction This document provides preliminary information to support an NRC Technical Exchange meeting related to the reduction of Protection and Safety Monitoring System Technical Specification Surveillance Requirements. The information provided below summarizes potential Vogtle 3 & 4 licensing actions and the associated technical evaluations. The following information is based upon on-going draft analyses and is still under formal review. Therefore, this information is subject to change.

Any potential future licensing actions associated with the final version of this information will follow the 10 CFR Part 52 change control process separate from this report.

Description of Proposed Activity The following licensing actions are proposed:

1. The SRs requiring a manual Channel Check to be performed on PMS components are proposed to be removed from the TS.

2. The SRs requiring a manual COT to be performed on PMS components are proposed to be removed from the TS.

3. The SRs requiring a manual ALT to be performed on PMS components (excluding the ADS and IRWST injection blocking device) are proposed to be removed from the TS.

4. The approach for satisfying the reactor trip and ESFAS response time SRs is changed. The current approach for satisfying the PMS response time surveillance tests is to perform a response time tests on the PMS equipment. The proposed method is to use allocated response times for the PMS equipment in lieu of testing. The reactor trip and ESFAS response time definitions allow an exception to testing if the response times can be verified via a previously reviewed and approved NRC methodology. This activity seeks NRC approval for the methodology outlined in this license amendment request. If approved, the Bases will be updated to allow for allocated values to be used for the PMS equipment to support the overall response time test SRs. Text is also added to describe where the PMS equipment allocated values can be found.

The SRs throughout the TS are renumbered to support changes 1, 2, and 3. Associated Bases changes are also made for the TS changes proposed above. This includes rewording the Background description of the PMS self-diagnostic test features in Bases 3.3.1 and 3.3.8 to more clearly align with the changes described above. The Bases surveillance requirement description for SR 3.3.4 and SR 3.3.6 is revised to acknowledge that these functions have no SRs due to self-checking features continuously monitoring logic OPERABILITY.

None of the activities change any PMS software or hardware. The activity credits the PMS self-diagnostic test features already part of the approved PMS design and uses these existing self-diagnostic features to justify the removal of redundant manual PMS surveillance tests.

Technical Evaluation of the Activity Self-Diagnostic Overlap with Manual Surveillance Testing Evaluation An evaluation was performed to compare the manual PMS surveillance tests included in the TS with the PMS self-diagnostic tests. The evaluation included the following general process:

x [

. ]a,c WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 SV0-GW-GLR-185, Revision 0 PagePage 3 70 of 129 x [

o

. ]a,c A summary of the evaluation of each manual surveillance test and the available self-diagnostic tests is included in Table 1 below. In Table 1, the surveillance tests applicable to the PMS are listed, along with the applicable SR number and a test description. A high-level description of the self-diagnostic coverage for each manual surveillance test is provided. A summary conclusion is made for each surveillance test based on the associated evaluation.

Most of the SRs associated with PMS Channel Checks, COTs, and ALTs are deleted based on the information in Table 1. With a few exceptions addressed in Table 1, it is shown that the self-diagnostic tests can detect the same failures as would be detected by the Channel Check, COT and ALT surveillance tests. In addition, though the Response Time Tests will be retained as a surveillance requirement, it is determined to be unnecessary to periodically test the response time of the PMS equipment. An allocated value for the PMS equipment is proposed to be used in lieu of a test in order to support the overall Response Time Test measurement. With an exception addressed in Table 1 below, it is shown that the self-diagnostic tests would capture any credible failure resulting in slower response times.

Overview of Self-Diagnostic Testing Features

[

o o

]a,c WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 SV0-GW-GLR-185, Revision 0 PagePage 4 71 of 129

[

. ]a,c Improved Reliability, Safety, and Operability of Self-Diagnostics The self-diagnostics are a reliable and superior alternative to manual surveillance tests. The self-diagnostics tests are automatically and continuously executed. This is in contrast to the manual tests which are executed every 92 days or 24 months, per the surveillance test program. Therefore, the self-diagnostics tests are executed more frequently than the manual tests. In addition, the self-diagnostics tests do not reduce the redundancy of the safety system. The PMS remains at full system redundancy during the self-diagnostic tests, unlike the manual surveillance tests which require the system to be at less than full redundancy. Because the surveillance tests are accomplished by the operator, they have a higher probability of a human error adversely impacting the operation of the safety system than the self-diagnostic tests which are inherently less prone to error than a human operator. This is supported by the fact that the self-diagnostics have gone through a rigorous design life-cycle processes.

[

]a,c Qualification of AC160 Self-Diagnostics The AC160 diagnostics were commercially dedicated to the same standards as the rest of the AC160 system software. In 2000, the NRC issued a safety evaluation report (ML003740165) on the Common Q Topical Report (CENP-396-P, Rev. 01 which is the predecessor to WCAP-16097-P-A). In the safety evaluation report the NRC acknowledged receipt of Westinghouse document GWKF 700 777, "Design and Life Cycle Evaluation Report on Previously-Developed Software in ABB AC160, I/O Modules and Tool Software" Rev. 02 (February 22, 2000), in support of the commercial dedication of the AC160. The safety evaluation report stated the, AC160 PDS [Previously Developed Software] is composed of the AC160 software, S600 I/O Module(s) software, and ABB Tool software. The evaluation is based on the requirements specified in International Electrotechnical Commission (IEC) standard IEC-60880, "Software for Computers in the Safety Systems of Nuclear Power Stations." IEC 60880 is referenced in IEEE 7-4.3.2-2003, "IEEE Standard Criteria for Digital Computers in Safety Systems of Nuclear Power Generating Stations." IEC 60880 is comparable to IEEE 7-4.3.2-2003, and the staff has found standard IEC 880 to be an acceptable equivalent.

The Design and Lifecycle Evaluation (DLCE) applies to all aspects of the PDS including the system software that executes the nuclear application program and the diagnostics integrated with the system software. In other words, the same software quality approach applied to both aspects of the system software. Therefore, the Common Q Platform diagnostics were developed using a rigorous process which was accepted by the NRC.

These same diagnostics were reviewed by the NRC staff in relation to the Palo Verde Nuclear Generating Station Core Protection Calculator System Technical Specifications. The NRC concluded, per the safety evaluation of the Palo Verde Nuclear Generating Station (PVNGS) Core Protection Calculator System (ML0330303630) in allowing for extended surveillance testing frequencies, the NRC WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 SV0-GW-GLR-185, Revision 0 PagePage 5 72 of 129 staff found that the diagnostics to be employed on the Common Q system are more extensive and have more coverage than in the legacy system.

Using self-diagnostics is also consistent with the Background sections of Bases 3.3.1 and 3.3.8 which state that PMS testing will be accomplished with continuous system self-checking features, to the extent practical. This text is enhanced throughout the Bases to clearly identify how the self-diagnostics are relied upon in lieu of manual surveillance tests and to ensure the self-diagnostics cannot be changed in such a way as to invalidate how they are currently used to confirm system operability.

Similarly, the PMS, including its application-specific self-diagnostics, was developed under a formal life-cycle process per COL Appendix C ITAAC Table No. 2.5.02.11 and 2.5.02.12.

Therefore, the PMS and Common Q self-diagnostic equipment relied upon to test system operability has been developed using project life-cycles which included specific processes for conceptual design activities, requirements development, design activities, implementation, testing, and commercial dedication.

Self-Diagnostics Compliance with Regulations A review was performed to determine which of the regulations and industry guidance documents discussed above are specifically applicable to the self-diagnostics. It is concluded that the self-diagnostics adhere to those requirements or, if not directly applicable, satisfy the intent of requirement.

GDC 18 and GDC 21 of 10 CFR Appendix A require systems important to safety to be designed to permit periodic testing. This includes testing of the performance of the components of the system and the system as a whole during plant operation. This activity does not propose any change to the PMS design. The PMS continues to be designed to permit periodic testing during plant operation. This activity credits the PMS self-diagnostics in certain instances in lieu of manual surveillance tests. The PMS self-diagnostics are design features which periodically and continuously test the system during plant operations, which is consistent with GDC 18 and GDC 21.

Criterion XI, "Test Control," of 10 CFR 50 Appendix B requires a test program to be established to ensure the safety system is tested in accordance with procedures to verify it is performing satisfactorily while in-service. The AP1000 surveillance test program continues to meet this requirement. The self-diagnostic tests support this requirement in that it is part of the overall suite of tests available to the PMS used to verify the PMS is performing satisfactorily while in-service. While performing the tests in accordance with test procedures is not directly applicable to self-diagnostic testing, the self-diagnostics execute in a specific, well-defined sequence and respond to given test failures in a predictable way, as shown in the evaluation summarized above.

Similar to GDC 18 and GDC 21, IEEE 603-1991 requires the protection system to have the capability for testing and calibration during power operations while retaining the capability of the safety systems to accomplish their safety functions. The protection system needs to be capable of performing the tests described in IEEE 338-1987. As stated above, this activity does not propose any change to the PMS design, and the self-diagnostics support this requirement. Though not always necessary due to self-diagnostic coverage, the AP1000 PMS is capable of performing the tests as described in IEEE 338-1987.

According to UFSAR Appendix 1A requires testing to be in accordance with Regulatory Guide 1.118 Revision 3 and IEEE 338-1987. Regulatory Guide 1.118 and IEEE 338-1987 provide guidance specifically for periodic testing included as part of the surveillance program. It defines the scope of periodic testing as including functional tests and checks, calibration verification, and time response measurements, as required, to verify the safety system performs to meet its define safety function.

IEEE 338-1987 does not define how to determine what is required to be part of the manual surveillance WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 SV0-GW-GLR-185, Revision 0 PagePage 6 73 of 129 program, but provides guidance for those tests within the surveillance program. The self-diagnostic tests are not part of the surveillance program and, therefore, the requirements in IEEE 338-1987 Section 6 are not directly applicable. In addition, IEEE 338-1987 is largely written specifically for manual testing and, therefore, the guidance does not explicitly address self-diagnostic testing features.

IEEE 338-1987 Section 5, item 8 addresses the automatic test features and programmable digital computer used within the surveillance program and the need to meet the requirements in the standard for these items. Even though the self-diagnostics are not part of the surveillance program, they do support the basis of the standard (i.e., IEEE 338-1987 Section 4) in that they continuously and periodically check the system to verify operability. The self-diagnostic tests also support the design requirements included in the standard (i.e., IEEE 338-1987 Section 5) in the following ways:

x The self-diagnostics support the requirement to have a system designed to be testable.

x The self-diagnostics permit the independent testing of redundant channels while maintaining the capability of these systems to respond to actual signals.

x The self-diagnostics are designed to provide overlap testing in that the diagnostics cover all relevant PMS components, including multiple diverse diagnostics covering the same PMS equipment.

10 CFR 50.36 establishes the need to have Technical Specifications; including limiting conditions for operations and surveillance requirements. Surveillance requirements are used, in part, to assure that the limiting conditions for operation will be met. It is concluded that, in some instances, the manual PMS SRs associated with COT, ALT, and Channel Checks are not required to assure the corresponding LCO is met. This is because comparable tests, as evaluated above, are built into the PMS design. These self-diagnostic tests have been shown to identify the same issues as the corresponding SRs and alert the operator of any condition contrary to the LCO.

WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 74 of 129 SV0-GW-GLR-185, Revision 0 Page 7 Table 1 - Summary of the Manual Surveillance Tests and Self-Diagnostic Tests for the PMS Components Test Name Relevant (PMS) SRs Test Description Summary of PMS Self-Diagnostic and Redundant Surveillance Test Coverage Evaluation Channel 3.3.1.8 Definition: A channel calibration shall be the adjustment, as necessary, of the channel output Not applicable for this activity. Calibration will continue to be a manual surveillance test.

Calibration 3.3.1.9 such that it responds within the necessary range and accuracy to known values of the 3.3.2.3 parameter that the channel monitors. The channel calibration shall encompass all devices in the channel required for operability.

3.3.3.3 Calibration of instrument channels with resistance temperature detector (RTD) or thermocouple 3.3.8.3 sensors may consist of an in place qualitative assessment of sensor behavior and normal 3.3.10.3 calibration of the remaining adjustable devices in the channel. The channel calibration may be 3.3.11.3 performed by means of any series of sequential, overlapping, or total channel steps.

3.3.13.3 3.3.14.3 3.3.17.2 3.3.20.3 3.4.1.4 3.4.9.3 3.9.3.2 Channel 3.3.1.1 Definition: A qualitative assessment, by observation, of channel behavior. This test includes a The PMS performs continuous channel comparison on specific sensor values across all four divisions. This Check 3.3.2.1 comparison of the channel indication and status to other indications or statuses derived from includes intra-channel and inter-channel comparison checks. This self-diagnostic test is described in WCAP-16675 independent instrument channels measuring the same parameter. Section 6.2.

3.3.3.1 Test Overview: The manual Channel Check identifies if a component has failed by comparing x [

3.3.8.1 all four divisions redundant instrument input values (inter-channel check) and comparing the 3.3.10.1 redundant BPL measurements within a division (intra-channel check). This test checks for a 3.3.11.1 significant deviation that may indicate a gross channel failure. This is accomplished by visual comparison of the indicators at the MTP, and noting if a pre-defined difference exists between 3.3.13.1 the highest and lowest indicator.

3.3.14.1 PMS Components Covered: The data from the process sensor passes to the A/D converter a,c 3.3.17.1 within the BPL and is displayed on the MTP. .]

3.3.20.1 The PMS self-diagnostic test verifies the same information verified by the manual Channel Check test. Therefore, the PMS Channel Checks can be eliminated.

3.9.3.1 A graphical representation of the self-diagnostic channel check test is shown in Figure A.3 of Appendix A.

WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 75 of 129 SV0-GW-GLR-185, Revision 0 Page 8 Test Name Relevant (PMS) SRs Test Description Summary of PMS Self-Diagnostic and Redundant Surveillance Test Coverage Evaluation Channel 3.1.8.1 Definition: Injection of a simulated or actual signal into the channel as close to the sensor as The PMS self-diagnostic tests have been shown to adequately test the operability of the same PMS components Operational 3.3.1.6 practicable to verify channel operability. Includes adjustments, as necessary, of the required tested as part of the manual COTs in all the SRs listed except SR 3.3.20.3, which is addressed below. Specifically, Test (COT) alarm, interlock, and trip setpoints such that the setpoints are within the necessary range and the PM646A, CI631 Module, BIOB, and HSL Common Q Platform diagnostics were evaluated and shown to cover 3.3.1.7 accuracy. the applicable processor module failure modes. In addition, the self-diagnostic tests have been shown to put the 3.3.2.2 system into a safe state following the same PMS failures evaluated as part of the PMS FMEA. In all cases, the Test Overview: The COT for all SRs except 3.3.20.3 is satisfied by manually injecting a 3.3.3.2 simulated digital signal at the MTP and verifying that the BPL actuates as expected. This internal fault detected by the diagnostic initiates the necessary visual and audible annunciation in the main control includes: room so that the operator can take the appropriate action.

3.3.8.2 x Manually entering a signal value for the input to the function being tested The COT for the ADS and IRWST injection blocking can be eliminated. The ALT on the ADS and IRWST injection 3.3.10.2 blocking device fully covers the component and completely overlaps the COT which only partially tests the device.

x Executing the function with the test input value 3.3.11.2 [

x Monitoring the function outputs to determine if the response to the test input value is 3.3.13.2 correct.

3.3.14.2 ]a,c Therefore, the COT associated with the ADS and IRWST injection blocking device can be The COT for the ADS and IRWST injection blocking device (SR 3.3.20.3) confirms the device eliminated.

3.3.20.3 is capable of unblocking on low CMT level. The ALT for the device (SR 3.3.20.5) confirms it is In summary, the PMS self-diagnostics adequately test the components tested as part of the COT (except for SR capable of unblocking for each of the blocking device inputs (i.e., remote shutdown room 3.3.20.3) and, therefore, the COT can be eliminated. In addition, the COT for the ADS and IRWST injection transfer switch, block/unblock switch, battery charger under-voltage, and CMT level low).

blocking device (i.e., SR 3.3.20.3) can be eliminated because the ALT performed on the device is adequate.

Therefore, the ALT for the blocking device is more comprehensive than the COT and overlaps the COT.

PMS Components Covered: The BPL PM646A processor modules, CI631 module, BIOB, and the HSL equipment connecting the BPL to the LCL are used to process the digital test injection signal. In addition, the ADS and IRWST injection blocking device is covered via 3.3.20.3.

A graphical representation of the equipment covered by the COT surveillance test is shown in Figure A.4 of Appendix A.

WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 76 of 129 SV0-GW-GLR-185, Revision 0 Page 9 Test Name Relevant (PMS) SRs Test Description Summary of PMS Self-Diagnostic and Redundant Surveillance Test Coverage Evaluation Actuation 3.3.4.1 Definition: The application of various simulated or actual input combinations in conjunction The PMS self-diagnostic tests have been shown to adequately test the operability of the same PMS components Logic Test 3.3.6.1 with each possible interlock logic state required for operability of a logic circuit and the tested as part of the manual ALTs, except for two instances that are addressed below. Specifically, the PM646A, (ALT) verification of the required logic output. CI631 Module, BIOB, and HSL Common Q Platform diagnostics were evaluated and shown to cover the applicable 3.3.15.1 Test Overview: The ALT surveillance tests include separate tests for the reactor trip system processor module failure modes. In addition, the self-diagnostic tests have been shown to put the system into a 3.3.16.1 safe state following the same PMS failures evaluated as part of the PMS FMEA. In all cases, the internal fault logic (SR 3.3.6.1), ESF system logic (SR 3.3.15.1, SR 3.3.16.1), ESF generated reactor trip 3.3.20.5 actuation logic (SR 3.3.4.1), and the ADS and IRWST injection blocking device logic (SR detected by the diagnostic initiates the necessary visual and audible annunciation in the main control room so that 3.3.20.5). The ALT for the ADS / IRWST injection blocking device (SR.3.3.20.5) is not the operator can take the appropriate action.

applicable to this activity because it will continue to be included as a manual surveillance test The components not fully covered by self-diagnostic tests include the DO630 module and the reactor trip matrix within the Technical Specifications. termination unit. However, these components are also tested every 92 days as part of the TADOT associated with For the reactor trip system logic ALT (SR 3.3.6.1), the injected signal goes from the LCL to the SR 3.3.7.1. Any failure that would be detected in these components by the ALT will also be detected by the reactor trip matrix logic via the DO630 module. Proper function is verified using the digital TADOT.

output display to check the current flow through the appropriate reactor trip matrix termination In summary, the PMS self-diagnostics for the components tested as part of the ALT and the existing TADOT unit ITP monitoring resistors, and thereafter using the DO630 status indicators. associated with SR 3.3.7.1 together provide complete coverage for the components tested as part of the ALT.

For the ESF system logic ALT (SR 3.3.15.1 and SR 3.3.16.1), the injected signal goes from the Therefore, it is concluded that the ALT is unnecessary and can be deleted from the TS (except for SR 3.3.20.5).

LCL to the ILP (via the HSLs). Confirmation that the system is functioning properly is obtained by monitoring that the correct ESF system level actuation signals are received by the ILP component control processor modules.

The signal path for the ESF generated reactor trip actuation logic (SR 3.3.4.1) is almost entirely covered by the other two tests described above. The only aspect of the safety path associated with this surveillance tests not covered by the other two surveillance tests is the communications over the BIOB between the ESFAS processor module and the reactor trip processor module.

PMS Components Covered:

x Reactor trip system logic ALT: RT LCL processor modules, communication processor modules, CI631, BIOB, DO630, reactor trip matrix termination unit x ESF system logic ALT: ESF LCL processor modules, communication processor modules, CI631, BIOB, HSL equipment, ILP component control processor module x ESF generated reactor trip actuation logic ALT: RT and ESF LCL processor modules, communication processor modules, CI631, BIOB, DO630, reactor trip matrix termination unit, BIOB between the ESF and RT processor modules.

A graphical representation of the equipment covered by the ALT surveillance test is shown in Figure A.5 and Figure A.6 of Appendix A.

Actuation 3.3.15.2 Definition: The application of simulated or actual logic signals and the verification of the Information on the on-going ALOT evaluation is included at the end of this table.

Logic Output 3.3.16.2 required component actuation output signals up to, but not including, the actuated device. The Test (ALOT) test may be performed by means of any series of sequential, overlapping, or total steps.

TADOT 3.3.1.10 Definition: The operation of the trip actuating device. The TADOT adjusts, as necessary, the Not applicable for this activity. The TADOT will continue to be a manual surveillance test.

3.3.5.1 trip actuating device so that it actuates at the required setpoint within the necessary accuracy.

3.3.7.1 3.3.9.1 3.3.12.1 3.3.18.4 3.3.20.6 WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 77 of 129 SV0-GW-GLR-185, Revision 0 Page 10 Test Name Relevant (PMS) SRs Test Description Summary of PMS Self-Diagnostic and Redundant Surveillance Test Coverage Evaluation Response 3.3.1.11 Definition: A test of the response time for a reactor trip and engineered safety feature Figure A.7 of Appendix A provides a simplified diagram of the response time signal path, along with the other Time Test 3.3.2.4 protection channel. The response time may be measured by means of any series of sequential, surveillance tests that cover each part of the signal path. Each component in the signal path was evaluated to overlapping, or total steps so that the entire response time is measured. In lieu of determine if the associated self-diagnostics within the equipment could adequately detect failures that impact 3.3.3.4 measurement, response time may be verified for selected components provided that the response times.

3.3.4.2 components and methodology for verification have been previously reviewed and approved by The PMS self-diagnostic tests or other surveillance tests (not being removed in this activity) have been shown to 3.3.8.4 the NRC. adequately test the PMS components (except the DO630 module) within the reactor trip and ESF actuation 3.3.10.4 Test Overview: Response time tests verify that the individual reactor trip and ESFAS response time signal paths and identify any failure that could impact equipment response times.

channel/division actuation response times, from sensor to actuating device, are less than or [

3.3.11.4 equal to the maximum values assumed in the accident analysis. This activity focuses 3.3.13.4 specifically on the PMS equipment portion of the protection path and not the sensor or the 3.3.14.4 actuating device.

PMS Components Covered: Figure A.7 of Appendix A shows the signal paths taken for PMS reactor trips and ESF actuations. In each case, the signal comes into the BPL processor module from an actual or simulated signal and the applicable I/O module (i.e., DP620, AI688, AI687, or DI621 module). The reactor trip inputs then pass through the reactor trip LCL, the ]a,c DO630 module, the reactor trip matrix termination unit, then to the reactor trip switchgear under-voltage and shunt trip mechanisms. The ESF actuation inputs pass through the ESF LCL, the ILP, SRNC, and the CIM. In each case, the signal path also passes through the HSLs, BIOB, and the CI631 module. The response time of this signal path is measured to ensure it is less than the maximum allowable response time assumed in the accident analysis.

WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 78 of 129 SV0-GW-GLR-185, Revision 0 Page 11 On-going ALOT Evaluation The TS SR evaluation of the ALOT is still in progress and is not as far along in the development and review process as the other surveillance tests. The preliminary results are included in this section. As indicated below, the ALOT surveillance test will likely need to remain in the TS and, therefore, may not be included in the license amendment request.

Test Overview: The ALOT demonstrates that both redundant signal paths from the inputs to the ILPs through the CIM logic and CIM output driver circuits (ILP to actuator test) in the ESF Actuation Subsystem Logic process injected LCL system actuation signals for the applicable actuation function. During this test, [

a,c

]

PMS Components Covered: ILP processor module (PM646A), communication module (CI631), digital input module (DI621), backplane I/O bus (BIOB), HSL (ILP to/from SRNC), SRNC, double and single width transition panels (DWTP/SWTP), CIM, ADS/IRWST blocking device, squib valve TU, and the component control Isolation barriers to Non-1E components.

A graphical representation of the equipment covered by the ALOT surveillance test is shown in Figure A.8 of Appendix A.

x For the components that have already been covered in previous sections (CI631s, PM646As, and BIOBs), it has been determined that diagnostics are sufficient, and therefore, ALOT testing is not required.

x The evaluation of the HSL, DI621s, and the SRNC concluded that the diagnostics are sufficient, and ALOT testing is not required.

x Based on the evaluation performed for the ALT and COT, it has been determined that ALT surveillance testing is necessary for the ADS/IRWST blocking device.

x For the CIM, there are multiple self-diagnostics that detect most of the postulated faults. [

a,c

]

x The evaluation of the double-wide transition panel (DWTP), single-wide transition panel (SWTP), squib valve termination unit, and the component control Isolation barriers to Non-1E is still being performed, and thus, there are no results available for these components.

The preliminary evaluation indicates that for most components associated with ALOT, the PMS self-diagnostic tests adequately test the operability of the same PMS components tested as part of the manual ALOTs, except for a small subset of components. In addition, the self-diagnostic tests have been shown to put the system into a safe state following the same PMS failures evaluated as part of the PMS FMEA. In most cases, the internal fault detected by the diagnostic initiates the necessary visual and audible annunciation in the main control room so that the operator can take the appropriate action. For the cases where the diagnostics are not sufficient to detect failures, surveillance testing or some other method (i.e., overlap testing, additional diagnostics, etc.) of detecting the failure will need to be performed. This will be determined once the evaluation is complete.

WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 79 of 129 SV0-GW-GLR-185, Revision 0 Page 12 Appendix A Supporting Figures WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 80 of 129 SV0-GW-GLR-185, Revision 0 Page 13 a,c WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 81 of 129 SV0-GW-GLR-185, Revision 0 Page 14 a,c WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 82 of 129 SV0-GW-GLR-185, Revision 0 Page 15 a,c WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 83 of 129 SV0-GW-GLR-185, Revision 0 Page 16 a,c WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 84 of 129 SV0-GW-GLR-185, Revision 0 Page 17 a,c WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 85 of 129 SV0-GW-GLR-185, Revision 0 Page 18 a,c WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

January 17, 2019 SVP_SV0_005383 Page 86 of 129 SV0-GW-GLR-185, Revision 0 Page 19 a,c WESTINGHOUSE NON-PROPRIETARY CLASS 3

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 20 January 17, 2019 SVP_SV0_005383 Page 87 of 129 Preliminary Vogtle 3 & 4 UFSAR Markups

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 21 January 17, 2019 SVP_SV0_005383 VEGP 3&4 - UFSAR Page 88 of 129 AP1000/

Criteria Referenced FSAR Section Criteria Position Clarification/Summary Description of Exceptions General Conforms The SRP 3.5.1.3 issued in 1981 and Regulatory Guide 1.115, issued in 1977, provide criteria for protection against the effects of potential turbine missiles.

Reference 28 issued in 1984 states that "the Nuclear Regulatory Commission staff has shifted emphasis in the reviews of the turbine missile issue from the strike and damage probability (P2xP3) to the missile generation probability (P1) and, in the process, has attempted to integrate the various aspects of the issue into a single coherent evaluation." The AP1000 turbine is arranged in a radial orientation. The three low pressure turbines incorporate fully integral rotors. The turbine conforms with the criteria given in Reference 28 and WCAP-16650 (Reference 52).

Conformance with this Regulatory Guide for programmatic and/or operational aspects is documented below.

The types of tests described in IEEE 338 Section 6.3 are not all General applicableConforms to the protection and safety monitoring system. In Reg. Guide 1.116, Rev. O-R,certain instances, 5/77 - Quality the Requirements Assurance self-diagnostics includedInspection, for Installation, within the and Testing of Mechanical Equipment and protection Systems and safety monitoring system are used to verify that Conformance for DCD scopethe safety of work is as system is capable stated below in the DCD.of meeting its designed safety function in lieu of manual testing as part of the surveillance General ANSI N/A Not applicable to AP1000 design certification. Section 17.5 program.

N45.2.8-1975 defines the responsibility for the Quality Assurance program.

Specifically, channel checks, logic system function tests, and Conformance for remaining scope is documented below.

response time tests are not manually performed on the General protectionException and safetyQuality assurance monitoring requirements system utilize theas equipment more recently part of NRC endorsed NQA-1 in lieu of the identified outdated the AP1000 surveillance program. In these cases, self-standards.

diagnostic test features continuously monitor the system.

Reg. Guide 1.117, Rev. 1, 4/78 - Tornado Design Classification C.1 FunctionalConforms tests are only performed on the PMS equipment that C.2 do not have complete self-diagnostic coverage. The Technical Conforms Specifications provide the necessary manual functional testing C.3 Conforms requirements in these instances (e.g., ALT and TADOT).

APPENDIX General Channel calibration Conforms verification For the AP1000, tests are included the leaktight integrity ofinthe the AP1000 primary surveillance program. containment is maintained.

Reg. Guide 1.118, Rev. 3, 4/95 - Periodic Testing of Electric Power and Protection Systems General IEEE Std. Conforms Guidelines apply to safety-related dc power systems. Since 338-1987 the AP1000 has no safety-related ac power sources, the guidelines do not apply to the AP1000 ac power sources.

Reg. Guide 1.119 - Withdrawn 1A-42 Revision 7.1

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 22 January 17, 2019 SVP_SV0_005383 VEGP 3&4 - UFSAR Page 89 of 129 z Continuity of the wiring is verified for devices that cannot be tested at power without includes damaging or upsetting the plant. Operability of the final actuated equipment is demonstrated at shutdown.

During reactor operation, the basis for acceptability of engineered safety features actuation is the successful completion of the overlapping tests performed on the protection and safety monitoring system. Process indications are used to verify operability of sensors.

7.3.2.2.7 Conformance to Requirements on Bypassing Engineered Safety Features Actuation Functions (Paragraph 5.8, 5.9, 6.6, and 6.7 of IEEE 603-1991)

Discussions on bypassing are provided in WCAP-15776 (Reference 1) and Subsection 7.3.1.4.

7.3.2.2.8 Conformance to the Requirement for Completion of Engineered Safety Features Actuation Once Initiated (Paragraph 5.2 of IEEE 603-1991)

Once initiated, engineered safety features proceed to completion.

Equipment actuated on a safeguards actuation signal cannot be returned to its previous position for a predetermined time period following initiation of the safeguards actuation signal. A block of the automatic safeguards signal is permitted at this time, if the reactor is tripped. This interlock is shown in Figure 7.2-1, sheet 11.

Resetting a system-level safeguards signal does not terminate any safeguards function. Rather, it permits the operator to individually reposition equipment. Equipment cannot be reset until the system-level signal is reset.

7.3.2.2.9 Conformance to the Requirement to Provide Manual Initiation at the System-Level for All Safeguards Actuation (Paragraph 6.2 of IEEE 603-1991)

Manual initiation at the system-level exists for the engineered safety features actuation. These system-level manual initiations are discussed in Subsections 7.3.1.1 and 7.3.1.2.

As a minimum, two controls are provided for each system-level manual initiation so that the protective function can be manually initiated at the system-level, despite a single random failure in one control. In certain applications, such as automatic depressurization, two pairs of controls are provided. One pair must be actuated simultaneously. This reduces the likelihood of inadvertent actuation while providing a design that meets the single failure criterion.

7.3.3 Combined License Information This section contained no requirement for information.

7.3.4 References

1. WCAP-15776, Safety Criteria for the AP1000 Instrument and Control Systems, April 2002 (as modified by changes provided in UFSAR Appendix 7A).

7.3-24 Revision 5.1

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 23 Attachment 1 January 17, 2019 SVP_SV0_005383 VEGP 3&4 - UFSAR Page 90 of 129 Depending on the protection and safety monitoring hardware used for AP1000, either WCAP-13383 or NABU-DP-00014-GEN describe design processes that will be used for AP1000.

Commercial Dedication

[INSERT 1]

WCAP-13383 (Reference 3) and CENPD-396-P WCAP-16097-P-A (Reference 7) provides for the use of commercial off-the-shelf hardware and software through a commercial dedication process. Control of the hardware and software during the operational and maintenance phase is the responsibility of the Combined License applicant.

z Revise Section 7, REFERENCES as follows:

3. WCAP-13383, Revision 1 (NP), "AP600 Instrumentation and Control Hardware and Software Design, Verification, and Validation Process Report," June 1996. Not Used.

4. CE-CES-195 WCAP-16096-P-A, Rev. 01 4, Software Program Manual for Common Q' Systems, May 26, 2000 February 2013.

7. CENPD-396-P WCAP-16097-P-A, Rev. 01 3, Common Qualified Platform Topical Report, May 2000 February 2013.

z Revise Section 3.9, Conformance to the Requirements to Maintain Independence Between Safety Systems and Other Interconnected Equipment (Paragraph 5.6.3.1 of IEEE 603-1991), as follows:

Signals from safety system equipment for control system use are transmitted through isolation devices. These devices are part of the safety system and are tested to confirm the credible failures at the output of the isolation device do not prevent the associated safety system channel from meeting the minimum performance requirements. Due to their inherent electrical isolation characteristics, fiber optic cables are exempt from electrical isolation qualification testing.

7A.6 Not Used 7A.7 WCAP-16674-P and WCAP-16674-NP, AP1000 I&C Data Communication and Manual Control of Safety Systems and Components The UFSAR incorporates by reference Tier 2 documents WCAP-16674-P and WCAP-16674-NP, AP1000 I&C Data Communication and Manual Control of Safety Systems and Components. See Table 1.6-1. WCAP-16674, Revision 4, includes the following revisions and additions as indicated by strikethroughs and underlines.

z Revise the Reference section, as follows:

1. WCAP-16097-P-A, Rev. 0 3 (Proprietary), Common Qualified Platform Topical Report, Westinghouse Electric Company LLC. (This document is also referred to as CENPD-396-P-A, Revision 2.)

7A-33 Revision 3.1

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 24 Attachment 1 January 17, 2019 SVP_SV0_005383 VEGP 3&4 - UFSAR Page 91 of 129 z Revise Section 2.2.3.1.3 Manual Reactor Trip, as follows:

A manual reactor trip is an entirely hardware based function that is initiated from the MCR by redundant momentary switches. The switches directly interrupt the power from the voting logic, actuating de-energizing the UV interposing relays and trip attachments, and energizing the ST trip attachments in all four divisions. Figure 2-3 illustrates a simplified version of the implementation of the manual reactor trip function.

[INSERT 2] z Revise Section 2.2.5 Interface and Test Processor Subsystem, as follows:

a,c z Add Section 2.2.9, Block to Prevent ADS and IRWST Injection Spurious Acutation as follows:

2.2.9 Block to Prevent ADS and IRWST Injection Spurious Actuation A number of measures have been taken to reduce the likelihood of spurious actuation of ESF functions in the AP1000 PMS design. Special attention has been given to prevention of spurious Automatic Depressurization System (ADS) and In-Containment Refueling Water Storage Tank (IRWST) Injection valve action, since a spurious actuation could result in a release of reactor coolant to containment. In order to prevent such spurious actuations, an ADS and IRWST Injection Blocking Device is provided that is independent of PMS failure modes. Each division of the PMS contains an independent block that prevents the ADS Stage 1-3 depressurization valves and the arm signal to the ADS Stage 4 depressurization and IRWST Injection valves from being actuated unless there is a confirmatory process condition separate from the PMS ADS and IRWST Injection actuation logic.

2.2.9.1 Independence The ADS and IRWST Injection Blocking Device is a Class 1E module physically located within each of the PMS divisions. The blocking device is diverse from the PMS AC160 hardware and software that is used to create the automatic ADS and IRWST Injection actuation signal, which provides the input to the component interface modules for the ADS and IRWST Injection valves. There are no interdivisional connections between the blocking devices nor will there be any coincidence voting.

2.2.9.2 Clearing of the ADS and IRWST Injection Block The ADS and IRWST Injection Blocking Device uses the CMT level to automatically clear this block. The ADS and IRWST Injection block in each division uses a level signal input from a level sensor on each CMT that clears the block if either signal indicates a CMT is draining. The use of two CMT level sensors in each ADS and IRWST Injection block device provides for a device that does not adversely affect the reliability of the ADS to actuate when it is required. Switches, one for each division, are provided in the MCR to allow the operators to manually clear the ADS blocks. Additionally, inputs from the MCR/

Remote Shutdown Workstation (RSW) transfer switch and from the battery chargers 7A-38 Revision 3.1

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 25 Attachment 1 January 17, 2019 SVP_SV0_005383 VEGP 3&4 - UFSAR Page 92 of 129 z Add Section 5.1.8, ADS Blocking Device as follows 5.1.8 ADS Blocking Device The ADS and IRWST Injection Blocking Device design uses conventional analog components that do not rely on software. Apart from its inputs and outputs and power source, the ADS and IRWST Injection Blocking Device does not share other PMS components.

The ADS and IRWST Injection Blocking Device in each division requires the following inputs:

z 4-20 mA inputs from two narrow range upper-level sensors (one on each CMT).

z Contact inputs from one MCR override switch.

z Contact inputs from one MCR/RSW transfer switch.

z Contact inputs from two undervoltage relays from battery chargers.

[

a,c

.]

[INSERT 3]

7A-42 Revision 3.1

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 26 January 17, 2019 SVP_SV0_005383 VEGP 3&4 - UFSAR Page 93 of 129 There is inherent conservatism in the use of Figure 15.0.5-2 in that it is based on a skewed flux distribution, which would exist relatively infrequently. For cases other than those associated with unbalanced xenon distributions, significantly more negative reactivity is inserted than that shown in the curve, due to the more favorable axial distribution existing prior to trip.

The normalized RCCA negative reactivity insertion versus time is shown in Figure 15.0.5-3. The curves shown in this figure were obtained from Figures 15.0.5-1 and 15.0.5-2. A total negative reactivity insertion following a trip of 4 percent k is assumed in the transient analyses except where specifically noted otherwise. This assumption is conservative with respect to the calculated trip reactivity worth available as shown in Table 4.3-3.

The normalized RCCA negative reactivity insertion versus time curve for an axial power distribution skewed to the bottom (Figure 15.0.5-3) is used in those transient analyses for which a point kinetics core model is used. Where special analyses require use of three-dimensional or axial one-dimensional core models, the negative reactivity insertion resulting from the reactor trip is calculated directly by the reactor kinetics code and is not separable from the other reactivity feedback effects. In this case, the RCCA position versus time of Figure 15.0.5-1 is used as code input.

15.0.6 Protection and Safety Monitoring System Setpoints and Time Delays to Trip Assumed in Accident Analyses A reactor trip signal acts to open two trip breaker sets connected in series, feeding power to the control rod drive mechanisms. The loss of power to the mechanism coils causesthe theprotection mechanisms to release the RCCAs, which then fall by gravity into the core. There are various instrumentation delays system is calibrated associated with each trip function including delays in signal actuation, in openingand thesurveillances trip breakers, and in the release of the rods by the mechanisms. The total delay to trip is defined as the time delay are performed from the time that trip conditions are reached to the time the rods are free and begin to fall. Limiting trip setpoints assumed in accident analyses and the time delay assumed for each trip function are given in Table 15.0-4a. Reference is made in that table to overtemperature and overpower T trip shown in Figure 15.0.3-1.

Table 15.0-4a also summarizes the setpoints and the instrumentation delay for engineered safety features (ESF) functions used in accident analyses. Time delays associated with equipment actuated (such as valve stroke times) by ESF functions are summarized in Table 15.0-4b.

The difference between the limiting setpoint assumed for the analysis and the nominal setpoint represents an allowance for instrumentation channel error and setpoint error. Nominal setpoints are specified in the plant Technical Specifications. During plant startup tests, it is demonstrated that actual instrument time delays are equal to or less than the assumed values. Additionally, protection system channels are calibrated and instrument response times are determined periodically in accordance with the plant Technical Specifications. to verify its performance remains within the pre-established limits of the safety analysis.

15.0.7 Instrumentation Drift and Calorimetric Errors, Power Range Neutron Flux Examples of the instrumentation uncertainties and calorimetric uncertainties used in establishing the power range high neutron flux setpoint are presented in Table 15.0-5.

The calorimetric uncertainty is the uncertainty assumed in the determination of core thermal power as obtained from secondary plant measurements. The total ion chamber current (sum of the top and bottom sections) is calibrated (set equal) to this measured power on a daily basis.

The secondary power is obtained from measurement of feedwater flow, feedwater inlet temperature to the steam generators, and steam pressure. Installed plant instrumentation is used for these measurements.

15.0-7 Revision 4.1

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 27 January 17, 2019 SVP_SV0_005383 Page 94 of 129 Inserts for Vogtle 3 & 4 UFSAR Markups

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 28 January 17, 2019 SVP_SV0_005383 Page 95 of 129 Insert 1 (Insert for WCAP-15776 Section 3.13) x Revise Section 3.13, Conformance to the Requirements to Provide Capability for Test and Calibration (Paragraph 5.7 of IEEE 603-1991) as follows:

Capability for testing and calibrating channels and devices used to derive the final system output signal from the various channel signals is provided. Testing from the sensor inputs of the PMS through to the actuated equipment is can be accomplished through a series of overlapping sequential tests with the majority of the tests capable of being performed with the plant at full power. Where testing final equipment at power would upset plant operation or damage equipment, provisions are made to test the equipment at reduced power or when the reactor is shut down.

Each division of the PMS includes a test subsystem. The test subsystem provides the capability for verification of the setpoint values and other constants, and verification that proper signals appear at other locations in the system.

Verification of the signal processing algorithms is made by exercising the test signal sources (either by hardware or software signal injection) and observing the results up to, and including, the attainment of a channel partial trip or actuation signal at the power interface. When required for the test, the tester places the voting logic associated with the channel function under test in bypass.

The capability for overlapping test sequence continues by inputting digital test signals at the output side of the threshold functions, in combinations necessary to verify the voting logic.

Some of the input combinations to the coincidence logic cause outputs such as reactor trips and engineered safety feature (ESF) initiation. The reactor trip circuit breaker arrangement is a two-out-of-four logic configuration, such that the tripping of the two circuit breakers associated with one division does not cause a reactor trip. To reduce wear on the breakers through excessive tripping, and to avoid a potential plant trip resulting from a single failure while testing is in progress, the test sequence is designed so that actual opening of the trip breakers is only required when the breaker itself is being tested.

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 29 January 17, 2019 SVP_SV0_005383 Page 96 of 129 Insert 2 (Insert for WCAP-16675 Section 2.2.5)

[

. ]a,c

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 30 January 17, 2019 SVP_SV0_005383 Page 97 of 129 Insert 3 (Insert for WCAP-16675 Section 6 and Section 6.2) x Revise Section 6, Maintenance, Testing, and Calibration as follows:

Maintenance and testing of the PMS consists of two types of tests: self-diagnostic tests and on-line verification tests. The self-diagnostic tests are built into the AC160 equipment and consist of numerous automatic checks to validate that the equipment and software are performing their functions correctly. Self-diagnostics, as well as on-line On-line verification tests are that can be manually initiated are used to verify that the safety system is capable of performing its intended safety function.

x Revise Section 6.2, On-line Verification Tests as follows:

Via the MTP in conjunction with the ITP, the I&C technician can perform manually initiated on-line verification tests to exercise the safety system logic and hardware to verify proper system operation. The ITP and the MTP also provide support for the detection and annunciation of self-diagnostics. Within each PMS division, the ITP interfaces with the NI subsystem, BPL subsystem, LCL subsystem, ILP subsystem, MTP, and the RTCB initiation relays to monitor and test the operational state of the PMS. The ITP together with the MTP provides support for on-line self-diagnostics and testing for the verification of PMS operability overall on-line verification testing.

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 31 January 17, 2019 SVP_SV0_005383 Page 98 of 129 Vogtle 3 & 4 COL Appendix A Technical Specifications Markups

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 32 January 17, 2019 SVP_SV0_005383 Page 99 of 129 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and D.1 Be in MODE 3. 15 minutes Associated Completion Time of Condition C not met.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.1.8.1 Perform a COT on power range neutron flux and Prior to initiation of intermediate range neutron flux channels per PHYSICS TESTS SR 3.3.1.6, SR 3.3.1.7, and SR 3.3.3.2.

SR 3.1.8.2 1 Verify the RCS lowest loop average temperature is 30 minutes 541°F.

SR 3.1.8.3 2 Verify THERMAL POWER is 5% RTP. 30 minutes SR 3.1.8.4 3 Verify SDM is within the limits specified in the COLR. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 33 January 17, 2019 SVP_SV0_005383 Page 100 of 129

7HFKQLFDO6SHFLILFDWLRQV $)' &$2&0HWKRGRORJ\

32:(5',675,%87,21/,0,76

$;,$/)/8;',))(5(1&( $)' &RQVWDQW$[LDO2IIVHW&RQWURO &$2& 0HWKRGRORJ\

/&2 7KH$)'

D 6KDOOEHPDLQWDLQHGZLWKLQWKHWDUJHWEDQGVSHFLILHGLQWKH&2/5

DERXWWKHWDUJHWIOX[GLIIHUHQFH

E 0D\GHYLDWHRXWVLGHWKHWDUJHWEDQGZLWK7+(50$/32:(5

573EXW573SURYLGHG$)'LVZLWKLQWKHDFFHSWDEOH

RSHUDWLRQOLPLWVVSHFLILHGLQWKH&2/5DQGFXPXODWLYHSHQDOW\

GHYLDWLRQWLPHLVKRXUGXULQJWKHSUHYLRXVKRXUV

F 0D\GHYLDWHRXWVLGHWKHWDUJHWEDQGZLWK7+(50$/32:(5

573

127(6

7KH$)'VKDOOEHFRQVLGHUHGRXWVLGHWKHWDUJHWEDQGZKHQWZRRU

PRUH23(5$%/(H[FRUHFKDQQHOVLQGLFDWH$)'WREHRXWVLGHWKH

WDUJHWEDQG

:LWK7+(50$/32:(5573SHQDOW\GHYLDWLRQWLPHVKDOOEH

DFFXPXODWHGRQWKHEDVLVRIDPLQXWHSHQDOW\GHYLDWLRQIRUHDFK

PLQXWHRISRZHURSHUDWLRQZLWK$)'RXWVLGHWKHWDUJHWEDQG

:LWK7+(50$/32:(5573DQG!573SHQDOW\

GHYLDWLRQWLPHVKDOOEHDFFXPXODWHGRQWKHEDVLVRIDPLQXWH

4 SHQDOW\GHYLDWLRQIRUHDFKPLQXWHRISRZHURSHUDWLRQZLWK$)'

RXWVLGHWKHWDUJHWEDQG

$WRWDORIKRXUVRIRSHUDWLRQPD\EHDFFXPXODWHGZLWK$)'

RXWVLGHWKHWDUJHWEDQGZLWKRXWSHQDOW\GHYLDWLRQWLPHGXULQJ

VXUYHLOODQFHRI3RZHU5DQJH1HXWURQ)OX[FKDQQHOVLQDFFRUGDQFH

ZLWK65SURYLGHG$)'LVPDLQWDLQHGZLWKLQDFFHSWDEOH

RSHUDWLRQOLPLWV

$33/,&$%,/,7< 02'(ZLWK7+(50$/32:(5!573DQGZLWKWKH2Q/LQH

3RZHU'LVWULEXWLRQ0RQLWRULQJ6\VWHP 23'06 QRWPRQLWRULQJ

SDUDPHWHUV

9(*38QLWVDQG $PHQGPHQW1R 8QLW

$PHQGPHQW1R 8QLW

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 34 January 17, 2019 SVP_SV0_005383 Page 101 of 129 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. As required by Required E.1 Reduce THERMAL 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action C.1 and POWER to < P-10.

referenced in Table 3.3.1-1.

SURVEILLANCE REQUIREMENTS

- NOTE -

Refer to Table 3.3.1-1 to determine which SRs apply for each RTS Function.

SURVEILLANCE FREQUENCY SR 3.3.1.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.1.2 -----------------------------------------------------------------------

1 - NOTES -

1. Adjust nuclear instrument channel in the Protection and Safety Monitoring System (PMS) if absolute difference is > 1% RTP.

2. Required to be met within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 15% RTP.

3. If the calorimetric heat balance is < 70% RTP, and if the nuclear instrumentation channel indicated power is:

a. lower than the calorimetric measurement by

> 1%, then adjust the nuclear instrumentation channel upward to match the calorimetric measurement.

b. higher than the calorimetric measurement, then no adjustment is required.

Compare results of calorimetric heat balance to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months nuclear instrument channel output.

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 35 January 17, 2019 SVP_SV0_005383 Page 102 of 129 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.3.1.3 -----------------------------------------------------------------------

2 - NOTES -

1. $GMXVWWKHFRQYHUVLRQIDFWRU7LQWKH7

power calculation (q 7 ) if absolute difference between q 7 and the calorimetric measurement is > 1% RTP.

2. Required to be met within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 50% RTP.

3. If the calorimetric heat balance is < 70% RTP, and if q 7 is:

a. lower than the calorimetric measurement by

> WKHQDGMXVW7WRPDWFKWKH

calorimetric measurement.

b. higher than the calorimetric measurement, then no adjustment is required.

Compare results of calorimetric heat balance to the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months T power calculation (q 7 ) output.

SR 3.3.1.4 -----------------------------------------------------------------------

3 - NOTES -

1. Adjust nuclear instrument channel in PMS if DEVROXWHGLIIHUHQFHLV 3% AFD.

2. Required to be met within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after reaching 20% RTP.

Compare results of the incore detector measurements 31 effective full to nuclear instrument channel AXIAL FLUX power days DIFFERENCE. (EFPD)

SR 3.3.1.5 -----------------------------------------------------------------------

4 - NOTE -

Required to be met within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after reaching 50% RTP.

Calibrate excore channels to agree with incore 92 EFPD detector measurements.

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 36 January 17, 2019 SVP_SV0_005383 Page 103 of 129 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.3.1.6 Perform COT in accordance with Setpoint Program. 92 days SR 3.3.1.7 -----------------------------------------------------------------------

- NOTE -

Only required to be performed when not performed within previous 92 days.

Perform COT in accordance with Setpoint Program. Prior to reactor startup AND 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after reducing power below P-10 AND 92 days thereafter SR 3.3.1.8 -----------------------------------------------------------------------

5 - NOTE -

This Surveillance shall include verification that the time constants are adjusted to within limits.

Perform CHANNEL CALIBRATION in accordance 24 months with Setpoint Program.

SR 3.3.1.9 -----------------------------------------------------------------------

6 - NOTE -

Neutron detectors are excluded from CHANNEL CALIBRATION.

Perform CHANNEL CALIBRATION in accordance 24 months with Setpoint Program.

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 37 January 17, 2019 SVP_SV0_005383 Page 104 of 129 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.3.1.10 -----------------------------------------------------------------------

7 - NOTE -

Verification of setpoint is not required.

Perform TADOT. 24 months SR 3.3.1.11 -----------------------------------------------------------------------

8 - NOTE -

Neutron detectors are excluded from response time testing.

Verify RTS RESPONSE TIME is within limits. 24 months on a STAGGERED TEST BASIS

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 38 January 17, 2019 SVP_SV0_005383 Page 105 of 129

7HFKQLFDO6SHFLILFDWLRQV 576,QVWUXPHQWDWLRQ

7DEOH SDJHRI

5HDFWRU7ULS6\VWHP,QVWUXPHQWDWLRQ

$33/,&$%/(02'(6

2527+(563(&,),(' 5(48,5(' 6859(,//$1&(

)81&7,21 &21',7,216 &+$11(/6 &21',7,216 5(48,5(0(176

3RZHU5DQJH1HXWURQ)OX[

D +LJK6HWSRLQW ' 65

651 65

656 658 E /RZ6HWSRLQW D ' 65

65

65 6 658

3RZHU5DQJH1HXWURQ)OX[+LJK ' 65

3RVLWLYH5DWH 656 65 8

2YHUWHPSHUDWXUH7 ORRS ' 65

652 653 654 65

655 658

2YHUSRZHU7 ORRS ' 65

652 65 3 65 4 65

65 5 65 8

3UHVVXUL]HU3UHVVXUH

D /RZ6HWSRLQW E ( 65

65

65 5 65 8 E +LJK6HWSRLQW ' 65

65

65 5 65 8

3UHVVXUL]HU:DWHU/HYHO+/-+LJK E ( 65

65

65 5 65 8 D %HORZWKH3 3RZHU5DQJH1HXWURQ)OX[ LQWHUORFNV

E $ERYHWKH3 3RZHU5DQJH1HXWURQ)OX[ LQWHUORFN

9(*38QLWVDQG $PHQGPHQW1R 8QLW

$PHQGPHQW1R 8QLW

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 39 January 17, 2019 SVP_SV0_005383 Page 106 of 129

7HFKQLFDO6SHFLILFDWLRQV 576,QVWUXPHQWDWLRQ

7DEOH SDJHRI

5HDFWRU7ULS6\VWHP,QVWUXPHQWDWLRQ

$33/,&$%/(02'(6

2527+(563(&,),(' 5(48,5(' 6859(,//$1&(

)81&7,21 &21',7,216 &+$11(/6 &21',7,216 5(48,5(0(176

5HDFWRU&RRODQW)ORZ+/-/RZ E SHUKRWOHJ ( 65

652 65

65 5 65 8

5HDFWRU&RRODQW3XPS 5&3 SHU5&3 ' 65

%HDULQJ:DWHU7HPSHUDWXUH+/- 65

+LJK 65 5 65 8

5&36SHHG+/-/RZ E SXPS ( 65

65

65 5 65 8

6WHDP*HQHUDWRU 6* 1DUURZ SHU6* ' 65

5DQJH:DWHU/HYHO+/-/RZ 65

655 65 8

6WHDP*HQHUDWRU 6* 1DUURZ F SHU6* ' 65

5DQJH:DWHU/HYHO+/-+LJK 65

65 5 65 8

3DVVLYH5HVLGXDO+HDW5HPRYDO SHUYDOYH ' 657

$FWXDWLRQ 65 8 E $ERYHWKH3 3RZHU5DQJH1HXWURQ)OX[ LQWHUORFN

F $ERYHWKH3 3UHVVXUL]HU3UHVVXUH LQWHUORFN

9(*38QLWVDQG $PHQGPHQW1R 8QLW

$PHQGPHQW1R 8QLW

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 40 January 17, 2019 SVP_SV0_005383 Page 107 of 129 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Required Action and E.1 Intiate action to fully insert 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months associated Completion all rods.

Time of Condition D not met. AND E.2 Place the Plant Control 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months System in a condition incapable of rod withdrawal.

F. Three or more channels F.1 Open reactor trip breakers Immediately inoperable. (RTBs).

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.2.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 41 January 17, 2019 SVP_SV0_005383 Page 108 of 129 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.3.2.2 -----------------------------------------------------------------------

- NOTES -

1. Only required to be performed when not performed within previous 92 days.

2. Not required to be performed prior to entering MODE 3 from MODE 2 until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after entry into MODE 3.

Perform COT in accordance with Setpoint Program. Prior to reactor startup AND 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after reducing power below P-6 AND 92 days thereafter SR 3.3.2.3 -----------------------------------------------------------------------

1 - NOTE -

Neutron detectors are excluded from CHANNEL CALIBRATION.

Perform CHANNEL CALIBRATION in accordance 24 months with Setpoint Program.

SR 3.3.2.4 -----------------------------------------------------------------------

2 - NOTE -

Neutron detectors are excluded from response time testing.

Verify RTS RESPONSE TIME is within limits. 24 months on a STAGGERED TEST BASIS

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 42 January 17, 2019 SVP_SV0_005383 Page 109 of 129 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.3.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.3.2 -----------------------------------------------------------------------

- NOTE -

Only required to be performed when not performed within previous 92 days.

Perform COT in accordance with Setpoint Program. Prior to reactor startup AND 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after reducing power below P-10 AND 92 days thereafter SR 3.3.3.3 -----------------------------------------------------------------------

1 - NOTE -

Neutron detectors are excluded from CHANNEL CALIBRATION.

Perform CHANNEL CALIBRATION in accordance 24 months with Setpoint Program.

SR 3.3.3.4 -----------------------------------------------------------------------

2 - NOTE -

Neutron detectors are excluded from response time testing.

Verify RTS RESPONSE TIME is within limits. 24 months on a STAGGERED TEST BASIS

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 43 January 17, 2019 SVP_SV0_005383 Page 110 of 129

7HFKQLFDO6SHFLILFDWLRQV 576(6)$6,QVWUXPHQWDWLRQ

$&7,216 FRQWLQXHG

&21',7,21 5(48,5('$&7,21 &203/(7,217,0(

' 5HTXLUHG$FWLRQDQG ' ,QLWLDWHDFWLRQWRIXOO\LQVHUW KRXU

DVVRFLDWHG&RPSOHWLRQ DOOURGV

7LPHRI&RQGLWLRQ&QRW

PHW $1'

25 ' 3ODFHWKH3ODQW&RQWURO KRXU

6\VWHPLQDFRQGLWLRQ

2QHRUPRUH)XQFWLRQV LQFDSDEOHRIURG

ZLWKWKUHHRUPRUH ZLWKGUDZDO

FKDQQHOVLQRSHUDEOHLQ

02'(RU

RTS ESFAS Function the SR applies to.

6859(,//$1&(5(48,5(0(176

127(

5HIHUWR7DEOHWRGHWHUPLQHZKLFK65VDSSO\IRUHDFK576(6)$6)XQFWLRQ

6859(,//$1&( )5(48(1&<

65 3HUIRUP$&78$7,21/2*,&7(67 GD\V

65 9HULI\5765(63216(7,0(LVZLWKLQOLPLW PRQWKVRQD

1 67$**(5('

7(67%$6,6

9(*38QLWVDQG $PHQGPHQW1R 8QLW

$PHQGPHQW1R 8QLW

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 44 January 17, 2019 SVP_SV0_005383 Page 111 of 129

7HFKQLFDO6SHFLILFDWLRQV 576(6)$6,QVWUXPHQWDWLRQ

7DEOH SDJHRI

5HDFWRU7ULS6\VWHP(QJLQHHUHG6DIHW\)HDWXUH$FWXDWLRQ6\VWHP,QVWUXPHQWDWLRQ

$33/,&$%/(02'(625

27+(563(&,),(' 6859(,//$1&(

)81&7,21 &21',7,216 5(48,5('&+$11(/6 5(48,5(0(176

6DIHJXDUGV$FWXDWLRQ,QSXWIURP 65

(QJLQHHUHG6DIHW\)HDWXUH$FWXDWLRQ 65

6\VWHP+/-$XWRPDWLF

$'66WDJHVDQG$FWXDWLRQ,QSXW D D D 65

IURP(QJLQHHUHG6DIHW\)HDWXUH

$FWXDWLRQ6\VWHP+/-$XWRPDWLF

N/A

&RUH0DNHXS7DQN$FWXDWLRQ,QSXW D D D 65

IURP(QJLQHHUHG6DIHW\)HDWXUH

$FWXDWLRQ6\VWHP+/-$XWRPDWLF

D :LWK3ODQW&RQWURO6\VWHPFDSDEOHRIURGZLWKGUDZDORURQHRUPRUHURGVQRWIXOO\LQVHUWHG

9(*38QLWVDQG $PHQGPHQW1R 8QLW

$PHQGPHQW1R 8QLW

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 45 January 17, 2019 SVP_SV0_005383 Page 112 of 129 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.6.1 Perform ACTUATION LOGIC TEST. 92 days There are no SRs.

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 46 January 17, 2019 SVP_SV0_005383 Page 113 of 129

7HFKQLFDO6SHFLILFDWLRQV (6)$6,QVWUXPHQWDWLRQ

6859(,//$1&(5(48,5(0(176 6859(,//$1&( )5(48(1&<

65 3HUIRUP&+$11(/&+(&. KRXUV

65 3HUIRUP&+$11(/23(5$7,21$/7(67 &27 LQ GD\V

DFFRUGDQFHZLWK6HWSRLQW3URJUDP

65

1 127(

7KLVVXUYHLOODQFHVKDOOLQFOXGHYHULILFDWLRQWKDWWKH

WLPHFRQVWDQWVDUHDGMXVWHGWRZLWKLQOLPLWV

3HUIRUP&+$11(/&$/,%5$7,21LQDFFRUGDQFH PRQWKV

ZLWK6HWSRLQW3URJUDP

65

2 127(

1RWDSSOLFDEOHWR)XQFWLRQD

9HULI\(6)5(63216(7,0(LVZLWKLQOLPLW PRQWKVRQD

67$**(5('

7(67%$6,6

9(*38QLWVDQG $PHQGPHQW1R 8QLW

$PHQGPHQW1R 8QLW

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 47 January 17, 2019 SVP_SV0_005383 Page 114 of 129 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.10.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.10.2 Perform CHANNEL OPERATIONAL TEST (COT) in 92 days accordance with Setpoint Program.

SR 3.3.10.3 -----------------------------------------------------------------------

1 - NOTE -

This surveillance shall include verification that the time constants are adjusted to within limits.

Perform CHANNEL CALIBRATION in accordance 24 months with Setpoint Program.

SR 3.3.10.4 Verify ESF RESPONSE TIME is within limit. 24 months on a 2 STAGGERED TEST BASIS

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 48 January 17, 2019 SVP_SV0_005383 Page 115 of 129 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.11.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.11.2 Perform CHANNEL OPERATIONAL TEST (COT) in 92 days accordance with Setpoint Program.

SR 3.3.11.3 -----------------------------------------------------------------------

1 - NOTE -

This surveillance shall include verification that the time constants are adjusted to within limits.

Perform CHANNEL CALIBRATION in accordance 24 months with Setpoint Program.

SR 3.3.11.4 Verify ESF RESPONSE TIME is within limit. 24 months on a 2 STAGGERED TEST BASIS

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 49 January 17, 2019 SVP_SV0_005383 Page 116 of 129 6859(,//$1&(5(48,5(0(176 6859(,//$1&( )5(48(1&<

65 3HUIRUP&+$11(/&+(&. KRXUV 65 3HUIRUP&+$11(/23(5$7,21$/7(67 &27 LQ GD\V DFFRUGDQFHZLWK6HWSRLQW3URJUDP

65

1 127(

7KLVVXUYHLOODQFHVKDOOLQFOXGHYHULILFDWLRQWKDWWKH

WLPHFRQVWDQWVDUHDGMXVWHGWRZLWKLQOLPLWV

3HUIRUP&+$11(/&$/,%5$7,21LQDFFRUGDQFH

PRQWKV ZLWK6HWSRLQW3URJUDP

65 9HULI\(6)5(63216(7,0(LVZLWKLQOLPLW PRQWKVRQD

2 67$**(5('

7(67%$6,6

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 50 January 17, 2019 SVP_SV0_005383 Page 117 of 129 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.14.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.14.2 Perform CHANNEL OPERATIONAL TEST (COT) in 92 days accordance with Setpoint Program.

SR 3.3.14.3 -----------------------------------------------------------------------

1 - NOTE -

This surveillance shall include verification that the time constants are adjusted to within limits.

Perform CHANNEL CALIBRATION in accordance 24 months with Setpoint Program.

SR 3.3.14.4 Verify ESF RESPONSE TIME is within limit. 24 months on a 2 STAGGERED TEST BASIS

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 51 January 17, 2019 SVP_SV0_005383 Page 118 of 129

7HFKQLFDO6SHFLILFDWLRQV (6)$6$FWXDWLRQ/RJLF

+/-2SHUDWLQJ

6859(,//$1&(5(48,5(0(176 6859(,//$1&( )5(48(1&<

65 3HUIRUP$&78$7,21/2*,&7(67RQ(6) GD\VRQD

&RLQFLGHQFH/RJLF 67$**(5('

7(67%$6,6

65 3HUIRUP$&78$7,21/2*,&2873877(67RQ(6) PRQWKV

1 $FWXDWLRQ

65

2 127(

2QO\UHTXLUHGWREHPHWZKHQDOOIRXUFROGOHJ

WHPSHUDWXUHVDUH!)

9HULI\SUHVVXUL]HUKHDWHUFLUFXLWEUHDNHUVWULSRSHQRQ PRQWKV

DQDFWXDORUVLPXODWHGDFWXDWLRQVLJQDO

65 9HULI\UHDFWRUFRRODQWSXPSEUHDNHUVWULSRSHQRQDQ PRQWKV

3 DFWXDORUVLPXODWHGDFWXDWLRQVLJQDO

65 9HULI\PDLQIHHGZDWHUDQGVWDUWXSIHHGZDWHUSXPS PRQWKV

4 EUHDNHUVWULSRSHQRQDQDFWXDORUVLPXODWHGDFWXDWLRQ

VLJQDO

65

5 127(

2QO\UHTXLUHGWREHPHWLQ02'(6DQG

PRQWKV

9HULI\DX[LOLDU\VSUD\DQGSXULILFDWLRQOLQHLVRODWLRQ

YDOYHVDFWXDWHWRWKHLVRODWLRQSRVLWLRQRQDQDFWXDORU

VLPXODWHGDFWXDWLRQVLJQDO

9(*38QLWVDQG $PHQGPHQW1R 8QLW

$PHQGPHQW1R 8QLW

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 52 January 17, 2019 SVP_SV0_005383 Page 119 of 129

7HFKQLFDO6SHFLILFDWLRQV (6)$6$FWXDWLRQ/RJLF

+/-6KXWGRZQ

$&7,216 FRQWLQXHG

&21',7,21 5(48,5('$&7,21 &203/(7,217,0(

' 5HTXLUHG$FWLRQDQG ' 6XVSHQGPRYHPHQWRI ,PPHGLDWHO\

DVVRFLDWHG&RPSOHWLRQ LUUDGLDWHGIXHODVVHPEOLHV

7LPHRI&RQGLWLRQ$QRW

PHWGXULQJPRYHPHQWRI

LUUDGLDWHGIXHO

DVVHPEOLHV

25

2QHRUPRUH)XQFWLRQV

ZLWKLQWZRRUPRUH

UHTXLUHGGLYLVLRQV

LQRSHUDEOHGXULQJ

PRYHPHQWRILUUDGLDWHG

IXHODVVHPEOLHV

6859(,//$1&(5(48,5(0(176 6859(,//$1&( )5(48(1&<

65 3HUIRUP$&78$7,21/2*,&7(67RQ(6) GD\VRQD

&RLQFLGHQFH/RJLF 67$**(5('

7(67%$6,6

65 3HUIRUP$&78$7,21/2*,&2873877(67RQ(6) PRQWKV

1 $FWXDWLRQ

65

2 127(

2QO\UHTXLUHGWREHPHWLQ02'(

9HULI\UHDFWRUFRRODQWSXPSEUHDNHUVWULSRSHQRQDQ PRQWKV

DFWXDORUVLPXODWHGDFWXDWLRQVLJQDO

9(*38QLWVDQG $PHQGPHQW1R 8QLW

$PHQGPHQW1R 8QLW

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 53 January 17, 2019 SVP_SV0_005383 Page 120 of 129

7HFKQLFDO6SHFLILFDWLRQV (6)$6$FWXDWLRQ/RJLF

+/-6KXWGRZQ

6859(,//$1&(5(48,5(0(176 FRQWLQXHG 6859(,//$1&( )5(48(1&<

65

3 127(6

1RWUHTXLUHGWREHPHWLQ02'(DERYHWKH

3 3UHVVXUL]HU/HYHO LQWHUORFN

1RWUHTXLUHGWREHPHWLQ02'(ZLWKZDWHU

OHYHO!IHHWDERYHWKHWRSRIWKHUHDFWRU

YHVVHOIODQJH

9HULI\&96OHWGRZQLVRODWLRQYDOYHVDFWXDWHWRWKH PRQWKV

LVRODWLRQSRVLWLRQRQDQDFWXDORUVLPXODWHGDFWXDWLRQ

VLJQDO

65

4 127(

2QO\UHTXLUHGWREHPHWLQ02'(

9HULI\6SHQW)XHO3RRO&RROLQJ6\VWHPFRQWDLQPHQW PRQWKV

LVRODWLRQYDOYHVDFWXDWHWRWKHLVRODWLRQSRVLWLRQRQDQ

DFWXDORUVLPXODWHGDFWXDWLRQVLJQDO

9(*38QLWVDQG $PHQGPHQW1R 8QLW

$PHQGPHQW1R 8QLW

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 54 January 17, 2019 SVP_SV0_005383 Page 121 of 129 applies SURVEILLANCE REQUIREMENTS

- NOTE -

SR 3.3.17.1 and SR 3.3.17.2 apply to each PAM instrumentation Function in Table 3.3.17-1.

SURVEILLANCE FREQUENCY SR 3.3.17.1 Perform CHANNEL CHECK for each required 31 days instrumentation channel that is normally energized.

SR 3.3.17.2 -----------------------------------------------------------------------

1 - NOTE -

Neutron detectors are excluded from CHANNEL CALIBRATION.

Perform CHANNEL CALIBRATION. 24 months

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 55 January 17, 2019 SVP_SV0_005383 Page 122 of 129 3.3 INSTRUMENTATION 3.3.19 Diverse Actuation System (DAS) Manual Controls LCO 3.3.19 The DAS manual controls for each function in Table 3.3.19-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.19-1.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more manual A.1 Restore DAS manual 30 days DAS controls controls to OPERABLE inoperable. status.

B. Required Action and B.1 Perform SR 3.3.7.1. Once per 31 days on a associated Completion STAGGERED TEST Time of Condition A not BASIS met for inoperable DAS manual reactor trip AND control.

B.2 Restore all controls to Prior to entering OPERABLE status. MODE 2 following next MODE 5 entry C. Required Action and C.1 Perform SRs 3.3.15.1 and Once per 31 days on a associated Completion 3.3.16.1, as applicable. STAGGERED TEST Time of Condition A not BASIS met for inoperable DAS manual actuation AND control other than reactor trip. C.2 Restore all controls to Prior to entering OPERABLE status. MODE 2 following next MODE 5 entry 1

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 56 January 17, 2019 SVP_SV0_005383 Page 123 of 129

7HFKQLFDO6SHFLILFDWLRQV $'6DQG,5:67,QMHFWLRQ

%ORFNLQJ'HYLFH

6859(,//$1&(5(48,5(0(176

127(

5HIHUWR7DEOHWRGHWHUPLQHZKLFK65VDSSO\IRUHDFK$'6DQG,5:67,QMHFWLRQ

%ORFNLQJ'HYLFH)XQFWLRQ

6859(,//$1&( )5(48(1&<

65 3HUIRUP&+$11(/&+(&. KRXUV

65 9HULI\HDFK$'6DQG,5:67,QMHFWLRQ%ORFNVZLWFKLV GD\V

1 LQWKH³XQEORFN'SRVLWLRQ

65 3HUIRUP&+$11(/23(5$7,21$/7(67 &27 LQ GD\V

DFFRUGDQFHZLWK6HWSRLQW3URJUDP

65 3HUIRUP&+$11(/&$/,%5$7,21LQDFFRUGDQFH PRQWKV

2 ZLWK6HWSRLQW3URJUDP

65 3HUIRUP$&78$7,21/2*,&7(67RI$'6DQG PRQWKV

3 ,5:67,QMHFWLRQ%ORFNLQJ'HYLFHV

65

4 127(

9HULILFDWLRQRIVHWSRLQWQRWUHTXLUHG

3HUIRUP75,3$&78$7,1*'(9,&(23(5$7,21$/ PRQWKV

7(67 7$'27 RI$'6DQG,5:67,QMHFWLRQ%ORFN

PDQXDOVZLWFKHV

65 7KHIROORZLQJ65VRI6SHFLILFDWLRQ³&RUH ,QDFFRUGDQFHZLWK

5 0DNHXS7DQNV &07V +/-2SHUDWLQJ'DUHDSSOLFDEOHIRU DSSOLFDEOH65V

HDFK&07

65

9(*38QLWVDQG $PHQGPHQW1R 8QLW

$PHQGPHQW1R 8QLW

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 57 January 17, 2019 SVP_SV0_005383 Page 124 of 129

7HFKQLFDO6SHFLILFDWLRQV $'6DQG,5:67,QMHFWLRQ

%ORFNLQJ'HYLFH

7DEOH SDJHRI

$'6DQG,5:67,QMHFWLRQ%ORFNLQJ'HYLFH

$33/,&$%/(02'(6 5(48,5('

2527+(563(&,),(' &+$11(/63(5 6859(,//$1&(

)81&7,21 &21',7,216 ',9,6,21 5(48,5(0(176

&RUH0DNHXS7DQN/HYHOIRU E 65

D

$XWRPDWLF8QEORFNLQJ 65

652 653 655

$'6DQG,5:67,QMHFWLRQ E 653

%ORFN6ZLWFKHVIRU0DQXDO 654 8QEORFNLQJ

F 651 65 3 654 D 1RWUHTXLUHGWREH23(5$%/(ZLWKDVVRFLDWHGGLYLVLRQDO$'6DQG,5:67,QMHFWLRQ%ORFNVZLWFKLQWKH³XQEORFN'SRVLWLRQ

E :LWKWKH5HDFWRU&RRODQW6\VWHP 5&6 QRWEHLQJFRROHGE\WKH1RUPDO5HVLGXDO+HDW5HPRYDO6\VWHP 516

F :LWKWKH5&6EHLQJFRROHGE\WKH516

9(*38QLWVDQG $PHQGPHQW1R 8QLW

$PHQGPHQW1R 8QLW

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 58 January 17, 2019 SVP_SV0_005383 Page 125 of 129 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.9.3.1 Perform a CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.9.3.2 -----------------------------------------------------------------------

1 - NOTE-Neutron detectors are excluded from CHANNEL CALIBRATION.

Perform CHANNEL CALIBRATION. 24 months

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 59 January 17, 2019 SVP_SV0_005383 Page 126 of 129 5.5 Programs and Manuals 5.5.14 Setpoint Program (SP)

a. The Setpoint Program (SP) implements the regulatory requirement of 10 CFR 50.36(c)(1)(ii)(A) that technical specifications will include items in the category of limiting safety system settings (LSSS), which are settings for automatic protective devices related to those variables having significant safety functions.

b. The Nominal Trip Setpoint (NTS), As-Found Tolerance (AFT), and As-Left Tolerance (ALT) for each Technical Specification required automatic protection instrumentation function shall be calculated in conformance with WCAP-16361-P, Westinghouse Setpoint Methodology for Protection Systems - AP1000, February 2011.

c. For each Technical Specification required automatic protection instrumentation function, performance of a CHANNEL CALIBRATION or CHANNEL OPERATIONAL TEST (COT) surveillance in accordance with the Setpoint Program shall include the following:

1. The as-found value of the instrument channel trip setting shall be compared with the previously recorded as-left value.

i. If the as-found value of the instrument channel trip setting differs from the previously recorded as-left value by more than the pre-defined test acceptance criteria band (i.e., the specified AFT),

then the instrument channel shall be evaluated to verify that it is functioning in accordance with its design basis before declaring the surveillance requirement met and returning the instrument channel to service. An Instrument Channel is determined to be functioning in accordance with its design basis if it can be set to within the ALT.

This as-found condition shall be entered into the plants corrective action program.

ii. If the as-found value of the instrument channel trip setting is less conservative than the specified AFT, the surveillance requirement is not met and the instrument channel shall be immediately declared inoperable.

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 60 January 17, 2019 SVP_SV0_005383 Page 127 of 129 Select Preliminary Vogtle 3 & 4 Technical Specification Bases Markups

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 61 Attachment 1 January 17, 2019 SVP_SV0_005383 Page 128 of 129

7HFKQLFDO6SHFLILFDWLRQV%DVHV 576,QVWUXPHQWDWLRQ

%

%$6(6

$&7,216 FRQWLQXHG

'

&RQGLWLRQ'LVHQWHUHGIURP5HTXLUHG$FWLRQ&ZKHQDQ\5HTXLUHG

$FWLRQDQGDVVRFLDWHG&RPSOHWLRQ7LPHRI&RQGLWLRQ$RU%LVQRWPHWRU

WKUHHRUPRUHFKDQQHOVDUHLQRSHUDEOHIRURQHRUPRUH)XQFWLRQVDQGLWLV

LGHQWLILHGDVWKHDSSURSULDWH&RQGLWLRQUHIHUHQFHGLQ7DEOH,IWKH

FKDQQHO V LVQRWUHVWRUHGWR23(5$%/(VWDWXVRUSODFHGLQWULSRU

E\SDVVDVDSSOLFDEOHZLWKLQWKHDOORZHG&RPSOHWLRQ7LPHRUWKUHHRU

PRUHFKDQQHOVDUHLQRSHUDEOHIRUD)XQFWLRQWKHSODQWPXVWEHSODFHGLQ

02'(6L[KRXUVDUHDOORZHGWRSODFHWKHSODQWLQ02'(7KLVLVD

UHDVRQDEOHWLPHEDVHGRQRSHUDWLQJH[SHULHQFHWRUHDFK02'(IURP

IXOOSRZHULQDQRUGHUO\PDQQHUDQGZLWKRXWFKDOOHQJLQJSODQWV\VWHPV

(

&RQGLWLRQ(LVHQWHUHGIURP5HTXLUHG$FWLRQ&ZKHQDQ\5HTXLUHG

$FWLRQDQGDVVRFLDWHG&RPSOHWLRQ7LPHRI&RQGLWLRQ$RU%LVQRWPHWRU

WKUHHRUPRUHFKDQQHOVIRURQHRUPRUH)XQFWLRQVDUHLQRSHUDEOHDQGLWLV

LGHQWLILHGDVWKHDSSURSULDWH&RQGLWLRQUHIHUHQFHGLQ7DEOH,IWKH

FKDQQHO V LVQRWUHVWRUHGWR23(5$%/(VWDWXVRUSODFHGLQWULSRU

E\SDVVDVDSSOLFDEOHZLWKLQWKHDOORZHG&RPSOHWLRQ7LPHRUWKUHHRU

PRUHFKDQQHOVDUHLQRSHUDEOHIRUD)XQFWLRQWKHUPDOSRZHUPXVWEH

UHGXFHGWREHORZWKH3LQWHUORFNDFRQGLWLRQLQZKLFKWKH/&2GRHV

QRWDSSO\7KHDOORZHG&RPSOHWLRQ7LPHLVUHDVRQDEOHEDVHGRQ

RSHUDWLQJH[SHULHQFHWRUHDFKWKHVSHFLILHGFRQGLWLRQIURPIXOOSRZHU

FRQGLWLRQVLQDQRUGHUO\PDQQHUDQGZLWKRXWFKDOOHQJLQJSODQWV\VWHPV

6859(,//$1&( 7KH65VIRUHDFK576)XQFWLRQDUHLGHQWLILHGLQWKH65VFROXPQRI

5(48,5(0(176 7DEOHIRUWKDW)XQFWLRQ is In lieu of measurement,

the $1RWHKDVEHHQDGGHGWRWKH65WDEOHVWDWLQJWKDW7DEOH

response time for the protection GHWHUPLQHVZKLFK65VDSSO\WRZKLFK576)XQFWLRQV

and safety monitoring system equipment is based on allocated 7KH&+$11(/&$/,%5$7,21DQG&27DUHSHUIRUPHGLQDPDQQHUWKDW

values. The overall response time LVFRQVLVWHQWZLWKWKHDVVXPSWLRQVXVHGLQDQDO\WLFDOO\FDOFXODWLQJWKH

may be determined by a series of UHTXLUHGFKDQQHODFFXUDFLHV)RUFKDQQHOVWKDWLQFOXGHG\QDPLFWUDQVIHU

overlapping tests and allocated IXQFWLRQVVXFKDVODJOHDGODJUDWHODJWKHUHVSRQVHWLPHWHVWPD\EH

values such that the entire SHUIRUPHGZLWKWKHWUDQVIHUIXQFWLRQVHWWRRQHZLWKWKHUHVXOWLQJ

response time is measured PHDVXUHGUHVSRQVHWLPHFRPSDUHGWRWKHDSSURSULDWH)6$5&KDSWHU

UHVSRQVHWLPH 5HI $OWHUQDWHO\WKHUHVSRQVHWLPHWHVWFDQEH

SHUIRUPHGZLWKWKHWLPHFRQVWDQWVVHWWRWKHLUQRPLQDOYDOXHSURYLGHGWKH

UHTXLUHGUHVSRQVHWLPHLVDQDO\WLFDOO\FDOFXODWHGDVVXPLQJWKHWLPH

FRQVWDQWVDUHVHWDWWKHLUQRPLQDOYDOXHV7KHUHVSRQVHWLPHPD\EH

PHDVXUHGE\DVHULHVRIRYHUODSSLQJWHVWVVXFKWKDWWKHHQWLUHUHVSRQVH

WLPHLVPHDVXUHG

9(*38QLWVDQG % 5HYLVLRQ

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

APP-GW-GLR-185, Revision 0 Westinghouse Non-Proprietary Class 3 Page 62 Attachment 1 January 17, 2019 SVP_SV0_005383 Page 129 of 129

7HFKQLFDO6SHFLILFDWLRQV%DVHV 576,QVWUXPHQWDWLRQ

%

%$6(6

6859(,//$1&(5(48,5(0(176 FRQWLQXHG

7KHPRQWK)UHTXHQF\LVEDVHGRQWKHQHHGWRSHUIRUPWKLV

6XUYHLOODQFHXQGHUWKHFRQGLWLRQVWKDWDSSO\GXULQJDSODQWRXWDJHDQGWKH

SRWHQWLDOIRUDQXQSODQQHGWUDQVLHQWLIWKH6XUYHLOODQFHZHUHSHUIRUPHG

ZLWKWKHUHDFWRUDWSRZHU2SHUDWLQJH[SHULHQFHKDVVKRZQWKHVH

FRPSRQHQWVXVXDOO\SDVVWKH6XUYHLOODQFHZKHQSHUIRUPHGRQWKH

PRQWK)UHTXHQF\

65 7 This 65LVWKHSHUIRUPDQFHRID7$'27RIWKH3DVVLYH5HVLGXDO+HDW

5HPRYDO$FWXDWLRQYDOYHSRVLWLRQLQGLFDWRUFRQWDFWLQSXWV7KLV7$'27LV

SHUIRUPHGHYHU\PRQWKV

7KH)UHTXHQF\LVEDVHGRQWKHNQRZQUHOLDELOLW\RIWKH)XQFWLRQDQGWKH

PXOWLFKDQQHOUHGXQGDQF\DYDLODEOHDQGKDVEHHQVKRZQWREH

In lieu of measurement, the DFFHSWDEOHWKURXJKRSHUDWLQJH[SHULHQFH

response time for the protection and safety monitoring

system 7KH65LVPRGLILHGE\D1RWHWKDWH[FOXGHVYHULILFDWLRQRIVHWSRLQWVIURP

equipment is based on allocated WKH7$'277KH)XQFWLRQVDIIHFWHGKDYHQRVHWSRLQWVDVVRFLDWHGZLWK

values. The overall response time WKHP

may be determined by a series of overlapping tests and allocated 65 8 values such that the entire response time is measured 7KLV65YHULILHVWKDWWKHLQGLYLGXDOFKDQQHOGLYLVLRQDFWXDWLRQ

UHVSRQVHWLPHVDUHOHVVWKDQRUHTXDOWRWKHPD[LPXPYDOXHVDVVXPHGLQ

WKHDFFLGHQWDQDO\VLV5HVSRQVH7LPHWHVWLQJFULWHULDDUHLQFOXGHGLQ

5HIHUHQFH

)RUFKDQQHOVWKDWLQFOXGHG\QDPLFWUDQVIHU)XQFWLRQV HJODJOHDGODJ

UDWHODJHWF WKHUHVSRQVHWLPHWHVWPD\EHSHUIRUPHGZLWKWKHWUDQVIHU

)XQFWLRQVHWWRRQHZLWKWKHUHVXOWLQJPHDVXUHGUHVSRQVHWLPHFRPSDUHG

WRWKHDSSURSULDWH)6$5&KDSWHUUHVSRQVHWLPH$OWHUQDWHO\WKH

UHVSRQVHWLPHWHVWFDQEHSHUIRUPHGZLWKWKHWLPHFRQVWDQWVVHWWRWKHLU

Allocations for signal processing QRPLQDOYDOXHSURYLGHGWKHUHTXLUHGUHVSRQVHWLPHLVDQDO\WLFDOO\

FDOFXODWHGDVVXPLQJWKHWLPHFRQVWDQWVDUHVHWDWWKHLUQRPLQDOYDOXHV

and actuation logic response 7KHUHVSRQVHWLPHPD\EHPHDVXUHGE\DVHULHVRIRYHUODSSLQJWHVWV

times may be obtained from the VXFKWKDWWKHHQWLUHUHVSRQVHWLPHLVPHDVXUHG

protection and safety monitoring system functional

requirements. 5HVSRQVHWLPHPD\EHYHULILHGE\DFWXDOUHVSRQVHWLPHWHVWVLQDQ\

VHULHVRIVHTXHQWLDORYHUODSSLQJRUWRWDOFKDQQHOPHDVXUHPHQWVRUE\

WKHVXPPDWLRQRIDOORFDWHGVHQVRUVLJQDOSURFHVVLQJDQGDFWXDWLRQORJLF

UHVSRQVHWLPHVZLWKDFWXDOUHVSRQVHWLPHWHVWVRQWKHUHPDLQGHURIWKH

FKDQQHO$OORFDWLRQVIRUVHQVRUUHVSRQVHWLPHVPD\EHREWDLQHG

IURP KLVWRULFDOUHFRUGVEDVHGRQDFFHSWDEOHUHVSRQVHWLPHWHVWV

K\GUDXOLFQRLVHRUSRZHULQWHUUXSWWHVWV LQSODFHRQVLWHRURIIVLWH

HJYHQGRU WHVWPHDVXUHPHQWVRU XWLOL]LQJYHQGRUHQJLQHHULQJ

9(*38QLWVDQG % 5HYLVLRQ

- - This record was final approved on 1/17/2019 2:04:29 PM. (This statement was added by the PRIME system upon its validation)

PMS TS Surveillance LAR Technical Exchange Meeting January 24, 2019

Meeting Purpose

Discuss the proposed changes to the VEGP 3&4 PMS TS surveillance requirements (SRs)

Discuss preliminary analysis results of application of Westinghouse methodology evaluating each SR type (see handout APP-GW-GLR-185, Preliminary Information to Support NRC Technical Exchange Meeting on Protection and Safety Monitor System Surveillance Reduction)

Receive and address Staff feedback

Agenda

Background

LAR Purpose Statement

Proposed licensing basis

LAR preparation status

Summary

Background

VEGP Units 3 & 4 instrumentation Technical Specifications (TS) based on Standard TS for analog protection systems

Protection and Safety Monitoring System (PMS) uses the Westinghouse Common Q platform which is a digital platform

Westinghouse Common Q NRC-generically approved WCAP-16097-P-A SER describes the Common Q diagnostic features

Background (contd)

Fully leveraging the continuous, self-diagnostic testing features of the PMS digital protection system to reduce the scope/frequency of manual TS surveillance testing would:

Increase safety by lowering operational risk associated with human performance errors

Reduce the duration of how long the PMS is at less than full redundancy

Reduce resources necessary to perform surveillances, and

Save substantial operational costs and still meet regulation

Background (contd)

VEGP 3&4 intends to submit a LAR to revise/eliminate select PMS TS SR manual testing by crediting digital self-diagnostic features

Westinghouse performing analysis to evaluate whether the self-diagnostic features can replace the current surveillance tests

Analysis shows that the self-diagnostics provide continuous coverage

LAR Purpose Statement

Current PMS TS SRs were not designed for a digital protection system

Self-diagnostic capabilities of a digital protection system provide sufficient testing to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met

This allows for elimination and/or reduction of select VEGP TS PMS surveillance tests

PROPOSED LICENSING BASIS 8

Credit PMS Self-diagnosis Crediting continuous self-diagnostic features allow for the elimination of most of the PMS manual surveillance testing required for TS compliance:

Elimination of Channel Check

Elimination of Channel Operational Tests (COTs)

Elimination of Actuation Logic Test (ALT)

Elimination of scope of Response Time Test

PMS SR Testing PMS equipment functionality maintained by:

Remaining manual TS surveillance testing

Continuously running, hardware and software self-diagnostic features

Proposed Technical Specifications (TS)

See separate handout of current TS

LAR PREPARATION STATUS 12

Technical Evaluation Status

Evaluation complete for:

- Channel Check,

- COT,

- ALT, and

- RTT

See handout APP-GW-GLR-185 for details

Technical Evaluation Status Evaluation for Actuation Logic Output Test (ALOT) in progress:

Preliminary results indicate that not all failures are detectable by self-diagnostics

While scope of the ALOT may be reduced, the ALOT will remain for select components

Regulatory Evaluation Status Evaluation for self-diagnostics compliance with regulatory requirements complete:

GDCs 18, 21

Criterion XI, "Test Control," of 10 CFR 50 Appendix B

IEEE 603-1991

IEEE 338-1987

10 CFR 50.36

Summary Proposed VEGP 3&4 TS surveillance testing changes meet regulatory requirements and assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.

Questions & Discussion January 17, 2019 SVP_SV0_005383 Page 1 of 129 January 17, 2019 SVP_SV0_005383 Page 2 of 129 January 17, 2019 SVP_SV0_005383 Page 3 of 129 January 17, 2019 SVP_SV0_005383 Page 4 of 129 January 17, 2019 SVP_SV0_005383 Page 5 of 129 January 17, 2019 SVP_SV0_005383 Page 6 of 129 January 17, 2019 SVP_SV0_005383 Page 7 of 129 Enclosure 2 - Proprietary Information Notice and Copyright Notice PROPRIETARY INFORMATION NOTICE Transmitted herewith are proprietary and non-proprietary versions of a document, furnished to the NRC in connection with requests for generic and/or plant-specific review and approval.

In order to conform to the requirements of 10 CFR 2.390 of the Commissions regulations concerning the protection of proprietary information so submitted to the NRC, the information which is proprietary in the proprietary versions is contained within brackets, and where the proprietary information has been deleted in the non-proprietary versions, only the brackets remain (the information that was contained within the brackets in the proprietary versions having been deleted). The justification for claiming the information so designated as proprietary is indicated in both versions by means of lower case letters (a) through (f) located as a superscript immediately following the brackets enclosing each item of information being identified as proprietary or in the margin opposite such information. These lower case letters refer to the types of information Westinghouse customarily holds in confidence identified in Sections (4)(ii)(a) through (4)(ii)(f) of the Affidavit accompanying this transmittal pursuant to 10 CFR 2.390(b)(1).

COPYRIGHT NOTICE The reports transmitted herewith each bear a Westinghouse copyright notice. The NRC is permitted to make the number of copies of the information contained in these reports which are necessary for its internal use in connection with generic and plant-specific reviews and approvals as well as the issuance, denial, amendment, transfer, renewal, modification, suspension, revocation, or violation of a license, permit, order, or regulation subject to the requirements of 10 CFR 2.390 regarding restrictions on public disclosure to the extent such information has been identified as proprietary by Westinghouse, copyright protection notwithstanding. With respect to the non-proprietary versions of these reports, the NRC is permitted to make the number of copies beyond those necessary for its internal use which are necessary in order to have one copy available for public viewing in the appropriate docket files in the public document room in Washington, DC and in local public document rooms as may be required by NRC regulations if the number of copies submitted is insufficient for this purpose. Copies made by the NRC must include the copyright notice in all instances and the proprietary notice if the original was identified as proprietary.

ML19022A312

Contents

Text

Subject:

Subject:

Subject:

Background

Navigation menu

ML19022A312

Text

Subject:

Subject:

Subject:

Background

Navigation menu

Search