TSTF-19-06, TSTF Comments on Draft Safety Evaluations for Traveler TSTF-569, Revision 1, Revise Response Time Testing Definition

TSTF Comments on Draft Safety Evaluations for Traveler TSTF-569, Revision 1, Revise Response Time Testing Definition

ML19176A034
Person / Time
Site:	Technical Specifications Task Force
Issue date:	06/25/2019
From:	Gullott D, Joyce R, Miksa J, Sparkman W, Vaughan J Technical Specifications Task Force
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
TSTF-19-06
Download: ML19176A034 (109)

Text

TECHNICAL SPECIFICATIONS TASK FORCE TSTF A JOINT OWNERS GROUP ACTIVITY June 25, 2019 TSTF-19-06 PROJ0753 Attn: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

TSTF Comments on Draft Safety Evaluations for Traveler TSTF-569, Revision 1, "Revise Response Time Testing Definition"

REFERENCE:

Letter from Peter J. Snyder (NRC) to the TSTF, "Draft Safety Evaluations of Technical Specifications Task Force Traveler TSTF-569, Revision 1, "Revise Response Time Testing Definition," dated May 29, 2019 (ADAMS Accession No. ML19017A219).

On October 31, 2018, the TSTF submitted traveler TSTF-569, Revision 1, "Revise Response Time Testing Definition," to the Nuclear Regulatory Commission (NRC) for review (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18304A026). In the referenced letter, the NRC provided the draft Safety Evaluations for TSTF-569 for comment.

Attachment 1 contains a summary table providing the TSTF's comments on the draft Safety Evaluations. Attachment 2 contains a mark-up reflecting the TSTF's comments. As described in Attachment 1, TSTF-569 was revised based on NRC comments. Revision 2 of TSTF-569 is enclosed.

Should you have any questions, please do not hesitate to contact us.

James P. Miksa (PWROG/CE) Ryan M. Joyce (BWROG)

David M. Gullott (PWROG/W) Jordan L. Vaughan (PWROG/B&W)

Wesley Sparkman (APOG) 11921 Rockville Pike, Suite 100, Rockville, MD 20852 Phone: 301-984-4400, Fax: 301-984-7600 Administration by EXCEL Services Corporation

TSTF-19-06 June 25, 2019 Page 2 TSTF Comments on the TSTF-569 Draft Safety Evaluations TSTF Markup of Draft Safety Evaluations Enclosure TSTF-569, Revision 2 cc: Michelle Honcharik, Technical Specifications Branch, NRC Peter Snyder, Technical Specifications Branch, NRC Victor Cusumano, Technical Specifications Branch, NRC

TSTF-19-06 June 25, 2019 Page 3 Attachment 1 TSTF Comments on the TSTF-569 Draft Safety Evaluations Comments on the TSTF-569 Traveler Draft Safety Evaluation Page(s) Line(s)1 Comment 1 24, 34, The NUREG-1432 change is to the "engineered safety feature (ESF) 35 response time" definition, not the "engineered safety feature actuation system (ESFAS) response time" definition. The system name is "ESFAS 10 10 Instrumentation," in NUREG-1431 and NUREG-1432, but "ESFAS" is not in the title of the defined term. Reference to "ESF" as the system 13 3 name is incorrect. These errors appeared in some locations in the traveler justification and appear in the draft SE. The traveler justification is 17 42 corrected in the enclosed Revision 2 of the traveler. The recommended changes to the draft SE are shown.

1 4, 12, References to TSTF-569, Revision 1, are changed to TSTF-569, 13, 14, Revision 2 to reflect the enclosed revision. The date and ADAMS 16 number for Revision 2 are unknown and are left to be completed.

2 14, 36 4 40, 41 5 20 7 17, 18, 31, 47, 48, 51 8 1, 6 9 45 10 7, 11, 13 11 9, 13, 28 12 44 13 1, 16, 23, 36 14 3, 22, 41, 47 1

Line numbers correspond to the attached proposed revision, not to the documents provided by the NRC.

Page 3

TSTF-19-06 June 25, 2019 Page 4 Page(s) Line(s)1 Comment 15 7, 12, 35 16 9, 50 17 5, 7, 15, 16, 23, 32, 37 2 20 The draft SE states that components need to be replaced to address increased unreliability issues. That statement does not appear in TSTF-569. TSTF-569 states that obsolete components must be replaced to support continued operation. The recommended changes to the draft SE are shown.

2 31 Recommended wording change for clarity.

3 37, 49 In discussions between the NRC and the TSTF, it was determined that the revised definitions should state, "or the components have been evaluated 4 14, 26 in accordance with an NRC approved methodology," in lieu of "and the components have been evaluated in accordance with an NRC approved methodology." This change is shown in the enclosed Revision 2 of the traveler. The recommended changes to the draft SE are shown.

9 Footnote The TSTF could not confirm the ADAMS accession number for the referenced document. An ADAMS search of the accession number returned no documents.

9 46 Added missing comma.

11 5-6 Revised the quoted text to include missing information from the traveler Attachment 1.

11 10, 12 The word "channel" is missing from the text.

13 28 Recommend adding the word "programmable" for accuracy.

14 20, 43, Recommended revisions for clarity.

44, 50, 51 16 12-20 TSTF-569 lists IEEE Standard 338-1977 as a reference because that version is the licensing basis for most operating plants. Recommend it be added to the SE.

Page 4

TSTF-19-06 June 25, 2019 Page 5 Comments on the TSTF-569 Draft Model Safety Evaluation Page(s) Line(s)1 Comment 1 25, 26 The NUREG-1432 change is to the "engineered safety feature (ESF) response time" definition, not the "engineered safety feature actuation 2 10, 11 system (ESFAS) response time" definition. The system name is "ESFAS Instrumentation," in NUREG-1431 and NUREG-1432, but "ESFAS" is not in the title of the defined term. Reference to "ESF" as the system name is incorrect. These errors appeared in some locations in the traveler justification and appear in the draft SE. The traveler justification is corrected in the enclosed Revision 2 of the traveler. The recommended changes to the draft SE are shown.

1 3, 11, References to TSTF-569, Revision 1, are changed to TSTF-569, 31, 32, Revision 2 to reflect the enclosed revision. The date and ADAMS 34, 37, number for Revision 2 are unknown and are left to be completed.

39, 40 2 30, 32 4 14 6 18 7 8, 20, 22, 28, 29 2 18 The model SE contains a bracketed reference to the "[Technical Requirements Manual or equivalent document]." The model application does not require the licensee to provide the name of the licensee controlled document that contains the RTT acceptance criteria. The traveler simply states that the acceptance criteria are under licensee control without specifying the licensee-controlled document.

Recommend removing the bold, bracketed designation on the phrase to avoid an unnecessary Request for Additional Information to provide the appropriate document name for the plant-specific SE.

3 7, 19, In discussions between the NRC and the TSTF, it was determined that the 42, 43 revised definitions should state, "or the components have been evaluated in accordance with an NRC approved methodology," in lieu of "and the 4 4, 5 components have been evaluated in accordance with an NRC approved methodology." This change is shown in the enclosed Revision 2 of the traveler. The recommended changes to the draft SE are shown.

Page 5

TSTF-19-06 June 25, 2019 Page 6 Page(s) Line(s)1 Comment 6 14, 15 The model SE contains a bracketed statement, "[design criteria GDC 13 or GDC 21 OR plant-specific criteria] are not affected." The traveler does not reference the GDCs and the model application does not require the licensee to state whether the plant is licensed to the GDCs or to a plant-specific equivalent. The SE for the traveler simply states that the plant-specific design criteria are described in the plants Updated Final Safety Analysis Report (UFSAR). Recommend deleting the bold, bracketed designation and stating, "design criteria GDC 13 and GDC 21 or the plant-specific equivalent criteria are not affected." This will avoid an unnecessary Request for Additional Information to provide any plant-specific GDCs, if applicable, for the plant-specific SE.

6 21-29 TSTF-569 lists IEEE Standard 338-1977 as a reference because that version is the licensing basis for most operating plants. Recommend it be added to the SE.

Page 6

TSTF-19-06 June 25, 2019 Attachment 2 TSTF Markup of Draft Safety Evaluations

1 DRAFT SAFETY EVALUATION 2 BY THE OFFICE OF NUCLEAR REACTOR REGULATION 3 TECHNICAL SPECIFICATIONS TASK FORCE TRAVELER 4 TSTF-569, REVISION 21 5 REVISE RESPONSE TIME TESTING DEFINITION 6 USING THE CONSOLIDATED LINE ITEM IMPROVEMENT PROCESS 7 (EPID L-2018-PMP-0002) 8 9

10

1.0 INTRODUCTION

11 12 By letter dated [DATE] October 31, 2018 (Agencywide Documents Access and Management 13 System (ADAMS) Accession No. ML[19XXXXXX]18304A026), the Technical Specifications 14 Task Force (TSTF) submitted Traveler TSTF-569, Revision 21, Revise Response Time Testing 15 Definition, to the U.S. Nuclear Regulatory Commission (NRC). Traveler TSTF-569, 16 Revision 21, proposes changes to the Standard Technical Specifications (STS) for all 17 Westinghouse and Combustion Engineering (CE) plants. These changes would be 18 incorporated into future revisions of NUREG-1431 and NUREG-1432, respectively.1 This 19 traveler would be made available to licensees for adoption through the consolidated line item 20 improvement process.

21 22 The proposed changes would revise technical specification (TS) definitions for engineered 23 safety feature (ESF) response time and reactor trip system (RTS) response time in 24 NUREG-1431, and engineereding safety feature actuation system (ESFAS) response time and 25 reactor protection system (RPS) response time in NUREG-1432, that are referenced in 26 Surveillance Requirements (SRs), hereafter referred to as response time testing (RTT).

27 28

2.0 REGULATORY EVALUATION

29 30

2.1 DESCRIPTION

OF RESPONSE TIME TESTING 31 32 The RTS and RPS initiate a unit shutdown, based on the values of selected unit parameters, to 33 protect against violating the core fuel design limits and the reactor coolant system pressure 34 boundary during anticipated operational occurrences and to assist the ESF and engineered 35 safety feature actuation system (ESFAS) in mitigating accidents. The ESF and ESFAS initiates 36 necessary safety systems, based on the values of selected unit parameters, to protect against 1 U.S. Nuclear Regulatory Commission, Standard Technical Specifications, Westinghouse Plants, NUREG-1431, Revision 4.0, April 2012, Volume 1, Specifications (ADAMS Accession No. ML12100A222), and Volume 2, Bases (ADAMS Accession No. ML12100A228).

U.S. Nuclear Regulatory Commission, Standard Technical Specifications, Combustion Engineering Plants, NUREG-1432, Revision 4.0, April 2012, Volume 1, Specifications (ADAMS Accession No. ML12102A165), and Volume 2, Bases (ADAMS Accession No. ML12102A169).

Enclosure 1

1 violating core design limits and the reactor coolant system pressure boundary, and to mitigate 2 accidents.

3 4 RTT verifies that the individual channel or train actuation response times are less than or equal 5 to the maximum values assumed in the accident analyses. The RTT acceptance criteria are 6 under licensee control. Individual component response times are not modeled in the accident 7 analyses. The analyses model the overall or total elapsed time, from the point at which the 8 parameter exceeds the trip setpoint value at the sensor to the point at which the equipment 9 reaches the required functional state (e.g., control and shutdown rods fully inserted in the 10 reactor core).

11 12 2.2 REASON FOR THE PROPOSED CHANGES 13 14 The TSTF developed traveler TSTF-569, Revision 21, to address concerns with RTT 15 requirements for replacement pressure sensor and protection channel components and defined 16 a standardized methodology that can be referenced in the definitions and analyses 17 requirements for RTT.

18 19 As plant components become obsolete from aging and usage, replacements will be installed to 20 support continued operationaddress increasing unreliability issues. The replacement 21 components oftentimes are not identical to the components being replaced (e.g., replacing 22 pressure transmitters that have analog electronics with pressure transmitters that have digital 23 technology such as microprocessor-based electronics). Currently, for replacement components, 24 NRC-approved topical reports containing the specific manufacturer, model, and other design 25 data along with analyses (e.g., similarity analysis between installed components and 26 replacement components) are utilized to justify an alternative to measured response times.

27 28 The current definitions and analyses requirements for RTT allow for the response time of 29 specific components types to be analyzed (using bounding response times) in lieu of measured 30 response time if the methodology used for ensuring RTT has been approved by the NRC.

31 Because NRC approval is limited to specific models of components, any potential 32 replacement/new components would need to be re-approved by the NRC under the current 33 STS. In effect, this means that the NRCs review and approval is necessary for replacement 34 components and that a supporting analysis is required to justify the action.

35 36 As an explanation for the proposed changes to the STS, TSTF-569, Revision 21, states, in part:

37 38 Response time testing verifies that the individual channel or train actuation 39 response times are less than or equal to the maximum values assumed in the 40 accident analysis. The RTT acceptance criteria are under licensee control, 41 typically in Technical Requirements Manual or equivalent document. Individual 42 component response times are not modeled in the accident analyses. The 43 analysis models the overall or total elapsed time, from the point at which the 44 parameter exceeds the trip setpoint value at the sensor to the point at which the 45 equipment reaches the required functional state (e.g., control and shutdown rods 46 fully inserted in the reactor core).

47 48 49 50 Response time testing is resource intensive, which is why the WOG 51 [Westinghouse Owners Group] and CEOG [Combustion Engineering Owners

1 Group] pursued its elimination as discussed above. RTT is generally performed 2 in discrete steps, with electronic signal conditioning and logic response time 3 being one of the steps. Other components of the total protection system 4 response time include the sensor and the final actuated device response times.

5 The RTT of instrument channels that includes pressure sensors requires different 6 procedures and techniques to be used for measuring the response time of the 7 pressure sensor devices in those instrument channels. As such, pressure sensor 8 RTT took additional time and effort and often involved the use of specialized 9 contractor services. This prompted the industry efforts to develop alternatives to 10 measuring the response time of selected components.

11 12

2.3 PROPOSED CHANGE

S TO THE STANDARD TECHNICAL 13 SPECIFICATIONS 14 15 The traveler proposed to revise the following RTT STS definitions in Section 1.1 of 16 NUREG-1431 and NUREG-1432:

17 18 Engineered Safety Feature (ESF) Response Time (NUREG-1431 and NUREG-1432),

19 Reactor Trip System (RTS) Response Time (NUREG-1431), and 20 Reactor Protection System (RPS) Response Time (NUREG-1432).

21 22 The definitions would be revised to state the following (with changes underlined).

23 24 NUREG-1431 25 26 Engineered Safety Feature (ESF) Response Time 27 28 The ESF RESPONSE TIME shall be that time interval from when the monitored 29 parameter exceeds its actuation setpoint at the channel sensor until the ESF 30 equipment is capable of performing its safety function (i.e., the valves travel to 31 their required positions, pump discharge pressures reach their required values, 32 etc.). Times shall include diesel generator starting and sequence loading delays, 33 where applicable. The response time may be measured by means of any series 34 of sequential, overlapping, or total steps so that the entire response time is 35 measured. In lieu of measurement, response time may be verified for selected 36 components provided that the components and methodology for verification have 37 been previously reviewed and approved by the NRC, and or the components 38 have been evaluated in accordance with an NRC approved methodology.

39 40 Reactor Trip System (RTS) Response Time 41 42 The RTS RESPONSE TIME shall be that time interval from when the monitored 43 parameter exceeds its RTS trip setpoint at the channel sensor until loss of 44 stationary gripper coil voltage. The response time may be measured by means 45 of any series of sequential, overlapping, or total steps so that the entire response 46 time is measured. In lieu of measurement, response time may be verified for 47 selected components provided that the components and methodology for 48 verification have been previously reviewed and approved by the NRC, and or the 49 components have been evaluated in accordance with an NRC approved 50 methodology.

51

1 NUREG-1432 2

3 Engineered Safety Feature (ESF) Response Time 4

5 The ESF RESPONSE TIME shall be that time interval from when the monitored 6 parameter exceeds its ESF actuation setpoint at the channel sensor until the 7 ESF equipment is capable of performing its safety function (i.e., the valves travel 8 to their required positions, pump discharge pressures reach their required values, 9 etc.). Times shall include diesel generator starting and sequence loading delays, 10 where applicable. The response time may be measured by means of any series 11 of sequential, overlapping, or total steps so that the entire response time is 12 measured. In lieu of measurement, response time may be verified for selected 13 components provided that the components and methodology for verification have 14 been previously reviewed and approved by the NRC, and or the components 15 have been evaluated in accordance with an NRC approved methodology.

16 17 Reactor Protection System (RPS) Response Time 18 19 The RPS RESPONSE TIME shall be that time interval from when the monitored 20 parameter exceeds its RPS trip setpoint at the channel sensor until electrical 21 power to the CEAs drive mechanism is interrupted. The response time may be 22 measured by means of any series of sequential, overlapping, or total steps so 23 that the entire response time is measured. In lieu of measurement, response 24 time may be verified for selected components provided that the components and 25 methodology for verification have been previously reviewed and approved by the 26 NRC, and or the components have been evaluated in accordance with an NRC 27 approved methodology.

28 29 The proposed change would be supported by changes to the STS Bases. Similar to the RTT 30 definitions, the STS Bases would state that for components that have been evaluated in 31 accordance with a methodology approved by the NRC, the response time can be verified in lieu 32 of being measured. The proposed change would revise the STS Bases to be consistent with 33 the proposed definition change.

34 35 Currently, these RTT definitions allow the response times for specific NRC-approved 36 component types to be verified using an approved methodology in lieu of being measured. The 37 proposed changes would eliminate the need for prior NRC review and approval of the response 38 time verification of new pressure sensor components (may be used interchangeably with the 39 phrase pressure transmitter within this evaluation due to the usage of these terms in 40 TSTF-569, Revision 21) and protection channel components, while still requiring verification to 41 be performed using the standard methodology contained in TSTF-569, Revision 21, Attachment 42 1, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse 43 Plants only) Response Time Testing. The proposed elimination of periodic pressure sensor 44 RTT would apply to both CE and Westinghouse plants; however, the proposed elimination of 45 periodic protection channel RTT would not apply to CE plants because no previous 46 methodology for such exemptions has been approved by the NRC. The proposed change and 47 methodology would allow licensees to verify the response time of similar/comparable 48 component types to those components being replaced without prior NRC approval for each set 49 of different components being installed.

50

1 2.4 APPLICABLE REGULATORY REQUIREMENTS AND GUIDANCE 2

3 The NRC staff identified the following regulatory requirements and guidance as applicable to the 4 traveler.

5 6 2.4.1 Regulatory Requirements 7

8 Section IV, The Commission Policy, of the Final Policy Statement on Technical Specifications 9 Improvements for Nuclear Power Reactors, published in the Federal Register on July 22, 1993 10 (58 FR 39132), states, in part:

11 12 The purpose of Technical Specifications is to impose those conditions or 13 limitations upon reactor operation necessary to obviate the possibility of an 14 abnormal situation or event giving rise to an immediate threat to the public health 15 and safety by identifying those features that are of controlling importance to 16 safety and establishing on them certain conditions of operation which cannot be 17 changed without prior Commission approval.

18 19 [T]he Commission will also entertain requests to adopt portions of the 20 improved STS [(e.g., TSTF-569, Revision 21)], even if the licensee does not 21 adopt all STS improvements. The Commission encourages all licensees who 22 submit Technical Specification related submittals based on this Policy Statement 23 to emphasize human factors principles.

24 25 In accordance with this Policy Statement, improved STS have been developed 26 and will be maintained for each NSSS [nuclear steam supply system] owners 27 group. The Commission encourages licensees to use the improved STS as the 28 basis for plant-specific Technical Specifications. [I]t is the Commission intent 29 that the wording and Bases of the improved STS be used to the extent 30 practicable.

31 32 As described in the Commissions Final Policy Statement on Technical Specifications 33 Improvements for Nuclear Power Reactors, the NRC and industry task groups for new STS 34 recommended that improvements include greater emphasis on human factors principles in order 35 to add clarity and understanding to the text of the STS, and provide improvements to the Bases 36 of the STS, which provides the purpose for each requirement in the specification. The improved 37 vendor-specific STS were developed and issued by the NRC in September 1992.

38 39 The regulation at Title 10 of the Code of Federal Regulations (10 CFR) Section 50.36(b) 40 requires:

41 42 Each license authorizing operation of a utilization facility will include 43 technical specifications. The technical specifications will be derived from the 44 analyses and evaluation included in the safety analysis report, and amendments 45 thereto, submitted pursuant to [10 CFR] 50.34 [Contents of applications; 46 technical information]. The Commission may include such additional technical 47 specifications as the Commission finds appropriate.

48 49 The regulation at 10 CFR 50.36(a)(1) states, in part: A summary statement of the bases or 50 reasons for such specifications, other than those covering administrative controls, shall also be 51 included in the application, but shall not become part of the technical specifications.

1 2

3 Appendix A to 10 CFR Part 50 provides General Design Criteria (GDC) for nuclear power 4 plants. Plant-specific design criteria are described in the plants Updated Final Safety Analysis 5 Report (UFSAR). The following GDC apply:

6 Criterion 13, Instrumentation and Control, which states that:

7 8 Instrumentation shall be provided to monitor variables and systems over their 9 anticipated ranges for normal operation, for anticipated operational occurrences, 10 and for accident conditions as appropriate to assure adequate safety, including 11 those variables and systems that can affect the fission process, the integrity of 12 the reactor core, the reactor coolant pressure boundary, and the containment 13 and its associated systems. Appropriate controls shall be provided to maintain 14 these variables and systems within prescribed operating ranges.

15 16 Criterion 21, Protection System Reliability and Testability, which states that:

17 18 The protection system shall be designed for high functional reliability and 19 inservice testability commensurate with the safety functions to be performed.

20 Redundancy and independence designed into the protection system shall be 21 sufficient to assure that (1) no single failure results in loss of the protection 22 function and (2) removal from service of any component or channel does not 23 result in loss of the required minimum redundancy unless the acceptable 24 reliability of operation of the protection system can be otherwise demonstrated.

25 The protection system shall be designed to permit periodic testing of its 26 functioning when the reactor is in operation, including a capability to test 27 channels independently to determine failures and losses of redundancy that may 28 have occurred.

29 30 2.4.2 Regulatory Guidance 31 32 The NRC staffs guidance for the review of TSs is in Chapter 16.0, Revision 3, Technical 33 Specifications, of NUREG-0800, Standard Review Plan for the Review of Safety Analysis 34 Reports for Nuclear Power Plants: LWR [Light-Water Reactor] Edition (SRP), March 2010 35 (ADAMS Accession No. ML100351425). As described therein, as part of the regulatory 36 standardization effort, the NRC staff has prepared STS for each of the LWR nuclear designs.

37 Accordingly, the NRC staffs review includes consideration of whether the proposed changes 38 are consistent with the applicable reference STS (i.e., the current STS), as modified by 39 NRC-approved travelers. In addition, the guidance states that comparing the change to 40 previous STS can help clarify the TS intent.

41 42 The STS for Westinghouse plants is NUREG-1431, Revision 4.0, Standard Technical 43 Specifications, Westinghouse Plants, April 2012, Volume 1, Specifications, and Volume 2, 44 Bases.

45 46 The STS for CE plants is NUREG-1432, Revision 4.0, Standard Technical Specifications, 47 Combustion Engineering Plants, April 2012, Volume 1, Specifications, and Volume 2, 48 Bases.

49

1 Regulatory Guide (RG) 1.118, Revision 3, Periodic Testing of Electric Power and Protection 2 Systems, April 1995 (ADAMS Accession No. ML003739468), endorses the Institute of 3 Electrical and Electronics Engineers, Inc. (IEEE) Std. 338-1987, IEEE Standard Criteria for the 4 Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems, which 5 was approved on March 3, 1988, by the American National Standards Institute.

6 7 Branch Technical Position (BTP) 7-17, Guidance on Self-Test and Surveillance Test 8 Provisions, August 2016 (ADAMS Accession No. ML16019A316), states, in part:

9 10 Failures detected by hardware, software, and surveillance testing should be 11 consistent with the failure detectability assumptions of the single-failure analysis 12 and the failure modes and effects analysis.

13 14

3.0 TECHNICAL EVALUATION

15 16 The NRC staff reviewed the proposed changes to the STS, the technical justification for the 17 changes provided in TSTF-569, Revision 21, and the standardized methodology contained in 18 Attachment 1 to TSTF-569, Revision 21.

19 20 The NRC staff reviewed the technical justification for the proposed changes to ensure that the 21 reasoning was logical, complete, and clearly written as described in Chapter 16.0 of 22 NUREG-0800. The NRC staff reviewed the proposed changes for consistency with 23 conventional terminology and with the format and usage rules embodied in the STS. The NRC 24 staff also reviewed the STS changes to ensure that adoption of the traveler by future applicants 25 would provide assurance that an applicants TS would continue to comply with the requirements 26 of 10 CFR 50.36. Finally, the NRC staff reviewed the changes to ensure that any limitations or 27 conditions placed on adoption of the traveler by future applicants were clearly described.

28 29

3.1 PROPOSED CHANGE

S TO THE RESPONSE TIME TESTING DEFINITION 30 31 Traveler TSTF-569, Revision 21, Section 2.1, System Design and Operation, states, in part 32 (emphasis added):

33 34 The following subsections summarize the components and methodology that 35 have been previously reviewed and approved by the NRC. Similar components 36 will be evaluated in accordance with the methodology contained in Attachment 1, 37 to determine if the component response time can be verified, in lieu of measured.

38 39 The NRC staff takes exception to the first sentence because the NRC has not previously 40 reviewed and approved response time analytical methodologies. The NRC previously reviewed 41 and approved equipment-specific topical reports that used Electric Power Research Institute 42 (EPRI) topical report NP-7243, Investigation of Response Time Testing Requirements. The 43 methodology contained in EPRI NP-7243, though, has not been previously approved by the 44 NRC staff.

45 46 The NRC staff finds it acceptable to reference EPRI NP-7243 as part of the technical basis 47 provided for the standardized methodology in Attachment 1 of TSTF-569, Revision 21.

48 However, any approval of TSTF-569, Revision 21, does not constitute the partial or full approval 49 of the methodology contained within EPRI NP-7243. This exception also applies to the 50 Westinghouse Electric Company, LLC (Westinghouse) and CE topical reports referenced in 51 TSTF-569, Revision 2 1, and to similar references to NRC staff approvals of prior

1 methodologies. As previously noted, Attachment 1 to TSTF-569, Revision 21, is the only 2 methodology generically approved by the NRC staff.

3 4 3.1.1 Topical Reports 5

6 Traveler TSTF-569, Revision 21, cites the following topical reports as a supporting technical 7 basis for the standardized methodology described in Attachment 1.

8 9 EPRI NP-7243 10 11 This topical report formed the original basis for subsequent Westinghouse and CE 12 topical reports regarding the elimination of periodic direct measurement RTT for select 13 pressure transmitters. EPRI NP-7243 evaluated a large database of over 14 4,200 response time measurements provided by various licensees and represents a 15 large sample size of various differential transmitters and switches.

16 EPRI NP-7243 analyzed RTT results, testing techniques, and failure trends.

17 EPRI NP-7243 contained failure modes and effects analyses (FMEA) on 17 different 18 sensor types installed in safety-related systems.

19 20 The more significant conclusions derived from EPRI NP-7243 were that no response time 21 failures were found in over 4,200 measurements contained in the database and that of the 22 pressure transmitters that had been replaced due to failure, those failures were detected by 23 routine maintenance activities such as channel checks, surveillance testing, and other forms of 24 instrument calibration. In addition, EPRI NP-7243 found that most of the pressure component 25 failure modes which could affect response times would also affect sensor output, thus making 26 the sensor failure detectable by other required testing. The report concluded that although 27 responses times may have been degraded by the failure(s), RTT wasnt a significant factor in 28 identifying the failures.

29 30 EPRI NP-7243 provided four recommendations that help provide the technical basis for 31 implementing analytical alternatives in lieu of direct measurement RTT:

32 33 1) Perform hydraulic response time test prior to installation of new transmitter/switch or 34 following refurbishment.

35 2) For transmitters and switches that use capillary tubes, RTT should be performed after 36 initial installation and after any maintenance or modification activity that could damage 37 the capillary tubes.

38 3) Perform periodic drift monitoring on all Rosemount pressure and differential pressure 39 transmitters in accordance with Rosemount Technical Bulletins and NRC Bulletin 90-01, 40 Supplement 1, Loss of Fill-Oil in Transmitters Manufactured by Rosemount, 41 December 22, 1992 (affects certain model numbers only) (ADAMS Accession 42 No. ML082490332).

43 4) Assure that variable damping (if used) is at the required setting and cannot be changed 44 or perform hydraulic or white noise RTT of sensor, following each calibration.

45

1 WCAP-13632-P-A, Elimination of Pressure Sensor Response Time Testing Requirements 2

3 The NRC staff approved Westinghouses topical report WCAP-13632-P-A (ADAMS Package 4 Accession No. ML18023A068) for a specific set of transmitters (12 in total) but did not 5 generically approve the methodology contained in the topical report. Topical report 6 WCAP-13632-P-A described a methodology for verifying total instrument response time by a 7 combination of allocated response times for the replacement transmitters and 8 overlapping/sequential actual testing performed on the rest of the instrument channel.

9 Consistent with EPRI NP-7243, WCAP-13632-P-A described that allocated response times for 10 the specific set can be determined through: (1) historical records based on acceptable response 11 time tests (hydraulic, noise, or power interrupt tests), (2) in-place, onsite, or offsite (e.g., vendor) 12 test measurements, or (3) utilizing vendor engineering specifications.

13 14 Topical report WCAP-13632-P-A also documented a similarity analysis that compared the 15 design and functionality of the transmitters evaluated in EPRI NP-7243 to the design and 16 functionality of the transmitters described in WCAP-13632-P-A. In addition to the similarity 17 analysis, an FMEA was performed and additional testing data supplemented areas where 18 similarity between the sets of components could not be adequately demonstrated. The FMEA 19 or additional testing data was used to show that response time would not be significantly 20 affected by equipment degradation or that changes in response time performance of the 21 replacement transmitters would be detectable by a plants calibration procedures in lieu of 22 measurement RTT.

23 24 NPSD-1167-A, Elimination of Pressure Sensor Response Time Testing Requirements 25 26 The NRC staff approved CEOGs topical report NPSD-1167-A for a specific set of pressure 27 sensor components but did not generically approve the methodology contained in 28 NPSD-1167-A. Similar to WCAP-13632-P-A, NPSD-1167-A also leveraged the evaluation 29 methodology described in EPRI NP-7243 including reliance on an FMEA comparison as well as 30 carrying forward the major recommendations from EPRI NP-7243, listed above, with minor 31 changes due to the specific components being evaluated. NPSD-1167-A also described that 32 with respect to allocated response times, there are generally two sources used: (1) data 33 provided by the original equipment manufacturer and (2) statistical analysis of the results of 34 previous RTTs. The NRC staffs safety evaluation of NPSD-1167-A states, in part, that 35 statistical analysis of previous RTT results used to determine allocated response time of 36 replacement components must be:

37 38 sufficiently conservative to ensure that the allocated response time assigned to 39 the sensor will be valid for 95 percent of the population of sensors, with a 40 95 percent confidence level. Methodology for this determination is contained in 41 NUREG-1475, Applying Statistics, April 1994.

42 43 Additional Topical Reports 44 45 Other topical reports cited in TSTF-569, Revision 21, include: WCAP-14036-P-A, Elimination 46 of Periodic Protection Channel Response Time Tests,2 WCAP-15413-A, Westinghouse 7300A 2 Essig, Thomas H., U.S. Nuclear Regulatory Commission, letter to Lou Liberatori, Westinghouse Owners Group, Safety Evaluation Related to Topical Report WCAP-14036, Revision 1, Elimination of Periodic Protection Channel Response Time Tests (TAC No. MA0863), dated October 6, 1998 (ADAMS Accession No. ML100050325).

1 ASIC [Application Specific Integrated Circuit]-Based Replacement Module Licensing Summary 2 Report,3 and WCAP-17867-P-A, Westinghouse SSPS [Solid State Protection System] Board 3 Replacement Licensing Summary Report.4 4

5 The NRC staff evaluated these topical reports and confirmed that they provide additional 6 detailed justification that forms the basis for the methodology in Attachment 1 to TSTF-569, 7 Revision 21. The standardized methodology in Attachment 1 of TSTF-569, Revision 21, is 8 generally consistent with approaches that were used in these previously approved topical 9 reports for specific equipment models. The NRC staff also confirmed that these approaches are 10 relevant as they describe RTS/RPS and ESF/ESFAS systems of different technologies that 11 would be applicable for inclusion under the scope of TSTF-569, Revision 21.

12 13 3.1.2 TSTF-569, Revision 21, Attachment 1 Methodologies 14 15 Methodology 1 16 17 Methodology 1 is dedicated to pressure transmitters for Westinghouse and CE plants, and is 18 described as follows:

19 20 1) If response time measurement data is available, evaluate the measurement 21 data with respect to the results, failure mechanisms, testing techniques, and 22 failure trends. If response time measurement data is available, the review of 23 the data should conclude that no response time failures were identified during 24 RTT. If a pressure transmitter(s) was replaced due to a failure, it should be 25 confirmed that the failure was detected by a channel check or other 26 instrument surveillance testing. It should be concluded that although the 27 response time was degraded by the failure, RTT was not a factor in 28 identifying the failed transmitter.

29 30 2) Perform [an FMEA] on the pressure transmitter to demonstrate that the 31 pressure transmitter component failure modes which can affect the 32 transmitter response time will also affect the transmitter output and therefore, 33 would be detectable by other required surveillance tests.

34 35 3) Identify any exception (i.e., pressure transmitter failure modes that may not 36 be detected by other surveillance tests) and identify specific 37 recommendations to address these exceptions.

38 39 4) Perform a similarity analysis that compares the design and the functionality of 40 the principal components of the pressure transmitter, to the transmitters that 41 were evaluated in EPRI Report NP-7243, WCAP-13632-P-A, or 3 Richards, Stuart A., U.S. Nuclear Regulatory Commission, letter to Michael G. Edison, Westinghouse Owners Group, Review of Westinghouse Topical Report WCAP-15413, 'Westinghouse 7300A ASIC-Based Replacement Module Licensing Summary Report (TAC No. M96513), dated February 8, 2001 (ADAMS Accession No. ML010390526).

4 Mohseni, Aby S., U.S. Nuclear Regulatory Commission, letter to W. Anthony Nowinowski, Pressurized Water Reactor Owners Group, Final Safety Evaluation for Pressurized Water Reactor Owners Group Topical Report WCAP-17867-P, Revision 1, Westinghouse SSPS Board Replacement Licensing Summary Report (TAC No. MF4655), dated September 19, 2014 (ADAMS Package Accession No. ML14260A133).

1 NPSD-1167-A. If the similarity analysis does not confirm the functionality of 2 the principal components of the pressure transmitter, as compared to the 3 transmitters that were evaluated in EPRI Report NP-7243, WCAP-13632-P-A, 4 or NPSD-1167-A, [an] FMEA or additional test data will be used to 5 demonstrate that the response time would not be significantly affected by the 6 degradation of components or that such changes would be detectable by 7 other surveillance tests.

8 9 Consistent with previous topical reports, Attachment 1 to TSTF-569, Revision 21, states that 10 total instrument channel response time is verified by a combination of allocated response times 11 and actual tests (sequential or overlapping measurements) for the rest of the instrument 12 channel. Also consistent with methods used in topical reports cited above, Attachment 1 to 13 TSTF-569, Revision 21, states that the allocated response time values are obtained from the 14 following:

15 16 1) If available, historical records based on acceptable response time tests 17 (hydraulic, noise, or power interrupt tests),

18 19 2) If available, in-place, onsite, or offsite (e.g., vendor) test measurements, or 20 21 3) Utilizing vendor engineering specifications.

22 23 The traveler is clear that this methodology is only applicable to pressure sensors and not to any 24 other type of sensor.

25 26 Methodology 2 27 28 Methodology 2 in Attachment 1 to TSTF-569, Revision 21, is dedicated to protection channels 29 for Westinghouse plants only. This methodology is specific to the electronic signal processing 30 hardware between the primary sensor and the final actuated device within an instrument 31 channel. According to the traveler, this includes analog/digital racks, excore nuclear 32 instrumentation system, and associated solid state and relay trip logic circuitry up to the slave 33 relay output. Consistent with Methodology 1 above, Methodology 2 is specific to 34 electronics/relays between the primary sensor and the final actuated device only and not to any 35 other types of equipment.

36 37 The actions for this methodology are stated as follows:

38 39 1) Analyze the system modules for their function in providing the protection 40 function. System modules which do not contribute to the protection functions, 41 such as modules used only for test or for interface with non-safety systems, 42 will be excluded.

43 44 2) [An FMEA] will be performed on the modules that perform a protection function to 45 determine whether individual component degradation has no impact on the 46 response time or whether the individual component may contribute to the system 47 response time degradation. The FMEA should confirm the following:

48 49 a. Identify any components on the cards and modules that are sensitive to 50 response time, 51

1 b. Evaluate the impact on response time if the component fails or degrades, 2

3 c. Determine whether the degraded component can be detected via a 4 channel calibration, 5

6 d. Identify the components that impact a channel calibration, but not the 7 response time.

8 9 3) If the individual component potentially impacts the system response time, 10 perform testing to determine the magnitude of the response time degradation.

11 12 If required to be performed, the testing, which verifies and further 13 quantifies the results of the FMEA should confirm the following:

14 a. Measure the response time of the calibrated production modules and 15 provide response time base-line data, 16 b. Measure the response time and obtain calibration data for the card or 17 module if the component identified to have an impact on response time 18 is degraded, 19 c. Measure the response time of a simulated protection channel from input 20 to output with the component degraded.

21 22 OR 23 24 Determine a bounding response time limit for the system or component if the 25 individual component does not impact the system response time. The results of 26 the FMEA must conclude that component degradation will not increase the 27 response time beyond the bounding response time without the response time 28 degradation being detected by other periodic surveillance tests, such as channel 29 checks and channel calibrations. [This is an alternative to the actions of Step 3.

30 Steps 1 and 2 are still required.]

31 32 Methodology 2 is applicable to the following systems in Westinghouse plants, consistent with 33 the above-referenced topical reports (e.g., WCAP-14036-P-A):

34 35 7100 Process Protection System (PPS) 36 7300 Process Protection System (PPS) 37 Nuclear Instrumentation System (NIS) 38 Eagle-21 Process Protection System (PPS) 39 Solid State Protection System (SSPS) 40 Relay Protection System (RPS) 41 42 Methodology 2 is not approved for use in non-Westinghouse plants. The NRC staff accepts the 43 stated limitations of applicability for both Methodology 1 and Methodology 2. Applying 44 TSTF-569, Revision 21, methodologies to components outside the stated limitations would 45 require a different methodology and approval for that methodology.

46

1 Section 3.1 of TSTF-569, Revision 21, states, in part, that the topical reports introduced the use 2 of allocated response time as the alternative to direct measurement RTT. In effect, the total 3 response time of an RTS/RPS or ESF/ESFAS instrument channel is the summation of the 4 allocated response time of the transmitter/sensor with the response time of the remainder of the 5 channel. Therefore, according to the traveler, and consistent with approved topical reports, 6 allocated response times for protection channels will be based upon the following sources:

7 8 Historical records based on acceptable RTT (hydraulic, noise, or power interrupt tests) 9 In-place, onsite, or offsite (e.g., vendor) test measurements 10 Utilizing vendor engineering specifications 11 Statistical analysis of the results of previous RTTs 12 13 Additional Considerations for Methodology 1 and Methodology 2 14 15 The following items are considerations that should be included if a licensee chooses to adopt 16 TSTF-569, Revision 21, and the attached methodologies.

17 18 Failure Modes and Effects Analysis 19 20 The NRC staff evaluated the methodologies for potential equipment using digital components 21 and for consistency with NUREG-0800 and BTP 7-17. Modern, digital (or 22 microprocessor-based) components would likely have some form of self-diagnostic or 23 self-testing features. TSTF-569, Revision 21, does not specifically address the potential 24 existence of self-diagnostic or self-testing functionality of replacement components. These 25 design features may factor heavily in their FMEAs and into the determination of failure modes 26 and their mode of detection, ultimately providing insights into whether a failure mode could 27 degrade component response time. Due to the potential presence of microprocessor-based 28 technology, complex programmable logic devices, or other forms of programmable technology, 29 automated self-testing functionality inherent to the replacement components could be an 30 essential tool. The type of self-testing features germane to detecting failures that could affect 31 response timing should be documented as part of the FMEA. Non-specific failure modes that 32 could degrade response time for a component should also be addressed. Non-specific failures 33 are failures that would not necessarily prevent operation of a microprocessor but could affect its 34 performance or reduce its speed of operation, thereby affecting response time (see ADAMS 35 Accession No. ML19031C905 5 for more information). Licensees, when implementing 36 TSTF-569, Revision 21, should consider what self-diagnostic features are incorporated into 37 selected components and how the self-diagnostic features provide detection and alerts for 38 failures unique to those select components and could degrade response time.

39 5 Lacal, Maria L., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, Palo Verde Nuclear Generating Station Units 1, 2, and 3, Supplemental License Amendment Request to Revise Technical Specifications Regarding Response Time Testing of Pressure Transmitters and Request for Additional Information Response, dated January 31, 2019.

1 Similarity Analysis 2

3 Regarding the similarity analysis, Section 3.1 of TSTF-569, Revision 21, stated, in part 4 (emphasis added):

5 6 A successful determination demonstrates that the failure modes associated with 7 the pressure sensor being evaluated would not affect sensor response time 8 independently of sensor output (as concluded in the EPRI report). Thus, in the 9 same manner as the EPRI report, the successful similarity analysis demonstrates 10 that any pressure sensor failures would be detected during the performance of 11 other TS surveillance requirements. If a failure mode(s) could adversely affect 12 response time and would not be detectable by other TS required surveillance, 13 specific recommendations in the EPRI report and Owners Group Topical 14 Reports were applied to eliminate these potential failure modes. In this case, the 15 use of response time verification in lieu of measurement would also be 16 acceptable.

17 18 The NRC staff evaluated whether the methodology contained within the traveler provides 19 adequate coverage for all potential failure modes associated with a particular set or series of 20 pressure transmitter models or protection channel components. Specifically, if there are failure 21 modes that cannot be detected through testing that does not involve direct measurement RTT, 22 the guidance in the Attachment 1 of TSTF-569, Revision 21, evaluation methodology identifies a 23 means of detecting those failures to validate the elimination of direct measurement RTT and to 24 justify the use of bounding or allocated response time verification. In other words, instead of 25 being periodically measured, time response is verified by analysis, with an assumption that any 26 failure of the transmitter that would affect time response would be detectable through other 27 means such as channel checks or calibration surveillances.

28 29 Consistent with WCAP-13632-P-A, where the similarity of two different sets of transmitters 30 cannot be adequately demonstrated, the licensee should address any lack of similarity through 31 an FMEA, additional testing data (e.g., known testing data available for the replacement 32 components), or design information that can be used as a basis for comparison between the 33 different sets of components. This analysis should demonstrate that response time of the 34 replacement components would not be degraded in such a way that would not be detectable by 35 non-measurement RTT.

36 37 EPRI Recommendations 38 39 The NRC staff evaluated the methodology with respect to the four recommendations in 40 EPRI NP-7243 to help ensure adequate operation of pressure transmitters, also referenced in 41 TSTF-569, Revision 21, as well as supporting topical reports. The NRC staff continues to 42 support these recommendations as part of the evaluation of this traveler. It is at the discretion 43 of the licensee to determine whether these recommendations are applicable to the replacement 44 pressure transmittersits situation.

45 46 The NRC staff accepts the general criteria established for both Methodologies 1 and 2 along 47 with the above stated additional considerations by NRC staff. Traveler TSTF-569, Revision 21, 48 adequately demonstrates that the methodologies described in Attachment 1 are consistent with 49 NRC-approved methodologies. In addition, the general criteria established for both 50 methodologies provide a consistent framework that is clear and concise to determine whether 51 RTT can be eliminated for replacement components and provide adequate criteria to develop a

1 technical basis that would be sufficient to justify the elimination of periodic direct measurement 2 RTT.

3 4 Emerging Technologies 5

6 The NRC supports the incorporation of state-of-the-art technologies that improve reliability and 7 overall maintain or improve safety of the components subject to TSTF-569, Revision 21. This 8 traveler and the analyses contained within are germane to current state-of-the-art digital 9 technologies that are common place within the process and control industries, such as 10 microprocessors and commonly used complex programmable logic devices and field 11 programmable gate array technologies. The similarity analysis described within TSTF-569, 12 Revision 21, forms the primary basis by which pressure sensors or protection channels of 13 different vintage or technologic aspects can be compared to determine whether the newer 14 components can replace currently installed components without prior NRC approval.

15 16 Because the traveler is based on currently available technology, there are limitations to which 17 the analysis contained in the traveler can be applied. Emerging future technologies could 18 present significant improvements beyond that which is envisioned now and could result in 19 substantial differences in how the pressure sensor or protection channel performs its design 20 function, calculates and transmits data, etc. As such, this traveler may not be adequate if 21 substantial differences in technologies reduce the ability to perform an adequate similarity 22 analysis, for example. It is understood that the transition from analog instrumentation and 23 control technology to future digital instrumentation and control technologies (e.g., those with 24 little operational experience or unreviewed by the NRC) incorporated into pressure sensor or 25 protection channel components could be considered a substantial difference in technology.

26 27 This traveler includes a methodology for performing a comparison of components of different 28 technology. The most substantial differences between pressure sensor or protection channel 29 technologies are caused by the incorporation of digital technology. If substantial differences in 30 pressure sensor or protection channel technology emerge such as differences in component 31 material and construction, differences in physical design including how the pressure sensor or 32 protection channel performs its design functions, then Attachment 1 may need to be augmented 33 with design-specific evaluation criteria to determine adequacy. This is critical in determining 34 whether a newer methodology is consistent with approved methodologies. Licensees should 35 ensure that the potential limitations of the evaluation methodology in TSTF-569, Revision 21, 36 based upon emerging technologies are addressed as part of the technical evaluation in 37 accordance with Attachment 1 of the traveler.

38 39 Use of Statistical Methods 40 41 Consistent with the past approval of NPSD-1167-A, licensees should ensure that if statistical 42 methods are used, then an adequate technical basis for the statistical analysis through an 43 approved methodology is warranted.

44 45 3.2 REGULATORY ADHERENCE EVALUATION 46 47 The proposed change would eliminate required periodic direct measurement RTT for selected 48 pressure transmitter/sensor and protection channel components but does not eliminate required 49 surveillance testing for the entirety of an instrument channel or the system (e.g., RTS).

50 Therefore, the NRC staff finds that the proposed change is consistent with the surveillance 51 testing requirements of 10 CFR 50.36.

1 2 Most plants have a plant-specific design criterion similar to GDC 13 and GDC 21. The NRC 3 staff confirmed that the proposed change has no effect on the design, fabrication, use, or 4 methods of testing of the instrumentation and will not affect the ability of the instrumentation to 5 perform the functions assumed in the safety analysis. Therefore, compliance with the design 6 criteria is not affected.

7 8 RG 1.118 describes acceptable methods for complying with NRC regulations pertaining to 9 periodic testing of protection systems and power systems. TSTF-569, Revision 21, states the 10 following regarding applicable design criteria:

11 12 Section 6.3.4 of IEEE Standard 338-1977, "Criteria for the Periodic Surveillance 13 Testing of Nuclear Power Generating Station Safety Systems," states response 14 time testing of all safety-related equipment, per se, is not required if, in lieu of 15 response time testing, the response time of safety system equipment is verified 16 by functional testing, calibration check, or other tests, or both. This is acceptable 17 if it can be demonstrated that changes in response time beyond acceptable limits 18 are accompanied by changes in performance characteristics which are 19 detectable during routine periodic tests.

20 21 Clause 6.3.4 of IEEE 338-1987, Criteria for the Periodic Surveillance Testing of 22 Nuclear Power Generating Station Safety Systems, states response time testing 23 shall be required only on safely systems or subsystems to verify that the 24 response times are within the limits given in the Safety Analysis Report including 25 Technical Specifications. Response time testing of all safety-related equipment 26 is not required if, in lieu of response time testing, the response time of safety 27 system equipment is verified by functional testing, calibration checks, or other 28 tests, or both. This is acceptable if it can be demonstrated that changes in 29 response time beyond acceptable limits are accompanied by changes in 30 performance characteristics that are detectable during routine periodic tests.

31 32 Section 5.3.4, Response time verification tests, of IEEE Standard 338-2012, 33 IEEE Standard for Criteria for the Periodic Surveillance Testing of Nuclear 34 Power Generating Station Safety Systems, Item c) states response time testing 35 of all safety-related equipment is not required if, in lieu of response time testing, 36 the response time of safety system equipment is verified by functional testing, 37 calibration checks, or other tests. This is acceptable if it can be demonstrated 38 that changes in response time beyond acceptable limits are accompanied by 39 changes in performance characteristics that are detectable during routine 40 periodic tests.

41 42 The traveler states that system operation, design basis, and capability for testing will remain 43 unchanged as the replacement components comply with the design criteria. The NRC staff 44 finds that the traveler provides an adequate technical basis and that replacement components 45 can continue to perform the same design functions as the original components. The NRC staff 46 finds that the methodologies contained in Attachment 1 provide adequate criteria for ensuring 47 that replacement components degraded response time issues or failures would be captured.

48 Therefore, conformance with IEEE 338-2012 and 338-1987 design criteria is not affected.

49 50 The NRC staff evaluated TSTF-569, Revision 21, for its conformance to the guidance of 51 BTP 7-17. The FMEA criteria in the traveler are consistent with previous failure analyses

1 provided in approved topical reports which are documented in the traveler. The traveler notes 2 that where similarity between components cannot be demonstrated, an FMEA or additional 3 testing data provide assurance that differences in transmitter models that could result in failure 4 modes that could affect response time would be captured. In addition, the methodologies in 5 TSTF-569, Revision 21, Attachment 1, focus the licensee on determining if failure modes that 6 could affect response time are detectable by other required surveillance tests. TSTF-569, 7 Revision 21, does not specifically reference continuous or automatic self-testing or 8 self-diagnostic aspects of potential digital replacement components that would be within this 9 scope although compliance with this guidance is not affected. Self-testing and self-diagnostic 10 capabilities of a particular digital component would likely inform the FMEA as one of the 11 principal means by which a potential failure is detected and alerted to operators. This would be 12 applicable to either Methodology 1 or 2. In addition, as part of the similarity analysis for 13 Methodology 1, an adequate comparison of the design functionality of components would reveal 14 the self-testing features of the replacement components, if they existed. Based upon an 15 evaluation of FMEA criteria described in TSTF-569, Revision 21, the NRC staff finds that 16 TSTF-569, Revision 21, generally conforms to the guidance of BTP 7-17. A licensee that 17 adopts the traveler should also ensure that self-diagnostic features, as described in 18 Section 3.1.2 of this safety evaluation, also conform to BTP 7-19 as part of the analysis 19 conducted in accordance with the Attachment 1 methodology.

20 21

4.0 CONCLUSION

22 23 The NRC staff reviewed traveler TSTF-569, Revision 21, which proposed changes to the STS in 24 NUREG-1431 and NUREG-1432. The NRC staff determined that, with the proposed changes, 25 the STS will continue to meet the Commissions Final Policy Statement on Technical 26 Specifications Improvements for Nuclear Power Reactors and 10 CFR 50.36. Additionally, the 27 changes to the STS were reviewed and found to be technically clear and consistent with 28 customary terminology and format in accordance with SRP Chapter 16.0. The NRC staff 29 reviewed the proposed changes to the definitions and concludes that, with the changes, they 30 continue to provide reasonable assurance and protection of the health and safety of the public.

31 32 The NRC staff has determined that the methodology in Attachment 1 to TSTF-569, Revision 21, 33 is suitable for use by Westinghouse and CE plants to analyze response times for pressure 34 sensor components and for use by Westinghouse plants to analyze response times for 35 protection channel components. The NRC staff has determined that the proposed changes to 36 the STS are acceptable and provide reasonable assurance of safety and that compliance with 37 applicable regulations will be maintained with the adoption of proposed TSTF-569, Revision 21.

38 The requested changes only apply to SRs of individual pressure sensor or protection channel 39 components without affecting plant safety. The NRC staffs conclusion does not include other 40 types of Westinghouse or CE plant components and only applies to the use of pressure sensor 41 and protection channel components in reactor trip systems, reactor protection systems, 42 engineered safety features systems and engineered safety feature actuation systems.

43 44 The NRC staff finds that the proposed traveler meets or is consistent with applicable regulations 45 and associated guidance. Therefore, the NRC staff concludes that the proposed STS changes 46 are acceptable.

47 48 Principal Contributors: C. Tilton, NRR/DSS 49 M. Wendell, NRR/DE 50 51 Date: May 29, 2019

1 General Directions: This Model safety evaluation (SE) provides the format and content to be 2 used when preparing the plant-specific SE of a license amendment request to adopt TSTF-569, 3 Revision 21. The bolded bracketed information shows text that should be filled in for the 4 specific amendment; individual licensees would furnish site-specific nomenclature or values for 5 these bracketed items. The italicized wording provides guidance on what should be included in 6 each section and should not be included in the SE.

7 8 DRAFT MODEL SAFETY EVALUATION 9 BY THE OFFICE OF NUCLEAR REACTOR REGULATION 10 TECHNICAL SPECIFICATIONS TASK FORCE TRAVELER 11 TSTF-569, REVISION 21 12 REVISE RESPONSE TIME TESTING DEFINITION 13 USING THE CONSOLIDATED LINE ITEM IMPROVEMENT PROCESS 14 (EPID [insert EPID number])

15 16 17

1.0 INTRODUCTION

18 19 By application dated [enter date] (Agencywide Documents Access and Management System 20 (ADAMS) Accession No. [MLXXXXXXXXX]), [as supplemented by letters dated [enter 21 date(s) and ADAMS Accession Nos.)), [name of licensee] (the licensee) submitted a license 22 amendment request (LAR) for [name of facility (abbreviated name), applicable units]. The 23 amendment would revise technical specification (TS) definitions for [for Westinghouse-designed 24 plants use: engineered safety feature (ESF) response time and reactor trip system (RTS) 25 response time OR for CE-designed plants use: engineered safety feature (ESF) engineering 26 safety feature actuation system (ESFAS) response time and reactor protection system 27 (RPS) response time] that are referenced in Surveillance Requirements (SRs), hereafter 28 referred to as response time testing (RTT).

29 30 The proposed changes are based on Technical Specifications Task Force (TSTF) traveler 31 TSTF-569, Revision 21, Revise Response Time Testing Definition, dated [enter date]

32 October 31, 2018 (ADAMS Accession No. ML[XXXXXXX]18304A026). The U.S. Nuclear 33 Regulatory Commission (NRC or the Commission) issued a final safety evaluation (SE) 34 approving TSTF-569, Revision 21, on [enter date] (ADAMS Accession No. ML19[XXXXXXX]).

35 36 [The licensee has proposed variations from the TS changes described in TSTF-569, 37 Revision 21. The variations are described in Section [2.2.1] of this SE and evaluated in 38 Section [3.3)). OR [The licensee is not proposing any variations from the TS changes 39 described in TSTF-569, Revision 21, or the applicable parts of the NRC staffs SE of 40 TSTF-569, Revision 21.))

41 42 [The supplemental letter[s] dated [enter date(s)], provided additional information that 43 clarified the application, did not expand the scope of the application as originally 44 noticed, and did not change the NRC staffs original proposed no significant hazards Enclosure 2

1 consideration determination as published in the Federal Register on [enter date] (cite FR 2 reference).]

3 4

2.0 REGULATORY EVALUATION

5 6

2.1 DESCRIPTION

OF RESPONSE TIME TESTING 7

8 The [RTS OR RPS] initiates a unit shutdown, based on the values of selected unit parameters, 9 to protect against violating the core fuel design limits and the reactor coolant system pressure 10 boundary during anticipated operational occurrences and to assist the [ESF OR engineered 11 safety feature actuation system (ESFAS)] in mitigating accidents. The [ESF OR ESFAS]

12 initiates necessary safety systems, based on the values of selected unit parameters, to protect 13 against violating core design limits and the reactor coolant system pressure boundary, and to 14 mitigate accidents.

15 16 RTT verifies that the individual channel or train actuation response times are less than or equal 17 to the maximum values assumed in the accident analyses. The RTT acceptance criteria are 18 under licensee control, in the [Technical Requirements Manual or equivalent document].

19 Individual component response times are not modeled in the accident analyses. The analyses 20 model the overall or total elapsed time, from the point at which the parameter exceeds the trip 21 setpoint value at the sensor to the point at which the equipment reaches the required functional 22 state (e.g., control and shutdown rods fully inserted in the reactor core).

23 24

2.2 PROPOSED CHANGE

S TO THE TECHNICAL SPECIFICATIONS 25 26 The licensee proposed to revise the RTT TS definitions in Section [1.1] of the TS. Specifically, 27 the proposed changes would revise the TS definitions to eliminate the requirement for prior 28 NRC review and approval of the response time verification of new pressure sensor components 29 {NOTE: this may be used interchangeably with the phrase pressure transmitter within this SE 30 due to the usage of these terms in TSTF-569, Revision 21.} and protection channel 31 components, while still requiring verification to be performed using the standard methodology 32 contained in NRC-approved TSTF-569, Revision 21, Attachment 1, Methodology to Eliminate 33 Pressure Sensor and Protection Channel (for Westinghouse Plant only) Response Time 34 Testing. The proposed change would allow the licensee to verify the response time of 35 similar/comparable component types to those components being replaced without prior NRC 36 approval for each set of different components being installed.

37 38 {NOTE: For Westinghouse-designed plants use:}

39 [The proposed change would revise the following TS definitions in Section [1.1]:

40 41 Engineered Safety Feature (ESF) Response Time and 42 Reactor Trip System (RTS) Response Time.

43 44 The definitions would be revised to state the following (with changes underlined):

45 46 Engineered Safety Feature (ESF) Response Time 47 48 The ESF RESPONSE TIME shall be that time interval from when the 49 monitored parameter exceeds its actuation setpoint at the channel sensor 50 until the ESF equipment is capable of performing its safety function (i.e.,

51 the valves travel to their required positions, pump discharge pressures

1 reach their required values, etc.). Times shall include diesel generator 2 starting and sequence loading delays, where applicable. The response 3 time may be measured by means of any series of sequential, overlapping, 4 or total steps so that the entire response time is measured. In lieu of 5 measurement, response time may be verified for selected components 6 provided that the components and methodology for verification have been 7 previously reviewed and approved by the NRC, and or the components 8 have been evaluated in accordance with an NRC approved methodology.

9 10 Reactor Trip System (RTS) Response Time 11 12 The RTS RESPONSE TIME shall be that time interval from when the 13 monitored parameter exceeds its RTS trip setpoint at the channel sensor 14 until loss of stationary gripper coil voltage. The response time may be 15 measured by means of any series of sequential, overlapping, or total steps 16 so that the entire response time is measured. In lieu of measurement, 17 response time may be verified for selected components provided that the 18 components and methodology for verification have been previously 19 reviewed and approved by the NRC, and or the components have been 20 evaluated in accordance with an NRC approved methodology.]

21 22 {NOTE: For CE-designed plants use:}

23 The proposed change would revise the following TS definitions in Section [1.1]:

24 25 Engineered Safety Feature (ESF) Response Time and 26 Reactor Protection System (RPS) Response Time.

27 28 The definitions would be revised to state the following (with changes underlined):

29 30 Engineered Safety Feature (ESF) Response Time 31 32 The ESF RESPONSE TIME shall be that time interval from when the 33 monitored parameter exceeds its ESF actuation setpoint at the channel 34 sensor until the ESF equipment is capable of performing its safety function 35 (i.e., the valves travel to their required positions, pump discharge 36 pressures reach their required values, etc.). Times shall include diesel 37 generator starting and sequence loading delays, where applicable. The 38 response time may be measured by means of any series of sequential, 39 overlapping, or total steps so that the entire response time is measured. In 40 lieu of measurement, response time may be verified for selected 41 components provided that the components and methodology for 42 verification have been previously reviewed and approved by the NRC, and 43 or the components have been evaluated in accordance with an NRC 44 approved methodology.

45 46 Reactor Protection System (RPS) Response Time 47 48 The RPS RESPONSE TIME shall be that time interval from when the 49 monitored parameter exceeds its RPS trip setpoint at the channel sensor 50 until electrical power to the CEAs drive mechanism is interrupted. The 51 response time may be measured by means of any series of sequential,

1 overlapping, or total steps so that the entire response time is measured. In 2 lieu of measurement, response time may be verified for selected 3 components provided that the components and methodology for 4 verification have been previously reviewed and approved by the NRC, and 5 or the components have been evaluated in accordance with an NRC 6 approved methodology.]

7 8 The proposed change would be supported by changes to the TS Bases. Similar to the RTT 9 definitions, the Bases would state that for components that have been evaluated in accordance 10 with a methodology approved by the NRC, the response time can be verified in lieu of being 11 measured. The proposed change would revise the Bases to be consistent with the proposed 12 definition change.

13 14 [2.2.1 Variations from TSTF-569, Revision 21 15 16 Insert description of any variations here.]

17 18 2.3 APPLICABLE REGULATORY REQUIREMENTS AND GUIDANCE 19 20 Title 10 of the Code of Federal Regulations (10 CFR) Section 50.36(a)(1) requires each 21 applicant for a license authorizing operation of a utilization facility to include in the application 22 proposed TSs.

23 24 The regulation at 10 CFR 50.36(b) states that:

25 26 The technical specifications will be derived from the analyses and evaluation 27 included in the safety analysis report, and amendments thereto, submitted 28 pursuant to [10 CFR] 50.34 [Contents of applications; technical information].

29 The Commission may include such additional technical specifications as the 30 Commission finds appropriate.

31 32 The regulation at 10 CFR 50.40(a) states, in part, that the TSs shall provide reasonable 33 assurance that the health and safety of the public will not be endangered.

34 35 Appendix A to 10 CFR Part 50 provides General Design Criteria (GDC) for nuclear power 36 plants. Plant-specific design criteria are described in the plants Updated Final Safety Analysis 37 Report (UFSAR).

38 The regulation at 10 CFR Part 50, Appendix A, GDC 13, Instrumentation and Control, states:

39 40 Instrumentation shall be provided to monitor variables and systems over their 41 anticipated ranges for normal operation, for anticipated operational occurrences, 42 and for accident conditions as appropriate to assure adequate safety, including 43 those variables and systems that can affect the fission process, the integrity of 44 the reactor core, the reactor coolant pressure boundary, and the containment 45 and its associated systems. Appropriate controls shall be provided to maintain 46 these variables and systems within prescribed operating ranges.

47

1 The regulation at 10 CFR Part 50, Appendix A, GDC 21, Protection System Reliability and 2 Testability, states:

3 4 The protection system shall be designed for high functional reliability and 5 inservice testability commensurate with the safety functions to be performed.

6 Redundancy and independence designed into the protection system shall be 7 sufficient to assure that (1) no single failure results in loss of the protection 8 function and (2) removal from service of any component or channel does not 9 result in loss of the required minimum redundancy unless the acceptable 10 reliability of operation of the protection system can be otherwise demonstrated.

11 The protection system shall be designed to permit periodic testing of its 12 functioning when the reactor is in operation, including a capability to test 13 channels independently to determine failures and losses of redundancy that may 14 have occurred.

15 16 The NRC staffs guidance for the review of TSs is in Chapter 16.0, Revision 3, Technical 17 Specifications, of NUREG-0800, Standard Review Plan for the Review of Safety Analysis 18 Reports for Nuclear Power Plants: LWR [Light-Water Reactor] Edition (SRP), March 2010 19 (ADAMS Accession No. ML100351425). As described therein, as part of the regulatory 20 standardization effort, the NRC staff has prepared Standard Technical Specifications (STS) for 21 each of the LWR nuclear designs. Accordingly, the NRC staffs review includes consideration of 22 whether the proposed changes are consistent with the applicable reference STS, as modified by 23 NRC-approved travelers. The STS applicable to [abbreviated name of facility] is 24 25 {NOTE: Choose applicable STS}

26 [NUREG-1431, Revision 4.0, Standard Technical Specifications, Westinghouse Plants, 27 April 2012, Volume 1, Specifications (ADAMS Accession No. ML12100A222), and 28 Volume 2, Bases (ADAMS Accession No. ML12100A228).

29 30 NUREG-1432, Revision 4.0, Standard Technical Specifications, Combustion Engineering 31 Plants, April 2012, Volume 1, Specifications (ADAMS Accession No. ML12102A165),

32 and Volume 2, Bases (ADAMS Accession No. ML12102A169).]

33 34 Regulatory Guide (RG) 1.118, Revision 3, Periodic Testing of Electric Power and Protection 35 Systems, April 1995 (ADAMS Accession No. ML003739468), endorses the Institute of 36 Electrical and Electronics Engineers, Inc. (IEEE) Std. 338-1987, IEEE Standard Criteria for the 37 Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems, which 38 was approved on March 3, 1988, by the American National Standards Institute.

39 40 Branch Technical Position (BTP) 7-17, Guidance on Self-Test and Surveillance Test 41 Provisions, August 23, 2016 (ADAMS Accession No. ML16019A316), states, in part:

42 43 Failures detected by hardware, software, and surveillance testing should be 44 consistent with the failure detectability assumptions of the single-failure analysis 45 and the failure modes and effects analysis.

46

1

3.0 TECHNICAL EVALUATION

2 3

3.1 PROPOSED CHANGE

S TO THE RESPONSE TIME TESTING DEFINITION 4

5 The proposed change to TS Section [1.1] would eliminate required direct measurement RTT for 6 selected [For CE plants: pressure transmitter/sensor OR for Westinghouse plants: pressure 7 transmitter/sensor and protection channel] components but does not eliminate required 8 surveillance testing for the entirety of an instrument channel or the system as a whole (e.g.,

9 RTS). Therefore, the NRC staff finds that the proposed change is consistent with the 10 surveillance testing requirements of 10 CFR 50.36.

11 12 The NRC staff confirmed that the proposed change has no effect on the design, fabrication, use, 13 or methods of testing of the instrumentation and will not affect the ability of the instrumentation 14 to perform the functions assumed in the safety analysis. Therefore, compliance with the [design 15 criteria GDC 13 and GDC 21 OR or the plant-specific equivalent criteria] is not affected.

16 17 RG 1.118, Revision 3, describes acceptable methods for complying with NRC regulations 18 pertaining to periodic testing of protection systems and power systems. TSTF-569, Revision 21, 19 states the following regarding applicable design criteria:

20 21 Section 6.3.4 of IEEE Standard 338-1977, "Criteria for the Periodic Surveillance 22 Testing of Nuclear Power Generating Station Safety Systems," states response 23 time testing of all safety-related equipment, per se, is not required if, in lieu of 24 response time testing, the response time of safety system equipment is verified 25 by functional testing, calibration check, or other tests, or both. This is acceptable 26 if it can be demonstrated that changes in response time beyond acceptable limits 27 are accompanied by changes in performance characteristics which are 28 detectable during routine periodic tests.

29 30 Clause 6.3.4 of IEEE 338-1987, "Criteria for the Periodic Surveillance Testing of 31 Nuclear Power Generating Station Safety Systems," states response time testing 32 shall be required only on safely systems or subsystems to verify that the 33 response times are within the limits given in the Safety Analysis Report including 34 Technical Specifications. Response time testing of all safety-related equipment is 35 not required if, in lieu of response time testing, the response time of safety 36 system equipment is verified by functional testing, calibration checks, or other 37 tests, or both. This is acceptable if it can be demonstrated that changes in 38 response time beyond acceptable limits are accompanied by changes in 39 performance characteristics that are detectable during routine periodic tests.

40 41 Section 5.3.4, "Response time verification tests," of IEEE Standard 338-2012, 42 "IEEE Standard for Criteria for the Periodic Surveillance Testing of Nuclear 43 Power Generating Station Safety Systems," Item c) states response time testing 44 of all safety-related equipment is not required if, in lieu of response time testing, 45 the response time of safety system equipment is verified by functional testing, 46 calibration checks, or other tests. This is acceptable if it can be demonstrated 47 that changes in response time beyond acceptable limits are accompanied by 48 changes in performance characteristics that are detectable during routine 49 periodic tests.

50

1 The traveler states that system operation, design basis, and capability for testing will remain 2 unchanged as the replacement components comply with these design criteria. The NRC staff 3 found that the traveler provided an adequate technical basis and that replacement components 4 can continue to perform the same design functions as the original components. The NRC staff 5 found that the methodologies contained in Attachment 1 to the traveler provide adequate criteria 6 for ensuring that replacement components degraded response time issues or failures would be 7 captured. Therefore, conformance with IEEE 338-2012 and 338-1987 design criteria is not 8 affected, since the licensee is adopting TSTF-569, Revision 21.

9 10 3.2

SUMMARY

11 12 The NRC staff reviewed the proposed changes against the regulations and determined that, 13 with the proposed changes, the TS will continue to meet the requirements of 10 CFR 50.36(b) 14 and, consistent with 10 CFR 50.40, will continue to provide reasonable assurance that the 15 health and safety of the public will not be endangered. Additionally, the NRC staff determined 16 that the proposed changes are technically clear and consistent with customary terminology and 17 format in accordance with SRP Chapter 16.0. Therefore, the NRC staff concludes that the 18 proposed changes are acceptable.

19 20 [3.3 VARIATIONS FROM TSTF-569, REVISION 21 21 22 The licensee described variations from TSTF-569, Revision 21, in Section [2.2] of the 23 LAR. The licensee provided justification for the proposed variations. The NRC staff 24 reviewed the justifications and determined that the variations are [not] acceptable 25 because.

26 27 The [Name of facilitys] TSs utilize different [numbering][and][titles] than the STS on 28 which TSTF-569, Revision 21, was based. The NRC staff determined that these 29 differences are editorial and do not affect the applicability of TSTF-569, Revision 21, to 30 the proposed LAR.]

31 32

4.0 STATE CONSULTATION

33 34 {This section is to be prepared by the plant project manager.}

35 36 In accordance with the Commissions regulations, the [Name of State] State official was notified 37 of the proposed issuance of the amendment(s) on [date]. The State official had [no]

38 comments. [If comments were provided, they should be addressed here.]

39 40

5.0 ENVIRONMENTAL CONSIDERATION

41 42 {This section is to be prepared by the plant project manager in accordance with current 43 procedures.}

44 45

6.0 CONCLUSION

46 47 {This section is to be prepared by the plant project manager.}

48 49 The Commission has concluded, based on the considerations discussed above, that: (1) there 50 is reasonable assurance that the health and safety of the public will not be endangered by 51 operation in the proposed manner, (2) there is reasonable assurance that such activities will be

1 conducted in compliance with the Commissions regulations, and (3) the issuance of the 2 amendment(s) will not be inimical to the common defense and security or to the health and 3 safety of the public.

4 5 Principal Contributors: [PM Name, NRR/DORL 6 C. Tilton, NRR/DSS]

7 8 Date: May 29, 2019

TSTF-19-06 June 25, 2019 Enclosure TSTF-569, Revision 2

WOG-224, Rev. 0 TSTF-569, Rev. 2 Technical Specifications Task Force Improved Standard Technical Specifications Change Traveler Revise Response Time Testing Definition NUREGs Affected: 1430 1431 1432 1433 1434 2194 Classification: 1) Technical Change Recommended for CLIIP?: Yes Correction or Improvement: Improvement NRC Fee Status: Not Exempt Changes Marked on ISTS Rev 4.0 See attached.

Revision History OG Revision 0 Revision Status: Closed Revision Proposed by: PWROG Revision

Description:

Original Issue Owners Group Review Information Date Originated by OG: 30-Aug-17 Owners Group Comments (No Comments)

Owners Group Resolution: Approved Date: 27-Sep-17 TSTF Review Information TSTF Received Date: 27-Sep-17 Date Distributed for Review 27-Sep-17 TSTF Comments:

Presubmittal meeting held with NRC on 11/30/2017.

TSTF Resolution: Approved Date: 31-Oct-17 NRC Review Information NRC Received Date: 08-Feb-18 NRC Comments:

Traveler to be revised based on the NRC's May 21, 2018 Request for Additional Information as clarified by a public teleconference held on July 17, 2018.

Final Resolution: NRC Requests Changes: TSTF Will Revise Final Resolution Date: 21-May-18 TSTF Revision 1 Revision Status: Closed Revision Proposed by: PWROG 25-Jun-19 Copyright(C) 2019, EXCEL Services Corporation. Use by EXCEL Services associates, utility clients, and the U.S. Nuclear Regulatory Commission is granted. All other use without written permission is prohibited.

WOG-224, Rev. 0 TSTF-569, Rev. 2 TSTF Revision 1 Revision Status: Closed Revision

Description:

Revision 1 is a complete replacement of the traveler based on the NRC's May 21, 2018 Request for Additional Information as clarified by a public teleconference held on July 17, 2018.

Owners Group Review Information Date Originated by OG: 01-Oct-18 Owners Group Comments (No Comments)

Owners Group Resolution: Approved Date: 15-Oct-18 TSTF Review Information TSTF Received Date: 15-Oct-18 Date Distributed for Review 15-Oct-18 TSTF Comments:

(No Comments)

TSTF Resolution: Approved Date: 30-Oct-18 NRC Review Information NRC Received Date: 31-Oct-18 NRC Comments:

NRC and industry agreed to revise definition insert to join new option with an "or" instead of "and."

Final Resolution: NRC Requests Changes: TSTF Will Revise TSTF Revision 2 Revision Status: Active Revision Proposed by: NRC Revision

Description:

NRC and industry agreed to revise definition insert to join new option with an "or" instead of "and."

The justification was revised to use the term "ESF" only with the "ESF Response Time" definition change, and the term "ESFAS" to describe the instrumentation system.

Owners Group Review Information Date Originated by OG: 11-Jun-19 Owners Group Comments (No Comments)

Owners Group Resolution: Approved Date: 25-Jun-19 TSTF Review Information TSTF Received Date: 11-Jun-19 Date Distributed for Review 11-Jun-19 TSTF Comments:

25-Jun-19 Copyright(C) 2019, EXCEL Services Corporation. Use by EXCEL Services associates, utility clients, and the U.S. Nuclear Regulatory Commission is granted. All other use without written permission is prohibited.

WOG-224, Rev. 0 TSTF-569, Rev. 2 TSTF Revision 2 Revision Status: Active (No Comments)

TSTF Resolution: Approved Date: 25-Jun-19 NRC Review Information NRC Received Date: 25-Jun-19 Affected Technical Specifications 1.1 Definitions NUREG(s)- 1431 Only Change

Description:

RTS Response Time 1.1 Definitions NUREG(s)- 1431 Only Change

Description:

ESF Response Time SR 3.3.1.16B Bases RTS Instrumentation (With Setpoint Control Program) NUREG(s)- 1431 Only SR 3.3.1.16A Bases RTS Instrumentation (Without Setpoint Control Program) NUREG(s)- 1431 Only SR 3.3.2.10B Bases ESFAS Instrumentation (With Setpoint Control Program) NUREG(s)- 1431 Only SR 3.3.2.10A Bases ESFAS Instrumentation (Without Setpoint Control Program) NUREG(s)- 1431 Only 1.1 Definitions NUREG(s)- 1432 Only Change

Description:

RPS Response Time 1.1 Definitions NUREG(s)- 1432 Only Change

Description:

ESF Response Time SR 3.3.1.9B Bases RPS Instrumentation - Operating (Analog) (With Setpoint NUREG(s)- 1432 Only Control Program)

SR 3.3.1.9A Bases RPS Instrumentation - Operating (Analog) (Without Setpoint NUREG(s)- 1432 Only Control Program)

SR 3.3.1.14B RPS Instrumentation - Operating (Digital) (With Setpoint Control NUREG(s)- 1432 Only Program)

SR 3.3.1.14A RPS Instrumentation - Operating (Digital) (Without Setpoint NUREG(s)- 1432 Only Control Program)

SR 3.3.4.5B Bases ESFAS Instrumenation (Analog) (With Setpoint Control NUREG(s)- 1432 Only Program)

SR 3.3.4.5A Bases ESFAS Instrumenation (Analog) (Without Setpoint Control NUREG(s)- 1432 Only Program) 25-Jun-19 Copyright(C) 2019, EXCEL Services Corporation. Use by EXCEL Services associates, utility clients, and the U.S. Nuclear Regulatory Commission is granted. All other use without written permission is prohibited.

WOG-224, Rev. 0 TSTF-569, Rev. 2 SR 3.3.5.4B Bases ESFAS Instrumenation (Digital) (With Setpoint Control Program) NUREG(s)- 1432 Only SR 3.3.5.4A Bases ESFAS Instrumenation (Digital) (Without Setpoint Control NUREG(s)- 1432 Only Program) 25-Jun-19 Copyright(C) 2019, EXCEL Services Corporation. Use by EXCEL Services associates, utility clients, and the U.S. Nuclear Regulatory Commission is granted. All other use without written permission is prohibited.

TSTF-569, Rev. 2

1.

SUMMARY

DESCRIPTION NUREG-1431, "Standard Technical Specifications - Westinghouse Plants," and NUREG-1432, "Standard Technical Specifications - Combustion Engineering Plants," contain definitions for Engineered Safety Feature (ESF) Response Time and Reactor Trip System (RTS) Response Time, and Engineereding Safety Feature Actuation System (ESFAS) Response Time and Reactor Protection System (RPS) Response Time, respectively, that are referenced in Surveillance Requirements (SRs), hereafter referred to as Response Time Testing (RTT). These definitions allow the response times for specific NRC-approved component types to be verified in lieu of being measured provided that the components and methodology for verification have been previously reviewed and approved by the NRC. The proposed change revises the definitions to eliminate the requirement for prior NRC review and approval of the response time verification of similar components, while retaining the requirement for the verification to be performed using the methodology contained in Attachment 1, titled, "Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only) Response Time Testing." The proposed change will permit licensees to verify the response time of similar component types using the methodology contained in Attachment 1, without obtaining prior NRC approval for each component.

2. DETAILED DESCRIPTION 2.1. System Design and Operation The RTS and RPS initiate a unit shutdown, based on the values of selected unit parameters, to protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (AOOs) and to assist the engineered safety feature actuation system (ESFAS) Engineered Safety Features (ESF) Systems in mitigating accidents. The ESF and ESFAS initiates necessary safety systems, based on the values of selected unit parameters, to protect against violating core design limits and the RCS pressure boundary, and to mitigate accidents.

Response Time Testing verifies that the individual channel or train actuation response times are less than or equal to the maximum values assumed in the accident analysis. The RTT acceptance criteria are under licensee control, typically in Technical Requirements Manual or equivalent document. Individual component response times are not modeled in the accident analyses. The analysis models the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the equipment reaches the required functional state (e.g., control and shutdown rods fully inserted in the reactor core).

The following subsections summarize the components and methodology that have been previously reviewed and approved by the NRC. Similar components will be evaluated in accordance with the methodology contained in Attachment 1, to determine if the component response time can be verified, in lieu of measured.

Page 1

TSTF-569, Rev. 2 2.1.1. Pressure Sensors Electric Power Research Institute (EPRI) Topical Report EPRI Report NP-7243, "Investigation of Response Time Testing Requirements," (Reference 1) evaluated the response time test data for various pressure sensors to determine whether RTT must be performed to justify those assumptions in the safety analyses chapter (typically Chapter

15) of the Final Safety Analysis Report (FSAR). The EPRI report reviewed a RTT database of greater than 4200 response time measurements that were provided by 39 nuclear power plants representing over 2100 different pressure and differential pressure transmitters and switches.

The measurement data was entered in a computer database designed to permit analyses of sensor types, RTT results, failure mechanisms, testing techniques, and failure trends. In addition to the evaluation of the measurement data collected, the EPRI report included the results of failure modes and effects analysis (FMEA) performed for 17 different sensor types that were considered to represent the majority of pressure sensor instrumentation currently installed or expected to be installed in safety-related systems in U.S. plants.

With respect to the RTT database review, the EPRI report stated that, "No response time failures were found in the over 4200 measurements contained in the database." The EPRI report also found that; "The plant data indicated that several pressure transmitters had been replaced due to failure. However, these failures were detected by a channel check, surveillance testing, or other instrument calibration. Although response times may have been degraded by the failure, RTT was not a factor in identifying the failed transmitter."

The EPRI review of the RTT measurement database and results of the failure modes and effects analyses (FMEAs) performed for each pressure sensor demonstrated that the majority of pressure sensor component failure modes which can affect sensor response times will also affect the sensor output and therefore, would be detectable by other required surveillance tests.

The EPRI report also identified certain exceptions (i.e., pressure sensor failure modes that may not be detected by other surveillance tests) and provided specific recommendations to address these exceptions. The EPRI recommendations that addressed the identified failure mode exceptions were incorporated into the subsequent Westinghouse and Combustion Engineering (CE) Owners Group (WOG and CEOG) Topical Reports (described below), as well as the associated NRC Safety Evaluation for those Topical Reports.

The EPRI report findings and FMEAs formed the bases for the subsequent Westinghouse and CE Owners Group topical reports that provided the justification to verify, in lieu of measure, the response times for specific pressure sensors (i.e., the use of allocated response times). Note that the EPRI report and subsequent Westinghouse and CE Owners Group topical reports only address pressure sensors and do not include any other type of sensors (i.e., temperature sensors are not included).

WCAP-13632-P-A, "Elimination of Pressure Sensor Response Time Testing Requirements" The Westinghouse Owners Group (WOG) submitted Topical Report WCAP-13632-P-A, "Elimination of Pressure Sensor Response Time Testing Requirements" (Reference 2) for NRC Page 2

TSTF-569, Rev. 2 review in August 1995, with NRC approval received in September 1995 (Reference 3). In their approval, the NRC stated: "...any sensor failure that significantly degrades sensor response time can be detected during the performance of other surveillance tests, principally calibration." The NRC further stated that, " ... the performance of periodic RTT for the selected pressure and differential pressure sensors identified in the topical report can be eliminated from Technical Specifications (TS) and that allocated sensor response times may be used to verify acceptable RTS and ESFAS channel response times."

By utilizing the FMEA results and the recommendations of the EPRI Report, WCAP-13632-P-A established the justification for eliminating periodic response time measurement for the 17 pressure and differential pressure sensor types that were evaluated in the EPRI report. In addition to the pressure and differential pressure transmitters identified in the EPRI Report, WCAP-13632-P-A identified and evaluated an additional 12 pressure sensor types that were installed in Westinghouse plants. WCAP-13632-P-A documented the justification for eliminating response time testing for these additional sensors (not addressed in the EPRI report) by showing similarity to those sensors included in the EPRI report or by additional FMEA and/or testing data. For the most part, similarity analyses were utilized to compare the design and the functionality of the principal components of each pressure and differential pressure unit, to those evaluated in the EPRI report. Where similarity could not be shown, a FMEA or additional testing data was used to demonstrate that response time would not be significantly affected by degradation of components or that such changes would be detectable by other calibration procedures.

WCAP-13632-P-A establishes the methodology for verifying the total instrument channel response time by using a combination of "allocated response times" for the specified pressure sensors and actual tests (in any series of sequential or overlapping measurements) for the remainder of the instrument channel. The "allocated response times" can be used in lieu of actual measured response times for those pressure sensors when performing the RTT surveillance.

WCAP-13632-P-A specifies that the "allocated response times" be determined as follows:

The response time to be allocated in place of response times obtained through actual measurement during the period of verification may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace, onsite, or offsite (e.g., vendor) test measurements, or (3) utilizing vendor engineering specifications.

CEOG NPSD-1167-A "Elimination of Pressure Sensor Response Time Testing Requirements" The CEOG submitted Topical Report NPSD-1167, "Elimination of Pressure Sensor Response Time Testing Requirements" (Reference 4) for NRC review in May 2000, with NRC approval received in December 2000 (Reference 5). In their approval, the NRC stated: "response time testing is not required to demonstrate satisfactory sensor performance and that other routine surveillance, such as calibrations and drift monitoring, is sufficient to demonstrate satisfactory sensor performance."

Page 3

TSTF-569, Rev. 2 The CEOG report includes plant-specific information from five utilities and a total of eleven nuclear power plants and addresses seven different types of pressure sensors. The CEOG report depended primarily on the analysis performed in EPRI Report NP-7243. In addition, the CEOG reviewed approximately 1400 sensor data points, and determined that no failures of response time had been detected. With two exceptions, the sensors addressed in the CEOG report were all subject to the FMEAs contained in the EPRI report, and, therefore, no further analysis was required. The CEOG report addressed the exceptions by confirming that existing FMEAs performed by EPRI were applicable to the two other sensor types. As such, the CEOG report utilized similarity evaluations (in the same manner as the Westinghouse Report) to confirm the applicability of the EPRI FMEAs to pressure sensors not specifically included in the EPRI report.

Similar to the Westinghouse report, the CEOG report establishes the use of "allocated response times" for the specified pressure sensors. Since the response time assumed in the safety analyses is the summation of all response times of components within the protective function, some assumed value for the sensor response time value must be used in lieu of an actual measured value. In accordance with Section 3.1 of the NRC Safety Evaluation for the CEOG report, the allocated response times are obtained from two sources: either from the original equipment manufacturer specification or from a statistical analysis of the results of previous RTTs.

2.1.2. Electronic Signal Processing Hardware WCAP-14036-P-A "Elimination of Periodic Protection Channel Response Time Tests" The WOG submitted Topical Report WCAP-14036-P "Elimination of Periodic Protection Channel Response Time Tests" (Reference 6) for NRC review in January 1998 with NRC approval received in October 1998 (Reference 7). WCAP-14036-P-A provides the technical justification for deletion of periodic RTT of the electronic signal processing hardware between the primary sensor and the final actuated device. This signal processing hardware includes the process analog/digital rack, excore nuclear instrumentation system (NIS), and associated solid state and relay trip logic circuitry up to the slave relay output. Note that WCAP-14036-P-A does not include the individual channel sensors (e.g., pressure or temperature sensors) only the electronics/relays between the sensor and the final actuated device.

The justification for the elimination of periodic RTT for the electronics addressed by WCAP-14036-P-A is based on the FMEAs that either determined that individual component degradation had no response time impact or identified components that may contribute to trip system response time degradation. Where the potential response time impact was identified, testing was conducted to determine the magnitude of the response time degradation, or a bounding response time limit for the system or component was determined. As a result of the FMEA, the only components which were tested were the Westinghouse 7100 and 7300 Process Protection System circuit boards and modules. For the remainder of the hardware types (e.g.,

NIS, Eagle 21, Solid State Protection System (SSPS), and relay logic), bounding response time allocations were determined. In these cases, the bounding response time allocation is derived from design response time specifications for the component. The bounding response time is justified because of its small magnitude when compared to the total response time limit for the protection channel and because the simulated degradations were grossly exaggerated.

Page 4

TSTF-569, Rev. 2 The NRC Safety Evaluation for WCAP-14036-P-A stated:

Based on this information, the staff concurs that RTT is redundant to other periodic surveillance tests and that appropriate surveillance testing alternatives to RTT are in place per the existing requirements of plant specific TSs. The staff concludes that calibration and other TS surveillance testing requirements will adequately ensure that the response time is verified for the components identified in WCAP-14036. The staff accepts the use of bounding response times as shown in Table 8-1, page 8-5 of WCAP-14036, when determining total channel response time and concludes that this method of response time verification provides assurance that the total channel response time is within safety analysis limits.

Thus, WCAP-14036-P-A established the method and guidance for the use of bounding response times for RTS and ESFAS channels, in lieu of actual response time measurements.

Note that the CEOG did not pursue a similar effort to eliminate RTS and ESFAS channel response time measurement, and this Topical Report only applies to Westinghouse plants.

2.2. Current Technical Specifications Requirements TSTF-111-A, "Revise Bases for SRs 3.3.1.16 and 3.3.2.10 to Eliminate Pressure Sensor Response Time Testing," was submitted for NRC review in August 1996. This Traveler contained changes to NUREG-1431, "Standard Technical Specifications Westinghouse Plants,"

to implement the changes approved by the NRC in WCAP-13632-P-A and WCAP-14036-P-A (described above). TSTF-111-A revised the definitions of ESF Response Time and RTS Response Time in Section 1.1 of NUREG-1431. The definitions were revised to allow the use of the NRC approved methodologies in WCAP-13632-P-A and WCAP-14036-P-A. In addition, this Traveler revised the Technical Specifications (TS) Bases to discuss and reference the NRC approved methodologies in WCAP 13632-P-A and WCAP-14036-P-A. TSTF-111-A was incorporated into Revision 2 of NUREG-1432.

NUREG-1431, Section 1.1, "Definitions," states:

ENGINEERED SAFETY FEATURE (ESF) RESPONSE TIME The ESF RESPONSE TIME shall be that time interval from when the monitored parameter exceeds its actuation setpoint at the channel sensor until the ESF equipment is capable of performing its safety function (i.e., the valves travel to their required positions, pump discharge pressures reach their required values, etc.). Times shall include diesel generator starting and sequence loading delays, where applicable. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC.

Page 5

TSTF-569, Rev. 2 REACTOR TRIP SYSTEM (RTS) RESPONSE TIME The RTS RESPONSE TIME shall be that time interval from when the monitored parameter exceeds its RTS trip setpoint at the channel sensor until loss of stationary gripper coil voltage. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC.

The following Surveillance Requirements invoke these definitions:

SR 3.3.1.16, "RTS Instrumentation," states, "Verify RTS RESPONSE TIME is within limits."

SR 3.3.2.10, "ESFAS Instrumentation," states, "Verify ESFAS RESPONSE TIMES are within limit."

TSTF-368-A, "Incorporate CEOG Topical Report to Eliminate Pressure Sensor Response Time Testing," was submitted to the NRC in October 2000. This Traveler revised NUREG-1432, "Standard Technical Specifications Combustion Engineering Plants," to incorporate the changes approved by the NRC in CEOG NPSD-1167-A (described above). TSTF-368-A revised the definitions of ESFAS Response Time and RPS Response Time in Section 1.1 of NUREG-1432.

The definitions were revised to allow the use of the methodology approved in CEOG NPSD-1167-A. In addition, this Traveler revised the Technical Specifications (TS) Bases to discuss and reference the NRC approved methodology in CEOG NPSD-1167-A.

TSTF-368-A was incorporated into Revision 2 of NUREG-1432.

NUREG-1432, Section 1.1, "Definitions," states:

ENGINEERED SAFETY FEATURE (ESF) RESPONSE TIME The ESF RESPONSE TIME shall be that time interval from when the monitored parameter exceeds its ESF actuation setpoint at the channel sensor until the ESF equipment is capable of performing its safety function (i.e., the valves travel to their required positions, pump discharge pressures reach their required values, etc.). Times shall include diesel generator starting and sequence loading delays, where applicable.

The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC.

REACTOR PROTECTION SYSTEM (RPS) RESPONSE TIME The RPS RESPONSE TIME shall be that time interval from when the monitored parameter exceeds its RPS trip setpoint at the channel sensor until electrical power to the CEAs drive mechanism is interrupted. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is Page 6

TSTF-569, Rev. 2 measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC.

The Combustion Engineering Standard Technical Specifications, NUREG-1432, contain separate Section 3.3, "Instrumentation," sections for plants with analog and digital instrumentation. The following Surveillance Requirements invoke these definitions:

SR 3.3.1.9, "RPS Instrumentation - Operating (Analog)," states, "Verify RPS RESPONSE TIME is within limits."

SR 3.3.4.5, "ESFAS Instrumentation (Analog)," states, "Verify ESF RESPONSE TIME is within limits."

SR 3.3.1.14, "RPS Instrumentation - Operating (Digital)," states, "Verify RPS RESPONSE TIME is within limits."

SR 3.3.2.5, "RPS Instrumentation - Shutdown (Digital)," states, "Verify RPS RESPONSE TIME is within limits."

SR 3.3.5.4, "ESFAS Instrumentation (Digital)," states, "Verify ESF RESPONSE TIME is within limits."

The Standard Technical Specifications for Westinghouse and CE plants contain instrumentation specifications that are applicable to plants with and without a Setpoint Control Program (the "A" and "B" versions, respectively). Currently, no operating plants have a Setpoint Control Program.

2.3. Reason for the Proposed Change Response time testing is resource intensive, which is why the WOG and CEOG pursued its elimination as discussed above. RTT is generally performed in discrete steps, with electronic signal conditioning and logic response time being one of the steps. Other components of the total protection system response time include the sensor and the final actuated device response times.

The RTT of instrument channels that includes pressure sensors requires different procedures and techniques to be used for measuring the response time of the pressure sensor devices in those instrument channels. As such, pressure sensor RTT took additional time and effort and often involved the use of specialized contractor services. This prompted the industry efforts to develop alternatives to measuring the response time of selected components.

As components become obsolete, replacements must be installed to support continued operation.

The replacement components are not identical to the original selected components, and therefore are not specifically listed in the NRC-approved topical reports that justified the application of an alternative to measuring response times. Because the replacement components are not listed in the NRC-approved topical reports, the NUREG-1431 and NUREG-1432 ESF and RTS/RPS Definitions require prior NRC review and approval to use bounding response times for the replacement components. Therefore, RTT is required to be performed on the replacement components.

Page 7

TSTF-569, Rev. 2 2.4. Description of Proposed Change The proposed change revises the following TS definitions in Section 1.1 of NUREG-1431 and NUREG 1432:

Engineered Safety Feature (ESF) Response Time (NUREG-1431 and NUREG-1432),

Reactor Trip System (RTS) Response Time (NUREG-1431), and Reactor Protection System (RPS) Response Time (NUREG-1432).

The revised definitions (with changes indicated in italics) for both NUREG-1431 and NUREG-1432 are:

NUREG-1431 Engineered Safety Feature (ESF) Response Time The ESF RESPONSE TIME shall be that time interval from when the monitored parameter exceeds its actuation setpoint at the channel sensor until the ESF equipment is capable of performing its safety function (i.e., the valves travel to their required positions, pump discharge pressures reach their required values, etc.). Times shall include diesel generator starting and sequence loading delays, where applicable. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC, and or the components have been evaluated in accordance with an NRC approved methodology.

Reactor Trip System (RTS) Response Time The RTS RESPONSE TIME shall be that time interval from when the monitored parameter exceeds its RTS trip setpoint at the channel sensor until loss of stationary gripper coil voltage. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC, and or the components have been evaluated in accordance with an NRC approved methodology.

NUREG-1432 Engineered Safety Feature (ESF) Response Time The ESF RESPONSE TIME shall be that time interval from when the monitored parameter exceeds its ESF actuation setpoint at the channel sensor until the ESF equipment is capable of performing its safety function (i.e., the valves travel to their required positions, pump discharge pressures reach their required values, etc.). Times shall include diesel generator starting and sequence loading delays, where applicable.

The response time may be measured by means of any series of sequential, overlapping, or Page 8

TSTF-569, Rev. 2 total steps so that the entire response time is measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC, and or the components have been evaluated in accordance with an NRC approved methodology.

Reactor Protection System (RPS) Response Time The RPS RESPONSE TIME shall be that time interval from when the monitored parameter exceeds its RPS trip setpoint at the channel sensor until electrical power to the CEAs drive mechanism is interrupted. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC, and or the components have been evaluated in accordance with an NRC approved methodology.

The proposed change is supported by changes to the TS Bases. Similar to the response time testing definitions, the Bases state that components that have been evaluated in accordance with a methodology approved by the NRC, the response time can be verified in lieu of being measured. The proposed change revises the Bases to be consistent with the proposed definition change. The regulation in Title 10 of the Code of Federal Regulations (10 CFR), Part 50.36, states: "A summary statement of the bases or reasons for such specifications, other than those covering administrative controls, shall also be included in the application, but shall not become part of the technical specifications." A licensee may make changes to the TS Bases without prior NRC staff review and approval in accordance with the Technical Specifications Bases Control Program. The proposed TS Bases changes are consistent with the proposed TS changes and provide the purpose for each requirement in the specification consistent with the Commission's Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors, dated July 2, 1993 (58 FR 39132).

A model application is included. The model may be used by licensees desiring to adopt the traveler following its approval.

3. Technical Evaluation The proposed change will revise the definitions to permit licensees to apply an NRC approved methodology to determine if response time verification can be implemented for a replacement component without prior NRC review and approval of the application of the methodology to the component. Implementation of the proposed change will eliminate the need to submit license amendment requests for approval to use bounding response times for similar replacement components, which results in the most effective use of both licensee and NRC resources.

The licensee's modification process will evaluate replacement components that are verified in lieu of response time testing to ensure the proper application of the NRC-approved methodology.

This limits the scope of the replacement component types to pressure sensors and electronic components as justified in the following topical reports. WCAP-13632-P-A (for Westinghouse Page 9

TSTF-569, Rev. 2 plants) and NPSD-1167-A (for CE plants) contain a methodology applicable to pressure sensors and establish the guidance for using allocated response times in place of measured RTT. These topical reports are only applicable to pressure sensors (i.e., other sensors, such as temperature sensors, were not evaluated in the methodology). WCAP-14036-P-A (only applicable to Westinghouse plants) contains a methodology that is applicable to the electronic signal processing hardware between the primary sensor and the final actuated device and establishes a methodology for using bounding response times in place of measuring the response times. The methodology in WCAP-14036-P-A does not include individual channel sensors (e.g.,

temperature sensors or RTDs), and only includes the electronics and relays between the sensor and the final actuated device.

The licensee's modification process, in accordance with 10 CFR 50.59, will ensure that substituting bounding values instead of measuring response time is consistent with the NRC-approved methodology, and does not require prior NRC approval. Prior NRC approval would be required if a licensee uses a new or unapproved methodology, or if the replacement component types were not evaluated in the NRC-approved TRs discussed above.

3.1. Pressure Sensor RTT EPRI Report NP-7243, "Investigation of Response Time Testing Requirements," (EPRI report) established the basis for evaluating pressure sensors used by WCAP-13632-P-A and NPSD-1167-A (i.e., the Owners Group Topical Reports). The EPRI report documented pressure sensor RTT measurement data and FMEA data that was used to evaluate eliminating RTT for the pressure sensors. The FMEAs performed by EPRI demonstrated that failure modes associated with the analyzed pressure sensors (with a few exceptions) would not affect sensor response time independently of sensor output. Therefore, sensor failure modes that have the potential to affect sensor response time would be detected during the performance of other TS surveillance requirements. The EPRI report included specific recommendations to address the exceptions (i.e., failure modes that may not be detected by other TS surveillance requirements).

The EPRI recommendations to address the identified failure mode exceptions were incorporated into the subsequent Owners Group Topical Reports as well as the associated NRC Safety Evaluations for those Topical Reports.

The EPRI report provided the basis for implementing an alternative to actual RTT of the pressure sensors evaluated subject to the following recommendations:

Perform hydraulic response time test prior to installation of new transmitter/switch or following refurbishment.

For transmitters and switches that use capillary tubes, RTT should be performed after initial installation and after any maintenance or modification activity that could damage the capillary tubes.

Perform periodic drift monitoring on all Rosemount pressure and differential pressure transmitters in accordance with Rosemount Technical Bulletins and NRC Bulletin 90-01 Supplement 1 (affects certain model numbers only).

Page 10

TSTF-569, Rev. 2 Assure that variable damping (if used) is at the required setting and cannot be changed or perform hydraulic or white noise response time testing of sensor, following each calibration.

The EPRI recommendations discussed above formed the basis for allowing response time verification in lieu of response time measurement for the pressure sensors that were evaluated.

The recommendations are necessary to eliminate potential failures that could affect the response time and which may go undetected by other surveillance tests. As such, the EPRI recommendations (if applicable to the specific pressure sensor being evaluated) would continue to be required for implementation of response time verification, in lieu of the measurement of response times.

The Owners Group Topical Reports utilized the FMEAs documented in the EPRI report to justify the use of an alternative to RTT (i.e., allocated response times) for the evaluated pressure sensors. The Owners Group Topical Reports evaluated additional pressure sensors (i.e., sensors not included in the EPRI report) via similarity analyses, FMEAs, or circuit testing. Specifically, WCAP-13632-P-A identified and evaluated an additional 12 pressure sensors of various types used by Westinghouse plants. Section 5 of WCAP-13632-P-A documented the details of these additional evaluations. The additional 12 evaluations performed by Westinghouse provide a variety of examples demonstrating how the methodology may be applied in the future for similar components to justify the use of response time verification, in lieu of the measurement of response times.

The following discussions provide a broad overview of the methodology utilized by the Owners Group Topical Reports to justify response time verification, as opposed to the measurement of response times for pressure sensors not previously evaluated by EPRI.

The Owners Group Topical Reports utilized similarity analyses to compare the design and the functionality of the principal components of each additional pressure sensor to those evaluated in the EPRI report. For those sensors where similarity could not be shown, other techniques (i.e.,

FMEA or circuit testing) were utilized to justify the implementation of response time verification in lieu of the measurement. Where a new FMEA was required to evaluate a specific pressure sensor, the EPRI report was used as guidance.

The Owners Group Topical Reports and the EPRI report provided adequate guidance to perform the necessary similarity analysis or a new FMEA in sufficient detail to evaluate a pressure sensor to determine whether or not an alternative to RTT (i.e., an allocated response time) is appropriate. The similarity analysis includes mechanical and/or electrical component evaluations, as appropriate, to determine the impact of any design differences on the response time and failure modes of the unit. A successful determination demonstrates that the failure modes associated with the pressure sensor being evaluated would not affect sensor response time independently of sensor output (as concluded in the EPRI report). Thus, in the same manner as the EPRI report, the successful similarity analysis demonstrates that any pressure sensor failures would be detected during the performance of other TS surveillance requirements. If a failure mode(s) could adversely affect response time and would not be detectable by other TS required surveillances, specific recommendations in the EPRI report and Owners Group Topical Reports Page 11

TSTF-569, Rev. 2 were applied to eliminate these potential failure modes. In this case, the use of response time verification in lieu of measurement would also be acceptable.

The Owners Group Topical Reports introduced the "allocated" response time as the alternative to response time measurement of the pressure sensors. The total RTS/RPS or ESF instrumentation channel response time is verified by summing the allocated sensor response time with the response time of the remainder of the channel. In addition, the Owners Group Topical Reports provided sufficient guidance to determine the appropriate allocated response time to use in lieu of the measurement for a pressure sensor. In accordance with the Owners Group Topical Reports, the allocated response times for pressure sensors were obtained from:

Historical records based on acceptable RTT (hydraulic, noise, or power interrupt tests),

Inplace, onsite, or offsite (e.g., vendor) test measurements, Utilizing vendor engineering specifications, or Statistical analysis of the results of previous RTTs.

Thus, the Owners Group Topical Reports provided sufficient guidance for evaluating replacement pressure sensors to determine whether response time verification in lieu of measurement is appropriate. If it is determined that response time verification in lieu of measurement is applicable to a pressure sensor, the Owners Group Topical Reports also provided the guidance necessary to assign the appropriate allocated response time to that sensor.

3.2. Electronic Signal Processing Hardware RTT WCAP-14036-P-A "Elimination of Periodic Protection Channel Response Time Tests," provides the technical justification for elimination of periodic RTT of the electronic signal processing hardware between the primary sensor and the final actuated device. This signal processing hardware includes the process analog/digital rack, excore nuclear instrumentation system (NIS),

and associated solid state and relay trip logic circuitry up to the slave relay output. Note that WCAP-14036-P-A does not include the individual channel sensors (e.g., temperature sensors (RTDs)), only the electronics between the sensor and the final actuated device.

Although the requirement to perform RTT is eliminated for the affected components, the requirement to determine the total response time for an instrument channel remains in accordance with the TS. As such, WCAP-14036-P-A established the use of bounding response times for electrical components when determining the total channel response time. The channel electronic components bounding response time is added to the response time of the remainder of the non-electronic channel components to determine the total instrument channel response time.

The total instrument channel response time is used to verify the TS limits are met. This alternative method of response time verification provides assurance that the total channel response time remains within the response times assumed in the safety analysis.

There are currently two precedents where the methodology contained in WCAP-14036-P-A was applied to replacement components. WCAP-15413-A, "Westinghouse 7300A ASIC-Based Replacement Module Licensing Summary Report," (Reference 8) and WCAP-17867-P-A, Page 12

TSTF-569, Rev. 2 "Westinghouse SSPS Board Replacement Licensing Summary Report," (Reference 9) utilize the methodology contained in WCAP-14036-P-A. The implementation of the WCAP-14036-P-A methodology in these subsequent Westinghouse Topical Reports provides examples of how the methodology may be applied to future electronic components intended for replacement parts.

The following subsections summarize how the WCAP-14036-P-A methodology was utilized.

3.2.1. WCAP-15413-A, "Westinghouse 7300A ASIC-Based Replacement Module Licensing Summary Report" The WOG submitted WCAP-15413-A to the NRC for review and approval in June of 2000 in order to implement Application Specific Integrated Circuit (ASIC) Based Replacement Modules (ABRMs) in the 7300 Process Protection and Control System via 10 CFR 50.59 at individual plant sites. The NRC approved WCAP-15413-A in February 2001 (Reference 10). The ABRMs are designed as a card-for-card replacement module intended to be treated as a spare part for specific 7300 analog cards in operating plants. ASIC technology is a state-of-the art technology that addresses the issues encountered by vintage instrumentation and control equipment life cycle management programs. In a Westinghouse supplied 7300 Process Protection System or Process Control System, the ASIC technology can be implemented as a card-for-card replacement.

WCAP-14036-P-A "Elimination of Periodic Protection Channel Response Time Tests," included the Westinghouse 7300 System of analog process protection equipment and justified the elimination of RTT for this equipment. WCAP-14036-P-A established the use of bounding response times in lieu of measured response time. The bounding response times continue to provide assurance the system actuations are within the response times assumed in the safety analyses. As the ABRM module was designed to be a direct replacement for the 7300 System analog cards included in WCAP-14036-P-A, WCAP-15413-A provided justification to maintain the elimination of response time testing when an analog card is replaced with the equivalent ABRM. Section 9.0 of WCAP-15413-A contains the details of the evaluation performed to justify the replacement of RTT with bounding response times for the ABRMs. The following discussion provides an overview of the evaluation performed in WCAP-15413.

WCAP-15413-A utilized the same methodology as used in WCAP-14036-P-A to analyze the ABRMs. The FMEA circuit analysis determined which components were critical to response time. In lieu of testing, due to the less complex ABRM, the analysis considered catastrophic component failure and degraded component performance to determine a bounding response time for the ABRMs. This response time bounds the limit to which response time can be increased by degraded or failed components without that degradation or failure affecting calibration and therefore, being detected by other TS surveillance requirements. The FMEAs performed for the ABRMs accomplished the following:

Identified response time sensitive components on the Main Board and Personality Modules via circuit analysis; Evaluated the impact on response time if a component fails or degrades; Identified detectability of degraded components via calibration; and Page 13

TSTF-569, Rev. 2 Identified components that impact calibration but not response time.

Based on the results of the FMEAs with degraded components, WCAP-15413-A established the justification for eliminating the periodic RTT of process protection channels using ABRM modules as direct replacements for the Westinghouse 7300 Process Protection System analog cards. Similar to the results of WCAP-14036-P-A, the FMEAs demonstrated that component degradation will not increase the response time beyond the bounding response time without that degradation being detectable by other periodic surveillance tests, such as channel checks, functional tests and/or calibrations. In place of periodic tests, generic bounding response times were developed for ABRM modules for use in the determination of total response time for the RTS and ESFAS instrument functions (consistent with the methodology of WCAP-14036-P-A) and as required by TS. Bounding response time allocations for the different ABRMs were provided in Table 9-1 of WCAP-15413-A to be used to verify plant specific response times remain within the required limits for protection system functions when ABRM(s) are installed.

The NRC Safety Evaluation for the elimination of RTT for the ABRMs in WCAP-15413-A stated, in part, that:

Based on its review of the information presented in the Section 9 of WCAP-15413, the staff agrees that significant degradation of instrumentation response times can be detected during the performance of calibrations and other currently required surveillance tests.

The staff also finds that the bounding response times determined by the FMEA and listed in Table 9-1 of WCAP-15413 are acceptable. Therefore, the staff concludes that, for a plant that has already eliminated RTT in accordance with WCAP-14036-P-A, Revision 1, the existing TS surveillance requirements would provide reasonable assurance that the safety functions of the plant's instrumentation will be satisfied without the need for periodic RTT.

As such, WCAP-15413-A provides an example of how new or different electronic components would be evaluated. In addition, WCAP-15413-A provides an example for how the bounding response times would be determined consistent with WCAP-14036-P-A.

3.2.2. WCAP-17867-P-A, "Westinghouse SSPS Board Replacement Licensing Summary Report" The WOG submitted WCAP-17867-P-A, Revision 0, to the NRC for review and approval in February of 2014. The NRC approved WCAP-17867-P-A, Revision 1 in September 2014 (Reference 11). WCAP-17687-P-A provided the documentation associated with the new design SSPS boards which use configured logic devices (Complex Programmable Logic Device (CPLD)). The new design SSPS boards are replacement components for the original design SSPS boards in operating plants that can be installed by documenting a 10 CFR 50.59 review.

WCAP-17687-P-A documents the design process, design details, analyses, manufacturing controls, and verification process and provides a comprehensive summary of evidence concluding that the installation of the new design SSPS circuit boards maintain or improve upon the existing reliability and functional requirements for the SSPS, and do not introduce any unanalyzed failures, and also eliminates the concern for introduction of software common cause Page 14

TSTF-569, Rev. 2 failures that would compromise SSPS equipment operations. As part of the comprehensive documentation of the redesigned SSPS boards, WCAP-17687-P-A evaluated the new design SSPS boards to ensure the response time of the SSPS remains acceptable and is within the system time response analysis that justified the elimination of RTT in WCAP-14036-P-A.

Section 10 of WCAP-17687-P-A contains a description of the evaluation performed to confirm the CPLD replacement boards have time responses that are within the bounding times allowed for RTT elimination as discussed and approved in WCAP-14036-P-A. The following discussion provides an overview of the evaluations described in Section 10 of WCAP-17687-P-A.

The operation of the SSPS for both the RTS and ESFAS instrumentation was evaluated including the credible failures for the new design boards. Using the same analysis as the original WCAP-14036-P-A, it was determined the new design boards were within the original bounding times for an actuation function. Further evaluations were performed where multiple new design boards were connected in series for the worst-case time response (longest possible series of boards).

Even if all the boards in series failed to the worst-case response time, the total response time would still only be a small fraction of the bounding response time assumed in WCAP-14036-P-A. As such, WCAP-17687-P-A concluded that the response time of the system following installation of the new design boards is acceptable and falls within the system time response analysis for RTT elimination in WCAP-14036-P-A.

In the Safety Evaluation for WCAP-17687-P-A, the NRC stated:

The NRC staff finds that there is sufficient information in the TR to adequately demonstrate that the performance of the new design boards have time responses that are within the bounding times allowed for in the time response testing elimination analysis in a manner that is consistent with the NRC staff's evaluation in its approval for use of WCAP-14036-P-A, Revision 1, assuming that only new design boards are being used to accomplish reactor trip or ESFAS actuation functions. The NRC staff also notes that some licensees may elect to use an appropriate combination of new design ULB, UVD, and SGD boards in conjunction with original design SSPS boards. The new design boards have been found to require a few microseconds greater response time than their original design SSPS counterparts, and still be capable of functioning within the bounding response times described within WCAP-14036-P-A, Revision 1. The NRC staff finds the performance of the new design boards in conjunction with original design SSPS boards accomplishing the same reactor trip or ESFAS actuation function would also have time responses that are within the bounding times allowed for in the time response testing elimination analysis in a manner that is consistent with the NRC staff's evaluation in its approval for use of WCAP-14036-P-A, Revision 1.

Thus, WCAP-17687-P-A provides another example of how new or different electronic components may be evaluated and bounding response times determined consistent with WCAP-14036-P-A.

Page 15

TSTF-569, Rev. 2 3.3. Surveillance Frequency Control Program Although not directly related to the elimination of RTT, it is appropriate to discuss how the extension of Surveillance Frequencies in accordance with the Surveillance Frequency Control Program (SFCP) is not affected by the proposed change. When the proposed change is used to apply bounding values in lieu of RTT for certain components via a licensees modification process using an NRC-approved methodology, TS surveillance testing is still relied on to detect component failures that would affect the response time, and to verify that the total instrument channel response time is within the required TS limits. Similarly, the SFCP evaluates Surveillance Frequency changes, in accordance with NEI 04-10 to ensure any changes to Surveillance Frequencies are monitored and controlled such that the affected plant components are maintained operable in accordance with the TS.

TSTF-425, Revision 3, "Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5b," added the SFCP as an Administrative Control program in Section 5 of the Standard Technical Specifications. TSTF-425, Revision 3, was approved by the NRC on July 6, 2009.

The SFCP states:

Surveillance Frequency Control Program This program provides controls for Surveillance Frequencies. The program shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met.

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, "Risk-Informed Method for Control of Surveillance Frequencies," Revision 1.

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control Program.

Item b. of the program requires that changes to Frequencies be made in accordance with NEI 04-10, "Risk-Informed Method for Control of Surveillance Frequencies," Revision 1 (Reference 12). NEI 04-10 was submitted to the NRC for approval in April 2007 and approved in September 2007 (Reference 13). The method contained in NEI 04-10 is consistent with Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessments in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," (Reference 14) and RG 1.177, "An Approach for Plant-Specific Risk-Informed Decisionmaking: Technical Specifications," (Reference 15).

Page 16

TSTF-569, Rev. 2 With respect to the control of Surveillance Frequency changes, NEI 04-10 States:

The SFCP shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation (LCOs) are met. Existing regulatory programs, such as 10 CFR 50.65 (Ref. 2; the Maintenance Rule) and the corrective action program required by 10 CFR 50, Appendix B (Ref. 3), require monitoring of Surveillance test failures and require action be taken to address such failures. One of these actions may be to consider changing the Frequency at which a Surveillance is performed. These regulatory requirements are sufficient to ensure that Surveillance Frequencies which are insufficient to assure the LCO is met are identified and action taken. In addition, the SFCP requires monitoring of Surveillance Frequencies that are changed using the process described in this document.

In addition, the NRC Safety Evaluation for NEI 04-10 stated:

NEI 04-10, Revision 1, requires performance monitoring of SSCs whose surveillance frequency has been revised as part of a feedback process to assure that the change in test frequency has not resulted in degradation of equipment performance and operational safety. The monitoring and feedback includes consideration of Maintenance Rule monitoring of equipment performance. In the event of degradation of SSC performance, the surveillance frequency is reassessed in accordance with the methodology, in addition to any corrective actions which may apply as part of the Maintenance Rule requirements.

The performance monitoring and feedback specified in NEI 04-10, Revision 1, is sufficient to reasonably assure acceptable SSC performance and is consistent with Regulatory Position 3.2 of RG 1.177. Thus, the fifth key safety principle of RG 1.177 is satisfied.

Therefore, the SFCP, as implemented by NEI 04-10, and the regulations (discussed above) provides adequate assurance that any changes to Surveillance Frequencies are monitored and controlled such that the affected plant components are maintained operable in accordance with the TS. The SFCP process is independent of the licensee's modification process that replaces components and evaluates if bounding values can be used in lieu of RTT for the replacement components. As such, the proposed TS change has no impact on the SFCP.

4. Regulatory Evaluation 4.1. Applicable Regulatory Requirements/Criteria Regulatory Guide 1.118, "Periodic Testing of Electric Power and Protection Systems, describes a method acceptable to the NRC staff for complying with the NRC's regulations with respect to the periodic testing of the electric power and protection systems. This RG endorses the use of IEEE Std. 338-1987, "Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems." The standard provides design and operational criteria for the performance of periodic testing as part of the surveillance program of nuclear power plant safety systems. The periodic testing consists of functional tests and checks, calibration Page 17

TSTF-569, Rev. 2 verification, and time response measurements, as required, to verify that the safety system performs to meet its defined safety functions.

Section 6.3.4 of IEEE Standard 338-1977, "Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems," states response time testing of all safety-related equipment, per se, is not required if, in lieu of response time testing, the response time of safety system equipment is verified by functional testing, calibration check, or other tests, or both. This is acceptable if it can be demonstrated that changes in response time beyond acceptable limits are accompanied by changes in performance characteristics which are detectable during routine periodic tests.

Clause 6.3.4 of IEEE 338-1987, "Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems," states response time testing shall be required only on safely systems or subsystems to verify that the response times are within the limits given in the Safety Analysis Report including Technical Specifications. Response time testing of all safety-related equipment is not required if, in lieu of response time testing, the response time of safety system equipment is verified by functional testing, calibration checks, or other tests, or both. This is acceptable if it can be demonstrated that changes in response time beyond acceptable limits are accompanied by changes in performance characteristics that are detectable during routine periodic tests.

Section 5.3.4, "Response time verification tests," of IEEE Standard 338-2012, "IEEE Standard for Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems," Item c) states response time testing of all safety-related equipment is not required if, in lieu of response time testing, the response time of safety system equipment is verified by functional testing, calibration checks, or other tests. This is acceptable if it can be demonstrated that changes in response time beyond acceptable limits are accompanied by changes in performance characteristics that are detectable during routine periodic tests.

The proposed change will allow certain replacement components to be evaluated to determine whether response time verification can be implemented, in lieu of the measurement of response times. This is consistent with Section 6.3.4 of IEEE Standard 338-1977, Clause 6.3.4 of IEEE 338-1987, and Section 5.3.4 of IEEE Standard 338-2012, Item c), (discussed above), in that the evaluation would confirm whether or not it can be demonstrated that changes in response time beyond acceptable limits are accompanied by changes in performance characteristics that are detectable during other routine periodic tests. The replacement components will continue to perform the same function as the original equipment. As such, the system operation, design basis, and capability for testing will remain unchanged.

Section IV, "The Commission Policy," of the "Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors" (58 Federal Register 39132), dated July 22, 1993, states in part:

The purpose of Technical Specifications is to impose those conditions or limitations upon reactor operation necessary to obviate the possibility of an abnormal situation or event giving rise to an immediate threat to the public health and safety by identifying those Page 18

TSTF-569, Rev. 2 features that are of controlling importance to safety and establishing on them certain conditions of operation which cannot be changed without prior Commission approval.

[T]he Commission will also entertain requests to adopt portions of the improved STS

[(e.g., TSTF-569)], even if the licensee does not adopt all STS improvements.

The Commission encourages all licensees who submit Technical Specification related submittals based on this Policy Statement to emphasize human factors principles.

In accordance with this Policy Statement, improved STS have been developed and will be maintained for each NSSS Owners Group. The Commission encourages licensees to use the improved STS as the basis for plant-specific Technical Specifications.

[I]t is the Commission intent that the wording and Bases of the improved STS be used to the extent practicable.

As described in the Commissions "Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors," recommendations were made by NRC and industry task groups for new STS that include greater emphasis on human factors principles in order to add clarity and understanding to the text of the STS, and provide improvements to the Bases of STS, which provides the purpose for each requirement in the specification. Improved vendor-specific STS were developed and issued by the NRC in September 1992.

Additionally, 10 CFR 50.36(b) requires:

Each license authorizing operation of a utilization facility will include technical specifications. The technical specifications will be derived from the analyses and evaluation included in the safety analysis report, and amendments thereto, submitted pursuant to [10 CFR] 50.34 ["Contents of applications; technical information"]. The Commission may include such additional technical specifications as the Commission finds appropriate.

The categories of items required to be in the TSs are provided in 10 CFR 50.36(c). As required by 10 CFR 50.36(c)(2)(i), the TSs will include LCOs, which are the lowest functional capability or performance levels of equipment required for safe operation of the facility. Per 10 CFR 50.36(c)(2)(i), when an LCO of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the TSs until the condition can be met.

Per 10 CFR 50.90, whenever a holder of a license desires to amend the license, application for an amendment must be filed with the Commission, fully describing the changes desired, and following as far as applicable, the form prescribed for original applications.

Per 10 CFR 50.92(a), in determining whether an amendment to a license will be issued to the applicant, the Commission will be guided by the considerations which govern the issuance of initial licenses to the extent applicable and appropriate.

The NRC staffs guidance for the review of TSs is in Chapter 16, "Technical Specifications," of NUREG-0800, Revision 3, "Standard Review Plan for the Review of Safety Analysis Reports for Page 19

TSTF-569, Rev. 2 Nuclear Power Plants" (SRP), dated March 2010 (ADAMS Accession No. ML100351425). As described therein, as part of the regulatory standardization effort, the NRC staff has prepared STS for each of the light-water reactor nuclear designs.

4.2. Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5. REFERENCES

1. EPRI Report NP-7243, Revision 1, "Investigation of Response Time Testing Requirements," May 1991.

2. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," January 1996.

3. NRC Letter (Bruce A. Boger - NRC to Roger A. Newton - WOG) "Review of Westinghouse Electric Corporation Topical Report WCAP-13632, Revision 2,

'Elimination of Pressure Sensor Response Time Testing Requirements, Dated August 1995 - Westinghouse Owners Group Program MUHP-3040, Revision 1,' September 5, 1995."

4. CEOG NPSD-1167-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," January 2001.

5. NRC Letter (Stuart A. Richards - NRC to Richard Bernier - CEOG), "Correction of Safety Evaluation for Combustion Engineering Owners Group Topical Report CE NPSD-1167, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," May 2000 (TAC NO. MA6010)," December 5, 2000.

6. WCAP-14036-P-A, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," October 1998.

7. NRC Letter (Thomas H. Essig - NRC to Lou Liberatori - WOG), "Safety Evaluation Related to Topical Report WCAP-14036, Revision 1, 'Elimination of Periodic Protection Channel Response Time Tests,' (TAC No. MA0863)," October 6, 1998.

8. WCAP-15413-A, Revision 0, "Westinghouse 7300A ASIC-Based Replacement Module Licensing Summary Report," March 2001.

9. WCAP-17867-P-A, Revision 1, "Westinghouse SSPS Board Replacement Licensing Summary Report," October 2014.

10. NRC Letter (Stuart A. Richards - NRC to Michael G. Edison - WOG), "Review of Westinghouse Topical Report WCAP-15413, 'Westinghouse 7300A ASIC-Based Replacement Module Licensing Summary Report (TAC No. M96513)'," February 8, 2001.

Page 20

TSTF-569, Rev. 2

11. NRC Letter (Aby S. Mohseni - NRC to W. Anthony Nowinowski - PWROG) "Final Safety Evaluation for Pressurized Water Reactor Owners Group Topical Report WCAP-17867-P, Revision 1, "Westinghouse SSPS Board Replacement Licensing Summary Report" (TAC No. MF4655)," September 19, 2014.

12. NEI 04-10, Revision 1 "Risk-Informed Method for Control of Surveillance Frequencies,"

April 2007.

13. NRC Letter (Ho K. Nieh - NRC to Biff Bradley - NEI) "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) 04-10, Revision 1, "Risk-Informed Technical Specification Initiative 5b, "Risk-Informed Method for Control of Surveillance Frequencies" (TAC No. MD6111)," September 19, 2007.

14. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," August 1998.

15. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," August 1998.

Page 21

TSTF-569, Rev. 2 Attachment 1 to TSTF-569 Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only) Response Time Testing

Background

Section 6.3.4 of IEEE Standard 338-1977, "Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems," states the following regarding eliminating response time testing (RTT):

Response time testing of all safety-related equipment, per se, is not required if, in lieu of response time testing, the response time of safety system equipment is verified by functional testing, calibration check, or other tests, or both. This is acceptable if it can be demonstrated that changes in response time beyond acceptable limits are accompanied by changes in performance characteristics which are detectable during routine periodic tests.

Clause 6.3.4 of IEEE 338-1987 states the following regarding eliminating RTT:

Response time testing shall be required only on safely systems or subsystems to verify that the response times are within the limits given in the Safety Analysis Report including Technical Specifications. Response time testing of all safety-related equipment is not required if, in lieu of response time testing, the response time of safety system equipment is verified by functional testing, calibration checks, or other tests, or both.

Section 5.3.4, "Response time verification tests," of IEEE Standard 338-2012, "IEEE Standard for Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems," Item c), states the following regarding eliminating RTT:

Response time testing of all safety-related equipment is not required if, in lieu of response time testing, the response time of safety system equipment is verified by functional testing, calibration checks, or other tests. This is acceptable if it can be demonstrated that changes in response time beyond acceptable limits are accompanied by changes in performance characteristics that are detectable during routine periodic tests.

Methodology for Evaluating the Elimination of Response Time Testing for Pressure Transmitters for Westinghouse and Combustion Engineering NSSS Plants The methodology for evaluating whether RTT can be eliminated for pressure transmitters (or sensors) consists of the following:

1) If response time measurement data is available, evaluate the measurement data with respect to the results, failure mechanisms, testing techniques, and failure trends.

If response time measurement data is available, the review of the data should conclude that no response time failures were identified during RTT. If a pressure transmitter(s)

Page A-1

TSTF-569, Rev. 2 was replaced due to a failure, it should be confirmed that the failure was detected by a channel check or other instrument surveillance testing. It should be concluded that although the response time was degraded by the failure, RTT was not a factor in identifying the failed transmitter.

2) Perform a failure modes and effects analyses (FMEAs) on the pressure transmitter to demonstrate that the pressure transmitter component failure modes which can affect the transmitter response time will also affect the transmitter output and therefore, would be detectable by other required surveillance tests.

3) Identify any exceptions (i.e., pressure transmitter failure modes that may not be detected by other surveillance tests) and identify specific recommendations to address these exceptions.

4) Perform a similarity analysis that compares the design and the functionality of the principal components of the pressure transmitter, to the transmitters that were evaluated in EPRI Report NP-7243, WCAP-13632-P-A, or NPSD-1167-A. If the similarity analysis does not confirm the functionality of the principal components of the pressure transmitter, as compared to the transmitters that were evaluated in EPRI Report NP-7243, WCAP-13632-P-A, or NPSD-1167-A, a FMEA or additional test data will be used to demonstrate that the response time would not be significantly affected by the degradation of components or that such changes would be detectable by other surveillance tests.

This methodology verifies the total instrument channel response time by using a combination of "allocated response times" for the specified pressure transmitters and actual tests (in any series of sequential or overlapping measurements) for the remainder of the instrument channel. The "allocated response times" can be used in lieu of actual measured response times for those pressure transmitters when performing the RTT surveillance.

The "allocated response times" will be determined as follows:

The response time allocated in lieu of response times obtained through actual measurement may be obtained from:

(1) If available, historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests),

(2) If available, inplace, onsite, or offsite (e.g., vendor) test measurements, or (3) Utilizing vendor engineering specifications.

This methodology is only applicable to pressure sensors and is not applicable to any other type of sensor (e.g., temperature sensors (RTDs)).

Methodology for Evaluating the Elimination of Response Time Testing for Protection Channels for Westinghouse NSSS Plants This methodology justifies the elimination of periodic RTT of the electronic signal processing hardware between the primary sensor and the final actuated device. This signal processing Page A-2

TSTF-569, Rev. 2 hardware includes the process analog/digital rack, excore nuclear instrumentation system, and associated solid state and relay trip logic circuitry up to the slave relay output.

Note that this methodology only includes the electronics/relays between the sensor and the final actuated device and does not include the individual channel pressure or temperature sensors.

The methodology is applicable to the following systems:

7100 Process Protection System (PPS) 7300 Process Protection System (PPS)

Nuclear Instrumentation System (NIS)

Eagle-21 Process Protection System (PPS)

Solid State Protection System (SSPS)

Relay Protection System (RPS)

The methodology for evaluating whether RTT can be eliminated for protection channels consists of the following:

1) Analyze the system modules for their function in providing the protection function.

System modules which do not contribute to the protection functions, such as modules used only for test or for interface with non-safety systems, will be excluded.

2) A Failure Modes and Effects Analysis (FMEA) will be performed on the modules that perform a protection function to determine whether individual component degradation has no impact on the response time or whether the individual component may contribute to the system response time degradation.

The FMEA should confirm the following:

Identify any components on the cards and modules that are sensitive to response time, Evaluate the impact on response time if the component fails or degrades, Determine whether the degraded component can be detected via a channel calibration, Identify the components that impact a channel calibration, but not the response time.

3a) If the individual component potentially impacts the system response time, perform testing to determine the magnitude of the response time degradation, If required to be performed, the testing, which verifies and further quantifies the results of the FMEA should confirm the following:

Measure the response time of the calibrated production modules and provide response time base-line data, Page A-3

TSTF-569, Rev. 2 Measure the response time and obtain calibration data for the card or module if the component is identified to have an impact on response time is degraded, Measure the response time of a simulated protection channel from input to output with the component degraded.

OR 3b) Determine a bounding response time limit for the system or component if the individual component does not impact the system response time. The results of the FMEA must conclude that component degradation will not increase the response time beyond the bounding response time without the response time degradation being detected by other periodic surveillance tests, such as channel checks and channel calibrations.

The bounding response time allocations are determined from response time design specifications for the components. It must be confirmed that the bounding response times that were determined for the specific components that were approved by the NRC in WCAP-14036-P-A are applicable to the replacement component. If the bounding response times are not applicable to the replacement component, new bounding response times must be determined for the replacement component. The bounding response time will be justified because of its small magnitude as compared to the total system response time limit.

The application of the methodology must conclude that RTT is redundant to other periodic surveillance tests; channel checks and channel calibrations, in lieu of performing RTT such that the response time is verified for the components.

Page A-4

TSTF-569, Rev. 2 MODEL APPLICATION

TSTF-569, Rev. 2

[DATE] 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

PLANT NAME DOCKET NO. 50-[xxx]

APPLICATION TO REVISE TECHNICAL SPECIFICATIONS TO ADOPT TSTF-569, "REVISION OF RESPONSE TIME TESTING DEFINITIONS" Pursuant to 10 CFR 50.90, [LICENSEE] is submitting a request for an amendment to the Technical Specifications (TS) for [PLANT NAME, UNIT NOS].

[LICENSEE] requests adoption of TSTF-569, "Revise Response Time Testing Definition,"

which is an approved change to the Improved Standard Technical Specifications (ISTS), into the

[PLANT NAME, UNIT NOS] Technical Specifications (TS). The proposed amendment revises the TS Definitions for Engineered Safety Feature (ESF) Response Time and [Reactor Trip System (RTS) Response Time (for Westinghouse plants) or Reactor Protection System (RPS)

Response Time (for CE plants)].

The enclosure provides a description and assessment of the proposed changes. Attachment 1 provides the existing TS pages marked to show the proposed changes. Attachment 2 provides revised (clean) TS pages. Attachment 3 provides existing TS Bases pages marked to show the proposed changes for information only.

Approval of the proposed amendment is requested by [date]. Once approved, the amendment shall be implemented within [ ] days.

This letter contains no regulatory commitments In accordance with 10 CFR 50.91, a copy of this application, with attachments, is being provided to the designated [STATE] Official.

[In accordance with 10 CFR 50.30(b), a license amendment request must be executed in a signed original under oath or affirmation. This can be accomplished by attaching a notarized affidavit confirming the signature authority of the signatory, or by including the following statement in the cover letter: "I declare under penalty of perjury that the foregoing is true and correct.

Executed on (date)." The alternative statement is pursuant to 28 USC 1746. It does not require notarization.]

If you should have any questions regarding this submittal, please contact [NAME, TELEPHONE NUMBER].

Sincerely,

[Name, Title]

Page 1

TSTF-569, Rev. 2 Enclosure Description and Assessment Attachments: 1. Proposed Technical Specification Changes (Mark-Up)

2. Revised Technical Specification Pages

3. Proposed Technical Specification Bases Changes (Mark-Up)

{Attachments 1, 2, and 3 are not included in the model application and are to be provided by the licensee.}

cc: NRC Project Manager NRC Regional Office NRC Resident Inspector State Contact Page 2

TSTF-569, Rev. 2 ENCLOSURE DESCRIPTION AND ASSESSMENT

1.0 DESCRIPTION

[LICENSEE] requests adoption of TSTF-569, "Revise Response Time Testing Definition,"

which is an approved change to the Improved Standard Technical Specifications (ISTS), into the

[PLANT NAME, UNIT NOS] Technical Specifications (TS). The proposed amendment revises the TS Definitions for Engineered Safety Feature (ESF) Response Time and [Reactor Trip System (RTS) Response Time (for Westinghouse plants) or Reactor Protection System (RPS)

Response Time (for CE plants)].

2.0 ASSESSEMENT 2.1 Applicability of Safety Evaluation

[LICENSEE] has reviewed the safety evaluation for TSTF-569 provided to the Technical Specifications Task Force in a letter dated [DATE]. This review included a review of the NRC staffs evaluation, as well as the information provided in TSTF-569. [As described herein,]

[LICENSEE] has concluded that the justifications presented in TSTF-569 and the safety evaluation prepared by the NRC staff are applicable to [PLANT, UNIT NOS.] and justify this amendment for the incorporation of the changes to the [PLANT] TS.

2.2 Variations

((LICENSEE] is not proposing any variations from the TS changes described in the TSTF-569 or the applicable parts of the NRC staffs safety evaluation dated [DATE].] ((LICENSEE] is proposing the following variations from the TS changes described in the TSTF-569 or the applicable parts of the NRC staffs safety evaluation: describe the variations]

[The [PLANT] TS utilize different [numbering][and][titles] than the Standard Technical Specifications on which TSTF-569 was based. Specifically, [describe differences between the plant-specific TS numbering and/or titles and the TSTF-569 numbering and titles.] These differences are administrative and do not affect the applicability of TSTF-569 to the [PLANT]

TS.]

[The [PLANT] TS contain requirements that differ from the Standard Technical Specifications on which TSTF-569 was based, such as definition titles and wording, but these differences do not affect the applicability of the TSTF-569 justification. [Differences and why TSTF-569 is still applicable.]

3.0 REGULATORY ANALYSIS

3.1 No Significant Hazards Consideration Determination

[LICENSEE] requests adoption of TSTF-569, "Revise Response Time Testing Definition,"

which is an approved change to the Improved Standard Technical Specifications (ISTS), into the Page 3

TSTF-569, Rev. 2

[PLANT NAME, UNIT NOS] Technical Specifications (TS). The proposed amendment revises the TS Definitions for Engineered Safety Feature (ESF) Response Time and [Reactor Trip System (RTS) Response Time (for Westinghouse plants) or Reactor Protection System (RPS)

Response Time (for CE plants)].

[LICENSEE] has evaluated whether a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No The proposed change revises the TS Definition of [RTS or RPS] and ESF instrumentation response time to permit the licensee to evaluate using an NRC-approved methodology and apply a bounding response time for some components in lieu of measurement. The requirement for the instrumentation to actuate within the response time assumed in the accident analysis is unaffected.

The response time associated with the [RTS or RPS] and ESF instrumentation is not an initiator of any accident. Therefore, the proposed change has no significant effect on the probability of any accident previously evaluated.

The affected [RTS or RPS] and ESF instrumentation are assumed to actuate their respective components within the required response time to mitigate accidents previously evaluated. Revising the TS definition for [RTS or RPS] and ESF instrumentation response times to allow an NRC-approved methodology for verifying response time for some components does not alter the surveillance requirements that verify the [RTS or RPS] and ESF instrumentation response times are within the required limits. As such, the TS will continue to assure that the [RTS or RPS] and ESF instrumentation actuate their associated components within the specified response time to accomplish the required safety functions assumed in the accident analyses. Therefore, the assumptions used in any accidents previously evaluated are unchanged and there is no significant increase in the consequences.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The proposed change revises the TS Definition of [RTS or RPS] and ESF instrumentation response time to permit the licensee to evaluate using an NRC-approved methodology and apply a bounding response time for some components in lieu of measurement. The proposed change does not involve a physical alteration of the plant (i.e., no new or different type of equipment will be installed). The proposed change does not alter any Page 4

TSTF-569, Rev. 2 assumptions made in the safety analyses. The proposed change does not alter the limiting conditions for operation for the [RTS or RPS] or ESF instrumentation, nor does it change the Surveillance Requirement to verify the [RTS or RPS] and ESF instrumentation response times are within the required limits. As such, the proposed change does not alter the operability requirements for the [RTS or RPS] and ESF instrumentation, and therefore, does not introduce any new failure modes.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No The proposed change revises the TS Definition of [RTS or RPS] and ESF instrumentation response time to permit the licensee to evaluate using an NRC-approved methodology and apply a bounding response time for some components in lieu of measurement. The proposed change has no effect on the required [RTS or RPS] and ESF instrumentation response times or setpoints assumed in the safety analyses and the TS requirements to verify those response times and setpoints. The proposed change does not alter any Safety Limits or analytical limits in the safety analysis. The proposed change does not alter the TS operability requirements for the [RTS or RPS] and ESF instrumentation. The [RTS or RPS] and ESF instrumentation actuation of the required systems and components at the required setpoints and within the specified response times will continue to accomplish the design basis safety functions of the associated systems and components in the same manner as before. As such, the [RTS or RPS] and ESF instrumentation will continue to perform the required safety functions as assumed in the safety analyses for all previously evaluated accidents.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, the [LICENSEE] concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

3.2 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Page 5

TSTF-569, Rev. 2 4.0 EVIRONMENTAL EVALUATION The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.

Page 6

TSTF-569, Rev. 2 Technical Specifications and Bases Proposed Changes

TSTF-569, Rev. 2 Definitions 1.1 1.1 Definitions ENGINEERED SAFETY The ESF RESPONSE TIME shall be that time interval from FEATURE (ESF) RESPONSE when the monitored parameter exceeds its actuation TIME setpoint at the channel sensor until the ESF equipment is capable of performing its safety function (i.e., the valves travel to their required positions, pump discharge pressures reach their required values, etc.). Times shall include diesel generator starting and sequence loading delays, where applicable. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC, or the components have been evaluated in accordance with an NRC approved methodology.

LEAKAGE LEAKAGE shall be:

a. Identified LEAKAGE

1. LEAKAGE, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leakoff), that is captured and conducted to collection systems or a sump or collecting tank,

2. LEAKAGE into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary LEAKAGE, or

3. Reactor Coolant System (RCS) LEAKAGE through a steam generator to the Secondary System (primary to secondary LEAKAGE);

b. Unidentified LEAKAGE All LEAKAGE (except RCP seal water injection or leakoff) that is not identified LEAKAGE, and

c. Pressure Boundary LEAKAGE LEAKAGE (except primary to secondary LEAKAGE) through a nonisolable fault in an RCS component body, pipe wall, or vessel wall.

Westinghouse STS 1.1-3 Rev. 4.0

TSTF-569, Rev. 2 Definitions 1.1 1.1 Definitions QUADRANT POWER TILT QPTR shall be the ratio of the maximum upper excore RATIO (QPTR) detector calibrated output to the average of the upper excore detector calibrated outputs, or the ratio of the maximum lower excore detector calibrated output to the average of the lower excore detector calibrated outputs, whichever is greater.

RATED THERMAL POWER RTP shall be a total reactor core heat transfer rate to the (RTP) reactor coolant of [2893] MWt.

REACTOR TRIP SYSTEM The RTS RESPONSE TIME shall be that time interval from (RTS) RESPONSE TIME when the monitored parameter exceeds its RTS trip setpoint at the channel sensor until loss of stationary gripper coil voltage. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC, or the components have been evaluated in accordance with an NRC approved methodology.

SHUTDOWN MARGIN (SDM) SDM shall be the instantaneous amount of reactivity by which the reactor is subcritical or would be subcritical from its present condition assuming:

a. All rod cluster control assemblies (RCCAs) are fully inserted except for the single RCCA of highest reactivity worth, which is assumed to be fully withdrawn.

However, with all RCCAs verified fully inserted by two independent means, it is not necessary to account for a stuck RCCA in the SDM calculation. With any RCCA not capable of being fully inserted, the reactivity worth of the RCCA must be accounted for in the determination of SDM, and

b. In MODES 1 and 2, the fuel and moderator temperatures are changed to the [nominal zero power design level].

SLAVE RELAY TEST A SLAVE RELAY TEST shall consist of energizing all slave relays in the channel required for channel OPERABILITY and verifying the OPERABILITY of each required slave relay.

The SLAVE RELAY TEST shall include a continuity check of associated required testable actuation devices. The SLAVE RELAY TEST may be performed by means of any series of sequential, overlapping, or total steps.

Westinghouse STS 1.1-5 Rev. 4.0

TSTF-569, Rev. 2 RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.1.16 SR 3.3.1.16 verifies that the individual channel/train actuation response times are less than or equal to the maximum values assumed in the accident analysis. Response time testing acceptance criteria are included in Technical Requirements Manual, Section 15 (Ref. 14).

Individual component response times are not modeled in the analyses.

The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the equipment reaches the required functional state (i.e.,

control and shutdown rods fully inserted in the reactor core).

For channels that include dynamic transfer Functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer Function set to one, with the resulting measured response time compared to the appropriate FSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value, provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.

---

REVIEWERS NOTE-----------------------------------

Applicable portions of the following Bases are applicable for plants adopting WCAP-13632-P-A and/or WCAP-14036-P, and the methodology contained in Attachment 1 to TSTF-569.

Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from:

(1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) in place, onsite, or offsite (e.g.,

vendor) test measurements, or (3) utilizing vendor engineering specifications. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," (Ref. 10) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test.

Westinghouse STS B 3.3.1A-65 Rev. 4.0

TSTF-569, Rev. 2 RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A BASES SURVEILLANCE REQUIREMENTS (continued)

[ WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," (Ref. 15) provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time. ]

The allocations for sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.

The response time may be verified for components that replace the components that were previously evaluated in Ref. 10 and Ref. 15, provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only) Response Time Testing, (Ref. 16).

[ As appropriate, each channel's response must be verified every

[18] months on a STAGGERED TEST BASIS. Testing of the final actuation devices is included in the testing. Response times cannot be determined during unit operation because equipment operation is required to measure response times. Experience has shown that these components usually pass this surveillance when performed at the 18 months Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

SR 3.3.1.16 is modified by a Note stating that neutron detectors are excluded from RTS RESPONSE TIME testing. This Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response.

Westinghouse STS B 3.3.1A-66 Rev. 4.0

TSTF-569, Rev. 2 RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A BASES REFERENCES (continued)

4. FSAR, Chapter [15].

5. IEEE-279-1971.

6. 10 CFR 50.49.

7. Plant specific setpoint methodology study.

8. WCAP-14333-P-A, Rev. 1, October 1998.

9. WCAP-10271-P-A, Supplement 1, May 1986.

10. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," January 1996.

11. [ Plant specific evaluation reference.]

12. WCAP-10271-P-A, Supplement 2, June 1990.

13. WCAP-15376, Rev. 0, October 2000.

14. Technical Requirements Manual, Section 15, "Response Times."

15. WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," December 1995.

16. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing Westinghouse STS B 3.3.1A-68 Rev. 4.0

TSTF-569, Rev. 2 RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B BASES SURVEILLANCE REQUIREMENTS (continued)

The SR is modified by a Note that excludes verification of setpoints from the TADOT. The Functions affected have no setpoints associated with them.

SR 3.3.1.15 SR 3.3.1.15 is the performance of a TADOT of Turbine Trip Functions. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This TADOT is as described in SR 3.3.1.4, except that this test is performed prior to exceeding the [P-9] interlock whenever the unit has been in MODE 3. This Surveillance is not required if it has been performed within the previous 31 days. Verification of the Trip Setpoint does not have to be performed for this Surveillance. Performance of this test will ensure that the turbine trip Function is OPERABLE prior to exceeding the [P-9] interlock.

SR 3.3.1.16 SR 3.3.1.16 verifies that the individual channel/train actuation response times are less than or equal to the maximum values assumed in the accident analysis. Response time testing acceptance criteria are included in Technical Requirements Manual, Section 15 (Ref. 14).

Individual component response times are not modeled in the analyses.

The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the equipment reaches the required functional state (i.e.,

control and shutdown rods fully inserted in the reactor core).

For channels that include dynamic transfer Functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer Function set to one, with the resulting measured response time compared to the appropriate FSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value, provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.

Westinghouse STS B 3.3.1B-62 Rev. 4.0

TSTF-569, Rev. 2 RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B BASES SURVEILLANCE REQUIREMENTS (continued)

---

REVIEWERS NOTE-----------------------------------

Applicable portions of the following Bases are applicable for plants adopting WCAP-13632-P-A and/or WCAP-14036-P, and the methodology contained in Attachment 1 to TSTF-569.

Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from:

(1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) in place, onsite, or offsite (e.g.,

vendor) test measurements, or (3) utilizing vendor engineering specifications. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," (Ref. 10) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test.

[ WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," (Ref. 15) provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.]

The allocations for sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.

The response time may be verified for components that replace the components that were previously evaluated in Ref. 10 and Ref. 15, provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only) Response Time Testing, (Ref. 16).

[ As appropriate, each channel's response must be verified every

[18] months on a STAGGERED TEST BASIS. Testing of the final actuation devices is included in the testing. Response times cannot be determined during unit operation because equipment operation is required to measure response times. Experience has shown that these Westinghouse STS B 3.3.1B-63 Rev. 4.0

TSTF-569, Rev. 2 RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B BASES REFERENCES (continued)

13. WCAP-15376, Rev. 0, October 2000.

14. Technical Requirements Manual, Section 15, "Response Times."

15. WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," December 1995.

16. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing Westinghouse STS B 3.3.1B-65 Rev. 4.0

TSTF-569, Rev. 2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation (Without Setpoint Control Program)

B 3.3.2A BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.10 This SR ensures the individual channel ESF RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis.

Response Time testing acceptance criteria are included in the Technical Requirements Manual, Section 15 (Ref. 13). Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the Trip Setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g.,

pumps at rated discharge pressure, valves in full open or closed position).

For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate FSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.

---

REVIEWERS NOTE-----------------------------------------

Applicable portions of the following Bases are applicable for plants adopting WCAP-13632-P-A (Ref. 14). and/or WCAP-14036-P (Ref. 15),

and the methodology contained in Attachment 1 to TSTF-569.

Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from:

(1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) in place, onsite, or offsite (e.g.,

vendor) test measurements, or (3) utilizing vendor engineering specifications. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," (Ref. 14) dated January 1996, provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test.

Westinghouse STS B 3.3.2A-59 Rev. 4.0

TSTF-569, Rev. 2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation (Without Setpoint Control Program)

B 3.3.2A BASES SURVEILLANCE REQUIREMENTS (continued)

WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," (Ref. 15) provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.

The allocations for sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.

The response time may be verified for components that replace the components that were previously evaluated in Ref. 14 and Ref. 15, provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only) Response Time Testing, (Ref. 16).

[ ESF RESPONSE TIME tests are conducted on an [18] month STAGGERED TEST BASIS. Testing of the final actuation devices, which make up the bulk of the response time, is included in the testing of each channel. The final actuation device in one train is tested with each channel. Therefore, staggered testing results in response time verification of these devices every [18] months. The [18] month Frequency is consistent with the typical refueling cycle and is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

This SR is modified by a Note that clarifies that the turbine driven AFW pump is tested within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after reaching [1000] psig in the SGs.

Westinghouse STS B 3.3.2A-60 Rev. 4.0

TSTF-569, Rev. 2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation (Without Setpoint Control Program)

B 3.3.2A

14. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," January 1996.

15. WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," December 1995.

16. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing Westinghouse STS B 3.3.2A-62 Rev. 4.0

TSTF-569, Rev. 2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation (With Setpoint Control Program)

B 3.3.2B BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.10 This SR ensures the individual channel ESF RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis.

Response Time testing acceptance criteria are included in the Technical Requirements Manual, Section 15 (Ref. 13). Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the Trip Setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g.,

pumps at rated discharge pressure, valves in full open or closed position).

For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate FSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.

---

REVIEWERS NOTE-----------------------------------------

Applicable portions of the following Bases are applicable for plants adopting WCAP-13632-P-A (Ref. 14). and/or WCAP-14036-P (Ref. 15),

and the methodology contained in Attachment 1 to TSTF-569.

Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from:

(1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) in place, onsite, or offsite (e.g.,

vendor) test measurements, or (3) utilizing vendor engineering specifications. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," (Ref. 14) dated January 1996, provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. Response time verification for other sensor types must be demonstrated by test.

Westinghouse STS B 3.3.2B-57 Rev. 4.0

TSTF-569, Rev. 2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation (With Setpoint Control Program)

B 3.3.2B BASES SURVEILLANCE REQUIREMENTS (continued)

WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," (Ref. 15) provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.

The allocations for sensor, signal conditioning, and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.

The response time may be verified for components that replace the components that were previously evaluated in Ref. 14 and Ref. 15, provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only) Response Time Testing, (Ref. 16).

[ ESF RESPONSE TIME tests are conducted on an [18] month STAGGERED TEST BASIS. Testing of the final actuation devices, which make up the bulk of the response time, is included in the testing of each channel. The final actuation device in one train is tested with each channel. Therefore, staggered testing results in response time verification of these devices every [18] months. The [18] month Frequency is consistent with the typical refueling cycle and is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

This SR is modified by a Note that clarifies that the turbine driven AFW pump is tested within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after reaching [1000] psig in the SGs.

Westinghouse STS B 3.3.2B-58 Rev. 4.0

TSTF-569, Rev. 2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation (With Setpoint Control Program)

B 3.3.2B BASES REFERENCES (continued)

14. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements," January 1996.

15. WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel Response Time Tests," December 1995.

16. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing Westinghouse STS B 3.3.2B-60 Rev. 4.0

TSTF-569, Rev. 2 Definitions 1.1 1.1 Definitions

- AVERAGE shall be the average (weighted in proportion to the DISINTEGRATION ENERGY concentration of each radionuclide in the reactor coolant at the time of sampling) of the sum of the average beta and gamma energies per disintegration (in MeV) for isotopes, other than iodines, with half lives > [15] minutes, making up at least 95%

of the total noniodine activity in the coolant.

ENGINEERED SAFETY The ESF RESPONSE TIME shall be that time interval from FEATURE (ESF) RESPONSE when the monitored parameter exceeds its ESF actuation TIME setpoint at the channel sensor until the ESF equipment is capable of performing its safety function (i.e., the valves travel to their required positions, pump discharge pressures reach their required values, etc.). Times shall include diesel generator starting and sequence loading delays, where applicable. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC, or the components have been evaluated in accordance with an NRC approved methodology.

LEAKAGE LEAKAGE shall be:

a. Identified LEAKAGE

1. LEAKAGE, such as that from pump seals or valve packing (except reactor coolant pump (RCP) seal water injection or leakoff), that is captured and conducted to collection systems or a sump or collecting tank,

2. LEAKAGE into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary LEAKAGE, or

3. Reactor Coolant System (RCS) LEAKAGE through a steam generator to the Secondary System (primary to secondary LEAKAGE),

b. Unidentified LEAKAGE All LEAKAGE (except RCP seal water injection or leakoff) that is not identified LEAKAGE, and Combustion Engineering STS 1.1-3 Rev. 4.0

TSTF-569, Rev. 2 Definitions 1.1 1.1 Definitions REACTOR PROTECTION The RPS RESPONSE TIME shall be that time interval from SYSTEM (RPS) RESPONSE when the monitored parameter exceeds its RPS trip setpoint at TIME the channel sensor until electrical power to the CEAs drive mechanism is interrupted. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured. In lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC, or the components have been evaluated in accordance with an NRC approved methodology.

SHUTDOWN MARGIN (SDM) SDM shall be the instantaneous amount of reactivity by which the reactor is subcritical or would be subcritical from its present condition assuming:

a. All full length CEAs (shutdown and regulating) are fully inserted except for the single CEA of highest reactivity worth, which is assumed to be fully withdrawn. However, with all CEAs verified fully inserted by two independent means, it is not necessary to account for a stuck CEA in the SDM calculation. With any CEAs not capable of being fully inserted, the reactivity worth of these CEAs must be accounted for in the determination of SDM, and

[ b. There is no change in part length CEA position. ]

[ STAGGERED TEST BASIS A STAGGERED TEST BASIS shall consist of the testing of one of the systems, subsystems, channels, or other designated components during the interval specified by the Surveillance Frequency, so that all systems, subsystems, channels, or other designated components are tested during n Surveillance Frequency intervals, where n is the total number of systems, subsystems, channels, or other designated components in the associated function. ]

THERMAL POWER THERMAL POWER shall be the total reactor core heat transfer rate to the reactor coolant.

Combustion Engineering STS 1.1-5 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Analog) (Without Setpoint Control Program)

B 3.3.1A BASES SURVEILLANCE REQUIREMENTS (continued)

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

The Surveillance is modified by a Note to indicate that the neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the calorimetric calibration (SR 3.3.1.2) and the linear subchannel gain check (SR 3.3.1.3).

SR 3.3.1.9 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis.

Individual component response times are not modeled in the analyses.

The analyses model the overall or total elapsed time from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. [ Response times are conducted on an

[18] month STAGGERED TEST BASIS. This results in the interval between successive surveillances of a given channel of n x 18 months, where n is the number of channels in the function. The Frequency of

[18] months is based upon operating experience, which has shown that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

Also, response times cannot be determined at power, since equipment operation is required.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

Combustion Engineering STS B 3.3.1A-37 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Analog) (Without Setpoint Control Program)

B 3.3.1A BASES SURVEILLANCE REQUIREMENTS (continued)

Testing may be performed in one measurement or in overlapping segments, with verification that all components are tested.

---

REVIEWERS NOTE-----------------------------------

Applicable portions of the following TS Bases are applicable to plants adopting CEOG Topical Report CE NPSD-1167-1, "Elimination of Pressure Sensor Response Time Testing Requirements,." and the methodology contained in Attachment 1 to TSTF-569.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements,"

(Ref. 11) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report. The response time may be verified for components that replace the components that were previously evaluated in Ref. 11 provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing, (Ref. 12). Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.2).

REFERENCES 1. Regulatory Guide 1.105, Revision 3, "Setpoints for Safety-Related Instrumentation."

2. 10 CFR 50, Appendix A, GDC 21.

3. 10 CFR 100.

4. IEEE Standard 279-1971, April 5, 1972.

5. FSAR, Chapter [14].

Combustion Engineering STS B 3.3.1A-38 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Analog) (Without Setpoint Control Program)

B 3.3.1A BASES REFERENCES (continued)

6. 10 CFR 50.49.

7. "Plant Protection System Selection of Trip Setpoint Values."

8. FSAR, Section [7.2].

9. NRC Safety Evaluation Report, [Date].

10. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989.

11. CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

12. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing.

Combustion Engineering STS B 3.3.1-39 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Analog) (With Setpoint Control Program)

B 3.3.1B BASES SURVEILLANCE REQUIREMENTS (continued) functioning as required and is expected to pass the next surveillance, then the channel is OPERABLE and can be restored to service at the completion of the surveillance. After the surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.

[ The Frequency is based upon the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

The Surveillance is modified by a Note to indicate that the neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the calorimetric calibration (SR 3.3.1.2) and the linear subchannel gain check (SR 3.3.1.3).

SR 3.3.1.9 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis.

Individual component response times are not modeled in the analyses.

The analyses model the overall or total elapsed time from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. [ Response times are conducted on an

[18] month STAGGERED TEST BASIS. This results in the interval between successive surveillances of a given channel of n x 18 months, where n is the number of channels in the function. The Frequency of

[18] months is based upon operating experience, which has shown that random failures of instrumentation components causing serious response Combustion Engineering STS B 3.3.1B-35 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Analog) (With Setpoint Control Program)

B 3.3.1B BASES SURVEILLANCE REQUIREMENTS (continued) time degradation, but not channel failure, are infrequent occurrences.

Also, response times cannot be determined at power, since equipment operation is required.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

Testing may be performed in one measurement or in overlapping segments, with verification that all components are tested.

---

REVIEWERS NOTE-----------------------------------

Applicable portions of the following TS Bases are applicable to plants adopting CEOG Topical Report CE NPSD-1167-1, "Elimination of Pressure Sensor Response Time Testing Requirements,." and the methodology contained in Attachment 1 to TSTF-569.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements,"

(Ref. 10) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report. The response time may be verified for components that replace the components that were previously evaluated in Ref. 10 provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing, (Ref. 11). Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

Combustion Engineering STS B 3.3.1B-36 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Analog) (With Setpoint Control Program)

B 3.3.1B BASES SURVEILLANCE REQUIREMENTS (continued)

A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.2).

REFERENCES 1. Regulatory Guide 1.105, Revision 3, "Setpoints for Safety-Related Instrumentation."

2. 10 CFR 50, Appendix A, GDC 21.

3. 10 CFR 100.

4. IEEE Standard 279-1971, April 5, 1972.

5. FSAR, Chapter [14].

6. 10 CFR 50.49.

7. FSAR, Section [7.2].

8. NRC Safety Evaluation Report, [Date].

9. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989.

10. CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

11. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing.

Combustion Engineering STS B 3.3.1B-37 Rev. 4.0

TSTF-569, Rev. 2 ESFAS Instrumentation (Analog) (Without Setpoint Control Program)

B 3.3.4A BASES SURVEILLANCE REQUIREMENTS (continued)

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

SR 3.3.4.4 is modified by two Notes as identified in Table 3.3.4-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value.

Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.

The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the [LTSP]. Where a setpoint more conservative than the [LTSP] is used in the plant surveillance procedures [NTSP], the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the [LTSP], then the channel shall be declared inoperable.

The second Note also requires that [LTSP] and the methodologies for calculating the as-left and the as-found tolerances be in [insert the facility FSAR reference or the name of any document incorporated into the facility FSAR by reference].

SR 3.3.4.5 This Surveillance ensures that the train actuation response times are the maximum values assumed in the safety analyses. Individual component response times are not modeled in the analyses. The analysis models the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the equipment in both trains reaches the required functional state (e.g.,

Combustion Engineering STS B 3.3.4A-26 Rev. 4.0

TSTF-569, Rev. 2 ESFAS Instrumentation (Analog) (Without Setpoint Control Program)

B 3.3.4A BASES SURVEILLANCE REQUIREMENTS (continued) pumps at rated discharge pressure, valves in full open or closed position).

Response time testing acceptance criteria are included in Reference 5.

The test may be performed in one measurement or in overlapping segments, with verification that all components are measured.

---

REVIEWERS NOTE-----------------------------------

Applicable portions of the following TS Bases are applicable to plants adopting CEOG Topical Report CE NPSD-1167-1, "Elimination of Pressure Sensor Response Time Testing Requirements,." and the methodology contained in Attachment 1 to TSTF-569.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements,"

(Ref. 12) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report. The response time may be verified for components that replace the components that were previously evaluated in Ref. 12 provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing, (Ref. 13). Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

[ ESF RESPONSE TIME tests are conducted on a STAGGERED TEST BASIS of once every [18] months. This results in the interval between successive tests of a given channel of n x 18 months, where n is the number of channels in the Function. Surveillance of the final actuation devices, which make up the bulk of the response time, is included in the testing of each channel. Therefore, staggered testing results in response time verification of these devices every [18] months. The [18] month STAGGERED TEST BASIS Frequency is based upon plant operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

OR Combustion Engineering STS B 3.3.4A-27 Rev. 4.0

TSTF-569, Rev. 2 ESFAS Instrumentation (Analog) (Without Setpoint Control Program)

B 3.3.4A BASES SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

REFERENCES 1. Regulatory Guide 1,105, "Setpoints for Safety-Related Instrumentation," Revision 3.

2. 10 CFR 50, Appendix A.

3. 10 CFR 100.

4. FSAR, Section [7.3].

5. NRC Safety Evaluation Report, [Date].

6. IEEE Standard 279-1971.

7. FSAR, Chapter [14].

8. 10 CFR 50.49.

9. "Plant Protection System Selection of Trip Setpoint Values."

10. FSAR, Section [7.2].

11. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989.

12. CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

13. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing.

Combustion Engineering STS B 3.3.4A-28 Rev. 4.0

TSTF-569, Rev. 2 ESFAS Instrumentation (Analog) (With Setpoint Control Program)

B 3.3.4B BASES SURVEILLANCE REQUIREMENTS (continued)

[ The Frequency is based upon the assumption of an [18] month calibration interval for the determination of the magnitude of equipment drift in the setpoint analysis.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

SR 3.3.4.5 This Surveillance ensures that the train actuation response times are the maximum values assumed in the safety analyses. Individual component response times are not modeled in the analyses. The analysis models the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the equipment in both trains reaches the required functional state (e.g.,

pumps at rated discharge pressure, valves in full open or closed position).

Response time testing acceptance criteria are included in Reference 5.

The test may be performed in one measurement or in overlapping segments, with verification that all components are measured.

---

REVIEWERS NOTE-----------------------------------

Applicable portions of the following TS Bases are applicable to plants adopting CEOG Topical Report CE NPSD-1167-1, "Elimination of Pressure Sensor Response Time Testing Requirements,." and the methodology contained in Attachment 1 to TSTF-569.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from records of test results, vendor test data, or Combustion Engineering STS B 3.3.4B-25 Rev. 4.0

TSTF-569, Rev. 2 ESFAS Instrumentation (Analog) (With Setpoint Control Program)

B 3.3.4B BASES SURVEILLANCE REQUIREMENTS (continued) vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements,"

(Ref. 12) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report. The response time may be verified for components that replace the components that were previously evaluated in Ref. 12 provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing, (Ref. 13). Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

[ ESF RESPONSE TIME tests are conducted on a STAGGERED TEST BASIS of once every [18] months. This results in the interval between successive tests of a given channel of n x 18 months, where n is the number of channels in the Function. Surveillance of the final actuation devices, which make up the bulk of the response time, is included in the testing of each channel. Therefore, staggered testing results in response time verification of these devices every [18] months. The [18] month STAGGERED TEST BASIS Frequency is based upon plant operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

REFERENCES 1. Regulatory Guide 1,105, "Setpoints for Safety-Related Instrumentation," Revision 3.

2. 10 CFR 50, Appendix A.

3. 10 CFR 100.

Combustion Engineering STS B 3.3.4B-26 Rev. 4.0

TSTF-569, Rev. 2 ESFAS Instrumentation (Analog) (With Setpoint Control Program)

B 3.3.4B BASES REFERENCES (continued)

4. FSAR, Section [7.3].

5. NRC Safety Evaluation Report, [Date].

6. IEEE Standard 279-1971.

7. FSAR, Chapter [14].

8. 10 CFR 50.49.

9. "Plant Protection System Selection of Trip Setpoint Values."

10. FSAR, Section [7.2].

11. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989.

12. CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

13. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing.

Combustion Engineering STS B 3.3.4B-27 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Digital) (Without Setpoint Control Program)

B 3.3.1A BASES SURVEILLANCE REQUIREMENTS (continued) feature is verified by the trip Function CHANNEL FUNCTIONAL TEST, SR 3.3.1.7 or SR 3.3.1.9. Therefore, further testing of the bypass function after startup is unnecessary.

SR 3.3.1.14 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis.

Individual component response times are not modeled in the analyses.

The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. [ Response times are conducted on an

[18] month STAGGERED TEST BASIS. This results in the interval between successive surveillances of a given channel of n x 18 months, where n is the number of channels in the function. The Frequency of

[18] months is based upon operating experience, which has shown that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

Also, response times cannot be determined at power, since equipment operation is required. Testing may be performed in one measurement or in overlapping segments, with verification that all components are tested.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

---

REVIEWERS NOTE-----------------------------------

Applicable portions of the following TS Bases are applicable to plants adopting CEOG Topical Report CE NPSD-1167-1, "Elimination of Pressure Sensor Response Time Testing Requirements,." and the methodology contained in Attachment 1 to TSTF-569.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response Combustion Engineering STS B 3.3.1A-43 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Digital) (Without Setpoint Control Program)

B 3.3.1A BASES SURVEILLANCE REQUIREMENTS (continued) times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements,"

(Ref. 11) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report. The response time may be verified for components that replace the components that were previously evaluated in Ref. 11 provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing, (Ref. 12). Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4).

REFERENCES 1. Regulatory Guide 1.105, Revision 3, "Setpoints for Safety-Related Instrumentation."

2. 10 CFR 50, Appendix A, GDC 21.

3. 10 CFR 100.

4. NRC Safety Evaluation Report.

5. IEEE Standard 279-1971, April 5, 1972.

6. FSAR, Chapter [14].

7. 10 CFR 50.49.

8. "Plant Protection System Selection of Trip Setpoint Values."

9. FSAR, Section [7.2].

10. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989.

11. CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

Combustion Engineering STS B 3.3.1A-44 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Digital) (Without Setpoint Control Program)

B 3.3.1A

12. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing.

Combustion Engineering STS B 3.3.1A-45 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Digital) (With Setpoint Control Program)

B 3.3.1B BASES SURVEILLANCE REQUIREMENTS (continued)

This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Proper operation of bypass permissives is critical during plant startup because the bypasses must be in place to allow startup operation and must be removed at the appropriate points during power ascent to enable certain reactor trips. Consequently, the appropriate time to verify bypass removal function OPERABILITY is just prior to startup.

The allowance to conduct this Surveillance within 92 days of startup is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 9). Once the operating bypasses are removed, the bypasses must not fail in such a way that the associated trip Function gets inadvertently bypassed. This feature is verified by the trip Function CHANNEL FUNCTIONAL TEST, SR 3.3.1.7 or SR 3.3.1.9. Therefore, further testing of the bypass function after startup is unnecessary.

SR 3.3.1.14 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis.

Individual component response times are not modeled in the analyses.

The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. [ Response times are conducted on an

[18] month STAGGERED TEST BASIS. This results in the interval between successive surveillances of a given channel of n x 18 months, where n is the number of channels in the function. The Frequency of

[18] months is based upon operating experience, which has shown that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

Also, response times cannot be determined at power, since equipment operation is required. Testing may be performed in one measurement or in overlapping segments, with verification that all components are tested.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Combustion Engineering STS B 3.3.1B-41 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Digital) (With Setpoint Control Program)

B 3.3.1B BASES SURVEILLANCE REQUIREMENTS (continued)

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

---

REVIEWERS NOTE-----------------------------------

Applicable portions of the following TS Bases are applicable to plants adopting CEOG Topical Report CE NPSD-1167-1, "Elimination of Pressure Sensor Response Time Testing Requirements.," and the methodology contained in Attachment 1 to TSTF-569.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements,"

(Ref. 10) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report. The response time may be verified for components that replace the components that were previously evaluated in Ref. 10 provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing, (Ref. 11). Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4).

REFERENCES 1. Regulatory Guide 1.105, Revision 3, "Setpoints for Safety-Related Instrumentation."

2. 10 CFR 50, Appendix A, GDC 21.

3. 10 CFR 100.

Combustion Engineering STS B 3.3.1B-42 Rev. 4.0

TSTF-569, Rev. 2 RPS Instrumentation - Operating (Digital) (With Setpoint Control Program)

B 3.3.1B BASES REFERENCES (continued)

4. NRC Safety Evaluation Report.

5. IEEE Standard 279-1971, April 5, 1972.

6. FSAR, Chapter [14].

7. 10 CFR 50.49.

8. FSAR, Section [7.2].

9. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989.

10. CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

11. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing.

Combustion Engineering STS B 3.3.1B-43 Rev. 4.0

TSTF-569, Rev. 2 ESFAS Instrumentation (Digital) (Without Setpoint Control Program)

B 3.3.5A BASES SURVEILLANCE REQUIREMENTS (continued)

The second Note also requires that [LTSP] and the methodologies for calculating the as-left and the as-found tolerances be in [insert the facility FSAR reference or the name of any document incorporated into the facility FSAR by reference].

SR 3.3.5.4 This Surveillance ensures that the train actuation response times are within the maximum values assumed in the safety analyses.

Response time testing acceptance criteria are included in Reference 12.

---

REVIEWERS NOTE-----------------------------------

Applicable portions of the following TS Bases are applicable to plants adopting CEOG Topical Report CE NPSD-1167-1, "Elimination of Pressure Sensor Response Time Testing Requirements,." and the methodology contained in Attachment 1 to TSTF-569.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements,"

(Ref. 13) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report. The response time may be verified for components that replace the components that were previously evaluated in Ref. 13 provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing, (Ref. 14). Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

[ ESF RESPONSE TIME tests are conducted on a STAGGERED TEST BASIS of once every [18] months. The [18] month Frequency is consistent with the typical industry refueling cycle and is based upon plant operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

Combustion Engineering STS B 3.3.5A-29 Rev. 4.0

TSTF-569, Rev. 2 ESFAS Instrumentation (Digital) (Without Setpoint Control Program)

B 3.3.5A BASES REFERENCES (continued)

3. 10 CFR 100.

4. FSAR, Section [7.3].

5. NRC Safety Evaluation Report.

6. IEEE Standard 279-1971.

7. FSAR, Chapter [15].

8. 10 CFR 50.49.

9. "Plant Protection System Selection of Trip Setpoint Values."

10. FSAR, Section [7.2].

11. CEN-327, May 1986, including Supplement 1, March 1989.

12. Response Time Testing Acceptance Criteria.

13. CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

14. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing.

Combustion Engineering STS B 3.3.5A-31 Rev. 4.0

TSTF-569, Rev. 2 ESFAS Instrumentation (Digital) (With Setpoint Control Program)

B 3.3.5B BASES SURVEILLANCE REQUIREMENTS (continued)

SCP. If the actual setting of the channel is found to be conservative with respect to the Allowable Value but is beyond the as-found tolerance band, the channel is OPERABLE but degraded. The degraded condition of the channel will be further evaluated during performance of the SR. This evaluation will consist of resetting the channel setpoint to the [NTSP]

(within the allowed tolerance), and evaluating the channel response. If the channel is functioning as required and is expected to pass the next surveillance, then the channel is OPERABLE and can be restored to service at the completion of the surveillance. After the surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.

[ The [18] month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

SR 3.3.5.4 This Surveillance ensures that the train actuation response times are within the maximum values assumed in the safety analyses.

Response time testing acceptance criteria are included in Reference 12.

---

REVIEWERS NOTE-----------------------------------

Applicable portions of the following TS Bases are applicable to plants adopting CEOG Topical Report CE NPSD-1167-1, "Elimination of Pressure Sensor Response Time Testing Requirements,." and the methodology contained in Attachment 1 to TSTF-569.

Combustion Engineering STS B 3.3.5B-27 Rev. 4.0

TSTF-569, Rev. 2 ESFAS Instrumentation (Digital) (With Setpoint Control Program)

B 3.3.5B BASES SURVEILLANCE REQUIREMENTS (continued)

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements,"

(Ref. 13) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report. The response time may be verified for components that replace the components that were previously evaluated in Ref. 13 provided that the components have been evaluated in accordance with the NRC approved methodology as discussed in Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing, (Ref. 14). Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

[ ESF RESPONSE TIME tests are conducted on a STAGGERED TEST BASIS of once every [18] months. The [18] month Frequency is consistent with the typical industry refueling cycle and is based upon plant operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

OR The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

---

REVIEWERS NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance Frequency Control Program should utilize the appropriate Frequency description, given above, and the appropriate choice of Frequency in the Surveillance Requirement.

---

]

SR 3.3.5.5 SR 3.3.5.5 is a CHANNEL FUNCTIONAL TEST similar to SR 3.3.5.2, except SR 3.3.5.5 is performed within 92 days prior to startup and is only applicable to bypass functions. Since the Pressurizer Pressure - Low bypass is identical for both the RPS and ESFAS, this is the same Combustion Engineering STS B 3.3.5B-28 Rev. 4.0

TSTF-569, Rev. 2 ESFAS Instrumentation (Digital) (With Setpoint Control Program)

B 3.3.5B

13. CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

14. Attachment 1 to TSTF-569, Methodology to Eliminate Pressure Sensor and Protection Channel (for Westinghouse Plants only)

Response Time Testing.

Combustion Engineering STS B 3.3.5B-30 Rev. 4.0