ML20057C377
| ML20057C377 | |
| Person / Time | |
|---|---|
| Site: | 05200001 |
| Issue date: | 09/16/1993 |
| From: | GENERAL ELECTRIC CO. |
| To: | |
| Shared Package | |
| ML20057C374 | List: |
| References | |
| NUDOCS 9309280285 | |
| Download: ML20057C377 (350) | |
Text
{{#Wiki_filter:. ABWR SECTION B3.3 INSERTS P&R REVIEW page 1 ALO 9/16/93
# Page Comment 001 83.3-003 -
Some parameters (e.g. SLCS and FWRB initiation on Reactor Vessel Water Level-Low, level 2) are connected to signal processing electronics that are separate from the normal SSLC processor. An Analog Trip Module (ATM) and logic card is provided in each division for these parameters. 002 B3.3-009 When normal AC power is not available LPFL actuation is delayed to allow sufficient time for the standby power-to become available and to permit load sequencing so that the peak demand on the standby power source is i within acceptable limits. The LPFL must provide flow to the vessel within a specified maximum time from receipt of an actuation signal and _ vessel pressure permissive when these delays are included. 003 B3.3-011 The HPCF pumps start immediately if normal AC power is available. When normal AC power is not available HPCF actuation is delayed to allow sufficient time for the standby power to become available and to permit load sequencing so that the peak demand on the standby power source is within acceptable limits. The HPCF must provide flow to the vessel within a specified maximum ' time from receipt of an actuation signal when these delays are included. 004 B3.3-011 A Low suction pressure Function is also provided to protect the pumps from cavitation. See LCO basis B3.3.1.4, "ESF Actuation Instrumentation" for additional information on these signals. 005 83.3-017 RECIRCULATION PUMP TRIPS Automatic Recirculation Pump Trips (RPT) are included in the ABWR to maintain the MCPR within limits for some pressurization events at End Of Cycle conditions (E0C-RPT) ard to reduce core reactivity for postulated ATWS events (ATWS-RPT). The SSLC provides low level 2d'M composite EOC-RPT (Turbine stop valve closure or turbine control valve fast closure)Cand swamJnitiath<iatP to the RPT signal processing devices. See B3.3.4.1, "ATWS & E0C RPT Instrumentation" for additional information. 006 B3.3-019 This LCO covers all Functions that use connections to the DTMs and the HMS Functic>ns. Functions, other than NMS, that are connected to the SLUs or TLUs are covered in the system actuation LCOs. O 9309280285 930921 PDR ADOCK05200001l PDR i A - J
ABWR SECTION B3.3 INSERTS P&R REVIEW page 2 ALO 9/16/93
# Page Comment 007 B3.3-030 Each ATM receives an analog signal directly from the process sensors for Function 3c. The ATM compares the signal with a setpoint to generate the ATWS mitigation Feature initiation signal.
008 B3.3-34 Each ATM receives an analog signal directly from the process sensors for Function 7c. The ATM compares the signal with a setpoint to generate the ATWS mitigation Feature initiation signal. 009 B3.3-36 Function 8a is also required to be OPERABLE in MODES 4 and 5 when HPCF is required to be OPERABLE to satisfy the requirement of at least two OPERABLE ECCS pumps when RPV level is less than a specified value above the vessel flange. 010 B3.3-38 Function 9a and 9b are also required to be OPERABLE in MODES 4 and 5 when the associated LPFL (A or C for 9a, 8 for 9b) are required to be OPERABLE to satisfy the requirement of at least two OPERABLE ECCS pumps when RPV level is less than a specified value above the vessel flange. 011 B3.3-40 - ESF Support. Various ESF support Features are also O> initiated on this Function. The Features that are initiated are SGTS, CAMS, RCW and RSW. 012 B3.3-40 RPS initiation (Function lla) is required to be OPERABLE l in MODES 1 and 2 consistent with the applicability of , the RPS in LCO 3.3.1.2, "RPS and MSIV Actuation". The MODE 5 applicability of RPS does not apply to this Function because there is insufficient energy in the RCS to pressurize the drywell. ! ESF and isolation initiation ( Functions 11b and 11c) are required in ... 013 B3.3-44 to provide confidence that no single failure will preclude protective action from this Function on a valid signal. RPS initiation (Function 15a) is required to be OPERABLE in MODES 1 and 2 consistent with the applicability of the RPS in LC0 3.3.1.2, "RPS and MSIV Actuation". The MODE 5 applicability of RPS does not apply to this function because there is no flow in the steamlines. Isolation initiation (Function 15b) is required to be OPERABLE in MODES 1, 2, and 3 consistent with the applicability of LC0 3.6.1.1, " Primary Containment".
ABWR SECTION B3.3 INSERTS P&R REVIEW page 3 ALO 9/16/93 O
# Page Comment 014 B3.3-45 reactor power may be high enough to require plant scram to reduce the suppression pool heat load to acceptable limits. Function 16b is required to be OPERABLE in MODES 1, 2, and 3 where 015 B3.3-56 This Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, " Primary Containment".
016 B3.3-65 Multiple entry into the conditions causes Condition G to be invoked on completion of Action H.1 so appropriate additional compensatory action is taken. 017 B3.3-67 This Action aoplies when the Required Actions of Conditions A, B, C, or D are not implemented within the specified Completion Times for those isolation Functions that have the conditions of applicability given in footnotes (g) or (h) of Table 3.3.1.1-1. 018 B3.3-69 These Actions apply when the Required Actions of Conditions A, B, C, or D are not implemented within the specified Completion Times for ECCS initiation Functions that are used by all ECCS systems and when the Required Action of Conditions 0 is not implemented within the specified Completion Time. 019 B3.3-70 These Actions apply when the Required Actions of Conditions A, B, C, or o a s riot implemented within the specified Completion Times for isolation initiation Functions that are used to isolate several flow paths. 20 B3.3-94 The Completion Times of 12 hours for isolating the penetration flow paths (Action L.1) provides sufficient time to identify the effected flow paths and perform the action. The Completion Times for achieving MODE 4 (Actions L.2.1 and L.2.2)... 21 B3.3-102 Multiple entry into the conditions causes Condition A to be invoked on completion of Action B.3 so appropriate additional compensatory action is taken. I l 22 B3.3-103 Under this condition protective action actuation is 1 maintained with an additional failure but the degree of redundancy is reduced. 23 B3.3-103 As noted at the beginning of the SRs, the SRs to be applied to each of the Functions are given in the SR column of Table 3.3.1.3-1. O
ABWR SECTION B3.3 INSERTS P&R REVIEW page 4 ALO 9/16/93
# Page Comment 24 B3.3-103 The test is performed by replacing the normal signal with a test signal as far upstream in the channel as possible within the constraints of the instrumentation design and the need to perform the surveillance without disrupting plant operations. See Section 1.1,
" definitions" for additional information on the scope of the test.
The devices used to implement the SLC and FWRB actuation functions are of high reliability and have a high degree of redundancy. Therefore, the [92] day frequency provides confidence that device Actuation will occur when needed. This test overlaps or is performed in conjunction with the DIVISIONAL FUNCTIONAL TESTS performed under LC0 3.3.1.1, "SSLC Sensor Instrumentation" to provide testing up to the OUTPUT CHANNEL. 25 B3.3-110 10d & 10e. Drywell Sumo Drain Line LCW/HCW Radiation-Hiah The drywell drain lines to the radwaste system are O L/ monitored for high radiation using one detector in each of the drain lines. High activity in the drain lines < could result in excessive radioactivity in the radwaste collection tanks. If the high activity flow continues without isolation, offsite dose limits may be reached. This Function also provides a diverse indication of primary coolant activity. Credit for these Functions is not taken in any transient or accident analysis in the _ ABWR SSAR. The detectors are connected to the PRRM system which i sends a trip signal to the division I SLU pair. The ! Allowable value is selected to be consistent with primary coolant activity limits. One channel of each of ; the Functions is required to be OPERABLE in MODES 1, 2, ' and 3 consistent with the Applicability for LCO 3.6.1.1,
" Primary Containment."
ABWR SECTION B3.3 INSERTS P&R REVIEW page 5 ALO 9/16/93
# Page Comment 26 B3.3-110 12e. RCIC Turbine Exhaust Diaphraam Pressure-Hiah High turbine exhaust diaphragm pressure indicates that the pressure may be too high to continue operation of the RCIC turbine. That is, one of two exhaust diaphragms has ruptured and pressure is reaching turbine casir] pressure limits. This isolation is for equipment protection and is not assumed in any transient or accident analysis in the ABWR SSAR. These instruments are included in the TS because of the potential for risk due to possible failure of the instruments preventing RCIC initiations.
The RCIC Turbine Exhaust Diaphragm Pressure-High data originates in four transmitters that are connected to the space between the rupture diaphragms on the turbine exhaust line. The division I and division II ESF SLU pairs each receive trip data from two of the turbine exhaust pressure transmitters. Two-of-two isolation I logic is used in the SLUs for this Function. Four- l instrumentation channels of RCIC Turbine Exhaust Diaphragm Pressure-High Functions are available and are . O required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function l or cause a spurious isolation. l The Allowable Values are high enough to prevent damage to the system's turbines. 1 0
e ABWR SECTION B3.3 INSERTS P&R REVIEW page 6 ALO 9/16/93
)
# Page Comment 27 B3.3-110 13e. CUW Isolation on SLC Initiation The isolation of the CUW System is required when the SLC System has been initiated to prevent dilution and removal of the boron solution by.the CUW System. SLC System initiation signals originate from the two SLC pump start signals. The SLC pump A start signal is connected to a division I SLU pair and the pump B signal to a division II SLU pair. The data is shared between division via suitable isolators. CUW isolation occurs when either pump is running.
There is no Allowable Value associated with this Function since it is discrete data based on the state of the SLC System operation detector. Two channels (one from each pump) of the SLC Initiation Function are required to be OPERABLE only in MODES 1 and 2, since these are the only MODES whe'e r the reactor can be critical, and these MODES are consistent with the Applicability for the SLC System (LCO 3.1.7). 28 B3.3-118 0.1 & D.2 [) This Condition addresses SENSOR CHANNEL failures for isolation SENSOR CHANNEL Functions that have only one channels For these Functions a failure in the SENSOR CHANNEL causes loss of automatic initiation. However, manual initiation is still available. Action D.1 causes restoration of the inoperable channel to OPERABLE status. Action D.2 provides an alternate of , closing the associated isolation valves which accomplishes the intended protective action. The Completion time are sufficient to perform the Required Actions. The times are acceptable because of there is a low probability of an event requiring the Functions within the time period and manual actuation capability is retained. I As noted, this Action applies only to Functions 10d, ; 10e, and 13d since these are the isolation Functions with one SENSORS CHANNEL. O l i l
i I ABWR SECTION B3.3 INSERTS P&R REVIEW page 7 ALO 9/16/93
# Page Comment l
29 B3.3-122 The [18] month frequency is based on the ABWR expected refueling interval and the need to perform this Surveillance under the conditions that apply during a plant outage. The Frequency is adequate baseo on the low drift of the devices used to implement the Functions covered by this LCO. 30 B3.3-127 A Note has also been provided to modify the Actions in this LCO. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent trains, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable SRNM channels provide appropriate compensatory measures for multiple inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable channel. 31 B3.3-127 A note has been added to this Required Action to exclude Q the MODE change restriction of LC0 3.0.4. This exception allows entry into the MODES or other specified conditions of applicability while relying on the Action. This exception is acceptable because adequate redundancy is maintained, the low probability of an event requiring these instruments, and the self-test features will detect most additional failures. 32 B3.3-135 A Note is included to exempt this Action from the MODE change restriction of LC0 3.0.4. This exemption allows entry into a MODE or other condition of applicability while relying on the Actions. This exception is acceptable because adequate redundancy is maintained, the low probability of an event requiring these instruments, and the self-test features will detect most additional failures. 33 B3.3-136 A note is included to exeapt this Action from the MODE change restriction of LC0 3.0.4. This exemption is require to avoid a potential " catch-22". The EMS must be OPERABLE in all MODES and other conditions while declaring the Features and Functions associated with the inoperable EMS division may require entry into a different MODE or other condition. l O
ABWR SECTION 83.3 INSERTS P&R REVIEW page 8 ALO 9/20/93 ' C' # Page Comment 34 B3.3-139 , and in a separate ATWS-ARI confirmatory logic device included specifically for ATWS-ARI Functions. The RFC is a triple redundant microprocessor system, the RCIS is a dual redundant microprocessor-based system, and the confirmatory logic device uses hardware ( i.e. not microprocessor based) logic. The data needed for the ATWS-ARI/ recirculation runback Functions is acquired from other systems using suitable isolation. 35 B3.3-139 and the scram header ARI valves are actuated when signals are received from any two of the three RFCs. 36 B3.3-143 A channel of this Function is considered to be OPERABLE when a level 3 signal originating in one of the three feedwater controllers is received by all three RFCs. 37 B3.3-144 A channel of this function is considered to be OPERABLE when a level 2 trip signal originating in one of the 1 four SSLC divisions is received by all three of the j RFCs. 38 B3.3-145 A channel of this function is considered to be OPERABLE when reactor pressure data originating in one of the . SB&PCs is received by all three RFCs. l O 39 83.3-145 A chaenel of this Fenctice is considered te be DeERABtE when an EOC-RPT trip signal originating in one of the four SSLC divisions is received by all three of the RFCs. ; 40 B3.3-146 Both of the RCIS systems and the confirmatory logic l receive scram follow data from the RPS portion of all four SSLC divisions. j 41 B3.3-146 A channel of this function is considered to be OPERABLE l when a scram follow signal originating in one of the l four SSLC divisions is received by both RCIS systems and j the confirmatory logic. 42 B3.3-147 A channel of this Function is considered to be OPERABLE when an ATWS-ARI initiation signal originating in one of l the three RFCs is received by both RCIS systems and the confirmatory logic. 43 B3.3-147 A channel of this Function is considered to be OPERABLE when an insertion initiation signal originating in one of the two RCISs is received by all associated FMCRD controllers. O O l l l
SSLC Sensor Instrun,entation 3.3.1.1 4 3.3 INSTRUMENTATION 3.3.1.1 Safety System Logic and Control (SSLC) Sensor Instrumentation LC0 3.3.1.1 The SSLC instrumentation for each Function in Table 3.3.1.1-1 shall be OPERABLE. APPLICABILITY: According to Table 3.3.1.1-1. f[ ~ V OTT::. ~ ACTIONS i *5 MhD 7 wwc% ord i ArewQ4 31 NOTE Separate Condition entry is allowed for each channel. CONDIT ION REQUIRED ACTION COMPLETION TIME A. One or more Functions A.NPlace SENSOR CHANNEL in 6 hours with one required trip. bl e h r M SENSOR CHANNEL inoperable. QR A.2.1 NOT E-Applies only to Functions 3 through BM - 3A Place affected division 6 hours in division of sensors bypass ! hotwMb k~ A.2.2 # NOTE Applies only to I Functions 1 & 2. channel in bypass 6 hours at Neutron Monitoring System.
. S.ND (continued) l ABWR TS 3.3-1 P&R 08/30/93 l
l
l ABWR SECTION B3.3 INSERTS P&R REVIEW page 9 ALO 9/20/93 ) i~ L> # Page Comment 44 B3.3-147 13. FMCRD Insertion Confirmatory Loaic l The confirmatory logic must transmit ATWS-ARI initiation data to the FMCRD controllers. The logic sends initiation signals to all of the FMCRD controllers when trip data is received from 2 of the 3 RFCs or two of the four RPS scram follow signa s. t One channel of this Function is required to be OPERABLE when ATWS mitigation is required to be OPERABLE to provide confidence that initiation of the FMCRD insertion Function of ATWS-ARI will occur on a valid signal. This function is considered to be OPERABLE when , it operates on its input signals as intended ( i.e. 2/4 ) on scram follow and 2/3 on RFC ATWS-ARI initiation) and presents an insertion initiation signal to all FMCRD controllers. There is no allowable value associated with this function. ! () j i l i l l i l O
j ACTIONS contin ued SSLC CONDITION Sensor Instrument ation 3.3.1.1 A. Continued REQUIRED ACTION A. 2.3' Res tore channel require COMPLETION TIME status. to OPERABLE 30 days 28 A.2.4 ( A t05 M
- NOTE to ock y 1.sensors Remove divi channel or NMS \ Thv.,
kr T, ! a g bypass after trip. placing channel in Q uA 1 k
- 2. bypass Division is of sensor or NHS b hours forallowed 6) for (ypass channel status. to OPERABLErestoring 3.maySENSOR be s CHANNEL ( )
remain inconsioered to condition a tripped division when a containi is placed inchannel (s)ng tripped division bypass due toof sensors into thissubsequent entries condition. Place channel in trip 30 days R TS 3.3-2 { continued) P&R 08/30/93
-XX
4 f SSLC Sensor Instrumentation ' 3.3.1.1 . i ( ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME { A. Continued A.2.3bRestore require 30 days ! channel to OPERABLE i status. l 93 ( 4tol;d'oolp . to 5' h% L ! ag A.2.4 NOTE
- 1. Remove division of DN \ TkP% 1 k '
sensors or NMS channel bypass after placing channel in trip.
- 2. Division of sensor bypass or NMS bypass is allowed for [6]
hours for restoring j channel to OPERABLE status. ,
- 3. SENSOR CHANNEL (s) .
may be considered to remain in a tripped ' condition when a division containing ; tripped channel (s) , i l is placed in ! t division of sensors bypass due to - - ' subsequent entries ' into this condition. Place channel in trip 30 days I i t - (continued)- ABWR TS 3.3-2 P&R 08/30/93 I 1,-- - , -. . _ __
~~~- - h ,Q _SjlLC Sensor Instrumentation Atd',--$ c>e\ y te., p q g, 3.3.1.1
\ %r o Q^ ;
( ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME ! v , B. One or more Functions B.1 Place one channel in trip 3 hours. , with two required , SENSOR CHANNELS AND ' inoperable. B.2.1 NOTE i Applies only to 31 l Functions 3 through-24. j
' l Place the other 6 Hours l affected division in !
division of sensors ; bypass. , l
@ l i
B.2.2 NOTE Applies only to . I Functions 1 & 2. f Place the other . 6 hours ; affected channel in bypass. , t M i B.34estore at least one 30 days required channel to OPERABLE status. : i i ! C. One or more Functions NOTE with three required Applies only to Functions 1 : SENSOR CHANNELS through 3%,1 A inoperable. C.1 Place one channel in Immediately , trip. , E ! t C.2 Restore at least one 6 hours " required channel to -l OPERABLE status. i (continued) r ABWR TS 3.3-3 P&R 08/30/93
- ---,,- , , - , , , , ,.,,-,.-.,a- ,---..,e . ~ . , , , , . . ..,.,n, ,,.,,,.g.n,,.,.p,,,-.,e..- , e.,7-.,,an
< 8 SSLC Sensor Instrumentation l 3.3.1.1 ! 4 ( ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME !
- f D. One or more Functions NOTE !
with four required Applies on!> to Functions 1 i SENSOR CHANNELS inoperable. through . Q i D.1 Place one channel in Immediately trip. e!!D 0.2 Restore at least one I hour required channel to l OPERABLE status. , E. Required Action and E.1 Enter the Condition Immediately ! associated Completion referenced in l Time of Condition A, Table 3.3.1.1-1 for the : B, C or D not met. Function. ! F. One or two required NOTE -- l SENSOR CHANNELS Applies only to Functions $5 i inoperable in one or through & l(. S.1 i more ADS divisions. . F.1 Restore required Prior to ! channel (s) to OPERABLE entering MODE 2 status. following the next MODE 4 entry
- G. Three required SENSOR NOTE CHANNELS inoperable Applies only to Functions M-through & A L O
in one or more ADS divisions. G.1 Restore three required 7 days. channel (s) to OPERABLE status in each division. H. Four required SENSOR NOTE Applies only to Functions 3 P ] CHANNELS inoperable in one or more ADS through W l L divisions. H.1 Restore two required 24 hours. channel (s) to OPERABLE statuy W m sm,n (continued) ABWR TS 3.3-4 P&R 08/30/93
i l i SSLC Sensor Instrumentation ! 3.3.1.1 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME
- 1. ADS initiation NOTE capability not Applies only to functions 35--- Ah maintained in one or through h A (a more ADS divisions.
1.1 Declare affected ADS 1 hour. ! OR division inoperable. Required Actions and Completion Times of Condition F, G, or H not met. l J. As required by J.1 Reduce THERMAL POWER to 4 hours t Required Action E.1 below the level listed in and referenced in Table 3.3.1.1-1 for the Table 3.3.1.1-1. Function. K. As required by K.1 Be in MODE 2. 6 hours Required Action E.1 and referenced in
~
Table 3.3.1.1-1. L. As required by L.1 Be in MODE 3. 12 hours Required Action E.1 and referenced in Table 3.3.1.1-1. M. As required by M.1 Initiate action to insert Immediately Required Action E.1 all insertable control and referenced in rods in core cells J Table 3.3.1.1-1. containing one or more fuel assemblies. As required by N.1 Initiate action to place Immediately N. Required Action E.1 the reactor power / flow and referenced in relationship outside of Table 3.3.1.1-1. the region of applicability shown in Figure 3.3.1.1-1. (continued) ABWR TS 3.3-5 P&R 08/30/93
I * ; SSLC Sensor Instrumentation- l 3.3.1.1 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME
- 0. As required by 0.1 Isolate the affected I hour !
Required Action E.1 penetration flow path (s). and referenced in Table 3.3.1.I-1. As required by P.1 Isolate the affected Imediately P. P luired Action E.1 penetration flow path (s). ad referenced in Table 3.3.1.1-I. OR ; P.2.1 Suspend CORE Imediately i ALTERATIONS. i e.ND , P.2.2 NOTE Applies only to function 24. Suspend movement of Imediately irradiated fuel i assemblies in the ( containment. . AND ! P.2.3 Initiate action to Imediately , suspend operations with- - l a potential for . l draining the. reactor vessel. r I Q. As required by NOTE Required Action E.1 Only applicable if RCIC and referenced in and/or HPCF pump suction is-Table 3.3.1.1-1. not aligned to the suppression pool. Q.1 Align RCIC and HPCF- I hour from suction to the discovery of suppression pool. loss of transfer capability. (continued) ABWR TS 3.3-6 P&R 08/30/93
SSLC Sensor Instrumentation
- 3.3.1.1
( ACTIONS (continued) ) COMPLETION TIME : CONDITION REQUIRED ACTION l R. As required by R.1 Declare supported I hour l Required Action E.1 feature (s) inoperable. ' and referenced in . Table 3.3.1.1-1. S. Required Action and 5.1 Declare supported Immediately, associated Completion feature (s) inoperable. t i Time of Condition Q.1 not met. , l NOTE T]One
- ' st rmobetiok en \ 'Tpis T actioh appljes okly tok
'c nnel'K reduire for\ Fopctions3Ag39'and40in \ -
au mati isolati Tab (e33.1.lgl g \ \ g act tion noperab .s s N 124] ho s i
\\ yT .1 store inkera'tQe \
s j
] ,
intru'm{ntat(onChanne(s. \ U.\ Reg redAionhnd\ .1Sqterthe\ ondk ion k \ Imme' ately .
\asso ted mple(ton 3 reTere ce n N ,
T,ime o Cond ion T Tabl'e,3. 1 1-1 f the ? not met. \ channel. . ! l
'% As required by I.1BeinMODE3. 12 hours 7 Required Action E.1 ,
r and referenced in AND Table 3.3.1.1-1. T Y.2 Be in MODE 4. 36 hours >
% As required by 4.1 Isolate the associated 12 hours y Required Action E.1 V penetration flow path (s) and referenced in Table 3.3.1.1-1. QR .
\)
W.2.1 Be in MODE 3. 12 hours l AND D W.2.2 Be in MODE 4. 36 hours. (continued) ABWR TS 3.3-7 P&R 08/30/93
\
SSLC Sensor Instrumentation 3.3.1.1 l l( ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME
% Required Action and %g l Be in MODE 3. 12 hours V associated Completion ,
Time of Condition 0.1 AND not met. v
%.2 Be in MODE 4. 36 hours required sby
\ .1kclareskported \y Y. Y I h ur Re ' red ActNon U.1 features in perable.
and eference'Ain \
\
! Table'1.3.1.1-b QB
\
\ Y.2 NOTE
\ lies to f tion IsohtetheilactorWaer 1 hou Cleanup System
!O I i I O ABWR TS 3.3-8 P&R 08/30/93
SSLC Sensor Instrumentation 3.3.1.1 l ( SURVEILLANCE REQUIREMENTS NOTE Refer to Table 3.3.1.1-1 to determine which SRs apply for each SSLC Sensor Instrumentation Function SURVEILLANCE FREQUENCY SR 3.3.1.1.1 Perform SENSOR CHANNEL CHECK. 12 hours SR 3.3.1.1.2 NOTE Only required to be met with THERMAL POWER 2 25% RTP. Verify the absolute difference between the [7] days average power range monitor (APRM) channels and the calculated power is s 2% RTP l O SR 3.3.1.1.3 NOTE Not required to be performed when entering MODE 2 from MODE 1 until 12 hours after entering MODE 2.
)
Perform DIVISION FUNCTIONAL TEST. [7] days i l SR 3.3.1.1.4 Perform DIVISION FUNCTIONAL TEST. [32] days 1 l l SR 3 rform DIVISION FUNCTIONAL TEST [92] days G SR 3.3cl.1.!n,A Perf rm CHANNEL FUNCTIONAL TEST [92] days
\
1 ABWR TS 3.3-9 P&R 08/30/93
t SSLC Sensor Instrumentation 3.3.1.1 l SURVEILLANCE REQUIREMENTS (continued) f ( SURVEILLANCE FREQUENCY 7 : SR 3.3.1.1.5, Calibrate the local power range monitors. 1000 MWD /T l average core exposure ; t 6 B - SR 3.3.1.1.7 NOTE
- 1. Required to be met with THERMAL POWER s5% RTP prior to entry into MODE 1 from MODE 2.
l
- 2. Required to be met prior to entry into MODE 2 from MODE 1. .
t Verify the SRNM and APRM channels overlap [7] days within at least 1/2 decade. ; i l SR 3.3.1.1.8- NOTE ;
- 1. Radiation and Neutron detectors are ;
excluded. spon e ti te s a enomhs te ing fd ami elege t t aYe ar ft RP log (E nst t). 4e \ i Perform COMPREHENSIVE FUNCTIONA,L TEST. [18] months w ABWR TS 3.3-10 P&R 08/30/93 1
n, --s- + - .a r n - s-- + - + - , - -- -c.-- - SSLC Sensor Instrumentation ; 3.3.1.1 ( SURVEILLANCE REQUIREMENTS (continued) , SURVEILLANCE FREQUENCY ,
\O SR 3.3.1.1.5L NOTE
- 1. Neutron detectors are excluded.
-i
- 2. SENSOR CHANNEL CALIBRATION shall !
include calibration of all parameters used to calculate setpoints (e.g. i recirculation flow for TPM setpoint) and all parameters used for trip . function bypasses (e.g. Turbine first : stage pressure for TSV closure bypass). Perform SENSOR CHANNEL CALIBRATION. [18] months O t SR 3.3.1.1.9 a Perform CHANNEL CALIBRATION [18] months i i' %% SR 3.3.1.1.M NOTE Neutron detectors are excluded. { [18] months Verify RPS RESPONSE TIME is within limits. ; i.3 SR 3.3.1.1.44 Verify ECCS RESPONSE TIME is within [18] months limits. W l SR 3.3.1.1.M NOTE Neutron detectors are excluded. ] l i
. Verify ISOLATION RESPONSE TIME is within [18] months .,
limits. - l O 3.3-11 P&R 08/30/93 ABWR TS
+ , , - .
SSLC Sensor Instrumentation 3.3.1.1 Table 3.3.1.1 1 (Page 1 of 7) SSLC Sensor Instrunentation f APPLICABLE CONDITicks MODES OR REFERENCED OTHER FROM REQUIRED SURVEILLANCE ALLOWABLE SPECIFIED REQUIRED Att10NS REQUIREMENTS VALUE FUNCTION C0kDIT10h5 CHAWkELS
- 1. Startup Range' Monitors - M *. dN N SRhM heutron Flux - High 2 4 L SR 3.3.1.1.1 s ( 1% RTP 1a.
SR 3.3.1.1.3 SR 3.3.1.1.A B l SR 3.3.1.1.8- % i SR 3.3.1.1.9. \D 5(a) 4 M SR 3.3.1.1.1 5 [ ]% RTP SR 3.3.1.1.4 SR 3.3.1.1.5 9 SR 3.3.1.1.A 1 0 2(D) 4 L SR 3.3.1.1.1 5IJ lb. SRNM heutron Flux Short SR 3.3.1.1.3 Seconds Period SR 3.3.1.1.P- 6 5(a)(b) 4 M SR 3.3.1.1.1 5I1 SR 3.3.1.1.4 Seconds SR3.3.1.1.Ag SR 3.3.1.1.R.g o 1 4 K SR 3.3.1.1.5 5 t 1 RTP Ic. SRNM ATWS Permissive SR3.3.1.1.8*] 4 L SR 3.3.1.1.3 N4 id. SRNM-Inop 2 5(*) 4 M SR 3.3.1.1.4
' SR 3.3.1.1.A 3 l .,
s 2. Average Power Range Monitors 2a. APRM Neutron Flux - High, 2 4 L SR 3.3.1.1.1 5 [ 3% RTP Setdown SR 3.3.1.1.3 SR3.3.1.1.6.7 SR 3.3.1.1. N Q 5(*) & M SR 3.3.1.1.1 5 [ 3% RTP SR 3.3.1.1.4 SR 3.3.1.1.6 ? SR3.3.1.1.e*9 SR 3.3.1.1. A \ D 4 K SR 3.3.1.1.1 s[ w 3% 2b. APRM Simulated Thermal 1 RTP Power-Migh, Flow Sissed SR 3.3.1.1.2 SR 3.3.1.1.5 and SR 3.3.1.1.6 "I st 3% RTP SR 3.3.1.1.5- 9 SR 3.3.1.1.9~ \ Q SR 3.3.1.1. 4 gg 1 4 K SR 3.3.1.1.1 ( ]% RTP 2c. APRM Fized heutron SR 3.3.1.1.2 F lum - H i gh SR 3.3.1.1.5 SR 3.3.1.1.6- 1 l SR 3.3.1.1.P 3 ( SR 3.3.1.1.9- \0 SR 3.3.1.1.te \ % (CONTINUED) N 3.3-12 P&R 08/30/93 ABWR TS l l l F i
SSLC Sensor Instrumentation 3.3.1.1 Table 3.3.1.1-1 (Page 2 of 73 ssLC sensor Instrumentation APPLICABLE CONDiflows MODES OR REFERENCED OTHER FROM SPECIFIED REQUIRED REQUIRED SURVEILLANCE ALLouABLE ACil0Ns REQUIREMENis VALUE FUNCTION CONDITIONS CHAhWELS 2d. APRM Inop 1.2 4 L st 3.3.1.1.5 NA st 3.3.1.1.4 7 kA 5(83 M st 3.3.1.1.4 st 3.3.1.1.+ 9 2e. Rapid Core Flow Decrease clB0]% RTP 4 J SR 3.3.1.1.1 t( ) sa 3.3.1.1.5 %/see SR 3.3.1.1.e T sR 3.3.1.1. b N st 3.3.1.1.ti>.* A 2f. Oscillation Power Range Per figure 4 W st 3.3.1.1.1 See 3.3.1.1-1 st 3.3.1.1.5 footnote Monitor. st 3.3.1.1.& $ (c> SR 3.3.1.1.9- O SR 3.3.1.1.t9. 4 5 3. acactor vessel steam Dome Pressure - M i gh 3a. RPs Trip Initiation 1.2 4 L st 3.3.1.1.1 5! 1 SR 3.3.1.1.5 kg/cm' st 3.3.1.1.6-sR 3.3.1.1.t " S @ sa 3.3.1.1.te \'L. 3b. Isolation Initiation 1,2,3 4 0 SR 3.3.1.1.1 5t 3 st 3.3.1.1.5 kg/cm' st3.3.1.1.0-3
) st 3.3.1.1.9- LO sa 3.3.1.1.44 \ L4 3c. sLCs and FwRB Initiation 1 4 K st 3.3.1.1.1 s( )
$R3.3.1.1.5o-6 kg/cm' st 3.3.1.1. A*- y
- 4. Reactor steam Dome Pressure - Low 1,2,3 4 R sR 3.3.1.1.1 5I 3 sa 3.3.1.1.5 kg/ce' (Injection Permissive) st 3.3.1.1.8 4 st 3.3.1.1.t- 10 SR 3.3.1.1. t+-- Q
- 5. Reactor vessel Water Level - 1,2,3 4 R st 3.3.1.1.1 1! I cm Hign, Level 8 SR 3.3.1.1.5 4('),5(') st3.3.1.1.8-$
SR 3.3.1.1.A t o
- 6. Reactor vessel Water Level - Low, Level 3 6a. RPs trip Initiation. 1,2 4 L st 3.3.1.1.1 t! 3 cm st 3.3.1.1.5 sR3.3.1.1.0-9 SR 3.3.1.1'.9-= ID st 3.3.1.1.te- 4 (CONTINUED) f
\
ABWR TS 3.3-13 P&R 08/30/93
i ! l i SSLC Sensor Instrumentation i i . 3.3.1.1 l ' table 3.3.1.1 1 (Page 3 of 7) I ssLC Sensor Instrumentation p
- k I APPLICABLE CONDit!ONS MODES OR REFERENCED OTHER FROM i I
sPECIFIED REQUIRED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CMANNELs ACTIONS REQUIREMENTS VALUE
)
6b. Isolation Initiation. 1,2,3 4 0 SR 3.3.1.1.1 e I ) em SR 3.3.1.1.5 ER 3.3.1.1.8- 9 ) st 3.3.1.1.9- \D l l, st 3.3.1.1.th SS- f (g) 4 P st 3.3.1.1.1 st 3.3.1.1.5 st 3.3.1.1.8 ' 9 st 3.3.1.1.9- t O sa 3.3.1.1.13. (t'r-
- 7. Reactor vessel Water Level-Low, Level 2 7a. Esf Initiation 1,2,3 4 R st 3.3.1.1.1 t [ ] cm st 3.3.1.1.5 st3.3.1.1.8-S '
sa 3.3.1.1.9- \C) sa3.3.1.1.u-\$ 7b. Isolation initiation. 1,2,3 4 0 sa 3.3.1.1.1 t ( ) em SR 3.3.1.1.5 st 3.3.1.1.8' S st 3.3.1.1. e % 6 st3.3.1.1.tb.gS
\ (g) 4 P st 3.3.1.1.1 SR 3.3.1.1.5
- SR3.3.1.1.8d SR 3.3.1.1.9- 16
$R 3.3.1.1.1 b i t 7c. SLCs and FWRB Initiation 1 4 K SR 3.3.1.1.1 5t 3 st 3.3.1.1.M (, kg/cm' i st 3.3.1.1.9:s g
- 8. Reactor vessel Water Level -tow, Level 1.5 Ba. EsF Initiatio1 1,2,3, 4 a st 3.3.1.1.1 t [ } cm I
st 3.3.1.1.5 4('),5(') st 3.3.1.1.8- 3 I' st 3.3.1.1. P 10 st 3.3.1.1. W d l Sb. Isolation Initiation. 1,2,3 4 'w $R 3.3.1.1.1 2 [ ] cm l U 5"335 l st 3.3.1.1.& % SR 3.3.1.1.9-4 D st 3.3.1.1.SF g14 1
- 9. Reactor vessel Water Level-Low, Level 1 9a. ADS A, PFL A & LPFL C 1,2,3, 4 R st 3.3.1.1.1 e I 3 cm initiati st 3.3.1.1.5 st 3.3.1.1.6 3 4(e)* $(e) st 3.3.1.1.9- ID C. b M A st3.3.1.1.M-t3 (CONTINUED) 3 l ABWR TS 3.3-14 P&R 08/30/93 i
l l -. I
SSLC Sensor Instrumentation 3.3.1.1 Table 3.3.1.1 1 (Page 4 of 7) ssLC sensor Instrumentation CONDITIONS APPLICABLE MODES OR REFERENCED OthER FROM ' SPECIFIED REculRED REculRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS ACTIONS REQUIREMENTS VALUE 9D. ads B, Diesel cenerator, 1,2,3, 4 R SR 3.3.1.1.1 E [ ] cm SR 3.3.1.1.5
- RCW,p LPFL B Initiation 4(e)' $(e) st3.3.1.1.9*3 C. AfM st 3.3.1.1.t- (O J SR 3.3.1.1.M- Q .
9c. Isolation Initiation 1,2.3, 4 % sa 3.3.1.1.1 t ( ) em i I g SR 3.3.1.1.5 st3.3.1.1.0-S st 3.3.1.1.t*
- SR 3.3.1.1.9- \W ,
- 10. Main steam Isolation 1 4 K sa 3.3.1.1.5 s I 31 Ve t we - Closure closed ,
i j SR3.3.1.1.0-$@ sa 3.3.1.1.t-SR 3.3.1.1. E . W > l l 11. Drywel1 Pressure - High 11a. RPS Initiation. 1.2 4 % b SR 3.3.1.1.1 5() SR 3.3.1.1.5 - kg/ca' sa 3.3.1.1.e- 3@
$4 3.3.1.1.?*
st 3.3.1.1.10- 4 lib. ESF Initiation. 1,2,3 4 4 SR 3.3.1.1.1 5t3 sa 3.3.1.1.5 kg/cm' st3.3.1.1.5-S SR 3.3.1.1.9- to ' st3.3.1.1.tk11 4(' 5(') M 1.1.1
\ 3R3.(3.1.1.5 s 3.
\ st .3.1kt.8 SR 3.1.i g9 . '
l $2 3. 1.1.11 r i 11c. Isolation Initiation. 1,2,3 4 % sa 3.3.1.1.1 st1 I i l g sa 3.3.1.1.5 sn3.3.1.1.6-3 kg/cm' 54 3.3.1.1.t- W st 3.3.1.1.12- % T
- 12. CRD Water Header Charging 1,2 4 L $2 3.3.1.1.1 s!)
i Pressure Low st 3.3.1.1.5 kg/ce' 5(*) 4 M SR 3.3.1.1.1 st 3.3.1.1.5 sa3.3.1.1.8% st 3.3.1.1.t- @
- 13. Turbine stop Valve-Closure t[4D]% RTP 4 J st 3.3.1.1.5 s I 1%
sa3.3.1.1.0-$ closed sa 3.3.1.1.t" O
+ sa 3.3.1.1.10- W 14 Turbine Control valve t[4D3% RTP 4 J sa 3.3.1.1.1 e11 Fast Closure, Trip Ott st 3.3.1.1.5 kg/ce' Pressure - Low sa3.3.1.1.9*3 oil st 3.3.1.1.t" LC, pressure st 3.3.1.1.10 g p (CONTINUED) l ABWR TS 3.3-15 P&R 08/30/93 j
SSLC Sensor Instrumentation 3.3.1.1 Table 3.3.1.1-1 (Page 5 of 7) ssLC sensor Instrumentation l APPLICABLE CONDITIONS MODES OR REFERENCED OTHER FROM sPECIFIED REQUIRED REQUIRED SURVEILLANCE ALLOWASLE FUNCTION CONDITIONS CHANNELS ACTIONS REQUIREMENTS VALUE
- 15. Main steam Tunnel Radiation-Migh 15a. RPS Trip Initiation 1.2 4 '% b sa 3.3.1.1.5 5 t 3 rods st 3.3.1.1.9- S
'SR 3.3.1.1.9 L O 15b. Isolation Initiation. 1.2,3 4 *% SR 3.3.1.1.5 s t 3 rods g SR3.3.1.1.B*S sa 3.3.1.1.9 @ 1 t
l
- 16. suppression Pool Tenperature Migh l
)
16a. RPs initiation. 1,2 4 L SR 3.3.1.1.1 5 t 1 'F i sR 3.3.1.1.5 l st 3.3.1.1.e* % SR 3.3.1.1.9-% D l st 3.3.1.1.1e W 16b. EsF Initiation. 1,2,3 4 a st 3.3.1.1.1 s [ ] 'T l SR 3.3.1.1.5 i SR 3.3.1.1.8 4 l SR 3.3.1.1.9- tC:> 17 Condensate storage Tank Level - 1,2,3 4 0 st 3.3.1.1.1 m t 3 cm 6 Low SR 3.3.1.1.5 -
! 4('3,5(') st3.3.1.1.8*S I
l sa 3.3.1.1.9. L O i 1
' SR 3.3.1.1.1 s [ 3 cm
, 18. suppression Pool Water level . 1,2,3 4 0 i High SR 3.3.1.1.5 4('3,5C ') st3.3.1.1.9*S i st 3.3.1.1.9- t O
- 19. Main steam Line Pressure - Low 1 4 C st 3.3.1.1.1 $[]
st 3.3.1.1.5 kg/cm' j{ st3.3.1.1.8-3 SR 3.3.1.1.9-SCr 4 !1 m kg/hr l f 20. Main steam Line Flow - Nigh 1,2,3 4 per *% st 3.3.1.1.1 ,
~
MSL V st 3.3.1.1.5 '! sa3.3.1.1.8-3 st 3.3.1.1.,- 46 sa3.3.1.1.4-lLt* ! 21. Condenser vacuum- Low 1, 2(d3 4 *W SR 3.3.1.1.1 2!3 g st 3.3.1.1.5 kg/cm# ! ,3(d) st3.3.1.1.t*3 l sa 3.3.1.1.9- 1 0
- 22. Main steam Tunnel 1,2,3 4 'w- st 3.3.1.1.1 5 t 3 'C -j
, iemerature - H i gh U sa 3.3 1 1 5 ' st 3.3.1.1.8-3 st 3.3.1.1.9-t 0
- 23. Main T"urbine Area Tem erature- 1,2,3 4 N sa 3.3.1.1.1 5 t 3 *C Hign g SR 3.3.1.1.5 st3.3.1.1.d I SR 3.3.1.1.9- ( 6 (CONTINUED)
ABWR TS 3.3-16 P&R 08/30/93 i I
-_ _ ,____,_-....,,_.m .,
_ _ _ _ _ ___ _ _. ~ _ _ _ _ _. __ _. _ _ _ . . _ _ i . I r SSLC Sensor Instrumentation 3.3.1.1 a table 3.3.1.1-1 (Page 6 of 7) SSLC Sensor Instrunentation f fl i APPLICABLE CONDifl0NS l REFERENCED ) MODES OR OTMER FROM l SPECIFIED REQUIRED REQUIRED SURVEILLANCE ALLOWABLE CONDIfloNS CHANNELS Atilots REQUIREMENTS VALUE-FUNCTION 24a. Reactor Building Area Exhaust Air 1,2,3 4 0 SR 3.3.1.1.1 s ( ) Reds ( Radiation Migh SR 3.3.1.1.5 j (g),(h) 4 P $R 3.3.1.1.1 f SR 3.3.1.1.5 i st 3.3.1.1. P S I SR 3.3.1.1.9"' \D ! SR 3.3.1.1.9 W 24.b Fuel Mandling Area Exhaust Air 1,2,3 4 0 SR 3.3.1.1.1 5 t 1 Reds R adiat ion-ni gh SR 3.3.1.1.5 t (g),(h) 4 P st 3.3.1.1.1 , l SR 3.3.1.1.5 ' SR 3.3.1.1.8- $ . SR 3.3.1.1.t" W SR 3.3.1.1.te L Lt' ; RCIC Steam Line flow - High 1,2,3 4 0 st 3.3.1.1.1- a kg/Mr 25. SR 3.3.1.1.5 SR3.3.1.1.9-S SR 3.3.1.1.9- (C7
- 26. RCIC Steam Supply Line 1,2,3 4 0 SR 3.3.1.1.1 5[]
$R 3.3.1.1.5 kg/ca' ,
Pressure - Low ] SR3.3.1.1.P$ ( SR 3.3.1.1. P l O
. R fu bi k i au ragm 1 3 \ 0 Sk3,3.1 1 \.1 #
f j High
} \,\\ SR3.3.1.1.9( kg/
SR 3'.3.1.1.8 4 SR 3.311.179 i gg
- 48. RCIC Equipment Area 1,2,3 4 0 sa 3.3.1.1.1 s I 1 'C Tenperature - High SR 3.3.1.1.5 ,
SR3.3.1.1.e*S i SR 3.3.1.1.9.L D , 29 CUW Dif f erential Flow - High 1,2,3 4 0 SR 3.3.1.1.1 5t1 ! st 3.3.1.1.5 Liters / Min j SR3.3.1.1.PS for <= [ ] l SR 3.3.1.1.9- tt> Seconds 3D. CUW Regenerative Heat Exchanger 1,2,3 4 0 SR 3.3.1.1.1 s ( 1 *C Area Tenperature - High SR 3.3.1.1.5 sa3.3.1.1.PS SR 3.3.1.1.9 t o
- 31. CUW non regenerative Meat 1,2,3 4 0 st 3.3.1.1.1 s 1 1 't Exchanger Area Temperature - Migh SR 3.3.1.1.5 SR 3.3.1.1.e -%
sa 3.3.1.1.9- \t>
- 32. CUW Equipment Area 1,2,3 4 0 SR 3.3.1.1.1 s I 1 'c 1esperature - High SR 3.3.1.1.5 SR 3.3.1.1.6 $ 1 st 3.3.1.1.9-\c:p 1
(CONTINUED) 1 1 l ABWR TS 3.3-17 P&R 08/30/93
SSLC Sensor Instrtsrentation
- 3.3.1.1 Table 3.3.1.1 1 (Page 7 of 7)
S$LC Sensor Instrteientation i APPLICABLE CONDITIONS l MODES OR REFERENCED OTHER FROM
$PECIFIED REQUIRED REQUIRED SURVEILLANCE ALLOWABLE <
I FUNCTION CONDITIONS CHANNELS ACTIONS REQUIREMENTS VALUE
% RMR Area Temperatu*es High 2,3 4 each 0 SR 3.3.1.1.1 5 t 3 *C <
Ag RHR area $R 3.3.1.1.5 SR3.3.1.1.6-% i' st 3.3.1.1.9- m la on on LC nitia on 2 1 pe SR .3.1 1.8
. Ch I h% ADS Division I LPFL Purip 1, 2(I) , 1 per hA st 3.3.1.1.5 ttg Discharge Pressure - High each of SR 3.3.1.1.8- % kg/cm !
3(f) (permissive) 3 pays SR 3.3.1.1.R. c i D-M. ADS Division l MPCF Ptmp 1, 2(f) , 1 per NA st 3.3.1.1.5 tt3 Discharge Pressure - High each of SR 3.3.1.1.6 % kg/cm 2 l 3(f) 2 ptsps SR 3.3.1.1.M c> (permissive) !- T ., 20) , 1 per st 3.3.1.1.5 tt1 D SF. ADS Division II LPFL Ptsp Discharge Pressure - High each of NA SR 3.3.1.1.L $ kg/cm 2 3(f) 3 ptmps st 3.3.1.1.h SC) (permissive) h 56. ADS Division II HPCF Ptsp 1, 2 0) , 1 per NA st 3.3.1.1.5 tt3 Discharge Pressure - Nigh each of SR 3.3.1.1.9A kgi:m 2 (permissive) 3(f) 2 ptsps $t 3.3.1.1.9 D
%. Drywelt b Dra\ LCW R lation- 2,3 1 W sa3.311.1.1 st Reds i High SR3.311.5 sa 3.3.7 1.8
< sa 3.3.1 1.9
'f
. D'rywel Step sin M ediation- 1,2,3 1 W R 3.3.1. 1 5 I 3 Reds [
\ Mig % \ $ 3.3.1.1.y NA 5 .3.1.1.& ;
~
SRK.3.1.1.9j
)
(a) With any control rod withdrawn from a core cett containing one or more fuel asses @ lies. (b) Trip automatically bypassed within each SRNM and not required to be OPERASLE at reactor power levels sto.00013% RTP. I (c) 1. Neutron flux oscittations within any OPRM celt have a period between 11.151 seconds and 13.353 seconds that persists for (10) cycles with a peak to peak amplitude of that is (10)% of point or ! greater. ;
- 2. Neutron flux oscillations within any OPEM cell that have a period between (0.31) and 12.21 seconds i become larger than 1303% of point within (31 periods or oscittations with the specified period range that are greater than (10%) of point grow by (303% of point within (3) cycles. !
i (d) With any Turbine Stop Valve not fully closed. j (e) When associated features are required to be operable. . (f) With reactor pressure > 50 paig. ! (g) During CORE ALTERATIONS or operations with a potentist for draining the reactor vessel. (h) During movement of ir radiated fuel asseselles in the contaltunent. i (CONTINUED) j ABWR TS 3.3-18 P&R 08/30/93
SSLC Sensor Instrumentation 3.3.1.1 100 --
\
90-
\ v_...
,.:it c
.Nh; ,
.._(.: r wi 60 - rws~:'; -::o ,'
. yl3 s x 1 REGION OF APPLICABILI iT :n-
< >J:
* '_g c
- gh^j y * .
- v. y pas a .;,,> ' j'; ' v
{U q% 4::, b2 : '"'
$ Ji:NAMI .. -i78h yff%;4 :J'J:#" x ce W
.g. kMU # +
^
> 60 - :m: .%v;nv. ; ., ~~ s,:nu
> ?: $ ..:. N k
2,. . :.. : , 4:.q' f'%Ylll$ s.NA:-:-k y.
- H.U
- ~:sn
- +.g+- j:t e,
- sg:yyss.gk??q ,
C :$Yl@p?
? & M ^ Y$ha$D"UG .vYC 2 * ' P's o 50 -
ggy-'cm2 ? . ;is W.': ~i . a. x y .::e :.
,r.
.A:%:w ou...~ .
m
~;&. ao .
O eywthy,g y * +: -.. w
~c,y,eAg ee - w -.
- 40 - s#- tem: n*4 E Jm.324 :.:G;,...^' >
+,
m > 30 mgu#wu*wp.m,* :wa .a;m umh: "~x 3e ..w,~ wn e~ s >
- ns<+-~~..-
s' ~. . m Q2r;9 gR
%M;p:nggl$$;g+<*EGION OF EXCLUSION
. my m. .
c 20 - E
^N._,:w*N:yDpA;TMme@wy"u*m*Nd R w ;ywer.w. :ew,'c^
wqr9 n-h m
-. v:xmy x w..
,:;:mn--.:svan'"'
;&.E%:**e'-l^A+
YW" t :
' sy' -@ M ' '
$5My ::.M~$w%he
. tw.w+wlig y % .$_. ..
htbw: Y wd
.u a -
^
-^' %z.%i2 n:%MV%niWTi .. " ' .'..W ~g$<($5MNdl%~n*.5hI[i$$ i,7 55NS/M!MN * [: f g~~kh sky;gm.%s.. ,
10- , a .:rg g ga, p pA .a _ .:Jttps: Ac g -
-~
rg . . MMy'sf.***"%nw4.-ds?m. W p:w: Qfy w. + ;.~.,e/?., ai - l
+nx $ x+;n .+ - : - f.a y y , . . --
as <w~
-- ' -- +@.me+b+g y:4rp- ta;.a 7+ nn p auM h ;.s , , Wp43rdopgY ca.4 0 I I I I I I I i I 30 40 50 60 70 70 90 100 O 10 20 CORE FLOW- % i l
l i FIGURE 3.3.1.1-1: Oscination Power Range Function Conditions or vporability ABWR TS 3,3-19 P&R 08/30/93 l
RPS and MSIV Actuation 3.3.1.2 Q 3.3 INSTRUMENTATION 3.3.1.2 Reactor Protection System (RPS) and Main Steam Isolation Valve (MSIV) Actuation LCO 3.3.1.2 The RPS and MSIV Actuation Functions in Table 3.3.1.2-1 shall be OPERABLE. r According to Table 3.3.1.2-1. ! APPLICABILITY: NOTE , Separate condition entry is allowed for each channel. ACTIONS i CONDITION REQUIRED ACTION COMPLETION TIME l A. One or more Functions NOTE with one channel Only applicable to Functions inoperable. la, 2a, and 5. , A.1 Place affected division 6 hours in trip. M A.2.1 Place affected 6 hours I division in TLU logic l output bypass. h.!!Q A.2.2.1 Restore required 30 days channel (s) to
-OPERABLE status M
A.2.2.2 Place affected 30 days division in trip. h l 4 (Continued) ABWR TS 3.3-20 P&R 08/30/93 i
l l RPS and MSIV Actuation 3.3.1.2 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME i B. One or more Functions NOTE with two channels Only applicable to Functions ! inoperable. la, 2a, and 5. l B.1 Place one affected 3 hours division in trip. AND l 1 B.2 Place the other 6 hours affected division in TLU logic output bypass. bhD B.3 Restore at least one 30 days inoperable channel to OPERABLE status. C. One or more Functions NOTE
! with three channels Only applicable to Functions s inoperable. la, 2a, and 5.
C.1 Place one affected Immediately division in trip. AND i C.2 Restore at least one 6 hours ! inoperable channel to OPERABLE status , D. One or more Functions NOTE i l with four channels Only applicable to Functions l l inoperable. la, 2a, and 5. i D.1 Place one affected Immediately division in trip. 6ND D.2 Restore at least one I hours inoperable channel to OPERABLE status t(~
'( (continued)
ABWR TS 3.3-21 P&R 08/30/93
RPS and MSIV Actuation s 3.3.1.2 i l( ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME. E. One or more Functions NOTE ; with one OUTPUT Only applicable to Functions ! CHANNEL inoperable. 1.b and 2.b. j E.1 Place inoperable 6 hours ! channel in trip l
~
F. One or more Functions NOTE ' with two OUTPUT Only applicable to Functions-CHANNELS inoperable. Ib and 2b. ! F.1 Place one inoperable I hour i channel in trip. } 5 \ F.2 Restore at least one 7 days , l inoperable channel to . OPERABLE status. ;
)
l G. One or more Functions NOTE : I with three or more Only applicable to Functions j i Ib and 2b. OUTPUT CHANNELS inoperable. i i G.1 Restore at least two I hour l l channels to OPERABLE ' status. H. One or more Reactor H.1 Restore required I hour ! Mode Switch-Shutdown channel to OPERABLE ; Position channels status, inoperable. (continued) ABWR TS 3.3-22 P&R 08/30/93 f l l 9- + -t y-, T -*-- 4- AT -i -= w e- er em --- N +Tp-r %+ w
. . - __ - . - . . _ . m _ _.m_ _ _ _ y ...m RPS and MSIV Actuation ,
g 3.3.1.2 , i l i ACTIONS (continued)- CONDITION REQUIRED ACTION COMPLETION TIME i i NOTE- !
- 1. One RPS manual scram i channel inoperable. The inoperable channel may I be bypassed for up to 6 hours for surveillance testing of the other :
-pc13 - -
channels. owly yiL W To I.1 Place affected division I hour i U wc.T.',.c G g 4. - in trip. s E I.2 Restore required 30 days '; channel to OPEPABLE status. i l J. RequiredActionandb NOTE associated Completion Only applicable to Functions Time not met for 1, 3 and 4. Conditions A, B, C, . D, E, F, G, H, or I J.1 Be in MODE 3. 12 hours i in MODE 1 or 2. l 4 Immediately i l K. Required Action and K.1 Initiate action to ! i
- associated Completion insert all insertable
! Time not met for control rods in core l Conditions A, B, C, cells containing one or ! D, E, F, G, H, or I more fuel assemblies. ! in MODE S(a). l 4 L. Required Action and NOTE associated Completion Only applicable to Functions Time not met for 2 and 5. Conditions A, B, C, Isolate the associated 12 hours ! D, E, F or G. L.1 penetration flow i i path (s). QE L.2.1 Be in MODE 3. 12 hours MD L.2.2 Be in MODE 4. 36 hours O P&R 08/30/93 ABWR TS 3.3-23 1 i
.~ -. - - - . .
l . i l RPS and MSIV Actuation i 3.3.1.2 ' I ; I
. SURVEILLANCE REQUIREMENTS i SURVEILLANCE FREQUENCY ,
SR 3.3.1.2.1 Perform CHANNEL FUNCTIONAL TEST. N47 ays i i SR 3.3.1.2.2 Perform DIVISION FUNCTIONAL TEST. 92 days l l SR 3.3.1.2.3 Perform CHANNEL FUNCTIONAL TEST. 1 92 ays SR 3.3.1.2.4 Perform COMPREHENSIVE FUNCTIONAL TEST. [18] months SR 3.3.1.2.5 Perform OUTPUT CHANNEL FUNCTIONAL TEST. [18] months o 3.3.1.2.6 Verify RPS RESPONSE TIME is within limits. 1 SR [18] months
)
s A h.s ,\,1,1 v -e'. g 2 a o i- m w s 4Mts5E T1AE is wav.s v. s '.t.5 ({$] s, 4 ; ( i 1 r O ABWR TS 3.3-24 P&R 08/30/93 l l
t i RPS and MSIV Actuation 3.3.1.2 ! I Table 3.3.1.21 (Page 1 of 1) t RPs and Ms!V Actuation F APPLICABLE , MODES OR OTHER SPECIFIED ' REQUIRED SURVEILLANCE ' FUNCTION CONDITIOWs CHANNELS REQUIREMENTS
- 1. RPs Actuation.
- a. LOGIC CHANNELS 1, 2, 5(*) 4 st 3.3.1.2.2 sa 3.3.1.2.4 e 54 3.3.1.2.6 l
- b. DUTPUT CHANNELS 1, 2, 5(s) 4 $4 3.3.1.2.2 ,
st 3.3.1.2.4 i sa 3.3.1.2.5 ' st 3.3.1.2.6
- 2. Mslys and Mst Crain valves Actuation. ,
- s. LOGIC CHANNELS 1,2,3 4 sa 3.3.1.2.2 i
" ld.I kQ
*h !
4 sa 3.3.1.2.2 f
- b. OUTPUT CHANNELS 1,2,3~
SR 3.3.1.2.4 ! SR 3.3.1.2.5p j l
- 3. Manual RPs scram. 1, 2, 5(a) 2 54 3.3.1.2.1 l f 4. Reactor Mode switch-shutdown Position. 1, 2, 5("I 2 SR 3.3.1.2.4 i
- 5. Manust Ms!V Actuation. 1,2,3 4 st 3.3.1.2.3 '
st 3.3.1.2.4 (a) With any control rod withdrawn in a core cett containing at least one fuel assenR>ty. t I 6 I 1 l l l i
?
ABWR TS 3.3-25 P&R 08/30/93 i e
- , ,,,--y
SLC and FWRB Actuation 3.3.1.3 ( 3.3 INSTRUMENTATION 3.3.1.3 Standby Liquid Control (SLC) and Feedwater Runback (FWRB)= l Actuation LCO 3.3.1.3 The SLC and FWRB Actuation Functions in Table 3.3.1.3-1 i shall be OPERABLE. 1
)
APPLICABILITY: MODE 1 NOTE I i Separate condition entry is allowed for each channel, ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME ) l A. One or more Functions NOTE l l with one.lagig Only applicable to Functions I channel _ TE5putable. 1.a, 2.a. and 3. ; A.1 Place affected ATWS 6 hours l division in trip. l M M i One division with one A.2 Place affected 6 hours or two manual ARI division in ATWS logic channels inoperable, output bypass. ; (continued) ABWR TS 3.3-26 P&R 08/30/93 1 l
h SLC and FWRB Actuation 3.3.1.3 , i ACTIONS (continued) { CONDITION REQUIRED ACTION COMPLETION TIME l B. One or more Functions NOTE : with two Only applicable to Functions channels erable. 1.a, 2.a, and 3. , B.1 Place one affected ATWS 3 hours QB division in trip. j Two divisions with AND one or more manual ARI channels B.2 Place the other 6 hours l inoperable. affected division in ATWS logic output bypass. 8!!D 1. W.ii p % l B.3 Restoreatlleastone 30 days inoperable %annel to i OPERABLE status. C. One or more Functions NOTE ! with one OUTPUT Only applicable to Functions ! O, CHANNEL inoperable. 1.b and 2.b. C.1 Place inoperable 6 hours channel in trip D. One or more Functions NOTE with two OUTPUT Only applicable to Functions ! CHANNELS inoperable. 1.b and 2.b. D.1 Place one inoperable I hour channel in trip. S t D.2 Restore at least one 7 days inoperable channel to OPERABLE status, i (continued) ABWR TS 3.3-27 P&R 08/30/93
SLC and FWRB Actuation 3.3.1.3 l ACTIONS (continued) f( CONDITION REQUIRED ACTION COMPLETION TIME E. Required Action and E.1 Declare SLC system I hour associated Completion inoperable. Time not met for Conditions A, B, C, ' or D. M l One or more Functions with three or more i LOGIC CHANNELS or
- OUTPUT CHANNELS inoperable. ,
M Three or more divisions with one or more manual ARI channels inoperable t' N l l l l l l 1 ABWR TS 3.3-28 P&R 08/30/93
SLC and FWRB Actuation 3.3.1.3 URVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.1.3.1 Perform DIVISION FUNCTIONAL TEST. [92] days t SR 3.3.1.3.2 Perform COMPREHENSIVE FUNCTIONAL TEST. [18] months SR 3.3.1.3.3 Perform OUTPUT CHANNEL FUNCTIONAL TEST. [18] months
, - y og -- -~
b.4c T-o Tome 1,d ,1,1 - l % 1.h r k'% bNd (] 5 4 ? \g- Eo t- % h P w <_.t A . l ABWR TS 3.3-29 P&R 08/30/93 l
l SLC and FWRB Actuation ' 3.3.1.3 i l 4 Table 3.3.1.3-1 (Pege 1 of 1) SLC and FWR8 Actuation REQUIRED SURVEILLANCE FUNCil0N CHANNELS REQUIREMENTS
- 1. SLC Actuation. .
i
- s. LOGIC CHANNELS 4 SR 3.3.1.3.1 SR 3.3.1.3.2
- b. DUTPUT CHANNELS 4 SR 3.3.1.3.2 SR 3.3.1.3.3
- 2. FWRB Actuation
- a. LOGIC CHANNELS 4 SR 3.3.1.3.1 SR 3.3.1.3.2 4 SR 3.3.1.3.2
- b. OUTPUT CHANNELS SR 3.3.1.3.3
- 3. Manual Alternate Rod Insertion 2/ division SR 3.3.1.3.1 SR 3.3.1.3.2
*s l
l s , l l ABWR TS 3.3-30 P&R 08/30/93 ! 1 I
ESF Actuation Instrumentation , 3.3.1.4 3.3 INSTRUMENTATION 3.3.1.4 ESF Actuation Instrumentation LCO 3.3.1.4 The ESF Actuation Instrumentation for each Function in Table 3.3.1.4-1 shall be OPERABLE. APPLICABILITY: According to Table 3.3.1.4-1. NOTE Separate Condition entry is allowed for each channel. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions NOTE with one required Not applicable to Function 44- o t- \%& LOGIC CHANNEL : inoperable. A.1 Place the associated : 1 hour O OUTPUT CHANNEL (s) in bypass. AND A.2.1 Restore the inoperable channel to 30 days ; OPERABLE status. l DE A.2.2 Verify redundant j Feature (s) are 30 days OPERABLE. B. One or more Functions NOTE l with one or more Not applicable to Function 4 d - oY N l required SENSOR i CHANNELS, a manual B.1 Restore at least one i initiation channel, required channel to I hour or two LOGIC CHANNELS OPERABLE status. inoperable. (continued) ABWR TS 3.3-31 P&R 08/30/93
l ESF Actuation Instrumentation i 3.3.1.4 , r I ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME C. One or more Functions NOTE ' with one or more Not applicable to Function 4 % ot- b.d OUTPUT CHANNELS inoperable. C.1 Restore ESF actuation I hour capability for the . affected Feature (s). l 93 ) C.2 Actuate associated I hour [ j device (s). E& Required Action and Al Declare the supported I hour ( associated Completion E Feature (s) inoperable. Timenotmegfor i Condition BJ or & 1
- 1. One or more lo ic r NOTE
? OUTPUT chann Applies only to Function 54 0 - Q gg l-inoperable. .;
.1 Declare associated g I E* R valve (s) inoperable. I hour l
b %N g t l O 3.3-32 P&R 08/30/93 l ABWR TS I l t _-
""W N ~1}g k ,S , \ S apt ard 3 gs gl' ABWR SECTION B3.3 INSERTS P&R REVIEW page 9 ALO 9/16/93 D. One or more Functions NOTE with an inoperable Applies only to Functions SENSOR CHANNEL. 10d, 10e, and 13d.
D.1 Restore inoperable [24] hours , SENSOR CHANNEL 08 D.2 Actuate the associated [24] hours device (s). O ; i 1 O l L- - yv
ESF Actuation Instrumentation 3.3.1.4 O SURVEILLANCE REQUIREMENTS l
~
1 SURVEILLANCE FREQUENCY i SR 3.3.1.4.1 Perform SENSOR CHANNEL CHECK. 12 hours SR 3.3.1.4.2 Perform OUTPUT CHANNEL FUNCTIONAL TEST. (( months SR 3.3.1.4.3 Perform DIVISIONAL FUNCTIONAL TEST. [92] days
\6 SR 3.3.1.4.4 Perform COMPREHENSIVE FUNCTIONAL TEST. [ h onths
\6 '
SR 3.3.1.4.5 Perform ECCS RESPONSE TIME TEST. [2honths 1e SR 3.3.1.4.6 Perform SENSOR CHANNEL CALIBRATION. [2(months Af5 SR 3.3.1.4.7 Perform Manual initiation CHANNEL [ onths FUNCTIONAL TEST. i O ABWR TS 3.3-33 P&R 08/30/93
ESF Actuation Instrumentation 3.3.1.4 Table 3.3.1.41 (Page 1 of 5) ESF Actuation Instrumentation APPLICABLE MODES OR CTHER SPECIFIED REQUIRED SURVEILLANCE 3 FUNCT!DN CONDITIONS CHANNELS REQUIREMENTS ALLOWABLE VALUE
- 1. Low Pressure Core Flooder Actuation.
kaPLPFL Pung Discharge Pressure - 1,2,3, 1p SR 3.3.1.4.1 t [ ] Kg/Cm2 pump I SR 3.3.1.4.3 Migh. 4(g) 3(g) SR 3.3.1.4.4 SR 3.3.1.4.6 a. V LPFL Puip Discharge Flow - Low. 1,2,3, 1pr SR 3.3.1.4.1 s ( ) Liters per i Y.1.b punp{a) st 3.3.1.4.3 min . 4(8) 5(8)
, SR 3.3.1.4.4 I st 3.3.1.4.6 l
s1.c,LPFL System Initiation. 1,2,3 2pejb) SR 3.3.1.4.3 NA > s system gg 3,3,3,4,4 4(8I,5(8) st 3.3.1.4.5 g LPFL Device Actuation. 1,2,3 1 per SR 3.3.1.4.2 NA actuate SR 3.3.1.4.3 4(83,5(8) device (*j st 3.3.1.4.4 SR 3.3.1.4.5
- L e lPFL Manual Initiation. 1,2,3, 1 pe SR 3.3.1.4.3 NA system [d) SR 3.3.1.4.4 4(83,5(g) SR 3.3.1.4.7
- 2. High Pressure Core Flooder Actuation.
2.s HPCF Puip Discharge Pressure - 1,2,3, 1p SR 3.3.1.4.1 1 ( ) Eg/Cm2 [j\ q High. 4(g) 5(8) P"gr } 88 3 3 i*'*3
\ '
SR 3.3.1.4.4 3.3.1.4.6 l SR {2dp HPCF Pulp Discharge Flow-Low. 1,2,3, 1p $R 3.3.1.4.1 5 [ ] Liters per puip I SR 3.3.1.4.3 min 4(8) 5, I8I $R 3.3.1.4.4 SR 3.3.1.4.6 , T2$ HPCF Pump Suction Pressure Low. 1,2,3, 1p SR 3.3.1.4.1 t [ ] Kg/cm2 4(g) 5(g) pun,g) $R 3.3.1.4.3 SR 3.3.1.4.4 . SR'3.3.1.4.6 ! id.lNPCF System Initiation. 1,2,3 2 per ) $R 3.3.1.4.3 NA l Ri system sb gg 3,3,3,4,4 l 4(83,5(8) st 3.3.1.4.5 l 1,2,3 1 per SR 3.3.1.4.2 NA l f/23 eaJ HPCF Device Actuation. actuate SR 3.3.1.4.3 4(8) 5(8) device (*j . SR 3.3.1.4.4 SR 3.3.1.4.5 i e2.f HPCF Meruel Initiation. 1,2,3, 1 pe SR 3.3.1.4.3 NA system {d) g, 3,3,3,4,4 4(8),5(8) $R 3.3.1.4.7
- 3. Reactor Core Isolation Cooling System Actuation.
f 1, 2 I '), 3I 'I I I *I SR 3.3.1.4.1 t ( ) Kg/Cm di3RCICPuupDischargePressure-4 Nigh. SR 3.3.1.4.3 st 3.3.1.4.4 SR 3.3.1.4.6 ABWR TS 3.3-34 P&R 08/30/93 l l l l l l
t ESF Actuation Instrumentation ! 3.3.1.4 j Table 3.3.1.4-1 (Pese 2 of 5) . j ESF Actuation Instrumentation t [ ; APPLICABLE ! MODES 04 , OTHER SPECIFIED REQUltED SURVEILLANCE FUNCTION CONDITIONS CHANNELS REQUIREMENTS ALLOWASLE VALUE ! 1, 2('), 3(') [is 3.b' RCIC Puup Discharge Flow-Low. 1(*) SR 3.3.1.4.1 SR 3.3.1.4.3 SR 3.3.1.4.4 s ( ) Liters per min SR 3.3.1.4.6 ! l gr-we , l d3YRCICSystemInitiation. 1, 2('), 3(') 2(b) SR 3.3.1.4.3 mA , DUM SR 3.3.1.4.4 ' SR 3.3.1.4.5 : I.) RClc Device Actuation. 1, 2('), 3(') 1 per SR 3.3.1.4.2 NA actusty SR 3.3.1.4.3 device ' SR 3.3.1.4.4 i SR 3.3.1.4.5 ascKeJCIC manuel Initietton. 1, 2('), 3(') 1(d) SR 3.3.1.4.3 NA , SR 3.3.1.4.4 - SR 3.3.1.4.7 l
- 4. Automatic Depressurization System.
4.e ADS System Initletion. 1,2,3 2 pe SR 3.3.1.= mA I 1 42 syetem{b)- gg 3,3,3,4,4 IIbADSDeviceActuation. 4 1,2,3 1 per . SR 3.3.1.4.2 NA f actuato SR 3.3.1.4.3 4('),5CII device (*g SR 3.3.1.4.4 , SR 3.3.1.4.5 -; eT4 L c ADS Manuel Initiation. 1,2,3, 2 per ) SR 3.3.1.4.3 NA ! system td gg 3,3,g,4,4 l 4(I) 5(I)
, SR 3.3.1.4.7 l 1
- 5. Diesel-Generator Actuation.
(ggDivisionI,II,&IIILossof 1,2,3, 1 pe phase [g SR 3.3.1.4.1 m ( IV and s ! IV ; Voltage-6.9 kV. 4(h) $(h) SR 3.3.1.4.2 : SR 3.3.1.4.3 for I SR 3.3.1.4.4 , SR 3.3.1.4.5 t t 3 secs and SR 3.3.1.4.6 5 t 2 secs .l 3 3 Division I, II, & III Degraded 1,2,3, 1 pe SR 3.3.1.4.1 e t3V and s !IV l Voltage-6.9 kV. phase (,I SR 3.3.1.4.2 4(h) *$(h) ' SR 3.3.1.4.3 for SR 3.3.1.4.4 i SR 3.3.1.4.5 t t 3 sees and SR 3.3.1.4.6 s [ ] secs-JJ,rDG System Initiation. 1,2,3 2 per ) SR 3.3.1.4.3 NA system tb SR 3.3.1.4.4 , 4(h) ,$(h) gg 3,3,g,4,$ p 4.d.DG Device Actuation. 1,2,3 1 per SR 3.3.1.4.2 NA i
- actuetg SR 3.3.1.4.3 ,
4(h) 5, th) device SR 3.3.1.4.4 ] 975!4 DG Manuel Initiation. 1,2,3, 1 per DG(d) st 3.3.1.4.3 mA ) SR 3.3.1.4.4 4(h) $(h) gg 3,3,g,4,7 ] O ABWR TS 3.3-35 P&R 08/30/93
1 ESF Actuation Instrumentation l 3.3.1.4 Tabte 3.3.1.4-1 (Page 3 of 5) ESF Actuation Instrumentation fr k APPLICABLE MODES OR OTHER ' SPECIFIED REQUIRED SURVEILLANCE FUNCTION CONDITIONS CHANNELS REQUIREMENf3 ALLOWABLE VALUE l
- 6. Stancby Gas Treatment System Actuation, j 444.s SGTS Initiation. 1,2,3 1 pe $t 3*3*1'4*3 "A systee[b) SR 3.3.1.4.4 g
~4.b,$GTS Device Actuation. 1,2,3 1 per SR 3.3.1.4.2 NA actust SR 3.3.1.4.3 (t)(j) device'y' SR 3.3.1.4.4
- 7. Reactor guilding Cooling Water /
Service Water Actuation. Dia.ACW/RSWSysteminitiation. 1, 2, 3, 2 pe SR 3.3.1.4.3 NA system [b) gg 3,3,g,4,4 4(g),$(g) CLt RCW/RSV Device Actuation. 1, 2, 3, 1 per SR 3.3.1.4.2 NA actuatg SR 3.3.1.4.3 4(8) 5(83
, device SR 3.3.1.4.4 47.c ~RCW/R$W Manual Initiation. 1, 2, 3, 1 pe SR 3.3.1.4.3 NA :
System [d) SR 3.3.1.4.4 4(83,5(8) SR 3.3.1.4.7 (2Kittivision I, II, & III Loss of 1,2,3, 1 pe SR 3.3.1.4.1 t 1 3V and 5 I 3V Voltage 6.9 kV. phase [*) SR 3.3.1.4.2 4(h)*$(h) SR 3.3.1.4.3 for SR 3.3.1.4.4 ' SR 3.3.1.4.5 t t 3 secs and SR 3.3.1.4.6 5 t 3 secs CF # Division I, II, & 111 Degraded 1,2,3, 1 pe SR 3.3.1.4.1 t ! 3V and s [ 3V voltage-6.9 kv. phase [a) SP. 3.3.1.4.2 4(h)* $(h) SR 3.3.1.4.3 for SR 3.3.1.4.4 SR 3.3.1.4.5 t [ 3 secs and SR 3.3.1.4.6 s I 1 secs
- 8. Contalrunent Atmospheric Monitoring m A o CAM System Initiation. 1, 2 ,3 2 pe SR 3.3.1.4.3 NA system D) SR 3.3.1.4.4
.&.b CAM Device Actuation. 1,2,3 1 per SR 3.3.1.4.2 NA ,
actuatg SR 3.3.1.4.3 i device SR 3.3.1.4.4
- 9. Suppression Poot Cooling Actuation.
r 4 9.a. SPC System Initiation. 1, 2, 3, 2 per SR 3.3.1.4.3 NA system (b) gg 3,3,g,4,4 4(g) 5(8) K $.b SPC Device Actuation. 1, 2, 3, 1 per SR 3.3.1.6.2 mA actustyC SR 3.3.1.4.3 4(8) 5(9)
, device SR 3.3.1.4.4 N $3'c, SPC Manual Initiation. 1, 2, 3, 1 per SR 3.3.1.4.3 NA Systan(d) $g 3,3,g,4,4 4(8),5(8) SR 3.3.1.4.7 i
ABWR TS 3.3-36 P&R 08/30/93 L
ESF Actuation Instrumentation 3.3.1.4 Table 3.3.1.4 1 (Page 4 of $) l ESF Actuation Instrimentation (O APPLICABLE MODES OR OTHER ! SPECIFIED REQUIRED suRVEILLAkCE FLwCTION CONDITIONS CHANNELS REQUIREMEkis ALLOWA8tE VALUE !
- 10. Primary Containment Isolation Velves i Actuation.
Sh.'eWPCIVSystemInitiation. 1, 2, 3, 2(b) gg 3,3,3,4,3 gg SR 3.3.1.4.4 (i)(J)
+
t20.h,PCIV Device Actuation. 1, 2, 3, 1 per SR 3.3.1.6.2 NA ectuet SR 3.3.1.4.3 SR 3.3.1.4.4 (I)(j) device
,q T19.s, PCIV Manuel Initletion. 1, 2, 3, 2(d) st 3.3.1.4.3 NA SR 3.3.1.4.4 (t)(j) sR 3.3.1.4.7 ,
I f 11. Secondary containment isolation . Valves Actuation. ; t11.e- CIV System Initiation. 1, 2, 3, 2(b) sa 3.3.1.4.3 NA st 3.3.1.4.4 ( (J) !
- M.A CIV Device Actuation. 1, 2, 3, 1 per SR 3.3.1.4.2 NA actuetg SR 3.3.1.4.3 !
(}) device SR 3.3.1.4.4 , 113 c, Civ Manuel Initiation. 1, 2, 3, 2(d) st 3.3.1.4.3 hA f SR 3.3.1.4.4 (j) SR 3.3.1.4.7 :
- 12. Reactor Core Isolation Cooling ,
Isolation Actuation. l 2(b) gg 3,3,3,4,3 gg ! 12.a f RCIC System Isoletion 1,2,3 g4E Initiation. st 3.3.1.4.4 i g ($2.b.RCIC ! solation Device Actuation. i, 2, 3 1 per st 3.3.1.6.2 NA t actuetg SR 3.3.1.4.3 1 device st 3.3.1.4.4 T +-f t- C h l d2.c RCIC Manuel Isotation 1,2,3 2(d) st 3.3.1.4.3 NA j Initiation. st 3.3.1.4.4 y SR 3.3.1.4.7
- 13. Reactor Water Cleanup Isolation Actuation.
c.v v
.kdfi7RweWSystemIsolation 1, 2, 3, 2(D) st 3.3.1.4.3 ha Initiation. (1) $R 3.3.1.4.4 g,tN
,3.b nWCW 1 solation Device Actuation. 1, 2' 3' 1 per SR 3.3.1.4.2 "A st 3.3.1.4.3 device (53 st 3.3.1.4.4 cup 2(d) ga 3,3.1.4.3 NA
,g4 Rwee menuel Isolation I,2 3*
le Initiation. st 3.3.1.4.4 st 3.3.1.4.7
,o - . % _ 1,0 3. o.1.o 5 te. 'D *.1" '. N i o % i g
3.3-37 & P&R 08/30/93 ABWR H %9 CQ n ,J
# % k.3 - heS,\i M hk6 g \, g { $. g ABWR SECTION B3.3 INSERTS P&R REVIEW page 10 ALO 9/16/93 10.d Drywell Sump Drain LCW 1,2,3 1(a) SR 3.3.1.4.3 -
- Radiation-High. SR 3.3.1.4.4 \
SR 3.3.1.4.6 10.e Drywell Sump Drain LCW 1,2,3 1(a) SR 3.3.1.4.3 s I ) Reds N Radiation-High. SR 3.3.1.4.4
\ SR 3.3.1.4
-" i p _ _ _ _ . - .
12.d PCIC Turbine Ex.haust Diaphragm 1,2,3 4(a) SR 3.3.1.4.1 1 [ ] kg/cm2 Pressure-High. SR 3.3.1.4.3 SR 3.3.1.4.4 SR 3.3.1.4.6 { i _
.b l
lO i O
- - . . . - - _ _ - _ -__ _ __L
I ESF Actuation Instrumentation 3.3.1.4 l Table 3.3.1.4-1 (Page 5 of 5) ESF Actuation Instrumentation APPLICABLE NCDES OR , DTHER l
$PECIFIED REQUIRED SURVEILLAhCE i FUNCTION CONDITIONS CHANNELS REQUIREMENTS ALLOWABLE VALUE l
14 Shutdown Cooling System isolation l Actuation. l k W SD Cooling system Isolation 2, 3,(1) 2(b) sa 3.3.1.4.3 NA Initiation. SR 3.3.1.4.4 ; I 4 A A SD Cooling Isolation Device 2, 3, (i) 1 per ER 3.3.1.4.2 NA Actuation, actuatgI $R 3.3.1.4.3 ; device sa 3.3.1.4.4 t 14'.c SD Cooling manual isolation 2, 3, (i) 2(d) SR 3.3.1.4.3 NA
^*
- Initiation. SR 3.3.1.4.4 st 3.3.1.4.7 (a) These are SENSOR CHANNEL Functions.
(b) These are LOGIC CHANNEL Functions. 7 (c) These are OUTPUT CHANNEL Furstions. l (d) These are manual initiation channel Functions. 1 (e) With reactor pressure greater than 150 Paig (f) With reactor pressure greater than 50 Psig (g) When associated sesystems are recpired to be operable. ( (h) When associated Diesel-Generator is required to be OPERABLE per LCO 3.8.2 *AC Sources - Shutdown" l (i) During CORE ALTERAfl0NS and operations with the potential for draining the rescror vessel. (j) During movement f irradiated fuel asseelies in the secondary contairsuent. ! w,c g L
- w s
__.c,m4w Ns ;s a s A c.y -
, a yQpxa, ','h' ,qcn s
s
- \
\
I ABWR TS 3.3-38 P&R 08/30/93
SRNM Instrumentation 3.3.2.1 . 3.3 INSTRUMENTATION 3.3.2.1 Source Range Monitor (SRNM) Instrumentation LC0 3.3.2.1 The SRNM instrumentation for each Function in Table 3.3.2.1-1 shall be OPERABLE. APPLICABILITY: According to Table 3.3.2.1-1. NOTE Separate Condition entry is allowed for each channel.
,0, &
ACTIONS / CONDITION REQUIRED ACTION COMPLETION TIME A. One required channel I NOTE inoperable in one or LCOM is not applicable more bypass groups. #blace inoperable channel in I hour hd bypass, B. Required Action and B.1 Be in MODE 3. 12 hours associated Completion Time of Condition A not met. OR Four or more required channels inoperable. C. One or more required C.1 Fully insert all I hour SRNMs inoperable in insertable control rods. MODE 3 or 4. 8.!!D C.2 Place reactor mode I hour switch in the shutdown position. (continued) ABWR TS 3.3-39 P&R 08/30/93
SRNM Instrumentation 3.3.2.1 I() ACTIONS (Continued) CONDITION REQUIRED ACTION COMPLETION TIME D. One required SRNM D.1 Suspend CORE ALTERATIONS Immediately inoperable in MODE 5. except for control rod insertion. AND D.2 Initiate action to Immediately insert all insertable control rods in core cells containing one or more fuel assemblies. - MD D.3 Initiate action to 7 days restore required SRNM to OPERABLE status. s s E. Two required SRNMs E.1 Initiate action to Immediately
)
inoperable in MODE 5. restore one required SRNM to OPERABLE status. ABWR TS 3.3-40 P&R 08/30/93 l
SRNM Instrumentation 3.3.2.1 j I SURVEILLANCE REQUIREMENTS NOTE : Refer to Table 3.3.2.1-1 to determine which SRs apply for each applicable MOD l or other specified conditions. j , -1 L l SURVEILLANCE FREQUENCY l I l SR 3.3.1.3.1 Perform CHANNEL CliECK. 12 hours l l l SR 3.3.2.1.2 NOTE
- 1. Only required to be met during CORE ALTERATIONS.
- 2. Only part a. is required under the i conditions specified in footnote (a) i of Table 3.3.2.1-1.
! 3. One SRNM may be used to satisfy more , than one of the following. ;
' j Verify an OPERABLE SRNM detector is 12 hours !
located in: i 6.ND - l l a. The fueled region; l Following a change
- b. The core quadrant where CORE in the core ;
l ALTERATIONS are being performed when quadrant where l l the associated SRNM is included in CORE ALTERATIONS the fueled region; and are being performed.
- c. A core quadrant adjacent to where CORE ALTERATIONS are being performed, when the associated SRNM is included in the fueled region.
l (continue'd) ABWR TS 3.3-41 P&R 08/30/93 j i-l l
I SRNM Instrumentation l 3.3.2.1 ! SURVEILLANCE REQUIREMENTS (Continued) l SURVEILLANCE FREQUENCY SR 3.3.2.1.3 NOTE i Not required to be met with four or less fuel assemblies adjacent to the SRNM and no other fuel assemblies in the associated core quadrant. Verify count rate is 2 3.0 cps 12 hours during CORE ALTERATIONS AND 24 hours SR 3.3.2.1.4 Perform CHANNEL FUNCTIONAL TEST. 7 days SR 3.3.2.1.5 Perform CHANNEL FUNCTIONAL TEST. 31 days v SR 3.3.2.1.6 NOTE Neutron detectors are excluded. g Perform CHANNEL CALIBRATION. h8) months ( l l 1 i ABWR TS 3.3-42 P&R 08/30/93 l l l
i i SRNM Instrumentation : 3.3.2.1 > 5 ( Table 3.3.2.1 1 (pose 1 of 1) startte Range Neutron Monitor Instrtmentation , APPLICABLE MODES OR CTHER REQUIRED SURVEILLANCE FUNCTION sPECIFIED CONDITIONS CHANNELS REQUlREMENis a
- 1. startup Range Neutron Monitor 2 Group 8'[14- SR 3.3.2.1.1 Crote 8 ;
3 st 3.3.2.1.3 Group 8 % - b3 SR 3.3.2.1.5
\ st 3.3.2.1.6 ,
3,4 2 st 3.3.2.1.1 i SR 3.3.2.1.3 st 3.3.2.1.5 ; l st 3.3.2.1.6 i 2(a),(b) 5 SR 3.3.2.1.1 SR 3.3.2.1.2 , SR 3.3.2.1.3 st 3.3.2.1.4 . SR 3.3.2.1.6 i i (a) Only one SRNM channel is required to be OPERABLE & ring spiret offlood or retoed den the fueled region l includes only that sRNM detector. , (b) specist movable detectors may be used in ptoce of sRNMs if connected to normal sRNM circuits. 1-1 I l i l l r 4 ABWR TS 3.3-43 P&R 08/30/93 .
Essential Multiplexing System (EMS) 3.3.3.1 (/ 3.3 INSTRUMENTATION 3.3.3.1 Essential Multiplexing System (EMS) LC0 3.3.3.1 Four divisions of EMS data transmission shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, 4, and 5. NOTE Separate Condition entry is allowed for each division. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more data NOTE transmission segments LCO 3.0.4 is not applicable. inoperable in one EMS division with data A.1 Restore ,11 data Prior to transmission transmissioli' segments entering MODE 2 maintained. to'0PERABLE st'atus. following next Mode 4 entry. [ 4 K B. One or m m data B.1 Restoreinoperablefdata (30] days transmissun segments transmission segments inoperable in two or in at least three EMS more EMS divisions divisTont to2p'erable with data transmission status, maintained in all divisions. C. Required Actions and C.1 Verify data 1 hour associated Completion transmission Times of Condition B capability. E not met. E once per 24 hours thereafter. C.2 Initiate action in Immediately accordance with specification 5.9.2.e. ( (continued) ABWR TS 3.3-44 P&R 0B/30/93
Essential Multiplexing System (EMS) 3.3.3.1 l 1
.i ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME l er l D. One or more EMS D.I NOTE divisions inoperable. LC0 3.0.4 is not i applicable. j
') Declare affected 4 hours Functions and supported Features inoperable.
i . 1
- ABWR TS 3.3-45 P&R 08/30/93 l
l l
Essential Multiplexing System (EMS) 3.3.3.1 "h i(d SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.3.1.1 Verify the required data transmission path [92) days segments are OPERABLE. SR 3.3.3.1.2 Perform a comprehensive network [18] months performance test. O 1 o ABWR TS 3.3-46 P&R 08/30/93 l 1
ATWS & E0C-RPT Instrumentation 3.3.4.1 3.3 INSTRUMENTATION 3.3.4.1 Anticipated Transient Without Scram (ATWS) and End-of-Cy:.le Recirculation Pump Trip (E0C-RPT) Instrumentation LCO 3.3.4.1 The channels for each Function listed in Table 3.3.4.1-1 shall be OPERABLE. APPLICABILITY: According to Table 3.3.4.1-1. NOTE Separate Condition entry is allowed for each channel. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions NOTE with one inoperable Applies only to Functions 1, channel. 3, 5,11, and K in Table 3.3.4.1-1. // O A.1 Place inoperable 6 hours channel (s) in trip. M A.2.1 Place inoperable 6 hours channel (s) in bypass. 8.NQ A.2.2.1 Restore inoperable 14 days channel (s) to OPERABLE status. M l A.2.2.2 Place inoperable 14 days channel (s) in trip. I (continued) ABWR TS 3.3-47 P&R 08/30/93
i ATWS & EOC RPT Instrumentation 3.3.4.1- ; ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME , B. One or more Functions NOTE . with two or more Applies only Functions 1,- ! channels inoperable. 3, 5, 11, and in Table l' 3.3.4.1-1. y B.1 Restore two channels 72 hours to OPERABLE status. i C. One or more Functions NOTE i with one channel Applies only to Functions 2, l' inoperable. 4, and 9 in Table 3.3.4.1-1. C.1 Place inoperable 6 hours , channel (s) in trip. M C.2.1 Place inoperable 6 hours channel (s) in bypass. C.2.2.1 Restore inoperable 30 days ; channel (s) to OPERABLE status. + M C.2.2.2 Place inoperable 30 days channel (s) in trip. l D. One or more Functions NOTE l with two channels Applies only to Functions 2, : inoperable. 4, and 9 in Table 3.3.4.1-1. l l D.1 Restore one inoperable 72 hours l channel to OPERABLE
. status.
r (continued) ABWR TS 3.3-48 P&R 08/30/93 i L _ _ . - , _ _ _ . _
ATWS & EOC-RPT Instrumentation 3.3.4.1 l 1 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME- i i' E. One or more Functions NOTE with three or more Applies only to Functions 2, channels inoperable. 4, and 9 in Table 3.3.4.1-1. E.1 Restore at least one [24] hours inoperable channel to OPERABLE status. ; t F. Required Action and NOTE f associated Completion Applies only to Function 4 Time of Condition C, in Table 3.3.4.1-1. D, or E not met. F.1 Apply the MCPR limit [2] hours for inoperable E0C-RPT as specified in the , COLR. l i G. One or more Functions NOTE - with one or more ; Applies only to Functions-6.~Ng O channels inoperable. 7, 8, 3.3.4.1-1. Table 10, 12,t and M in g \5 \ b , 1 G.1 Restore channels to [24] hours ! OPERABLE status. l
}
I 1 i O ccen14nuee> ABWR TS 3.3-49 P&R 08/30/93 l l l
'W #=-+~4? & #!f
i ! ATWS & EOC-RPT Instrumentation 3.3.4.1 , i ( ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME , i H. Required Action and H.1 NOTE associated Completion Applies only to l
% ih Time not met. m Functions 6, 7, 8, der---abcl w3 u,.x,.~ ..
.Y.
Table 3.3.4.1-1. l Declare affected Immediately Functions and ! supported features l l inoperable % i l < 03 H.2 NOTE i Applies only to i
^ _ Function 1, 2, 3, e-5 :
I in SL 9311 Aand "able 3.3.4.1- (1. 15
~
% \1 3 L'+ ,
BeinMODE1.b thours y \ ~4-i l l H.3 NOTE ; Applies only to i Function 4 in Table ! 3.3.4.1-1. l l Reduce power to s 40% 6 hours l RTP. l l , O i ABWR TS 3.3-50 P&R 08/30/93
ATWS & EOC-RPT Instrumentation 3.3.4.1 l {(,r' SURVEILLANCE REQUIREMENTS NOTE Refer to Table 3.3.4.1-1 to determine the applicability of the SRs to each RPT Function. , SURVEILLANCE FREQUENCY SR 3.3.4.1.1 Perform SENSOR CHANNEL CHECK. 12 hours SR 3.3.4.1.2 Perform CHANNEL FUNCTIONAL TEST. [92] days SR 3.3.4.1.3 Perform SENSOR CHANNEL CALIBRATION. [18] months SR 3.3.4.1.4 Perform LOGIC SYSTEM FUNCTIONAL TEST. [18] months SR 3.3.4.1.5 Verify the RPT SYSTEM RESPONSE TIME is (18] months within limits. SR 3.3.4.1.6 Perform COMPREHENSIVE FUNCTIONAL TEST. [18] months SR 3.3.4.1.7 Perform CHANNEL FUNCTIONAL TEST 7 days 1 i O ABWR TS 3.3-51 P&R 08/30/93
ATWS & EOC-RPT Instrumentation 3.3.4.1 iO K-) Table 3.3.4.1-1 (page 1 of 1) ATWS and E0C RPT Instrumentation APPLICABLE MODES AND OTHER REQUIRED SPECIFIED SURVEILLANCE ALLOWABLE FUNCTION CHANNELS CONDITIONS REou!REMENTS VALUES
- 1. Fee & ster Reactor Water Level-Low, Level 3 1g SR 3.3.4.1.1 s ( ) em
- 3. ( 3 SR 3.3.4.1.2 d t.\ SR 3.3.4.1.3 SR 3.3.4.1.4 SR 3.3.4.1.5
- 2. Reactor ster Level-Low, Levet 2. 4 11 SR 3.3.4.1.1 s [ ] cm SR 3.3.4.1.2 SR 3.3.4.1.3 SR 3.3.4.1.4 SR 3.3.4.1.5 51 Qt._g SR 3.3.4.1.6
- 3. SB&PC Reactor ome Pressure-High. 3 14 SR 3.3.4.1.1 s t 3 psig SR 3.3.4.1.2 SR 3.3.4.1.3 SR 3.3.4.1.4 SR 3.3.4.1.5 4 EOC-RPT Initiation 4 14D% RTP. SR 3.3.4.2.2 NA SR 3.3.4.1.5 SR 3.3.4.1.6
- p. 5. RPT Trip initiation Function of the RFC. 3
- 1) SR 3.3.4.1.2 NA
( SR 3.3.4.1.4
- 6. ASD Ptrnp Trip Actuation. 1 per ASD 13 3 SR 3.3.4.1.4 NA
- 7. ASD Ptsp Trip Timers. 1 per ASD 1,1 SR 3.3.4.1.3 footnote (a)
SR 3.3.4.1.4
- 8. ASD Punp Trip Load InterrL4:ters 1 per ASD 1Q t*. M .0. .; 7" NA SR 3.3.4.1.4
- 9. RPS Scram Follow Signal. 4 13A SR 3.3.4.1.2 SR 3.3.4.1.4
- 1-L+ N k SR 3.3.4.1.6
- 10. Manust ATWS ARI Initiation. 2 1 A SRSR 3.3.4.1.4 NA 3.3.4.1.7
- 11. ATWS ARI Trip Initiation Ftriction of the 3 1,% SR 3.3.4.1.4 NA RFC.
- 12. ATWS-FMCRD Initiation Function of the 2 NA RCIS.
1 4 SR 3.3.4.1.4 M 45. ATWS.ARI valve Actuation. 3 14 SR 3.3.4.1.4 hA f $ 44. FMCRD Emergency Insertion Inverter Control 1 per rod 1A3 SR 3.3.4.1.4 hA Logic k M . Recirculation R m ck 1 per p g 1A SR 3.3.4.1.4 NA (a) $ I 2 seconds for RIPS IA, D, F, J, B, E, & M1 and s [ ] secords for RIPS IC, G, & K). O } h , Y X db b5 [** ph I J b S*k.4. leS ( h% wa.re r - ,J: g 1.ap.c. ABWR TS 3.3-52 P&R 08/30/93 I
l Feedwater and Main Turbine Trip Instrumentation i 3.3.4.2 l [ 3.3 INSTRUMENTATION 3.3.4.2 Feedwater and Main Turbine Trip Instrumentation i l LCO 3.3.4.2 Three channels of feedwater and main turbine trip ! instrumentation shall be OPERABLE. l I APPLICABILITY: THERMAL POWER 2 25% RTP. l NOTE l Separate Condition entry is allowed for each channel. l ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One feedwater and main A.1 Place channel in 6 hours I turbine trip channel trip. l inoperable. E ' Place channel in 6 hours (d A.2.1 bypass. b& A.2.2.1 Restore channel to 14 days OPERABLE status. M A.2.2.2 Place channel in 14 days trip. B. Two or more feedwater B.1 Restore two channels 72 hours and main turbine trip to OPERABLE status. channels inoperable. l l C. Required Action and C.1 Reduce THERMAL POWER 4 hours l associated Completion to < 25% RTP. Time not met. N I l ABWR TS 3.3-53 P&R 08/30/93
- Feedwater and Main Turbine Trip Instrumentation
( 3.3.4.2 l SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.4.2.1 Perform SENSOR CHANNEL CHECK. 24 hours i SR 3.3.4.2.2 Perform CHANNEL FUNCTIONAL TEST. 92 SR 3.3.4.2.3 Perform SENSOR CHANNEL CALIBRATION. The ths l ! 18 Allowable Value shall be s [ ] inches. l SR 3.3.4.2.4 Perform LOGIC SYSTEM FUNCTIONAL TEST ,118konths ! including [ valve] actuation. / l !O ' i l I l ABWR TS 3.3-54 P&R 08/30/93
Control Rod Block Instrumentation 3.3.5.1 , 3.3 INSTRUMENTATION 3.3.5.1 Control Rod Block Instrumentation _ i P LC0 3.3.5.1 The control rod block instrumentation for each Function in Table 3.3.5.1-1 shall be OPERABLE. l APPLICABILITY: According to Table 3.3.5.1-1. ACTIONS j CONDITION REQUIRED ACTION COMPLETION TIME ! A. One Automated Thermal A.1 Restors :bannel to [72] hours Limit Monitor (ATLM) OPERABL. ;tatus channel inoperable. E : A.2 Verify the thermal 4 hours i limits are met. M l once per 4 hours. i thereafter B. Two ATLM channels NOTE inoperable Removal of ATLM block under administrative control is l' l permitted provided manual control of rod movement and thermal limits are verified i l by a second licensed operator. i
/ i B.1 Insert an ATLM block. Immediately AND ,
pfLO '. rify RCIS blocks .4 hours gd B.2 V M.E pal} control rod movement by. M bM _ attempting to withdraw once per 4 hours
~ er iatert- one rodg er thereafter koneyoj of roh C. One Rod Worth C.1 store channel [72]' Hours Minimizer (RWM) ERABLE-statu .
channel inoperable.
.(continued)
ABWR TS 3.3-55 P&R 08/30/93
. - _ - . _ . . . - .. .. , - ,. a
l Control Rod Block Instrumentation 3.3.5.1 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME D. Two RWM channels 0.1 Suspend control rod Immediately inoperable. movement, except by scram. DE l Required Actions and l associated Completion Time of Condition C not Met. l E. One or more Reactor E.1 Suspend control rod Immediately Mode Switch-Shutdown withdrawal. ; Position channels inoperable. AND , l E.2 Initiate action to fully Immediately insert all insertable control rods in core cells containing one or more fuel assemblies. l 1 i ABWR TS 3.3-56 P&R 08/30/93
l i Control Rod Block Instrumentation 3.3.5.1 SURVEILLANCE REQUIREMENTS NOTE Refer to Table 3.3.5.1-1 to determine which SRs apply for each Control Rod Block Function. SURVEILLANCE FREQUENCY SR 3.3.5.1.1 NOTE YC" -
'" 1 Not required to be performed until I hour. bra' after THEPNAL POWER is > [10]% RTP. 44,is con"'
Perform CHANNEL FUNCTIONAL TEST. [92] days SR 3.3.5.1.2 NOTE Not required to be performed until I hour after any control rod is withdrawn in MODE 2. Perform CHANNEL FUNCTIONAL TEST. [92] days l SR 3.3.5.1.3 Verify the RWM is not bypassed when [ months THERMAL POWER is s [10]% RTP. jg SR 3.3.5.1.4 Verify the ATLM is not bypassed when f g m gf,, THERMAL POWER is s [10]% RTP. SR 3.3.5.1.5 NOTE Not required to be performed until I hour ! i after reactor mode switch is in the l shutdown position. 12 Perform CHANNEL FUNCTIONAL TEST. [dmonths ( Continued ) ABWR TS 3.3-57 P&R 08/30/93
Control Rod Block Instrumentation 3.3.5.1 ( SURVEILLANCE REQUIREMENTS (continued) I SURVEILLANCE FREQUENCY SR 3.3.5.1.6 Perform CHANNEL CHECK of process [ ours idcU parameter and setpoint inputs to the ATLM. l l r ik l I l 1 l 1 i L.) ABWR TS 3.3-58 P&R 08/30/93 l
Control Rod Block Instrumentation 3.3.5.1 Table 3.3.5.1 1 (page 1 of 1) Control Rod Block Instrunentation AFPLICABLE ' MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE FUNCTION CONDITIONS CHANNELS REQUIREMENTS
- 1. Rod Control & Information System
- a. Automated Thermal Limit Monitor ((a)) 2 SR 3.3.5.1.1 SR 3.3.5.1.4 SR 3.3.5.1.6
- b. Rod worth Minimiter 1IDI,2(D) 2 SR 3.3.5.1.2 SR 3.3.5.1.3
- 2. Reactor Mode Switch - Shutdown Position (c) 4 SR 3.3.5.1.5 (a) THERMAL POWER >
(b) With THERMAL POWER 5 (10]% RTP. (c) Reactor mode switch in the shutdown position, o LJ ABWR TS 3.3-59 P&R 08/30/93
%re w
Remote Shutdown System 3.3.6.2 1 3.3 INSTRUMENTATION 1 3.3.6.2 Remote Shutdown System 1
- l. 9~S 5 i LCO 3.3.6.2 The Remote Shutdown System instrumentation for each Function '
listed in Table 3.3.6.2-1 shall be OPERABLE. l i
- I APPLICABILITY: MODES 1-and 2. l NOTE
- 1. LCO 3.0.4 is not applicable. ;
- 2. Separate Condition entry is allowed for each Function.
ACTIONS l CONDITION REQUIRED ACTION COMPLETION TIME 9 65 A. One(division with one A.1 Restore required 90 days ; or more required div hfen to OPERABLE : Functions inoperable, f status. :
'O , (Q E "*%"6 h4. f B. Two/ d E ons with one B.1 Restore required 30 days or more required Functions to OPERABLE Functions inoperable. status. l f
C. Required Action and C.1 Be in MODE 3. 12 hours ! associated Completion t Time not met. l l l l I i ABWR TS 3.3-64 P&R 08/30/93 1 1 5
Remote Shutdown System 3.3.6.2 Table 3.3.6.2-1 (page 1 of 2) Remote Shutdown System Instrumentation REQUIRED NUMBER FUNCTION (INSTRUMENT OR CONTROL PARAMETER) 0F DIVISIONS
- 1. Reactor Pressure. 2 k > El.t.cn O o
- 2. HPCF B Flow. 1
- 3. HPCF B Controls. 1(c.)
- 4. HPCF B Pump Discharge Pressure. 1
- 5. RHR Flow. 2(a)
- 6. RHR Hx Inlet Temperature. 2(a)
- 7. RHR Hx Outlet Temperature. 2(a)
- 8. RHR Hx Bypass Valve Position. 2(a) ,
- 9. RHR Hx Outlet Valve Position. 2(a)
'd
- 10. RHR Pump Discharge Pressure. 2(a)
- 11. RHR Controls. 2(a)(C}
- 12. RPV Wide Range Water Level. 2
- 13. RPV Narrow Range Water Level. 2
- 14. Reactor Building Cooling Water Flow. 2
- 15. Reactor Building h.% $%3 Cooling Water Controls.
2(c}
- 16. Reactor (Service Wat'er System Controls.
2(C]
- 17. Flammability Control System Controls 1
- 18. Suppression Pool' Level. 2
- 19. Condense.te Storage Pool Level. 1
( Continued ) ABWR TS 3.3-66 P&R 08/30/93 I
.- . - - - - .. - - . . .. -~
i Remote Shutdown System I 3.3.6.2 l l Table 3.3.6.2-1 (page 2 of 2)
- i. Remote Shutdown System Instrumentation.
REQUIRED NUMBER l FUNCTION (INSTRUMENT OR CONTROL PARAMETER) 0F DIVISIONS i
- 20. Suppression Pool Temperature. 2 l
- 21. Electric Power Distribution Controls. 2(C) g
- 22. Diesel Generator Syeesa Monitors. T J es\o d Q 2 i
( 23. SRV Controls. (b) (a) RHR A for division I RSS panel, RHR B for division II RSS panel. (b) Three on the Division I RSS, 4 on division II RSS. C&) T b 5 P - cl 4 1 m d. % %LL%kcc oC C>Ec.w b [
# *- Y t yk'* 4 'Lo ' h e-oiliMh LE 6e e u.m e c_ u em ,
" ~ # * ~ '" '
O .. 1 I .i l l l l t l
'O ABWR TS 3.3-67 P&R 08/30/93 -__=_-_ _ _ _ . - _ _ - . . ., - _
L Remote Shutdown System l 3.3.6.2 SURVEILLANCE REQUIREMENTS l i SURVEILLANCE FREQUENCY SR 3.3.6.2.1 Perform CHANNEL CHECK for each required 31 days instrumentation channel. SR 3.3.6.2.2 Verify each required control circuit and 18 months transfer switch is capable of performing the intended functions. l I SR 3.3.6.2.3 Perform CHANNEL CALIBRATION for each 18 months required instrumentation channel. l lO l 1 O ABWR TS 3.3-65 P&R 08/30/93
PAM Instrumentation 3.3.6.1
- SURVEILLANCE REQUIREMENTS NOTE These SRs apply to each Function in Table 3.3.6.1-1.
SURVEILLANCE FREQUENCY f SR 3.3.6.1.1 Perform CHANNEL CHECK. 31 days NOTE Neutron detectors are excluded. SR 3.3.6.1.2 Perform CHANNEL CALIBRATION. 18 months
/ ,
) -
- b S.S , kd.\ dos.g g-g '\
(g y '9the b V +cc ,s h 6 , j l
\x ~ ' % +_ _ __ #^
/
l l i (Continued) ABWR TS 3.3-62 P&R 08/30/93
CRHA System Instrumentation 3.3.7.1 !
.C 3.3 INSTRUMENTATION 3.3.7.1 Control Room Habitability Area (CRHA) ergency Filtration (EF) pstem Instrumentation j i
LC0 3.3.7.1 The CRHA EF System instrumentation for each Function in l Table 3.3.7.1-1 shall be OPERABLE. APPLICABILITY: a. MODES 1, 2, and 3. , I
- b. During movement of irradiated final assemblies in the i secondary containment. i
- c. During CORE ALTERATIONS.
- d. During operations with a potential for draining the :
reactor vessel. NOTE ; Separate Condition entry is allowed for each channel. ; ACTIONS ! CONDITION REQUIRED ACTION COMPLETION TIME O dia:siv e A. One or more EF m ite A.1 Place channel in trip. 6 hours . with one control l room ventilation _0R : radiation monitor < channel system A.2 Place channel in bypass 6 hours inoperable. cj;vib B. One or more EF W B.1 Place one channel in 6 hours with two control trip and the other in room ventilation bypass. radiation channels inoperable. AND B.2 Restore one channel to Prior to OPERABLE status, completion of next CHANNEL FUNCTIONAL TEST O ( continued > _ ABWR TS 3.3-68 P&R 08/30/93 -1 l I
. ,_ - . . . __ _ . _ - _ _ _ _ . , .. __ - .i
CRHA System Instrumentation
-3.3.7.1 ,
t i ACTIONS (continued) l CONDITION REQUIRED ACTION COMPLETION TIME l 149 0 ". C. Required Action and C.1 Place.the one associated EF M; I hour associated n l Completion Time of the emergency Condition A or B not filtration-mode of. j met, operation. l E y:oidea5 E l One or more EF w,itr-- C.2 Declare associated EF with one or more -em+ inoperable. I hour ' Manual Switch gy;,,,,, , channel, Standby ; l Switch channel, or ; low flow actuation ! channel inoperable. E y;sive*5 ! One or more EF N I with 3 or more ; control room ! radiation monitoring O channel inoperable. I l l I l I I ! ! l l l O ABWR TS 3.3-69 P&R 08/30/93 t
f CRHA C EF System Instrumentation 3.3.7.1 SURVEILLANCE REQUIREMENTS
) '
NOTE Refer to Table 3.3.7.1-1 to determine which SRs apply for each Function. SURVEILLANCE FREQUENCY SR 3.3.7.1.1 Perform SENSOR CHANNEL CHECK. [24] hours SR 3.3.7.1.2 Perform CHANNEL FUNCTIONAL TEST. [92] days SR 3.3.7.1.3 Perform SENSOR CHANNEL CALIBRATION. [18] months l SR 3.3.7.1.4 Perform LOGIC SYSTEM FUNCTIONAL TEST. [18] months O t l l I i O ABWR TS 3.3-70 P&R 08/30/93
CRHA EF System Instrumentation 3.3.7.1
% fable 3.3.7.1-1 (page 1 of 1)
Control Room Habitability Area HVAC - Emergency Filtration System Instrumentation SURVEILLANCE ALLOWABLE FUNCTION REQUIRED CHANNELS REQUIREMENTS VALUE I
- 1. Control Room 4 SR 3.3.7.1.1 1 [ ] nWt/hr ventilation Per EF M . A SR 3.3.7.1.2 Radiation Monitors *Y g SR 3 . 3. 7.1.3 n SR 3.3.7.1.4
- 2. Emergency Filtration 2 per EF W h SR 3.3.7.1.2 s t 3 kg/hr System Low Flow .
SR 3.3.7.1.3 SR 3.3.7.1.4
- 3. Emergency Filtration 1 per EF M I SR 3.3.7.1.2 N/A System Manual Switch SR 3.3. 7.1.4
- 4. Emergency Filtration 1 per EF h SR 3.3.7.1.2 N/A i System Standby SR 3.3.7.1.4 Switch (a) During operations with a potential for draining the reactor vessel.
(b) During movement of irradiated fuel assemblies in the primary or secondary containment. t l l I i O ABWR TS 3.3-71 P&R 08/30/93
Electric Power Monitoring 3.3.8.1 3.3 INSTRUMENTATION 3.3.8.1 Electric Power Monitoring LCO 3.3.8.1 Two electric power monitoring assemblies ~ shall be OPERABLE for eac inservice constant voltage constant frequency (CVCF) ower supply.
-- Cla ss 16 .
APPLICABILITY: MODES 1, 2, and 3. ! MODES 4 and 5 with any control rod withdrawn from a core l cell containing one or more fuel assemblies. l NOTE . Separate condition entry is allowed for each CVFC power supply. J l l ACTIONS i CONDITION REQUIRED ACTION COMPLETION TIME l I A. One or more inservice A.1 Place the associated I hour l CVCF power supplies electric power I with one electric monitoring assembly power monitoring circuit breaker in l assembly inoperable. tripped condition. l l B. One or more inservice B.1 Remove associated 72 hours CVCF power supplies inservice power with both electric supply (s) from service. power monitoring assemblies inoperable. C. Required Action and C.1 Be in MODE 3. 12 hours ! associated Completion Time of Condition A AND l or B not met in MODE j 1, 2, or 3. C.2 Be in MODE 4. 36 hours ! (c>w c! 410 m 3 see aara ey O ABWR TS 3.3-72 P&R 08/30/93 l i l
Vital Ac Electric Power Monitorirq 3.3.8.1 l' O ^cr ons <c "ti""ea) ; CDNDITION REQUIRED ACTION CNPETICH TIME
\
l
\
D. Required Action ard D.1 Initiate action to T M intely ' associated Ccepletion fully insert all l ! Tire of Condition A or insertable u.ma^uul i 4 B not met in IODE 4 rods in core cells
\
or 5 with any u.uiuvl containirg one or 9 , rod withdrawn frcxn a more fuel a M lies. ! core cell containing one or rcro fuel AND a w lies. - t D.2.1 Initiate action to T W iately \ restore one electric pm monitorirq , assembly to OPERABLE J-
~
}
status for inservice n' '
,' power supply (s) ,
supplyirq required instrumentation. _ I m _ D.2.2 Initiate action to L W ately f L_ isolate the Resichtal
-~
C Heat Rez:rnal Shutdown /,
/ Coolirq Systems. _
/ J
/t k /
SURVFTTIANCE HrwmTTIS S N ICE turwr.21CY SR 3.3.8.1.1 :UTE Only required to be performed prior to entering WDE 2 or 3 frtra } ODE 4, when in IODE 4 for 2 24 hours. Perform CHAlWEL FUNCTIO!GL 'IEST. 184 days (continued) O ABWR TS 3.3-2 7/29/93
. - ~ . - - - . . . . _ - . _ - - _ _ .
t i
-l i
J Electric Power Monitoring l 3.3.8.1 l O SURVEILLANCE REQUIREMENTS l
]
SURVEILLANCE FREQUENCY SR 3.3.8.1.1 Perform CHANNEL CHECK. 7 days , l l SR 3.3.8.1.2 Perform CHANNEL FUNCTIONAL TEST. 92 days SR 3.3.8.1.3 Perform CHANNEL CALIBRATION [18] months l l , i l l l lO l l l O - ABWR TS 3.3-73 P&R 08/30/93
I RPV Coolant Temperature Monitoring 3.3.8.2 O 3.3 instaustatation 3.3.8.2 Reactor Coolant Temperature Monitoring-Shutdown , LCO 3.3.8.2 One Reactor Coolant Temperature Monitoring channel associated with each RHR subsystem operating in the Shutdown : Cooling Mode shall be OPERABLE. APPLICABILITY: When RHR is operating in the Shutdown Cooling Mode. ACTIONS ;
~
CONDITION REQUIRED ACTION COMPLETION TIME ! A. One or more reactor A.1 Verify at least one Immediately. 1 coolant temperature RHR subsystem is . 4 monitoring channels operating in the ! inoperable. Shutdown Cooling l Mode. ! O A.2 Verify an alternate 1 hour method of reactor coolant temperature M i monitoring is available. Once per 24 ! hours thereafter. ! B. Required Action and B.1 Initiate action to Immediately, i associated Completion restore reactor Time of Condition A coolant temperature not met. monitoring ; capability. !
. ')
l O l ABWR TS 3.3-74 8/23/93 _. . _ _ _ _ _ _ _ . _ _ _ _ _ . _ . _ _ __ . __ _ _ _ , - _ . _ , . . , , , ,_m., _.,,,__....__.,..i
l
- RPV Coolant Temperature Monitoring 3.3.8.2 j
SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY
&g
[7] days SR 3.3.8.2.1 Perform CHANNEL CHECK. e' c.R 3.3.8.2.2 Perform CHANNEL FUNCTIONAL TEST. [92] days SR 3.3.8.2.3 Perform CHANNEL CALIBRATION. [18] months O O l 3.3-75 P&R 08/30/93 ABWR TS
SSLC Sensor Instrumentation B 3.3.1.1 B 3.3 INSTRUMENTATION , B 3.3.1.1 Safety System Logic and Control (SSLC) Sensor Instrumentation l BASES BACKGROUND The SSLC initiates protective actions when one or more , monitored parameters exceed their specified limit to preserve the integrity of the fuel cladding and the Reactor Coolant System (RCS) and minimize the energy that must be removed from the RCS following accidents or transients. The protection and monitoring functions of the SSLC have been designed to ensure safe operation of the reactor. This is achieved by specifying Limiting Safety System Settings (LSSS) in terms of parameters monitored by the SSLC, as well , as Limiting Conditions of Operation (LCOs) on reactor system parameters and equipment performance. For the purpose of this specification the LSSS are defined as the Allowable Values, which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs), during Design Basis Accidents (DBAs). The SSLC is comprised of four independent logic divisions (Div. I, II, III, IV). Each logic division provides protective action initiation signals for safety system prime movers associated with their division. Each division is a collection of SENSOR CHANNELS which provide data to the ! LOGIC CHANNEL in the division. The LOGIC CHANNELS provide Miv f;M o initiation signals to theYOUTPUT CHANNELS" each divubn. The OUTPUT CHANNELS cause actuation of the equipment that ,
,____ y implements 7a p otective actions. The Functions listed in Table 3.3.1.1-1 have a SENSOR CHANNEL in one or more divisions. 3 Each SSLC division has five main components: io Wa ho n i t 8* - Digital Trip Module (DTM). The digital p module is a yleftogcM microprocessor based device that acqui es data for most ge n .g lg pff i 7 process parameters to be monitored in its division and p 9} generates a pMecWe acdon dW= signal wWn W pp peJ / gelVi#y , 4) division if the monitored parameter is outside of .
J specified limits.4Most of the parameters are transmitted j;#f (l0 f) kv3 f to the DTM via the Essential Multiplexer System (EMS) in its division while some are received from sub-systems or p MD g;ge6 devices associated with the same division as the DTM. y3# (continued) ABWR TS B 3.3-1 P&R 06/30/93
SSLC Sensor Instrumentation B 3.3.1.1 k BASES /p O BACKGROUND There are two DTMs in each division. One DTM serves the ( Continued ) Reactor Pr tion System and MSIV closure functions whiln th other servef the ESF and non-MSIV isolation functions. or the discussions in this LC0 the DTMs that implement the RPS and MSIV closure functions are referred to as the "RPS DTMs" and the ones that implement the ESF g }hed and non-MSIV closure functions are referred to as the "ESF DTMs".
- Trip Logic Unit (TLU). The TLU is a microprocessor based device that uses the parameter trip information from the RPS DTMs in all four divisions to determine if a protective action is required. There is a TLU in each division. The combinatorial logic used to create protective system actuation commands is performed in the TLU. Some data used for initiating protective actions are connected directly to the TLUs.
afety)LogicUnit(SLU).TheSLUisamicroprocessor h,4F based device that uses the parameter trip information from the_ESF DTMs_ in all four divisions to determine if a , [ protective action is required.*The potential for spurious l actuation due to failure of an SLU is greatly reduced by employing two SLUs in parallel with a two-out-of-two O l \ output confirmation reouired before component or system l uation is permitted.(The combinatorial logic used to l create protective systmh actuation commands _is performed in th_e SLU.) Some data used for initiating protective actions are connected directly to the SLUs. There are dual redundant SLUs in three divisions (DIV I, II, & III).
- Output Logic Unit (OLU). The OLUs receive protective action actuation commands from the TLUs in the same division. The OLU contains hardware logic to provide trip, seal-in, reset, and manual test functions for the RPS and MSIV closure functions.
- Bypass Unit (BPU). The BPU provides the bypass and bypass interlock functions.7tiereds kBPU in each division tirah provides bypass signals to the TLU, SLU and OLU in its division. The bypass unit contains logic to enforce i restrictions on bypassing multiple divisions of related l functions. l
[ l (continued) O ABWR TS B 3.3-2 P&R 08/30/93 i
SSLC Sensor Instrumentation B 3.3.1.1 1 BASES BACKGROUND Most of the parameters are analog signals that are digitized + ( Continued ) by the EMS. Each division has one EMS that transmits data to the DTMs in the same division. The DTM processing logic compares this data against numeric trip setpoints to determine if a protective action is required. , Typically, a process sensor in each of the four divisions provides a signal to the EMS and DTMs in its division. l Exceptions are
- Some parameters are received by the DTM as discrete (i.e.
2 state) actuation data signals directly from other ! systems or devices (e.g. MSIV closure signals, PRRM l system).
- Some parameters are received by the DTM as analog signals \
directly from process sensors (e.g. Turbine 1st stage pressure).
@Q pg D Some parameters are received'directly by the SLU or TLU as discrete (i.e. 2 state) actuation data signals l
t
% C-a m Q,, directly from other systems (e.g. NMS signals, ECCS anualinitiationsignals).g O 'by o-ety 4 W e<-@ % c- - Some parameters are received by the SLU as analog' signals directly from process sensors (e.g. RHR pump discharge i
FM. e.av m t APA*.W4
,- Q h,$ pressure). % % V+ca h % c5 A N eve-N.d k l
%q{$ w J O'%.w GCDs.
- Parameters that are used for control of equipment !
associated with a specific division may use one or two ' sensors (e.g. ECCS pump pressure interlocks, manual initiation of an ECCS pump).
- Some parameters may use multiple sensors wi} na division to provide additional redundancy %r where a distributed parameter is monitored (e.g. tevel 1, p p\ -3 Suppression pool temperature), i dd The SSLC hardware and logic is arranged so the system uses i
two-out-of four coincident initiation logic (i.e. 2 signals ; for the same parameter must exceed the setpoint before a protective action initiation command is issued). The interdivisional initiation data used in the SLU/TLU logic is ! l transmitted between divisions by isolated fiber optic links ; fr- +/sc 'D T M s of afSfr ly b '*5
;,, .t t,e ye olua, hd cNv n to M.
(continued) O .. ABWR TS B 3.3-3 P&R 08/30/93 1 l
1 ; a SSLC Sensor Instrumentation i B 3.3.1.1 4 l BASES BACKGROUND There are two basic segments.that are used to initiate , 2 ( Continued ) protective actions. The SENSOR CHANNEL segment consists of ; the instrumentation portion which encompasses the sensors, sensor data conversion, sensor data transmission path (i.e. , EMS), thejunctions responsible for acquiring data from the l EMS, and the setpoint comparison.functic A Capability is provided to manually trip individual SENSOR CHANNELS. l
~
l Interlocks are provided to prevent placing more than one SENSOR CHANNEL for a given Function in trip at the same r g,ds M time. The LOGIC CHANNEL segment consists of the functions l responsible for implementing the initiation logic, ! generating initiation signals when needed, and various ! support functions. The LOGIC CHANNELS in each division send j data to the OUTPUT CHANNELS. The SENSOR CHANNELS and LOGIC CHANNELS are replicated in four independent and separated divisions of equipment. The sensors and EMS are not considered to be part of the SSLC. , However, the sensors and the analog to digital conversion portion of the EMS.are addressed by this LCO since these i devices can effect the results of.surveillances required by l O this LCO. Various bypasses are provided to permit on-line maintenance and calibration. The " division of sensors bypass" disables the DTM inputs to the associated SLU and TLU in one , division. The direct trip inputs to the SLU and TLU are not bypassed. Interlocks are provided so only one division of ! sensors at a time can be placed in bypass. When a division
~
of sensors is bypassed the sensor trip.1ogic in all SLUs and , TLUs become 2 out of 3 and all of them are capable of l providing signals to equipment used to provide protective l action. Other bypasses are used to manually or automatically disable selected Functions when they are not required. The RPS/MSIV OUTPUT CHANNEL may be bypassed with the gg a 4 u., n. , + et _ . " - - bypass which disables the trip input I I to the OLU in one logic division. Interlocks are provided so log' Odf"t only one division at a time can be placed in divisier c&ef
- ::rtice bypass. When a logic division is bypassed the final 3 actuation logic becomes 2/3 for the scram and MSIV closure actions. The sensor trip logic within the unbypassed logic T L (
divisions remains as 2/4. [3 g e, o utput (continued) 8 3.3-4 P&R 08/30/93 ABWR TS i
l SSLC Sensor Instrumentation . B 3.3.1.1 BASES , BACKGROUND The Main Steamline Isolation special bypass is similar to - ( Continued ) the division of sensors bypass except it affects only the
-MSI" a ne" e scram. This bypass is provided to permit operation with one steam line isolated.
If one of th ' undant SLUs in a division is inoperab bp/ '/ can be bypas: d 3 'hich changes the actuation logic to 'onejof-one in the a g ated division. g, N #a The NMS contains a bypass which causes one of the NHS APR divisions to be bypassed in the NMS logic. The trip logic in I ( 90 all four NMS APRM divisions then becomas 2/3 and all divisions will send a trip signal to all four SSLC divisions when appropriate. This bypass is therefore transparent to the SSLC. Interlocks are provided so only one NMS division can be placed in bypass. , ggggy f Since the logic is 2/3 even with any one division of sensors in bypass and any one _i"isier cut of r evice bypass, the SSLC still meets the single failure criteria for failure to trip and spurious trip prevention under this condition.
' PSimilarly, the HMS contains a bypass for SRNM channels. t Refer to the bases of LC0 3.3.2.1 for details of the bypass .
(implementation. l l Each processing division has test and trip switches located , in the divisional control room panels. These test switches ' are used for testing the SSLC and can also provide manual I protective action initiation. The SSLC includes a variety of elf-test and monitoring features. The self test in each microprocessor based device checks the health of the micr rocessor, RAM, ROM, communications, and software. Any detected failure that could degrade protective action initiation activates an annunciator and provides fault indication to the board level. Transient failures (e.g data transmission bit error) are logged to provide maintenance information. Monitoring of the power supplies, card out of file interlocks, and memory batteries (if used) causes an INOP/ TRIP in addition to activating an annunciator. If the self test detects a failure in one of the redundant SLUs within a division, the failed SLU is automatically bypassed (initiation logic j i becomes one of-one) and an alarm is generated. ob (continued) ABWR TS B 3.3-5 P&R 08/30/93 i _ - _ _ _ - _ _ , _.._._-,.4
SSLC Sensor Instrumentation B 3.3.1.1 BASES BACKGROUND Signal validity tests are performed on the data received ( Continued ) from the EMS. If a permanent error is detected on a particular parameter the logic state for that parameter will default to a tripped state for the signal and an annunciator or alarm will be activated. Soft (i.e., transient) errors will be logged to provide maintenance information. Once a protective action is initiated, it seals in and must be manually reset. The manual resets are inoperative if the SSLC initiation signals are still present. Reactor Protection System (RPS) The RPS portion of the SSLC initiates a reactor scram when one or more monitored parameters exceed their specified limit to preserve the integrity of the fuel cladding and the Reactor Coolant System (RCS) and minimize the energy that , must be absorbed following a loss of coolant accident ' (LOCA). This can be accomplished either automatically or manually. The RPS, as shown in reference 10, uses four independent O divisions each containing sensors, the EMS, the SSLC, load drivers, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters. The input parameters to the SSLC scram logic are it from devices that vcssmon
- e. \ or:
- reactor vessel water level
- reactor steam dome pressure g SRNM Neutron Flux & neutron flux period APRM simulated thermal power
- oscillation power range monitor
- rapid core flow decrease
- main steam line isolation valve-closure
- turbine control valve fast closure (trip oil pressure l low)
- turbine stop valve-closure
- suppression pool temperature
- main steam tunnel radiation
- drywell pressure
- CRD water header charging pressure L -At kA V LWo w 9 \ A tf-Q (continued)
LJ ABWR TS B 3.3-6 P&R 08/30/93
SSLC Sensor Instrumentation B 3.3.1.1 BASES (
/ N BACKGROUND Reactor Protection' System (RPS) )(continued)
( Continued ) Twonormallyener[gize cn} solenoid; operated, scram pilot valves are located heHydrauJicControlUnit(HCU)for each Control Rod Dr ve s (CRD) pai,r. The scram pilot valves control the air supplP to thej tram inlet valve for the associated CRD pair. Whehther scram pilot valve solenoid is energized, air pressure holds the scram valves closed. Therefore, both scram pilot valve solenoids must be de-energized to cause a control rod pair to scram. The scram valve controls the supply path for the CRD water during a scram. Each of the pilot valve solenoids is controlled by a series / parallel arrangement of four load drivers (one set of load drivers is in division II, a second set is in division III) with the outputs of the four logic divisions connected to the load drivers such that a trip signal from any two of the logic divisions results in de-energizing both solenoids, air bleeding off, scram valves opening, and control rod g scram. Two hardwired manual scram switches which completely bypass O the EMS, SSLC, and load driversi gte nputs are provided. i O The switches on the main control console remove power from the scram pilot valve solenoids and also energize the air header dump valve solenoids (backup scram). When the reactor mode switch is in the SHUTDOWN position, manual scram is also initiated. The manual scram functions are covered in LC0 3.3.1.2. g The backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by he RPS portion of the SSLC. Emeroency Core Coolina Systems (ECCS) The Emergency Core Cooling Systems (ECCS) encompass the High Pressure Core Flooder (HPCF) system, Automatic Depressurization System (ADS), Reactor Core Isolation Cooling (RCIC) system, and the Low Pressure Flooder (LPFL) mode of the Residual Heat Removal (RHR) system. The purpose of the ECCS portion of the SSLC instrumentation is to initiate appropriate responses from the systems and the standby Diesel Generators (DGs) to ensure that fuel is l (continued) ABWR TS B 3.3-7 P&R 08/30/93 i
i SSLC Sensor Instrumentation l B 3.3.1.1 BASES BACKGROUND Emeraency Core Coolina Systems (ECCS) (continued) ! ( Continued ) adequately cooled in the event of a design basis accident or transient. The equipment involved with each of these systems ! is described in the Bases for LC0 3.5.1, "ECCS-Operating." ' To provide redundant and diverse protection ainst anticipated operational occurrences (A00s)farid sign Basis ; Accidents (DBAs), a wide range of dependatit and i ependent ' parameters are monitored. In addition, hird' wired anual start of HPCF C is provided from the matn / clintrol room. l Motive power for the motor driven ECCS pumps is supplied from AC buses that can receive normal AC power or standby AC power from the DGs. Instrumentation power for all of the ECCS system originates in the 125 VDC essential busses. The l three LPFL systems, except valves with isolation functions, are supplied.by the division I, II, and III AC and DC busses while the two HPCF system are supplied by the division II and III AC and DC busses. Control power for RCIC instruments I and controls, except for valves with isolation functions, , originates in the division I DC bus. ADS i is powered by the division I DC bus and ADS 2 by the division II DC bus. The , l O LPFL and RCIC valves that provide isolation functions receive power from busses suitable for providing the redundant isolation functions. t Low Pressure Flooder (LPFL) System (Mode of the Residual Heat Removal System) The LPFL consists of three independent subsystems. Each subsystem has separate and independent pumps, valves, and ! vessel injection paths. ] The LPFL pumps and the associated DGs are initiated automatically when high drywell pressure or low reactor water level (Level 1) is detected. Automatic and manual opening of the injection valve to the vessel is prohibited until reactor pres e dr ps below the injection permissive setpoint. The LPF pumps' otor starters are interlocked with bus undervoltage mon rs to prevent starting the motors unless the bus voltage is adequate. The LPFL controls to pump permitmotor operator
#and valves areofprovided control with manual the systems.
(continued)- ABWR TS B 3.3-8 P&R 08/30/93 l
i ~ SSLC Sensor Instrumentation i B 3.3.1.1 I 1 BASES 3 BACKGROUND Emeraency Core Coolina Systems (ECCS) ( LPFL continued) ( Continued ) i The LPFL pumas start immediately if normal power is availableJTie delay times for the pumps to start when ] 3 F normal AC power is not available include approximately 3 t I seconds for the start signal to develop after the actual
- 0 gs
- reactor vessel low water level or drywell high pressure occurs, 10 seconds for the standby power to become I b '
available, and a sequencing delay to reduce peak demand on 98y standby power. The LPFL is designed to provide flow into 4M the reactor vessel within 36 seconds of the receipt of an P initiation signal and the low reactor pressure permissive. A pump discharge pressure and pump flow transmitter monitor the discharge of each pump to control the minimum flow bypass 4t- <.4L;yalve. Se % bl J.Dr " E5 Pr 6 < h -a J t m M h w $ $_ C.na. m%cJt es , The LPFL suction valves from the suppression pool are normally open. On receipt of an LPFL initiation signal, the reactor shutdown cooling system valves and the RHR test line valves are signaled to close to ensure that the LPFL pump discharge is aligned for injection to the reactor. O Reactor Core Isolation Coolina System (RCIC) The instrumentation and controls for the RCIC system provides control of the RCIC pump, turbine and associated valves and other equipment during a loss-of-coolant accident, when the reactor vessel isolated while in hot . standby, when normal coolant flow is unavailable with the ' reactor vessel isolated, during a plant shutdown with loss of feedwater, and for a complete loss of AC power. When actuated, the RCIC system pumps demineralizer water j from the Condensate Storage Tank (CST) to the reactor vessel i but may use the suppression pool as an alternate source of ) water. Suction flow will transfer automatically to the suppression pool on low CST level or high suppression pool level . 1 l The RCIC system is initiated automatically when either high i drywell pressure or low reactor vessel water level 2 is (continued) ABWR TS B 3.3-9 P&R 08/30/93
l 4 SSLC Sensor Instrumentation B 3.3.1.1 i BASES g T b~ G M M L 't e . i BACKGROUND Emeraency Core Coolina Systems (ECCS) ( RCIC continued) l ( Continued ) . l jS-detected and produces the design flow rate withirrW seeends. The system then functions to provide makeup water j to the reactor vessel until the reactor vessel water level i estored. RCIC flow will shut down automatically when l ighgeactor pater jevel q Level 8 is detected. In addition, line overspeed and high exhaust pressure equipment i protection signals will trip the turbine. The RCIC system is ! also shut down by the isolation feature described in the isolation section of this LCO. A pump discharge pressure and pump flow transmitter monitor the discharge of each pump to control the minimum flow bypass valve. 5 e - W.-o E L.A 4 E.s F k t % Tt. m 4 wswW -O &h ~ " c.r J &g L,%g i w <*t-w., g M, The RCIC turbine and valves are provided with manual controls which permit the operator control of the systems. Hiah Pressure Core Flooder System (HPCF) N x The HPCF consists of two independent subsystem Each l s subsystem has separate and independent pumps, valves, and vessel injection paths. The HPCgF s stem is initiated when reactor vessel low water leve U evel 1.5) or high drywell pressure is detected. The HPCF umps' notor starters are interlocked with bus undervo age monitors to prevent starting the motors unless the bus voltage is adequate. The HPCF will continue discharging to the reactor vessel until reactor high water level (Level 8) is detected. The HPCF then automatically stops flow by closing the injection valve but the motor will continue to run. The injection valve will recpen if reactor water level subsequently decreases to the low level initiation point. The HPCF is provided with manual controls which permit operator control of the systems. When actuated, the HPCF system pumps demineralizer water from the Condensate Storage Tank (CST) to the reactor vessel but may use the suppression pool as an alternate source of , water. Suction flow will transfer automaticaMy-tmh I
% [ w.% JL c.em.%vsL$ 4e t- H S M C. <-- tw keh.M i wi f M %- W94.5 -%,e. G. M a. 5 5 l=C ntinued) %)
ABWR TS B 3.3-10 P&R 08/30/93
SSLC Sensor Instrumentation B 3.3.1.1 BASES BACKGROUND Emeroency Core Coolina Systems (ECCS) ( HPCF continued) l j ( Continued ) suppression pool on low CST level or high suppression pool level. i
.-- l
%3JC ,y @The HP(F vqve must be opened suff4cientiy to* provide designi s
flow rat wit on sight l. T se n nce 36Monds o from relajpt ofsthe htitilt(y tor st twhennormalAC)ower not av,aila is s desc ed fo he LPFL sysiem. A pump discharge pressure and pump flow transmitter monitor the discharge of each pump to control the minimum flow ! bypass valve. C 4. % Q lt-Automatic Depressurization System (ADS) Reactor depressurization by the ADS is provided to reduce the pressure during a loss-of-coolant accident where the . HPCF and/or RCIC are unable to maintain vessel water level above the LPFL initiation point and reactor pressure remains above the low pressure injection permissive setpoint. Opening the ADS valves reduces pressure sufficiently to - O, allow the LPFL systems to inject water at the design flow rate. , The motive power for the opening the ADS valves is from , local accumulators supplied by the high pressure nitrogen , supply systems (Division I and II). The ADS accumulators have sufficient capacity to operate the safety relief valve twice with the drywell- at 70% of design pressure with no external source of nitrogen. Two ADS subsystems, ADS 1 and_ ADS 2 are provided. ADS 1 is - controlled by thel division I Slutand ADS 2 is controlled by the division 11 SLUV Each ADS division controls one of the two separate solenoid-operated pilot scitacidrtin each% %3Vq Safety / Relief Valve (SRV) assigned to the ADS. Energizing either pilot valve causes the SRV to open. l ADS initiation is armed when low reactor water level (level
- 1) persists for more then a specified amount of time (outside containment LOCA) or when low reactor water level occurs concurrently with high drywell pressure (inside containment LOCA). When ADS is armed, the ADS' initiation timer will start if any one of the 5 LPFL or HPCF pumps are (continued)
ABWR TS B 3.3-11 P&R 08/30/93 l - - -_
SSLC Sensor Instrumentation - B 3.3.1.1 BASES BACKGROUND Emeroency Core Coolina Systems (ECCSI (' ADS continued) i ( Continued ) operating. While the ADS timer is running, ADS initiation , may be interrupted by operator action or by loss of the arming signal. If the timer is not interrupted, ADS will initiate when the timer times out. ! The reactor low water level initiation setting for the ADS is selected to_ depressurize the reactor vessel in time to allow adequate cooiing by the LPFL systentOfollowing a loss-of-coolant accident with an assumed failure of the HPCF and/or RCIC. l t Positive indication of operation of an HPCF or LPFL pump is l l detected by two pump discharge pressure transmitters , connected to each pump. One transmitter serves _the ADS 1 l l logic and the second serves the ADS 2 logic. These - transmitters are different from the transmitter used for contmlling the minimum flow valve (i.e. there are three pressere transmitters on each pump). l The reactor vessel low water level for ADS is sourced from 8 level transmitters. One set of four is used by the ADS 1 logic and the other set is used by the ADS 2 logic. The ADS initiation timer setting is long enough to permit HPCF and/or RCIC to restore water level but short enough to ! provide adequate time for LPFL to adequately cool the fuel if the HPCF is assumed to be inoperable. , Manual actuation pushbuttons are provided to allow the operator to initiate ADS. Manual actuation requires a sequence of actions combined with annunciators to assure manual initiation of ADS is a deliberate act. Manual actuation is prohibited unless a pump discharge pressure - permissive is active. solat O The isolation portion of the SSLC automatically initiates- I closure of appropriate isolation valves. The function of i' the isolation valves, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs). Valve closure within the time limits specified for-i (continued) ABWR TS B 3.3-12 P&R 08/30/93 1 l
. - - - . ~ - - - . -.
i SSLC Sensor Instrumentation B 3.3.1.1 CMS : O BASES r i BACKGROUND Isolation (continued) ( Continued ) ; those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in O the' analyses for a DBA. Reference 18 maps the isolation i 55 0 functions to the equipment that is isolated. The isolation instrumentation includes the sensors, the EMS, i the SSLC, load drivers, and switches that are necessary to cause closure of the valves provided to close off flow paths , that could result in unacceptable fission product release. Functional diversity is provided by monitoring a wide range of independent parameters. The input data to the isolation logic originates in devices that monitor local parameters (e.g. high temperatures, high radiation, high flows) as well as primary system and containment system parameters that are indicative of a leak. t Manual isolation capability is provided by operator switches that initiate a division trip or individual valve closures. p S S L4. The isolation functions are provided in the same 49aat O - pr;ct;;ini; devices as the ECCS, exctpt for the MSIV closure, which is provided in the same devices as the RPS. l L ss tc_ ; ! 1. Main Steam Line Isolation Two normally energized, solenoid operated, pilot valves are located on each MSIV. Both solenoids must be de-energized,to u4 cause tne valve to close. ine pilot valve solenoids-.aee e5
' f controlled byT series / parallel arrangementsof four load gtt4g driversovith the outputs of the four logic divisions connected to the load drivers such that a trip signal from (g g any two of the logic divisions results in de-energizing both 4g solenoids. The Load drivers for the outboard MSIVs are in ,
division I and the load drivers for the inboard MSIVs are in division II.
]
The Functions used to initiate MSIV closure are: ! eactor essel yater jevel-jow, team g ne twgressuregg Jevel 1.5 , Ns , , (continued) ABWR TS B 3.3-13 P&R 08/30/93 i
- - . , - - - - . .- e m
6 SSLC Sensor Instrumentation B 3.3.1.1 - BASES BACKGROUND 1. Main Steam line Isolation (continued) ( Continued ) - [_-- main l main steam line flow-high (in any one of the steamlines) ( steam tunnel radiation-high , bit- 09 6 - main steam tunnel temperature-high :
%, q,r - main turbine area temperature-high
- condenser vacuum-low. ;
- 2. Containment Isolation 1 -
- Containment isolation closes valves (except MSIVs) and dampers in effluent pipes and ducts that penetrate the primary and/or secondary containment to prevent fission product release and initiates the standby gas treatment ;
I system (SGTS) to remove fission products from the secondary containment atmosphere. Isolation initiation is performed in containment the divisionis#olation I d II(ESF initiation SLUs.are:The f*
- c/gFunctions used Me Ng - geactor vessel water level-low, level 1
- reactor vessel water level-low, -level 2 cAS - reactor vessel water level-low, level 3 i O. - drywell pressure-High t N
q*, y95
- drywell sump drain Low Conductivity Water (LCW)
Radiation-High (Note: Single signal from PRRM system to M*N division I SLU oni f W J - drywell sump drain High Conductivity water (HCW) ; p gv Radiation-High (Note: Single signal from PRRM system to ' Vg ( n division I SLU onl V
- Reactor building area / fuel handling area exhaust air i
l d' Radiation-High. (Note: Signal received directly from PRRM discrete outputs to the DTMs). l l Each of these parameters is used'to isolat~e one or more
-- Unx' s th.at penetrate
\5 c.ov e.the containmente n g. L g t./ o U ,,\.%" G 5P M- h s%..
4s e>5 :CA-w h% w& % %t,a.;.w".
, 3. Reactor Core Isolation Coolina (RCIC) System Isolation g 6 ewe The RCIC isolation protects against bheaks in the steam ;
supply line to the RCIC turbine. RCICvtrip calculations are performed in the DTMs in all four ESF divisions. Isolation initiation for the inboard isolation valve is performed in ! the division I ESF SLU and for the outboard isolation valves l W% l I (continued) ABWR TS B 3.3-14 P&R 08/30/93 I
, SSLC S::nsor Instrumentation B 3*3*I*
b% TW.hc.L' on '.5 c M re_.4c=.{ i N BASES D S 1N E5P AG tich h it.rt N A T.'se M BACKGROUND 3. Reactor Core Isolation Coolino (RCIC) System Isolation ( Continued ) (continued) - in the division II ESF SLU. The Functions used for RCIC f g u *t, KP .isol ation_initi atimure: p E.W. p w. co d <_ 6 - RCIC area temperature W'th p 7 6 c M ]t l - RCIC steam supply line pressure-low 04 ek. #
- RCIC steam supply line flow-high RCIC turbine exhaust diaphragm pressure h
4 Reactor Water Cleanuo System Isolation / ! This isolation protects against breaks in lines carrying Cleanup Water (CUW) and also serves to align CUW valves so m they do not interfere with ECCS injection. Isolation L initiation _ for the inboard isolation valve is performed in pg [c the division II ESF SLUAand for the outboard isolation valves in the division I L5t SLUPThe Functions used for CUW line isolation /ECCS lineup initiation are: c - CUW area temperatures-high ! W- 4o r - CUW differential flow-high 4; ',nT, - main steam tunnel temperature-high 4,Jev - reactor vessel water level-low, level 2 g %% - CUW isolation on Standby Liquid Control initia ho p gg - Reactor vessel steam dome pressure-Hig7 (This function is used only in division I to close tne nead spray valve) L s w t~e-^e:miv% w t %4
- 5. Shutdown Coolina System Isolation This isolation protects against breaks in lines used in the shutdown cooling mode of the RHR and also serves to align RHR valves so they do not interfere with ECCS injection.
f g F" g'N solation I9 initiation for the RHR loops are performed in the ESF SLUs as follows: RHR LOOP A B C Inboard Div. I Div. II Div. III Outboard Div. II Div. III Div. I q (continued) J ABWR TS B 3.3-15 P&R 08/30/93
i SSLC Sensor Instrumentation B 3.3.1.1 BASES BACKGROUND 5. Shutdown Coolina System Isolation (continued) , ( Continued ) The Functions used for RHR isolation /ECCS lineup initiation ' are: 1
~ .s --
D ie- utt e - RHR area temperatures-high reactor vessel water level -low, level 3
%w
- reactor vessel steam dome pressure-High o4ea.L wod, !
OTHER ESF FUNCTIONS {\Q ( l The SSLC provides actuation Functions for various other ESF l Functions: ,
- 1. Diesel Generator (DG) Initiation. The DG are initiated ,
on high drywell pressure, low reactor water level, or Essential 6.9KV bus undervoltage (covered in LCO l 3.3.1.3). yer qg (
- 2. Standby Gas Treatme c uation. The Standby Gas l
'N Treatment (SGTS) high drywell-pressure, lo .
system (i\w level 3, Reac automatically initiated on e-xbit. LWp area %igh radiation, or fuel handling are high radiatio u
- 3. Reactor Building Cooling Water / Service Water Actuation. This Feature is actuated on high drywell :
pressure, low level 1, or 6.9 KV emergency bus i undervoltage signals (covered in LC0 3.3.1.3). -
- 4. Containment Atmospheric Monitoring System Start. The :
Containment Atmospheric Monitoring (CAM) system is l automatically started on a high drywell pressure or : low level 1 signal. .l
- 5. Suppression Pool Cooling Actuation. Suppression pool ',
cooling is-automatically initiated on high suppression pool temperature. C.K@ l ATWSCMitiaatip {\ M B] ] The ABWR provides various features to mitigate a postulated Anticipated Transient Without Scram (ATWS) event. The Standby Liquid Control System (SLCS) and Feedwater Runback (continued) ABWR TS B 3.3-16 P&R 08/30/93 1
SSLC Sensor Instrumentation B 3.3.1.1 b) U BASES NMS M A; % BACKGROUND 5. %44cwn enn10p Syste" !!chtion - (continued) ( Contin [ FWRB) are initiated by Reactor Vessel Steam Dome Pressure - b<g M, . ,b8"y[# High or Reactor Water Level - Low, level 2 Functions. The initiation signals are provided by Analog Trip Modules ATM) [6 et A[& y I that are located in the SSLC cabinets. p6A tf ctv6 i 4 d' There is an ATM in each division for each of the functions. 49 r# # 5t The ATMs are connected directly to the sensors in the b y)4 division associated with the ATM. The outputs of all four J.Wp +f- d ATMs are connected to four logic units (one in each g ve division) using suitable isolation. Each logic unit uses 2 i ypf 'e X {L6k'}i - out of 4 logic to create initiation signals. The SRNM ATWS # M,8 0 lg .f( ah5
\ i permissive function will permit initiation only when power O O ' ir - level is above a specified value. The initiation signals Y from the four logic units are connected to a series / parallel f('df g
f rrangement of load drivers /such that an initiation signal n y two of the logic units will cause actuation of e' b*pe^ ATWS m igation features. C R cr rT m - ' l gHa .f e4+-3 9 w p :ucJ % %c. k au M = i'\J f A f yWx A& W ?M M E + Fi = * ' M '* ' " ~ " "'
%[k
SSLC Sensor Instrumentation ; B 3.3.1.1 l l BASES APPLICABLE Table 3.3.1.1-1 may be needed to mitigate the consequences SAFETY ANALYSIS, of a design basis accident or transien . o sure reliable LCO, and initiation of protective actions seve 1 functi ns are APPLICABILITY required for each safety system actuat'on*to pr vide' primary ( Continued ) and diverse initiation signals. Twd k Y , Reactor Protection System { RPS is required to be OPERABLE in MODE 1, MODE 2, and MODE S with any control rod withdrawn from a core cell containing l one or more fuel assemblies. Control. rods withdrawn from a core cell containing na fuel assemblies do not affect the react f-th cure and4 efore do not nged scram pability. The required" Shut Dow argin SDIO;LC0 3.1.1) and"{efuel osition'gne- od-out inte lock {'(LCO 3.9.2) ensu at no eve t requiring PS iirill o- r when the reactor mode sw is ir, the refnelt g p- on. During normal operation in MODES 3 and 4, all control rods are fully inserted and : the Reactor Mode Switch Shutdown Position control rod withdrawal blockWLCC 2.3.2.1) does not allow any control I rod to be withdrawn. Under these conditions, the RPS , y f g is not required to be OPERABLE. The OPERABILITY of scram pilot valves and associated solenoids and backup scram valves, described in the , Background section, are not addressed by this LCO. Emeroency Core Coolina System (ECCS) h(4 t.M , The ECCS is initiated to preserve the integrity of the fuel cladding by limiting the post LOCA peak cladding temperature to less than the 10CFR50.46 limits. In general, the ECCS initiation Functions are required to be OPERABLE in the MODES or other specified conditions that may require ECCS l (or DG) initiation to mitigate the consequences of a design basis accident or transient. The applicabil_ity basis fo the ECCS systems are given.in LC0 3.5.1%nd 3.5.2&To ensure reliable ECCS and DG function, a combination of Functions is required to provide primary and secondary initiation SWbb
; l F %Q ow @e tc.o Q sg
- c44,.o j gg
<%" %-sumna.Q (continued) ;
ABWR TS B 3.3-19 P&R 08/30/93. i
SSLC Sensor Instrumentation l B 3.3.1.1 m .. a
^y' q s
- WW t
l BASES y
,' h
\
l APPLICABLE Isolation l SAFETY ANALYSIS, l LCO, and Isolation valve closures a used to limit the offsite dose APPLICABILITY as described in LCO 3.6.1.3. In general, the individual i ( Continued ) Functions that initiate isolation valve closure are required ; to be OPERABLE in MODES 1, 2, and 3 consistent with the l Applicability for LC0 3.6.1.1, " Primary Containment." Functions that have different Applicabilities are discussed below in the individual Functions discussion. l I Functions The specific Applicable Safety Analyses, LCO, and ; Applicability discussions are listed below on a Function by l Function basis, 1.a & b. Startuo Ranae Neutron Monitor (SRNM) Neutron 1 Flux - Hioh/Short Period , The SRNMs monitor rieutron flux levels from very low power l levels to a power level where the Average Power Range l Monitors (APRMs) are on scale. There is a specified minimum overlap between the SRNMs and APRMs to assure continuous I monitoring of neutron flux levels. The SRNMs generate trip signals to prevent fuel damage resulting from abnormal positive reactivity insertions under conditions that are not , covered by the APRMs. The SRNMs generate both high neutron 1 flux and high rate of change of neutron flux (i.e. short period) trips. In this power range, the most significant i source of reactivity change is due to control rod withdrawal. The SRNM provides diverse protection for the Rod Worth j Minimizer (RWM) in the Rod Control & Information System (RCIS) which monitors and controls the movement of control rods at low power. The RWM prevents the withdrawal of an out of sequence control rod during startup that could result in an unacceptable neutron flux excursion (Ref.13). The SRNM provides mitigation of any ner.ron flux excursion. ' Generic analyses have been perforud (Ref.14) to evaluate the consequences of control rod withdrawal events during startup that are mitigated only by the SRNM. This analysis, which assumes the most limiting SRNM bypass or out of service condition, demonstrates that the SRNMs provide (continued) ) ABWR TS B 3.3-20 P&R 08/30/93
[ SIC Sensor Instrumentation L W1 G- % Qghe .3.1.I km 61 a%g5B u .a_a, % p g w w 3 A e ; BASES
\
f APPLICABLE 1.a & b. Startuo Ranae Neutron Monitor (SRNM) Neutron SAFETY ANALY!ilS, Flux-Hiah/Short Period (continued) ; LCO, and APPLICABILITY protection against control rod withdrawal errors and results ( Continued ) in peak fuel energy depositions below the fuel failure t threshold criterion. (_ N q *s Q%sa y s..A kw g_ ggg The SRNMs are also capable of limiting other reactivity I ; excursions during startup, such as cold water injection events, although no credit is specifically assumedF - J The ten SRNM fixed in-core regenerative fission chambers are ; each connected to electronics suitable for monitoring , neutron flux for power levels up to 15% RTP. The SRNM , detectors are evenly distributed throughout the core and are : located slightly above the fuel mid-plane.' The SRNM's are i assigned to the four Neutron Monitoring System (NMS) >
#a " -""
' divisions $
Di sion : SR Dete orsAhI&J : ! ivis' II. MD ecto B& ! Div' ion ] S tect s ,G&L i ! Division V: SRNM Detectors H i For each division, a high flux, short period, or IN0P trip l from any one SRNM channel will result in a trip signal from that division. The SRNM trip data is transmitted to the TLUs in the SSLC. I
\
SRNM thannels a divided to b T
- s. One I
cha el fr'bm each may h pa hreqbypasGrou(bypass ged b ing hree l
- switc s on the oper o consb i . A by ss .f up to ;
! three ch nelsh The are r ed o er is at , l least one bypaised c nx 1inekh 'vi 'n d oqe {
- nbypassed hgnnel 'igeac o quad (an T SRNMS hre' l
a signed to thD bypassNGrou as ollbws: ! Gro\upxJ : SRNM A, B, F, G 1 Group 2: S M C, E, H ; P Group 3: SRNM J ,
\,L l
i l (continued) l l ABWR TS B 3.3-21 P&R 08/30/93 1
I N Sensor Instrumentation f T h S b b Ya d d d t~- w f,y, * ! h 9IM'A%'LE odied Q*I$ iVb:st Y tQ pp e,p'P#Wer b Q[j *'V di-g D4 BASES "'% h* I APPLICABLE 1.a & b. Startup Ranae Neutron Monitor (SRNM) Neutron l SAFETY ANALYSIS, Flux-Hiah/Short Period (continued) ! LCO, and ft three N ultipb io N erator switqhes APPLICABILITY ( Continued ) c res nds one the oups. l An SRNM division is OPERABLE if one or more channels in the f division is OPERABLE. The division of sensor bypass in the i RPS portion of the SSLC does not bypass the SRNM trip signal ! input.g j C norability O of the SRN fun ion of the SSLC also requires f ai ieasT. ohe OPERABLE hannel in each core quadrant.
- The arrangement of SRNM channels into bypass Groups and the i l
%\.' M -6 actionst of LC0 3. b.2.1i% %ensure din hsv thisW reauirement G4T.J.W is9 satisfied. '!
p e, ped __ The Startup Rangedtonitor Neutron Flux-High/Short Period ; m Functio %must be OPERABLE during MODE 2 when control rods j W may be withdrawn and the potential for criticality exists. ! In MODE 5, when a cell with fuel has its control rod : withdrawn, the SRNMs provide monitoring for and protection l g,%\} 1 against unexnected reactivity excursions. In MODE 1, the APRM System, the* thermal power monitor (T""),' .nd the O Automatic Thermal Limit Monitor (ATLM) functiongf the RC IS provide protection against control' rod yithdra events and the SRNMs are not required. D
,1 error j
w _- ~ l 1.c. SRNM ATWS Permissive j l During some low power plant conditions the ATWS trips could i interfere with normal plant maneuvering and cause l unnecessary stress on plant equipment. In order to prevent l the risks associated with the stresses, and to confirm that : I a ATWS may have occurred, the_ATWS Functions are disabled at ; low neutron flux-levels. ,g; gtm p. g u g . The SRNM ATWS Permissive Function is sed in-sempof the
- ns hu -m..m snac ...vi;...;d ATWS W 4a - to permit initiation when the power level as detected by the ,
SRNM is greater that the Allowable Value. When all of thed. SRNM channels indicate that power _ level is less than the Allowable Value then the permissive is removed and 4Hpe are automatically bypassed. L 5 bC Q FbQ v -.) Av aA b b ci -Et o g; w ; t % C.a. g e.+ x - A s (continued) ABWR TS B 3.3-22 P&R 08/30/93 _ _ -. . . _ _ _ . _ - ~ . _
i l SSLC Sensor Instrumentation B 3.3.1.1 h M,b i
- 51.c k F M E AL h l'D !
3 BASES ___ _( I APPLICABLE 1.c SRNM ATWS Permissive (continued) ' SAFETY ANALYSIS, LCO, and This Function is required t be OPERABLE in Mode I since APPLICABILITY this is the MODE where the A dS functions must be OPERABLE. ( Continued ) See the-RPT trn (irn 1 1 A !T #or the operability basis. The Allowable Value is selected be high enough to permit the necessary plant maneuvers, and low enough to assure that ATWS is available when the plant power level will not permit long term cooling by the ECCS and their support systems. ; i 1.d. SRNM - Inop chGd % This trip signal provides asmaase that a minimum number of SRNMs are OPERABLE. Whenever the SRNM self test and monitoring *6t"m detect a condition that could prevent it from generating a trip when needed an -INOP/ TRIP signal will be sent to all four RPS TLUs/ This Function was not specifically credited in any ABWR SSAR analysis, but it is ; retained for the overall redundancy and diversity of the RPS l [ as required by the NRC approved licensing basis. This Function is provided by self test and other monitoring j f 4 @ t/'#;h , features and is a discrete signal so there is no Allowable Value for this Function. l This Function is required to be OPERABLE when the Startup l Range Monitor Neutron Flux-High/Short Period Functions are I required. 2.a. Averaae Power Ranae Monitor Neutron Flux-Hich. Setdown ;yk.pg g%g l The APRM divisions receive input s)gnals from the Local L u)ower gange
,4 , .monitors an m u .(LPRM) w4WGthe;;g reactor
;gtjg corU g ga-44 l ;;,3
) yum der.;;c s. The APRM divisions average these LPRM signals to provide a continuous indication of average reactor power from a few percent to greater than Rated Thermal Power (RTP). For operation at low power (i.e.,
MODE 2), the Average Power Range Monitor Neutron Flux-High/Setdown Function is capable of generating a. trip signal that prevents fuel damage resulting from abnormal operating transients in this power range. For most l (continued) O ABWR TS B 3.3-23 P&R 08/30/93
s SSLC Sensor Instrumentation ; B 3.3.1.1 ; BASES l APPLICABLE 2.a. Averaae Power Ranae Monitor Neutron Flux-Hiah. SAFETY ANALYSIS, Setdown (continued) LCO, and Ned*h l APPLICABILITY operations at low power levels, the(Average Power Range i ( Continued ) nction will provide a Monitor secondaryNeutron Flux-High/Setdown-kMonitor scram to the Startup Range Neutron l Flux-High/Short Period Functionsbecause of the relative j setpoints. With the SRNMs near the high end of their range, { it is possible that the Average Power Range Monitor Neutron i Flux-High/Setdown Function will provide the primary trip ; signal for a corewide increage in power. ! MWS LS% k, ! Nospecific{safetyanalysestakedirectcreditforthe : Average Power Range Monitor Neutron Flux-High/Setdown : Function. However, this Function indirectly ensures that, ' before the reactor mode switch is placed in the run position, reactor power does not exceed 25% RTP (SL 2.1.1.1) i when operating at low reactor pressure and low core flow. i Therefore, it indirectly prevents fuel damage during i significant reactivity increases with THERMAL POWER ;
< 25% RTP. t The APRM System is made up of four independent divisions.
O Each APRM division transmits a trip signal to all four RPS TLUs using suitable isolators. The system is designed to ! allow one division to be bypassed. Three divisions of APRM ! Neutron Flux-High/Setdown are required to be OPERABLE to l ensure that no single failure will preclude a scram from ! this Function on a valid signal. In addition, to provide ! i adequate coverage of the entire core, at least [20] LPRM i inputs are required for each APRM division, with at least i two LPRM inputs from each of the four axial levels at which ! the LPRMs are located. ' The Allowable Value is based on preventing significant i increases in power when THERMAL POWER is < 25% RTP. ; The Average Power Range Monitor Neutron Flux-High/Setdown Function must be OPERABLE during MODE 2 when control rods ! may be withdrawn, and in MODE 5 with any control rod i l withdrawn from a core cell containing one or more fuel l assemblies, since the potential for criticality exits. In ; r Neutron Flux-High MODE 1, the Average Power h Function provides protect o against re tivity transients and the ATLM function of tt RCRIS protec against control rod withdrawal error events. l (continued) ABWR TS B 3.3-24 P&R 08/30/93 i
SSLC Sensor Instrumentation-B 3.3.1.1 BASES APPLICABLE 2.b. Averace Power Ranoe Monitor Simulated Thermal Power-l SAFETY ANALYSIS, Hich Flow Biased LCO, and APPLICABILITY The Average Power Range Monitor Simulated Thermal ( Continued ) Power-High/ flow biased Function monitors a calculated value for the THERMAL POWER being transferred to the reactor i coolant. The neutron flux to thermal power relationship is l modeled using a single time constant to represent the fuel ! heat transfer dynamics and calculate a parameter that is l proportional to the THERMAL POWER in the reactor. The trip 5.L?cO CC . Icv:1 is varied as a function of recirculation flow. The : setpoint is proportional to the reactor power that corresponds to the recirculation flow for a rod pattern that l provides 100% power at 100% recirculation flow. There is an upper limit on the setpoint that is lower than the APRM Fixed Neutron Flux-High Allowable Value. The Average P er Ran Monitor Simulated Thermal Power-High/F1 w jiase Function provides protection against transients whe THE L POWER increases slowly (such as the loss of feedwater eating event) and protects the fuel cladding integrity by ensuring that the MCPR SL is not i exceeded. During these events, the thermal power increase O does not significantly lag the neutron flux response and, because of a lower trip setpoint, will initiate a scram before the high neutron flux scram. For rapid neutron flux increase events, the thermal power lags the neutron flux and the Average Power Range Monitor Fixed Neutron Flux-High Function will provide a scram signal before _the Average . Power Range Monitor Simulated Thermal Power-High/ Flow ! Biased Function setpoint is exceeded. , This Function's trip signal is sent to RPS over the same . data transmission paths as those described in Function 2.a above and is subject to the same onerab litv conditions. Each APRM division receives a tolai rec rculation flow data value from the EMS. The flow is measured using 4 independent flow transmitters that monitor the core plate pressure drop. l The Allowable Value for the upper limit is based on analyses that take credit for the Average Power Range Monitor Simulated Ttermal Power-High/ Flow Biased Function for the i mitigation of the loss of feedwater heater event. The thermal power time constant of < [7] seconds is based on the l fuel heat transfer dynamics. (continued) ABWR TS B 3.3-25 P&R 08/30/93 l 1
SSLC Sensor Instrumentation B 3.3.1.1 BASES APPLICABLE 2.b. Averaae Power Ranac Monitor Simulated Thermal Power-SAFETY ANALYSIS, Hich. Flow Biased (continued) LCO, and APPLICABILITY The Average Power Range Monitor Simulated Thermal ( Continued ) Power-High/ Flow Biased Function is required to be OPERABLE in MODE 1 when there is the possibility of generating excessive thermal power and potentially exceeding the SL applicable to high pressure and core flow conditions (MCPR SL). During MODES 2 and 5, other SRNM and APRM Functions provide protection for fuel cladding integrity. 2.c. Averace Power Ranae Monitor Fixed Neutron Flux-Hiah The APRM divisions provide the primary indication of neutron . flux within the core and respond almost instantaneously to-neutron flux increases. The Average Power Range Monitor Fixed Neutron Flux-High Function is capable of generating a t trip signal to prevent fuel damage or excessive RCS pressure. For the overpressurization protection analysis of Reference 11, the Average Power Range Monitor Fixed Neutron l Flux-High Function is assumed to terminate the main steam l isolation valve (MSIV) closure event and, along with the l safety / relief valves (S/Rvs), limits the peak reactor I pressure vessel (RPV) pressure to less than the ASME Code j limits. W 1W6 L l This Function's trip signal is sent to RPS over the same data transmission paths as those described for Function 2.a above and is subject to the same operability conditions. ! The Allowable Value is based on the Analytical Limit assumed I in the vessel overpressure protection analyses. l The Average Power Range Monitor Fixed Neutron Flux-High Function is required to be OPERABLE in MODE 1 where the potential consequences.of the analyzed transients could result in the SLs (e.g., MCPR and RCS pressure) being exceeded. Although the Average Power Range Monitor Fixed Neutron Flux-High Function is assumed in the CRDA analysis that is applicable in MODE 2, the Average Power Range Monitor Neutron Flux-High, Setdown Function conservatively bounds the assumed trip and, together with the assumed SRNM trips, provides adequate protection. Therefore, the Average Power Monitor Fixed Neutron Flux-High Function is not required in MODE 2. (continued) O ABWR TS B 3.3-26 P&R 08/30/93 l l I
? !' q l SSLC Sensor Instrumentation ! l B 3.3.1.1 1 BASES ( APPLICABLE 2.d. Averace Power Ranae Monitor-Inon i l SAFETY ANALYSIS, . 4 LCD, and . W einn=1 pr^"i&: ::;r: ace the e .dniimw nuder of- . APPLICABILITY me are npEoABLE. Whenever the APRM self test and i ( Continued ) monitoring algorithms detect a condition that could prevent i it from generating a trip when needed or the APRM has
- insufficient OPERABLE LPRMs and the division is not !
- bypassed, an INOP/ TRIP signal will be sent to all four RPS divisions over the same data transmission paths as those i describe nction 2.a above. Interlocks prevent placing j more the one ision in bypass so only one division may be
- inoperabe Jw out causing a reactor trip. This Function was
- not specifTcally credited in any ABWR SSAR analysis, but it is retained for the overall redundancy and diversity of the 1 RPS as required by the NRC approved licensing basis.
i Three unbypassed divisions of Average Power Range ! i Monitor-Inop are required to be OPERABLE to ensure that no ; O single failure will preclude a scram from this Function on a ; { j valid signal. l There is no Allowable Value for this Function. f ! ) This function is required to be OPERABLE in the MODES where the APRM Functions are required.
; .G -
)
g 2.e. Rapid Core Flow Decrease N_f.d ; ! j A rapid flow decrease fr m high power can jeopardize the !
- e 3 Q MCPR causes a SL.
sc'r Thef["" Pr ^s .-Core Flow Decrease W unctionfg j is greater haft 66 ^!. to provide confidence that the SL
- will not be violated.
iL4.p d The Neutron Mon ng System Ra'^ Of Core Flow Decrease P igh Function provides protection against transients where core flow decreases rapidly. This function is assumed in the all pump trip analysis. The scram signal from this function is sent to the RPS TLUs over the same data transmission path as the APRM trips. The APRM System is divided into four divisions. Each APRM division sends a trip signal to all four RPS TLUs via suitable isolators. The rate of flow decrease is calculated from total recirculation flow data acquired from the EMS. (continued) ABWR TS B 3.3-27 P&R 08/30/93
J SLC L Sensor Instrumentation B 3.3.1.1
'YAe. N :_ SN G & cQ,% ; m g
% 6 40 'T~g ,
BASES f APPLICABLE j 2.e. Rapid Core Flow Decrease (continued) SAFETY ANALYSIS', LCO, and The flow is measured using 4 independent flow transmitters APPLICABILITY that monitor the core plate pressure drop. ( Continued )
~
The Neutron Monitoring System Rate of Core Flow Decrease-High Function isgmatically bypassed when thermal power 1s less Inan
. The thermal power value calculated for the Average Power Range Monitor Simulated Thermal Power-glow Biased Function is used to implement the bypass.
Three unbypassed divisions of thi func ion are required to be OPERABLE to ensure that no singTL.-fa lure will preclude a scram from this Function on a valid signal. The Allowable Value for this function is derived from the analytic limit used in the all pump trip analysis. The Neutron Monitoring Sys atesof Core Flow Decrease-High Function is required to be OPE BLE in MODE 1 when gg thermal power is greater han(~%f,RTPwherethereisa A i possibility of a rapid floy decrease, jeopardizing the MCPR l SL. At' power levels im us._0^% O4A trip of all l recirculation pumps will not violate the MCPR SL. l N. 2.f. Oscillation Power Ranae Monitor MM I .5 The Oscillation Power Range Monitor (0PRM) Function detects I the existence of neutron flux oscillation that could cause ' violation of the fuel thermal limits. Thi Function is not assumed in any ....b ,,, n t h ABWR SSAR. However, it is included for redundancy and diversity and to provide confidence that the assumptions used in fuel limits calculations are preserved. The OPRM uses two algorithms to detect flux oscillations. Each algorithm operates on several groups of LPRMs (called
- OPRM cells). The OPRM cells are selected to provided a l representation of the radial neutron flux distribution so that local flux oscillations will be detected.
The amplitude / growth rate algorithm measures the amplitude of flux oscillations as a fraction of the average value (i.e
% of point). The algorithm is invoked if the peak to average l
value exceeds a specified amount. The algorithm measures the l e (continued) l l ABWR TS B 3.3-28 P&R 08/30/93 i
. _ . - _ _ ~
b
}
SSLC Sensor Instrumentation B 3.3.1.1 ; BASES r APPLICABLE 2.f. Oscillation Power Ranae Monitor (continued) SAFETY ANALYSIS. W.r@ , period of the oscil tion to determine if it is within the LCO, and APPLICABILITY range expected for hydraulic core oscillations. If it ( Continued ) is, then the cell flux is scanned for three of the measured . periods. If the sensed flux increases (growth. rate) by a ! specified amount or becomes larger than a specified amount !
% (amplitude) within this period,%c.rvDthen a trip is declared.
The period based algorithm measures the period of successive f peaKsh in sensed / flux. If the period is within ' the range expected for core Dehydraulic or a specified i number of times and the amplitude is greater an i d D,i specified value, then a trip is declared. ; There are four divisions of OPRMs, one in each NMS division. ! Each OPRM acquires data from LPRMs distributed throughout i the core. Therefore, each OPRM is capable of detecting an i oscillation in any core region. Each OPRM sends trip data to ; all four RPS TLUs via suitable isolators. The potential for power oscillations in a BWR is restricted' ; to operation conditions with low core flow and relatively O high power. In order to reduce the potential for spurious trips due to LPRM nojs r-th OPRM function is automatically bypassed when the p6 r flo lationship is below the , characteristicshowningigur 3.3.1.1-1. The OPRM satisfies GDC . he Allowable Values for the trip < and bypass setpoints are based on extensive analysis of BWR ! core oscillation characteristics (see reference 16).
- OPKW The Aver.g Fvwer R.nge ".=it
- r Ti,.ed Nevis en i6-::igh l' Function is required to be OPERABLE ia p 'e.when the power / flow characteristic is as shown i jigre3.3.1.1-1 since this is the a,e i .nd ethe g onditi 1 here core l
i oscillations can occur. Three divisions of this function are required to be OPERABLE to ensure that no single failure will preclude a scram from this Function on a valid signal. 3.a. b. & c. Reactor Vessel Steam Dome Pressure-Hiah An increase in the RPV pressure during reactor operation compresses the steam voids and results in a positive reactivity insertion. This causes the neutron flux and (continued) ABWR TS B 3.3-29 P&R 08/30/93 l l
SSLC Sensor Instrumentation , B 3.3.1.1 BASES APPLICABLE 3.a. b. & c. Reactor Vessel Steam Dome Pressure-Hioh $ SAFETY ANALYSIS, (continued) LCO, and l APPLICABILITY THERMAL POWER transferred to the reactor coolant to . ( Continued ) increase, which could challenge the integrity of the fuel ( cladding and the RCPB. None of the ABWR SSAR safety ! analysis takes direct credit for this Function. However, the Reactor Vessel Steam Dome Pressure-High function ' initiates a scram (3.a) for transients that results in a pressure increase, counteracting the pres are increase by rapidly reducing core power. For the overpressure protection analysis of Reference 11, the reactor scram which ; terminates the MSIV closure event is conservatively assumed , to occur on the Average Power Range Monitor Fixed Neutron Flux-High signal, and, along with the S/RVs, limits the peak RPV pressure to less than the ASME Section III Code limits. g The Reactor Steam Dome Pressure-High Function also is lates (3.b) the shutdown cooling portion of the RHR System an the j head spray line from the CUW system. This interlock is . provided only for equipment protection to prevent an intersystem LOCA scenario and credit for the interlock is O not assumed in any accident or transient analysis in the ABWR SSAR. ! Automatic Standby Liquid Control System (SLCS) and Feedwater Runback (FWRB) are also initiated by this Function (3c). m These features are provided to mitigate a postulated ATWS 4ec h g -V e **"
- V.-v @ %b UN iM~N . ..
D W Q h, Each DTM eceivesa9a[luerepresentingmeasuredreactor i pressure from the EMS in its division and compares the value l l against a numeric setpoint to determine if a trip is f requireddReactor pressure is measured using four g*Oq independent (separate vessel taps, instrument piping, etc) l pressure transmitters connected to the RPV steam space. e l Reactor Vessel Steam Dome Pressure-High Allowable Value is ! chosen to provide a sufficient margin to the ASME Section III Code limits during pressurization events. Three unbypassed divisions of Reactor Vessel Steam Dome ' Pressure-High Function are required to be OPERABLE to l ensure that no single instrument failure will preclude a i protective action from this Function on a valid _ signal. ! Ne- G e tu- .bMors e- T ! uv ,.a m u MC-wet-esk bA w , s - . h- Y *U' E - f J (continued) ABWR TS B 3.3-30_ P&R 08/30/93 o l
YMMA hW SSLC Sensor Instrumentation
\- QQ g , gqq B 3.3.1.1
.e;-e c pw- i<# n , < <
- L *\ v ..
, .. 5 W6 .
Y"* BASES APPLICABLE 3.a. b. & c. Reactor Vessel Steam Dome Pressure-Hich SAFETY ANALYSIS (continued) LCO, and APPLICABILITY Function 3as is required to be OPERABLE in MODES I and 2 ( Continued ) since these ire the MODES where RPS is required to be OPERABLE.@ Function 3bkisrequiredtobeOPERABLEinMODES1,2,and3 when the RCS may be pressurized and the potential for pressure increase exists. Function 3clisrequiredtobeOPERABLEinMODE1sincethis is the MODE where ATWS features must be OPERABLE.
- 4. Reactor Steam Come Pressure-Low (Iniection Permissive)
Low reactor steam dome pressure signals are used as permissives for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design o pressure. The Reactor Steam Dome Pressure-Low is one of
,d the Functions assumed to be OPERABLE and capable of permitting initiation of the ECCS during the trr.nsients analyzed in References 2 and 8. In addition, the Reactor Steam Dome Pressure-L'.s Function is directly assumed in the analysis of the Design Bois Accident (maximum steamline brenf4r-maximum feedwater line break, or maximum RHR shutdown suction line break). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10CFR50.46.
L c X- a--
.Each ESF DTM receives fa value representing measured reactor U pressuriinrrha from the EMS in its division and compares the value against a numeric setpoint to determine if a trip is required. Reactor pressure is measured using four independent (separate vessel taps, instrument piping, etc) !
I pressure transmitters connected to the RPV steam space. The Allowable Value is low enough to prevent overpressurizing the equipment in the low pressure ECCS, but high enough to ensure that the ECCS injection prevents the fuel peak cladding temperature from exceeding the limits of 10 CFR 50.46. (continued) l ABWR TS B 3.3-31 P&R 08/30/93 i
SSLC Sensor Instrumentation l B 3.3.1.1 i BASES APPLICABLE 4. Reactor Steam Dome Pressure--Low (In.iection Permissive) SAFETY ANALYSIS, (continued) LCO, and ! APPLICABILITY Three divisions of Reactor Steam Dome Pressure-Low Function ;
~
( Continued ) are required to be OPERABLE when the associated ECCS is required to be OPERABLE to ensure that no single instrument - failure can preclude ECCS initiation. Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure ECCS subsystems. l
- 5. Reactor Vessel Water Level-Hiah. Level 8 i i
! High RPV water level indicates that sufficient cooling water - inventory exists in the reactor vessel such that there is no < danger to the fuel. Therefore, the Level 8 signal is used to automatically terminate RCIC and HPCF injection to ; prevent overflow into the Main Steam Lines (MSLs). RCIC injection is terminated by closing the RCIC steam supply, ; steam supply bypass, and cooling water supply valves. HPCF 1 sing the injection valve. The. i c.g Mg %9- injection. ReactorisVessel terminate Water L vel-Hi h, Level 8 Function is not assumeo in tM.acciden aidtrnsientanalyses.Itwn.is retained since it ' a otenti lly significant centrihntnr i
, h .ta risk.
5
%, t ed.Lc2 lo vs ;
w h _Each ESF DTM receives a data value representing measured rom the EMS in its division and i reactor compares vesseFalevel v@ic setpoint to determine if a it against a numer level 8 trip is required. The reactor water level signals originate in four independent (separate vessel taps, instrument piping, etc.) level transmitters that sense the ! pressure difference between a constant column of water ' (reference leg) and the effective water column (variable leg) in the vessel. A concurrent high level signal from any ' two of the sensors will cause termination of the injection ' flows. c,v w. % Three divisions of the Reactor Vessel Water Level-High, Level 8 Function are required to be OPERABLE when the , l associated ECCS is required to be OPERABLE to ensure that no ! single instrument failure can preclude ECCS initiation due , to false high level. Refer to LCO 3.5.1 and LCO 3.5. for l Applicability Bases for.the low pressure CCS u stems. l I aAJ, T h _4 l (continued) ABWR TS B 3.3-32 P&R 08/30/93 i l l
SSLC Sensor Instrumentation d" B 3.3.1.1
% 3 5 % 55 W SQ 5 3 i BASES APPLICABLE 6.a. & b. Reactor Vessel Water Level- Low. Level 3 x
SAFETY ANALYSIS, LCO, and Low RPV water level indicates the capability to cool the APPLICABILITY fuel may be threatened. Therefore, a reactor scram is ( Continued ) initiated at level 3 to substantially reduce the heat generated in the fuel from fission. The Reactor Vessel Water Level-Low, Level 3 scram Function (6.a) is assumed in the LOCA analysis (Ref. 11). This Function (6.b) also initiates a containment isolation - and isolates the RHR shutdown cooling mode. The isolation functions are not specifically assumed in any of the ABWR SSAR analysis, however, they are implicitly assumed in fission release calculations since the paths they isolate are assumed to be isolated. The reactor scram reduces the amount of energy required to be absorbed and, along with the isolation and Emergency Core ! Cooling Systems (ECCS) actions, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. m d Each DTM receives a data value representing measured reactor
' " vessel leTerwka from the EMS in its division and compares k-) it against a numeric setpoint to determine if a level 3 trip is required. The reactor water level signals originate in four independent (separate vessel taps, instrument piping, etc.) level transmitters that sense the pressure difference betweer a constant column of water (reference leg) and the effective water column (variable leg) in the vessel.
Three unbypassed divisions of Reactor Vessel Water Level-Low, Level 3 Function are required to be OPERABLE to , ensure that no single instrument failure will preclude a protective action from this Function on a valid signal. The Reactor Vessel Water Level-Low, Level 3 Allowable Value is selected to ensure that, for transients involving loss of all normal feedwater flow with successful operation of a high pressure system, initiation of the low pressure ECCS at RPV Water Level I will not be required. Reactor scram on this Function is required in MODES 1 and 2 where considerable energy exists in the RCS resulting in the limiting transients and accidents. Isolation initiation on this function is required in modes 1, 2, and 3 which is g (continued) d ABWR TS B 3.3-33 P&R 08/30/93 l
SSLC Sensor Instrumentation i B 3.3.1.1 j l BASES f A.O APPLICABLE 6.a. & b. Reactor Vessel Water level-Low. Level 3 d' gD l SAFETY ANALYSIS, (continued) e j LCO, and ! APPLICABILITY consistent with the applicability of LCO 3.6.1.1.' Shutdown-( Continued ) cooling isolation is also required to be OPERABLE during i core alteradons and operations with the potential for ; orain'.ng (nu reactor vessel. t 7.a.. b. & c. Reactor Vessel Water Level-Low. Level 2 h La F, water level idi :ter +%t' the Wi'ity t: cul- ! ____ hhe fnl si. Toe tnresi.ened:- Should RPV water level decrease too far,. fuel damage could result. . Low reactor water level l ! i indicates that normal feedwater flow is insufficient to ! l maintain ~ reactor vessel water level and that the capability ;
^
, sty to cool the fuel may be threatened. Therefore, the RCIC-
! / ' _ system is initiated at Level 2 to sist in maintaining ; l water level above the active fud.p'h: Reactor Vessel Water t
- 7. *e Level-Low, Level 2 is one of the Functions (7a)' assumed to ity#h. be OPERABLE and capable of. initiating RCIC during the ;
pQg transients analyzed in Reference 2 and_8. . The-Reactor- i Vessel Water Level-Low, Level 2 Function associated with- ! l l l [3s j3 f RCIC is directly assumed in the analysis'of the Design Basis Accident (maximum steamline break, or maximum.feedwater line r <-- break, or maximum RHR shutdown suction line break). :
.,?.4 l
q #g This Function also initiates a' containment isolation and j isolates the Reactor Water Clean-up system. The isolation (
,d Functions-(7.b) are not specifically assumed in any of the 'l 2334 ABWR SSAR analysis, however, they are implicitly assumed in i
~~ j i fission release calculations since the paths they isolate
! r d are assumed to be isolated. i i-se ' "o The core cooling function of the ECCS, along with the
' 0 isolation and RPS scram actions, ensures that the fuel peak l
7 ,f, *vi cladding temperature remains below the limits of 10 CFR l
) 50.46.
i 5 g% s f J$ Automatic Standby Liquid Control System (SLCS) and Feedwater
/ (L y Runback (FWRB) are also initiated by this Function (7c).
f These features are provided to mitigate a postulated ATWS event.Cg. Each ESF DTM receives a data value representing measured reactor vesse1 1evel rom the EMS in its division and 9 wacc (continued). ABWR TS B 3.3-34 P&R 08/30/93 e
- - - . n..w..->.~.-~.s .-.a a. n , a- . u,. - .su . s.~ .-. .
a l SSLC Sensor Instrumentation B 3.3.1.1 BASES 1 APPLICABLE 7.a.. b. & c. Reactor Vessel Water Level-Low. Level 2 ; SAFETY ANALYSIS, (contirius2 , v.4 g. ] Ihrtre M % "y_ LCO, and i compares it against a point to determine if a APPLICABILITY me ( Continued ) level 2 trip is require __ he reactor water level signals originate in four independent (separate vessel taps, ! instrument piping, etc.) level transmitters that sense the l w,Es pressure difference between a constant column of water (reference leg) and the effective water column (variable leg)inboh W the vessel we . We- 4 0 w t- h & at5 S N e. C-o W YA RTb 44 b.W h h Sh a tv 4,4 . The Reactor Vessel Water Level - Level 2 Allowable Value'is ! chosen such that for. complete loss of feedwater flow,- the. -
'/ RCIC System flow, coupled with an assumed failure of the 4 o high pressure core flooders, will be sufficient to avoid i
~'
initiation of low pressure ECCS at' Reactor Vessel Water Level i
- Low,-Level 1.
d Three unbypassed divisions of Reactor Vessel Water ;
< Level-Low, Level 2 Function are required to be.0PERABLE to -
)
ensure that no single instrument failure will preclude a , l g protective action from this Function on a valid signal. - l 4 lh 7b 2
- The Reactor Vessel Water Level-Level 2 Functions Sa., and %.
ik vl are required to be OPERABLE in modes 1, 2, & 3. The-CUW j
,.; y' isolation is also required to be OPERABLE during CORE Jf [ ALTERATIONS or operations with the potential for draining !
I4-
) the reactor vessel. Refer'to LCO 3.5. nd LCO 3.5. for- 1 Applicability Bases for the RCIC system LC0 3.6. !
N N l} the Applicability basis for isolation. MV - v2 i y -] Function 7c. is required to be OPERABLE in MODE 1 since this , o is the MODE where ATWS features must be OPERABLE. ! 4j ._ k MM -G 6 aw ;
, . , 8.a. & b. Reactor Vessei water Levei-low. Level I.5 j Low RPV water level indicates that the capability to cool !
.g the fuel may be threatened. Should RPV water level decrease ;
y too far, fuel damage could result. Therefore, the HPCF je Systems and associated DGs are initiated at Level 1.5 to n 'W maintain level above the top of the active fuel. The ; Reactor Vessel Water-Low, Level 1.5 is one of the Functions ! (8.a) assumed to be OPERABLE and capable of initiating HPCF ! during the transients analyzed in References 2 and 8. The l Reactor Vessel Water Level -Low, level 1.5 Function ; associated with HPCF is directly assumed in the analysis of j (continued) ABWR TS B 3.3-35 P&R 08/30/93 .
i SSLC Ssnsor Instrumentation B 3.3.1.1 BASES APPLICABLE 8.a. & b. Reactor Vessel Water Level-Low. Level 1.5 SAFETY ANALYSIS, (continued) LCO, and l the Design Basis Accident (maximum steamline break, or APPLICABILITY 2 maximum feedwater line break, or maximum RHR shutdown ( Continued ) suction line break). This Function (8.b) also initiates a IV closure. The MSIV closure is not specifically assumed in any ABWR SSAR analysis, however, tW er implicitly assumed in fission pro $ ' release calculitions sinceThe calculations assume the main steam lines are isolated. (y-The core cooling function of the ECCS, along with scram and MSIV closure, ensures that the fuel peak cladding l temperature remains below the limits of 10 CFR 50.46. Each DTM receives a data value representing measured reactor
*4c?C 'vesseTlevel m the EMS in its division and compares ,
it against a nume c setpoint to determine if a level 1.5 trip is required. The reactor water level signals originate, , in four independent (separate vessel taps, instrument l l piping, etc.) level transmitters that sense. the pressure ; difference between a constant column of water (reference leg) and the effective water column (variable leg) in the vessel. , The Reactor Vess 1 Water Level- Level 1.5 Allowable Value is chosen such thatWor complete loss of feedwater flow, the HPCF flow, coupled with an assumed failure of the RCIC, will l be sufficient to avoid initiation of LPFL at Reactor Vessel Water Level - g Three unbypassed divisions of Reactor Vessel Water Level-Low, Level 1.5 Function are required to be OPERABLE to ensure that no single instrument failure will preclude a - protective action from this Function on a valid signal. E The Reactor Vessel Water Level IhveFunction is required to be OPERABLE in modes I,-2, & 3.% efer to LCO 3.5.lsand LC0 3.5.2sfor Applicability Bases for the HPCF system anD C0 3.6. o the Applicability basis for . i isolation. i P (continued) i P&R 08/30/93 : ABWR TS B 3.3-36 f
SSLC Sensor Instrumentation B 3.3.1.1 BASES APPLICABLE 9.a. b. & c. Reactor Vessel Water Level-Low. Level 1 n Low reac ve water level indicates that APPLICABILITY the capability to cool the fuel may be threatened. Should ( Continued ) RPV water level decrease too far, fuel damage could result. RCW, ADS, LPFL, and the associated DGs are initiated at Level 1 to ensure that low pressure flooding is available to prevent or minimize fuel damage. The Reactor Vessel Water Level-Low, level 1 Function (9.a&b) is assumed to be OPERABLE and capable of initiating LPFL during the transients analyzed in References 2 and 8. In addition, the Reactor Vessel Water Level- Low, level 1 ADS and LPFL initiation is assumed in the analysis of Design Basis Accidents (maximum steamline break, or maximum feedwater line break, or maximum RHR shutdown suction line break) (Ref. 1). Additional details on the conditions for initiating ADS are given in the background section of this LCO. This Function (9.c) is also used in the containment isolation logic. The containment isolation is not p specifically assumed in any of the ABWR SSAR analysis, a however, they are implicitly assumed in fission release
' calculations since the calculations assume these paths are isolated.
The core cooling function of the ECCS, along with the scram and isolation actions, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. W( _~ Each ESF DTM _ receives two data values representing measured reactor vessel'leveT 4alue from the EMS in its division and ; compares them against a numeric setpoint to determine if a ! level 1 trip is required. The reactor water level signals I oriainate in eiaht level transmitters that sense the pressure difference between a constant column of water ' MT-@ g i (reference leg) and the effective water column (variable leg) in the vessel. Data values from four independent transmitters (separate vessel taps, instrument 0101n0, etc. , are ushthe L ip calculaMees for%DS A, LPFL A & C l (9.a), and for the isolation logic (9.c). Four additional l transmitters are used to provide data values for initiating the Diesel Generators, the Reactor Building Cooling Water, ADS/hand LPFL B (9.b). (s,C A A6 A l CAA5 B (continued) ABWR TS B 3.3-37 P&R 08/30/93 1
?
SSLC Sensor Instrumentation B 3.3.1.1 ; BASES l 9.a. b. & c. Reactor Vessel Water level --Low. Level 1 APPLICABLE SAFETY ANALYSIS, (continued) LCO, and APPLICABILITY The Reactor Vessel Water Level-Low, Level 1 Allowable Value ( Continued ) is high enough to allow sufficient time for the high ' pressure systems to be effective before the low pressure flooders initiate and provide a uate cooling. Three unbypassed divisions of Reactor Vessel Water Level-Low, Level 1 Function are required to be OPERABLE to ensure that no single instrument failure will preclude a protective action fro th Function on a valid signal. v .-- -14 cT. t o, The Reactor Vessel Wat vel-evelhlFunctionisrequired ! to be OPERABLE in modes 1,-2, & 3.W efer to LC0 3.5. and LC0 3.5. for the Applicability Bases of the ADS & LP : systems, CO3.8.Qnd3.8. or the Applicability Bases of i the DGs a LCO 3.6. for the s plicability basis for isolation. g n yt.t 3 3)
- 10. Main Steam isolation Valve-Closure ;
l MSIV closure results in loss.of the main turbine and the condenser as a heat sink for the Nuclear Steam Supply System and indicates a need to shut down the reactor to reduce heat ' generation. Therefore, a reactor scram is-initiated on a Main Steam Isolation Valve-Closure signal before the MSIVs are completely closed in anticipation of the complete loss of the normal heat sink and subsequent overpressurization , transient. However, for the overpressurization protection analysis of Reference 11, the Average Power Range Monitor Fixed Neutron Flux-High Function, along with the S/RVs, limits the peak RPV pressure to less than the ASME Code l limits. That is, the direct scram on position switches for MSIV clos e events is not assumed in the overpressurization analysis. . MSIV closure scram is assumed in the transients analyzed in Reference 2 (e.g., low steam line pressure, manual closure of MSIVs, high steam line flow). The reactor scram reduces the amount of energy to be absorbed and, along with the actions of the ECCS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. Each RPS DTM directly receives (i.e. not via the EMS)~ valve closure data from both the outboard and inboard MSIVs on a (continued) O ABWR TS B 3.3-38 P&R 08/30/93 l
SSLC Sensor Instrumentation B 3.3.1.1 BASES APPLICABLE 10. Main Steam Isolation Valve-Closure (continued) .i SAFETY ANALYSIS, LCO, and single steamline. The closure signals originate from APPLICABILITY position switches mounted on each MSIV. The Main Steam ( Continued ) Isolation Valve-Closure logic will cause a scram when the steam flow is shut off in two or more steam lines. One division (i.e. one steamline) of this function may be bypassed to permit operation with one steamline isolated. ; The Main Steam Isolation Valve-Closure Allowable Value is specified to ensure that a scram occurs prior to a i' significant reduction in steam flow, thereby reducing the severity of the subsequent pressure transient. Note that the allowable value is not implemented in the initiation logic, ; but is part of the MSIV requirements and the MSIVs are part i of the Nuclear Boiler System (NBS). Three unbypassed divisions of the Main Steam Isolation !' Valve-Closure Function are required to be OPERABLE to ensure that no single instrument failure will preclude the scram from this Function on a valid signal. This Function is only required in MODE 1 since, with the MSIVs open and ; the heat generation rate high, a pressurization transient ~ g\s BT W !
~,
can occur if the MSIVs close. In M0 6 heat goA 63 generation rate is low enough so that the other diverse RPS l functions provide sufficient protection. II .a. . b. & c. Drywell Pressure-Hiah , High pressure in the drywell could indicate a Reactor : Coolant Pressure Boundary (RCPB) break inside the drywell. I various protective actions are initiated to minimize the 1 possibility of fuel damage, to reduce the amount of energy added to the coolant and the drywell, and to keep offsite dose within limits. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The protective actions are:
- Reactor Scram (11.a). This function provides a scram signal that is diverse to the Reactor Vessel Water i Level-Low, Level 3 Function for LOCA events inside the i drywell. This scram initiation is not specifically credited in any ABWR SSAR analysis, but it is retained (continued) l ABWR TS B 3.3-39 P&R 08/30/93 I
i
'"W m
i 4 SSLC Sensor Instrumentation B 3.3.1.1 BASES ' d 0 APPLICABLE 11.a.. b.. & c. Drywell Pressure-Hiah (continued) SAFETY ANALYSIS, l LCO, and for the overall redundancy and diversity of the RPS as l
- 4 APPLICABILITY required by the NRC approved licensing basis. ;
i ( Continued ) !
- ECCS pumps (LPFL, HPCF, & RCIC) and the associated Diesel-Generators (DGs) (ll.b). This function provides an >
ECCS initiation signal that is diverse to the low reactor
- water level initiations. ECCS initiation on this
! Function is not specifically credited in any ABWR SSAR ' analysis, but it is retained for overall redundancy and diversity as required by the NRC approved licensing basis. ggg,h
- Automatic DepressuritJtion System (ADS) (ll.b). The Drywell Pressure 4iigmis assumed to be OPERABLE and capable of initiating the ADS during the accidents analyzed in Reference 1.
Containment Isolation (ll.c). The isolation of some of l the CIVs on high drywell pressure supports actions to l ensure that offsite dose limits of 10 CFR 100 are not ' exceeded. The Drywell Pressure 4tigh Function associated with isolation of the containment is implicitly assumed in the ABWR SSAR accident analysis as these leakage paths are assumed to be isolated post LOCA. gq EichDTM(boththeRPSandESFDT eives a data value representing measured drywell pressure from the EMS in its division and compares it against a numeric setpoint to determine if a trip is required. Drywell pressure is measured using four pressure transmitters connected to the drywell atmosphere. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment. Negative barometric fluctuations are accounted for in the Allowable Value. Three unbypassed divisions of Drywell Pressure-High Function are required to be OPERABLE to ensure that no single instrument _failur_e_will preclude protective action f om this
% q gg a Q _ function on a valid signal.WT
. MODES 1, 2, and 3 where considerable energy exists in the RCS, resulting in the limiting transients and accidents. In MODES 4 and 5, the Drywell Pressure 4tigh Function is not required since there is insufficient energy in the reactor (ce"t4"#ed)
<O ABWR TS B 3.3-40 P&R 08/30/93
i SSLC Sensor Instrumentation B 3.3.1.1 i BASES APPLICABLE ll.a.. b., & c. Drvwell Pressure-Hiah (continued) SAFETY ANALYSIS, LCO, and to pressurize the drywell to the Drywell Pressure-High APPLICABILITY setpoint. ( Continued ) Q 12, CRD Aecu ulater Charaina HroJcn Pressure W [ Q Q '
% u The Control Rod Drives (CRD) use high pressure water that is stored in accumulators as the motive power for driving in the control rods. The accumulators are connected through suitable valve arrangements to a header which provides the high pressure water. If the header pressure is lower then some threshold value then the control rod insertion time may ,
*6do< becharging greater then spressure ecified. Therefore, scram a The is provided. low CRD CRDheader accumuitter QLe i
pressure is indirectly din any safety analysis where the scram time is a significant parameter. T q Each RPS DTM receives a measured CRD charging header pressure value from its associated EMS and compares it against a numeric setpoint to determine if a trip is required. CRD charging header pressure is measured using four pressure transmitters connected to the header. The
' Allowable Value was selected to assure that the scram time
! will be equal to or less than the values used in various safety analysis with the reactor pressure at the highest value that occurs during the analyzed events. The CRD charging header pressure trip may be manually bypassed from keyloc 1ches in each division when the reactor is in the sh ownN r refueling modes. Each division sends a rod withdra 1 block to the Rod Control and Information System; RC.LIS) w en the bypass is invoked in that division. j 4 i Three unbypassed divisions of CRD Accumu.:tw Charging N Fader Pressure-Low are required to be OPERABLE to ensure l that no single instrument failure will preclude a scram from this. Function on a valid signal. The Function is required to be OPERABLE in MODES I and 2 when the scram function is required and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies. AtQ _l.> vthw C~is FUm.iien 4s net ++ quired, I (continued) l ABWR TS B 3.3-41 P&R 08/30/93 l l
... . - - . - ~
i SSLC Sensor Instrumentation i B 3.3.1.1 ( BASES APPLICABLE 13. Turbine Stoo Valve-Closure SAFETY ANALYSIS, LCO, and Closure of the Turbine Stop Valves (TSV) results in the loss : APPLICABILITY of the normal heat sink and causes reactor pressure, neutron j ( Continued ) ~ flux, and heat flux transients that must be limited, j Therefore, a reactor scram is initiated at the start of TSV-closure in anticipation of these transients. The Turbine ;~ Stop Valve-Closure Function is the primary scram signal for the turbine trip event analyzed in Reference 2. For this event, the reactor scram reduces the amount of energy to be , absorbed and, .along with the actions of the End of Cycle Recirculation Pump Trip (EOC-RPT), ensures that the MCPR SL t... w MoL*f2*E w a Q Turbine Stop Valve-Closure signals are initiated by a , position switch on each of the four stop valves. Each ! _ position switch sends a discrete signal directly to one of ; the four RPS DTMsV The logic for the Turbine Stop Valve-Closure Functi uch that a trip will occur when closure of two or more TSVs,is etected. This function must e enabled at THERMAL POWER a 40% RTP. This is normally accomplished automatically using the data from four independent pressure transmitters sensing turbine
'O first stage pressure. Turbine first stage pressure data is received in each RPS DTM via the EMS.
The Turbine Stop Valve-Closure Allowable Value is selected ; to be high enough to detect imminent TSV closure thereby ! reducing the severity of the subsequent pressure transient. Three unbypassed divisions of Turbine Stop Valve-Closure are , required to be OPERABLE to ensure that no single instrument ! failure will preclude a scram from this Function. This Function is required, consistent with analysis assumptions, t whenever THERMAL POWER is a 40% RTP. The Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor Fixed Neutron Flux-High Functions are adequate to , maintain the necessary safety margins when power is less ; than 40% RTP. c (continued) ABWR TS B 3.3-42 P&R 08/30/93
SSLC Sensor Instrumentation B 3.3.1.1 i BASES ) k II APPLICABLE 14 Turbine Control Valve Fast Closure. Trio Oil Pressure-SAFETY ANALYSIS, low LCO, and APPLICABILITY Fast closure of the TCVs results in loss of the normal heat ( Continued ) sink and causes reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated on TCV fast closure in anticipation of these transients. The Turbine Control Valve Fast Closure, Trip 011 Pressure-Low Function is the primary scram signal for the generator load rejection event analyzed in Reference 2. For this event, the reactor scram reduces the amount of energy to be absorbed and, along with the actions of the EOC-RP_T System. ensures that the MCPR SL is not s exceeded. ( e , m .w g t t,r w *5 Q tCr.e 4 % r. w E. Turbine Control Valve Fast Closure, Trip Oil (Pressure-W signals are initiated from a pressure sensor each of the four turbine control valve hydraulic mechanism . The pressure sensor data associated with each contr i valve is transmitted directly to one of the four RPS DTM '. This function must be enabled at THERMAL POWER a 40% RTP as described for the Turbine Stop Valve-Closure Function. The Turbine Control Valve Fast Closure, Trip Oil
'[A Pressure Low Allowable Value is selected high enough to detect imminent TCV fast closure.
Three unbypassed divisions of Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Function are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This function is required, consistent with the analysis assumptions, whenever THERMAL POWER is a 40% RTP. The Reactor Vessel Steam Dome Pressure-High and the Average Power Range Monitor Fixed Neutron Flux-High Functions are adequate to maintain the necessary safety margins when power is less than 40% RTP. 15.a. & b. Main Steam Tunnel Radiation-Hioh High radiation in the steam line tunnel indicates a i potential gross fuel failure. The MSIVs are therefore closed
~
when high steam tunnel radiation (15.b) is detected to , prevent possible violation of the offsite release limits. l The MSIV closure causes a loss of the normal heat sink which l I 1 (continued) ABWR TS B 3.3-43 P&R 08/30/93
SSLC Sensor Instrumentation B 3.3.1.1 ( BASES f APPLICABLE 15.a. & b. Main Steam Tunnel Radiation-Hiah (continued) ; SAFETY ANALYSIS, LCO, and results in reactor pressure, neutron flux, and heat flux ! APPLICABILITY transients that must be limited. Therefore, a reactor scram ( Continued ) (15.a) is also initiated on high radiation in the main steam tunnel to rapidly reduce power and therefore the severity of the transients. This function is not specifically credited ; in any ABWR SSAR analysis, but it is retained for t% ! overall redundancy and diversity of the R"' as required by the NRC approved licensing basis. . 1 High steam tunnel radiation is detected using four radiation detectors located such that each detector can sense all four main steam lines. One radiation detector is connected to each division of the Process Radiation Monitoring (PRRM) O SysteT L= trip signals are generated when the radiation level exceeds its setpoint. A discrete signal is sent t l directly from the PRRM divisions to the RPS DTM in the same ' ! division (i.e. does not v.pme through the EMS). NLL$ p r.p D ad Z'. V e,f Q ,. 4 The Allowable Value for this Function is et low enough to . . provide reasonable assurance that : m will occur due to l excessive radiation but high enough to prevent spurious
'O scrhms due to normal steam tunnel radiation levels.
Tc wwG os # 9.%e. l Three unbypassed divisions of Steam Line Tunnel Radiation- i HigPare required to be OPERABLFeh "^00 !. 2 & 3 See LEih
-0.5.! !r E r th: :;;lic;Lil;t, be ns,.
b-- 44, N \ o Th6 l 16.a. & b. Sucoression Pool Temoerature-Hiah High temperature in the suppression pool could indicate a break in the reactor coolant system or a leak through the Safety / Relief Valves (S/RV), or a stuck open S/RV. A reactor , scram (16.a) is initiated to reduce the amount of energy ! h b% added to the containment. The Suppression Pool ! Temperature-High Function is assumed in the stuck open S/RV analysis. High suppression pool temperature signals originate in four divisions of temperature sensors distributed throughout the ; suppression pool. The suppression pool temperature / - - monitoring system in each of the four divisions calcu ites a s bulk average temperature from the sensors and compare 4* N i against a setpoint. The high temp ature trip data fro ,/ A , syWOJ g _ (continued) ABWR TS B 3.3-44 P&R 08/30/93
SSLC Sensor Instrumentation B 3.3.1.1 , BASES APPLICABLE 16.a. & b. Sucoression Pool Temperature-Hich' (continued) SAFETY ANALYSIS, LCO, and suppression pool temperature monitoring system is connected to the RPS DTM in the same division. The allowable value was j APPLICABILITY ( Continued ) selected considering the maximum normal suppression pool temperature and to indicate a stuck open S/RV. f This Function (16.b) also cause automatic initiation of the , suppression pool cooling mode of the RHR systems. Three divisions of the Suppression Pool Temperature-High Function are required to be OPERABLE to provi confidence that no single failure will preclude from th s reta!.h function on a valid signal. We Functiong reouired in OtW- M , MODES 1 and 2 wher onsiderable energy exists in primary coolant. N j ? T %4<-f b W \W l 17. Condensate Storace Tank Level-Low 1 The normal source of water for the RCIC and HPCF pumps is the Condensate Storage Tank (CST). Low level in the Condensate Storage Tank (CST) indicates the potential for an MNah l inadequate supply of makeup water. If the water level in the CST falls below a specified level, the suppression pool suction valve automatically opens, followed by automatic
\1 closure of the CST suction valve This ensures that an adiiquate suppiy or makeup water Nisvailable to the pumps. :
To prevent losing suction to the pump, the valves are : interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes. i The Function is implicitly assumed in the accident and transient analyses which take credit for RCIC or HPCF since the analyses assume that the suction source is the suppression pool. Each ESF DTM receives a data value representing measured i condensate storage tank level from the EMS in its division l and compares it against a numeric setpoint to determine if a transfer is required. Condensate Storage Tank Level-Low signals originate from four level transmitters. The Condensate Storage Tank Level-Low Function Allowable Value is high enough to ensure adequate pump suction head while water is being taken from the CST. (continued) t ABWR TS B 3.3-45 P&R 08/30/93 i'
1 SSLC Sensor Instrumentation B 3.3.1.1 O (Q BASES APPLICABLE 17. Condensate Storaae Tank Level-Low (continued) SAFETY ANALYSIS, c hch s% tha-Te Levd- 1-dv LCO, and Three divisions of the Suppre::fr. Pto' Tai erst re "igi; APPLICABILITY Function are required to be OPERABLE to provide confidence ( Continued ) that no single failure will preclude a transfer of the suction source on a valid signal. The Function is required to be OPERABLE in MODE 1 and in MODES 2 and 3. This Function must also be OPERABLE in MODES 4 and 5 when HPCF is used to satisfy the requirement that at least 2 ECCS system be OPEPABLE with RPV Level less than (23] feet above the vessel flange. The applicability basis is the same as given for nd LCO 3.5.2 RCIC and HPCF thintLCON 3.5.ly\e. -
- 18. Sucoression Pool Water level-Hioh Q
--Excessively %igh suppression pool water could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the S/RVs. Therefore, high suppression pool water level is used to transfer the suction source of RCIC and HPCF from the Condensate Storage Tank (CST) to the suppression pool to eliminate the possibility of continuing to provide ,(o additional water from a source outside containment. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes.
This Function is implicitly assumed in the accident and i transient analyses which take credit 4er-RC-IC ec HPCF- 31 ce l the anabies assume Liioi. i.he sucMon-sourg is Lire %b e.'re l W b4. A ow a.w msg we._f i ; suppression w v. h v~ poodw.ek%,v h c)\ ,s Each ESF DTM receives a data value representing measured suppression pool water level from the EMS in its division and compares it against a numeric setpoint to determine if a transfer is required. Suppression Pool Water Level-High data originates in four level transmitters. The Allowable Value for the Suppression Pool Water Level-High Function is chosen to ensure that RCIC and HPCF will be aligned for ! suction from the suppression pool before the water level reaches the point at which suppression pool design loads , would be exceeded. l Three divisions of the Suppression Pool Temperature-High Function are required to be OPERABLE to provide confidence that no single failure will preclude a transfer of the fm (continued) U ABWR TS B 3.3-46 P&R 08/30/93 1
SSLC Sensor Instrumentation ! B 3.3.1.1 , ( BASES APPLICABLE 18. Suppression Pool Water Level-Hiah (continued) SAFETY ANALYSIS, LCO, and suction source on a valid signal. The Function is required , APPLICABILITY to be OPERABLE in MODE I and in MODES 2 and 3. This function ! ( Continued ) must also be OPERABLE in MODES 4 and 5 when HPCF is used to satisfy the requirement that'at least 2 ECCS system be i OPERABLE with RPV Level less than [23] feet above the vessel j flanges. The applicability basis is the same as given for ! RCICandHPCFinLC03.5pndLCO3.5.2. d N% / ,
- 19. Main Steam Line Pressure-Low Low MSL pressure indicates that there may be a problem with ,
the turbine pressure regulation, which could result in a low i ' reactor vessel water level condition and the RPV cooling down more than 100*F/ hour if the pressure loss is allowed to continue. The Main Steam Line Pressure-Low Function is l directly assumed in the analysis of the pressure regulator ! l failure (Ref. 2). For this event, the closure of the MSIVs ' ensures that the RPV temperature change limit (100*F/ hour) is not reached. In addition, this Function supports actions - to ensure that Safety Limit 2.1.1.1 is not exceeded. (This ! Function closes the MSIVs prior to pressure decreasing below , 785 psig, which results in a scram due to MSIV closure, thus reducing reactor power to < 25% RTP.) ! The MSL low pressure data originates in four transmitters that are connected to the MSL header. The transmitters are arranged such that, even though physically separated from each other, each transmitter is able to detect low MSL : pressure. The pressure transmitter signals are digitized and t transmitted to the RPSSDTMs via the EMS. Three divisions of !' Main Steam Line Pressure-Low Function are required to be OPERABLE to ensure that no single instrument failure can IMg preclude the isolation function or cause a spurious isolation. ' i The Allowable Value was selected to be high enough to l prevent excessive RPV depressurization. The Main Steam Line Pressure-Low Function is required to be f OPERABLE in MODE 1 since this is when the assumed transient can occur-. The Function is automatically bypassed when the reactor mode switch is not in the RUN position. (continued) O ABWR TS B 3.3-47 P&R 08/30/93 l l l _ . _ . . _ _ _ ~ ~ ,
SSLC Sensor Instrumentation B 3.3.1.1 p BASES APPLICABLE 20. Main Steam Line Flow--Hioh
^
SAFETY ANALYSIS, . i LCO, and Main St in Flow-High is provided to detect a break of APPLICABILITY the MSL d nitiate closure of the MSIVs. If the steam , ( Continued ) were allowe continue flowing out of the break, the j reactor would depressurize and the core could uncover.' If j the RPVTherefore, water levelhgcreases isolation too far, fuel damage
.is initiated on high coul low g p i occur.
to prevent core damage. The Ma'.n Steam Line Flow-High- ! Function is directly assumed in the analysis of the main i stream line break (MSLB) accident (Ref.1). The isolation action, along with the scram function of the RPS, ensures that the fuel peak cladding temperature remains below the ! i limits of 10 CFR 50.46 and offsite doses do not exceed +be 10 CFR 100 limits. g g g.% 9 The MSL flow data originates in 16 transmitte that ar " - ; connected to the four MSLs. The transmitters are arranged i such that, even though physically separated from each other, all four connected to one steam line can det et high flow. r The flow transmitter signals are digitized q trensmitted ; to the RPStDTMs via the EMS. Three divisions f Main Steam-Line Flow-High Function for each unisolated MSL are l I ' required to be OPERABLE so that no single instrument failure ' [M1IV will preclude detecting a break in any individual MSL or cause a spurious isolation. The Allowable Value is chosen to ensure that offsite dose . limits are not exceeded due to the break. This Function is i required to be OPERABLE in MODES 1, 2, and 3 consistent with : the Applicability for LC0 3.6.1.1, " Primary Containment." t I
- 21. Condenser Vacuum--Low The Condenser Vacuum-Low Function is provided to prevent I
g overpressurization of the main condenser in the event of a ! o/>$ w loss of the main condenser vacuum. Since the integrity of
~~
the condenser ist 2::r;ti0n in offsite dose calculations, the Condenser Vacuum-Low Function is implicitly assumed to be OPERABLE and capable of initiating closure of the MSIVs. The closure of the MSIVs is initiated to prevent the : addition of steam that would lead to additional condenser pressurization and possible rupture of the diaphragm ! installed to protect the turbine exhaust hood, thereby (continued) p V ABWR TS B 3.3-4B P&R 08/30/93
'-- m e-a- , . _r - m _._m ..
SSLC Sensor Instrumentation B 3.3.1.1 BASES l APPLICABLE II . Condenser vacuum-tow (continued) SAFETY ANALYSIS, LCO, and preventing a potential radiation leakage path.ftT1uwing & APPLICABILITY h iden e ( Continued ) Condenser vacuum pressure data originates in four pressure transmitters that sense the pressure in the condenser. The
- pressure transmitter signals are digitized and transmitted g to the_ RPSj DTMs via the EMS. Three divisions of Condenser Vacuum-Low Function are required to be OPERABLE to ensure
/N no single instrument failure can preclude the olation
- g Tur.dion or cause a spurious isolation.
The Allowable Value is chosen to prevent damage to the x condenser due to pressurization, thereby ensuring its integrity for offsite dose analysis. This Function is
'{ " KN ES 4 q _requiredtobeOPERABLEinmode1._consistentwghLCO
-3.6.1.H However, as noted in' footnote -(td,,lo (C4&ws.
\
Table 3.3.1.1-1, the Function is required to be OPERABLE in MODES 2 and 3 only when one or more TSVs are not fully closed, since the potential for condenser overpressurization is minimized. Operator controls are provided to manually bypass the Function. Bypass is automatically prohibited unless all TSVs are closed, the reactor mode switch is not h. d in run, and reactor pressure is low.
- 22. Main Steam Tunnel Temperature-Hiah Main Steam Tunnel (Temperature-High is provided to detect a
-Ng _ leak in the RCPB, anu pr W 4s diversMEy to the highVgteam Q [ine{ low 4 unction. This{udtioniscapableofdetectinga S
1 leak is allowed to continue very small leak. If the without ibolation, mM k%d h a, edit foroffsite these dose limits may instruments be th is not reached en transient or accident analysis in the ABWR SSAR, since bounding analyses are performed for large breaks such as MSLBs. Main steam /T WhM temperature data originates in four temperature transmitters located in the area being monitored. The ; temperature signals are digitized and transmitted to the RPS j and ESF DTMs via the EMS. Three divisions of Main Steam Tunnel Temperature-High Function are required to be l -OPERABLE to_ ensure tMLao_11aaleo instrument failure can
" W IA $M/ C.,\DsWL d C OV \6o A 8 '
- M t. 6t1 g % s Pk % h s Fo Ud cont.inued) l 644 Ge_. h\ g y ,
l .Cm - ABWR TS B 3.3-49 P&R 08/30/93 6 i
SSLC Sensor Instrumentation B 3.3.1.1 BASES i APPLICABLE 22. Main Steam Tunnel Temoerature-Hiah (continued) ] SAFETY ANALYSIS, LCO, and preclude isolation or cause a spurious APPLICABILITY isolation. lctA *
- I'
( Continued ) The Main Steam Tunnel Temperature-High Allowable Value is chosen to detect a leak equivalent to [25] gpm. This l Function is required to be OPERABLE in MODES 1, 2, and 3 ; consistent with the Applicability for LCO 3.6.1.1, " Primary l Containment." , i
- 23. Main Turbine Area Temoerature-Hiah
%w cAA W .% %W Etaturbineareatemperaturei rovided to detect a leak ;
l from the associatMyst= steam piping. This Function is ; ca ! l N,%pable^ of detecting a very small leak If theand smallis leak diverse to the is allowed I tolo'steamlineflowdunction.niinue withFut Tolation, offsite dose limits ma! 4p reached. These Functions are not assumed in any ABWR SSAR transient or accident analysis, since bounding analyses are. i t performed for large breaks. l Main turbine area temperature data originates in four ! temperature transmitters that are appropriately located to l detect potential leaks in the main steam lines. The ; temperature transmitter data is digitized and transmitted to ! __ the RPSaDTMs in each division via the associated EMS. Three divisions of the Main Turbine Area Temperature-High Function ! g,,g are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function or j cause a spurious isolation. l t The Allowable Values are set low enough to detect a leak equivalent to 25 gpm. This Function is required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, " Primary Containment." l 24a. & 24b. Reactor Buildina Area / Fuel Handlina Area Exhaust Radiation-Hiah High ventilation exhaust radiation is an indication of ; possible gross failure of the fuel cladding. The release ! may have originated from the containment due to a break in ! the RCPB or from the refueling floor due to a refueling i J (continued) ABWR TS B 3.3-50 P&R 08/30/93
?
l i I L _ i
C Sensor Instrumentation e,. 6 QT $ i .i 4.Aco c c.e4 (AM p q M S C d 6 W Use.hv6 iowsTo a45 M e-D BASES % wL%_.-651'.% Jptcl. W w.w,c+,) 6epAe. h.g, J APPLICABLE j 24a. & 24b. Reactor Buildino Area / Fuel Handlino Area Exhaust SAFETY ANALYSIS Air Radiation-Hioh (continued) LCO, and APPLICABILITY t accident. When Exhaust Air Radiation-High is detected, ( Continued ) valves whose penetrations communicate with the containment tmos h re are isolated to limit the release of fission pro ucts. Additionally, this Function is assumed to initiate isolation of the containment during a fuel handling accident (Ref. 2). The Exhaust f hRadiation-High
~. V signals are initiated from radiation detectors that are located on the ventilation 4 % N - exhaust h coming from the monitored areas. There are four radiation detectors in each area which are connected to the four independent PRRM divisions. Trip signals from the PRRM divisions are sent to the ESF DTMs in the same division. Three divisions of Exhaust Air Radiation-High are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function or cause a spurious isolation.
The Allowable Values are chosen to promptly detect gross failure of the fuel cladding and to ensure offsite doses (Q/ remain below 10 CFR 20 and 10 CFR 100 limits. , This function is required to be OPERABLE in MODES 1, 2, & 3. In addition the Function is required to be OPERABLE during CORE ALTERATIONS, operations with a potential for draining the reactor vessel (OPDRVs), and movement of irradiated fuel assemblies in the primary or secondary containment because the capability of detecting radiation releases due to fuel failures (due to fuel uncovery or dropped fuel assemblies) must be provided to ensure offsite dose limits are not exceeded.
- 25. RCIC Steam Line Flow-Hioh The RCIC Steam Line Flow-High Function is provide to detect a break of the RCIC steam lines and initiate closure of the RCIC steam line isolation valves. If the steam is allowed to continue flowing out of the break, the reactor will depressurize and core uncovery can occur. Therefore, the isolation is initiated on high flow to prevent core damage. Specific credit for this Function is not assumed in any ABWR SSAR accident analyses since the bounding analysis I
(] (continued) ABWR TS B 3.3-51 P&R 08/30/93
i l ! SSLC Sensor Instrumentation B 3.3.1.1 I BASES APPLICABLE 25. RCIC Steam Line Flow-Hiah (continued) SAFETY ANALYSIS, LCO, and is performed for large breaks such as MSL breaks. However, APPLICABILITY these instruments prevent the RCIC steam line break from ( Continued ) becoming bounding. The RCIC Steam Line Flow-High data originates in four transmitters that are connected to the RCIC steam lines. The ' transmitter signals are digitized and transmitted to the ESF DTMs via the EMS. Three divisions of W C Steam h A c__ Flow-High Function ( are required to be OPERABLE to ensure that no single instrument failure can preclude t isolation en or cause a spurious isolation. w'.t. a.,.e g l The Allowable Value is chosen to be low enough to ensure l that the trip occurs to prevent fuel damage and maintains the MSLB event as the bounding event. This Function is required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LC0 3.6.1.1, " Primary Containment."
- 26. RCIC Steam Sucoly Line Pressure-Low Low RCIC steam supply line pressure indicates that the
' pressure of the steam in the RCIC turbine may be too low to continue operation of the turbine. This isolation is for equipment protection and is not assumed in any transient or accident analysis in the ABWR SSAR. However, it also provides a diverse signal to indicate a possible system break. These instruments are included in the Technical Specifications (TS) because of the potential for risk due to possible failure of the instruments preventing RCIC initiations.
The RCIC Steam Supply Line Pressure-Low data originates in feur pressure transmitters that are connected to the system steam line. The transmitter signals are digitized and transmitted to the ESF DTMs via the EMS. Three divisions of
't,he, RCIC Steam Supply Line Pressure-Low Function ( are required to be OPERABLE to ensure that no single instrument failure can preclude isolation fu .
or cause a spurious isolation. N.W. , % The Allowable Value is selected to be high enough to prevent damage to the system's turbines. This Function is required (continued) ABWR TS B 3.3-52 P&R 08/30/93
SSLC Sensor Instrumentation . B 3.3.1.1
! BASES APPLICABLE 26. RCIC Steam Sucolv Line Pressure-low (continued) -
SAFETY ANALYSIS, LCO, and to be OPERABLE in MODES 1, 2, and 3 consistent with the APPLICABILITY Applicability for LC0 3.6.1.1, " Primary Containment." ( Continued ) 2 A. RCI Turbine Exhaust Diaohraam Pressure-Hiah heagm pressur indicates that the Hig\s re m gre be \turbi 00 high to eontinue ex aust ope ationdiap\ of the RCIC rbin . T t is, one of two exhaust dia ragms has-ru ture and ress e is reach gg turbine sing pressure lim'ts. This isolat'on is for e uipment pro ction and is not ssum in any t sient or a cident anal fis in the BWR SAR. Theh inst ments are 'ncluded in t e TS because o( th poted ial or ri due to po sible failur of the initruments eve ting R C initiati s (Ref. 3). The IC Turbi e Exhaust D phragm Pres ure-High da a
, origi te in f ur tegnsmitt rs that are onnected to the '
turbine exh ust y oiN % be we Tn thekvision line. uptQre diap. I add agms divis on thS(Lys each recee n II ESF t p dat f m two f tn turbin exhaust pr ssure O tr for mitt s. Two-o two solatio logic is u d in the SL is F ct on. Turbin Exha st laph r trumen tion chann is of RCIC m P'ressure- igh Functi s are av ilab an gar requ ed 16 be OPER BLE to ens e that no sin e in tru nt allu can reclude he isolat n ; func on o cau e a spuri s is lation. T\h Al W abl Val es re the tystem's turbi es. hig eno htoprzentdamage o 3.7
$&. RCIC Eouipment Area Temperature-Hiah
[k ( RCIC equipment area temperatures are provided to detect a leak from the associated system steam piping. This Function is capable of detecting a very small leak and is diverse to the high flow Function. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. These Functions are not assumed in any ABWR SSAR transient or accident analysis, since bounding analyses are 1 performed for large breaks such as MSL breaks. (continued) ABWR TS B 3.3-53 P&R 08/30/93 i
SSLC Sensor Instrumentation B 3.3.1.1 BASES a78. RCIC Eauipment Area Temoerature-Hiah (continued) APPLICABLE SAFETY ANALYSIS, LCO, and RCIC equipment area temperature data originates in APPLICABILITY temperature transmitters that are appropriately located to ( Continued ) detect potential leaks in RCIC steam lines. The temperature transmitter data is digitized and transmitted to the ESF DTMs via the EMS. Three divisions of the RCIC Equipment Area Temperature-High Function art required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function or cause a spurious isolation. The Allowable Values are set low enough to detect a leak equivalent to 25 gpm. This Function is required to be OPERABLE in MODES 1, 2, and 3 consistent with the p pom Applicability for LCO 3.6.1.1, " Primary Containment." t Ae -4 %
- 29. CVW Differential Flow-Hiah The high differential flow signal is provided to detect a break in the CUW System. This will detect leaks in the CUW System when area temperature would not provide detection O (i.e., a cold leg break). Should the reactor coolant d continue to flow out of the break, offsite dose limits may be exceeded. Therefore, isolation of the CUW System is initiated when high differential flow is sensed to prevent exceeding offsite doses. This Function is not assumed in any ABWR SSAR transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.
Differential mass flow is calculated in the DTH in each ESF division as the sum of the return and blowdown flows subtracted from the suction flow. In order to avoid spurious trips due to transient flow conditions, the flow mismatch must persist for a specified time period before a trip is declared. The mass flow value for each of the three flows is calculated from differential pressure and temperature data associated with each of the flows. The data for the differential mass flow calculation originates in three differential pressure transmitters and three temperature I transmitters in each division (total of 12 each type). The l sensors are arranged to maintain adequate divisional l separation while providing a representative measurement of flow and temperature in the three flow paths. The G (continued) (O ABWR TS B 3.3-54 P&R 08/30/93 l l
SSLC Sensor Instrumentation B 3.3.1.1 BASES APPLICABLE 29. CUW Differential Flow-Hiah (continued) SAFETY ANALYSIS, LCO, and differential pressure transmitter and temperature APPLICABILITY transmitter data is digitized and transmitted to the ESF ( Continued ) DTMs via the EMS. If the calculated flow difference is too large, each DTM generates an isolation signal. Three divisions of the CUW Differential Flow-High Function are required to be OPERABLE to ensure thct no single instrument failure can preclude the isol. tion function or cause a spurious isolation. Three differ ential pressure SENSOR CHANNELS and three temperature SENSOR CHANNELS must be OPERABLE in a division in order for the Function to be OPERABLE in the division. Therefore, a failure in any one of the six sensors in a division will result in the Function being declared inoperable in the division. The CUW Differential Flow-High Allowable Value ensures that the break of the CUW piping is detected. The Allowable Value of the persistence time is selected to ensure that the MSLB outside containment remains the limiting break in the ABWR SSAR analysis for offsite dose calculations. This Function is required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LC0 3.6.1.1, " Primary Containment."
- 30. 31. & 32. CVW Area Temoeratures-Hiah Ambient and Differential CUW Area Temperature-High functions are provided to detect leaks in the CUW System.
These Functions are capable of detecting very small leaks and - for the hot portions of the CUW system - are diverse to the high differential flow instrumentation. If the small leak continues without isolation, offsite dose limits may be reached. Credit for these Wt'm enttJs not taken in any transient or accident analysis in the ABWR SSAR, si % bounding analyses are performed for large breaks such as %b, u MSLBs. CUW area temperature data originates in temperature elements that are located in the room that is being monitored. There are twelve temperature transmitters that provide input to the CUW Area Temperature-High Functions (four per area). The temperature data is digitized and transmitted to the DTMs via the EMS. Three divisions are required to be (continued) ABWR TS B 3.3-55 P&R 08/30/93
SSLC Sensor Instrumentation 't B 3.3.1.1 f BASES ! APPLICABLE 30. 31. & 32. CUW Area Temoeratures-Hioh (continued) l SAFETY ANALYSIS, _ LCO, and OPERABLE to ensure that no single instrument failure can APPLICABILITY -ti= pr cause a spurious ; ( Continued ) preclude isolation tgisolation f=dC'.@m 6 The CUW Area Temperature-High Allowable Values are set low enough to detect a leak equivalent to 25 gpm. @ g Th5-rD O -
%. RHR Area Temoerature-Hich RHR Area Temperature-High is provided to detect a leak from NoDg p the associated system steam piping when the RHR is in the ,
shutdown cooling mode. This Function is capable of detecting l p a very small leak. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. , These Functions are not assumed in any ABWR SSAR transient i or accident analysis,'since bounding analyses are performed - l for large breaks such as MSLBs. , RHR Area Temperature-High data originates in temperature ! i transmitters that are appropriately located to detect leaks in RHR equipment. Four instruments monitor each of the three RHR areas. The temperature transmitter outputs are I digitized and transmitted to the ESF DTMs via the EMS. Three divisions of RHR Area Temperature-High Function are required to be OPERABLE to ensure that no single instrument ti n or cause a : failure spuriouscan preclude tgisolation isolation, tA t=iMW This Function is only required to be OPERABLE in MODES 2 and 3 since these are the modes where the shutdown cooling mode ,
~
cf the RHR is used. The Allowable Values are set low enough to detect a leak equivalent to 25 gpm. -
- 34. CUE \Isolatidw on SLCNnitiati The\ sol t n of th CUW Sy emisreqhtredwhen s
t.C Syste has een init edtopMyentdilhionandremov'a(of he bo n solution by CUW Syh (Ref. . SLC' System y in1tiati signQsorigi e from two SL ump start N ; signals.T SLC pqmp A sta signal Aconnec td,to the \ e divisi % I LU and thea pump B (galtothedivisNonIISLU l (continued) ABWR TS B 3.3-56 P&R 08/30/93 I a , ., , . - , - ,
l SSLC Sensor Instrumentation . B 3.3.1.1 l ( BASES APPLICABLE 34. CUW isolation bn SLC Initia\ ion (contidued) SAFETY ANALYSIS, '
\ \ \
LCO, and APPLICABILITY The ata is\ shared betweenisdivis\ CUW i' solation occurs w en either p runni ion via suitahle is s
. 1
( Continued ) N \ . sunction i Thb[e is'no Allgwable Va ge associat with this since it i's mechh ically attuated baseksolely on e , position of he SL System itiation switch. - kwo cha nels ne f m each puta Initiatior . F' unction are r quire \to be OPE'p) BLE onlyof ithe MODES S 1 an'd 2, sin'ce the e are he only MODES w re the rea or can be . crittSal, and th se MODE 6 are con .4 stent with the Applidability for the SLC System (R0 3.1.7). WW 15 hlL
- 35. 30. 37 & 10. ADS Division I/ Division II ECCS Pumo
<?A Discharae Pressure-Hiah (Dermissive) {g j The Pump Discharge Pressure-High signals from the LPFL and .
HPCF pumps are used as permissives for ADS initiation to provide confidence that there is a source available to restore vessel water inventory prior to initiating reactor
.O blowdown. This function is assumed to be OPERABLE and capable of permitting ADS initiation during the events analyzed in References 1 and 8. For these events, the ADS i depressurizes the reactor vessel so that the low pressure i l
ECCS can perform the core cooling functions. The core l cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature j remains below the limits of 10 CFR 50.46. Pump discharge pressure data originates in two pressure - transmitters on the discharge side of each of the three low pressure and two high pressure ECCS pumps. Th data from one transmitter on each pump is sent to the ESF T associated with ADS 1 and the data f 4mthesecondtransmiteroneach The logic pump is sent to the ESF TM associated with ADS . will declare an ADS perm si 'f any one of the 5 pressure values are above their respective points. The Pump Discharge Pressure-High Allowable Value is less than the pump discharge pressure when the pump is operating l in a full flow mode, and above the maximum expected pressure that can occur when the pumps are running and the valves are (continued) sO ABWR TS B 3.3-57 P&R 08/30/93-l t . - - - - - - _ _ , .-
l SSLC Sensor Instrumentation B 3.3.1.1 BASES APPLICABLE 34. 35. 36. 37 & 38. ADS Division I/ Division 11 GCS Pumo SAFETY ANALYSIS, Discharae pressure-Hiah foermissive) (continued) LCO, and APPLICABILITY aligned for injection. The actual operating point of this ( Continued ) Function is not assumed in any ABWR SSAR analysis. Three ECCS Pump Discharge Pressure-High SENSOR CHANNELS in
- an ADS division are required to be OPERABLE to provide !
. confidence that no single instrument failure can preclude ADS initiation on a valid condition. The SENSOR CHANNELS are i required to be OPERABLE when the ADS is required to be !
OPERABLE. Refer to LC0 3.5.1 for ADS Applicability Bases. 3d\&40.DrywellSumo rainLineLCW/HCkRadiation-Hiah The d wel drairg lines the r dwaste s tem are monitored fgr h h\ rad 41 tion using o e detector in e Sh of the drain l lines. }{igh activity g in theNrain li'nes coul result < in ! gexc'essivesiadica tiv(ty in thi radwaste coll tion t'anks. If i the high attivit low ontinukswithougisol ion, offsite. s be ea j dbs,e limits %'ay' ion d. ThihxFunctior(also rovides edit s fpra divs e\indic'at f pr rqary coo' ant actiyity. ; g these s'truments t s is' hot th en in y trans'ent o accident t analysi
^
l' the ABWR S R. r\ tor are\\ The detec\ connec d to the PRRMss ystem which sends a ! tri'ps signal the d$sich 13 Si't). The Allowabl6svalue is [ belected to be onsistertt wqh pr'inary k coblant acjivity lhuits.'Qne cha, el of bhch o{ the unctio is required o be'D ERABL%in H DES 1, Zh ant 3 co istent ith the Appl (icability for LC0 3.6 4 1, "Pri ary Cont inment." ACTIONS A Note has been provided to modify the ACTIONS related to SSLC instrumentation channels. Section 1.3, Completion i Times, specifies that once a Condition has been entered, subsequent trains, subsystems, components, or variables > expressed in the Condition, discovered to be inoperable or not with^n limits, will not result in separate entry into ; the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for , inoperable SSLC instrumentation provide appropriate l compensatory measures for multiple inoperable channels. As + (continued) : 1 ABWR TS B 3.3-58 P&R 08/30/93 f I { l. I
,-9 - .,---m-, y ,,,,~,
. _ = . . . .
i I l l SSLC Sensor Instrumentation B 3.3.1.1 g l l BASES ACTIONS such, a Note has been provided that allows' separate ( Continued ) Condition entry for each inoperable SSLC instrumentation i channel. l Note that some of the conditions have placing a channel in : trip as an allowable action. This causes the initiation logic to become 1 out of 3 which provides adequate plant - protection but increases the vulnerability to spurious ' initiations. This actio should be used with caution on Functions that initiate SLC (3 & 7) because a spurious SLC actuation could cause a elay in plant restart. A.1. A.2.1. A.2.2. A.2. and A.2.4 NS5@ A SENSOR CHANNEL is considered to be OPERABLE when all
' o mci;;r -+rumante H tvi;;s required to previi. the f
*N results of a trip calculatiorg . th; *irien: that use the data from the channel.are OPERABLE. If any LOGIC CHANNEL 5pc o *M9 A .that uses the trip data from a SENSOR CHANNEL does not.
receive valid data then the channel is considered to be UeP inoperable. ; Notes are included in the LCOs for these Actions so they are f applied only to those Functions that have four SENSOR ' CHANNELS. For these Functions, a failure in one SENSOR - g'g@ig l l CHANNEL will cause the tWriogic to Decome-in or 2/3 depending on the nature of the failure ( i.e failure which causes a channel trip vs. a failure which does not cause a e channel trip). Therefore, an additional single failure will not result in loss of protection but could cause a spurious initiation of a protective action fcr additional failures ! that result in a tripped condition. . g p i he btwNc:: Action A.1 forces a trip condition fcom the SENSOR CHANNEL i which causes the initiation logic to become 1/3 for the > l specific Functions that are placed in trip. In this 1 condition a single failure will not result in loss of ; protection. This Action is applicable when more than one - i Function has a single inoperable SENSOR CHANNEL without ; regard to the divisions containing the failed channels. In ; this condition, the availability of the Function to provide l a plant protective action is at least equivalent to the 2/4 ; trip logic. Since plant protection capability is within the . design basis no further action is required when the !
~
inoperable SENSOR CHANNEL is placed in trip. l (continued).
, ABWR TS B 3.3-59 P&R 08/30/93 f
i SSLC Sensor Instrumentation l B 3.3.1.1 r BASES
- h;d -
l 3 - l ACTIONS A.I. A.2.1. A.2.2. A.2.3 and A.2.4 (cont inued) l ( Continued ) Action A.2.1 bypasses all SENSOR CHANNE i, except the NMS, i in the division containing t noperabl SENSOR CHANNEL. . This causes the logic for a unctionsM i o become 2/3 so a _ ] single failure will not res 1 inJossofprotectionor
't cause a spurious initiation.Niowever, the degree of redundancy is reduced. As indicated by note in the LCO, Qb'6 :
i 9
,g this action is not applicable to the NM Ihis acT. ion- be :
p implement for single SENSOR CHANNEL failures in multiple l t Functions ly when all failures are in the same division. ! I Act A.2.2 - similar to Action A.2.1 but applies only to { th NMS uncti ns as indicated by a note in the LCO. The NMS l h tr p 10 c in 11 NMS divisions then becomes 2/3 and remains as 2/JLin th SSLC. In this condition a single failure will 7 y not resu in loss of protection or cause a spurious , initiation. 2 The APRM portion of the NMS is bypassed or tripped on a , division basis. The.SRNM, however, is bypassed or tripped. d by tripping or bypassing the individual sanenr channels. k _ Bypass must be accomplished using the three hKNrl bypa's3
'O
[ ' switches as described iWem.ticr.14, amHn This d arrangement also prevents bypassing all Division II sensors;
- therefore, failure of all Division II sensors requires d taking the trip action. For the SRNM, any inoperable d' channel must be bypassed even if the associated SSLC S
# division remains OPERABLE. The requirement for the
- 6 individual tchannel bypass is controlled by LCO 3.3.3.1 U..J.,1 5% .
The Co Ametion Time of six hours for implementing Actions M' A.1, A.2. P, A.2.2 is based on providing sufficient time for o4 l the operator to determine which of the actions is appropriate. The Completion Time is acceptable because the t. 6 g % c5 probability of an event requiring the Function coupled with s%
~
a f ailure in T.ec ot h =v- SENSOR CHANNElliy:::c t ht d d th N p s.g . ' occurring within that time period is quite low. l Action A.2.3 restores all required SENSOR CHANNELS for the ; l Function to the OPERABLE status following completion of l
. Action A.2.1 or A.2.2. Action A.2.4 provides an alternate to A.2.3. Both of these Actions place the SSLC within the SSLC availability design basis. Implementing Actions A.2.1 or A.2.2 provides confidence that Plant protectirn is maintained given an additional single failure and the SSLC (continued)
ABWR TS B 3.3-60 P&R 08/30/93
I SSLC Sensor Instrumentation . B 3.3.1.1 ! B'ASES j l ACTIONS A.l. A.2.1. A.2.2. A.2.3 and A.2.4 (continued) l ( Continued ) self-tests will detect most failures, so operation in this condition for 30 days is acceptable. Also, the PRA analysis ; has shown that the change in core damage frequency is
- negligible with three instead of four OPERABLE divisions of sensors.
Note 1 for Action A.2.4 requires that the bypass implemented per Action A.2.1_or A.2.2 be removed after implementing Action A.2.4. This is necessary to restore the SSLC to within_ its availability design basis. Note 2 is included to e 1;Ws; g permitJrc:ter:tkn of the bypass for a limited period to permit repairs. Note 3 is included to permit placing a
** j division in division of sensors bypass even if the division contains SENSOR CHANNELS that were =n=Ftripped due to previous entries into the condition. Placing a division in division of sensor bypass masks any SENSOR CHANNEL manual trips in the division. This configuration is acceptable for the period of time that a division of sensor bypass is permitted under other actions of condition A.
B.l. B.2.1. B.2.2 and B.3 Condition B occurs when two SENS ELS for the same Function become inoperable for t func ions that have a SENSOR CHANNEL in all four divisi A. this condition the initiation logic could be 2/2 so a ngle failure would cause loss of initiation from the Function. Placing one of the failed SENSOR CHANNELS in trip (Action ' B.1) causes the trip logic to become 1/2 so a failure in an additional SENSOR CHANNEL for the function will not_ prevent l i initiation of a protective action from the Function. The three hour Completion time for this Action provides sufficient time for the operator to implement the Action. , Operation for this amount of time does not contribute si nificantly to plant risk because the arobability of an dhMd event requiring the Function, coupled wit 1+a-stng4Jailure in one of the remaining channels for the Function, within the time period is quite low. ; 1 Action B.2.1 requires placing the division containing the j second failed SENSOR CHANNEL in division of sensors bypass j for those Functions given in the LC0 note. Action B.2.2 (continued) 4 O P&R 08/30/93 ABWR TS B 3.3-61
i l SSLC Sensor Instrumentation B 3.3.1.1 l 1 BASES ACTIONS B.1. B.2.1. B.2.2 and 8.3 (continued) ( Continued )
%*d* requires aFeirtorming similar action for inoperable dr+' action will prevent NMS a change channels.
in status of : the inoperable channel from causing a spurious initiation of i a protective action. A Completion Time of 6 hours is permitted for these actions. The probability of the failed i channel causing a spurious initiation during this time period is quite low. Action B.3 restores at least one of the failed channels to OPERABLE status. A Completion Time of 30 days is permitted for this Action. The Completion Time is based on the low : probability of an undetected failure in both of the OPERABLE l channels for the Function occurring in that' time period. The self-test features of the SSLC, NMS, and EMS provide a high degree of confidence that no undetected failures will' occur ! in the allowable Completion Time. Multiple entry into the conditions uses Condition A to be invoked on completion of Action B.3 so appropriate , additional action is taken. ;
'O C.1 & C.2 This Condition applies when three SENSOR CHANNELS for the i 1
same function become inoperable for those Functions-that have four SENSOR CHANNELS. This Condition represents a case where automatic protective action from a Function is 1/1 (one of the channels fails in a tripped state) or is completely unavailable. l Action C.1 causes the initiation logic to become 1/1 so a ! protective Action from the Function is still available but the single failure criteria for automatic actuation is not met. However, other diverse trip parameters are available, including manual initiation. Action C.2 causes restoration of a second channel. for the function so the initiation logic becomes 1/2 and plant-protection is maintained for a single additional failure. f The six hour Completion Time-for C.2 provides a reasonable amount of time to effect repairs on at least pn of the inoperable channels and avoid the risks associated with plant shutdown. ) sg ' (continued) l ABWR TS B 3.3-62 P&R 08/30/93 l l
, .i
i j I j SSLC Sensor Instrumentation ' B 3.3.1.1 - I. a BASES ACTIONS C.) & C.2 (continued) ( Continued ) Multiple entry into the conditions causes Condition B 3 to be invoked on completion of Action C.2 so appropriate > < additional action is taken. i u D.1 & D.2 This Condition applies when all of the SENSOR CHANNELS for i the same function become inoperable for those Functions that have four SENSOR CHANNELS. This Condition represents a case-where automatic protective action from a Function is completely unavailable. However, other diverse trip ; parameters are available, including manual initiation. : Although Action D.1 does not restore the initiation ; capability from the Function it is required so that the logic wili become 1/1 when Action D.2 is completed. Action D.2 causes restoration of at least one channel for the Function which causes the initiation logic to become 1/1 so protective action for the Function-is restored. The one
'O %
hour Completion Time for D.2 provides some amount of time to effect repairs on at leaseso of the inoperable channels and avoid the risks associated with plant shutdown. Plant i operation in this condition for the specified time does not ' contribute significantly to plant risk because the probability of an event requiring the Function within the Completion Time is quite low. Multiple entry into the conditio t M auses Condition C l' to be invoked on completion of Action D.2 so appropriate additional action is taken. j f.d - Required Action E.1 directs entry into the appropriate Condition referenced in Table 3.3.1.1-1 if the Required i Action and associated Completion Times of Conditions A, B, ; C, or D are not met. The applicable Condition specified in .
~
the Table is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time the entry i condition is met, Condition E will be entered for~that l (continued)
'O ABWR TS B 3.3-63 P&R 08/30/93 6
,--, _ , , i-,,---ne, y -,-
i SSLC Sensor Instrumentation B 3.3.1.1 i BASES ACTIONS El (continued) , ( Continued ) channel / division and provides for transfer to the - appropriate subsequent Condition. f.J. l As noted in the LCO this action applies only to the ADS , permissive functions from the ECCS pump discharge pressure. ! This condition occur; when one or two of the ECCS pump , pressure permissive SENSOR CHANNELS associated with an ADS division become inoperable. The logic for the ADS permissive will change from 1/5 to 1/4 or 1/3. Therefore, a high degree , of p ndancy is maintai d EP3 4 CVS U p 4 i Action F.1 restores all required SENSOR CHANNELS for the Function to the OPERABLE status. All divisions of ADS , initiation logic remain OPERABLE for this condition and a single failure will not result in loss of protection. In l addition, the self test features provide confidence that anywc1T. J additional failures will be automatically detected. This is ; an acceptable long term condition so the Completion Time r specified for repair corresponds to a maximum time equal to i the refueling interval. However, the LC0 requires the repairs to be completed if a cold shutdown occurs prior to i the next refueling outage. t l G.1 l As noted in the LCO this action applies only to the ADS ) l permissive Functions from the ECCS pump discharge pressure. ! This condition occurs when three of the ECCS pump pressure permissive SENSOR CHANNELS associated with an ADS division j become inoperable. For this condition the logic for the ADS permissive becomes 1/2 so the degree of redundancy is reduced to some extent. However, All divisions of ADS initiation logic remain OPERABLE for this condition and a single JAilure will not result in loss of automatic ADS initiation. Sli p.s g c u p p g I Action G.l'J ^ --
" 'eW " -- ' " r equireu 5En50R
-CLiEL5 for-the Textien te the CJERABLE etetus. The completion time of 7 days is based on the low probability of undetected failures in both of the OPERABLE channels for the L5 4 6 wi$ =a L. A.M. C m ed %,5 WG
~
Ot NM o t' E%.A hWi 5 Elv.0 9. CHNPM6 (continued) ABWR TS 3.3-64 P&R 08/30/93 l l j
SSLC Sensor Instrumentation B 3.3.1.1 BASES ( ACTIONS M (continued) ( Continued ) Function occurring in that time period. The self-test features of the SSLC, NMS, and EMS provide a high degree of ; confidence that no undetected failur s will occur. i M 3 O e multiple entry to the conditio t;.t': ': r = ired, be% completion of Action G.l M cause5 Condition F to be nd appropriate ection taken, U m . As noted in the LC0 this action applies only to the ADS permissive Functions from the ECCS pump discharge pressure. This condition occurs when four of the ECCS pump pressure .j permissive SENSOR CHANNELS associated with an ADS division become inoperable. For this condition.the logic for the ADS permissive becomes'l/l so a single failure in the remaining OPERABLE SENSOR CHANNEL for.the function will cause loss of automatic ADS initiation. Action H.10 re h n et 1 n d te Of th M Equired SENSDR
;O (C"ANNELS-for the rur.ctivi Lu the GFE 30LC states. The completion time of 24 hours is based on the low probability i of undetected failures in the remaining OPERABLE channel for the function occurring in that time period. The self-test !
features of the SSLC, NMS, and EMS provide a high degree of ! confidence that no undetected failures will occur. ] l
- hN.5 %CC c-uz.h U v',5 i o n o4 ADsTa_t & i i ** -
W h C) otr=A4Qt g { Epso g c.u pp g,4 l As noter' in the LC0 this action applies only to the' ADS permissi.e Functions from the ECCS pump discharge pressure. This condition occurs when all of the ECCS pump pressure permissive SENSOR CHANNELS associated with an ADS divisio_n_ become inoperable. For this Condition automatic ADS initiation for the associated division becomes unavail ble. Action 1.1 causes the associated ADS division to be declared inoperable, which will cause the LCO for in able ADS d v gjo g tog g voked 3 Q a.ytnt6 db QsMg j This Action is also invoked if the completion times of Actions F, G, or H are not met. (continued) ABWR TS B 3.3-65 P&R 08/30/93 I I
.- e- . _ . . . . .
i SSLC Sensor Instrumentation B 3.3.1.1 BASES ACTIONS ( Continued ) J.l. K.1. L.1 and N.1 i 4.y'ind action for Cond tions A, 5-Gn or D are not if the we uif implementedwik{ildhespecifiego'm' pl eti timps, the plant must be placed in a MODE or oth specifie 4.oridition in which the LCO does not apply. The Completion Times are reasonable, based on operating experience, to reach the l specified condition from full power conditions in an orderly t manner and without challenging plant. systems. In addition, l the Completion Time of Required Action J.1 is consistent with the Completion Time provided in LC0 3.2.2, " MINIMUM CRITICAL POWER RATIO (MCPR)." U fle p d or D are not If the gicif;cd ktion for Conpi ns A, l implemented within the specifie pletic s, the plant i must be placed in a condition i(d ch the oes not apply. This is done by immediately initiating action to insert all insertable control rods in core cells containing~ , one or more fuel assemblies. Control rods in core cells ! containing no fuel assemblies do not affect the reactivity
- of the core and are, therefore, not required to be inserted.
Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully i sad ad - hh 9,,c o p '. d b6L b.5 ud MEON l Gew p \e t.*, o w v t lim,4 % Cw &t C *55 (Qw i U D a.Pe. (eT,. wC (oP 7 WV MbW5 , This Action appliesk ir.:,tr==t ti= Nt M used to isolate specific flow paths. l If the Function is not restored to OPERABLE status or placed i in trip within the allowed Completion Time, plant operation may continue if the affected penetration flow path (s) is j isolated. Isolating the affected penetration flow path (s) : accomplishes the safety action of the inoperable function. For some of the Functions, the affected penetration flow j path (s) may be considered isolated by isolating only that portion of the ystem in the associated room monitored by , the inoperabl ,f,unc ion. ;
'- l l
(continued) O ABWR TS B 3.3-66 P&R 08/30/93 i
SSLC Sensor Instrumentation 8 3.3.1.1 BASES The Completion Time is acceptable because it minimizes risk ACTIONS while allowiN, sufficient time for plant operations ( Continued ) personnel to isolate the affected penetration flow path (s). P.l. P.2.1. P.2.2. and P.2.3 [w If2 the Function is not restored to OPERABLE status or placed in trip within the allowed Completion IimL_t_he associated"Ng penetration flow path (s) simtrWbeTolated (RequiredIs Action P.1). path (s) accomplishes the safety action of the inoperable Function.4 Alternately, the plant must be placed in aIf applicable, condition in which the LCO does not apply. CORE A Suspension of these must be immediately suspended. activities shall not preclude completion of movement of a component to a safe condition. -Also, if applicable, action must be immediately initiated to suspend OPDRVs to minimizeA ot.', the probability of a vessel drain down and subsequenmust ; potential for fission production release, continue until O I applies only to Function 24 since this is the only function required while moving fuel assemblies in the containment. 9.:.1 This Required Action is intended to ensure that appropriate ' actions are taken if multiple, inoperable, untripped SENSOR CHANNELS for the same function results in a complete loss of automatic transfer of the suction from the condensate
^ storage tank to suppression pool for the HPCF and RCIC.
# Automatic transfer capability is considered 17 to be andlost 18 are if
{5" g't ,g the Required Actions acolicable_to FuAntti Inei+ not met within ine T owable Completlon Timte. A., Q er O / (iEsbeofmanually automatic suc44cn war) the-46 tended j situeuun must Function implamantad H t ha r ect4en -eatmot "be inivi e6 As noted, the Required Action is only applicable if the HPCF or RCIC pump suction is not aligned to the suppression pool, since, if aligned, the Required Action is already performed. f If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time in Action A, B, C or D, the suction source must be aligned to the (continued) P&R 08/30/93 B 3.3-67 ABWR TS __ .~. _ . .
SSLC Sensor Instrumentation B 3.3.1.1
!( BASES ACTIONS L1 (continued)
( Continued ) suppression pool which performs the intended function of the channel shtf ing th ut ion source to the suppression pool). T e go pletio Jime rovides sufficient time to will allow operatic h \ @- perform t peration h continue. Measures s W taken to ensure that the HPCF and RCIC System piping remains filled with water while the suction is aligned to the suppression pool. fL.1 Required Action R.1 is intended to ensure that appropriate actions are taken for multiple failures in devices that affect one or more of the available ECCS systems. The affected Functions are those Functions with four SENSOR CHANNELS that effect either the low pressures systems only or the high pre ure ystems only. The inoperable SENSOR CHANNELSfortef'un ions covered by this action may result in loss of auto initiation capability for the associated feature (s). In this situation, the feature (s) associated with the inoperable channels be declared q inoperable within 1 hour. The Completio 4.ime is based on providing a reasonable amount of time t Est lish which features are associated with the inoperab e Function. Declaring the supported features inoperable will cause entry intp the LC0 that is appropriate for the inoperable Feature. Su ' & h % 4e y 442e Q wu W T,1,% j L.1 L4 WMh Required Action Q is not completed within its specified Completion Time, the associated feature (s) may be incapable i of performing the intended function so the supported feature (s) associated with the inoperable untripped channels must be declared inoperable immediately. Om l
\\ \ n S TisConditionaddressesSENSORCHANNE(failuresforN
\\
l fuhqtio'ns that9 ave ohly one o'ritwo channels. For 'these l Func ons\a failu in h ngle 5ENSOR CRANNEL cause's t'he prot t ve %ction eqic t h me 'l is%pletely l (continued) ABWR TS B 3.3-68 P&R 08/30/93 l l l \
SSLC Sensor Instrumentation i B 3.3.1.1 ! ( l BASES i f ACTIONS L.1 (continued) l i ( Continued ) \ \ t un)kailable. for utomaticpkte Id this cond,ition the siive kction Jefailurecriteria i actua l i 7hesNitationiss'imiartovonditionH,hsnotmet. N \ sosthe completion ti'me to r storesthe'\lnop'erabl channels isxth same as for ! acti'o H.l. \ \ \
' t N 'N ,
As noted, thi Action applies s
\oni toFunctio\ ns.32, 35, & 36 i since thes ar the functipns With ne or two SENS S HANNELS. \ \
x ,
\ -
l M N Required gtionx .1 U
\s\ k x ir ts ' entry into the sappropriate. \
s
\
N , C ndition spe Qfied s in Ta(b1q 3.3.1.11ondition is Funr. tion and MODE r&(erenge s or pther specif t d eqnd (ion \dep'enden and m'ay\ change as the ; Reqdired Action o evT us (onditio' nth %ted. Each {scomp\beenmet j time hqy Required ti(ogo Cond o as not ; 1' within the associated Co tion egCon'd ! entered f6T and prov(tion'y ides fo ill be l x the inoperabl {unctio s transfertotQeappropriateiubsequentConditfon. , 1,l % 3 A) V .1, V ,1 - Y.! V ? W . and N bN k
*L%c3 \@>- -
If the specified number of OPERABLE channels / divisions are i not restored to OPERABLE status within the allowed . Completion Time, the plant must be placed in a MODE or other Y
~
specifiea cond6 the RPfrTw does not apply.N This is done by placing the plant in at least MODE 3 within 12 hours and in MODE 4 within 36 hours. The Completion Times are reasonable, based on operating experience, to g reach the required plant conditions from full power
~ wnJ44 ens in an orderly manner and without challenging l
plant systems, r mo nd (continued) ABWR TS B 3.3-69 P&R 08/30/93 1 L
SSLC Sensor Instrumentation B 3.3.1.1 : BASES V .b U.1.h 1 i ACTIONS 4. i . W . .4 . and-" U . 2 ,. A 2- 1. b N b b.J ( Continued ) . ) If the Function is not restored to OPERABLE status or placed ' in trip within the allowed Completion Time, the plant must M*N N be placed in a MODE or other specified condition in which ! the LC0 does not apply. This is done by isolating the 4 associatedpenetrationgrbyplacingtheplantinMODE4. Note that MSIV closures Functions are covered by this ACTION to permit closure of the MSIVs should the Condition occur while in MODE 3. i d'fM The allowedre::en:bleCompletion Time of to permit the operator F-%terthefor to identify Action WL is affected flow paths and isolate them. The Completion Times for ! U 4 ,) [ Actioneh2,4 andM2 2 are reasonable, based on operating experience, to achieve the specified conditions in an orderly manner and without challenging plant systems. l i g 4. Y.lsand Y.2 - . I O\ ' i rf If t*e Functib isnotrestoredtoOPERABLE\ status \within the ; decl a lowed C6m d inopera le (Acletion }t{on V.1). Declaring the Feattareimej inoper le causss ntry 16to the app' opriate LC0 for \ inopera le Featu .
\ \
\ \ l he CUW i lation SLC in.tiat'on F ction is includedgto s
i pYovideco idencet() tthehtCS em erforms its intended fu ction. I lating tt CUW s)ptem rf pns th(l -intended \ Fun tion so ction Y. is a suf icie r edia a'ture for 4 Func ion 32. \ \ l The Co letion Time of I our is cepta le becaus th\ f i l minimi risk hile allo ng suff cient imb for p sopnel' l to imple nt th required tions. SURVEILLANCE As noted at the beginning of.the SRs, the SRs for each SSLC s . REQUIREMENTS instrumentation Function are located in the SRs column of Table 3.3.1.1-1. Si:x\rs y (continued) ABWR TS B 3.3-70 P&R 08/30/93
l
.SSLC Sensor Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.1 REQUIREMENTS
( Continued ) Performance of the SENSOR CHANNEL CHECK provides confidence that a gross failure of a device in a SENSOR CHANNEL has not occurred. A SENSOR CHANNEL CHECK is a comparison of the parameter indicated in one SENSOR CHANNEL ~ to a similar parameter in a different SENSOR CHANNEL. It is based on the assumption that SENSOR CHANNELS monitoring the same parameter should read approximately the same value. Significant deviations between the channels could be an , indication of excessive instrument drift on one of the channels or other channel faults. A SENSOR CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each DIVISION FUNCTIONAL TEST. l Agreement criteria are determined by the plant staff based on a combination of the channel instrument and parameter indication uncertainties. The high reliability of each channel provices confidence f l that a channel failure will be rare. In addition, the continuous self tests provide confidence that failures will :
,(
be automatically detected. However, a low surveillance interval of 12 hours is used to provide confidence that l gross failures which do not activate an annunciator or alarm
; will be detected within 12 hours. The SENSOR CHANNEL CHECK l supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO. ,
I SR 3.3.1.1.2 To ensure that the APRMs are accurately indicating the true core average power, the APRMs are calibrated to the reactor power calculated from a heat balance. The Frequency of once per 7 days is based on minor changes in LPRM sensitivity, which could affect the APRM reading between LPRM calibrations (SR 3.3.1.1. g 7 - pa q A Note is provided that imposes the SR only hen power is 2: 25% RTP because it is difficult to accura ely determine core THERMAL POWER from a heat balance when < 25% RTP. At low power levels, a high degree of accuracy is unnecessary because of the large inherent margin to thermal limits (MCPR 3 (continued) ABWR TS B 3.3-71 P&R 08/30/93
\
SSLC Sensor Instrumentation B 3.3.1.1 'Y3 BASES O SURVEILLANCE SR 3.3.1.1.2 (continued) ! REQUIREMENTS ( Continued ) and APLHGR). At 2: 25% RTP, the Surveillance is required to have been satisfactorily performed within the last 7 days in accordance with SR 3.0.2. SR 3.3.1.1.3 A DIVISION FUNCTIONAL TEST is performed on the SRNM and APRM-High/Setdown channels in each division to provide confidence that the function will perform as intended. If the as found trip point is not within its required Allowable Value, the plant specific setpoint methodology may be revised, as appropriate, if the history and all other pertinent information indicate a need for the revision. The as-left setpoint shall be consistent with the assumptions of the current plant specific setpoint methodology. As noted, this SR is not required to be performed prior to entering MODE 2 from MODE 1 since testing,of-the MODE 2s required SRNM and APRM Functions cannot be p rformed * % d; 7 MODE 1. This allows entry into MODE 2 if the ,% cy g is not met per SR 3.0.2. In this event, ust be performed within 12 hours after entering M0 h ffom MODE 1. Twelve hours is based on the high reliability of these % p [s*J functions and providing a reasonable time in which to N# fa<lpps e
, . Tomplete the SR. -"
y of 7 days provides an acceptable leve)l tem ,of s
-p43d"k'T e
,, g g A Fr averag availability over the Freauency interval
*f 55'4 s .p @ W a r21i-atttt1ty-enal~yiT4-{ReL--Ut.
~
,[ c
^
G[A Q3.3.1.1.4 M ^ *-1rdMbMD
~
~
um p, SR
) jj o (MM^f Qer A DIVISION FUNCTIONAL EST is performed on the r;s t d SRNM and APRM- actr-tfiMo provide confidence that th fu tions will perform as intended. A OWk Frequency of [32] d provides an acceptable level of system average availability over the Frruex7Chnc-tsMseo)g
@ t he re! ! ae ! t i tyanatys i s o f - Referene)e 4 (Tfie MaiIual Scram functional test frequency described in LC0 3.3.1.2 p as credited in the analysis to extend many automatic _ scram l Functions' Frequencies.) y ggy gg n (continued)
U j ABWR TS B 3.3-72 P&R 08/30/93
SSLC Sensor Instrumentation B 3.3.1.1 BASES 6 SURVEILLANCE REQUIREMENTS SR 3.3.1.1.5 and SR 3 . 3 .1.1.'Ja [%1( ( Continued ) A DIVISIONAL FUNCTIONAL TEST or CHANNEL FUNCTIONAL TEST is performed on the required Functions or Channels in each division to provide confidence that the Functions will perform as intended. The test is performed by replacing the Gp d process signal with a test signal as far upstream in the
~
instrumen W as possible within the constraints of the instrumentation design and the need to perform the surveillance without disrupting plant operations. The testing may be performed so that multiple uses of a parameter may be tested at one time. d If the as found trip point is not within its required P [-icML(fp - J Allowable Value, the plant specific setpoint methodology may be revised, as appropriate, if the history and.all other pertinent information indicate a need for the revision. The 5M'AbI Q dg-fe setpoint shall be left set consistent with the assumptions
} ,M.jp p :
of the current plant specific setpoint methodology. The d uency is based on the Eliati Li yir - yJA p e s w . v , e r:. r w f(,I A .46 The operability of the SENSOR CHANNELS is determined by injecting a test signal in a single s...srdh Biorr as near
/
to the source as possible to assure that the DTMs in all T M. divisions create W signal when needed and that the signal is received by the TLU or SLU. The-operabH44y-of-s L%IL LHANNLL is determinedu ' y s iintdtt4f@e-tf4p-54gn64
-1Trputs to thTSItror-Ttti in a sinvie dtvision-and-ennfirming thatqhe tityision trip =5ign'al=i53 reratwL SR 3.3.1.1 @cl$
LPRM gain settings are determined from the local flux profiles measured by the Automatic Traversing Incore Probe (ATIP) System. This establishes the relative local flux profile for appropriate representative input to the APRM System. The 1000 MWD /T Frequency is based on operating experience with LPRM sensitivity changes. I b SR 3 . 3 .1.1.Y This surveillance assures that no gaps in neutron flux indication exist between the SRNM and APRM measurements.
) (continued) l ABWR TS B 3.3-73 P&R 08/30/93 l
I SSLC Sensor Instrumentation B 3.3.1.1 t[ BASES g l SURVEILLANCE SR 3.3.1.1.1 (continued) l REQUIREMENTS ( Continued ) The on.rlap between SRNMs and APRMs is of concern when reducing power into the SRNM range. On power increases, the system design will prevent further increases (initiate a rod block) if adequate overlap is not maintained. l This SR is imposed only for the conditions given in t notes in the LCO. After the overlap requirement met and indication has transitioned to the SRNMs, establishing the overlap may not be possible (APRMs may be reading l downscale once in MODE 2). If overlap is not demonstrated within a division, the Functions in that division that are required per the current mode and other conditions shall be declared inoperable. The basic Surveillance Frequency is whenever a transition to ! low power occurs. A maximum frequency of 7 days is also provided so the SR may be skipped if less than 7 days has elapsed since the last transition to power less than 5% RTP. The maximum frequency of 7 days is reasonable based on reliability of the SRNMs and APRMs. O
'l q l
SR 3.3.1.1.'8 C R1 ( A COMPREHENSIVE FUNCTIONAL TEST tests a division using a selected range of sensor inputs into the division while simulating the other three divisions as appropriate. This test verifies the OPERABILITY of all SENSOR CHANNELS, LOGIC CHANNELS, and OUTPUT CHANNELS. See 1. kfor additional l information on the scope of this test. ,_L u g g) s-ggu i Q=%. This surveillance overlaps or is performed in conjunction i with the OUTPUT CHANNEL COMPREHENSIVE FUNCTIONAL TESTS in i the LCOs that address the OUTPUT CHANNELS and LCOs that test the final actuation devices. The combined or overlapping tests provide complete end-to-end testing of all protective actions associated with the SSLC. yvd C l .The [18] month fre (RfFUELiNG INTER and%quency is perform the need to based on thisthe ABWR expected Surveillance under the conditions that apply during a plant outage to reduce the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The high reliability of the devices used in the SSLC processing
.( (continued)
ABWR TS B 3.3-74 P&R 08/30/93 l l r
l l SSLC Sensor Instrumentation B 3.3.1.1 l , BASES l SURVEILLANCE SR 3 . 3 .1. l 't (continued) REQUIREMENTS ( Continued ) coupled with the DIVISION FUNCTIONAL TESTS provide i confidence that the specified frequency is adequate. l
\o M l SR 3.3.1.1.'S and SR 3.3.1.1.9a C % & ( ,
I A SENSOR CHANNEL CAllBRATION or CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This I test verifies that a channel responds to the measured J parameter within the necessary range and accuracy. Calibration leaves the channel adjusted to' account for instrument drift between successive calibrations. Measurement error istorical determinations must be performed consistent with the plant specific setpoint ! methodology. The channel shall be left calibrated i consistent with the assumptions of the setpoint methodology. J g g ggy As notedY the calibration includes calibration of all parameters used to establish derived setpoints (e.g. TPM setpoint) .and all parameters used to automatically bypass a
% trh unction (e.g. < 40% RTP bypass of TSV closure).
CHANNEL CALIBRATION includes calibration of the Analog Trip ! Modules used to implement the ATWS mitigation feature initiation. i If the as found trip point (fixed or variable) is not within ; l its Allowable Value, the plant specific setpoint methodology ! may be revised, as appropriate, if the history and all other pertinent information indicate a need for the revision. h c"""'-Galibration shall be provided that is consistent ! with the assumptions of the current plant specific setpoint methodology. j
~
' h As notedi neutron detectors are excluded from SENSOR CHANNEL CALIBRATION because of the difficulty of simulating a meaningful signal. Changes in neutron detector sensitivity are compensated for by performing the 7 day calorimetric calibration (SR 3.3.1.1.2) and the 1000 MWD /T LPRM calibration (SR 3.3.1.1.{ 7 The [18] month frequency is based on the ABWR expected refueling interval and the need to perform this Surveillance 4 under the conditions that apply during a plant outage. The l
[18]' month frequency must be supported with a setpoint j (continued) ABWR TS B 3.3-75 P&R 08/30/93
l SSLC Sensor Instrumentation B 3.3.1.1 BASES I 10 W l SURVEILLANCE SR 3.3.1.1.9 and SR 3 . 3 .1.1.% (continued) i REQUIREMENTS ( Continued ) analysis that includes a drift allowance commensurate with l this frequency. i l u_ SR 3. 3.1.1. T9 hi This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The RPS RESPONSE TIME acceptance criteria are included in Reference [ ]. As noted, neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time. The [18] month frequency is based on the ABWR expected REFUELING INTERVAL and the need to perform this Surveillance under the conditions that apply during a plant outage. The high reliability of the devices used in the RPS processing coupled with operating experience which shows that random e failures of instrumentation and embedded processor components causing serious time degradation, but not channel failure, are infrequent provide confidence that the specified Frequency is adequate. SR 3.3.1.1.% 8 CM ( This SR ensures that the individual channel response times for ECCS actuation are less than or equal to the maximum values assumed in the accident analysis. Response time testing acceptance criteria are included in Reference [ ]. v The [181 month frequency is based on the ABWR expected I REFUELING INTERVAh and the need to perform this Surveillance under the conditions that apply during a plant outage. The high reliability of the devices used in the ESF and ECCS s processing-coupled with operating experience which shows that random failures of instrumentation and embedded processor components causing serious time degradation, but not channel failure, are infrequent-provide confidence that the specified Frequency freg ar.~ is adequate. (continued) l ABWR TS B 3.3-76 P&R 08/30/93 1
. _ _ . - - . ._ ~.
SSLC Sensor Instrumentation B 3.3.1.1 ; BASES SURVEILLANCE SR 3.3.1.1.M D (N ' REQUIREMENTS ( Continued ) This SR ensures that the individual.. channel response times l are less than or equal to the maximum values assumed in.the accident analysis. The instrument response times must be added to the CIV closure times to obtain the ISOLATION , SYSTEM RESPONSE TIME. ISOLATION SYSTEM RESPONSE TIME acceptance criteria are included in Reference [ ]. .
.s e mtTd
~ A Note to the Surveillance :t:te; U 6 e radiation U detectohy be excluded from ISOLATION SYSTEM RESPONSE l TIME testing. This Note is necessary because of the ,
difficulty of generating an appropriate detector input i j signal and because the principles of detector operation ! virtually ensure an instantaneous response time. Response .! time for radiation detection channels shall be measured from ; l detector output or the input of the first electronic l component in the channel.
\D O' The [181 month fr uency is based on the ABWR expected ; i REFUELING INTERVA nd the need to perform this Surveillance I i under the conditions that apply'during a plant outage. The ,
high reliability of the devices used in the RPS processing - ! l coupled with operating experience which shows that random 4 ; w failures of instrumentation and embedded processor
$e c#r', componenTrtaus4ag serious time degradation, but not channel failure, are infrequentgprovide confidence that the !
specified Frequency is adequate. ; REFERENCES 1. ABWR SSAR, Section [6.3]. f
- 2. ABWR SSAR, Chapter [15].
- 3. NED0-31466, " Technical Specification Screening l Criteria Application and Risk Assessment," i November 1987.
- 4. ABWR SSAR, Section [9.3.5]. l
- 5. NEDC-31677-P-A, " Technical Specification Improvement j Analysis for BWR Isolation Actuation Instrumentation," '
June 1989. ] 1
- 6. NEDC-30851-P-A, Supplement 2, " Technical Specifications. Improvement Analysis for BWR Isolation (continued)
O ABWR TS B 3.3-77 P&R 08/30/93
r SSLC Sensor Instrumentation B 3.3.1.1 BASES REFERENCES Instrumentation Common to RPS and ECCS ( Continued ) Instrumentation," March 1989.
- 7. ABWR SSAR, Section [7.3].
- 8. ABWR SSAR, Section [5.2].
- 9. ABWR SSAR, Section [6.3], Table [6.3-2].
- 10. ABWR SSAR, Figure [ ].
- 11. ABWR SSAR, Section [5.2.2].
- 12. ABWR SSAR, Section [6.3.3].
I
- 13. ABWR SSAR, Section [15.4.1].
- 14. NED0-23842, " Continuous Control Rod Withdrawal in the Startup Range," April 18, 1978.
- 15. ABWR SSAR, Section [15.4.9].
- 16. NEDO-31960, "BWR Owners' Group Long-Term Stability l
Solutions Licensing Methodology.", June 1991
- 17. NED0-30851-P-A, " Technical Specification Improvement Analyses for BWR Reactor Protection System,"
March 1988.
- 18. ABWR SSAR, Table 5.2-6
! 19. ABWR SSAR, Section [] l l O l ABWR TS B 3.3-78 P&R 08/30/93
t i SSLC Sensor Instrumentation t
~
Tableh.3.1.1-1 (Page 1 of 3) SSLC Instrumentation Summary BASES EMS 1 FUNCTION Y/N USAGE
- 1. Startup Range Monitors la. SRNM Neutron Flux-High N RPS lb. SRNM Neutron Flux-Short Period N RPS ;
Ic. SRNM ATWS Permissive N ATWS Id. SRNM Inop N RPS j 2. Average Power Range Monitors ; 2a. APRM Neutron Flux-High, Setdown N RPS 2b. APRNb. Si=d Simulated Thermal N RPS Power-High,s h k W
-2c. APRM Fixed Neutron Flux-High N RPS 2d. APRM Inop N RPS l
2e. Rapid Core Flow Decrease N RPS 2f. Oscillation Power Range Monitor. N RPS
- 3. Reactor Vessel Steam Dome Pressure-High Y RPS,4EWS S t.( s, Me M6.116 o< CW ad 9R '
I l
- 4. Reactor Steam Dome Pressure-Low (Injection Y LPFL awe--
Permissive) ,
- 5. Reactor Water Level - High, level 8 Y RCIC,HPCF
- 6. Reactor Vessel Water Level-Low, Level 3 Y RPS, ISO of S.kk, cav s G1s . ,
- 7. Reactor Vessel Water Level ryv g i2 Y 5%NCIC,pSO c'M T.co cW, , ,
- 8. Reactor Vessel Water Level - Level 1.5 Y HPCF.,DG3 MSIV i
- 9. Reactor Vessel Water Level Level 1 Y LPFL, ADS,C.Ah j DG,t6e cI.v, he v/ W '
l
- 10. Main Steam Isolation Valve-Closure N RPS
- 11. Drywell Pressure-High Y 5 RPS, HPCF LPFL, RCIC, cA 3 ADS,$80 ca v3 vjp A'p,c
- 12. CRD Water Header Charging Pressure-Low Y RPS
- 13. Turbine Stop Valve-Closure N RPSEOC-RPT(80
- 14. Turbine Control Valve Fast Closure, Trip N RPS E0C-RPT Oil Pressure-Low ABWR TS B 3.3-79 P&R 08/30/93
i SSLC Sensor Instrumentation l B 3.3.1.1 l TableIG.3.1.1-1 (Page 2 of 3) N SSLC Instrumentation Summary s
\,
\. ( l s
\\ s \. k. \ m. -
\. \
m Ah EMS FUNCTION Y/N USAGE l
- 15. Main Steam Tunnel Radiation-High N RPS MSIV
- 16. Suppression Pool Temperature-High Y RPS ,ESF S PC. 4
- 17. Condensate Storage Tank Level - Low Y RCIC,HPCF- '
- 18. Suppression Pool Water level - High Y RCIC,HPCF
- 19. Main Steam Line Pressure-Low Y MSIV
- 20. Main Steam Line Flow-High Y MSIV i
- 21. Condenser Vacuum-Low Y MSIV
- 22. Main Steam Tunnel Temperature-High Y 18 &~3-5
- e 4 C D U MSIV i
- 23. Main Turbine Area Temperature-High Y MSIV W 3 or Fyel Handling Area
- 24. Reactor Building N 4W S GT S# CL\7 (SRadiation-H M i. h 4 A Q .
- 25. RCIC Steam Line Flow-High Y ISO o< kcic. l
- 26. RCIC Steam Supply Line Pressure-Low Y ISO e< kc Cd e ur g 6
?B, RCIC Equipment Area Temperature-High Y ISO 64 n.c!EC ;
- 29. CUW Differential Flow-High Y ISO c4 GUh
- 30. CUW Regenerative Heat Exchanger Y ISO of COW i Temperature-High .
- 31. CUW non-regenerative Heat Exchanger Y 150 M COW Temperature -High
- 32. CUW Equipment Area Temperature-High Y ISO or cb W ,
! O BR RHR Area Temperature) -High Y ISO e4 ML i p rnu ;;;pt(nn ny Stc 9$gjgy y\ g k h 7 33 36. ADS Division I LPFL Pump Discharge pressure Y ADS i - high (Permissive) ; 1436. ' ADS Division I HPCF Pump Discharge Y ADS h Pressure-High (Permissive) i S31. ADS Division 11 LPFL Pump Discharge Y titt- A b.5 pressure'- high (Permissive) !O ! ABWR TS B 3.3-80 P&R 08/30/93 l
SSLC Sensor Instrumentation Tableb.3.1.1-1 (Page 3 of 3) n umary hASES( \ \ n 4\
" * \ T N N -g N i
\ 's EMS FUNCTION Y/N USAGE SLSB ADS Division II HPCF Pum? Oischarge Y ffF CF A B S Pressure-High (Permisstve).
h
- 39. ryw 1SukDrain1CWRadi\tionkgh \ h(0
- 40. ywei SumPhrains sh Radiahen-s N\ x iso.
~
GEkb k @ C.wtco %x < von s i L< . O ( I O ABWR TS B 3.3-81 P&R 08/30/93
RPS and MSIV Actuation B 3.3.1.2 m l() B 3.3 INSTRUMENTATION B 3.3.1.2 Reactor Protection System (RPS) and Main Steam Isolation Valve (MSIV) Actuation BASES BACKGROUND The RPS initiates a reactor scram when one or more monitored parameters exceed their specified limit to preserve the integrity of the fuel cladding and the Reactor Coolant System (RCS) and minimize the energy that must be absorbed following a loss of coolant accident (LOCA). This can be accomplished either automatically or manually. n s s t. c m s e y. M-%Q,@ The RPS uses sensors, data transmission, signal processing, load drivers, relays, bypass circuits, and switches that are I I necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide ran J ofdependentandindependentparameters(seeB3.3.1.1V.ga The RPS control logic hardware and software is contained within the four independent, divisional panels of Safety System logic and Control (SSLC) as described in LC0 B 3.3.1.1. Two hardwired manual scrams which completely bypass the SSLC ,./ processing are provided. The hardwired manual scrams remove ' (]/
., power from the scram pilot valve solenoids and also energize the air header dump valve solenoids (backup scram) via two manual scram switches on the main control console or when the reactor mode switch is in the SHUTDOWN position.
The RPS logic includes a Main Steamline Isolation special bypass in addition to the division of sensors bypass and division of logic bypass provided for most SSLC instrumentation (see LCO B 3.3.1.1 for a description of the bypasses). The Main Steamline Isolation bypass is similar to the division of sensors bypass except it affects only the MSIV closure scram. This bypass is provided to permit operation with one steam line isolated. The MSIV actuation automatically initiates closure of the MSIVs when measured parameters exceed specified limits. The function of the MSIVs valves, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs). Valve closure within the specified time limits ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA. ,{) (continued) ABWR TS B 3.3-82 P&R 0B/30/93
i k e TA.4._T' - 4 oh RPS and MSIV T 'p ! .;J.tien ' B 3.3.1.2 7 ' r
/
BASES ; 1.( t BACKGROUND MSIV isolation initiation includes sensors, data
- i
( Continued ) transmission, signal processing, load drivers, relays, and switches that are necessary to cause closure of the valves. Functional diversity is provided by monitoring a wide ranga . of independent parameters. The input data to the isolation ' logic originates in devices that monitor local parameters (e.g. high temperatures, high flows) as well as primary ! system and containment system parameters that are indicative of a leak. The MSIV control logic hardware and software for . developing isolation initiation signals is contained within , the four independent, divisional panels of Safety System 4 logic and Control (SSLC) as described in LCO B 3.3.1.1.The . Functions used to create the initiation signals are addressed in LCO B 3.3.1.1. This LCO addresses the iscl.t': actuation devices. 39.5 Q /e dV ; s e.9S "YThe M final initiation signals for isolating the main A g steamiineitare transmitted to the Output logic Units (0LUs) ' t>we ' G h load drivers by the TLUs in the SSLC. There are OLUs in all four divisions and load drivers in the two +tSM 6 - actuation divisions. The RPS and MSIV use 2/4 logic in both the LOGIC CHANNELS and OUTPUT CHANNELS. One RPS and one MSIV actuation output from the TLU may be , O- bypassed. Implementing this bypass causes the LOGIC CHANNEL and OUTPUT CHANNEL 9 0 change to 2/3. Interlocks are provided to prevent placing more then one RPS or MSIV actuation output in bypass. i W
/r A>/ W 3.
The actionsAthe RPSMe assumed in the safety analyses of APPLICABLE SAFETY ANALYSIS References (2, 3, and-4) The RPS initiates a reactor scram LCO, and when monitored parameter values exceeds its setpoint. See APPLICABILITY LC0 B 3.3.1.1 for additional information. RPS instrumentation satisfies Criterion 3 of the NRC Policy Statement. Functions not specifically credited in the gb N acident analysis are retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis. 7 , ,, j y The isolation of the main steam lines is mplicitly assumed in the safety analyses of References (LWto limit offsite doses. Refer to LCO 3.6.1.3, " Primary Containment ! Isolation Valves (PCIVs)," and LCO 3.3.1.1 "SSLC ! Instrumentation" Applicable Safety Analyses Bases, for more detail. (continued) ABWR TS B 3.3-83 P&R 08/30/93
RPS and MSIV Actuation B 3.3.1.2 f BASES APPLICABLE The containment isolation actuation satisfies Criterion 3 of SAFETY ANALYSIS, the NRC Policy Statement. LCO, and APPLICABILITY The OPERABILITY of the RPS and MSIV closure is dependent on ( Continued ) the OPERABILITY of the individual SENSOR CHANNEL Functions within each division and are covered by LC0 3.3.1. The OPERABILITY of the LOGIC CHANNELS and OUTPUT CHANN S (0Lus
& load drivers) and manual init.iation is covered by his _
[ S S L- C. I e. w o r b n e % g
~
- 1. RPS Actuation CAL The RPS Actuatio must be OPERABLE in MODE I, MODE 2, and in MODE 5 with any :ontrol rod withdrawn from a core cell l
containing at least one fuel assembly. The Shutdown Margin l (LCO 3.1.1) and jod-put Sterlock (LCO 3.9.2) provide confidence that no eNent' requiring RPS will occur while in l MODE 5. RPS is not required in MODES 3 and 4 since all l control rods are fully inserted and the Reactor Mode Switch ! in Shutdown position rod withdrawal block (LCO 3.3.1 I prevent rod withdrawal in these modes. $ Three unbypassed LOGIC CHANNELS and OUTPUT CHANNELS must be m OPERABLE to assure that no single failure will preclud scram when needed. f cgea) L1 k\ocL
- 2. MSIV and MSL Drain Valves Actuation b4T.cOwMo@j The IV a MSL% rain)IvesA6uation\{unct uses a TLU
\inal fou ivistqns. Th TlU at uires t ip i rmation the LUs. Two f(om t q DTM and s rds ac untion gnals normally\ener zed, olenoi operat pilot valve are loc'hted og eat MSIV.Both(solenoids st be -ene ized to causs the v,alve o clo'se. Each pilot sQenoid g
con olled by independtnt se ies/ allel rrangemen s of ur lo d driver (eightto 1 for ach MS V) with t e outp ts o the f ur OL s arranged o tha a trip ignal fr m any oo t m de- nergi es b sol oids. pr each IV, the cad-dr vers qr one pilo alve re in division I and the oad dribers for the ther ilot Ive are in divis'on II. N l The MSIV actuation must be operable in MODES I,2, ana 3 since these are the modes where one or more of the MSIV closure functions must be OPERABLE. m (continued) b ABWR TS B 3.3-84 P&R 08/30/93
RPS and MSIV Actuation B 3.3.1.2 l BASES APPLICABLE 2. MSIV and MSL Drain Valves Actuation (continued) : SAFETY ANALYSIS, LCO, and Three untypassed LOGIC CHANNELS and OUTPUT CHANNELS must be. ) APPLICABILITY OPERABLE to assure that no single instrument failure can - ( Continued ) preclude MSIV closure when needed. ;
- 3. Manual RPS Scram l The Manual Scram push buttons are completely independent of *
' and isolated from the RPS automatic trip divisions. This l
'n q 4M. Function was not specifically credited " tM sccium.T suA analysis, but it is retained for the overall redundancy and '
% diversity of the RPS as required by the NRC approved ;
licensing basis.
- There are two independent manual scram switches, one in :
division II and one in division III. Each switch removes + power from one set of scram solenoids and energizes one of l the air header dump valves so the function completely ' bypasses the automatic scram logic divisions. Both switches must be activated to cause a scram. ; I i g There is no Allowable Value~ for this Function since the : YA. di"icim are mechanically actuated based solely on the i position of the push buttons. Two divisions of Manual Scram are required to be OPERABLE in MODES I and 2, and in MODE 5 with any control rod withdrawn l from a core cell containing one or more fuel assemblies, i since these are the MODES and other specified conditions when control rods are withdrawn. l l l
- 4. Reactor Mode Switch-Shutdown Position The Reactor Mode Switch-Shutdown Position Function provides ;
anual reactor trip signals, via the manual scram logic ! ivisions (II and III), that are redundant to the automatic o O # 56 protective instrumentation divisions. This Function was not specifically credited Tfrthtacs.4 dent analysis, but it is retained for the overall redundancy and diversity of the RPS as required by the NRC approved licensing basis. The reactor mode switch is a single switch with independent contacts for initiating scram when the switch is in the (continued) ABWR TS B 3.3-85 P&R 08/30/93
RPS and MSIV Actuatien B 3.3.1.2 BASES APPLICABLE 4. Reactor Mode Switch-Shutdown Position (continued) SAFETY ANALYSIS, LCO, and 3HUTDOWN position. This function removes power from the APPLICABILITY scram solenoids and energizes the air header dump valves so _( Continued ) it completely bypasses the automatic scram logic divisions. There is no Allowable Value for this Function since the divisions are mechanically actuated based solely on reactor mode switch position.
,he-Two divisions of Reactor Mode Switch-Shutdown Position Function are available and required to be UPERABLE. The Reactor Mode-Switch Shutdown Position Function is required to be OPERABLE in MODES I and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn.
- 5. Manual MSIV Actuation The Manual Initiation push button Function provides signals p to the OLU in each division that are redundant to the V automatic protective instrumentation and provide manual isolation capability.D her; T i+hlo specific ABWR SSAR safety analysis that takes credit for this function. It is retained for overall redundancy and diversity of the isolation function as required by the NRC in the plant licensing basis.
There are four MSIV manual actuation pushbuttons. The data is routed directly to the OLUs for the HSIVs so this function bypasses the EMS, DTMs and TLus. Pressing any two of the fotar manual pushbuttons will cause isolation of all four steam lines. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons. 9 0 LY"
-Tttree divisions of the MSL Manual Initiation Function are required to be OPERABLE in MODES 1, 2, and 3, since these are the MODES in which the MSIVs are required to be OPERfdLE.
t [ (continued) ABWR TS B 3.3-86 P&R 08/30/93 l l
RPS and MSIV Actuation B 3.3.1.2 l BASES ACTIONS A Note has been provided to modify the ACTIONS related to RPS and MSIV Actuation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent trains, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or ! not within limits, will not result in separate entry into , the Condition. Section 1.3 al to specifies that Required l Actions of the Condition continue to apply for each j additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RPS and MSIV Actuation r.hannels provide appropriate compensatory measures for multiple inoperable i channels. As such, a Note has been provided that allows . separate Condition entry for each inoperable RPS or MSIV . Actuation channel. I A.I. A.2.1. A.2.2.1 and A.2.2.2 These Actions assure that appropriate compensatory measures are taken when on O 8ece es 4 ever 8,e LOGIC e rer these CHANNEL r##ct4 #s. or <MSIV 41ere manual 4 channel will cause the actuation logic to become 1/3 or 2/3 e channel : depending on the nature of the failure ( i.e failure which causes a channel trip vs. a failure which does not cause a - channel trip). Therefore, an additional single failure will not result in loss of protection. Action A.1 forces a trip condition in the inoperable : division which causes the initiation logic to become 1/3 for ; the Function. In this condition a single additional failure : will not result in loss of protection and the availability i of the Function to provide a plant protective action is at least as high as 2/4 trip logic. Since plant protection capability is within the design basis no further action is required when the inoperable channel is placed in trip. i Action A.2.1 bypasses the inoperable division which causes j the logic to become 2/3 so a single failure will not result in loss of protection or cause a spurious initiation. Since overall redundancy is reduced, operation in this condition is permitted only for a limited time. Action A.2.2.1 restores the inoperable channel. Action A.2.2.2 repeats Action A.1 if repairs are not made within the allowable l (continued) ABWR TS B 3.3-87 P&R 08/30/93 l i { l
RPS and MSIV Actuation B 3.3.1.2 BASES l ACTIONS A.1. A.2.1. A.2.2.1. and A.2.2.2 (continued) l ( Continued ) Completion Time of Action A.2.2.1. Either of the Actions j A.2.2.1 or A.2.2.2 places plant protection capability within l the design basis'so no further action is required. 1 The Completion Time of six hours for implementing Act: ens A.1 and A.2.1 is based on providing sufficient time for the , operator to determine which of the actions is appropriate. The Completion Time is acceptable because the probability of : an event requiring the Function, coupled with failures that i would defeat two other channels associated with the . Function, occurring within that time period is quite low. r 4;.e self-te:t fe% =. vi the SSLC-p.eiide a nigh d:g m ef' ! eonf4ttence Inat no undetected failures wiii occur with;.. the : 4 11e eble Cvyletion y . Implementing Action A.2.1 provides confidence that Plant , protection is maintained (2/3 logic) for an additional ! single instrument failure. However, with division I or III i in bypass, a loss of the division 11 power supply could t disable two of the remaining channels. Therefore, operation ! with.one division in bypass is restricted to 30. days , (Actions A.2.2.1 and A.2.2.2 Completion Time). The ; probability of an event requiring the Function coupled with . t undetected failures wh3ch cause the loss of two of the : remaining OPERABLE divisions in the Completion Time is quite low. Tha_: elf-teet features nf +he-SStI provice a high ! dvee of c n'idac .ti..i-=0 endetected f.ilui e> il' eceur ! withia th: :lleg g . r g letien Tj: , B.1. B.2. and B.3 Condition B occurs if two LOGIC CHANNELS or MSIV manual channels become inoperable in a fashion that does not result in an Actuation. In this Condition, the actuation logic could become 2/2. Therefore, it'is appropriate to place one ! division in trip (Action B.1) and the other in TLU output bypass (Action B.2). The trip logic then becomes 1/2 so a i single failure in the remaining operable divisions would not ; cause loss of protection. However, a single failure in one } of the operable divisions could result in a spurious trip. , t The Completion Times-for implementing Actions B.1 and B.2 is ! based on providing adequate time for the operator to (continued) ABWR TS B 3.3 P&R 08/30/93 i
-. - -, . .. l
RPS and MSIV Actuation B 3.3.1.2 : BASES ACTIONS B.I. B.2. and B.3 (continued) ( Continued ) implement the Required Actions. The Completion Times are acceptable because the probability of an event' requiring the , Function, coupled with a failure in one or two of the other . ' channels associated with the Function, occurring within that time period is quite low. Action B.3 restores at least one of the failed channels to OPERABLE status. A Completion Time of 30 days is permitted for this Action. The basis for the Completion Time is as . given for Action A.2.2.1 and A.2.2.2 since the plant protective action capability is similar. ien-bered er. the-low,+rebebility ef :n und:tected Te h ra in both er the OPERABM--cAmneis for the Tur. tica necurrinn i n t h at_.t.4,e perioo. ine self-test feeturc; cf-the S';LC previde : Mgh
% ee of confiaence ih.L-r.: undetected 4eilurc; will = cur w44& ihe .110r41. rn=nletion-Time.
Multiple entry into the condition i aIises Condition A to be invoked on completion of Action B.3 so appropriate additional action is taken. O C.1 & C.2 ' i This Condition applies when three LOGIC CHANNELS for the same Function or three MSIV manual initiation channels
~
become inoperable. This Condition represents a case where intended protective action from a Function is 1/1 (one , channels fails tripped) or is completely unavailable. Action C.1 forces the initiation logic to become 1/1 Jo a protective Action from the Function is still available but the single failure criteria for plant protective action is not met. ! Action C.2 causes restoration of a second channel for the Function so the initiation logic becomes 1/2 and plant ; protection is maintained for a single additional failure. Th's six hour Completion Time for C.2 provides a reasonable amount of time to effect repairs on at least.cn of the inoperable channels and avoichthe risks assoc iated with plant shutdown. 5 io (continued) l ABWR TS B 3.3-89 P&R 08/30/93
i RPS and MSIV Actuation B 3.3.1.2 O V BASES b ACTIONS C.1 & C.2 (continued) ( Continued ) h& Multiple entry into the conditiorTt4M4 causes Condition B to be invoked on completion of Action C.2 so appropriate additional action is taken. D.1 & D.2 This Condition occurs when all of the LOGIC CHANNELS for the same Function or all of the manual MSIV channels become inoperable. In this Condition the intended protective action from a Function is completely unavailable. Although Action D.1 does not restore the initiation capability from the Function it is required so that the logic will become 1/1 when Action D.2 is completed. IN4 E6 N 5 5%* le, Yen Action D.2 -ceu;= raturatiun of at least one channel fer M
'T ' the Function which causes the actuation logic to become 1/1 so h tended protective action is restored. The one hour Completion Time for D.2 provides some amount of time to
[_ . effect repairs on at least on of the inoperable channels and
' avoid the risks associated with plant shutdown. Continued plant operation in this condition for the specified time does not contribute significantly to plant risk because the probability of an event requiring the Function within the completion Time is quite low.
Multiple entry into the condition te causes Condition C to be invoked on completion of Action D.2 so appropriate additional action is taken. l M l 1 These Actions assure that appropriate compensatory measures ! are taken when one OUTPUT CHANNEL becomes inoperable. For 1 these Functions, a failure in one channel will cause the actuation logic to become 1/3 or 2/3 depending on the type of failure ( i.e failure which causes a trip vs. a failure which does not cause a trip). Therefore, an additional single failure will not result in loss of protection. Action E.1 forces a trip condition in the inoperable channel which causes the actuation logic to become 1/3. In this ] l (continued) ABWR TS B 3.3-90 P&R 08/30/93 L.__
l RPS and MSIV Actuation
- B 3.3.1.2 l l
BASES , ACTIONS L1 (continued) l ( Continued ) . condition a single additional failure will not result in ! loss of protection and the availability of the Function to-
. provide a plant protective action is at least as high as for !
the 2/4 trip logic. Since plant protection capability is within the design basis no further action is required. : The Completion Time of six hours for implementing Action A4 is acceptable because the probability of an event requiring , the Function, coupled with failures that would defeat 4wew I q l l other channels associated with the Function, occurring l within that time period is quite low. , l F.1 and F.2 : l Condition F occurs if two OUTPUT CHANNELS become inoperable in a fashion that does not result in an Actuation. In this Condition, the actuation logic could become 2/2. Placing one of the inoperable enannels in trip (Action F.1) causes the . logic to become 1/2 so a single failure in the remaining O operable channels would not cause loss of protection. However, a single failure in one of the operable channels could result in a spurious trip. The Completion Times for implementing Action F.1 is based on l providing adequate time for the operator to implement the Required Action. The Completion Time is acceptable because l the probability of an event requiring the Function, coupled with undetected failures in one of the OPERABLE channels ! associated with the Function, occurring within that time period is quite low. Action F.2 restores at least one of the fai'ed channels to , OPERABLE status. A Completion Time of 7 days is permitted
- for this Action. The Completion Time is based on the b w l probability of an undetected failure in both of the OKRABLE l
channels for the Function occurring in that time period. The.
- !f-test f::.ture:; si the ZLC provide e h-;gh dem cc uf- '
SnnNave-- thei uv undeteGed i.ilwre: "H Lecttf Tt'h1Trthe allewable-Cumplettr. T4me. i Multiple entry into the conditio causes Condition E to be invoked on completion of Action F.2 so appropriate additional action is taken. (continued) ABWR TS B 3.3-91 P&R 08/30/93 l J
_. - .- --- __ ~ _ . -- . - . . { RPS and MSIV Actuation l B 3.3.1.2 j BASES t ACTIONS S,.d ( Continued ) This Condition applics when three or.four OUTPUT CHANNELS for the same Function become inoperable. This. Condition ; represents a case where protective action from a Function is 1/1 or is completely unavailable. t Action G.1 requires restoring a total of at least two - channels to OPERABLE status which restores the actuation logic to 1/2 so plant protection is maintained for a single - additional failure. The one hour Completion Time for D 2 provides some amount of. , time to effect repairs and avoid the risks associated with , I plant shutdown. Plant operation in this condition for the i specified time does not contribute significantly to plant l risk because the probability of an' event requiring the Function within the completion Time is quite low. ; Multiple entry into the condition t auses Condition F to be invoked on completion of Action G.1 so appropriate 'I additional action is taken. , O u t ThisConditionaddre%ssfailuresintheReactorModeSwitch; i Shutdown Position Function. Since the Function Logic is 2/2 l any failure causes protective' action from the Function to i become unavailable. j Action H.1 restores the required channels to OPERABLE : status. The one hour Completion Time for H.1 provides some r amount of time to effect repairs prior to implementing l additional Actions to place the plant in a state where the ) LCO does not" apply. Continued operations in this condition i for the specified time does not contribute significantly to. ; plant risk because the probability of an event requiring the i Function within the Completion Time is quite low. I.1 and 1.2 If one of the manual scram divisions becomes inoperable then j manual scram is unavailable. Placing the affected division in trip (Action 1.1) causes the manual scam logic to become (continued)- ABWR TS B 3.3-92 P&R 08/30/93
RPS and MSIV Actuation 8 3.3.1.2 i BASES l ACTIONS I.1 and I.2 (continued) f ( Continued ) l 1/1. Note that the automatic actuation logic becomes 1/3 in this condition so there is an increased vulnerability to l spurious trips. Since the manual trip uses a minimum of equipment and completely bypasses the automatic RPS trip logic, there is high confidence that manual scram will be available tif needed ~ q , 4 g w w %M g ( u'Q The one hour Completion Time for I.1 provides sufHcient S e,w<- w@ o4 time for the operator to implement the Action. Plant l l operation in this condition for the specified time does not contribute significantly to plant risk because the probability of an event requiring the Function within the completion Time is quite low. Action 1.2 restores all required manual scram channels. The completion time for Action I.2 is set the same as for condition B.3 since the conditions are similar in terms of overall plant protection. This Condition assures that appropriate actions are taken for multiple inoperable RPS Actuation Functions while in MODE 1 or 2. If the specified Actions for Conditions A, B, C, D, E, F, G, H, or I are not implemented within the specified Completion Times the plant must be placed in a condition where the LC0 does not apply. This is accomplished by placing the plant in MODE 3. The Completion Time is reasonable, based on operating experience, to reach MODE 3 from MODES 1 or 2 in an orderly manner and without challenging plant systems. K.1 This Condition assures that appropriate actions are taken ! for multiple inoperable RPS Actuation Functions while in MODE 5 with any control rod withdrawn from a core cell containing at least one fuel assembly. If the specified Actions for Conditions A, B, C, D, E, F, G, H, er I are not j implemented within the specified Completion Times the plant must be placed in a condition where the LCO does not apply. l l This is done by immediately initiating action to insert all l '( r \ (continued) ABWR TS B 3.3-93 P&R 08/30/93 i
RPS and MSIV Actuation B 3.3.1.2 i W h. %-t- N. c. v. N'i*w %d c~ c e. ! BASES
" S k 5 bh l
ACTIONS L_l (continued) ( Continued ) insertable control rods in core cells containing one or more ; fuel assemblies. Control rods in core cells containing no l fuel assemblies do not affect the reactivity of the core and , are, therefore, not required to be inserted. Action must ' t continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted. L.1. ]1 M1 t L.1 and E-e- i5qwg,;ci whw.ke. e 4.4 6.c.hd PeJr.dm This Condition assures th 1 appropriate actions are taken for multiple inoperable M V Actuation Functions. If-the specified Actions for Condi ions A, B, C, D, E, F, or W k not implemented within the ecified Completion Ti es the plant must be placed in a coldition where the LCO does not I apply. This is accomplished placing the plant o MODE % i-- where the LCO does not apply' T4 Cm.vk'ina T % ' ra - reasonable, based on operating experience, to rea MODEM# in an orderly manner and without challengin nt systems.
^!cN % ss cT. M-SURVEILLANCE The CHANNEL FUNCTIONAL TESTS required in LCO 3.3.1.1 nsures that the requiredifunct;en w ill perform as intended an REQUIREMENTS
- 'N generate a trip condition when required. This LC0 addresses 5 ?.v 3 A the operability of the LOGIC CHANNELS and OUTPUT CHANNELS g4ppp.,$ for RPS and MSIV, which covers the TLus, output logic units (0LUs), the load drivers, and the manual actuation Functions. .n d S t L c , _ b s c % T.< A SR 3.3.1.2.1 A CHANNEL FUNCTIONAL TEST is performed on each manual RPS scram division to ensure that the entire manual trip' channel will operate as intended. This function uses a minimum of components, and the components have been proven highly reliable through operating experience. However, a relatively snort surveillance interval of [7] days is used since availability of manual scram is important for providing a diverse means of reactor scram and the logic is 2/2. The probability of an event requiring manual scram coupled with a failure of one of the scram channels within this time period is very low. (continued) ABWR TS B 3.3-94 P&R 08/30/93-
f RPS and MSIV Actuation B 3.3.1.2 A Q BASES SURVEILLANCE SR 3.3.1.2.2 REQUIREMENTS ( Continued ) A DIVISIONAL FUNCTIONAL TEST is per"ormed on the LOGIC CHANNELS in each division to provide confidence that the functions will perform as intended. The test is performed by replacing the normal signal with a test signal as far upstream in the channel as possible within the constraints of the instrumentation design and the need to perform the surveillance without disrupting plant operations. See Section 1.1, " definitions" for additional information on the scope of the test. The devices used to implement the RPS and MSIV act.uation functions are of high reliability and have a high' degreel redundancy. Therefore, the [92] day frequency p vides confidence that device Actuation will occur whe eded. This test overlaps or is performed in conjunction tAthe DIVISIONAL FUNCTIONAL TESTS performed under LCO 3.3.1.lg to provide testing up to the Wa+-artiratir.g device. O VM9 A Gui v W t.-4l 4 SR 3.3.1.2.3 ' 5.suc. h w %,%w r.wcc,remh g.1 V A CHANNEL FUNCTIONAL TEST is performed on each manual MSIV channel to ensure that the channel will operate as intended. The devices used to implement the manual MSIV actuation are of high reliability and have a high degree of redundancy. Therefore, the [92) day frequency provide confidence that device Actuation will occur when needed. The probability of an event requiring manual MSIV actuation coupled with undetected f ailures in three channels within this time period is very low, i SR 3.3.1.2.4 l l A COMPREHENSIVE FUNCTIONAL TEST tests a division using a selected range of sensor inputs into the division while simulating the other three divisions as appropriate. This test verifies the OPERABILITY of all SENSOR CHANNELS, LOGIC ' CHANNELS, and OUTPUT CHANNELS. See 1.lforadditional l information on the scope of this test. [ . 13 s&m O (continued) ' l V ABWR TS B 3.3-95 P&R 08/30/93 l l
_- - .-. = . - - - . . RPS and MSIV Actuation i B 3.3.1.2 BASES SURVL*LLmCE SR 3.3.1.2.4 (continued)- REQUIREMENTS ( Continued ) This surveillance overlaps or is performed in conjunction , with the COMPREHENSIVE FUNCTIONAL TESTS in LC0 3.3.1.1. The combined or overlapping tests provide complete end-to-end testing of all RPS and MSIV protective actions. l 0 Tha I181 month frequency is based on the ABWR expected [ b9 T REFUELING INTERVA and the need to perform this Surveillance i under the co . ions that apply during a plant outage to reduce the potential for an unplanned transient if the- ; Surveillance were performed with the reactor at power. The high reliability of the devices used in the SSLC processing coupled with the CHANNEL FUNCTIONAL TESTS provide confidence i that the specified frequency is adequate. : SR 3.3.1.2.5 The OUTPUT CHANNEL FUNCTIONAL TEST demonstrates the capability to actuate all of the devices (e.g pumps, valves, , etc) required to implement a protective action. N,oVoy LMk The flui month frequency is based on the ABWR expected l ( REFUELING INTERV5D and the need to perform this Surveillance t under the conditions that apply during a plant outage to reduce the potential for an unplanned transient if the i Surveillance were performed with the reactor at power. The , high reliability of the devices used in the SSLC processing coupled with the DIVISIONAL FUNCTIONAL TESTS provide confidence that the specified frequency is adequate. SR 3.3.1.2.6 g.h5 ! This SR ensures that the response times are less than or equal to the maximum values assumed in the accident I analysis. - l This surveillance overlaps or is performed in conjunction with the RPS RESPONSE TIME Surveillance in LC0 3.3.1.1. The combined or overlapping tests provide complete end-to-end testing of the RPS protective actions.
,The [181 month frequency is based on the ABWR expected .
UELINGINTERVApndtheneedtoperformthisSurveillance { N c. (continued) ABWR TS B 3.3-96 P&R 08/30/93 i _m - -. , .
RPS and MSIV Actuation : B 3.3.1.2 i j BASES SURVEILLANCE SR 3.3.1.2.6' (continued) : REQUIREMENTS l ( Continued ) under the conditions that apply during a plant outage. The i high reliability of the devices used in the RPS processing i coupled with operating experience which shows that random l failures of instrumentation and embedded processor ; components causing serious time degradation, but not channel failure, are infrequent provide confidence that the ; specified Frequency is adequate. SR 3.3.1.2.7 4 pl61I - This SR ensures that the individual channel h response times are less than o& equal to the maximum values assumed in the ; l accident analysis. The instrument response times must be i added to the MSIV closure times to obtain the ISOLATION l SYSTEM RESPONSE TIME. l This surveillance overlaps or'is performed in conjunction with the ISOLATION RESPONSE TIME Surveillance in LCO , 3.3.1.1. The combined or overlapping tests provide complete ; end-to-end testing of the MSIV response time. The I181 month frequency.is based on the ABWR expected j giiEFUELING INTERVAD and the need to perform this Surveillance ' under the conditions that apply during a plant outage. The' I#du high reliability of the devices used in the MSIV processing , p M- coupled with operating experience which shows that random ! failures of instrumentation and embedded processor i components causing serious time degradation, but not channel j failure, are infrequent provide confidence that the p 1 specified Frequency is adequate. l$;9 \W, ! REFERENCES -NettE- \ \ 1 1. neua swe, sedkn c22 A A0 tere SSM, $nkon f . 3 3. Adud SSM, [ 4y hr /5'
~
O !
- l. ABWR TS B 3.3-97 P&R 08/30/93 i i c . . . - g .- . ~ , . - , , , . . , , , + . , -..%,,...-.%,...m.,- ,,w, - .-r.,,,, ,.mm--e+.9-e-,,y .,#.w-...i
l SLC and FWRB Actuation B 3.3.I.3 B 3.3 INSTRUMENTATION l B 3.3.1.3 Standby Liquid Control (SLC) and Feedwater Runback (FWRB) , ! Actuation l 1 I BASES BACKGROUND The SLC and FWRB Functions provide alternate means for I reactivity reduction to protect against the remote probability of a failure to insert all control rods when ! l needed. ! 1 These Functions are in adoition to those described in LC0 "" B3.3.4.I,"ATWS and E0C-RPT Instrumentation". SLC and FWRB are initiated on Reactor Vessel Water Level-Low, Level 2 or Reactor Steam Dome Pressure-High. These features will not be initiated unless the neutron flux level is above the value specified for the SRNM ATWS permissive Function. ! The SLC injects a solution of Boron (a neutron absorber) and water into the reactor vessel. The available quantity of bo~ated r water is sufficient to reduce core. reactivity to an i i acceptable level for a postulated failure of all control i rods to be inserted. There are two SLC pumps and injection , valves. The FWRB causes the feedwater pumps to go to minimum speed, which reduces core inlet subcooling and therefore core reactivity and power level. A runback' signal is sent to each of the feedwater pumps. An SLC and FWRB LOGIC CHANNEL and OUTPUT CHANNEL is contained in each of the four SSLC divisions. Both channel types use 2/4 logic with suitable isolation between divisions. See the background section of LCO 3.3.I.I, "SSLC l Sensor Instrumentation" for additional information. APPLICABLE SLC and FWRB are not assumed in any ABWR SSAR analysis. SAFETY ANALYSIS These features are initiated to aid in preserving the LCO, and integrity of the fuel cladding fcilowing events in which a . APPLICABILITY required scram may not occur. The features are included as !' required by the NRC Policy Statement. The OPERABILITY of the SLC and FWRB is dependent on the OPERABILITY of the individual Functions. Each Function must have a required number of OPERABLE channels. ; (continued) ABWR TS B 3.3-9B P&R 0B/30/93
A it N t.em SLC and FWRB Act boties R 3.3.1.3 y% e. 6 E.P 5cA C.\M PPE.kS oJe o-1 1 M ie4. t E !e t c c3 1.1, t ,I h sse i.tvo,. hsT.c % u t,A ( BASES W 1,c o dLos 5 -r k.e. 1.4 C. C. ad ovmf c.supp%d. _ s APPLICABLE The individual Functions are required to be OPERABLE in MODE SAFETY ANALYSIS, I to protect against postulated common mode failures of the i LCO, and Reactor Protection System by providing a diverse method of APPLICABILITY reducing core reactivity. In MODE 1 the reactor is ( Continued ) producing significant power. In MODE 2, the reactor is at low power so SLC and FWRB are not necessary. In MODES 3 and 4, the reactor is shut down with all control rods inserted; thus, an ATWS event is not credible. In MODE 5, the one-rod-out interlock ensures the reactor remains subcritical; thus, an ATWS event is not significant. l 1r h l w The discussions are W ted below on a Function by Function basis. . \ $ L. C. ACku a bc 4 a nd f UK8 b6b44 5/0 '1
- 1. a. 2. a . -WC 2nd rupB Init4+ tion- 5"J ##
#hd""# /'
These LOGIC CHANNELS must generate and transmit initiation data to the OUTPUT CHANNELS. Each of the four channels sends initiation data to all four OUTPUT CHANNELS. Four channels of this Function are required to be OPERABLE and three are necessary to provide confidence that no single O_ g instrument failure can preclude RFC or FWRB initiation from
- V this Function on a valid signal.
There is no allowable value associated with this function. 1.b. 2.b. SLC and FWRB Actuation g d @ w f C b bf"e h These OUTPUT CHANNELS cause actuation of the SLC and FWRB. Protective action will occur when Actuation signals occur in . 2 of the 4 channels. Four channels are required to be OPERABLE and three channels must be OPERABLE to provide confidence that no single instrument failure can preclude an RFC or FWRB Actuation from this Function on a valid signal.
- 3. Manual ARI Initiation The Manual Initiation push button channels introduce signals into the SLC and FWRB logic to provide manual initiation capability that is redundant to the automatic initiation.
There are two push buttons and both must be activated to initiate SLC and FWRB. Signals from both manual switches are sent to the logic in all four divisions. e ( (continued) ABWR TS B 3.3-99 P&R 08/30/93
I SLC and FWRB Activation B 3.3.1.3 (/ BASES APPLICABLE 3. Manual ARI Initiation (continued) SAFETY ANALYSIS, LCO, and There is no Allowable Value for this Function since it is APPLICABILITY mechanically actuated based solely on the position of the ( Continued ) push buttons. Two channels per division of the Manual Initiation Function are required to be OPERABLE when the SLC Jind_FWRB are required to be OPERABLE. ( % e Fr M L b d ~_ 5 Cev-v d 3 9 'UMd L d C . ACTIONS , A Note has been provided to modify the ACTIONS related to N ' A"J instr"=entat4on-ebinnsl4. Section 1.3," Completion Times',3 specifies that once a Condition has been entered, subsequent trains, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial gg % A S entry into the Condition. However, the Required Actions for gg E inoperableWJ instrumentetica chcnnek provide appropriate g* compensatory measures for sepwale inoperable _ channels. As q M such, a Note has been provided that allows separat h s d t.t g A Condition entry for each inoperable channel. Some of the Actions permit placing a division in trip. The protective action actuation becomes 1 out of 3 or 1 out of 2 when this is done. For this condition, plant protection capability is maintained but a spurious actuation becomes more likely. Caution should be used when placing a channel in trip because a spurious SLC injection could cause a significant delay in plant restart.
^
A.1 and A.2 MS % C-M N P E L w Thaca Actions 4EurDtgat appropriate compensatory measures w.m d l@dL are taken A division. when fahTa'*(' rein,,; tan onebecomes inoperable dennel will cause in one the logic to cuq become 1/3 or 2/3 depending on the nature of the failure (i.e. failure which causes a trip vs. a failure which does not cause a trip). Therefore, an additional single failure will not result in loss of protection. Action A.1 forces a trip condition in the inoperable division which causes the initiation logic to become 1/3 for the Function. In this condition a single additional failure (continued) ABWR TS B 3.3-100 P&R 08/30/93
SLC and FWRB Activation B 3.3.1.3 r-BASES , REQUIRED A.] and A.2 (continued) . SURVEILLANCE ( Continued ) will not result in loss of protection and the availability of the Function to provide a plant protective action is at least as high as for 2/4 trip logic. Since plant protection t capability is within the design basis no further action is i required when the inoperable channel is placed in trip. Action A.2. bypasses the inoperable channel which causes the logic to become 2/3 so a single failure will not result in loss of protection or cause a spurious initiation. The Completion Time of six hours for implementing the Actions is based on providing sufficient time for the l operator to determine which of the actions is appropriate. g._ g, @ Implementing these Actions provides confidence that Plant protection is ja ntained for an additional single instrument l
*#b failure. Also, th features do not provide rapid
(
~
response so-th?ro 4c adeouate_ time for_the operator to as 1.sess the need
..elly. for these Therefore, features no further action and+ initiate them is required.
(O) B.I. B.2. and B.3 [ m p g _These Actions assure that appropriate compensatory measures
/p are taken when a"? x m is inoperable in two divisions.
( ^]. For this condition, the actuation logic becomes 2/2.
\ \C b'* R Action B.1 forces a trip condition in one inoperable division which causes the initiation logic to become 1/2 for the Function. In this condition a single additional failure will not result in loss of protection and4he m41ah41Hv mf-the4unct-fon-to-provfde-a plant protective action 4 7 maintained but the degree of redundancy is reduced.
Action B.2 bypasses the other inoperable division in order to force it to a known state. Action B.3 restores at least one inoperable channelMo e c.qq sQu The Completion Time of 3 hours for implementing Actions B.1 is based on providing sufficient time for the operator to perform the Action. An additional 3 hours is permitted for B.2 since it is less urgent. The Completion Times are acceptable because the probability of an event requiring the Function, coupled with a failure that would defeat the other (continued) ABWR TS B 3.3-101 P&R 08/30/93
SLC and FWRB Activation B 3.3.1.3 m Q BASES REQUIRED .B.1. B.2. and B.3 (continued) SURVEILLANCE ( Continued ) channels associated with the Function, occurring within that time period is quM c_sh.% ( {
# " h0'M Smee T protective action is_ maintained as lona as the other l
h.\ s. channels remain OPERABLE,' operation in this condition is be., 4%gg*h,% permitted for 30 daysdAction B.3 Completion Time). The N probability of an event requiring plant scram, combined with failure to scram and an undetected failure in another c.Qnnel of the Function in the Completion Time is quite low. I L1 These Actions assure that appropriate compensatory measures are taken when one OUTPUT CHANNEL of a Function becomes inoperable. For these Functions, a failure in one channel will cause the actuation logic to become 1/3 or 2/3 i depending on the nature of the failure (i.e. failure which ! causes a channel trip vs. a failure which does not cause a l channel trip). Therefore, an additional single failure will ! not result in loss of protection. Action C.1 forces a trip condition in the inoperable channel which causes the initiation logic to become 1/3 for the l Ftiction. In this condition a single additional failure will not result in loss of protection and the availability of the Function to provide a plant protective action is at least as high as 2/4 trip logic. Since plant protection capability is within the design basis no further action is required when the inoperable channel is placed in trip. The Completion Time of six hours for implementing Action C.1 is based on providing sufficient time to implement the Actions. The Completion Time is acceptable because the probability of an event requiring the Function, coupled with failures that would defeat two other channels associated with the Function, occurring within that time period is quite low. D.1 & D.2 m se, a.c.%
- M Atc Requin d Actinn n.1 ': intended to ensure that appropriate actions are taken when two OUTPUT CHANNELS become inoperable. For this Condition the actuating logic becomes 2/2.
(continued) ABWR TS B 3.3-102 P&R 08/30/93
~
i i l SLC and FWRB Activation ! B 3.3.1.3-BASES l REQUIRED SURVEILLANCE IL1 & D.2 (continued) .
' pMP_s ( gbu b,b
( Continued ) Placing one' channel in trip'isiuses the logic to become 1/2.C S%c7le:::phet
.s-a. pretect4en7 Ste re:tcr: ene-h _i:
- int *ittedC-4iey-Completier._ Time an=*-1.
The Completion Time to restore one of the inoperable 4D ['Cb5" Ngd I'* ] - channels is sufficient for the operator to take corrective action and takes into account the low likelihood of an event requiring actuation of the Si.C and FWRIM uring this period. W' 4W ad. / %r Completion of Required Action D.2 places the system in the 0% % , same state as in Condition C and multiple condition entry
' will then result in suitable compensatory measures.
L.1 TA e_ With any Required Action and associa,ted Completion Time not l met, or multiple failures that cause\ loss of a Function or l the logic to become 1/1 the SLC must be declared inoperable. ' l This will cause the LC0 for an inoperable SLC to be invoked and appropriate compensatory measures taken. The allowed Completion Time provides sufficient time to ' if' s perform the Actions.
- ~
SURVEILLANCE ' SR
= Te W-3.3.1.3.1 A3 g cgyp Q REQUIREMENTS g 4% ,
A DIVISION FUNCTIONAL TEST is performed on each required Junction to ensure that the "isi:isp will perform the. a.g intended,funci.ivne% *5
%s. W The requecyof\{92] s is ased o the high reliability hnd dunda cy of\the d ices sed to mplemed$ the fea ures atid e low nherent dri of th 9 devic s. T sdr;isilleiwe sui ugReecqr Wir ' =uan' ~ g' y&B TUrictioh mustspe perAormed-in-conjunction wi Equiv lep sur vwiiiirfEe'in1)e-SStCt-Seni5 y nMr" ntalipn LCO Mr3rld) .
SR 3.3.1.3.2 A COMPREHENSIVE FUNCTIONAL TEST tests a division using a selected range of sensor inputs into the division while (continued) ABWR TS B 3.3-103 P&R 08/30/93
SLC and FWRB Activation B 3.3.1.3 i BASES REQUIRED ~SR 3.3.1.2.2 (continued) SURVEILLANCE ( Continued ) simulating the other three divisions as appropriate. This test verifies the OPERABILITY of all SENSOR CHANNELS, LOGIC CHANNELS, and OUTPUT CHANNELS. See Section 1.1,
" Definitions" for additional information on _he scope _nf-_. -
s this test. s e.g ec 14t,( % sskor mm'})' This surveillance overlaps or is performed in conjunction with the COMPREHENSIVE FUNCTIONAL TESTS in LCO . . The combined or overlapping tests provide complete end-to-end testing of all protective actions associated with the SSLC. l The [18] month frequency is based on the ABWR expected refueling interval and the need to perform this Surveillance under the conditions that apply during a plant outage to reduce the potential for an unplanned transient if the ! Sur*;eillance were performed with the reactor at power. The high reliability of the devices used in the SLC and FWRB processing coupled with the DIVISION FUNCTIONAL TESTS provide confidence that the specified frequency is adequate. (q/ l SR 3.3.1.3.3 , An OUTPUT CHANNEL FUNCTIONAL TEST is performed on each Function to ensure that the channels will operate as intended. The frequency of [18) months is based on the ABWR expected I refueling interval and the need to perform this surveillance : under conditions that apply during a plant outage to reduce ! the potential for an unplanned transient if the surveillance l ' l was performed at power. The high reliability of the signal processing devices coupled with S43 -3:+S.Tprovides : co fidence i that the specified frequency is adequate..
%C h-sv csso w P V V c vto u 6 N E$T REFERENCES NONE )
l l l O ABWR TS B 3.3-104 P&R 08/30/93 1 I____---- . .
ESF Actuation Instrumentation B 3.3.1.4 l B 3.3 INSTRUMENTATION
- w B 3.3.1.4 Engineered Safety Features (ESF) Actuation Instrumentation, i
BASES l BACKGROUND This LC0 addresses the devices needed to cause Actuation of the devices that implement protective actions for the ECCS, non-MSIV isolation, and ESF support features. The ESF actuation system automatically starts appropriate systems to protect against plant transients and accidents analyzed in the ABWR SSAR. The ECCS systems ensure adequate core cooling following Loss ) of Coolant Accidents. The Emergency Core Cooling Systems (ECCS) encompasses the High Pressure Core Flooder (HPCF) system, Automatic Depressurization System (ADS), Reactor Core Isolation Cooling (RCIC) system, and the Low Pressure Flooder (LPFL) mode of the Residual Heat Removal (RHR) system. The purpose of the ECCS is to initiate appropriate l responses from the systems to ensure that fuel is adequately cooled in the event of a design basis accident or transient. The equipment involved with each of these systems is described in the Bases for LC0 3.5.1, "ECCS-Operating." i The ESF support systems needed to assure adequate performance of the ESF systems and adequate heat removal are also covered by this LCO. A description of the systems is given in LCO B3.3.1.19 gguc, seg g q q % g e w n The isolation actuation Functions automatically initiate closure of appropriate isolation valves when measured parameters exceed specified limits. The function of the isolation valves, in combination with other accident mitigation systems, is to limit fission product release l during and following postulated Design Basis Accidents (DBAs). Valve closure within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA. l The non-MSIV isolation instrumentation provides valve closure signals for isolating the containment, Reactor Core Isolation Cooling (RCIC), Reactor Water' Cleanup (CUW) system, and the Shutdown cooling mode of,the ' Residual Heat Removal (RHR) system. TfrE SiteSet CHr""ELHttadtivnased-te
\ j
( ') N (continued) ABWR TS B 3.3-105 P&R 08/30/93 l
i l ESF Actuation Instrumentation B 3.3.1.4 (/ hs44 564or MTR uGEMb@ l BACKGROUND creai.e the 7nitiativi. 549n21e are addreeceA in irn 1 A_h-h i ( Continued ) -inis LCC Eddresses the iseldiun LOGIC umNNEL5 and GUTNT ! l CMNN[l%. l The final initiation signals for the non-MSIV valves are transmitted from the SSLC SLUs to remote ectuation devices.
- The non-MSIV isolation valve lo s contained in three of l as described in L B3. . l . L
- the four SLUa,L N cs 4 - - -
i The ESF portion of the SSLC uses sensors, data transmission, signal processing, relays, and switches that are necessary to cause initiation of the various features needed to mitigate the consequences of a Loss of Coolant Accident l (LOCA). Functional diversity is provided by monitoring a s D wide range of independent parameters. The input data to the 9 gr ESF features originates in devices that monitor local
~ process _ parameters (e.g. high temperatures, high flows) as well as orimary system ye.g RPV level) and containment systemle.g. Drywell pressure) aramete that are indicative of a breach in any of t e various barriers provided to prevent release of fission products and maintain l core integrity. The ESF control logic hardware and software l ; for developing initiation signals are contained within the C four independent, divisional panels of Safety System logic and Control (SSLC) as described in LC0 B3.3.1.
A description of the operation of the ESF SENSOR CHANNELS and LOGIC CHANNELS is given in LC0 3.3.1.14 tach o m - redundant pair of ESF SLUs sends initiation data to a pair l of OUTPUT CHANNELS via the EMS. Both OUTPUT CHANNELS must receive initiation data before system actuation will occur. The 2/2 output initiation logic is provided to reduce the potential for inadvertent ESF actuation and the resulting stress on plant equipment and attendant plant risk. There is a pair of OUTPUT CHANNELS for each required device (pump, valve,etc.). l One of a redundant pair of OUTPUT CHANNELS may be bypassed either manually or automatically be the SSLC self test. When an OUTPUT CHANNEL is bypassed the actuation logic becomes one-of-one. tr*%L h Sil~. s
~
Mosl of the SENSOR CHANNELS required to initiate ESF syst as 7 re covered in LCO 3.3.1.19 This LCO covers the LOGIC CHANNELS, OUTPUT CHANNELS, and those SENSOR CHANNELS not addressed in LCO 3.3.1.1. The SENSOR CHANNELS that are g* h hW t' %%%%Lhw (continued) t V ._ _ _ _ _ _ _ _ _ bi D IMW Yh p ABWR TS _ --
- B-3:3 106 ~ _
Jj P&R 08/30/93 l
ESF Actuation Instrumentation B 3.3.1.4 BASES BACKGROUND routed directly to the SLUs are covered by this LCO since ( Continued ) the SLUs are part of the LOGIC CHANNEL. Table B3.3.1.3-1 provides a summary of the systems and features addressed by this LCO. APPLICABLE Operation of the ECCS and its support features is explicitly SAFETY ANALYSIS or implicitly assumed in the analysis of references of 1, 2, LCO, and and 3. The ESF is initiated to preserve the integrity of the i APPLICABILITY fuel cladding by limiting the post LOCA peak cladding temperature to less than the 10CFR50.46 limits. The ESF l channels are required to be OPERABLE in the MODES or other l specified conditions that may require ESF initiation to i % mitigate transient.theTh consequences of afordesign basissystems accidentareor w licability basis the ECCS J WYo kgivenin1003.5. and 3.5.23 To ensure reliable ECCS
= initiation, a combination of features eca required. _ M'N f The ESF LOGIC CHANNELS and OUTPUT CHANNELS satisfy Criterion 3 of the NRC Policy Statement.
i The isolation of flow paths from the containment and the , Reactor Coolant Pressure Boundary (RCPB) are implicitly assumed in the safety analyses of References [] and [] to i initiate closure of valves .to limit offsite doses. Refer to LCO 3.6.1.3, " Primary Containment Isolation Valves (PCIVs)," and LC0 3.3.1.13 "SSLC Sensor Instrumentation" Applicable Safety Analyses Bases, for more detail-. t The ESF isolation actuation Functions satisfiesJriterion 3 of the NRC Policy Statement. E. cA%ppi.J The OPERABILITY of the ESF actuation is dependent on the OPERABILITY of the individual Functions specified in LCO ! 3.3.1.1 and in this LCO. The OPERABILITY of the OG CHANNEL and OUTPUT CHANNEL Functions shown in7able
- 3. 3 .1. (-
are covered by this LCO. g A LOGIC CHANNEL is OPERABLE when it is canable of accessing the divisional trip data from th 50CIATED3ENSOR CHANNELS, using the trip data to generate device ac_tyal.Lon data, and transmitting the actuation data to the TSSOCIAT 1 OUTPUT CHANNELS.
\ouw M C (continued)
ABWR TS B 3.3-107 PAR 08/30/93 l
._4
ESF Actuation Instrumentation B 3.3.1.4 ; i O BASES APPLICABLE An OUTPUT CHANNEL is OPERABLE when it is capable of SAFETY ANALYSIS, receiving the actuation data from the LOGIC channel and. . LCO, and converting the data to signal levels suitable for causing i APPLICABILITY the associated device (pump, valve, etc) to assume its , ( Continued ) protective action state and restore the device to its normal- i state. , 1.a. 1.b. 2.a. 2.b. 3.a. 3.b. ECCS Pumo Discharae Flow-tow { and Pressure - Mah j The minir m flow SENSOR CHANNELS are provided to protect the ~ HPCF, LrFL, and RCIC pumps from overheating when the pump is t operat'ng and the flow through the normal injection path is insufficient to provide adequate pump cooling. The minimum flow valve is opened when pump discharge pressure is high ! enough to indicate pump operation and the flow is low enough to indicate the potential for inadequate cooling. The minimum flow valve is automatically closed when the flow rate is adequate to protect the pump. For the HPCF pumps, s the minimum flow valve is also closed when discharge l pressure is low. O These Functions are assumed to he OeERABLE and caPabie of closing the minimum flow valves in the transients and accidents analyzed in References 1, 2, and 8. The core cooling function of the ECCS, along with the scram action of , the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. , One flow and one pressure transmitter per pump are used to detect the associated subsystem discharge pressure to verify the operation of the pump. Note that these pressure , transmitters are not the same as the ones used in the ADS i permissive (Function 34). Data values representing pressure and flow are received by the ESF@$fassociated with~the l e n"=n initiation division via the EMS in the same Lvision.
-d4 9' .^ The' data values are compared to the respective setpointsWto determine if the associated minimum flow valve is to be N . d closed or opened. The LPFL minimum flow valves are time delayed so the valves will not open unless high pressure concurrent with low flow persists for-[8] seconds. The time delay is provided to limit reactor vessel inventory loss during the startup of the RHR shutdown cooling mode.
(continued) l ABWR TS B 3.3-108 P&R 08/30/93 l f
4 ESF Actuation Instrumentation ; 8 3.3.1.4 I BASES , APPLICABLE 1.a. 1.b. 2.a. 2.b. 3.a. 3.b. ECCS Pumn Discharae Flowdow SAFETY ANALYSIS, and Pressure - hiah (continued) LCO, and APPLICABILITY The ECCS System Flow Rate-Low Allowable Values are high . ( Continued ) enough to ensure that pump flow rate is sufficient to ! protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to allow full flow into the core. The ECCS Pump Discharge Pressure-High Allowable Values are set high enough to ensure that the valve will not be open when the pump is not operating. One channel of these functions for each pump are required to be OPERABLE when the associated ECCS is required to be ' OPERABLE, to ensure that no single instrument failure can preclude the ECCS function. Refer to LCO 3.5.1h LC0 3.5.2 for Applicability Bases for the FrCS_ Subsystems 7
% -opep3J 2.c. HPCF Pumo Suction Pressure-Low The HPCF low suction pressure SENSOR CHANNEL is provided to protect the pump from damage due to cavitation. If the suction pressure is less than the pump NPSH requirement, the pump start will be inhibited.
SLUs l The suction pressure data originates in~a pressure l transmitter and is sent via the EMS to the ESF in the division that controls the HPCF pump being mon ored. The SLU logic is arranged so that Low suction pressure must exist for a specified amount of time before pump. start will be inhibited to prevent spurious inhibits due to suction i pressure transients. The HPCF low suction pressure signal is 1 automatically reset (i.e. no manual reset needed to remove the pump start inhibit when suction pressure recovers). The HPCF Suction Pressure-Low Function is assumed to be OPERABLE and will not cause a spurious pump start inhibit during the transients and accidents analyzed in References 1, 2, and S M
,5 1
The HPCF Suction Pressure-Low Allowable Value are selected to assure that there is sufficient NPSH for the pump and i prevent spurious start inhibits due to normal fluctuations in suction pressure. l l , - (continued)- l ABWR TS B 3.3-109 P&R 08/30/93 l I
6 ESF Actuation Instrumentation B 3.3.1.4 1 . - -~~ BASES 4 G5 F 30$% ) , APPLICABLE 2.c. HP Pumo Suction Pressure-Low (continued) SAFETY ANALYSIS, LCO, and One channel (for each HPCF system is required to be OPERABLE APPLICABILITY when the HPCF is required to be OPERABLE. Refer to ( Continued ) LCO 3.5.1 and LCO 3.5.2 for HPCF Applicability Bases. ' E u.s . a t e.t-4.G 5.a. 5.b. 7.d. 7.e. Divisions I. II. 8 III Loss of Voltaae- 1 6.9 kV and Dearaded Voltaae-6.9 kV. The 6.9 kV busses are monitored to detect a loss of the , offsite power or degraded bus conditions. If the bus voltage is less then required to support ESF Features, the , associated emergency Diesel-Generator (DG), provided as a t'ack up to the offsite power source, is started. These /d SENSOR CHANNELS are provided to assure that there is i i sufficient power available to supply safety systems should they be needed. This Function is assumed in the loss of offsite power analysis of reference .TheRCWMstemis , also started on these Functions since it rovides cooling ' for the diesels. The signals for this function originate in undervoltage O i relays connected to each phase of the 6.9 kV bus. The phases are connected so that the loss of a single phase will cause two of the undervoltage relays to trip. The three t undervoltage relays are combined in 2/3 logic so that a loss of any phase will cause starting of the associated DG while > a failure in one of the relays will not cause a spurious j start. A time delay is provided to prevent starting the DG due to transient conditions on the bus. l SW WThe undervoltage relay trip signals are transmitted to the
*" - in the associated division via the EMS. Three channels of this Function are required to be OPERABLE in each of divisions I, II, & II in order to cause start of the associated DG on a valid signal. The Functions must be wij operable in MODES 1, 2, and 3 and in MODE 54% hen any safety system is required to be OPERABLE as described in LCO 3.8.2
*Ac. 5. w .s. s% A 4 The Allowable values ar elected high enough to detect !
degradation in offsite power to the point where it cannot supply the loads but low enough to assure that normal transients do not cause a spurious DG start. The degraded , voltage Function uses a higher voltage set point but a l ' longer time delay than the loss of voltage Function. 10.M b5 -db
% 6- Me (continued)
Cs ha m@ ! ABWR TS B 3.3-110 P&R 08/30/93
ESF Actuation Instrumentation
B 3.3.1.4 pd 5 ? WS ~ 09eydi Q'Q)
Q BASES i APPLICABLE 1.c. 2.d. 3.c. 4.a. ECCS Systems Initiation. SAFETYANALYSIS,I LCO, and These Functions are the LOGIC CHANNELS that send initiation APPLICABILITY data to the OUTPUT CHANNELS for the ECCS systems. Two LOGIC ( Continued ) CHANNELS (dual redundant SLUs) must be OPERABLE when the associated ECCS Feature is required to be OPERABLE. The a licability basis for the ECCS systems are given in LCO b.ht I~6"
.. nd 3.5.2. A LOGIC CHANNEL is OPERABLE when it is capablehletdat.iag. device actuation data and transmitting it to the OUTPUT CHANNELS.
10.a. 11.a. 12.a. 13.a. and 14.a Isolation Initiation. These Functions are the LOGIC CHANNELS that send initiation data to the OUTPUT CHANNELS for the various isolation valves. The sensor Functions for each of the isolation valves are as described in LC0 3.3.1.1, "SSLC Sensor Instrumentation". Two LOGIC CHANNELS (dual redundant SLUs) must be OPERABLE when the associated isolation function is required to be Q U/ OPERABLE. See LCO 3.3.1.1, "SSLC Sensor Instrumentation" for the basis. A LOGIC CHANNEL is OPERABLE when it is capable of h w W g -gener: ting initiation data and transmitting it to the associated OUTPUT CHANNEL. .
=vd 15oW.bh
- 1. d . 2. e. 3.d . 4. b. 5 d . 6 b. 7. b. 8. b. 9. b. 10. b. 11. b.
12.b. 13.b. and 14.b. ESF%evice Actuationa i i These functions are the OUTPUT CHANNELS that cause the % devices (e.g. pumps, valves) to begin performing their intended plant protective action. There is an OUTPUT CHANNEL connected to each actuated device that causes the device state to change to the state suitable for its protective Funct%n. Each output receives an appropriate signal from the associated LOGIC CHANNEL when a protective action is required. The OUTPUT CHANNEL Functions must be OPERABLE when the associated ESF eature is required to be OPERABLE. The channels are OPERA LE when they are capable of going to the stateneededtoperormtheprotectiveactiog O a6h% .m - (continued) i ABWR TS B 3.3-111 P&R OB/30/93
ESF Actuation Instrumentation B 3.3.1.4 BASES APPLICABLE 1.e. 2.f. 3.e. ECCS Iniection Manual Initiation. SAFETY ANALYSIS, LCO, and The Manual Initiation push button channels introduce signals APPLICABILITY into the appropriate ECCS logic to provide manual initiation ( Continued ) capability that is redundant to the automatic initiation SENSOR CHANNELS. There is one push button for each of the ECCS pumps. The manual actuation data is acquired by the SLU that controls the ECCS pumping subsystem, except for HPCF B. HPCF B Manual Initiation is hardwired to provide a diverse means of ECCS initiation. The Manual Initiation Function is not assumed in any accident or transient analyses in the ABWR SSAR. However, the Function is retained for overall redundancy and diversity of the ECCS Features as required by the NRC in the plant licensing basis. l There is no Allowable Value for this Function since it is l mechanically actuated based solely on the position of the h - LPFL initiation switches. Each division of the Manual Initiation Function is required to be OPERABLE when the e associated ECCS is required to be OPERABLE. Refer to LCO 3.5.1 and LC0 3.5.2 for Applicability Bases for the ECCS subsystems. l 4.c. ADS Manual Initiation l The Manual Initiation push button channels introduce signals into the ADS logic to provide manual initiation capability that is redundant to the automatic SENSOR CHANNELS. There are two push buttons for each ADS division trip system (total of four). The manual actuation data is acquired by the SLUs that controls the ADS subsystems. Both switches associated with one of the ADS divisions must be activated to initiate ADSc ,_,, i g;g {,v ' f e,g, The Manual Initiation Function is not assumed in any accident or transient analyses in the ABWR SSAR. However, the Function is retained for overall redundancy and diversity of the ADS function as required by the NRC in the plant licensing basis, i L. There is no Allowable Value for this Function since the-
'diVBton is mechanically actuated based solely on the position of the push buttons. Four channels of the Manual l l' '
f (continued) l ABWR TS B 3.3-112 P&R 08/30/93 l
ESF Actuation Instrumentation ! py~ ~ B-3.3.1.4 l M 4$~ DQes & \ i BASES % , 'p l APPLICABLE 4.c. ADS Manual Initiation (continued) SAFETY ANALYSIS, AMdoM i LCO, and Initiation Function (two e e....e 4 and two pushbutt r.s per : APPLICABILITY ADS tr q syst ) are only required to be OPERABLE en the ( Continued ) ADS is require be OPERABLE. Refer to LCO .5.1 for ADS Applicability Bases. 5 . 7.c. 9.c. ESF Manual Initiation. C 4d O The Manual Initiation push button channels introduce signals into the appropriate ESF Feature logic to provide manuel initiation capability that is redundant to the automatic i initiation SENSOR CHANNELS. There is one push button for i each of the ESF s p t-- with manual initiation capability. The manual actuation dat isacquiredbytheSLUghat controls the ESF Feature. [g g%g he' t- ! The ESF Manual Initiation FunctionsYn$t assumed in any l accident or transient analyses in the ABWR SSAR. However, l the Function is retained for overall redundancy and j diversity of the m e; as required by the NRC in : I the plant licensing bas . 5. S p There is no Allowable Value for~this Function since it is ! mechanically actuated based solely on the position of the ! M TPFi: initiation switches. Each channel of the Manual ! l Initiation Function is required to be OPERABLE when the l associated ESF Feature is required to be OPERABLE. , l l 10.c. 11.c. 12.c. 13.c. and 14.c. Isolation Valve Manual ' l Initiation-The Manual Initiation push button channels' introduce signals into the isolation logic to provide manual initiation capability that is redundant to the automatic SENSOR CHANNELS. There are two push buttons for each isolattena h D -Punu.iun. One pushbutton controls the inboard valve (s) for_. isolating the flow path (s) and the second controls the A _ outboard valve (s). The manual actuation data is acquired by TEt V the SLlPin the same division as the valve. Either of the i pushbuttons causes the flow path to be isolated. l The Manual Initiation Function is not assumed in any accident or transient analyses in the ABWR SSAR. However, (continued) ABWR TS B 3.3-113 P&R 08/30/93 i i L
ESF Actuation Instrumentation B 3.3.1.4 BASES APPLICABLE 10.c. 11.c. 12.c. 13.c. and 14.c. Isolation Valve Manual SAFETY ANALYSIS, Initiation (continued) LCO, and APPLICABILITY the Function is retained for overall redundancy and ( Continued ) diversity of the ADS function as required by the NRC in the plant licensing basis. There is no Allowable Value for this function since the division is mechanically actuated based solely on the position of the push buttons. Two channels of the Manual Isolation Initiation Functions are required to be OPERABLE when the associated isolation Function is required to be OPERABLE. C 5.E Diesel Generator Initiation. @ck l The Diesel Generators (DG) are used to supply emergency back up power to the ESF systems. The division II and III DGs receive a start signal when HPCF is initiated and all three divisions receive a start signal when the LPFL's are initiated. Each DG also receives a start signal from the divisional 6.9 KV bus monitors.
]
.g c The DGs LOGIC CHANNELS are required to be OPERABLE in MODES 3 , 3, and in MODE 4 and 5 when the associated featnra are required to be OPERABLE. u m m--
m tscfr j 5 n ST.nm - Y 6.aStandbyGasTreatmentinitiation.(MA-k The Standby Gas Treatment (SGTS) systems removes radioactive gasses from the containment atmosphere following a LOCA and . when the normal offgas treatment system is unable to maintain containment activity levels within specified bounds. The OPERABILITY of the SGTS is implicitly assumed in 9 plant offsite dose calculations. The SGTS system is initiated on high drywell pressure, low ~f . level 3, Reactor building area high radiation, or fuel u I handling area high radiation. This LOGIC CHANNEL Function is } ; required to be OPERABLE in %e MODE no other conditions ! _ -that the SGTS is re_ quired to be OPERABL . l hi f,d.$ b., b wa.- % p %L 1,ubg 60 M' A LTE.A.AWp.g
,A Gw ar'q1c4q% wer i Vde4 4.ud Lwrig ww % o eq in.Jic-L h \ _ l .O - "3e w ==. -sc r -~27 / <ce ti ee) i l
l ABWR TS B 3.3-114 P&R 08/30/93 l l
ESF Actuation Instrumentation B 3.3.1.4
; l BASES 1
APPLICABLE 7.a. Reactor Buildina Coolina Water / Service Water i SAFETY ANALYSIS, Initiation. LCO, and , APPLICABILITY This Function is included to provide confidence that the ( Continued ) HVAC needed to support ESF systems is within the design ! basis. The initiation occurs on high drywell~ pressure, low l level 1, or 6.9 KV emergency bus monitors. This function is i i not explicitly assumed in any accident or transient analysis in the ABWR SSAR. These signals, or suppression pool high t temperature, also initiate shedding of non-essential loads. This LOGIC CHANNEL Function is required to be OPERABLE in MODES 1, 2, & 3 and in MODE 4 and 5 when the DGs are required to be OPERABLE. ; 8 a. Containment Atmospheric Monitorina System Initiation, i The Containment Atmospheric Monitoring (CAM) system provides indications of the activity level in the containment l following a LOCA. The CAM system is automatically started on 1 i l j a high drywell pressure or low level 1 signal. Two CAM l systems are provided, one in division I and one in division . II. The OPERABILITY of the CAM is not assumed in any ABWR - SSAR transient or accident analysis. The CAM automatic start LOGIC CHANNEL Function must be l l OPERABLE in MODES 1, 2 & 3 since these are the MODES where ' l the CAM system is required to be operable. ( ! 9.a. Suporession Pool Coolino Initiation. l Suppression pool cooling is included to provide confidence that containment overpressure will not occur. Therefore, , this Function is a~utomatically initiated on high suppression ' pool temperature._The suppression pool cooling initiation is needed te keep the energy in the containment within the assumptions of the containment pressure analysis. The suppression pool cooling LOGIC CHANNEL Function must be OPERABLE in MODES 1, 2, & 3 since these are the MODES where suppression pool cooling is required to be OPERABLE. (continued) ABWR TS B 3.3-115 P&R 0B/30/93 L ..
ESF Actuation Instrumentation B 3.3.1.4 : ( BASES [tPS % APPLICABLE An OUTPUT CHANNEL is OPERABLE when it is cap ble of SAFETY ANALYSIS, receiving the actuation data from the LOGICCchannA and LCO, and converting the data to signal levels suitable for causing APPLICABILITY the associated device (pump, valve, etc) to assume its ( Continued ) protective action state and restore the device to its normal state. 1.a. 1.b. 2.a. 2.b. 3.a. 3.b. ECCS Pumo Discharoe Flowdow and Pressure - hiah The minimum flow SENSOR CHANNELS are provided to protect the HPCF, LPFL, and RCIC pumps from overheating when the pump is operating and the flow through the normal injection path is insufficient to provide adequate pump cooling. The minimum flow valve is opened when pump discharge pressure is high enough to indicate pump operation and the flow is low enough to indicate the potential for inadequate cooling. The minimum flow valve is automatically closed when the flow rate is adequate to protect the pump. For the HPCF pumps, the minimum flow valve is also closed when discharge pressure is low. g N These Functions are assumed to be OPERABLE! and capable of closing the minimum flow valves in the traitsients and accidents analyzed in References 1, 2, and B. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. 1 One flow and one pressure transmitter per pump are used to I detect the associated subsystem discharge pressure to verify ;
. N he operation of the pump. Note that these pressure l
-y L ' g6 A w .
transmitters are not the same as the ones used in the ADS x permissive V=ction 34). Data values representing pressure and flow are received by the ESF DTM associated with the l h % A11,1 Mste ump initiation division via the EMS in the same division. s%% ggN ,T e data values are compared to the respective setpoints to termine if the associated minimum flow valve is to be closed or opened. The LPFL minimum flow valves are time delayed so the valves will not open unless high pressure concurrent with low flow persists for (S) :nsn The time ; delay is provided to limit reactor vessel inventory loss durg h startup of the RHR shutdown cooling mode. G m e;. % h , ( (continued) ABWR TS B 3.3-108 P&R 08/30/93
ESF Actuation Instrumentation B 3.3.1.4 l BASES ACTIONS A Note has been provided to modify the ACTIONS. i Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent trains, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition i l continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable ESF provide appropriate compensatory measures for multiple , inoperable divisions. As such, a Note has been provided l that allows separate Condition entry for each inoperable ESF channelftr- , e r 'is a\dA og M 1 'ndo \G og A.!. A.2.1. and A.2.2 This condition assures that appropriate actions are taken ! when one of a redundant pair of ESF LOGIC CHANNELS is ! inoperable. Placing the associated OUTPUT CHANNEL in bypass !- causes the logic to change from 2 out of 2 to 1 out of I so initiation capability is maintained. However, the ESF i Feature is more vulnerable to spurious actuation. The 1 hour Completion Time for A.1 provides sufficient time ; for the operator to determine which OUTPUT CHANNELS are j associated with the inoperable channel. Plant operation in this condition for the specified time does not contribute ! significantly to plant risk. Since plant protection is maintained and the potential for a i spurious trip is low because of the high reliability of the logic, operation in this condition for an extended period is acceptable. Therefore, a Completion Time of 30 days is allowed for restoring the inoperable channel (Action A.2.1). The probability of an event requiring the Function coupled with an undetected failure in the associated redundant LOGIC l CHANNEL in the Completion Time is quite low. Also, redundant ESF Features may provide adequate plant protection given the unavailability of the associated Features. The self-test capabilities of the SSLC provide a high degree of confidence l (continued) ABWR TS B 3.3-116 P&R 08/30/93 l
ESF Actuation Instrumentation B 3.3.1.4 BASES ACTIONS A.1. A.2.1. and A.2.2 (continued) ( Continued ) that no undetected failures will occur within the allowable Completion Time. Action A.2.2 provides an alternate to Action A.2.1. Verification of the OPERABILITY of any redundant Feature (s) provides confidence that adequate plant protection capability is maintained. Action A.2.2 does not apply to Features with no redundant alternate. The Completion Time for Action A.2.2 is as given for Action A.2.1. Implementing either of the Actions A.2.1 or A.2.2 provides confidence that plant protection is within the design basis so no further Action is required. 1L1 This Condition is provided to assure that appropriate action is taken for single or multiple inoperable channels that cause automatic or manual actuation of an ESF Feature to
/ ,~) become unavai able. However, automatic and manual initiation for redundan features are not affected.
The 1 hour Completion Time for Action B.1 provides some amount of time to restore automatic or manual actuation before additional Required Actions are imposed. Action B.1 either restores the intended plant protection capability or will cause condition A to be invoked due to multiple entry into the conditionstg
.C_J ci h_%
This Condition is provided to assure that appropriate action is taken for inoperable OUTPUT CHANNELS. The nature of the OUTPUT CHANNELS is such that the failure that makes the channel inoperable could also prevent bypassing the channel. Therefore, no distinction is made between one or two
- inoperable OUTPUT CHANNELS and an inoperable channel is assumed to make the associated device (pump, valve, etc.)
unable to perform its protective action. i (continued) l ABWR TS B 3.3-117 P&R 08/30/93
ESF Actuation Instrumentation B 3.3.1.4 BASES (O _ b ACTIONS [.d (continued) ( Continued ) Required Action C.1 restores the actuation capability for the device controlled by the channel. Action C.2 provides an alternate to C.1 for some devices. Actuating the associated device is equivalent to the channel performing its intended Function and will place the associated device in the configuration needed to perform its protective action. Actuating the associated device cannot be performed if it would cause violation of other safety criteria, prevent normal plant operation, create potential thermal shock, etc. The I hour Completion Time for Action C.1 provides some amount of time to restore automatic or manual actuation before additional Required Actions are imposed. The 1 hour Completion Time for Action C.2 provides some amount of time for the operator to determine if the associated device can be actuated.
'We L MS
,C U. O Q D If the specified action for Conditions B or E are not implemented within the specified Completion Times the g Feature (s) associated with the inoperable channel must be o declared inoperable. Declaring the associated feature inoperable will cause entry into the appropriate Cunditicio dq N LC0 gthat address the Feature so appropriate compensatory measures will be taken.
N4 u P 4 O$
\)
r-/ Thisconditionassuresthatappropriatecompedsatory () U , w asures are taken for the ADS LOGIC CHANNELS w OUTPUT d ag g CHANNEth For ADS, these channels cannot be tripped or bypassed so the associated valves must be declared Jg inoperableifanyoneofthetwochannelsisinoperable.(g P 2 ' The Completion Time provides adequate time for the operator 1 g to complete the action. The Completion Time is acceptable
$# because of the probability of an event requiring the feature coupled with failures in redundant features within the time frame is_very low. _ _
j [h WC., iMoM'N $ E W#b CA
- b*W5 A CC'
'vfy k & Li&ds os u%%H L 'OL%- Ek
\ e 4 G OktN
\ h ke. < 4eZT
. gn ow c u M 5- G ; <_. (continued)
~~
l ABWR TF B 3.3-118 P&R 08/30/93
ESF Actuation Instrumentation B 3.3.1.4 BASES SURVEILLANCE Thi\L a resse tife operability of th LOGIlCHA ELS%nd REQUIREMENTS 007PWT AN LS f E$R which cover the LUs,butput2/2{ voter, a th manu 1 attuati'on Fun ions b SR 3 . 3 .1.'ll .1 @L Performance of the SENSOR CHANNEL CHECK provides confidence , that a gross failure of a device in a SENSOR CHANNEL has not occurred. A SENSOR CHANNEL CHECK is a comparison of the parameter indicated in one SENSOR CHANNEL to a similar parameter in a different SENSOR CHANNEL. It is based on the assumption that SENSOR CHANNELS monitoring the same parameter should read approximately the same value. Significant deviations between the channels could be an indication of excessive instrument drift on one of the ' channels or other channel faults. A SENSOR CHANNEL CHECK will detect gross channel failure; thus, it is key to lf verifying the instrumentation continues to operate properly , between each DIVISION FUNCTIONAL TEST. Agreement criteria are determined by the plant staff based on a combination of the channel instrument and parameter indication uncertainties. The high reliability of each channel provides confidence i that a channel failure will be rare. In addition, the ! continuous self tests provide confidence that failures will be automatically detected. However, a low surveillance interval of 12 hours is used to provide confidence that gross failures which do not activate an annunciator or alarm l will be detected within 12 hours. The SENSOR CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO. l Y - SR 3.3.1.4.2 An OUTPUT CHANNEL FUNCTIONAL TEST is performed on each OUTPUT CHANNEL to provide confidence that an ESF device will actuate as intended. This test overlaps or is performed in (continued) ABWR TS B 3.3-119 P&R 08/30/93
ESF Actuation Instrumentation B 3.3.1.4 BASES SURVEILLANCE SR 3.3.1. 2 (continued) REQUIREMENTS ( Continued ) l conjunction with the COMPREHENSIVE FUNCTIONAL TEST in SR 3.3.1.3.4 to provide end to end testing. v* ha I181 month frequency is based on the ABWR expected ps FUllAG INTERVXDand the need to perform this Surveillance under the conditions that apply during a plant outage to reduce the potential for an unplanned transient if the , Surveillance were performed with the reactor at power. The high reliability of the devices used in the OUTPUT CHANNELS provide confidence that the specified frequency is adequate. > SR 3.3.1.13 l l A DIVISIONAL FUNCTIONAL TEST is performed on the LOGIC ! CHANNELS and SENSOR CHANNELS in each ESF division to provide ! confidence that the functions will perform as intended. The l test is performed by replacing the normal signal with a test , signal as far upstream in the channel as possible within the >
'O constraints of the instrumentation design and the need to perform the surveillance without disrupting plant operations. See L
~
scope of the test. 1.lfor additional information on4the g ,
, W g. {y, l The devices used to implement the Functions are of high reliability and have a high degree of redundancy. Therefore, the [92] day frequency provide confidence that device ;
Actuation will occur when needed. This test overlaps or is ! performed in conjunction with the DIVISIONAL FUNCTIONAL i TESTS performed under LCO 3.3.1.1 to provide testing up to I the final actuating device. N SR 3.3.1.1.4 A COMPREHENSIVE FUNCTIONAL TEST tests a division using a selected range of sensor inputs into the division while simulating the other three divisions as appropriate. This test verifies the OPERABILITY of all SENSOR CHANNELS, LOGIC CHANNELS, and OUTPUT CHANNELS. See L I information on the scope of this test. c 10,, % 1.1{for additional g g4,m,zwc' s s (continued) ABWR TS B 3.3-120 P&R 08/30/93 . l
. . -_ . _ .- i
< ) ESF Actuation Instrumentation B 3.3.1.4 BASES , b 4 SURVEILLANCE SR 3.3.1.1.4 (continued) 1 REQUIREMENTS ( Continued ) This surveillance overlaps or is performed in conjunction l with the COMPREHENSIVE FUNCTIONAL TESTS in LCO 3.3.1.1. The l combined or overlapping tests provide complete end-to-end l testing of all ESF protective actions. i l The (181 month frequency is based on the ABWR expected l REFUELING INTERV and the need to perform this Surveillance n i ions that apply during a plant outage to l / un h e l l reduce the potential for an unplanned transient if the , Surveillance were performed with the reactor at power. The l high reliability of the devices used in the SSLC processing ! j coupled with the CHANNEL FUNCTIONAL TESTS provide confidence I that the specified frequency is adequate.
/
I T .W M l SR 3.3.543-t i This SR ensures that the individual channel response times I for ECCS actuation are less than or equal to the maximum ( values assumed in the accident analysis. Response time l y W 4/m\ testing acceptance criteria are included in Reference [ ]. l Qp j V .T h n r181 mn frequency is based on the ABWR expected REFUEllNG JNTERVA nd the need to perform this Surveillance under the conditions that apply during a plant outage. The l high reliability of the devices used in the ESF and ECCS processing coupled with operating experience which shows that random failures of instrumentation and embedded processor components causing serious time degradation, but not channel failure, are infrequent provide confidence that ; the specified Frequency is adequate. SR 3.3.1.9.6 A SENSOR CHANNEL CALIBRATION is a complete check of.the instrument loop and the sensor. This test verifies a SENSOR f4ANNEL responds to the measured parameter within the n cessary range and accuracy. SENSOR CHANNEL CALIBRATION l leaves the channel adjusted to account for instrument drifts i i between successive calibrations. Measurement error historical determinations must be performed consistent with the plant specific setpoint methodology. The channel shall (continued) ABWR TS B 3.3-121 P&R 08/30/93 l
)
l ESF Actuation Instrumentation B 3.3.1.4 i ( BASES w SURVEILLANCE SR 3.3.1.4.6 (continued)
. REQUIREMENTS
( Continued ) be left calibrated consistent with the assumptions of the . setpoint methodology. As noted, the calibration includes l calibration of all parameters used to establish derived setpoints and all parameters used to automatically bypass a trip function. ! If the as found trip point (fixed or variable) is not within its Allowable Value, the plant specific setpoint' methodology may be revised, as appropriate, if the history and all other pertinent information indicate a need for the revision. Suitable calibration shall be provided that is consistent with the assumptions of the current plant specific setpoint methodology. A iJu MS 4 SR 3.3.13.7 An manual initiation CHANNEL FUNCTIONAL TEST is performed on t each required manual initiation channel to provide l: confidence that an ESF device will actuate as intended. , l
^ The [181 month frequency is based on the ABWR expected dFUELING INTEliVAt> and the need to perform this Surveillance ;
under the conditions that apply during a plant outage to reduce the potential for an unplanned transient if the Surveillance were performed with the reactor at power. _The ! high reliability of the devices used for manual initiation provide confidence that the specified frequency is adequate. REFERENCES 1. ABWR SSAR, Section [5.2]. l
- 2. ABWR SSAR, Section [6.3].
3.- ABWR SSAR, Chapter [15].
- 4. ABWR SSAR, Chapter [ ]
i O 1 ABWR TS B 3.3-122 P&R 08/30/93 ) l
I ESF Actuation Instrumentation
'B 3.3.1.4 l ,
BASES i Table 83.3.1.3-1 (Page 1 of 1) ! ESF Systems Instrumentation l l 1. Low Pressure Core Flooder Actuation. ! 2. High Pressure Core Flooder Actuation. ;
- 3. Reactor Core Isolation Cooling System Actuation, i t
l 4. Automatic Depressurization System. ,
~5. Diesel-Generator Actuation.
l
- 6. Standby Gas Treatment System Actuation.
l 7. Reactor Building Cooling Water / Service Water Actuation.
- 8. Containment Atmospheric Monitoring
- 9. Suppression Pool Cooling Actuation.
- 10. Primary Containment Isolation Valves Actuation.
l
- 11. Secondary Containment Isolation Valves Actuation. j l 12. Reactor Core Isolation Cooling Isolation Actuation. ,
- 13. Reactor Water Cleanup Isolation Actuation.
j 14. Shutdown Cooling System Isolation Actuation. l O ABWR TS B 3.3-123 P&R 08/30/93 l l
SRNM Instrumentation B 3.3.2.1 B 3.3 INSTRUMENTATION l B 3.3.2.1 Startup Range Neutron Monitor (SRNM) Instrumentation BASES L ! BACKGROUND The SRNMs provide the operator with information relative to the neutron level from very low flux levels to 15% power. l There is sufficient overlap between the SRNMs and the APRMs l to assure continuous indication of core power level. The l SRNM subsystem protects agatast abnormal reactivity insertions when the plant is in the startup power range by sending a trip signal to the RPS on a high neutron f. lux J level or short reactor period (i.e. high rate of flux increase). The setpoints are selected to provide confidence T O iu .ueint:ining fuel integrity or the worst reactivity ! insertion event coincident wit the most limiHnn GN bypass or out of service conditio . ',3 %;4: q The SRNM subsystem of the Neutron Monitoring System ) consists of ten channels connected to detectors which are l evenly distributed throughout the core and located slightly j above the fuel mid-plane. Each channel consists of a fission , l chamber with associated cabling, signal conditioning l equipment, and electronics to implement the various SRNM s functions. The SRNM's are assigned to the four Neutron Monitoring System (NMS) divisions as follows: l l Division I: SRNM Detectors A, E & J Division II: SRNM Detectors B & F Division III: SRNM Detectors C, G & L l Division IV: SRNM Detectors D & H ! The SRNM channels are divided into three bypass Groups. One channel from each Group may be bypassed (i.e. bypass of up to three channels). The Groups are arranged so there is at least one unbypassed channel in each division and one l unbypassed channel in each core quadrant. The SRNMS are l assigned to the following bypass Groups: 1 l Group 1: SRNM A, B, F, G Group 2: SRNM C, E. H Group 3: SRNM D. J, L (continued) ABWR TS B 3.3-124 P&R 08/30/93 l
l SRNM Instrumentation B 3.3.2.1 BASES BACKGROUND There are three multiposition operator control switches that ( Continued ) correspond to the Groups, so that or.ly one channel from each l Group can be bypassed. I l In addition to scram and rod block functions, each SRNM channel includes indication and alarm functions. Scram and rod block functions are addressed by other LCOs while this LCO addresses OPERABILITY requirements only for the monitoring and indication functions. During refueling, shutdown, and low power operations, the primary indication of neutron flux levels is provided by the SRNMs. During refueling special movable detectors may be connected to the normal SRNM circuits. The SRNMs provide monitoring of reactivity changes during fuel or control rod i movement and give the control room operator early indication of unexpected subtritical multiplication that could indicate an approach to criticality. ' APPLICABLE Prevention and mitigation of prompt reactivity excursions ' SAFETY ANALYSIS during refueling and low power operation are provided by: l g - LC0 3.9.1, " Refueling Equipment Interlocks" l [Q l - LCO 3.1.1, " SHUTDOWN MARGIN (SDM)" LCO 3.3.1.1, "SSLC SENSOR Instrumentation," Startup , Range Neutron Monitoring Flux High/ Flux short period ! and Average Power Range Monitor Neutron l Flux-High/Setdown Functions l
- LC0 3.3.5.1, " Control Rod Block Instrumentation."
The applicable safety analysis for the SRNMs are covered by the listed LCOs. This LC0 is included in the technical specifications since the SRNMs are the only indication of neutron flux levels during refueling and during those portions of startup where the APRMs are off scale. , The SRNM instrumentation satisfies Criterion 2 of the NRC Policy Statement.
%cW LC0 While in MODE 2 with the APRMs downscale, st":=t k: fed l SRNM channels are required to be OPERABLE to monitor the reactor flux level prior to and during control rod _
withdrawal, to monitor suberitical multiplication and i reactor criticality, and to monitor neutron flux level and reactor period until the flux level is within the range of - ( LM b kus45 Grout i geg b hM3 OcW 1 U.5 (continued) ABWR TS B 3.3-125 P&R 08/30/93 1
SRNM Instrumentation 3.3.2.1 BASES O \ -*MI N Nh o k e. h k M 6-64 4 3 D h LC0 the APRMs. The assignment of SRNM detectors to the four ( Continued ) divisions and three bypass Groups are such that with one
- division INOPERABLE or one group in bypass the indications provide an adequate representation of the overall core i response during those periods when reactivity changes are l
occurring throughout the core. The preferred configuration}s to hav{ T_n ia d"femt core quadrants. In MODES 3 and 4, with the reactor shut down,.two SRNM channels are sufficient to provide redundant monitoring of flux levels in the core. The preferred configuration is to have the SRNMs in different core quadrants. In MODE 5, during a spiral offload or reload, an SRNM L outside the fueled region is not-required to be OPERABLE, since fueleditregion is not of capable of monitoring the core. Thus, theneutron LC0 (perflux in the(a) footnote i in Table 3.3.2.1-1) permits CORE ALTERATIONS in a quadrant with no OPERABLE SRNM in an adjacent quadrant when the bundles being spiral reloaded or spiral offloaded are all in a single fueled region containing at least one OPERABLE SRNM. Spiral reloading and offloading are Erra alterriang ! in a cell on the edges of a continuous fuelec region s ;ne* l cell can be reloaded or offloaded in any sequence). l r*6%M In nonspiral reet4*e op+erations, two SRNMs are required to be OPERABLE to provide redundant monitoring of reactivity , changes occurring in the reactor core. Because of the local nature of reactivity char.ges during refueling, adequate l coverage is provided by requiring one SRNM to be OPERABLE in ' the quadrant of the reactor core where CORE ALTERATIONS are being performed and one SRNM to be OPERABLE in an adjacent quadrant. These requirements ensure that the reactivity of the core will be continuously monitored during CORE l ALTERATIONS. Footnote (b) to Table 3.3.2.1-1 permits the substitution of movable detectors for the' fixed detectors during CORE ALTERATIONS. These special detectors must be connected to the normal SRNM circuits 'in the NMS such that the applicable neutron flux indication can be generated. These special detectors provide more flexibility in monitoring reactivity changes during fuel loading, since they can be' positioned anywhere within the core during refueling. The movable detectors must meet the location requirements of SR 3.3.2.1.2, and all other required SRs for SRNMs. (continued) ABWR TS B 3.3-126 P&R08/30/93
SRNM Instrumentation ' i B 3.3.2.1 BASES , LCO For an SRNM channel to be considered OPERABLE, it must be ( Continued ) providing neutron flux monitoring indication. , APPLICABILITY The SRNMs are required to be OPERABLE in MODES 3, 4, 5, and in MODE 2 until neutron flux is within the range of the APRMs. In MODE I and in MODE 2 with the APRMs on scale, the < APRMs provide adequate monitoring of reactivity changes in the core M (% aA Y. bD S , ACTIONS M , In MODE 2, while the APRMs are downscale SRNMs provide monitoring of core reactivity and criticality. The assignment of the SRNM channels to the bypass Groups and SRNM divisions are such that there is adequate redundancy and core coverage when there is one required intrpr91e SRNM - Q in each Group. 7 ,s , % g 4 Q requires placing the inoperable channel in bypass h @within one hour. Since adequate redundancy and core coverag K is maintained, no further action is required. The Completion . Time is sufficient to permit the operator to perform the ' g action.
%&W D u l If the Required Action for Condition A is not implemented within the allowed Completion Time, or if four or more channels are inoperable, the reactor must be placed in MODE 3. With all control rods fully inserted, the core is in its least reactive state with the most margin to criticality. The allowed Completion Time of 12 hours is reasonable, based on operating experience, to reach MODE 3 in an orderly manner and without challenging plant systems.
C.1 and C.2 With one or more required SRNM channels inoperable in MODE 3 or 4, the neutron flux monitoring capability is degraded or nonexistent. The requirement to fully insert all insertable control rods ensures that the reactor will be at its minimum reactivity level. Placing the reactor mode switch in the (continued) l ABWR TS B 3.3-127 P&R 08/30/93 i
SRNM Instrumentation B 3.3.2.1 l l BASES ACTIONS C.1 and C.2 (continued) ( Continued ) shutdown position causes a scram and prevents subsequent control rod withdrawal by maintaining a control rod block. The allowed Completion Time of I hour is sufficient to accomplish the Required Action, and takes into account the l low probability of an event requiring the SRNM. occurring during this time. ; MC *a h b, I . IJ D.1. D.2, and D.3 l With D r e requi SRNMs inoperable in MODE 5, the , ~ capability to dete ocal reactivity changes in the core during refue - is degraded er nnnavuteninr CORE ! ALTERATIONS ust be immediately suspended, and action must l be immediately initiated to insert all insertable control - l rods in core cells containing one or more fuel assemblies? ( Agrg l A Suspending CORE ALTERATIONS prevents the two most probable i causes of reactivity changes, fuel loading and control rod g .P withdrawal, from occurring. Inserting all insertable control rods ensures that the reactor will be at its minimum N vity, given that fuel is present in the' core. : C% Required Action % which must be initiated within 24 "I by homes, is provided to ensure that having less than the required number of SRNMs inoperable with the vessel head : l removed is not construed as a condition that allows .
- continuous operations. Thus, entry into MODE 5 without the required SRNM channah OPERABLE is not allowed _pe_r i LC0 ,0.4.JSuspension of CORE ALTERATIONS shall not_ .
l preclude completion of the movement of a component to a !' fe, conservative position. Actions (once required to be initiated) to insert control rods and restore SRNMs must continue until all insertable rods in core cells containing one or more fuel assemblies i are inserted, and the required SRNMs are restored to ' OPERABLE status. l g' g3 b,1 nel,, Q i Ia (% B3 r , With two required SRNMs inoperable in MODE 5, the ability to detect local reactivity is unavailable. changes Required in(the Actions _ 1 core during refueling E.?r oud E.} are already applicable and continue to be applicable. Required (continued) ABWR TS B 3.3-128 P&R 08/30/93 I
. 'l l
SRNM Instrumentation l B 3.3.2.1 l l BASES ) t i i ACTIONS E.1 (continued) ' ( Continued ) b 4h Action ddifies Required Action-Er3 to require immediate initiation of action to restore one of the inoperable required SRNMs to OPERABLE status instead of requiring initiation of action within the former Completion Time of [7] days. 1 SURVEILLANCE The SRs for each SRNM Applicable MODE or other specified REQUIREMENTS condition are found in the SRs column of Table 3.3.2.1-1. SR 3.3.2.1.1 ; Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred between Cha1nel Functional Tests. A CHANNEL CHECK is a comparison of. t w ;
- piffimetFr indicated on one channel to the same parameter ,
indicated on other similar channels. It is based on the ' assumption that instrument channels monitoring the same parameter should read approximately the same value.
- Significant deviations between the instrument channels could ,
be an indication of excessive instrument drift or other l W faults in one of the channels. Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, , including indication and readability. If a channel is outside the match criteria, it may be an indication that the instrument has drifted outside its limit.
%Qh %
The high reliability of'(each SRNM channel provides i confidence that a channel failure will be rare. However, a i surveillance interval of T24-} hours is used to provide cc-fidence that gross failures that do not activate an . a 4 .ciator or alarm will be detected within [-24] he . The l CHANNEL CHECK supplements less formal, but more frequen j checks of channels during normal operational use-of the - displays associated with the channels required by the LCO. U % ,y,TA m., SR 3.3.2.1.2 1 To provide adequate coverage of potential reactivity changes in the core, one SRNM is required to be OPERABLE in the f (continued) ABWR TS B 3.3-129 P&R 08/30/93 I _-.- __ J
I SRNM Instrumentation j B 3.3.2.1
- i l{ BASES ;
SURVEILLANCE S1 3.3.2.1.2 (continued) REQUIREMENTS ( Continued ) quadrant where CORE ALTERATIONS are being performed, and another OPERABLE SRNM must be in an adjacent quadrant. Note 1 states that this SR is imposed only during CORE ALTERATIONS. It is not required to be met at other times in MODE 5 since core reactivity changes are not occurring. Q This Surveillance consists of an evaluation to establish that the number and location of OPERABLE SRNM channels are appropriate for the core region undergoing alteration. Note ' 2 covers situations where only one SRNM is required to be D ~ OPERABLE, per footnote 9 ) in Table 3.3.2.1-1, so only the
- a. portion of this SR is required. Note 3 clarifies that the three requirements can be met by the same or different OPERABLE SRNMs.
p obk \ ch The high reliability of b ch SRNM channel provides ; confidence that a channel lfailure will be rare. However, a surveillance interval of % hours is used to provide confidence that the required number of SRNMs are operable during 4cr# alterations. The SR is also imposed when the quadrant unaergoing aiterations changes to provide confidence that the configuration of OPERABLE SRNM channels
;O is appropriate. This SR supplements the alarms and/or annunciators that result from most failures and operational controls over refueling activities, which include steps to ,
ensure that the SRNMs required by the LC0 are in the proper ' l quadrant. SR 3.3.2.1.3 This Surveillance consists of a verification of the SRNM instrument readout to ensure that the SRNM reading is greater than a specified minimum count rate. This ensures that the detectors are indicating count rates typical of neutron flux levels within the core. If there are insufficient fuel assemblies in the core the count rate will be to low to meet this-SR. Therefore, the SR is modified by a Note that exempts an SRNM channel from the SR when there are four or less fuel assemblies adjacent to , the SRNM and no other fuel assemblies are in the associated i core quadrant. With four or less fuel assemblies loaded around each SRNM and no other fuel assemblies in the < t (continued) i ABWR TS B 3.3-130 P&R OB/30/93 4
l SRNM Instrumentation l B 3.3.2.1 l l BASES 4q NJ SURVEILLANCE SR 3.3.2.1.3 (continued) REQUIREMENTS ( Continued ) associated quadrant, even with a control rod withdrawn the configuration will not be critical. The Frequency is based upon channel redundancy and other information available in the control room, and ensures that I the required channels are frequently monitored while core reactivity changes are occurring. When no reactivity changes are in progress, the Frequency is relaxed from 12 hours to 24 hours.
- SR 3.3.2.1.4 and SR 3.3.2.1.5 l
Performance of a CHANNEL FUNCTIONAL TEST demonstrates the l associated channel will function properly. l 1 SR 3.3.2.1.4 is required in MODE 5, and the 7 day Frequency l ensures that the channels are OPERABLE w e core reactivity l changes could be in progress. This Frequency is < reasonable, based on the reliability of the devices used in I i]r the SRNM and on other Surveillances (such as a CHANNEL () CHECK) that ensure proper functioning between CHANNEL FUNCTIONAL TESTS. SR 3.3.2.1.5 is required in MODE 2 with the APRMs downscale and in MODES 3 and 4. Since core reactivity changes do not normally take place in these modes, the Frequency has been extended from 7 days to 31 days. The 31 day Frequency is based on the reliability of the processing devices used and on other Surveillances (such as CHANNEL CHECK) that ensure proper functioning between CHANNEL FUNCTIONAL TESTS. This Surveillance may be delayed on entry into the specified condition of Applicability. The SR must be performed within 12 hours of reaching a neutron flux level where the SRNMs are sufficiently below their upscale value to permit satisfactory testing. The permissible delay is short compared to the surveillance interval and permits sufficient time to perform the surveillance. Note that surveillances performedunderLC03.3.1.lgverlapthisSRtosomedegree.
? ss e swwmmg ~ -
a
, (continued)
ABWR TS B 3.3-131 P&R 08/30/93
SRNM Instrumentation B 3.3.2.1 ( BASES l l l SURVEILLANCE SR 3.3.2.1.6 REQUIREMENTS ( Continued ) Performance of a CHANNEL CALIBRATION verifies the [ performance of the SRNM detecter: :r.d a:;;;ciat# circuitry. ; The Frequency 9ce.;id;r the31 ant conditions reauired to I perform the test and(the Vikelihood of a change in the ~ system or component status. ine neutron ditTctors ah det'h 3 ' excluded from the CHANNEL CALIBRATION because they cannot readily be adjusted. The detectors are fission chambers that are designed to have a relatively constant sensitivity i over the range, and with an accuracy specified for a fixed useful life. - 4 k ia - I REFERENCES None.
!.s
- w_L
~~
m _sx._1 u n , v-4wAWg\e--; % m%vvd 9 trov' b c : , 'O l l , 5 i l l O ABWR TS B 3.3-132 P&R 08/30/93 , t . ._ .
Essential Multiplexing System (EMS) B 3.3.3.1 B 3.3 INSTRUMENTATION B 3.3.3.1 Essential Multiplexing System (EMS) w y c3Me 4L ,s o n 4.a d BASES ( N _ BACKGROUND The EMS is a data collection and ta distribution system that provides plant parameter data for use by the safety systems in providing protective action. The EMS consists of remote multiplexing units (RMU), Control Room Multiplexing units (CMU), and a segmented dual redundant data transmission path. The transmissions paths are reconfigurable so that most data transmission failures effect only one segment in one of the redundant paths. f The EMS is comprised of four independent divisions (Div. I, ( te=enjr N II, III, IV ). Strategically located RMUs gather data from plant sensors, convert it to serial digital data, and i [' E N '- " transmit the data to the Safety System Logic and Control WM (T.LLQ (SSLC) Digital Trip Modules (DT[s7%over dual redundant o e- sgaY optical data transmission paths. The RMUs also receive data
. representing the desired actions for controlled devices and g M U d Y 5 M ldelivers it to the appropriate OUTPUT CHANNEL. The OUTPUT i
Y 3 CHANNEL converts the data to a signal level suitable for the controlled device. The EMS includes a variety of self-test and monitoring features. The self test checks the health of the micro-processor, RAM, ROM, communications, data transmission segments, and software. A hard failure will activate an alarm and provide fault indication to the board level. Soft G.e.praWe.,t failures are logged to provide maintenance information. Reconfiguration status after a segment failure also activates an alarm. The dual redundant data transmission paths provide communication between the RMUs and CMUs. The paths are reconfigurable so that communication is maintained as long as there is one OPERABLE path between all pairs of multiplexers. One path between any pair of units is called a
" segment" in this LCO.
A data transmission segment is OPERABLE when communication between a pair of multiplexers can occur over the segment. This requires the line drivers and line receivers on both ends to be OPERABLE and the path between the units to be OPERABLE. The EMS must also be capable of providing the (continued) ( ABWR TS B 3.3-133 P&R 08/30/93
Essential Multiplexing System (EMS) B 3.3.3.1 l ( BASES BACKGROUND specified maximum throughput and the data error rates must l ( Continued ) be within specified limits for it to be considered OPERABLE. l APPLICABLE Some portion of the EMS is. required to be operable in all : SAFETY ANALYSIS, s since there are one or more safety systems that > LCO, and acqu re data from the EMS in all modes. The applicable , i APPLICABILITY safety analysis for the various portions of the EMS are the , analysis that apply to the Functions that acquire data from i the EMS. The signal acquisition and conversion portions of i the EMS are adequately covered by the LCOs for the systems i that acquire and/or transmit data over the EMS. Therefore, this LC0 addresses only the data transmission portion'of the ; EMS. The Essential Multiplexing System (EMS) Joes not directly_ l generate any trip functions so there are no'sp.ecific i Allowable Value for the EMS since the(effFct,ofxany EMS t processing is included in the allowatile values for the ! Functions in systems that utilize the EMS. I i ACTIONS A Note has been provided to modify the ADiONS related to ! EMS. Section 1.3, Completion Times, specifies that once a ! Condition has been entered, subsequent trains, subsystems, l l components, or variables expressed in the Condition, ! ! discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition l continue to apply for each addicional failure, with
~
i
%\Tdtk Comoletion Times based on initial entry into the Condition However, the Required Actions for7 inoperable EMS dhisica; i
provide appropriate compensatory measures ivi : .d ti p'" i
. iaoperatriedivi sias. As such, a Note has been provided
- that allows separate Condition entry for each inoperable EMS division. . ..
- d. wc l- r%$ h ,751m p alks -
i j A.1 This Condition address the situation where there is some loss of data transmission redundancy in one EMS division but a complete data transmission path is maintained so the systems serviced by the EMS can acquire the needed data. (continued) O ABWR TS B 3.3-134 P&R 08/30/93
Essential Multiplexing System (EMS) : B 3.3.3.1 ,4 BASES ACTIONS A1,.1 (continued) ( Continued ) All Functions required for protective actions remain. OPERABLE and a single failure will not result in loss of ! , protection. In addition, the self test features provide ; confidence that any additional-failures will be l - ! automatically detected. This is an acceptable long term : condition so the Completion Time specified for repair j corresponds to a maximr "me equal to the refueling interval. However, the LCO requires the repairs to be completed if a cold shutdown occurs prior to the next ! l refueling outage. i 0 %5 h -S ! fL.1 This Condition address the situation where there is some , loss of data transmission redundancy in more than one EMS ' l division but complete data transmission paths are maintained . l in all divisions. This LCO is included to assure that any '
- degradation in data transmission redundancy in more than one EMS division will be repaired on a reasonable schedule. The j l
Completion Time is based on the high reliability of the : !g individual data transmission segments and the limited number j of devices involved in each segment.C _ i L1 i l If the required action of condition B is not accomplished ; within the required Completion Time, then additional EMS j monitoring ( Action C.1) is required to provide confidence . that adequate data transmission capability is maintained. ! The Completion Times for C.1 are adequate to detect an-inoperable EMS division soon enough so that the impact of any additional failures on plant risk is negligible. - l ' Action C.2 requires preparation of a special evaluation to-determine the root cause of the inoperable data transmission segment failure and to assure that it is not a potential ' common mode failure. l - , 1.34 h \n % 'PM Of -fr-is't 4em; b . 4 ;
%erT- bbr% o_.L LNi oQ d 46
~
W M s.sstow 9 dx g b y-x, ;
. (continued)
ABWR TS B'3.3-135 P&R 08/30/93 ! _. _ _= _ _ .. -
- Essential Multiplexing System (EMS)
/ M .3.3.1 N5 ^* d h it\l GN f1',
BASES kO C 5 e.s s e s- % sT.c L&wW'D h ( Continued ) When one o more EMS divisions become inoperable then the l Functions an or Features associated with the EMS become unavailable. e loss of one or more EMS data transmission divisions is s milar to the loss of multiple SEhjlop rmE_ in LC0 3.3.1.1 or LOGIC channels in LC0 3.3.1.F and 0.0.1.2 A Therefore, declaring the 4>>vciated Functions and Features to be inoperable will cause entry into the appropriate conditions in other LCOs and suitable-compensatory _ meas _ur.es ' A rt, gu m Azt.s% gvitm % TM{ will be implemented. J The Completion Time provides adequate time for the operator to determine which functions and/or Features need clared inoperable. h66 d SURVEILLANCE SR 3.3.3.1.1 REQUIREMENTS The operability of the EMS data transmission segments should be periodically confirmed to assure that an adequate degree of redundancy is maintained. This SR is included to provide
.g
&g\ ~ confidence thh data transmission segments are OPERABLE.
l The test consists of assuring that the two data transmission paths between all connected pairs of multiplexers are OPERABLE. The test assures that the line drivers and line receivers on both ends of each of the redundant paths between the multiplexers are OPERABLE. The test must also assure the ability to reconfigure the data transmission paths. Reconfiguration is accomplished by cross connecting the line drivers and line receivers to the data transmission paths. The inability to reconfigure shall be treated as a i loss of a single segment (i.e., Condition A). l The EMS data transmission segments are constructed from a few highly reliable devices and the loss of segments while j maintaining data transmisd en integrity does not degrade plant safety. Therefore, a frequency of [92] days is i adequ ate.%e- ENd sw hct;. 64 as %.S Ms t- f a.: k rs.s , p cpJcowoL*.dg SR 3.3.3.1.2 I A comprehensive network analym confirms that the data transmission capability is as intended. The test may be performed using commercially available equipment
&te-(continued)
ABWR TS B 3.3-136 P&R 08/30/93 j l
Essential Multiplexing System (EMS) B 3.3.3.1 , l BASES SURVEILLANCE SR 3.3.3.1.2 (continued) REQUIREMENTS l ( Continued ) specifically designed to perform tests on digital -! communication networks. The network analysis provides confidence that data error rates are within specified ; limits, signal quality is within specifications and the i network is capable of handling the specified maximum , required throughput. go e go Thp IIR1 mnnth frequency is based on the ABWR expected MUsLISG INTERVAD and the need to perform this Surveillance under the conditions that apply during a plant outage to reduce the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The - high reliability of the devices used in the EMS cbmbined 6 with self tests intended to detect EMS degradation provide confidence that this frequency is m4t=hla 4r @' acting EMS insper:bi'ity, ^l %h, REFERENCES 1. A WR 3 AR, ect' n ]. g yg i ( A RSSA'\e
\
S ion [ l
- 4. WR A(Ch.Tpter[(].
g i O ABWR TS B 3.3-137 P&R 08/30/93
ATWS & E0C-RPT Instrumentation B 3.3.4.1 B 3.3 INSTRUMENTATION jof, '. B 3.3.4.1 Anticipated Transir
- Without Scram (ATWS) and End Of Cycl ff*'dg Recirculation Pump .p (E0C-RPT) Instrumentation 6 b g @ y. $I .
BASES v BACKGROUND The E0C-RPT is provided totransient improveATWSfeaturesare margif.s to the MCPR limit during selecteppressurization geci[ird [provided to protect against the remote probability of a ; I failure to insert all controi 3ds when needed The ATWS : Functions initiate several devices to add negative reactivity as a backup to control rod insertion by t:1e S M ,;,,,, 3 ydraulic drives for events where the control rods may not h a'Y n j gu id be fully inserted. Fuebo% A diage{ere h 5 4. A % f e+ke d 1. !ogic
, -for ghe ue se t9 gt ;
Tripping the recirculation pumps mitigates the effec s of an ATWS event since it adds negative reactivity the i increase in steam voiding in the core region as core flow decreases. When the Reactor Vessel Water Level-Low, Level 3 or Reactor Steam Dome Pressure-High setpoint is reached, a specified number of the Reactor Internal Pumps j (RIP) are tripped. If reactor level decreases to the Reactor Vessel Water Level-Low, Level 2 setpoint the remaining RIPS are tripped, with a specified number of the pumps tripped immediately and the others tripped after a specified delay. The RIP trip at level 3 is included to mitigate level transients and prevent level 2 ECCS initiations for pressurization and inventory reduction events that are less severe than the design basis events while the level. 2 trip is provided to trip all of the RIPS as required by, the design basis. ach w les inserhen The Anticipated Transient Without Scram lte nate Rod Insert (ATWS-ARI) System ;niMat. t e' lectric motor-driven Fine Motion ContrplA,od Drivra (FM DJ a runback of the recirculation pum,ps, and alternate air header dump valves. The alternat'e air header dump valves are intended to cause the c rol rod hydrage drives to insert the control rods, h electric .. ves provide an alternate to l the hydraulic rod drives. The recirculation runback is provided to reduce woid m ctivity rd reduce the extent cf the level tra" h rea der Wer ( Vio > W void reactivig c t>) coiacide t' i+ h activaNon ,p ne cou f rol Pod I"se r + on F 6s. : (continued) ABWR TS B 3.3-138 P&R08/30/93 ,
Essential Multiplexing System (EMS) . B 3.3.3.1 l ~ hJ BASES f SURVEILLANCE SR 3.3.3.1.2 (continued) REQUIREMENTS . l ( Continued ) specifically designed to perform tests on digital ; communication networks. The network analysis provides , confidence that data error rates are within specified ; limits, signal quality is within specifications and the network is capable of handling the specified maximum ; required throughput. l go wn i gc The F1R1 mnnth frequency is based on the ABWR expected TJLEEUiLISG INTERV D and the need to perform this Surveillance under the conditions that apply during a plant outage to reduce the potential for an unplanned transient if the - Surveillance were performed with the reactor at power. The i high reliability of the devices used in the EMS cbmbined j
' with self tests intended to detect EMS degradation provide ;
confidence that this frequency is w it @la 4r d=+ac+ h; EMS incper 2i'ity, AL u.oJ_.e , l h A9kR 3 AR, REFERENCES ect r . 4 A SA Se ion [ ] !
- 4. WR C apterg [ ]. :
O ABWR TS B 3.3-137 P&R 08/30/93 l L. ~l
i ATWS & EOC-RPT Instrumentation l B 3.3.4 1 . B 3.3 INSTRUMENTATION B 3.3.4.1 Anticipated Transient Without Scram (ATWS) and End Of Cycl t*'hle L; Recirculation Pump Trip (E0C-RPT) Instrumentation b g, (5i 8 ' l hyr/ c o BASES /' BACKGROUND The E0C-RPT is provided to improve margifs to the MCPR limit 3 edf,ec / [d_uring provided selecQdpressur'.zation to protect Mainst the remotetransient. probability ATWS of a {eatures : failure to insert all control rods when needed The ATWS i Functions initiate several devices to add negative ! reactivity as a backup to control rod insertion by the 5 6 d ~;,,, 3 hydraulic drives for events where the control rods may not fu M beFutfully bos.,inserted. A diay{a-Re e rc 4.ec+he. 1. , lopc for _ae ye se i b S h. A *% 6 l (tM, Tripping the recirculation pumps mitigates the effec s of an eg ATWS event since it adds negative reactivity .:t the increase in steam voiding in the core region as core flow l decreases. When the-Reactor Vessel Water Level-Low, .' Level 3 or Reactor Steam Dome Pressure-High setpoint is reached, a specified number of the Reactor Internal Pumps i i (RIP) are tripped. If reactor level decreases to the Reactor , Vessel Water Level-Low, Level 2 setpoint the remaining RIPS ' are tripped, with a specified number of the pumps tripped immediately and the others tripped after a specified delay. The RIP trip at level 3 is included to mitigate level transients and prevent level 2 ECCS initiations for pressurization and inventory reduction events that are less severe than the design basis events while the level 2 trip is provided to trip all of the RIPS as required by.the design basis. ac/,w A.s inserhm The Anticipated Transient W thout Scram e nate Rod Insert (ATWS-ARI) Syste": . nit ht C. t e71ectric motor-driven Fine Motion Contrpl A,od Drives (FM D),) a runback of the , recirculation pumps, apd alternate cram air header dump i valves. The altetaate air header dump valves are intended ) tocausethecotrolrodhydragu4.cdrivestoinsertthe h electric .. ' vee provide an alternate to [ controltherods, hydraulic_.rod drives. The recirculation runback is provided to reduce weid reacthity rd reduce the extent-of- [ 4he loval tranh A r*ea c4o r pe r ( ViO UOil feachidi i+ H Lk&}> ) Lo ime Eclew W ac& gt[en 4 Me cow brol ved ieerh on hec h'oa5 , O <centinued) ABWR TS B 3.3-138 P&R 08/30/93
l ATWS & E0C-RPT Instrumentation i; (O/fe.-drecddAv3W~d' - - m-- B 3.3.4.1 ! . . . .N~m /
}
I BASES BACKGROUND The ATWS-ARI* Functions are included in the Recirculation ( Continued ) Flow Control (RFC) system3 and the Rod Control and aformation System (RCld)). lhe RFC system is a triple
~
redundantTnicroprocessoriased system with the data needed
, , by the ATWS Functions acquired from other systems over the l multiplexing system. The RCIS is a dual redundant microprocessor based system with the data needed by the ATWS-ARI Functions uired from other systems over J k multiplaxing_s;yste hese sfstTis are compTdt~ely independent of an iverse to the RPS. The data used is:
LG:T- @lr - Four independent low level 2 discrete trip data from the ECCS portion of the SSLC pOthe RFC. . - Three independent discrete data representations of l reactor pressure from the Steam Bypass and Pres:ure Control (SB&PC) system g the RFC. [Q g {g g. g 7
& t <-. - a
- - Four independent scram follow discrete trip data from bu[d c re the ECCS portion of the SSLC
- the RCIS F ' - --
o Independent ATWS-ARI signals are generated in all three RFC subsystems using 2/4 or 2/3 logic, as appropriate. AT ARL ggg,c,. . i (} initiation data from all three RFC subsystems are d nu _ ag l 'v b ohik,on Maic transmitted to both of the RCIS subsystems and to in c;ct af the centrol-ic- sJecathcI"':P03. rdwireo-
- l. o G &
Each RCIS x sends aihf4 Mat 4en signal to the FMCRD controllers when [," m trip signals are received from two of the three RFCs or when Ddi'Ph8*=@ s received from any two of the'6RPS NW bh >disiaens. The-hardwireddngic-in=the drives providas an
'u/ d~m,,
guow ATWS--ccaf-irmatien signel usi-ndogic~s4mRaMtrthc P,CIS; The FMCRDs are actuated when a signal is received from both c,g3 logic The recirculation runback is m ... _j oftheRCISchannelsandgpgetardwewhen a signal ,iLr ved from both RCIS channels3 - f m 5 ;'
-L WT 3 5 d -
The EOC-RPT instrumentation initiates a'tri of a specified number of the Reactor Internal Pumps (RIP) o reduce the peak reactor pressure and power resu t 3 rom turbine trip or generator load rejection transients to provide additional margin to core thermal MCPR Safety Limits (SLs). The need for the additional negative reactivity in excess of that normally inserted on a scram reflects end of cycle reactivity considerations. Flux shapes at the end of cycle are such that the control rods may not be able to ensure that thermal limits are maintained during the first few feet of roitravel upon a scram caused by Turbine Control Valve ( B*NCd Tek:t=GR4-jtwcE&p Y[g
,.I c. H A Oh 4,Q Ta e Q g W g g lc Q (continued)
~
/ d ABWR TS h B 3.3-139 P&R 08/30/93 bArAJbe, l
ATWS & EOC-RPT Instrumentation B 3.3.4.1 BASES BACKGROUND (TCV) Fast Closure, Trip Oil Pressure-Low, or Turbine Stop Valve (TSV)-Closure. The physical phenomenon involved is ( Continued ) that the void reactivity feedback due to a pressurization ; transient can add positive reactivity at a faster rate than l the control rods can add negative reactivity. i v e, g c h The RPT Functions are included in the Recirculation Flow O Control (RFC) system. The RFC system is a triple redundant "Dh*h _ microprocessor based system with the data needed by the RPT Functions acquired from otN.r system Wuves dm alt:fo'%g 2yr+om. The data used by ti.e function is L'es <
- Three independent low level 3 d W trip data from the feedwater Control (FWC) System for the ATWS-RPT.
- Four independent low level 2 discrete trip data from the ECCS portion of the SSLC for the ATWS-RPT.
- Three independe s ct.e data representations of M g reactor pressure from the Steam Bypass and Pressure Control (SB&PC) system for the ATWS-RPT.
- Four independent composite discrete data values which h
%.7 are a trip state data value when either a Turbine stop Valve-Closure or Turbine Control Valve Fast Closure, Trip Oil Pressure-Low scram initiation occurs. The i data is received from the RPS portion of the SSLC and is used for the E0C-RPT. The logic for these signals is described in the SSLC Sensor Instrumentation LC0 (LC0 3.3.1.1).
Q d 4 crete ta vtriges 'ch h reseh an KTWS rmusivb Condi 'on orMnati in tie NM Th4 data Nisrecive from t RPS ) rtio of t e SSL an is bpe fo the TWS-R '. The asis or t se s nal is degc be in he SSLC Senso Instr nent tion 0( 0 3.35.1. ). Independent RPT signals are generated in all three RFC subsystems using 2/4 or 2/3 logic, as appropriate. RPT data from all three RFC subsystems are transmitted to the RIP f3 (continued) ( B 3.3-140 P&R 08/30/93 ABWR TS l
l ATWS & EOC-RPT Instrumentation
- B 3.3.4.1 j
%',Tl g*%' son G $65 4 A c- AAS W f ye Q g
BASES Qy B.Muli A% oAA%d.s o{ Pee.4 e w ce, M f BACKGROUND Adjustable Speed Drives (ASD) via the multiplexing system. ( Continued ) The ASDs use 2/3 logic to implement the trip and include an ! adjustable delay on the trip actuation signals to the load : interrupters. . l 1
/ y %g W '- l APPLICABLE The ATWS V ae % ms & uui anuacd n ui ABWR SSAR 2.T=ty i SAFETY ANALYSIS, m 1yris. The ATWS aids in preserving the integrity of the '
LCO, and fuel cladding following events in which a required scram may APPLICABILITY not occur. M ^a He - ^ " ^ ' ' - - i mi- , okaceH-9 1 ..t rii Savor, t% instrumenici,iun is ird uded as-+eqvmc by ihe NKt, rul^iy A . h ...M . [ The E0C-RPT of a specified number of RIPS is provided to mitigate the neutron flux, heat flux and pressure
~
' i transients, and to increase the margin to the MCPR SL for- l l events that cause a rapid shutoff of the steam flow to the ! l main turbine. The analytical methods and assumptions used in i l evaluating the turbine trip and generator load rejection, as l I l well as other safety analyses that assume E0C-RPT, are l summarized in References ' 4 W " ,t, a ., J 3 ! [ g cAc%B- To mitigate pressurizat transient effects, the E0C-RPT must trip the RIPS after initial movement of either the TSVs
- y ~ .
1( orethe TCVs. The combined effects of this RIP trip and a ! l scram reduce fuel bundle power more rapidly than does a scram alone, resulting in an increased margin to the~ MCPR 1 SL. Alternatively, MCPR limits for an inoperable E0C-RPT as specified in the COLR are sufficient to mitigate ! pressurization transient effects. i The OPERABILITY of-the ATWS nd E0C-RPT is dependent on the j OPERABIcITY of the indivi ua if Functions. Each Function : must have a required number of OPERABLE channels with their i trip points within the specified Allowable Values. The data ( value for the trip point is set consistent with applicable 4 setpoint methodology assumptions. Channel DPEP^.BILITY & &
+ includes the o nucieted I!!P ^SDs. A channel is inoperable i if its actual trip point is not within its required i Allowable Value.
Allowabie values ar e specified for tne suutReacter-Steam l Lume P.es.uie-Hig~, n feeowater Reacius Woto. Ltv=1-t w . Leuni l 1, end RIF--Trip Dmy Funciiuns. The ^,11onblz-Valuerfor l ThTTemITMiig Fundiuns are cuve, ed by de SSLC Senser
--intrua.;ntatica LC04Lrn 1 Lktt. Nominal trip setpoints are established in the setpoint calculations. The data -
(continued) ABWR TS B 3.3-141 P&R 08/30/93
l 1 ATWS & E0C-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE values for the setpoints are selected to ensure the trip SAFETY ANALYSIS points do not exceed the Allowable Value between CHANNEL LCO, and CALIBRATIONS. Operation with a trip point less conservative APPLICABILITY than the nominal trip point, but within its Allowable Value, ( Continued ) is acceptable. Trip points are those predetermined values ! of output at which an action should take place. The l setpoint data values are compared to the data values representing the measured process parameter (e.g., reactor vessel water level), and when the data value for the process parameter exceeds the setpoint, the logic declares a tripped condition and changes the state of the associated output data value. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits corrected for calibration, process, and some of the instrument errors. The trip setpoint data values are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for. L qQ p The individual ATWS Functions are required to be OPERABLE in MODE lh o protect against postulated common mode failures of the Reactor Protection System by providing a diverse trip to mitigate the consequences of a postulated ATWS event. In cal. m MODE lithe reactor ir producing significant power and the' D k recirculation system could be at high flow. Om his this
> 400@the potential exists for pressure increases or low %dMC- ) water level, assuming an ATWS event.
1 In MGDE i, uic i coder at low powe. and the recirculatica 3y3teii, i; i lew itW ;
--thus , Uie puien t i al . 3 icw for a prcsture-4nereass-er-low w t p r lev el , a s s u .i r.g a n "JWS+v ent . TRS_isaet-
- necessary, In MODES 3 and 4, the reactor is shut down with all control rods inserted; thus, an ATWS event is not g g;;&Q significant and the possibility of a significant pressure ,
. increase or low water level is negligible. In MODE 5, the ,
r m nn-not mtr-toenensures the reactor remains 1 subcritical; thus, an ATWS event is not significant. In i O addition, the reactor pressure vessel (RPV) head is not ! fully tensionec h no pressure transient threat to the de coolant pressure boundary (RCPB) exists. iNL6h + M'.m$*% Tr=.dT%g p., sbr *,(.,,T, o ad (continued) ABWR TS B 3.3-142 P&R 08/30/93
ATWS & E0C-RPT Instrumentation i B 3.3.4.1 f BASES l APPLICABLE E0C-RPT instrumentation satisfies Criterion 3 of the NRC SAFETY ANALYSIS Policy Statement. The modes and other conditions where the - LCO, and E0C-RPT must be OPERABLE are as specified for the turbine APPLICABILITY stop valve closure and turbine control valve fast closure ! ( Continued ) Functions in the SSLC Sensor Instrumentation LC0 (LC0 3.3.1.1). The specific Applicable Safety Analyses and LC0 discussions . are listed below on a function by Function basis. !
- 1. Feedwater Reactor Vessel Water level-Low. Level 3 Low RPV water level indicates the capability to cool the !
fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the ATWS-RPT l System trips a specified number of RIPS at Level 3 to aid in i maintaining level above the top of the active fuel. The i reduction of core flow reduces the neutron flux and THERMAL ; POWER and, therefore, the rate of coolant boiloff. j The Feedwater Reactor Vessel Water Level-Low, Level 3 data }
, originates from three level transmitters that sense the ,
difference between the pressure due to a constant column of water (reference leg) and the pressure due to the. actual water level (variable leg) in the vessel. Data from the : three level transmitters are received by the three FWC f co trollers via the three plant multiplexing systems. Level i
$c) .
f* 'l trip data is canorated in the FWC and the results from all i 1 2O7 * ! three FWC controlle7s%gs each of the three RFC controllers which use 2/3 logic to create RPT dat i
%g
-- Three channels of the Reactor Vessel Level-Low, Level 3 '%hpt. .l "O FuicTTtm w4h are available and reouired to be OPERABLE 4to ure that no single instrument failure can preciuoe an 4h ATWS-RPT from this function on a valid signal.N ine w
$ p3 Allowable Value is the same as rh -SEC "1=:21e Value (sea gc Q LEO 3 3 1 IU bbw 'm 14 0 b3,3.
5$tt 5 %h
-C<> 4 4 g N T- N % q gu
- 2. Reactor Vessel Water Level-Low. Level 2 Low RPV water level indicates the capability to cool.the fuel may be threatened. Should RPV water level decrease too ,
far, fuel damage could result. Th refore, ATWS mitigation ; is initiated if water leval continues to decrease to Level 2 l
~% !
(continued) l I l ABWR TS B 3.3-143 P&R 08/30/93 l l
ATWS & E0C-RPT Instrumentation B 3.3.4.1 BASES l APPLICABLE 2. Reactor Vessel Water Level-Low. Level 2 (continued) i SAFETY ANALYSIS l LCO, and to aid in maintaining level above the top of the active fuel l APPLICABILITY and to provide alternate methods for reducing core ! ( Continued ) reactivity. The actions reduce the neutron flux and THERMAL POWER and, therefore, the rate of coqlant boiloff l (%}- tM.% % uc. WCs Reactor Vessel Water Level-LW,.J.evel 2 trip data is received from all four SSLC divisionW The ATWS trip logic will generate a trip data value when r of the tour are in a- MD tripped state. A tr% will occur when needed and spurious trips cannot occur ' three of the four level 2 data values are valid. The bast for this function is as described in the SSLC (LC0 3.3.1. gy ggygg Four channels of fieactor Vessel Level-tow, Level 2 are < available and three are required to be OPERABL to ensure that no single instrument failure can preclude n ATWS-RPT from this function on a valid signals - -- 1
.ug i ! O%.h -M v s s N i c Qg j
i 3. SB&PC Reactor Steam Dome Pressure-Hiah b O Fc".QQ Excessively high RPV pressure may rupture the RCPB. An l increase in the RPV pressure during reactor operation l compresses the steam voids and results in a positive reactivity insertion. This increases neutron flux and THERMAL POWER, which could potentially result in fuel failure and RPV overpressurization. The SB&PC Reactor Steam Dome Pressure-High Function initiates ATWS for transients that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power generation. Fnr the overpressurization event, the actions aid in the
' gen [tsr.T.inath safety of th?ATWS
/ relief =t and, valves (S/Rvs), limitsalong the peakwith RPV thepressure l g to less than the ASME Section III Code Service Level C y )"#['py-limits (1500 psig). .
9 Pa.64 tre, g 81kt, ! l 1[r The SB&PC Reactor Steam Dome Pressure-High ata oci inates from three pressure transmitters that monito rea or ste m l l 7 5 W e m rt. Data from the three transmitters rerecei)ved by the three SB&PR controllers via the three pla t $ / ; multiplexing systems. Data values for all three s soF are i received by each of the three RFC controllers which se'2/3 logic to create 9RPT data. Three channels of Reactor Steam Dome Pressur -High are available and required to be F M%, l (7%S1 l- (continued) ABWR TS B 3.3-144 P&R 08/30/93
I~
~ ATWS & E0C-RPT Instrumentation B 3.3.4.1 <
g-f v b W s is Md ; I BASES O M , APPLICABLE 3. SB& Reactor Steam Dome Pressure-Hiah (continued) ktyT
/
SAFETY ANALYSIS LCO, and OPERABLE o ensure.that no single instrument failure can t APPLICABILITY preclude an initiation from this Function on a valid signal. ( Continued ) %The SB&PC Reactor Steam Dome Pressure-High Allowable Value is chosen to provide an adequate margin to the ASME , Section III Code Service Level C allowable Reactor Coolant l System pressure. S Sw g . E0C-RPT Initiation. E0Chnitiation signal is a composite signal received .
- Trom Ine ~5SLC. The allowable values, applicable safety l analvs k and applicability of this Function is as described ;
i in the SSLC#LCO (LC0 3.3.1.1) for the Turbine Stop Valve-Closure and Turbine Control Valve Fast Closure, Trip Oil Pressure-Low functions. Four channels of Turbine Steam Flow Rapid Shutoff E0C-RPT l
-~~
are available and three are required to be OPERABLE to. m3 : provide confidence that no single instrument failure can preclude an RPT from this Function on'a valid signal ( , I ive are av ilable nd I u cknn s of RNM AT Permi ERABLE o provide nfide e that ; a uire to be umen failur( can p clude an {S-RPT(rom t n a'v lid sighal \\ ! 6
- 5. RPT Initiation Function of the RFC.
The RFC must provide RPT initiation dat to the ASD controllers. Each RFC sends RP data to the ASD controllers. to provide QeN lhree channels of KVI inilla io ust be preclude an O confidence that no single instrument fai l RPT from this Function on a valid signal.
- There is no allowable value associated with this function.
- 6. Adiustable Soeed Drive Pumo Trio Actuation The trip actuation devices in the ASD are required to be operable in order to complete the RIP trip Function. Each (continued)
ABWR TS B 3.3-145 P&R08/30/93 I f
ATWS & EOC-RPT Instrumentation B 3.3.4.1 BASES APPLICABLE 6. Ad.iustable Speed Drive Pump Trio Actuation (continued) SAFETY ANALYSIS LCO, and ASD uses signals from the RPT Function in all three of the APPLICABILITY RFC controllers. A trip condition' from any two of the , (C ) controllers will cause a trio-.of the associated RIP. Three 1 St o provide ! Y" # cnannels confidenceorthat pumpno trip actuatio@must single instrument fa beh. preclude an ! RPT from .this Function on a valid. signal. j ; There is no allowable value associated with this function. g w 7 & 8. Ad.iustable Speed Drive Pump Trio Timers & Load ; gg pb Interruoters ;
*t The ASDs provide timers to cause a small delay before !
ft 6?#Y '- ('
, -c,c, interrupting the devices that provide power to the RIPS. One timer channel and load __ driver in each ASD is available and be. WMN required to be f 9J.df The Allowable Values are chosen to I
cause a trip of tae pumps in a timely fashion while minimizing the effects of the transients caused by the pump , trips. l
- 9. RPS Scram Follow Sianal TAe hcP_.D r w s . r I.'. => w An RPS scram indicates that control rod insertion is y gy. m e C. required. Therefore,,e RATWS-ARI is initiated from these ;
signals. The basis for this signal is as described in LC0 ' II 33Ik - 3 % SS M SW C hhhMI A
/ L . 1 , Jai. is .cc;ie:d 'cea oli Teo, "PS LC g di e i 4 The ATWS-ARI trip logic will generate a trip data ,
gMO M ,j value when 2 of the four are in a tripped state. A trip will r occur when needed and spurious trips cannot occur if three Y of the four data values are valid. [r wb KW.S _ Four channels of RPS Scram Follow Signal are required to be s'.$. T.p@*. c>. 3 OPERABLEMo ensure that no single instrument failure can W18 AB 4 preclude an ATWS-ARI from this function on a valid signal.q-- l
~1.k.Isrt $:Sv
- 10. Manual ATWS-ARI Initiation.
! The Manual Initiation push button channels introduce signals into the ATWS-ARI' logic to provide manual initiation capability that is redundant to the automatic initiation. (continued) ABWR TS B 3.3-146 P&R 08/30/93 :
l
.I ATWS & E0C-RPT Instrumentation B 3.3.4.1 :
I BASES i APPLICABLE 10. Manual ATWS-ARI Initiation. (continued) ! SAFETY ANALYSIS l LCO, and There are two push buttons and both must be activated to APPLICABILITY initiate ATWS-ARI. l ( Continued ) There is no Allowable Value for this function since the division is rrechanically actuated based solely on the CM *f"* Y"4 position of the push buttons. Two channels of the Manual Initiation Function are required to be OPERABLE when the r ATuR-ARI is requir_ed to be OPERABL L.-
--T-g - -] % = %a3kWM9-
- 11. ATWS-ARl'hinitiation Function of the RFC.
M e *,9 w( w Q sv.s The RFC must transmit ATWS-ARI initiation data to the RCIS
.nd cicctric dr"le centr:11:rs. E&ch ef-- the three RFS g , g- g channel: cend:-si..M atter deio iv ihe RC 5 onu FHCRB h it " d D c-entiuliers. Three channels of this Function g ag 9',,,1%
! 6 0 9 V,. M B A. - Mo provide confidence that no single instrument
-. a ur can preclude an ATWS-ARI initiation from this Function on a valid signal.c., ~1 k,g d =t. g it A There is no allowable value associated with this function.
l
- 12. ATWS-FMCRD Initiation Function of the RCIS. l The RCIS must transmit ATWS-ARI initiation ata to the FMCRD controllers. Both of the RCIS channels send initiation signals to the FMCRD controllers. Two channels of this 7 -__
FunttTon mustle ooQ o provide confidence tha ATWS-ARI iriti:tir win omrr on a valid signal. b .,T,i._ h o-e _ r l W e- Sin c R D There is no allowable value associated wTth this/ function. TE % s.EV
. ATWS-ARI Valve Actuation iM-6 uNrtt \br The RFC sends Actuation signals to Alternate Rod Insertion (ARI) valves that are intended to cause control rod insertion from the hydraulic drives. All three RFC channels i send data to both of the ARI valves. The valves will own I when Actuation signals are received from 2 of the 3 of the l RFC channels. Three channels of pe., ir' ctuation must be operable o provide confidence that no sing instrument w k-t f A'.C pT @
Y *- W M 9 0 be. Ci % Q (continued) ABWR TS B 3.3-147 P&R 08/30/93 x !, i . [ l
ATWS & EOC-RPT Instrumentation B 3.3.4.1 7 BASES , W APPLICABLE M. ATWS-ARI Valve Actuation (continued) SAFETY ANALYSIS LCO, and failure can preclude an ATWS-AR f = thi: Fr:t-i- on a APPLICABILITY valid signal. ( Continued ) There is no allowable value associated with this function. Ic4 %
% up ss 14 FMCRD Emeraency Insertion Inverter Control loaic % FMCRD controller receives emergency insertion signals
& g~ u a_ - trom r '-t ':: .Jcs" and Wcr:m fe'!!cu fgr.:1: 'rce:P 4 r
M SELC divi einns. An e.nc. genuj4nsertica signal ;> yenev+ tad I %.4 u) M usiu3 2/3 lug;c for t% "JC siunais ur 2/4 iogic un the x.am felisw sign l-s. The FMCRD motors will start when a signal is received from both RCIS channels and from the Cd r GQ ha.vdoa.ve.
Y e.c <- G t o\ One channel of this unction % ust be OPERABLE when ATW is Y o,L required to be OPERA LE. g g. - Ib
%.' Recirculation Runback l O uo- -
Each RI (dh M receives a runback signal from the RCIS channels. The RIP will go to its minimum spAed when a trip signal is ! received on both RCIS channels' % channe of runback for : each RIP
- required to be OPERABLE when ATW is required to !
be OPERABL gg l pai I ACTIONS A Note has been provided to modify the ACTIONS related to
^>RPT instrumentation channels. Section 1.3,' Completion i Times',' specifies that once a Condition has been entered, ;
# subsequent trains, subrvstems, components, or variables stv5 W W - expressed in the Condi ion, discovered to be inoperable or not within limits, will not result in separate entry into
' ' the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for in W PT instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperabl PT instrumentation channel.
(continued) ABWR TS B 3.3-148 P&R 08/30/93
i ! -l ATWS & EOC-RPT Instrumentation I B 3.3.4.l_ .)
'TA.iL u 2L o J. M .3 lo4 C k i l BASES a l
% l l
ACTIONS A.1. A.2.1. A.2.2.1. and A.2.2.2 i These Actions assure that appropriat compensatory measures o are taken when channel of a function s inoperable. For the.se_, U FunctionNind " the w e, a failure in one channelW cause the actur.ti;r logic to become 2/2. hlel L i w', O 4T. w Action A.1 forces a trip condition in the inoperable
' d divi: ice which causes the initiation logic-to become 1/2'for !
the Function. In this condition a single additional failure will not result in loss of protection and the availability 1 l of the Function to provide a plant protective action is : I adequate so no further action is required when the l l inoperable channel is placed in trip. : I wel l Action A.2.1 bypasses the inoperable ivirie which causes l -t w .v4 W the logic to become 2/2 so the single failure criteria is not met. ';h vvecall redunden;y i; red = A operation in this condition is permitted only for a limited _ time. Action A.2.2.l_ restores the inoperable channel. Action A.2.2.2 repeats Action A.1 if repairs are not made within the' ' allowable Completion Time of Action A.2.2.1. Either of the j Actions A.2.2.1 or A.2.2.2 provides adequate plant protection capability so no further action is required. The Completion Time of six hours for implementing Actions A.1 and A.2.1 is based on providing sufficient time for the ' operator to determine which of the actions is appropriate. The Completion Time is acceptable because the probability of ! an event requiring the Function, coupled with a failure that would defeat the other channels associated with the , c Function _ occurring within that time period is quite low. I C tee TeTf-test features of tne M logic provide a high I degree of confidence that no undetected failures will occur j within the allowable Completion Time. ; Implementing Action- A.2.1 causes the logic to be 2/2 so i protective action capability is maintained as long as the l other channels remain OPERABLE. Operation in this condition is restricted to 14 days (Actions A.2.2.1 and A.2.2.2 - Completion Time). The probability of an event requiring J
% N cWMiiit ;cr=, combined with feilure is irr= M !
undetected failure in a second hannel of the Junction 3thtQ l in the Completion Time is quite ow The self-test features l of the logic provide a high degree of- confidence that no i k (continued) ABWR TS B 3.3-149 P&R 08/30/93- l l l
i ATWS & EOC-RPT Instrumentation ' 1 B 3.3.4.1 BASES (, ACTIONS A.1. A.2.1. A.2.2.1. and A.2.2.2 (continued) ( Continued ) undetected failures will occur within the allowable Completion Time. - u hV) ** '/h N% Required Action B.1 is intended to ensure that appropriate ; actions are taken if multiple, inoperable, ipped s channels within the same iE ch = :1 Function esultiin theFunctionnotmaintaininhc trip c ability. A Function is considered to.be maintainin trip capability Y N- when sufficient channels are.0PERABLE or in trip such that tne Kri btr will generate a trip signal from the given . Function on a valid signal. Thih equi.m3. t e cWP +
'tne i m ti r. t L UrUMDLL vr in b i p, Q (C> l- -
g Thk72 hour Completion Time to restore two c nel s erator to take mLquireo Adivu 6.rp is sufficient for t corrective action and takes into acc the likelihood of . an event requiring actuation of the PT instrumentation during this period. Completion of Required Action B.1 places the system in the same state as in Condition A and multiple O condition entry will then result K suitable compensatory measures. Lg hT kw C.l. C.2.1. C.2.2.1. and C.2.2.2 h/ Lt - \qic These Actions assure that appropriate conpensatory measures are taken when one channel of a Function % C. h . w ...., W becomes inoperable. For these Functions, a failure in one ; channel will cause the actuation logic to become 1/3 or 2/3 depending on the nature of the failure ( i.e failure which l causes a channel trip vs. a failure which does not cause a channel trip). Therefore, an additional single failure will l not result in loss of protection. l 1 Action C.1 forces a trip condition in the inoperable channel l l which causes the initiation logic to become 1/3 for the Function. In this condition a single additional failure will not result in loss of protection and the availability of the Function to provide a plant protective action is at least as high as 2/4 trip logic. Since plant protection capability is (continued) ABWR TS B 3.3-150 P&R 08/30/93 l l 2
- - , .- a
ATWS & E0C-RPT Instrumentation l B 3.3.4.1 frN BASES U ACTIONS C.l. C.2.1. C.2.2.1. and C.2.2.2 (continued) ( Continued ) within the design basis no further action is required when l the inoperable channel is placed in trip. ) Action C.2.1 bypasses the inoperable channel which causes the logic to become 2/3 so a single failure will not result in loss of protection or cause a spurious initiation. Since overall redundancy is reduced, operation in this condition is permitted only for a limited time. Action C.2.2.1 restores the inoperable channel. Action C.2.2.2 repeats Action C.1 if repairs are not made within the allowable Completion Time of Action C.2.2.1. Either of the Actions C.2.2.1 or C.2.2.2 places plant protection capability within the design basis so no further action is required. The Completion Time of six hours for implementing Actions C.1 and C.2.1 is based on providing sufficient time for the operator to determine which of the actions is appropriate. The Completion Time is acceptable because the probability of an event requiring the Function, coupled with failures that would defeat two other channels associated with the g [,e Fupciion, occurrino within__that time period is quite low. the self-test features of thT53t$ provide a high degree of
- confidence that no undetected failures will occur within the allowable Completion Time.
Implementing Action C.2.1 provides confidence that Plant protection is maintained (2/3 logic) for an additional single instrument failure. However, with division I or III in bypass, a loss of the division Il power supply could disable two of the remaining channels. Therefore, operation with one division in bypass is restricted to 30 days (Actions C.2.2.1 and C.2.2.2 Completion Time). The probability of an event requiring the Function coupled with undetected failures which cause the loss of two of the remaining OPERABLE divisions in the Completio_n Time is quite . low. The self-test features of the SStt provide a IFigh^ Nog 4 degree of confidence that no undetected failures will occur within the allowable Completion Time. D.d Required Action D.1 is intended to ensure that appropriate actions are taken when two channels become inoperable for a (continued) ABWR TS B 3.3-151 P&R 08/30/93
ATWS & E0C-RPT Instrumentation B 3.3.4.1 ( BASES ACTIONS Qd (continued)- ( Continued ) .. a Function that utilizes 2/4 logic. For thic. to dition the initiating logic becomes 2/2. igg T 72 hour Completion Time to rest ce one of the ; inoperable channels is sufficient for ;he operator to take-corrective action and takes into accou' it the low likelihood ; of an event requiring actuation of theM PT instrumentation during this period. Completion of Required. Action'D.1 places the system in the same state as in Condition C and multiple. l condition entry will then result suitable . compensatory ; measures. i M i' l ! EJ er Ecur Required Action E.1 is i ended to ensure that appropriate i actions are taken when three channels become-inoperable for i a function that utilizes 2/4 logic. For this Condition 4 ! initiation from the Function is unavalable. ' 24 ur Completion Time to restore one'~of the
- inoperable channels is sufficient for the operator to take j corrective action and takes into account the low likelihood i of an event requiring actuatier. of theAPT instrumentation
- during this ' period. Completion of Requi red Action E.1 places :
the system in the' same state as in Con ' tion D and multiple condition entry will then result sui ble compensatory measures. 'y _, e-1
\ - Al %s 4 goc- j Ed !;
Required Action F.1 is intended to ensure that appropriate ; actions are taken for if the required Actions'and associated
- Completion Times for the E0C-RPT Functions %tyeb MR Required Action F.1 requires the MCPR limit inoperale A EOC-RPT,asspecifiedin'theCOLR,tobe'appied;whjch M94 ^ restores tnegnargin tp assumed in the s galysis.
N" The [2] hour Completion Time to implement the inoperable M.M E0C-RPT COLR is sufficient for the operator to take corrective action, and takes into account the high I reliability of the devices used to implement the E0C-RPT and (continued) ABWR TS B 3.3-152 P&R 08/30/93
. , ~ , - - - - , ,
1 ATWS & E0C-RPT Instrumentation I B.3.3.4.1 BASES ; ACTIONS F.1 (continued) ( Continued ) the :ikelihood of an event requiring actuation of the EOC .1strumentation during this period. , t l G.1 L l l This required Action assures that appropriate compensatory ! measures are taken for inoperable channels in Functions with one or two channels. Because of the low probability of an event requiring these ,
~
l Functions, [24] hours is provided to restore the inoperable functions. l H.l. H.2 and H.3 With any Required Action and associated Completion Time not met, tne plant must be brought to'a MODE or other specified condition in which the LC0 does not apply. To achieve this status: V g (QrM4dQ ~ the trip capability of the associated RIP must be 3 declared inoperable (Action Q the AS , the plant must be brought to at least MODE for Functions associated with ATWS (required Action H.2)
- the power level must be reduced to below the.
applicability of the E0C-RPT for the Function p associated with the E0C-RPT (Required Action H.3). allowed Completion ..s for Actions H.2 and reasonable, based on operating experience to reach the specified conditions from full power ecnditie- n an orderly manner and without challenging plant systemsy , ,,qt
/ \;a e SURVEILLANCE The note on the surveillances imd.st:c- Table 3.3.4.1-1 REQUIREMENTS indinta the applicability of the surveillancD\
Gof b a.cu h M D 1 (continued) ABWR TS B 3.3-153 P&R 08/30/93
ATWS & EOC-RPT Instrumentation B 3.3.4'1 i BASES SURVEILLANCE SR 3.3.4.1.1 REQUIREMENTS ( Continued ) Performance of the SENSOR CHANNEL CHECK once every 12 hours provides confidence that gross failure of instrumentation has not occurred. A SENSOR CHANNEL CHECK is a comparison of the parameter indicated on one instrumentation channel to a similar parameter on other instrumentation channels. It is based on the assumption that independent displays of the same parameter should read approximately the same value. 8 Significant deviations between the instrument channels could t be an indication of excessive instrument drift or other faults in one of the channels. A SENSOR CHANNEL CHECK will g detect' gross channel failure; thus, it is key to verifying < that the instrumentation continues to operate properly between each SESDR CH^""EL C,MBRAT40th CA A P NE.L P V PCT-Lo NAL -T % Agreement criteria are determined by the plant staff based ' on a combination of the channel instrument uncertainties, including indication and readability. If a channel is ; outside the match criteria, it may be an indretinn that the j instrument has drifted outside its limit. 3g g i W The high reliability and redundancy of the devices ussti to - l WimplemelT%HlM functions provides confidence that failure , of more then one instrumentation channel in my9S=ra '
% 54ed is rare. Thus, performance of the SENSOR CHANNEL '
CHECK provides confidence that undetected outright instrumentation channel failure is limited to 0 hour- The SENSOR CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channah nf this LCO. @ w s Q c Q h;g, l As indicated in Table 3.3.4.1-1 this surveillance applies , only to the SB&PC Reactor Dome Pressure-High*ano teeawater Reactor Water Level Low, Level 3 Functions. The equivalent I M o t' surveillance for 26 Aim namish .4 Turbine Steam , tgg.a @.3 Flow Rapid Shut off Functions are provided under the SSLC ! C -)LCO (LC0 3.3.1.1) while the surveillance does not apply to , the remaining Functions. a ko.g.feg- \/"m KS A . OT 41 O IM .
~
(continued) l ABWR TS B 3.3-154 P&R 08/30/93 i
ATWS & EOC-RPT Instrumentation . B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.2 [ REQUIREMENTS ( Continued ) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. If the as found trikoint is not within its required Allowable Value, the plant specific setpoint methodology may , be revised, as appropriate, if the history and all other ! pertinent information indicate a need for the revision. The as left trip point shall be consistent with the assumptions ; of the current plant specific setpoint methodology. . l The frequency of [92] days is based on the high reliability j and redundancy of the devices used to implement the Q ! functions, the low inherent drift of the devices and the ; signal validation tests that are automatically and i continuously performed on the channels. This surveillance i for the Reactor Water Level-Low, Level 2, """ "" - WErmtwhe, and Turbine Steam Flow Rapid Shutoff Functions i must be. performed in conjunction with the equivalent surveillances in the SSLC LCO (LCO 3.3.1.1). i L_wr LGr u.N=.d4C.ag ' SR 3.3.4.1.3 ; A CHANNEL CALIBRATION is a complete check of the instrument processing channel and the sensor. This test verifies that the channel responds to the measured parameter within the specified range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts . between successive calibrations. Measurement and setpoint l error historical determinations must be' performed consistent 3 with the plant specific setpoint methodology. The channel' e shall be left calibrated consistent with the assumptions of - the setpoint methodology. If the as found setpoint is not within its required Allowable Value, the plant specific setpoint methodology may be revised, as appropriate, if the history and all other pertinent information indicate a need for the revision. The setpoint shall be left set consistent with the assumptions of the current plant specific setpoint methodology. _T h o [19] month frequency is based on the ABWR expected ELING IN and the need to perform this Surveillance (continued) P ABWR TS B 3.3-155 P&R 08/30/93 l l ; t
. . _ _ _ - . . . _ ~ . _ - .
I i ATWS & EOC-RPT Instrumentation B 3.3.4.1 ; I E BASES I SURVEILLANCE SR 3.3.4.1.3 (continued) i REQUIREMENTS l ( Continued ) under the conditions that apply during a plant outage to . l reduce the potential for an unplanned transient if the l Surveillance were performed with the reactor at power. The ; low inherent drift of the devices used to implement the i function provides confidence that the trip points will remain within the allowable values for the specified period. ;
-As--indic&ted by Ta' u li: 3.3.4MtM r s'"-ve4'l mc'Lapplies mniy to ine-5B&PC Re&ctec Steam De e -Pressura lligh, l
%dwater xeactor-Sater Level Lcw, Levet-h ud-AS&
' time M unctW Mr. The calibration of the Reactor Water Level-Low, Level 2, GRE ATW3 FermisHgand Turbine Steam Flow rapid Shutoff Functions crc- ccscred br the SSLC . Sox,or hsh%.Muh.
LC0 (LC0 3.3.1.1). - T'
~N_ -_
t- Yw by Db Oh SR 3.3.4.1.4 %$ cQ e,pigg g f.y% . The LOGIC SYSTEM FUNCTIONAL TEST demonstrates t P - ~ OPERABILITY of the required trip logic for a specific h h?
' 0 Function. The s.,dem functiurr test encompasses the RIP .O power interrupting devices provid complete testing of the
() assumed A unction. lgo g'g
\ om The [18] month frequency is based on the ABWR expected
- DUtLING INTERVA.Dand the need to perform this Surveillance under the conditions that apply during a plant outage to reduce the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The high reliability of the devices used in the SSLC processing coupled with the DIVISIONAL FUNCTIONAL TESTS provide confidence that the specified frequency is adequate. j This surveillance for the Reactor Water Level-Low, Level 2, i h Sri AT'.'S Pe r-4 e c i vo rand Turbine Steam Flow Rapid Shutoff i Functions must be performed in conjunction with the j equivalent surveillances in the SSLC LCO (LCO 3.3.1.1). 1 545at-Mr k AdiIl' og jiR 3.3.4.1.5 l This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the ;
i (continued) ABWR TS B 3.3-156 P&R 08/30/93 i
i l ATWS & EOC-RPT Instrumentation .
~
B 3.3.4.1 ! I ig Tbe_% %eb f %ht% $4 hAidoh % BASES ( jdA ge,g
\ .
SURVEILLANCE SR 3.3.4.1.5 (continued) 7f REQUIREMENTS . ' ( Continued ) accident analysis. The E0C-RPT S" STEM RESPD 3E TIME acceptance criteria are included Reference 7. ! E06-RFi SYSTE". y ]NSE p E teg Ru utu nu in i m.,,m . r:pr u_ ...:gerc cerducted-sm.v)
.vrefueling interval %d.
t requ e nu., ,, vased wr the need to perform this Surveillance under the conditions that apply during a plant outage and ' the potential for an unplanned transient if the Surveillance
- were performed with the reactor power. The frequency is pg *g consistent wi A the fact that e n ture of the devices used .
to impiement theV0C-RPT funct or5 ar such that random- . failures of instrumentatibn com one s that cause serious response time degradation, but no channel failure, are infrequent occurrences. ' i SR 3.3.4.1.6 A COMPREHENSIVE FUNCTIONAL TEST tests a division using a selected range of sensor inputs into the division while i sA simulating the other three divisions as appropriate. This i test verifies the OPERABILITY of all SENSOR CHANNELS, LOGIC , t') CHANNELS, and OUTPUT CHANNELS. See Section l.1,
" Definitions" for additional information on the scope of ,
this test. This surveillance overlaps or is performed in conjunction , l with the COMPREHENSIVE FUNCil0NAL TESTS in LC0 3.3.1.1. The j combined or overlapping tests provide complete end-to-end testing of the protective actions, i l l' g The I1A1 mnnth frequency is based on the ABWR expected q A Q EFUill$G INTER h and the need to perform this Surveillance under Uie uTnditions that apply during .a plant outage to reduce the potential for an unplanned transient if the l Surveillance were performed with the reactor at power. The l high reliability of the devices used in the logic processing coupled with the CHANNEL FUNCTIONAL TESTS provide confidence that the specified frequency is adequate. j l I (continued) ABWR TS B 3.3-157 P&R OB/30/93 ; i
ATWS & E0C-RPT Instrumentation B 3.3.4.1 O BASES SURVEILLANCE SR 3.3.4.1,7 REQUIREMENTS ( Continued ) A CHANNEL FUNCTIONAL TEST is performed on each manual ATWS-ARI channel to ensure that the entire manual trip channel will operate as intended. This function uses a minimum of components, and.the components have been proven highly reliable through l operating experience. However, a relatively-short surveillance interval of ~ [7] days 'is used since availability ., of manujal -seram- is important for providing a diverse means ! r4ac4er-sc-ram and the logic is 2/2. The probability of. i AU an event requiring manual escam coupled with a failure of
/n s ey/,.g one of the channel within this time period is very gg l l
n/w/ j) inc w /-/ap Mw.4*A fr / U* l 9'l f Mc co~ Vod.s M w.9assf6 ( l REFERENCES 1. ABWR SSAR, Figure f ].4. /5 5. / .f. l
\
--2,--ABWR-SSAR, Eigure_{-] (E0C'PT instr =catatica logic),o j R g. ABWR SSAR, Section/ 5.2.2 7 j J ,(. ABWR SSAR , Sect i on s/15.1.1 h 15.1. 2 }',ind/15.1. 3 f I
-5. ABWR-SSAR, Sectiens--{-5v5vl6r13-and-{4-6rl4],-e _ j
- 5. CENE470-05 1, " Bases-for-Changes-To-Surveilhnce-Test 4ntervalt And-Allowed-Out-0f-Serv 4ee TiinerT6r -
4eheted-instrumentation-Technical Speci'icatiens." 4ebruary 1991. c pZ ABWR SSAR, Section [5 3 16.2_},Cdap/er / { $ f /c. / Q ,1, , 5 A BwR SSAR, Aff% c/N /5'E. 1 l : O ABWR TS B 3.3-158 P&R 08/30/93 l
ATWS & E0C-RPT Instrumentation B 3.3.4.1 BASES REFERENCES ( Cantinued) l l l l l
\
O I l Figure 3.3.4.1-1 TBD O . ABWR TS 8 3.3 159 P&R 08/30/93 1
Feedwater and Main Turbine Trip Instrumentation B 3.3.4.2 O C/ B 3.3 INSTRUMENTATION B 3.3.4.2 Feedwater and Main Turbine Trip Instrumentation BASES BACKGROUND The feedwater and main turbine trip instrumentation is designed to detect a potential failure of the Feedwater Level Control System that causes excessive feedwater flow. With excessive feedwater flow, the water level in the reactor vessel rises toward the high water level, level 8 reference point, causing the trip of the two feedwater pump adjustable speed drives (ASDs) and the main turbine. Reactor Vessel Water Level-High, level 8 signals are provided by level sensors that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level in the reacto sD (variable leg). Three channels of Reactor Vesse Wate devel-High, Level 8 instrumentation are provi. 'put to a two-out-of-three initiation logic that triyet' e two feedwater pump ASDs and the main turbine. q The channels include electronic equipment (e.g., digital trip logic) that compares measured input signals with pre-(O established s - oints. When the setpoint is exceeded, the e a_n.mgl utp t5 trip signal, which then outputs a main3 tur$me_ feedwater an ASD trip signal to the trip logic. A tri of the feedwater pump tu imits further increase in reactor vessel water level by limiting further addition of feedwater to the reactor vessel. A trip of the main turbine and closure of the stop valves protects the turbine from damage due to water entering the turbine. [d.jid\t APPLICABLE The feedwater and main turbine trip instrumentation is SAFETY ANALYSES assumed to be capable of providing a turbine trip in the design basis transient analysis for a feedwater controller failure, maximum demand event (Ref.1). The Level 8 trip indirectly initiates a reactor scram from the main turbine trip (above 40% RTP) and trips the feedwater pumps, thereby terminating the event. The reactor scram mitigates the reduction in MCPR. Feedwater and main turbine trip instrumentation satisfies Criterion 3 of the NRC Policy Statement. ( (continued) ABWR TS B 3.3-160 P&R 08/30/93
Feedwater and Main Turbine Trip Instrumentation I B 3.3.4.2 i f BASES (comt.) . I - l LC0 The LC0 requires three channels of the Reactor Vessel Water f Level-High, Level 8 instrumentation to be OPERABLE to - ensure that no single instrument-failure will prevent the feedwater pump ASDs and main turbine trip on a valid Level 8 signal. Two of the three channels are needed to provide j trip signals in order for the feedwater and main turbine i trips to occur. Each channel must have its setpoint set ! within the specified Allowable Value of SR 3.3.4.2.3. The ; Allowable Value is set to ensure that the thermal limits are i not exceeded during the event. The actual setpoint is calibrated to be consistent with the applicable setpoint 1 methodology assumptions. Nominal trip setpoints are specified in the setpoint calculations. The nominal ! setpoints are selected to ensure that the setpoints do not- l exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint less : conservative than the nominal trip setpoint, but within its ! Allowable Value, is acceptable. , Trip setpoints are those predetermined values of output at -l which an action should take place. The setpoints are O compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of i l theprocessparameterexceedsthesetpoint,theassociatedfysj,se/i ' d 7 reic; (e.g.,limits analytic :!! git:1 are trip legier derived changes from state. the limiting Theof the values process parameters.obtained from the safety analysis. The i Allowable Values are derived from the analytic limits, I l corrected for calibration, process, and some of the instrument errors. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe I environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for. I (continued) i ABWR TS B 3.3-161 P&R 08/30/93 I ___,u
i i Feedwater and Main Turbine Trip Instrumentation l B 3.3.4.2 ! BASES (coat.)
.s-APPLICABILITY The feedwater_and main turbine trip instrumentation is required to be OPERABLE at ;t 25% RTP to ensure that the fuel cladding integrity Safety Limit and the cladding 1% plastic strain limit are not violated during the feedwater controller failure, maximum demand event. As discussed in the Bases for LC0 3.2.1, " Average Planar Linear Heat ;
Generation Rate (APLHGR)," and LC0 3.2.2, " MINIMUM CRITICAL POWER RATIO (MCPR)," sufficient margin to these limits exists below 25% RTP; therefore, these requirements are only necessary when operating at or above this power level. 4. ,
/\>
ACTIONS A Note has been provided to modify the ACTIONS related to feedwater and main turbine trip instrumentation channels. Section 1.3, Completion Times, specifies that once a l' Condition has been entered, subsequent trains, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition ' continue to apply for each additional failure, with O Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable feedwater and l main turbine trip instrumentation channels provide : appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable feedwater.and main turbine trip instrumentation channel. A.1. A.2.2. A.2.2.1 and A.2.2.2 These actions assure that appropriate compensatory measures are taken when a channel is inoperable. A failure in one channel will cause the actuation logic to become 2/2. 2 Action A.1 forces a trip condition in the inoperable channel which causes the initiation logic to become 1/2. In this condition a single additional failure will not result in loss of protection and the availability to provide a plant protective action is adequate so no further action is required when the inoperable channel is placed in trip. (continued) ABWR TS B 3.3-162 P&R 08/30/93
4 Feedwater and Main Turbine Trip Instrumentation , B 3.3.4.2 BASES ( ) f ACTIONS A.I. A.2.2. A.2.2.1. and A.2.2.2 (continued) ( Continued ) Action A.2.1 bypasses the inoperable channel which causes i the logic to become 2/2. Since overall redundancy is reduced, operation in this condition is permitted only for a limited time. Action A.2.2.1 restores the inoperable channel. Action A.2.2.2 repeats Action A.1 if repairs are not made within the allowable Completion Time of Action- ! A.2.2.1. Either of the Actions A.2.2.1 or A.2.2.2 provides i adequate plant protection capability so no further action is required. 4 The Completion Time of six hours for implementing Actions : A.1 and A.2.1 is based on providing sufficient time for the
- operator to determine which actions is appropriate. 'The Completion Time is acceptable because the probability of an ,
event coupled with a failure that woula defeat the other ,
; channels occurring within the time period is low. The self-1 test features of the main turbine and feedpump trip logic provide a high degree of confidence that no undectected failures will sa.ur within the allowable Completion Time. ;
Implementing Action A.2.1 causes the logic to be 2/2 so protective action capability is maintained as long as the other channels remain OPERABLE. Operation in this condition is restricted to 14 days (Actions A.2.2.1 and A.2.2.2 Completion Time). The Completion Time is acceptable because the probability of an event coupled with a failure that would defeat the other channels occurring within the time period is low. The self-test features of the main turbine and feedpump trip logic provide a high degree of confidence that no undectected failures will occur within the allowable Completion Time. L1 With two or more channels inoperable, the feedwater and main turbine trip instrumentation cannot perform its design function (feedwater and main turbine trip capability is not maintained). Therefore, continued operation is only l permitted for a 72 hour period, during which feedwater and main turbine trip capability must be restored. The trip capability is considered maintained when sufficient channels are OPERABLE or in trip such that the feedwater and main turbine trip logic will generate a trip on a valid (continued) ABWR TS B 3.3-163 P&R 08/30/93
l l Feedwater and Main Turbine Trip Instrumentation l B 3.3.4.2 l BASES ( ) l l ACTIONS L.1 (continued) l ( Contine d ) ! signal . This requires two channels to be OPERABLE or in i trip. If the required channels cannot be restored to i OPERABLE status or placed in trip, Condition C must be l entered and its Required Action taken. l The 72 hour Completion Time is sufficient for the operator I to take corrective action, and takes into account the i likelihood of an event requiring actuation of feedwater and main turbine trip instrumentation occurring during this , period and the reliability of the triplicated fault-tolerant l digital control system for the feedwater control. l L1 i With the required channels not restored to OPERABLE status or placed in trip, THERMAL POWER must be reduced to l
< 25% RTP within 4 hours. As discussed in the Applicability i section of the Bases, operation below 25% RTP results in sufficient margin to the required limits, and the feedwater l
i (n') and main turbine trip instrumentation is not required to protect fuel integrity during the feedwater controller
- failure, maximum demand event. The allowed Completion Time of 4 hours is based on operating experience to reduce THERMAL POWER to < 25% RTP from full power conditions in an orderly manner and without challenging plant systems. d. W f \W* ,
l 1 SURVEILLANCE Reviewer's Note: Certain Frequencies are 'oased on approved REQUIREMENTS topical reports. In order for a licensee to use these Frequencies the licensee must justify the Frequencies as i required by the staff Safety Evaluation Report (SER) for the _ topical report. _ SR 3.3.4.2.1 Performance of the SENSOR CHANNEL CHECK once every 24 hours ensures that a gross failure of instrumentation has not occurred. A SENSOR CHANNEL CHECK is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should (continued) ABWR TS B 3.3-164 P&R 08/30/93
l w . i Feedwater and Main Turbine Trip Instrumentation B 3.3.4.2 l l - l BASES SURVEILLANCE SR 3.3.4.2.1 (continued) REQUIREMENTS ( Continued ) read approximately the same value. Significant deviations l between instrument channels could be an indication of i excessive instrument drift in one of the channels, or something even more serious. A SENSOR CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying , the instrumentation continues to operate properly between 1 each SENSOR CHANNEL CALIBRATION. j Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is i cutside the match criteria, it may be an indication that the i instrument has drifted outside its limits. l The Frequency is based on operating experience that ! demonstrates channel failure is rare. Performance of the l SENSOR CHANNEL CHECK guarantees that undetected outright channel failure is limited to 24 hours. The CHANNEL CHECK l supplements less formal, but more frequent, checks of l l (~ channel status during normal operational use of the displays l( associated with the channels required by the LCO. l SR 3.3.4.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the
- intended function. If the as found setpoint is not within its required Allowable Value, the plant specific setpoint methodology may be revised, as appropriate, if the history l l and all other pertinent information indicate a need for the '
I revision. The setpoint shall be left set consistent with the assumptions of the current plant specific setpoint methodology. l The Frequency of 92 days is based on the system capability I to automatically perform self-tests and diagnostics. l SR 3.3.4.2.3 SENSOR CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the
)
s (continued) ABWR TS B 3.3-165 P&R 08/30/93
l I l' Feedwater and Main Turbine Trip Instrumentation B 3.3.4.2 1 BASES l i SURVEILLANCE SR 3.3.4.2.3 (continued) i i l REQUIREMENTS ' ( Continued ) necessary range and accuracy. SENSOR CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations. Measurement and setpoint l error historical determinations must be performed consistent with the plant specific setpoint methodology. The channel shall be left calibrated consistent with the assumptions of the setpoint methodology. If the as found setpoint is not within its required ' Allowable Value, the plant specific setpoint methodology may , be revised, as appropriate, if the history and all other pertinent information indicate a need for the revision. The setpoint shall be left set consistent with the assumptions of the current plant specific setpoint methodology. - The Frequency is based upon the assumption of an [18] month calibration interval in the determination of the magnitude . j of equipment drift in the setpoint analysis. , 1 SR 3.3.4.2.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The (18] month Frequency is based on the need to l perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the ' i reactor at power. Operating experience has shown that these ,R ! l components usually pass the Surveillance when performed at y4 the 18 month Frequency. \;# REFERENCE 1. ABWR SSAR, Section 15.1. l r O ABWR TS B 3.3-166 P&R 08/30/93
Control Rod Block Instrumentation f B 3.3.5.1 B 3.3 INSTRUMENTATION B 3.3.5.1 Control Rod Block Instrumentation BASES [ BACKGROUND Control rods provide -tYe primary means for implementing reactivity changes. Control rod block instrumentation includes sensors, logic and associated electronic equipment, operator controls, data transmission paths, and load drivers needed to enforce control rod patterns that will provide confidence that specified fuel design limits are not ; exceeded for postulated transients and accidents. During operation above a specified Low Power Setpoint (LPSP), the o Automated Thermal Limit Monitor (ATLM) provides protection i U p K for control rod withdrawal error events. During operations l N below the LPSP, control rod blocks from the Rod Worth ' Minimizer (RWM) enforce specific control rod sequences bY [S q , designed to mitigate the consequences of a rod withdrawal a (v y i error (RWE). During shutdown conditions, control rod blocks I
,g from the Reactor Mode Switch-Shutdown Position ensure that all control rods remain inserted to prevent iriadvertent I criticalities. pelf [#
The ATLM and RWM are s systems of the Rod Control and Information System (R TIS). The R I is a non-safety system l (category 3) but is made up of dua redundant to ! assure igh availability. Both syst= independently acquire all of the required data and perform identical functions. The Rr IS functions are implemented on micro-processors with ahighdegreeof7segmentationwithinthesystem.Thedata needed by the R@lS is acquired from the Essential Mu tiplexing System with suitable isolators or from the R 15 multiplexing system 3 The rod block logic is arranged l so _that a rod block /Trom either channel will prevent rod withdrawal. APRM data received from all four NMS divisions is used to determine reactor power level for comparison with the LPSP to automatically disable and simultaneously enable
# the appropriate rod block function.
yeS l ihe Wg The purpose of the ATLM is to prohibit control rod withdrawal that would cause violation of the fuel thermal j NA;f J limits. The ATLM provides a rod block function to other g je "^ RC&l5 subsystems to appropriately inhibit control rod
}
withdrawal when reactor power is at or above the low power setpoint (LPSP). l (continued) ABWR TS B 3.3-168 P&R 08/30/93 l 1i
Control Rod Block Instrumentation B 3.3.5.1 BASES BACKGROUND The purpose of the RWM is to ensure control rod patterns ( Continued ) during startup are such that only specified control rod sequences and relative positions are allowed over the operating range.from all control rods inserted until reactor power is at the LPSP. The sequences effectively limit the potential amount and rate of reactivity increase during a RWE. The RWM, in conjunction with other RC&IS subsystems, will initiate control rod blocks when the actual sequence l deviates beyond allowances from the specified sequence. With the reactor mode switch'in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained. This function prevents criticality resulting from inadvertent control rod withdrawal during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position. There are four divisions of the reactor mode switch-shutdown position rod block. Each RC&IS logic receives data from all four divisions and will issue a rod block when any two of the mode switch-shutdown position vision) are active. The scram times of the control rods are required to comply f JNMM ab with LC0 3.1.4. The scram time testing is performed by g simultaneously scramming the two rods associated with a a Hydraulic Control Unit (HCU) - except for one of the 103 HCUs which has only one associated control rod. Scram time testing during MODE 5 requires a withdrawal block for all other r here are four divisions of the Reactor Mode SwitchJhutdown Position d bhd. - Each RC&IS logic f receives data from all four divisions and will issue a required rod block when any two of the mode switch-refueling Ny;,) M position div%ons- g4 yJg/ w tare
- s. active.
y .\s The thermal limits information calculated in the process computer is based on various process parameters measured acquired by the process computer. The ATLM and RWM Functions provide automatic control of rod soquencing to permit relatively rapid plant maneuvering.-If the automatic capabilities are inoperable, plant maneuvering may proceed using alternate means to establish assure operation within prescribed limits. The alternate methods must be implemented using suitable procedures and plant state information that does not depend on the ATLM OPERABILITY. (continued) ,- ABWR TS B 3.3-169 P&R 08/30/93 l
l Control Rod Block Instrumentation l B 3.3.5.1 BASES APPLICABLE 1.a. Automated Thermal Limit Monitor i SAFETY ANALYSES, LCO, and The ATLM is designed to prevent violation of the fuel APPLICABILITY thermal operating limits,and the cladding 4Fylotic si.. .irr
-fuel desigr. limit that may result #rc : : ingle-camteci red-
--ethdrawal errer (PWE) event. The analytical methods and 3 3 S)b assumptions usedei cvale: ting th: P,"E ev d are summarized vt hP in lieference 2. A statistical analysis of f,WE event +W M
. *" D performed to determine the fuel thermal performance response Cg do hp h as a function of withdrawal distance and initial operating 7 ,.
I conditions. These analysis were used to establish the p N,< t,t coefficients used in the ATLM algorithms for calculating rod cd}/,tW"3 /block f setpoints. The ATLM satisfies Criterion 3 of the NRC 9p / Policy Statement. Two channels of the ATLM are available and f are required to be OPERABLE to ensure that no single instrument failure can preclude a rod block from this . Function. The ATLM compares the calculated rod block setpoints in each l of the ATLM core regious with the LPRM readings in the region to determine if a rod block is needed. The calculated ' setpoints include factors to accommodate the uncertainties (GM in the measured parameters used to perform the rod block g# setpoint calculations. g gM The ATLM is assumed to heconsequencesofankRWE event when operating with reactor power above the LPSM-s- M. 3 RTf'. Below this power level, the consequences of an RWE event will not exceed the fuel thermal limits, and therefore the ATLM is not required to be OPJRABLE (Ref. 3). dere fore %e W adoMe VAWe et be D% rtW v be l.a &
- c mvr ATL
- 1.b. Rod Worth Minimizer ( WM) o f7e r
- W it hy 4bov e b% ftTf'.
l The RWM enforces the Ganged rod Withdrawal Sequence ! Restrictions (GWSR) to ensure that the initial conditions of - ! the RWE analysis are not violated. The analytical methods and assumptions used in evaluating the RWE are summarized in. References 4, 5, and 6. The GWSR requires that control rods be moved in groups, with all control rods assigned to a specific group required to be within specified positions. Requirements that the control rod sequence is in compliance with GWSR are specified in LC0 3.1,6. The RWM satisfies Criterion 3 of the NRC Policy Statement. The RWM is a backup to operator selection of rod sequences (continjed) ABWR TS B 3.3-170 P&R 08/30/93 ~ i
The. R M Oerdoye frovMes the C4f4bli b f4% do@5 c ~ d2 Control Rod Block Instrumentation B 3.3.5.1 l hYe 4o fe vu & ne Ac 5 tWd b % e. re(e rwe r el LC.Os. BASES j ~ f APPLICABLE 1.b. Rod Worth Minimizer (RWM) (continued) SAFETY ANALYSIS, LCO, and during manual operation and is a backup to the Reference Rod . APPLICABILITY Pull Sequence during automatic operation. The system design i ( Continued ) prohibits automatic control rod sequencing operations when : only one channel is operable (automatically switches to i manual when one channel is inoperable). Required Actions of ' LC0 3.1.3 and LCO 3.1.6 may necessitate bypassing individual j control rods to allow continued operation with inoperable C control rods or to allow correction of a control rod ttern ; notincompliancewiththeGWSR.gheinoiviaualcontro ods may be bypassed as requirea by the conditions, and the : RWM is not considered inoperable provided SR 3.3.5.1.6 is / .j met. l Compliance with the GWSR, and therefore OPERABILITY of' the
' lng RWM, is required in MODES 1 and 2 with THERMAL POWER below !
the LPSP~ When THERMAL POWER is above the LPSP there is no , hA\\o O(Eff fe d'ble p/o d p ssible control rod configuration that results in a control-rod worth that could exceed the fuel damage limit for the l b worst case RWE. In MODES 3 and 4, all control rods are !
# *d co required to be inserted in the core. In MODE 5, Ao '
# "ye re$ved f
C# restrictions on control rod withdrawals in core cells ' containing fuel assemblies provides sufficient Shutdown ef8g4>M Margin (SDM) to assure that the reactor is subcritical and ; R the consequences of a RWE are within limits l ipgbd',py - 2. Reactor Mode Switch-Shutdown Position During MODES 3 and 4, and during MODE 5 when the reactor-mode switch is required to be in the shutdown position, the core is assumed to be subtritical; therefore, no positive reactivity insertion events are analyzed. . The Reactor Mode Switch-Shutdown Position control rod withdrawal block ensures that the reactor remains subcritical by blocking , control rod withdrawal, thereby preserving the assumptions l of the safety analysis. The Reactor Mode Switch-Shutdown Position Function satisfies Criterion 3 of the NRC Policy Statement. I Three channels are required to be OPERABLE to ensure that no single channel failure will preclude a rod block when i required. No Allowable Value is applicable for this i l l ' (Continued) ABWR TS B 3.3-171 P&R 08/30/93 , 1
Control Rod Block Instrumentation B 3.3.5.1 BASES l l l APPLICABLE 2. Reactor Mode Switch-Shutdown Position (continued) SAFETY ANALYSIS, LCO, and Function since the channels are mechanically actuated based l APPLICABILITY solely on reactor mode switch position. l ( Continued ) During shutdown conditions (MODE 3, 4, or 5) no positive i reactivity insertion events are analyzed because control rod withdrawal blocks are provided to prevent criticality. l Therefore, when the reactor mode switch is in the shutdown ! position, the control rod withdrawal block is required to be OPERABLE. During MODE 5, with the reactor mode switch in S GANG / SINGLE switch in the refueling the SINGLE position position, theand the R$out one-rod- interlock (LCO 3.9.2) provides the required control rod withdrawal blocks. ACTIONS A.1 & A.2 When either ATLM becomes inoperable a rod block is issued and automatic R & S actions prohibited by forcing the RCalS to be in the manual mode. Automatic operation can be restored only by restoring ATLM operation. Manual control3 8h r_od withdrawal # may proceed if the inoperable ATLM is placed h-) b in bypass. The [72] hour Completion Time for Action A.1 is based on the high reliability of the ATLM Function and , provides sufficient time to effect repairs. ; fN Alterna.ely, plant maneuvering may continue if operation within thermal limits is verified by other suitable means as e $ef described above. ! hd g( g.g f^f s Jc!
,CA B.1 and B.2 6e
# J9 f If both ATLMs become inoperable then there may be insufficient protection from erroneous rod withdrawals.
l Therefore, all control rod withdrawals are prohibited by inserting a rod block (Action B.1). Action B.2 requires confirmation that the rod block is in effect by attempting a rod movement or et, mo J e % e d. ro d ga # l U When either WM becomes inoperable a rod block is issued and automatic R ,S actions prohibited by forcing the RC&IS to (continued) ABWR TS B 3.3-172 P&R 08/30/93 !
i l Control Rod Block :ostrumentation l B 3.3.5.1 1 BASES g , ne RCl5 W a*"Al ACTIONS .C_:_1.
~
(continued) pi g1maM oJe) l ( Continued ) be in the manual mode. Automatic operation can be restored only by restoring RWM operation. Manual control rod withdrawal may proceed $if the inoperable RWM is placed in bypass. The [72] hour Completion Time is based on the high reliability of the RWM Function and provides sufficient time to effect repairs. The RWM is considered to remain OPERABLE when individual control rods are bypassed as required by LCO 3.1.3 or LC0 3.1.6. l D.d If both RWMs become inoperable then there may be no protection from erroneous rod withdrawals. Therefore, all control rod withdrawals are prohibited until both RWMs are restored to OPERABLE status. Rod withdrawals are also prohibited if Required Action C is not implemented within the specified Completion Time to limit the amount of time operations are permitted to continue with one RWM inoperable. E.1 and E.2 If there are failures in of the Reactor Mode Switch-Shutdown Position Function the plant must be placed in a condition where the LC0 does not apply. This is accomplished by ! suspending all control rod withdrawal immediately (Action ' E.1), and initiating to fully inserting all insertable control rods in core cells containing one or more fuel assemblies (Action E.2). This will ensure that the core is subcritical, with adequate SDM ensured by LC0 3.1.1, !
" SHUTDOWN MARGIN (SDM)." Control rods in core cells j containing no fuel assemblies do not affect the reactivity of the core and are therefore not required to be inserted.
Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted. SURVEILLANCE As noted at the beginning of the SR, the SRs for each REQUIREMENTS Control Rod Block instrumentation Function are found in the SR column of Table 3.3.5.1-1. l [] V (continued) ABWR TS B 3.3-173 P&R 08/30/93
Control Rod Block Instrumentation . B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.1 and SR 3.3.5.1.2 l REQUIREMENTS ! ( Continued ) The CHANNEL FUNCTIONAL TESTS for the ATLM and RWM are performed using simulated data that emulates an action outside of permissible rod withdrawals and verifying that a rod block output occurs. If the rod blocks do not occur ; within the specified allowable values , the plant specific setpoint methodology may be. revised, as appropriate, if the history and all other pertinent information indicate a need r for the revision. The setpoint shall be left set consistent' with the assumptions of the current plant specific setpoint methodology. As noted, the SRs are not required to be performed until I hour after specified conditions are met (e.g., after any control rod is withdrawn in MODE 2). This allows entry into the appropriate conditions needed to perform the required SRs. The Frequencies are based i reliability analysis (Ref. 7). g e Md i j pea 0*fb & C j, SY SR 3.3.5.1.3 and SR 3.3.5.1.4 J The 10.LPSPisthepointwhere(theTransitionismade - l between the ATLM and RWM functionsN. The effective setpoint l l of the LPSP must be periodically confirmed. ! i The [18] month frequency is based on the ABWR expected l l ' REFUELING INTERVAL and the need to perform these ; j Surveillance under the conditions that apply during a plant i outage. Since the LPSP function is very reliable and the setpoint is , not subjected to drift, a surveillance interval equal to the ! specified interval is adequate. ) I SR 3.3.5.1.5 ; The CHANNEL FUNCTIONAL TEST for the Reactor Mode Switch- " Shutdown Position Function is-performed by attempting to withdraw any control rod with the reactor mode switch in the ! i shutdown position and verifying a control rod block occurs. The Reactor Mode Switch-Refueling Position Function may be tested by attempting to withdraw control rods.other than the j rods under test while the scram test is active. ! As noted in the SR, the Surveillance is not required to be ! performed until-1 hour after one hour after the condition of (continued) ABWR-TS B 3.3-174 P&R 08/30/93 1
l > Control Rod Block Instrumentation B 3.3.5.1 f~ BASES SURVEILLANCE SR 3.3.5.1.5 (continued) REQUIREMENTS l ( Continued ) applicability occurs, since testing of the functions in any other condition would require lifting leads and installing jumpers. This allows entry into the modes and other conditions of applicability if the specified Frequency is ' not met per SR 3.0.2. The [18] month frequency is based on the ABWR expected REFUELING INTERVAL and the need to perform this Surveillance under the conditions that apply during a plant outage. The high reliability of the devices used in the RC&IS provide confidence that the specified frequency is adequate. SR 3.3.5.1.6 The process computer calculations that provide setpoints to the ATLM uses various measured process parameters. A CHANNEL CHECK on the parameters is performed every [24] hours. These parameters are:
- a. FMCRD cooling water flow,
[s b. Feedwater flow,
- c. Feedwater temperature,
- d. Recirculation flow, '
- e. RPV pressure,
- f. CUW flow, '
l
- g. APRM, and
- h. Selected LPRMs.
Performance of the CHANNEL CHECK provides confidence that a gross failure of a device in a channel has not occurred. A ! CHANNEL CHECK is a comparison of the parameter indicated in ' l one channel to a similar parameter in a different channel. It is based on the assumption that channels monitoring the same parameter should read approximately the same value. Significant deviations between the channels could be an indication of excessive instrument drift on one of the channels or other channel faults. Agreement criteria are determined by the plant staff based on a combination of the channel instrument and parameter j l indication uncertainties. , I l /"\ (continued) U ABWR TS B 3.3-175 P&R 08/30/93 i
4 Control Rod Block Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.6 (continued) REQUIREMENTS ( Continued ) The high reliability of each chan'iel provides confidence that a channel failure will be rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO. REFERENCES 1. ABWR SSAR, Section [7.6.1.7.3].
- 2. ABWR SSAR, Section [15.4.2].
- 3. NEDE-240ll-P- A-9-US, " General Electrical Standard Application for Reload fuel," Supplcment for United States, Section S 2.2.3.1, September 1988.
- 4. " Modifications to the Requirements for Control Rod Drop Accident Mitigating Systems," BWR Owners Group, July 1986.
- 5. NED0-21231, " Banked Position Withdrawal Sequence," ,
l January 1977.
- 6. NRC SER, Acceptance of Referencing of Licensing Topical Report NEDE-24011-P-A, " General Electric l
Standard Application for Reactor Fuel, Revision 8, l l Amendment 17," December 27, 1987.
- 7. NEDC-30851-P-A, " Technical Specification Improvement l
i Analysis for SWR Control Rod Block Instrumentation," ' October 1988. i I l l l f (continued) ABWR TS B 3.3-176 P&R 08/30/93 l )
l I PAM Instrumentation i B 3.3.6.l l I B 3.3 INSTRUMENTATION B 3.3.6.1 Post Accident Monitoring (PAM) Instrumentation . l BASES BACKGROUND The primary purpose of the PAM instrumentation is to display l plant' variables that provide information required by the i control room operators during accident situations. This . information provides the necessary support for the operator ! to take the manual actions for which no automatic control:is i l provided and that are required for safety systems to ' accomplish their. safety functions for Design Basis Events. The instruments tha hese variables are designated ! as Type A, Category ad non-Ty'pg A, Category I .in j l accordance with Re atory Guide 1.97.(Ref. 1). I c Pa4 t: , TheOPERABILITYofthegccidentgoniLoring{nstrumentation '! ensures that there s sufficient'inf rmation available on l selected plant parame JQomonito and assess plant' status and behavior following an accide . This capability is i consistent with the recommendations of Reference 1. APPLICABLE The PAM instrumentation LC0 ensures the OPERABILITY of lO SAFETY ANALYSIS Regulatory Guide 1.97, Type A, variables so that the control room operating staff can:
- Perform the diagnosis specified in the Emergency !
l Operating Procedures (E0P). TWse varhbles'are ! restricted to preplanned actions for the primary
~
l success path of Design Basis Accidents (DBAs) i (e.g., loss of coolant accident :(LOCA)); . and i
- Take the specified, preplanned, manually contr41ed - l actions for which no automatic control is provided, l which are required for safety systems to accomplish !
~
i their safety function. i The PAM instrumentation LCO also ensures OPERABILITY of , Category I, non-Type A, variables. This ensures the control ! I, room operating staff can: l t s
- Determine whether systems important to safety are ,
performing their intended functions; - O ABWR TS B 3.3-177 P&R08/30/93 I l
l PAM Instrumentation ) B 3.3.6.1 i l BASES i APPLICABLE
- Determine the potential for causing a gross breach of I SAFETY ANALYSIS the barriers to radioactivity release; ;
( Continued ) l'
- Determine whether a gross breach of a barrier has occurred; and
- Initiate action necessary to protect the public and to obtain an estimate of the magnitude of any impending threat.
The plant specific Regulatory Guide 1.97 analysis (Ref. 2) documents the process that identified Type A and Category I, non-Type A, variables. ; PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 od the NRC Policy Statement. Category I, non-Type A, instrumentation is retained in the Technical Specifications (.S) because it ' is intended to assist operators in minimizing the consequences of accidents. Therefore, these Category I, l non-Type A, variables are important for reducing public risk. LCO LC0 3.3.6.1 requires the OPERABLE Fun:tions and chanr.els as indicated in Table 3.3.6.1-1. All Functions, except for PCIV position, have at least two channels to ensure no single failure prevents the operators from being presented with the l information necessary to determine the status of the unit - i and to bring the unit to, and maintain it in, a safe condition following an accident. Furthermore, multiple j channels permit performing CHANNEL CHECKS during the post l accident phase to confirm the validity of displayed l information. For the PCIV's, the important information is the status of the primary containment penetrations. The LCO for PCIV l j ! position describes the requirements and provides the basis for PCIV position indication. If a normally active PCIV is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE. f Listed below is a discussior, of each of the specified instrument Functions listed in Table 3.3.6.1-1. Thne s - O (cont 4neeo) l B 3.3-178 P&R 08/30/93 ABWR TS l
]
I I PAM Instrumentation B 3.3.6.1 BASES LCO - discus:ica; ;rc intended a; cx ples nf wh=t eheu!d b & ( Continued ) -fwevided for c;ch function Mer the p1=" epecific B:ses are
- - r =parede Data for most of the display Functions are
/ transmitted to the operator displays via the four divisions i of the Essential Multiplexer System (EMS). Exceptions are noted in the following discussions for each Function.
t
- 1. Reactor Steam Dome Pressure Reactor steam dome pressure is a Category I variable provided to support monitoring of Reactor Coolant System (RCS) integrity and to verify operation of the Emergency Core Cooling Systems-(ECCS). Four independent pressure transmitters with a range of 0 psig to 1500 psig monitor pressure. Wide range displays are the primary irdication ,
used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel. 2.3. Reactor Vessel Water level-Wide Ranoe. Fuel Zone o lO l Reactor vessel water level is a Category I variable provided to support monitoring of core cooling and to verify ' operation of the ECCS. The wide range and fuel zone water level channels prcvide the PAM Reactor Vessel Water Level Function. The four wide range water level channels cover the range from the near top of the fuel to the steam lines and two fuel zone channels cover the range from below the $ core support plate to the top of the steam separator shroud. l The display controller uses these channels to create a l continuous display of reactor water level. These displays , are the primary indication used by the operator during an ! accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel. : i Either the hardwired or multiplexed displays of this Function may be used to satisfy the LCO.
- 4. Sucoression Pool Water level l Suppression pool water level is a Category I variable provided to detect a breach in the reactor coolant pressure boundary (RCPB). This variable is also used to verify and (continued)
B 3.3-179 P&R 08/30/93 ABWR TS
PAM Instrumentation B 3.3.6.1 BASES LC0 4. Sucoression pool Water Level (continued) ( Continued ) provide long term surveillance of ECCS function. The wide range suppression pool water level measurement provides the operator with sufficient information to assess the status of the RCPB and to assess the status of the water supply to the ECCS. The wide range water level indicators monitor the suppression pool level from the bottom of the ECCS suction lines to five feet above the r- 1 suppression pool level. Four wide range sg pression poc, ater level signals are transmitted from separate differential pressure transmitters, rd are continuously displayed in the control room. These (f re.,dve fool a displays are the primary indication used by the operator M" W g during an accident. Therefore, the PAM Specification deals
' specifically with thi: portion of the instrument channel.
5.a. Drywell pressure. 5.b. Wide Rance Containment Pressure Drywell pressure is a Category I variable provided to detect breach of the RCPB and to verify ECCS functions that operate to maintain RCS integrity. Requirements for monitoring of drywell pressure are specified for both narrow range and
/ wide range. The narrow range monitoring requirement is satisfied in the existing essential safety system designs by the four divisions of drywell pressure instruments which provide inputs to the initi 1,ionsf%e y,eactor p,rdtect4cn
,p-ttrnr7 gystem (RPS) and th pmergency gore qooling lystems (ECCS).gThe requirement for ambiguaus_ wide range dryjwel
( pressure monitoring are satisfied with two channels of instrumentation and integration with the wetwell pressure pl instrumentation. Given the existence of (1) the normal pressure suppression vent path between the drywell and wetwell and (2) the wetwell to drywell vacuum breakers, the ; long-term pressure within the drywell and wetwell will be approximately the same. Drywell pressure signals are transmitted from separate pressure transmitters,'" --- + ! i [f%ge0ye .O continuously displayed in the main control room. These p displays are the primary indication used by the operator l kg during an accident. Therefore, the PAM Specification deals t specifically with this portion of the instrument channel. C l l Either the hardwired or multiplexed displays may be used to I satisfy the LCO. (continued) ABWR TS B 3.3-180 P&R 08/30/93 l
I l PAM Instrumentation j B 3.3.6.1 j BASES ! LCO 6,7. Drywell/Wetwell Area Radiation (Hioh Rance) , ( Continued ) j Drywell and wetwell radiation measurements and displays are ' provided to monitor for the potential of significant ; radiation releases and to provide release assessment for use i V"h by operators in determining the need to invoke site - emergency plans. Two separate divisions of instrumentatinn i are provided with both dr well and wetwell monitor chanrels in each division e d 2ra continuously displayed in the Aain 1 control room. These displays are the primary indicatio" used by the operator during an accident. Therefore, the P.tt'
- 4 Specification deals specifically with this portion of the '
g 4 instrument channel. 4 gr[ cO . M c
- 8. Primary Containment Isolation Valve (PCIV) Positici 1
j Q[Sp/g PCIV position is provided for verification of containnstnt integrity. In the case of PCIV position, the importan1 information is the isolation status of the containment penetration. 4 ) O The LC0 requires two channels of PCIV position status er penetration to be OPERABLE for penetration flow paths oith i two active valves. For containment penetrations with o: ly one active PCIV with control room indication, note (a) l requires a single channel of valve position indication to be j OPERABLE. This is sufficient to provide indications of the 4 isolation status of each isolatable penetration via indicated status of the active valves and, where applicable, a prior knowledge of passive valve or system boundary st itus. 1 If a penetration flow path is-isolated by at least one closed and de-activated automatic valve, closed manual valve, blind flange, or check valve with flow through he valve secured, position indication for the PCIV(s) in t he j associated penetration flow path is not needed to deter nine status. Therefore, per footnote (b) in Table 3.3.6.1-1 the l position indication' for valves in an isolated penetrati, n is l not required to be OPERABLE. Indication of the completion of the containment isolatio, function is provided by valve closed /not closed indicatius for individual valves on safety related displays, Annunciators are provided to alert the operator to any lites 4 j that may not be isolated. 1 1 (continueo n 1 B 3.3-181 P&R 08/30/93 ABWR TS s I
PAM Instrumentation B 3.3.6.1 ( BASES LC0 8. Primary Containment Isolation Valve (PCIV) Position ( Continued ) (continued) for this plant, the PCIV position PAM instrumentation _ consists of the following: _ g%O 9.10. Wide Ranae Neutron Flux l Wide range neutron flux is a Category I variable provided to verify q ctor shutdown. The display co q 11er uses data from foum neird APRM channels and four , q. ired SRNM channels to provide a display >f neutron flux on the main control room panel with a range of 10'*% to full pm ggg g v These displays are the primary indication used by the 1 operator during an accident. Therefore, the PAM- l Specification deals specifically with this portion of the j instrument channel. 4 o b
- 11. 12. Containment
~
Atmosoberic Monitors-Drywell and Wetwell Hydroaen and Oxvaen Analyzer Drywell- and wetwell hydrogen and oxygen analyzers are' Category I instruments provided to detect high hydrogen or oxygen concentration conditions that represent a potential for containment breach. These parameters are also important in verifying the adequacy of mitigating actions. There are two divisions in the Containment Atmospheric Monitoring System analyzers with one channel of H2 monitoring and one ) channel of 0, monitoring per division. Samples of either the ! drywell or wetwell are drawn into the analyzers based on the 4 position of a selector switch in the main control room. l Displays and alarms are provided in the main control room. ! These displays are the primary indication used by the i operator during an accident. Therefore, the PAM ; Specification deals specifically with this portion.of the instrument channel. i
- 13. Containment Water level.
Containment Water Level displays onelyzus are Category I instruments provided for early detection of small leaks in the containment and as an alternate to drywell pressure and (continued) ABWR TS B 3.3-182 P&R 08/30/93
t PAM Instrumentation B 3.3.6.1 , O BASES LC0 13. Containment Water level. (continued) ( Continued ) drywell radiation Functions. . There are two channels of < Containment-Water Level with displays and alarms provided in the main control room. These displays are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel. IL Sucoression Pool Water Temperature Suppression Pool Water Temperature is a Category I variabic ' provided to detect a condition that could potentially lead to containment breach, and to verify the effectiveness of - ECCS actions taken to prevent containment breach. The - suppression pool water temperature instrumentation allows operators to detect trends in suppression pool water d, V[p4i temperature in sufficient time to take action t0 pr:;;nt fL p l ste ar rw quending vibrati:n; in th; suppr:::i n peal. Theredivision 4 (/ ouf withadisplaychannelineachdivisio&n. c rw mW , Therearemultipletemperatu[sensorsineachdivision.The temperature sensors in each/ division _are spatially distributedatspecifiedQircumfren,t,_tappositionsand several elevations at each pos m on to provide an indication i of the average pool temperature. The temperature sensors are - also located to monitor each relief valve discharge location. The individual sensors and bulk average temperature may be selected for display in the control room. These displays are the primary indication used by the l operator during an accident. Therefore, the PAM ) Specification deals specifically with this portion of the i instrument channels.
& osyr k ert
- 15. Drywell moerature [.H1 6,]
Orywe17 perature is a Category I variable provided to verify RCS and containment integrity and to verify the d pere effectiveness of actions taken to remove energy from the containment. There are two divisions of drywell temperature monitoring with a display channel in each division. Temperature sensors are distributed throughout the drywell to provide confidence that there is an adequate , l O (co#ti"#ea) ABWR TS B 3.3-183 P&R 08/30/93 i i I 4 -
,_ . _ . . _ , . . . - _ _ , . - . _ ~ .
I
i PAM Instrumentation B 3.3.6.1 O BASES LC0 15. Drvwell Air Tercerature (continued) { Continued ) representation of the state of the drywell. Control room displays of the temperatures are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.
- 16. Main Steam Line Radiation Main steam line radiation is a Category I variable provided to monitor fuel integrity. Radiation in the main steam line tunnel - which is measured by the process radiation monitoring system - is an indicator of coolant radiation.
There are four divisions of main steam tunnel radiation monitoring with a control room display channel from each division. These displays are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel. O APPLICABILITY The PAM instrumentation LC0 is applicable in MODES I and 2. These variables are related to the diagnosis and preplanned actions required to mitigate DBAs. The applicable DBAs are ! assumed to occur in MODES 1 and 2. In MODES 3, 4, and 5, ! plant conditions are such that the likelihood of an event j that would require PAM instrumentation is extremely low; , l therefore, PAM instrumentation is not required to be OPERABLE in these MODES. , ACTIONS Note I has been added to the ACTIONS to exclude the MODE change restriction of LCO 3.0.4. This exception allows entry into the applicable MODE while relying on the Actions even though the Actions may eventually require plant shutdown. This exception is acceptable due to the passive function of the instruments, the operator's ability to diagnose an accident using alternate instruments and methods, and the low probability of an event requiring these instruments. A Note has also been provided to modify the ACTIONS related , to PAM instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, (continued) ABWR TS B 3.3-184 P&R 08/30/93 i l ,. _ __
l PAM Instrumentation i i B 3.3.6.1 l 1 BASES l ACTIONS subsequent trains, subsystems, components, or variables ( Continued ) expressed in the Condition, discovered to be inoperable or ; not within limits, will not result in separate entry into : the Condition. Section 1.3 also specifies that Required l Actions of the Condition continue to apply for each ' additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable PAM instrumentation channels provide appropriate , compensatory measures for separate inoperable functions. As ' l such, a Note has been provided that allows separate ' Condition entry for each inoperable PAM Function. l When a function has one required channel that is inoperable, i the required inoperable channel must be restored to OPERABLE ' status within 30 days. The Completion Time is based on the high reliability of the remaining devices for monitoring the parameter and takes into account the ;::::ive n:ture of th; instrum:nt (no critical :et^ stic action i :::u,;d Lu u m i - frc- these instruments}r-and the low probability of an event i
, requiring PAM instrumentation during this interval.
l B.d i If the _ required actions and associated completion time of condition A is not met, this Required Action specifies initiation of actions in accordance with l Specification 5.9.2.c, "Special Reports," which requires a written report, approved by the [onsite review committee), to be submitted to the NRC. This report discusses the results of the root cause evaluation of.the inoperability and identifies propo esto ttve actions. This Action is appropriate in lie of a shutdown M quirement since alternative Actio s are identified be ore loss of functional capability, and g ven thel likelihood plant conditions that would requir information provide 3b y this instrumentation. u (kbW As noted in the LCO K acti D Ues t g y to Functions 11 & 12, (hydro ofygen monitors , which ar addressed in Condition D. W n onewf thab Fur tion has t o required C (continued) ABWR TS B 3.3-185 P&R 08/30/93 I i
PAM Instrumentation B 3.3.6.1 BASES ACTIONS [.d (continued) ( Continued ) channels that are INOPERABLE then one channel must be restored to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur. Multiple entry into the condition table causes Condition A , to be invoked on completion of Action C.1 so appropriate ! additional action is taken. I ( When two hydrogen / oxygen monitor display channels are inoperable, at least one channel must be restored to OPERABLE status within 72 hours. The 72 hour Completion Time is reasonable, based on the backup capability of the Post Accident Sampling System to monitor the hydrogen concentration for evaluation of core damage and to provide information for operator decisions. Also, it is unlikely that a LOCA that would cause core damage would occur during this time. f.d his Required Action directs entry into the appropriate Cbndition refere datable 3.3.6.1-1. The applicable Condition refer nced in th M 4ble is Function dependent. If C- the re)uired A. tions and assochttqd Completion Times for cononi nr% ar D not. met for i Function then Conditi n E is entere or that fun ion and Table 3.3.6.1-1 used to transf r to the appropriate bsequent Condition.
\ GJN:t.
O (continued) ABWR TS B 3.3-186 P&R 08/30/93
. . = - - - _.
i PAM Instrumentation B 3.3.6.1 BASES ACTIONS f_.1 C. ( Continued ) For the PAM Functions in Table 3.3.6.1-1, if any equired Action and associated Completion Time of Condition or D is not met, the plant must be placed in a MODE in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging p1 ant systems. M Since alternate means of monitoring the parameters to which this Condition applies have been developed and tested, the . Required Action is to follow the directions of Specification 5.9.2.c instead.of. requiring a plant shut down. These alternate means may be temporarily installed if- , the normal PAM channel cannot be restored to OPERABLE status ' O within the allotted time. The report provided to the NRC : should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels. SURVEILLANCE The following SRs apply to each PAM instrumentation Function REQUIREMENTS in Table 3.3.6.1-1 7 p c,e,p g g Lg 4), g loe,s w, m SR 3.3.6.1.1 CL. PerformanceoftidCHANNELCHECKonceevery31daysensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is a comparison of the parameter indicated on one instrumentation channel to a similar parameter on other instrumentation channels. It is based on the assumption that independent displays of the same parameter should read approximately the same value. Significant deviations between displays could be an indication of excessive instrument drift or other faults in one of the channels. A CHANNEL CHECK will detect gross channel ' failure; thus, it is (continued). ABWR TS B 3.3-187 P&R 08/30/93
i PAM Instrumentation M th 64 i:hh d ibh B Mik% M N 1.~% php vlB Ved hoh d BASES y o%9 % g s.t.g g t,Qg
~
SURVEILLANCE SR 3.3.6.1.1 (continYd) REQUIREMENTS (Continued ) key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a f channel is outside the match criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. Performance of the CHANNEL CHECK provides confidence that undetected outright channel failure is limited to 31 days. f The high reliability of the devices used to implement the PAM functions provides confidence that failure of more than one channel of a given function in any 31 day interval is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of those displays associated with the required channels of this LCO. SR 3.3.6.1.2 CHANNEL CALIBRATION is a complete check of the instrument loop including the sensor. The test verifies that the , display reflects the measured parameter with the necessary ( range and accuracy. As noted M ron detectors are excluded from SENSOR CHANNEL CALIBRATION because of the difficulty of simulating a meaningful signal. Changes in neutron detector sensitivity are compensated for by performing the 7 day calorimetric calibration and the 1000 MWD /T LPRM calibration specified in LCO 3.3.1.lg s 11< 5 v or h gt.rL A 4 % % The 118fmonth frequency is based on the ABWR expected l
- refueling interval and the need to perform this Surveillance l under the conditions that apply during a plant outage. The )
i Frequency is adequate based on the low drift of the devicas
. used to implement the functions covered by this LCO. Note that calibration of these channels overlaps or is encompassed by calibrations required by other LCOs that address some of the same components required by the PAM displ ays.
I
/~ (continued) l ABWR TS B 3.3-188 P&R 08/30/93 l
l
PAM Instrumentation B 3.3.6.1 BASES REFERENCES 1. Regulatory Guide 1.97, " Instrumentation for Light-Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an _ Accident," [Date).
- 2. ABWR SSAR, Section 7.5 6
S ABWR TS B 3.3-189 P&R 08/30/93
Remote Shutdown System B 3.3.6.2 B 3.3 INSTRUMENTATION B 3.3.6.2 Remote Shutdown System l BASES BACKGROUND The Remote Shutdown System provides the control room operator with sufficient instrumentation and controls to ! I place and maintain the plant in a safe shutdown condition from a location other than the control room. This capability , is necessary to protect against the possibility of the control room becoming inaccessible. A safe shutdown condition is defined as MODE 3. With the plant in MODE 3, the High Pressure Core Flooder System, the safety / relief valves, and the Residual Heat Removal Shutdown Cooling System can be used to remove core decay heat and meet all safety requirements. Additional systems assisting in the . remote shutdown capability are portions of the Nuclear y\ g% U Boiler System, the Reactor Building Cooling Water System, the Reactor 4 Service Water System, the Electrical Power l Distribution System, and the Flammability Control System. The long term supply of water for the HPCF and the ability l to operate shutdown cooling from outside the control room i allow extended operation in MODE 3. In the event that the control room becomes inaccessible, the operators can establish control at either of two remote , shutdown panels (Division I and Division II) and place and maintain the plant in MODE 3. The two panels have a different complement of controls and indications, but either panel may be used to achieve and maintain MODE 3. The main ' difference between the two panels is that one of them uses HPCF and one SRV to regulate pressure and provide the decay
--heat removal and inventory make up. The other panel uses 3 i the LPCF and shutdown cooling mode of RHR system l SRVs>idethiscapability.
l to prov 1% % The postulated conditions assumed to exist when the Main Control Room becomes inaccessible are 1) the plant is , operating initially at or less than design power and 2) the l plant is not experiencing any transient or accident i situations. Therefore, complete control of engineered safeguard feature systems from outside the main control room l is not required. Even though the loss of offsite power is considered unlikely, the remote shutdown panels are powered from Class IE power system buses I and 11 so that backup AC power would 1 (Continued) ABWR TS B 3.3-190 P&R 08/30/93 l l 3
Remote Shutdown System B 3.3.6.2 BASES BACKGROUND be automatically supplied by the plant diesel generator. ( Continued ) Manual controls of the diesel generator are also available locally. All plant personnel are assumed to have evacuated the main control room and the main control room continues to be inaccessible for several hours. The initial event that causes the main control room to become inaccessible assumes the reactor operator can manually scram the reactor before leaving the main control room. If this is not possible, the capability of a backup means to achieve reactor reactivity shutdown is available. Some of the existing systems used for normal reactor shutdown operations are also utilized in the remote shutdown panels. The functions needed for remote shutdown control are transferred to the remote shutdown panels using manual switches that disable control of the functions from the main control room and enable control from the remote shutdown panels. Control signals are interrupted by the transfer devices at the hardwired, analog loop. Sensor signals which interface with the remote shutdown system for local display
, of process variables are continuously powered and available for monitoring at all times. Control signals from the main control room are routed from the RMUs to remote shutdown transfer devices, and then to the interfacing system equipment. Actuation of the transfer switches bypasses the RMUs and connects the control signals directly to the remote shutdown panels.
All recessary power supply circuits are also transferred to other sources. Remote shutdown control is not possible without actuation of the transfer devices. Operation of the transfer devices causes an alarm in the main control room. The remote shutdown control panels are located outside the main control room. Access to the panels is administrative 1y and procedurally controlled. The OPERABILITY of the Remote Shutdown System control and instrumentation Functions ensures that there is sufficient information available on selected plant parameters to place and maintain the plant in MODE 3 should the control room become inaccessible. (continued) ABWR TS B 3.3-191 P&R 08/30/93
Remote Shutdow System N B 3.3.,l.2 \ l i (
}
BASES APPLICABLE The R,emetrShut Qn System is required to provide equipment iate locati s outside the control room with a SAFETY ANALYSIS at appr i deli ability to pr tly shut down the reactor to -l M0 , including the necegsary instrumentation and ; co trols, btomaintainthegiantinasafeconditionin MOD 3. g ; The csiteria governing the esign and the specific system ' requirements of the Remote hutdown System are located in 10 CFR 50, ppendix A, GDC 19 (Ref.-1). The Remote Shutdowfr5 em is considered an important contributor to reducing the risk of accidents; as such, it has been retained in the Technical Specifications (TS) as ' indicated in the NRC Policy Statement. LC0 The Remote Shutdown System LC0 provides the requirements for the OPERABILITY of the instrumentation and controls necessary to place and maintain the plant in MODE 3 from a . ! location other than the control room. The instrumentation and controls typically required are listed in ! Table 3.3.6.2-1 in the accompanying LCO. The Functions with l two required channels have one on each RSS panel while those ; with one required channel are on only one of the RSS panels. , The controls, instrumentation, and transfer switches are ; those required for: ;
- Reactor pressure vessel (RPV) pressure control; ;
- Decay heat removal;
- RPV inventory control;
. Flammability Control; l
- Atmospheric Control Monitoring; and
- Safety support systems for the above functions, including service water, component cooling water, and onsite power, including the diesel generators.
A Remote Shutdown System panel is OPERABLE if all instrument and controls on the panel are OPERABLE. In some cases, (continued) O ABWR TS .B 3.3-192 P&R 08/30/93
- I
, , ,- _ , ~ ,
1
)
Remote Shutdown Syst C B 3.3.6.2 I BASES LCO the required information or control capability is available ( Continued ) from several alternate sources. In these cases, the Remote Shutdown panel is OPERABLE as long as one of the alternate information or control sources for each Function is OPERABLE. The Remote Shutdown System instruments and control circuits covered by this LC0 do not need to be energized to be considered OPERABLE. This LC0 is intended to ensure that the instruments and control circuits will be OPERABLE if plant conditions require that the Remote Shutdown System be placed in operation.
- 1. Reactor Steam Dome Pressure.
Reactor stiam dome pressure is an indication of Reactor Coolant System (RCS) integrity and is a necessary parameter for achieving and maintaining the reactor in MODE 3. A reactor pressure indication is provided on both of the RSS panels. Both channels are required to be OPERABLE in order to achieve MODE 3 from either RSS panel. 'O 2. 3. and 4. HPCF B Flow / Controls /Discharae Pressure. The HPCf-jsy tem can be used to provide vessel inventory make up and decay eat removal while brin ing the plant to MODE
- 3. The h PCF a i l conjunction with ot r instruments and controls nt division 11 RSS pa e is i sufficient to achieve a intain MODE 3 from t psionIIpanel.The HPCF flow and pressure indications p de monitoring of HPCF operation. The controls provided are as given in reference 2. One channel of each function is required to be OPERABLE in order to achieve MODE 3 from either RSS panel.
l 5 throuah 11. RHR A. B Control & Indication. The RHR s stem can be used to provide vessel inventory make
- up and at removal l
- 3. The HR31n onjunctip'ghile bringing niitth other the plant instruments to MODE and l control on t e RSS panbls,3 1s lufficient to achieve and l maintain 3 from ei$her pa/el. The RHR flow indications l l provide monitoring of RRR opefation and the heat exchanger monitors provide indication of decay heat removal. The RHR (continued)
ABWR TS B 3.3-193 P&R 08/30/93 i
1 Remote Shutdown System l B 3.3.6.2 kN S .( l BASES f l LCO 5 throuah 11. RHR A. B Contro & Indication. (continued)' l ( Continued ) controls and monitors are adequ te to place it in the l shutd5wn 5 mode. The controls pro ~ded are as given in l reference 3. Two channels of each Function (RHR A on the I division I panel and RHR B on the division 11 panel) are t l coa required to be OPERABLE in order to achieve MODE 3 from either RSS panel.
- 12. and 13. RPV Wide Ranae/ Narrow Ranae Water Level.
Reactor vessel water level is provided to support monitoring
/ pumps, of andcore cooling,for ir needed to verify operation satisfactory of the control operator make up/make of up l pumps. The wide range water level channels cover the range ;
- from the near top of the fuel to near the top of the steam i separators. The narrow range provides indication from near >
the bottom of the separators to above the steam lines. RPV : i level is a necessary parameter for achieving and maintaining l the reactor in MODE 3. One channel of each range is provided on of the RSS panels. Both channels are required to be l_ s OPERABL in order to achieve MODE 3 from either RSS panel. Mc,h
~5 g Nb.hp
- 14. 15. and 16. ReactorfBuildino CooTina Water Flow / Controls & Reactor' Service Water Controls.
These parameters and controls are required to monitor and control the water supply for cooling the equipment needed to 4 achieve MODE 3 and to provide containment heat removal. The Reactor Building Cooling Water controls orovided are as -h'$nh . , given in reference 4 and the Reactor Service WRer' controls G I provided are as given in reference 5. One channel of each Function is provided on of the RSS panels. Both ) channels of each Function a required to be OPERABLE in order to achieve MODE 3 fro either RSS panel. CN)
- 17. Flammability Control System Control .
A control for the FCS B inlet valve is provided on the division 11 panel only. This control is needed in order for the operator to manage cooling eter flow. One channel is l required to be GPERABLE to assure that MODE 3 can be achieved from RSS panel.
%c gM .5 '. ong (continued) i ABWR TS B 3.3-194 P&R 08/30/93 1
Remote Shutdown System B 3.3.6.2 iSES 10 C Continued ) 18. Sucoression Pool level . Suppression pool water level provides information needed to assess the status of the RCPB and to assess the status of the water supply to the ECCS. The level indicators monitor the suppression pool level from the bottom of the ECCS suction lines to five feet above the normal suppression pool h level. One channel of this function is provided on-beM E the RSS panels. Both channels are required to be OPERABLE in order to achieve MODE 3 from either RSS panel.
- 19. Condensate Storace Pool level.
Condensate Storage Level provides information needed to assess the status of the water supply to the HPCF. The indication is needed in order to achieve and maintain MODE 3 when using HPCF. A channel of this Function is provided on the division 11 RSS panel. The channel is required to be OPERABLE in order to achieve MODE 3 from RSS panel, m y d t.'m 'd.
- 20. Suppression pool Temperature.
Suppression PoolSater Temperature allows the operator to detect trends in suppression pool water temperature in sufficient time to take action to prevent steam quenching vibrations in the suppression pool. Tnis function is required in order to maintain MODE 3. One channel of this function is provided on he RSS panels. Both channels are required to be OPER 'n order to maintain MODE 3 from either RSS panel. %g
- 21. Electric Power Distribution Controls.
These Functions are provided so the operator can select various AC power sources for the equipment needed to achieve and maintain MODE 3. The Electric Power Distribution Controls provided are as given in references 6 and 7. One channel of each Function is provided on % of the RSS panels. Both channels of each Function are r equired to be OPERABLE in order to achieve MODE 3 from eitler RSS panel. (-G-Oc>k (continued) $BWRTS B 3.3-195 P&R 08/30/93
Remote Shutdown System B 3.3.6.2 ( BASES LCO 22. Diesel Generator System Interlock and Monitors. ( Continued ) This Function is provided to per nitoring the status of the emergency DG. These monito . re ired to permit the operator to manage the electr c p dis ribution. The interlock disables DG start /s op the control room to assure that the event that ma
@@g will not disrupt DG operation 9 the channel corJirol of this room unavailable function is providht of the R.SS s. Both channels of the Function are required to be OPERABLE in order to achieve MODE 3 from either RSS panel.
1 i
- 23. SRV Controls, i This Function is provide to permit the operator to perform a controlled depressurization and to maintain reactor pressure :
within limits. Three channels are provided on the division I ; RSS panel and one channel is provided on the division II ; panel. These channels, in conjunction with other controls : and indications on the panels, are sufficient to achieve and maintain MODE 3 from either panel. O w - M x1 ;f thie g ,
"arfunction is provided wi buu of the R';'; pench. Three channels on the division I panel and one channel on the .
division 11 panel are required to be OPERABLE in order to achieve MODE 3 from either RSS panel. APPLICABILITY The Remote Shutdown System LCO is applicable in MODES I, and 2. This is required so that the plant can be placed and maintained in MODE 3 for an extended period of. time from a location other than the main control room. This LC0 is not applicable in MODES 3, 4, and 5. In these MODES, the plant is already subtritical and in a condition of reduced Reactor Coolant System energy. Under these conditions, considerable time is available to restore necessary instrument control Functions if main control room instruments or control becomes unavailable. Consequently, the TS ( not require OPERABILITY in MODES 3, 4, and 5.
& D A$
ACTIONS A Note is included that excludes the MODE change restriction J of LCO 3.0.4. This exception allows entry into an
- applicable MODE while relying on the ACTIONS even though the-ACTIONS may eventually require a plant shutdown. This (continued)
ABWR TS B 3.3-196 P&R 08/30/93
Remote Shutdown System i B 3.3.6.2 l r i BASES ACTIONS exception is acceptable due.to the low probability of an ] ( Continued ) event requiring this system. ! Note 2 has been provided to modify the ACTIONS related to 7 Remote Shutdown System Functions. Section 1.3, Completion Times, specifies that once a Condition has-been entered, subsequent trains, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or _not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies.that Required ' Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial i entry into the Condition. However, the Required Actions for inoperable Remote Shutdown System Functions provide appropriate compensatory measures for separate Functions. As ' such, a Note has been provided that allows separrte Condition entry for each inoperable Remote Shutdown System - , function. : A.1 gg i . Condition A addre ses the situation where one or more required Functions inoperable in one of the RSS divisions. This includes any Function listed in Table 3.3.6.2-1, as well as the control and transfer g! l switches. The Required Action is to restore the inoperable division of l the Function to OPERABLE status within [90] days. The-Completion Time is based on the high- reliability of the devices used to implement the Functions and the low I probability of an event that would require evacuation of the control roop c,gg 4oyg
- be- 0%st 9 66 Mvii*%
B.1 @Ahg Condition A addresses the situation where one or more required Functions are inoperable in both of the RSS divisions. This includes any function listed in Table 3.3.6.2-1, as well as the control and transfer switches. l The Required Action is to restore the Function (both i divisions, if applicable) to OPERABLE status within (continued) ABWR TS B 3.3-197 P&R 08/30/93
)
1 l Remote Shutdown System B 3.3.6.2 ; l BASES I ACTIONS IL1 (continued) f ( Continued ) M30 ays. The Completion Time is based on the low . probability of an event that would require evacuation of the control room. j C_d If the Required Action and associated. Completion Time of I Condition A or B are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within r M 12 Qours. The allowed Completion Time 'is reasonable, l basec on operating experience, to reach the~ required MODE from full power conditions in an orderly manner and without ; challenging plant systems. j 1 ; SURVEILLANCE SR 3.3.6.2.1 i
- REQUIREMENTS
Performance of the CHANNEL CHECK once every 31 days ensures . that a gross failure of instrumentation has not occurred. A ! l CHANNEL CHECK is a comparison of the parameter indicated on , l one channel to a similar parameter on other channels. It is + l based on the assumption that instruments monitoring the same ! I parameter should read approximately-the same value. ! l Significant deviations between the instruments could be an indication of excessive instrument drift in one of them divisions or something even more serious. A CHANNEL CHECK ) will detect gross channel or division failure; thus, it is < key to verifying the instrumentation continues to operate j l properly between each CHANNEL CAllBRATION. j Agreement criteria are determined by the plant staff based ! on a combination of the instrument uncertainties, including l indications. If a channel is outside the acceptance criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. q: :pe-4ri a <n tha ("rediance, a CnAiinb. CHECX is cr4 requh J fer +hnse channels thn+ 3re nernlly energu4
. Performance of a CHANNEL CHECK provides confidence that undetected outright channel failure is limited to 31 days.
The Frequency is based upon the high reliability of the devices used to implement the Functions. (continued) O f i ABWR TS B 3.3-198 P&R 08/30/93 I l l i
Remote Shutdown System l B 3.3.6.2 i BASES
\
)
SURVEILLANCE SR 3.3.6.2.2 REQUIREMENTS ( Continued ) SR 3.3.6.2.2 verifies each required Remote Shutdown System transfer switch and control circuit performs the intended i function. This verification is performed from the remote i shutdown panel and locally, as appropriate. This will ensure that if the control room becomes inaccessible, the plant can be placed and maintained in MODE 3 from the remote i shutdown panel and the local control stations. ii se,, tids h b ,,a L , qm ceJ iu 'b1Gie14reet'bnty-Wfimrh c V - pi:n r $ Operating experience demonstrates that Remote > Shutdown Syst m control divisions usually pass the Surveillanc when performed at every refueling Frequency.
, @ SR 3.3.6.2.3 A CHANNEL CALIBRATION is a complete check of the instrument i loop and the sensor. The test verifies the channel responds to measured parameter wit _h,_the h necessary range and accuracy. ,
N-Tha [181 month frequency is based on the ABWR expected l \ o 41 % l and the need to perform this Surveillan l; gc EFUELING INTERV un er Uic wo n i inns that apply during a plant outag . he l i Frequency is adequate based on tne innereni. ivw drift of the devices used to implement the functions covered by this LCO. : Note that calibration of these channels overlaps or is encompassed by calibrations required by other LCOs that address some of the same components required by the RSS ; indications. i REFERENCES 1. 10 CFR 50, Appendix A, GDC 19. ! l l 2. ABWR SSAR Section 7.4.1.4.4(2)(a)
- 3. ABWR SSAR Section 7.4.1.4.4(3)(a)
- 4. ABWR SSAR Section 7.4.1.4.4(5)(a)
- 5. ABWR SSAR Section 7.4.1.4.4(6)(a)
- 6. ABWR SSAR Section 7.4.1.4.4(7)(a)
- 7. ABWR SSAR Section 7.4.1.4.4(7)(b)
O ABWR TS B 3.3-199 P&R 08/30/93 i 7
)
CRHA EF In,trumentation l B 3.3.7.1 J BASES .l
; vision BACKGROUND Each Emergency Filtration yb)has tv o flow switches, one-l
( Continued ) in each discharge duct- of the recirculation supply fan. A ! two-out-of-two logic low flow indication will initiate the automatic switchover to the other se clivision i The main control area envelope Ventilation Radiation Monitors are arranged in a two-out-of-four logic. The
- channels include electronic equipment- that. compares measured ;
input sigt.als with pre-established setpoints. When the : i setpoint is exceeded, the division output logic actuates, which then outputs a CRHA initiation signal. Each division - receives an output initiation signal to initiate only the :
.sy %em on standby.
L g;,;scon ,,, - g w v 5 c a n F i tA r A+i o^ l APPLICABLE The ability of the CRHA' System to maintain the habitability ! SAFETY ANALYSIS, of the MCAE is explicitly assumed for certain accidents as l LCO, and discussed in the ABWR SSAR safety analyses (Refs. 2 and 3). ; APPLICABILITY CRHA - System operation ensures that the radiation , exposure of control room personnel, through the duration of ; GF any one of the postulated accidents, does not. exceed the limits set by GDC 19 of 10 CFR 50, Appendix'A. CRHA Q EF instrumentation satisfies Criterion 3 of the NRC Policy i C Statement. The OPERABILITY of the CRHA $MC Emergency. Filtration system instrumentation is dependent upon the OPERABILITY of the 1 l individual instrumentation Functions specified in l l Table 3.3.7.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual setpoint is not'within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Allowable Values are specified for each.CRHA HVAC and Emergency Filtration Function specified in the Table. l Nominal trip setpoints are specified in the setpoint calculations. These nominal setpoints are selected to
- ensure that the setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setpoint that is less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable.
(continued) (O ABWR TS B 3.3-201 P&R 08/30/93~ l l -- - - -. .
,1
CRHA M EF Instrumentation B 3.3.7.1 B 3.3 INSTRUMENTATION B 3.3.7.1 Control Room Habitability Area (CRHA) mergency Filtration (EF) System Instrumentation BASES / }lyisioA s l, BACKGROUND The CRHA Emergency Filtration system is desig d to provide ! a radiologically controlled environment to en ure the l habitability of the main control area envelop e.for the safety of control room operators under all pl ant conditions. Two independent CRHA Emergency Filtration deems.are each capable of fulfilling the intended safety function. .The instrumentation and controls for the CRHA Emergency Filtration System automatically initiate-action to isolate or pressurize the main control area envelope (MCAE) to minimize the consequences of radioactive material in the main control area gvelope environment. divi.s tos . n divisio M Each'sys4am consists of an ectric heater, prefilter, a high efficiency particula air (HEPA) filter, an activated charcoal adsorber section a second HEPA. filter and two fans. Two redundant i., w s of the CRHA system are required to ensure at least one is available assuming a single d it/ISI'( ~ tailure disables the other W m. Should any component in
') ( une W fail, filtration can be performed by the other w tcc. The OPERABILITY of each independent is based on having adequate system flow and OPERABLE HEP filters, charcoal .adsorbers and heaters. );pgsto3 l g mc /S C ^ TheM CRHA q system instrumentation has eight radiation l
p r.gH o^ monitoring sensors; four sensors monitoring each of two air intake ducts. The output logic is a two-out-of-four' logic which produces two trip systems: one trip system initiates d iv iSi'^ ~ one , while the second trip system initiates the other , syMem. Upon receipt of an actuation signal the CRHA , system automatically switches to the emergency mode of ,
& mecSe^M operation to prevent infiltration of radioactive Fi L+cA contaminated air into the main control area envelope. A system of dampers isolates the normal air intake and minimum outdoor air is mixed with recirculated air. The Emergency l
i Filtration system is an automatic or manual operation. The ; operator can olace either of the two in standby mode. t j;g; p f yThe selected as the IfstandbyMt will initiate when the operatio al sy;t- detects a the emergency occurs. low flow condition possibly due to a ugged fil er element, an automatic switchover to the other 11 ccur. l GEVi% l );,;p w l (continued) ABWR TS B 3.3-200 P&R 08/30/93 l t
CRHA TNAt EF Instrumentation g 3 3 3.7.1 L 1 BASES. , i APPLICABLE Trip setpoints are those predetermined values of output at SAFETY ANALYSIS, whicn an action should take place. The setpoints are LCO, and compared to the actual process parameter and, when the l APPLICABILITY measured output value of the process parameter exceeds the ! ( Continued ) setpoint, the associated device changes state. .The analytic limits are derived from the limiting values of the process ! i parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined, accounting for the ; remaining instrument errors (e.g.,. drift). The trip setpoints derived in this manner provide adequate-protection , because instrumentation and parameter indication uncertainties, process effects,. calibration tolerances, instrument drift, and severe environment errors (for i channels that must function in harsh environments as defined i by 10 CFR 50.49) are accounted for. The CRHA p K EF System is required to be OPERABLE in MODES 1, 2, and 3 and in MODES 4 and 5 during CORE ! ALTERATIONS, OPDRVs, and movement of irradiated fuel in the secondary containment to ensure that main control area i envelope personnel are protected during a LOCA, fuel-
) handling event, or a vessel draindown event. ,
- 1. Main Control Area Enveloce ventilation Radiation Monitors e
The main control area envelope Ventilation Radiation Monitors measure radiation levels exterior to the inlet ; ducting of the MCAE. A high radiation level may pose a ' threat to MCAE personnel; thus, a detector indicating this l ' l condition automatically signals initiation of the Emergency
- Filtration on standby.
Jivision N Wo ^ l The Main Control Area Envelope Ventilation Rad ation Monitors Function consists of eight independert monitors; l four monitors on the outdoor intake to each tp44. Four l' channels of Main Control Area. Envelope Ventilation Radiation Monitors on each duct are available and are required to be ! l OPERABLE to ensure that no single' instrument failure can ' initiation. The Allowable preclude Emergency Filter Value was selected to ensure rotection of the control room , personnel. 4 g.p g 1 (continued) J l ABWR TS B 3.3.202 P&R 08/30/93 ! t t
.. .-,- . ~ . .
CRHA SM[ EF f nstrumentation B 3.3.7.1 l
- BASES l APPLICABLE 2. Emeroency Filtration System low Flow Switches ,
i SAFETY ANALYSIS, J iv aios LCO, and The Emergency Filtration Od flow switch measures the APPLICABILITY recirculation fan air discharge flow in the duct. Low flow _ ( Continued ) measurement is indicative of the recirculation fan inoperable. Each of the recirculation supply fan flow rate is monitored. Each supply fan is capable of delivery of 100% flow. Low flow in both supply fan5 (i.e., two-out-of- , two logic) in one nbW tw will initiate an automatic ; j switchover to the other emergency filtration op[tt. j iq t s is ^ divisic^ , ! 3. Emeraency Filtration System Manual Switch
);g iSio ^
The Emergency Filtration system has standb system selection capability and can be manually selected. ihere are two manual selection switches; one for each . One of the l j g 3cp.s -- iwu uw Ks must be selected prier to th M DMA syst 3 ia 5+a g i 9itiatirn fe- the E=arpary Wrat# - '"' % te 4c6 automaticeMy initiat[ Otherwise, the Emergency Filtration g3;r __ ptt can lowbe flowinitiated conditionmanually as described by the operator. above, However, a an automatic ; switchover standby mode.will occur without the mp(_t, selection in the
}
l
); gig;o3 ACTIONS A Note has been provided to modify the ACTIONS related to ,
CRHA instrumentation channels. Section 1.3, Completion i Times, specifies that once a Condition has been entered, subsequent trains, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions ; of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable CRHA HVAC instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable CRHA HVAC , instrumentation channel. l i (continued) i
]
ABWR TS B 3.3-203 P&R 08/30/93 l
_ .. - . .~~ ' ~ 7.EnA HGt- T1rist'rumentdion ^ B 3.3.7.1-BASES ACTIONS A.l. A.2.1 A.2.2.1, and A.2.2.2 ( Continued ) . A instrumentation channel is considered to be OPERABLE when all associated instruments and devices are OPERABLE. If any LOGIC CHANNEL that uses the trip data from a instrumentation channel does not receive valid data then the channel is considered to be inoperable. A failure in one ventilation radiation monitor instrumentation channel will cause the ; trip logic to become 1/3 or 2/3_ depending on the nature of l the failure ( i.e failure which causes a, channel trip vs. a l failure which does not cause a ch&nnel trip). Therefore, an additional single failure will not result in loss of- . protection but could cause a spurious initiation of a' 3 ' protective action for additional failures _ that result in a tripped condition. Action A.1 forces a trip condition on the inoperable
- instrumentation channel which causes' the initiation logic to-become 1/3. In this condition _ a single failure will not . i result in loss of protection. Action A.2 bypasses the l
inoperable instrumentation channel. This causes the logic , for the function to become 2/3 so a single failure will not i result in loss of protection or cause a spurious initiation.
~) Since plant protection capability is maintained no further 4 action is required when the inoperable instrumentation channel is placed in trip. j The Completion Time of six hours for implementing Actions j A.1 and A.2 is based on providing _ sufficient time for the 1
operator to determine which of the. actions is appropriate. l The Completion Time is acceptable because the probability of ; an event requiring the Function-coupled with.a failure in : two other instrumentation channels associated with the ' Function occurring within that time period is quite low. , l ! I B.1 and B.2 i l Condition B occurs when two instrumentation' channels for the j MCAE ventilation radiation monitors become inoperable. For these conditions it_is appropriate to place one channel'in ' l trip and the other in bypass. The trip-logic then becomes l 1/2 so a single failure in the remaining operable channels i would not cause loss of protection. However, a single failure could result in a spurious _ trip. (continued) ABWR TS B 3.3-204 .P&R 08/30/93 ) l
+
\
I CRHA EF Instrumentation B 3.3.7.1 l l l BASES l ACTIONS B.1 and B.2 (continued) ( Continued ) Since plant protection is maintained and the potential for a spurious trip is low because of the high reliability of the trip logic, operat' , in this condition for several days is acceptable. A maxi completion time corresponding to the next channel functi. l test is acceptable since the channel functional test interval criteria is a suitable criteria for operation in this condition. l l Since there is multiple entry in this LCO, restoration of one channel to OPERABLE status will cause Condition A to be invoked an appropriate compensatory measures taken. C.1 This Condition represents a case where an automatic or manual Function is 1/1 or completely unavailable. In this condition the single failure criteria for automatic action J;g3 o is not met. For this condition it is appropriate to declare , the w inoperable. This Condition also occurs if the Required Action and associated Completion Times for
) Condition A or B are not met.
The Completion Time provides a reasonable amount of time to perform the required actions. The Completion Time is acceptable because the probability of an event requiring the Function within that time period is quite low. SURVEILLANCE As noted at the beginning of the SRs, the SRs for each CRHA REQUIREMENTS and Emergency Filtration Instrumentation Function are located in the SRs column of Table 3.3.7.1-1. SR 3.3.7.1.1 Performance of the SENSOR CHANNEL CHECK once every [24] hours ensures that a gross failure of instrumentation has not occurred. A SENSOR CHANNEL CHECK is a comparison of the indicated parameter for one instrument channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could (continued)
} !
ABWR TS B 3.3-205 P&R 08/30/93 i
l CRHA EF Instrumentation , B 3.3.7.1
) ) BASES ,
SURVEILLANCE SR 3.3.7.1 1 (continued) REQUIREMENTS be an indication of excessive instrument drift in one of the ' ( Continued ) channels or other channel faults. A SENSOR CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly , between each CHANNEL FUNCTIONAL TEST. I Agreement criteria are determined by the plant staff based : on a combination of the channel instrument and parameter indication uncertainties. The Frequency is based upon operating experience that demonstrates channel failure is rare. Thus, performance of ; the SENSOR CHANNEL CHECK ensures that undetected outright 1 channel failure is limited to [24] hours. The SENSOR CHANNEL CHECK supplements less formal, but more frequent, ; checks of channel status during normal operational use of the displays associated with channels required by the LCO. SR 3.3.7.1.2
) A CHANNEL FUNCTIONAL TEST is performed on each. required channel to ensure that the entire channel will perform the intended function and that the programmed setpoints in the initiation logic devices (micro-processor based) are correct.
The Frequency of 92. days is. based on requiring the Emergency Filtration train to operate for a specified duration every : 92 days. SR 3.3.7.1.3 A SENSOR CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the i I channel responds to the measured parameter within the i necessary range and accuracy. SENSOR CHANNEL CALIBRATION l leaves the channel adjusted to account for instrument drifts between successive calibrations. Measurement and setpoint error historical determinations must be performed consistent with the plant specific setpoint methodology. The channel shall be left calibrated consistent with the assumptions of the setpoint methodology. (continued) l ABWR TS B 3.3-206 P&P.08/30/93 l r I
CRHA EF Instrumentation B 3.3.7.1 l BASES SURVEILLANCE SR 3.3.7.1.3 (continued) I REQUIREMENTS If the as found trip points (fixed or variable) is not ( Continued ) within its Allowable Value, the plant specific setpoint ' methodology may be revised, as appropriate, if the history and all other pertinent information indicate a need for the ! revision. The setpoint shall be left set consistent with the assumptions of the current plant specific setpoint methodology The [18] month frequency is based on the ABWR expected refueling interval and the need to perform this Surveillance under the conditions that apply during a plant outage. The [18] month frequency must be supported with a setpoint analysis that includes a drift allowance commensurate with this frequency. t ytest R con th W
- k b;t.N 4 Ar* A CC d dd)
SR 3.3.7.1.4 Y p( e ,eg ge) Sy rgi.rt.t*t-ra+
- 2 0^
The LOGIC SY M FUNCTIONA TEST demonstrates the OPERABILIT of the initia ion logic for a specific division. The system fu ctional testing performed in
) LCO 3.7. , ""eir. C .tr:1 are: E=velepe 4: bit:tilitj Area (CllA' ""'C Spam," overlaps this Surveillance to provide complete testing of the assumed safety function. .
The [18] month frequency is based on the ABWR expected ! refueling interval and the need to perform this Surveillance under the conditions that apply during a plant outage. The high reliability of the devices used .in the signal processing coupled with the CHANNEL FUNCTIONAL TEST provides confidence that the specified frequency is adequate. REFERENCES 1. ABWR SSAR, Figure [ ].
- 2. ABWR SSAR, Section [6.4].
l 3. ABWR SSAR, Chapter [151 t l l
)
ABWR TS B 3.3-207 P&R 08/30/93
f l erd ric Power Monitoring a B 3.3.8.1 l
)
8 3.3 INSTRUMENTATION B 3.3.8.1 Power Monitoring i {< < hic ; BASES BACKGROUND The Power Monitor is provided to isolate the Vital AC bus from the constant frequency constant voltage (CVCF) power supply in the event of overvoltage, undervoltage,fo M 0 g[g,,nf underfrequency. This system protects the loads connected to the Vital AC bus against unacceptable voltage and frequency conditions (Ref. 1) and forms an important part of the primary success path for the essential safety circuits. Some of the essential equipment powered from the Vital AC buses includes the RPS logic, scram solenoids, MSIV solenoids, and various valve isolation logic. heglo er The Powerhonitor will detect any abnormal high or low voltage orflow frequency condition in the outputs of the CVCF power supply within the division and will de-energize its respective Vital AC bus, thereby causing all safety this bus to de-energize. functionsnormallypoweredoy/or a nJ c un dery eepe-cy In the event of a low voltage condition for an extended period of time, the scram solenoids can chatter and potentially lose their pneumatic control capability, resulting in a loss of primary scram action.
-) and/or ho'yh fregue~cy Intheeventofanovervoltage[conditionforanextended period of time, the RPS logic relays and scram solenoids, as well as the main steam isolation valve solenoids, may-experience a voltage higher than their design volt:gtC If the-overvelt y cond tion persists for an extended time % e-period, it may cause quipment degradation and the loss of plant safety function, g Two redundant Class IE circuit breakers are connected in parallel between each Vital AC bus and its CVCF power supply. Each of these circuit breakers has an associated set of Class 1E overvoltage, undervoltage,Ves/erfreg"'"7 underfrequency sensing logic. Together, a circuit breaker and its sensing logic constitute an electric power monitoring assembly. If the output of the CVCF power supply exceeds the predetermined limits of overvoltage,
( undervoltage }, or underfrequency, a trip coil driven by this
/ logic circuitry opens each of the two circuit breakers, which removes the associated CVCF power supply from service.
gr re d (continued) , ) ABWR TS B 3.3-208 P&R 08/30/93 1
ASES (cod. ) Power Monitor B 3.3.8.1 LICABLE ETY ANALYSESPower monitoring is neces assumptions of the safety analsary to meet the - equipment intended function. powered from ysesthe a Vit l by ensuring that the the RPS AC buses AC buses,and other Power monitoring providescan perform its the power systems that receive power froprotection to by disconnecting the RPS a d damagesupply under the Vital AC bus pon other specified conditio m the Vital systems from Statement. Power monitoring satisfie wered equipment.ns that could s Criterion 3 of they NRC Polic The OPERABILITY of each po OPERABILITY of the overvoltwer monitor is dependent u underfrequency logic, age as well , undervoltage Wpon the associated circuit two electric power monitori .breaker , o& OPERABLE for One power monitor with onas the OPERA The OPERABLE power ng assemblies monitor are requirede of t / redundant each protectioninservice against and power OPERABLE o be supply. CVCF frequency conditions and to enCVCF power supply provides failure ortno single CVCF any abnormal voltage or the function inservice setpoi of Vital electric power power AC mobsupply it failure or can pre lsure that n us n powered components. c ude Value.nts are required to be within Each the sp applicable setpointrated methodologThe coecific Allowable actual setpoint Allowable Values are specifiedy assumptions.nsistent with monitoring Nominal trip assembly fo trip logic ( r calculations. setpoints refer toare SR 3 specified in the se.3.8.I.2).each The nominal setpoints are sel that the setpoints do not e tpoint CHANNEL conservative tha CALIBRATIONS. Allowable Value, nOperation the nominal with trip a trip setpoixceed setpoint een the Allowable V its actual trip is acceptable. nt less
, but within its A channel is inoperable if Allowable values setp of outputValue.setpoint at which an a equiredis not within its rTrip setpoi e etermin (e.g.oints are compared the pr,oceovervoltage), ands parameter to the actual when the proces The meaction should take plac device g., (e.ss parameter exceeds the setpointsured output value of are derivedtripfrom unit)the changes limiting state
. v l, the associated a ues of the processThe analytic limits (continued)
B 3.3-209 P&R 08/30/93 X - - - ~
Power Monitor B 3.3.8.1 (co.A )
?
CABLE Power monitoring is necessary to meet the Y ANALYSES assumptions of the safety analyses by ensuring that the equipment powered from the Vital AC buses can perform its intended function. Power monitoring provides protection to the RPS and other systems that receive power from the Vital AC buses, by disconnecting the RPS and other systems from the power supply under specified conditions that could damage the Vital AC bus powered equipment. Power monitoring satisfies Criterion 3 of the NRC Policy Statement. The OPERABILITY of each power monitor is dependent upon the OPERABILITY of the overvoltage, undervoltage,{We#rfrgueq underfrequency logic, as well as the OPERABILITY of the / associated circuit breaker. One power monitor with one of two electric power monitoring assemblies are required to be OPERABLE for each inservice and OPERABLE CVCF power supply. The OPERABLE power monitor and CVCF power supply provides redundant protection against any abnormal voltage or frequency conditions to ensure that no single power monitor failure or no single CVCF power supply failure can preclude the function of Vital AC bus powered components. Each inservice electric power monitoring assembly's trip logic setpoints are required to be within the specific Allowable Value. The actual setpoint is caliorated consistent with applicable setpoint methodology assumptions. Allowable Values are specified for each RPS electric power monitoring assembly trip logic (refer to SR 3.3.8.I.2). Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter
~
(e.g., overvoltage), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process (continued) TS B 3.3-209 P&R 08/30/93
Power Monitor B 3.3.8.1 BASES parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined, accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) arecounted ac & for. aglh; t e h' e $ 5 % The Allowable Values for the[ instrument settings are based da/t YI on the power upplyprovidingEW-Hf7120Vi to al equipment), and 115 V 210 V (to scram and M V soleno ds). Ng/ he most 1 miting voltage requirement determines the-i f.3,f.d. J settings of the electric power monitoring instrument channels. The settings are calculated based on the loads on the buses and CVCF power supply being 120 VAC and 60 Hz.
~
y - G sic. APPLICABILITY The operation of the power monitor is essential to , disconnect the Vital AC bus powered components from the CVCF O " power supply during abnormal voltage or frequency conditions. Since the degradation of a Class IE -cr r,cr.
- power to the Vital bus can
/- Ch::occur 1E source suppl as a result o random single fail et he ERABILITY o power monitor is require en the Vital AC bus powered components are required to be OPERABLE. This results in the Power Monitor OPERABILITY being required in MODES 1, 2, and 3, and MODES 4 and 5 with any control rod
/* withdrawn from a core cell containing one or more fuel assemblies or with both residual heat removal (RHR) shutdown g e v h,Mglde4 cooling isolation valves open.
l 1
\ (continued)
ABWR TS B 3.3-210 P&R 08/30/93
Power Monitoring B 3.3.8.1 BASES (continued) P ACTIONS A.d If one electric power monitoring assembly for an inservice power supply (CVCF) is inoperable, or one electric power monitoring assembly on each inservice power supply is inoperable, the OPERABLE assembly will still provide protection to the Vital AC bus powered components under degraded voltage or frequency conditions provided the circuit breaker associate with the inoperable assembly is placed in the tripped (open) position. In this condition, I hour is allowed to place the associated circuit breaker in the tripped position. The I hour Completion Time is sufficient for the plant operations personnel to take corrective actions. If the associated circuit breaker can b not be placed in the tripped position, the power monitor is incperable and the required action of condition B shall be followed. B.:.1 If both electric power monitoring assemblies (the power monitor) for an inservice power supply (CVCF) are _ in_o3erable,for both electric power monitoring assemblies inn Ceac1 insoFvice power supply are inoperable,f the OPERABLE IVCF power supply will still provide voltage and frequency to the Vital AC bus powered components within allowable limits. However, the reliability and redundancy of the protection provided Vital AC bus power components is reduced and only a limited time (72 hours) is allowed to restore one of two inoperable assembly (s) to OPERABLE status. If one of the two inoperable assembly (s) cannot be restored to OPERABLE status, the associated power supply must be removed from service (Required Action B.1). This places the Vital AC bus in a safe condition. The 72 hour Completion Time takes into account the remaining OPERABLE CVCF power supply and the low probability of an event (requiring Power Monitor protection) occurring during this period. It allows time for plant operations personnel to take corrective actions or to place the plant in the required condition in an orderly manner and without challenging plant systems. (continued) ABWR TS B 3.3-211 P&R 08/30/93 g . . . . _..
i ! Power Monitoring l B 3.3.8.1 l BASES (continued) Alternatively, if it is not desired to remove the power supply (s) from service (e.g., as in the case where removing the power supply (s) from service would result in a scram or i isolation), Condition C or D, as applicable, must be entered ; and its Required Actions taken. i yeped iternately, if itT not desired to remove the power
' 4, ff 8
supply (s) from service (e.g., as in the case where removing
/ the power supply (s) from service would result in a scram or
' isolation), Condition C or D, as applicable, must be entered (anditsRequiredActionstaken.
C.1 and C.2 If any Required Action and associated Completion Time of , Condition B is not met in MODE 1, 2, or 3, a plant. shutdown ' must be performed. This places the plant in a condition where minimal equipment, powered through the inoperable electric power monitoring assembly (s) (power monitor), is l required and ensures that the safety function of the RPS l (e.g., scram of control rods) is not required. The plant ' shutdown is accomplished by placing the plant in MODE 3 l within 12 hours and in MODE 4 within 36 hours. The allowed i (m') Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. D.1. D.2.1, and 0.2.2 If any Required Action and associated Completion Time of Condition B are not met in MODE 4 or 5, with any control rod withdrawn from a core cell containing one or more fuel 1 assemblies or with both isolation valves of a RHR shutdown l cooling subsystem open, the operator must immediately I initiate action to fully insert all insertable control _ rods in core cells containing one or more fuel assemblies (Required Action D.1). This Required Action results in the ! least reactive condition for the reactor core and ensures I that the safety function of the RPS (e.g., scram of control rods) is not required. l In addition, action must be immediately initiated to either restore one of two electric power monitoring assembly to 1 , g (continued) ; O ABWR TS B 3.3-212 P&R 08/30/93 1
Power Monitoring B 3.3.8.1 BASES (continued) 1 l OPERABLE status for the inservice power source supplying the l required instrumentation powered from the Vital AC bus ; (Required Action D.2.1) or to isolate the RHR Shutdown-Cooling System (Required Action 0.2.2). Required- j Action 0.2.1 is provided because the RHk Shutdown Cooling ' System (s) may be needed to provide core cooling. All actions must continue until the applicable Required Actions , k are completed. V .
/ \;+ l SURVEILLANCE SR 3.3.8.1.1 ;
REQUIREMENTS : A CHANNEL FUNCTIONAL TEST is performed on each overvoltage, -i undervoltage j, and underfrequency channel to ensure that the l entire chantiel will perform the intended function. ! As noted in the Surveillance, the CHANNEL FUNCTIONAL TEST is o #r[re *g only required to be performed while the plant is in a J condition in which the loss of the Vital AC bus will not , jeopardize steady state power operation (the design of the l system is such that the power source must be removed from j service to conduct the Surveillance). The 24 hours is i intended to indicate an outage of sufficient duration to
^
O allow for scheduling and proper performance of the Surveillance. The 184 day Frequency and the Note in the i Surveillance are based on guidance provided in Generic ! Letter 91-09 (Ref. 2). l SR 3.3.8.1.2 ; CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The Frequency is based upon the assumption of an 18 month calibration interval in the determination.of the magnitude j of equipment drift in the setpoint analysis. i SURVEILLANCE SR 3.3.8.1.3 : l REQUIREMENTS Performance of a system functional test demonstrates a i required system actuation (simulated or actual)' signal. The logic of the system will automatically trip open the associated power monitoring assembly circuit breaker. Only one signal per power monitoring assembly is required to~ be (continued)- ABWR TS B 3.3-213 P&R 08/30/93
Power Monitoring B 3.3.8.1 BASES (continued) tested. This Surveillance overlaps with the CHANNEL CALIBRATION to provide complete testing of the safety function. The system functional test of the Class lE circuit breakers is included as part of this test to provide complete testing of the safety function. If the breakers are incapable of operating, the associated electric power monitoring assembly would be inoperable. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has.shown that these components usually pass the Surveillance when performed at the 18 month REFERENCES Frequency.
- 1. ABWR SSAR, Section 8.3.1.1.4.2.2.
/gg{ g
- 2. NRC Generic Letter 91-09, " Modification of Surveillance Interval for the Electric Protective Assemblies in Power Supplies for the Reactor Protection System."
h ABWR TS B 3.3-214 P&R 08/30/93
l Reactor Coolant Temperature Monitoring ; B 3.3.8.2 O 8 3.3 instaustatatiou ; B 3.3.8.2 Reactor Coolant Temperature Monitoring j BASES BACKGROUND Reactor coolant temperature monitoring is provided to : monitor the progress and the effectiveness of residual decay l i heat removal operations. The RHR System consist of three subsystems each of which can be operated in the Shutdown l Cooling Mode for decay heat removal. RHR shutdown cooling l operation can be initiated during a reactor shutdown when ' ; reactor pressure decreases to the shutdown cooling interlock l pressure (approximately 135 psig). RHR shutdown cooling ! operation is normally required to maintain the reactor in j cold shutdown conditions .(MODE 4) and to maintain the reactor coolant temperature as low as.possible for refueling operations in MODE 5. The temperature monitoring instrumentation.will provide temperatureindicaj main c.ontrol roomM; ion uringand RHRtrends to the decay heat operator in the removal ! operation. One temperature monitoring _ channel is available to monitor reactor coolant temperature at the inlet to the , RHR heat exchanger. This monitoring channel will also detect - the loss of decay heat removai caPabiiity durias iow Power O operation and shutdown. conditions. Sufficient time is-available to the operator to take corrective actions when l required to minimize the potential for a complete loss of decay heat removal capability I [V.\i# APPLICABLE No specific safety analyses were performed for loss of decay : SAFETY ANALYSIS heat removal capability. Chapter 19 of the SSAR, Probability Risk Assessment (PRA), evaluates the consequences of shutdown risk due to loss of decay heat removal. The reactor coolant tempeature monitoring instrumentation provides the necessary information and i trending information for monitoring the effectiveness of shutdown cooling operation and for detecting loss of decay ' heat removal capability to allow the operator to take necessary corrective actions. j LCO AND The OPERABILITY of the reactor coolant temperature . I APPLICABILITY monitoring ~ channel is specified only for RHR subsystems that are operating in the shutdown cooling' mode. RHR is normally in operation in MODE 3 with reactor. pressure below the- l ' (continued). O B 3.3-215 P&R 08/30/93 ABWR TS l
O BASES Reactor Coolant Temp erature Monitoring LCO AND B 3.3.8.2 APPLICABILITY shutdown shutdown. 200 F, it is When cooling interlock pressure d cons 44the reactor MODE 5, reactor coolant uring a possible for reactor coolantarad -to-Wintemperature MODE 4 For is m. temperature The reactor refueling operations an is . aintained as lowoperation in coolant temperature as m o t>E not required to be OPERABL system is q 3shutdown abovecthe shutdownnot E when operating wn itsmonitoring in shutdo on instrumentati ascension, ooling mode cooling is isolatedcooling In MODE interlock reactor todecay heatupheat and removal is . sure, RHR )r I and ACTIONS pressurize. secured toIn MODE r 2 during p A.1, A.2 allow the If one or (r p instrument capability assure of the channel imore reactor s inoperablecoolant temperature continuous monitoring shutdownaffected the RHR decay su,bsystem heat remov l other parametersverificationmust s nvolvescooling typically a i operation. be verified to checking v This temperatures in the 41 outlet temperature,uch
< [ f/ '
shutdown removal capability tempera and heat exchangerand pressure,alve exicooling cooling can s be alignments waterheat verifiedosed exchanger, n Cooling W However,ture sts m. e[o is prudentwith to themonitoring reactor instrumentatialthoug,h reactor ,#[/ thecontin temperature on is inoperablecoolant by monitoring establish monitoring coolant r alternate of thecapability temperaturefinope os meth d . / if the Reactoreactor Waterbottom Cl One alternateof reactor coolantrable, it The change drain lin eanup system is in e tempemethod is one hour Completion Time operation. of reactor i rature s reasonable heat removal coolant y. capabilitsmall temperature over sincechange the rate this iof time int onbethe not in consideration operation erval the that forof the even decay lossThe Comp this system into indication. o per adequate time isReactor Cleanup Systemals and ation for a may reliable temperaturerequired to place ?WR TS B 3.3-216 (continued) P&R 08/30/93
-- - - p
l l Reactor Coolant Temperature Monitoring B 3.3.8.2 O 8^sts 1 l LC0 AND shutdown cooling interlock pressure during a reactor i l APPLICABILITY shutdown. When the reactor coolant temperature is less than j 200 *F, it is considered te he Tn MODE 4. For operation in 3 l ! MODE 5, reactor coolant temperature is maintained as low as i possible for refueling operations. i The reactor coolant temperature monitoring instrumentation isnotrequiredtobeOPERABLEwhenitsassociatedRHRf j system is not operating in shutdown cooling. In MODEy 1 and moDEq 3 above the shutdown cooling interlock pressure, RHR ' shutdown cooling mode is isolated. In MODE 2 during power LP ascension, decay heat removal is secured to allow the reactor to heatup and pressurize.
%p ACTIONS A.1. A.2 If one or more reactor coolant temperature monitoring instrument channel is inoperable, the decay heat removal :
capability of the affected RHR subsystem must be verified to assure continuous shutdown cooling operation. This verification typically involves checking valve alignments, f other parameters such as flow and pressure, heat exchanger outlet temperature, and heat exchanger cooling water hj temperatures in thejClosed Cooling Water system. If RHR /e
,# h r shutdown cooling can be verified, continued decay heat removal capability exists although the reactor coolant ',
t f)[f[' F temperature monitoring instrumentation is inoperable. However, with the reactor coolant temperature inoperable, it is prudent to establish alternate methods of reactor coolant temperature monitoring capability. One alternate method is by monitoring of the reactor bottom drain line temperature if the Reactor Water Cleanup system is in operation. l The one hour Completion Time is reasonable since the rate of i l change of reactor coolant temperature change is typically small over this time interval even for the loss of decay heat removal capability. The Completion Time is also based i on the consideration that the Reactor Cleanup System may ' not be in operation and adequate time is required to place this system into operation for a reliable temperature j indication. . s (continued) O ABWR TS B 3.3-216 P&R 08/30/93 l
.-. , . . . . . -l
Reactor Coolant Temperature Monitoring B 3.3.1.2 Q BASES ACTIONS ]L1 ( Continued ) If it can not be verified that at least one RHR is operating in the shutdow cooling mode, and alternate reactor coolant temperature monitoring capability can not be established, it is necessary to take actions to restore the capability immediately. Local indication of reactor coolant temperature is an acceptable alternate when control room indications can not be established. [ S',U SURVEILLANCE SR 3.3.8.2.1 REQUIREMENTS , Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred between Channel Functional Tests. A CHANNEL CHECK is a comparison of the parameter indicated on one channel to the same parameter indicated on other similar channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. j Significant deviations between the instrument channels could ~ be an indication of excessive instrument drift or other channel faults in one of the channels. O Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the match criteria,-it may be an indication that the instrument has drifted outside itsfem limit erajswd mom 4Y . The high reliability of each hanne provides confidence that a channel fai re will be rare..However, a surveillance interval ofr{24fhours is used to provide confidence that gross failures that do not activate an annunciator or alarm will be detected withinp[24Phours. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO. SR 3.3.8.2.2 A CHANNEL FUNCTIONAL TEST is performed on each reactor coolant temperature monitoring channel to ensure that the entire channel will perform the intended function. As noted in the Surveillance, the CHANNEL FUNCTIONAL TEST is only (continued) ABWR TS B 3.3-217 P&R 08/30/93
+ e
. Reactor Coolant Temperature Monitoring f B 3.3.1.2 ,
O Basts ACTIONS SR 3.3.8.2.2 (continued) i i ( Continued ) ' required to be performed prior to RHR shutdown operation. The 92 day frequency is based on the simple design and i reliability of the temperature monitoring instrumentation. , SR3.3.8.2.3 l CHANNEL CALIBRATION is a complete check of the instrument l L loop and sensor. t The frequency is based upon the assumption of an 18 month . lu 1 l calibration interval in the determination of the magnitude F'" ' of equipment drift in the setpoint analysis. };p-e i REFERENCES 1. ABWR SSAR, Section 19. [hter] 19 L , l l
~
l d e i O ! ABWR TS B 3.3-218 P&R 08/30/93 t}}