Text

Proposed Tech Specs Revising Applicability & SR for Irm,Aprm High Flux (15% Scram) & APRM Inoperative Trip Functions
	ML20077K246
Person / Time
Site:	Browns Ferry
Issue date:	01/04/1995
From:	; TENNESSEE VALLEY AUTHORITY
To:	;
Shared Package
ML20077K220	List: ML20077K217; ML20077K246;
References
	NUDOCS 9501100253
	Download: ML20077K246 (48)
	v • d • e

x.,

"U1g O

M DO 00 8t!

gu TABLE 3.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION REQUIREMEN15 O4 c en gD y Min. No. oF Operable n

or "U O O Instr.

Modes in which Function gNA Channels Must Be Operable

U LA Per Trip Shut-Startup/

4 System (11(23) Trio Function Trio Level Settina down Refuel (7) Hot Standby Run Action (1) 1 Mode Switch in X

.X X

X 1.A Shutdown 1

Manual Scram X

X X

X 1.A IRM (16) 3 Igh Flus 1120/125 Indicated X(22)

X (5) 1.A 3

noper N X

X (5) 1.A APRM (16)(24)(25) 2 High Flux (Flow Blated) See Spec. 2.1.A.1 X

1.A or 1.5 2

High Fluu (Fixed Trip) i 120%

X 1.A or 1.8 P

f High Flus i 15% rated power X(21)

X(17)

(15) 1.A 2

Inoperative (13)

X(21)

X(17)

X 1.A

)

2 Downscale 1 3 Indicated on Scale (11)

(11)

X(12) 1.A or 1.8 b

2 High Reactor Pressure i 1955 psig X(10)

X X

1.A 2

High Drywell Pressure (14) i 2.5 psig X(8)

X(8)

X 1.A 2

Reactor Low Water Level (14) 1 538" above

-X X

X 1.A vessel aero -

0 4*

7%

c._

"N c-aa r-g-

9 3C g

~>

m

.-L

- ~ -.,

o 1

NOTES FOR TABLE 3.1.A (Cont'd)

$(f871994 8.

Not required to be OPERABLE when primary containment integrity is not l

required.

d 9.

(Deleted) 10.

Not required to be OPERABLE when the reactor pressure vessel head is not l

bolted to the vessel.

11. The APRM downscale trip function is only active when the reactor mode l

switch is in EUN.

12.

The APRM downscale trip is automatically bypassed when the IRM instrumentation is OPERABLE and not high.

l 13.

Less than 14 OPERABLE LPRMs will cause a trip system trip.

l 14.

Channel shared by Reactor Protection System and Primary Containment and Reactor Vessel Isolation Control System. A channel failure may be a channel failure in each system.

15.

The APRM 15 percent scram is bypassed in the RUN Mode.

16.

Channel shared by Reactor Protection System and Reactor Manual Control System (Rod Block Portion). A channel failure may be a channel failure in each system. If a channel is allowed to be inoperable per l

Table 3.1.A, the corresponding function in that same channel may be inoperable in the Reactor Manual Control System (Rod Block).

17.

Not required while performing low power physics tests at atmospheric pressure during or after refueling at power levels not to exceed 5 MW(t).

18.

This function must inhibit the automatic bypassing of turbine control valve fast closure or turbine trip scram and turbine stop valve closure scram whenever turbine first state pressure is greater than or equal to 154 psig.

19.

Action 1.A or 1.D shall be taken only if the permissive fails in such a manner to prevent the affected RPS logic from performing its intended function. Otherwise, no action is required.

d 20.

(Deleted)

The APRM High Flux and Inoperative Trips do not have to be OPERABLE @

l 21.

MdyiftheSourceRangeMonitogsareconnectedtogivea noncoincidence, High Flux scram, at 5 x 10 cps. The SRMs shall be OPERABLE per Specification 3.10.B.1.

The removal of eight (8) shorting I

links is required to provide noncoincidence high-flux scram protection from the Source Raete Monitors.

p rep,; red w n a, ca.,k t c.s w.M.w. p.,., a e.,, cet; o.,I co, Lug one ac n,e. 4 1 asw s/ies. -

w Y

BFN 3.1/4.1-6 AMENDMENT NO. 212 Unit 1 Yu~,nm

NOTES POR TABLE 3.1.A (Cont'd) j d_e three required IRMs per trip channel is not required g f__fQ93

-22.

E,:_; 2 3 1f.at least four IRMs (one in each core quadrant) are connected to give a noncoincidence. High Flux scram. The removal of four (4) shorting links is required to provide noncoincidence high-flux scram protection from the IRMs.

23.

A channel may be placed in an inoperable status for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for required surveillance without placing the trip system in the tripped condition provided t least one OPERABLE channel in the same trip system a

is monitoring that parameter.

24.

The Average Power Range Monitor scram function is varied (Reference Figure 2.1-1) as a function of recirculation loop flow (W).

The trip setting of this function must be maintained in accordance with 2.1.A.

25.

The APRM flote-biased neutron flux signal is fed through a time constant circuit of approximately 6 seconds. This time constant may be lowered or equivalently removed (no time delay) without affecting the operability of the flone-biased neutron flux trip channels. The APRM fixed high neutron flux signal does not incorporate the time constant but responds directly to instantaneous neutron flux.

k 5

~ ~<. c,i m,. u.u. n,- m nu.g nu n.r c /.%

e W

3.1/4.1-7 i

Unit 1

J TABLE 4.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRtMENTATION FUNCTIONAL TESTS MINIMUM FIMCTIONAL TEST FREQUENCIES FOR SAFETY INSTR. AND CONTROL CIRCUITS y@

Group (2)

Functional Test Minimum Frequencvf 3) '

rz Mode Switch in Shutdown A

Place Mode Switch in Shutdown Each Itefueling Outage Manual Scram A

Trip Channel and Alarm Every 3 Months IRM High Fluu C

Trip Channel and Alam (4)

_; -.ek t_r*n.;.".e' ".8a; ceNe

_ gg)

Inoperative C

Trip Channel and Alarm (4) j OnceNeek "- "

xf SSn Se SS-*- (g)

APRM o,ce/we lc (9 )* "_ _2 High Flum (15% Scram)

C Trip Output Relays (4)

S':n r ^ 5 ", r -d L

o_ _ o.

m__

h!=EIE "'

'" U High Flum (Flow Biased)

B Trip Output Relays (4)

OnceNeek u

High Flum (Fixed Trip)

B Trip Output Relays (4)

OnceNeek Inoperative 8

Trip Output Relays (4)

OnceNeek Downscal e 8

Trip Output Relays (4)

OnceNeek Flow Blas 8

(6)

High Reactor Pressure A

Trip Channel and Alarm Once/ Month (1)

High Drywell Pressure A

Trip Channel and Alarm Once/ Month (1)

Reactor Low Water Level A

Trip Channel and Alarm Once/ Month (1)

N(yftlS POR TABL3 4.1. A 1.

Initially the minimum frequency for the indicated tests shall be once per month.

2.

A description of the three groups is included in the Bases of this specification.

3.

Functional tests are not required unen the systems are not required to be operable or are operating (i.e.

already tripped).

If tests are missed.

they sna11 be performed prior to returning the systems to an operable status.

0 4.

This instrumentation is exempted free the instrument channel test definition. This instrument enannel functions! test will consist of injecting a simulated electrical signal into th'e measurement channels.

5.

(Deleted) 6.

The functional test of the flow bias network is performed in accordance with Table 4.2.C.

7.

Functional test consists of the injection of a_ simulated signal into the electronic trip circuitry in place of the sensor signal to verify operability of the trip end alarm functions, 8.

The functional test frequency decreased to once/3 months to reduce challenges to relief valves per NURBC 0737. Ites II.K.3.16.

9.

tJol reju reel de k perWec{ uke < e der;,5 lhe srA*mP/H ts cte. % Rw Mode-u,1ll l2 a

hour.s af4ee e.,hcl.,$F%

STM rg/Her srnwoey Mode-

~-

k I

8N 3.1/4.1-10 Unit 1

. ~.

.c 3.1. R&gE (Cont'd) 4 be acce==adated which would result in slow scram times or Partial control

~

e i

rod insertion. To preclude this occurrence, leve' switches have been provided in the instrument volume which alarm and scram the reactor when the voltsee of water reaches 50 gallons. As indicated above, there is sufficient volume in the piping to accommodate the scram without 1mpairment of the scram times or amount of insertion of the f.ontrol rods. This function shuts the reactor down while sufficient volume

{

remains to accommodate the discharge water and precludes the situation in i

which a scram would be required but not be able to perform its function adequately.

A source range monitor (SM) system is also provided to supply additional

{

neutron level information during startup but has no scram functions.-

Reference se 7.5.4 FSAR. Thus, the IRN is required in the REFUEL and ST a6 des In the power range the APRM system provides required protection.

e erence section 7.5.7 PSAR. Thus, the IRM System is not required in the RUN mode. The APRMs and the IRMs provide adequate _

coverage in the startup and intermediate range.

km a c{er_4 cellcookel< 9 en o,- mo

,,X, cook f rod w,/Unwa i

r The high reactor pressure, high drywell pressure, reactor low water level and scram discharge volume high level scrans are required for STARTUP and q

RUW modes of plant operation. They are, therefore, required to be operational for these modes of reactor operation.

j The r uirement to ove the scram unctions <as i icated in Table 3.

1 oper le in the RE EL mode is t assure thart fting to mode dur g reactor r operation oss not dimini h the need or the eactor i

r tection s

=#

i Because of the APRM downscale limit of 2,3 percent when in the RUN mode i

and high level limit of s15 percent when in the STARTUP Mode, the l

transition between the STARTUP and RUN Modes must be made with the APRM instrumentation indicating between 3 percent and 15 percent of rated power or a control rod scram will occur. In addition, the IRM system must be indicating below the High Flux tcetting (120/125 of scale) or a scram will occur when in the STARTUP Mode. For normal operating i

conditions, these limits provide assurance of overlap between the IRN i

system and APRM system so that there are no " gaps" in the power level indications (i.e., the power level is continuously monitored from-beginning of startup to full power and from full power to shutdown).

When power is being reduced, if a transfer to the STARTUP mode is made and the IRMs have not been fully inserted (a maloperational but not impossible condition) a control rod block immediately occurs so that reactivity insertion by control rod withdrawal cannot occur.

1 BPW 3.1/4.1-16 Unit 1 i

i

. 4.1 BA_3EE The minimus functional testing f requency used in this specification is

[

based on a reliability analysis using the concepts developed in reference (1). This concept was specifically adapted to the one out of-two taken twice logic of the reactor' protection system. The analysis shows that the i

sensors are primarily responsible for the reliability of the reactor protection system. This analysis makes use of

unsafe failure" rate experience at conventional and nuclear power plants in a reliability model i

~

for the system.. An " unsafe failure" is defined as one which negates channel operability and which, due to its nature, is revealed only when the channel is functionally tested or attempts to respond to a real' l

signal. Failure,such as blown fuses, ruptured bourdon tubes, faulted i

amplifiers, faulted cables, etc., which result in " upscale" or *downscale" readings on the reactor instrumentation are " safe" and will be easily i

recognized by the operators during operation because they are revealed by l

an alarm or a scram.

4 The channels listed in Tables 4.1.A and 4.1.B are divided into three

{

groups for functional testing. These are.

i A.

On-off sensors that provide a scram trip function.

I B.

Analog devices coupled with bistable trips that provide a scras function.

C.

Devices which only serve a useful function during some restricted mode of operation, such as STARTUp @4)ArfDetAf, or for which the i

only practical test is one that can be performed at shutdown.

The sensors that make up group (A) are specifically selected.from among j

the whole family of industrial on-off sensors that have earned an i

excellent reputation for reliable operation. During design, a goal of-l 0.99999 probability of success (at the 50 percent confidence level) was l

adopted to assure that a balanced and adequate design is achieved. The probability of success is primarily a function of the sensor failure rate i

and the test interval. A three-month test interval was planned for group i

(A) sensors. This is in keeping with good operating practices, and I

satisfies the design goal for the logic configuration utilized in the 4

Reactor protection System.

i To satisfy the long-term objective of maintaining an adequate level of l

safety throughout the plant lifetime, a minimus goal of 0.9999 at the 95 l

Percent confidence level is proposed. With the (1-out-of-2) X (2) logic, i

this requires that each sensor have an availability of 0.993 at the 95 l

Percent confidence level. This level of availability may be maintained by i

adjusting the test interval as a function of the observed failure history.A l

1.

Reliability of Engineered Safety Features as a Function of Testing Frequency. I. M. Jacobs,

Nuclear Safety " Vol. 9. No. 4.

July-August, 1968, pp. 310-312.

l l

i BPN 3.1/4.1-17 unit 1 t

---c 4

b c

x

(_

4.1 Sages (cont'd)

The frequency of calibration of the APRM Flow Biasireg ' Network has been established as each refueling outage. There are several-instruments which must be calibrated and it will take several hours to perform the calibration of the entire network. While the calibration is being 3

performed, a zero flow signal will be sent to half of the APRMs resulting in a half scram and rod block condition. Thus,'if the calibration were performed during operation, flux shaping would not be possible. Based on experience at other generating stations, drift of instruments, such as those in the Flow Biasing Network, is not significant and therefore, to avoid spurious scrams, a calibration frequency of each refueling outage is established.

/ Der rsenBV e,d neytoCL (w,+ <,.y co.4 *A r=<f s.,l#,dw M es eart ees\\ ce,Is;-;,g o e ne ner. f.,eI asso,jI;es)on Group (C) devices are active _ only during a given portiorFof the j

operational cycle. For example, the IRM is active during p ARTUPfand inactive during full power operation. Thus, the only test tnat as meaningful is the one performed M prior ht

(1.e.,

-- - - - a r the tests that are performed Q prior toruse of _the__ instrument).

Q.,4re. 9 m opplo h Molt) calibration frequency of the instrument channel is divided into two groups. These are as fo11cus:

1.

Passive type indicating devices that can be compared with like units on a continuous basis.

2.

Vacuum tube or semiconductor devices and detectors that drift'or lose sensitivity.

Experience with passive type instruments in generating stations and substations indicates that the specified calibrations are adequate. Por those devices which employ amplifiers, etc., drift specifications call for {

drift to be less than 0.4 percent / month; i.e.,

in the period of a month a i

drift of 4 percent would occur and thus providing for adequate margin.

Por the APRM system drift of electronic apparatus is not the only consideration in determining a calibration frequency. Change in power distribution and loss of chamber' sensitivity dictate a calibration every seven days. calibration on this frequency assures plant operation at or-below thermal limits.

A comparison of Tables 4.1.A and 4.1.8 indicates that two instrument channels have been included in the latter table. These are: mode switch in SHUTDOWN and manual scram. All of the devices or sensors associated with these scram functions are simple on-off switches and, hence, calibration during operation is not applicable, i.e.,

the switch is either on or off.

5;.,te. }nl:.,p e/ /d'e T/2H f=~cll*<1 I' **lfmell<rl in #4e RuMede., Jesl,3 is -,4 ny.:r< D k bt

(**'f tN udl i2 4e.as a fJe I

8

'm EY Aede 4.~ m em osde, e,/,.e;g,%.r n4x,7wP lAO T o

. nLe w-r 4 0 creh eyra u, o.,/ /

d

c. s,h/ce. S. 5 rd' 4 reu..ut /;.e ;, a..a /. co.,y44 /4 /a6 j

BFN 3.1/4.1-19 Unit 1 i

(

i l

4, E "N TABLE 3.1.A p

REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION REQUIREMENTS N

Min. No. of Operable Instr.

Modes'in which Function Channels Must Be Operable Per Trip Shut-Startup/

Svstem (1)(23) Trio Function Trio Level Settina down Refuel (7) Hot Standbv Ryun Action (1) 1 Mode Switch in X

X X

X 1.A Shutdown 1

Manual Scram X

X X

X 1.4 IRM (16) 3 i

Flum 1120/125 Indicated (#fM4) X(22)

X (5) 1.A on scale 3

Inoper X 2 X

(5) 1.A APRM (16)(24)(25) w 2

High Flum (Flow Blated) See Spec. 2.1.A.1 X

1.A or 1.B

~

N 2

High Flus (Fined Trip) i 120%

X

1. A or 1.8 2

High Flus i 15% rated power X(21)

X(17)

(15) 1.A

~

2 Inoperative (13)

X(21)

X(17)

X 1.A m

w 2

Downscale 1 3 Indicated on c8 Scale (11)

(11)

X(12) 1.A or 1.8 T

en 2

High Reactor e's Pressure

< 1055 psig X(10)

X X

1.A (P15-3-22AA 95,C,5) d m

pg 2

High Drywell ce na Pressure (14) 1 2.5 psig X(8)

X(8)

X 1.A m

yR (PIS-64-56 A-D) y 4

h 2

Reactor low Water

o. re Level (14) 1 538" above X

X X

1.A w

(LIS-3-203 A-D) vessel zero

,2 N

D.

O-Eis-m

8 w

+

m.

3 L

i SE'P 2 71994 NOTES FOR TABLE 3.1.A (Cont'd) 8.

Not required to be OPERABLE when primary containment integrity is not j

required.

9.

(Deleted) 10.

Not required to be OPERABLE when the reactor pressure vessel head is not bolted to the vessel.

11.

The APRM downscale trip function is only active when the reactor mode switch is in RUN.

12.

The APRM downscale trip is automatically bypassed when the IRM instrumentation is OPERABLE and not high.

13.

Less than 14 OPERABLE LPRMs will cause a trip system trip.

14 Channel shared by Reactor Protection System and Primary Containment and Reactor Vessel Isolation Control System. A channel failure may be a channel failure in each system.

15.

The APRM 15 percent scram is bypassed in the RUN Mode.

16.

Channel shared by Reactor Protection System and Reactor Manual Control System (Rod Block Portion). A channel failure may be a channel failure in each system. If a channel is allowed to be inoperable per l

Table 3.1.A, the corresponding function in that same channel may be ineperable in the Reactor Manual Control System (Rod Block).

l 17.

Not required while performing low power physics tests at atmospheric pressure during or after refueling at power levels not to exceed 5 MW(t).

18.

This function must inhibit the automatic bypassing of turbine control valve fast closure or turbine trip scram and turbine stop valve closure scram whenever turbine first stage pressure is greater than or equal to 154 psig.

19. Action 1.A or 1.D shall be taken only if the e m issive fails in such a manner to prevent the affected RPS logic fro'A performing its intended function. Otherwise, no action is required.

I 20.

(Deleted) 21.

The APRM High Flux and Inoperative Trips do not have to be OPERABLE @

6 if the Source Range Monitogs are connected to give a noncoincidence, High Flux scram, at 5 x 10 cps. The SRMs shall be OPERABLE per Specification 3.10.B.1.

The removal of eight (8) shorting links is required to provide noncoincidence high-flux screa protection from the Source Range Monitors.

l

\\

~

0 G rey:eed. wh a g. e kI red w4dm., 4*

a caie ceil

\\

'*~h '% '%8 o-t y< ye. f-d am L h es.,-

A DMENT NO. 2 2 7 BTN 3.1/4.1-6 Unit 2 1

+.

j l

?

WDTES POR TABLE 3.1.A (Cont'd)-

i k three required IRMs per trip channel is not required

[

22.

if M if at least four IR7ts (one in each core quadrant) are connected to give a noncoincidence. High Flux scram. The removal of four (4) shorting links is required to provide noncoincidence high-flux scram j

protection from the IRMs.

23.

A channel may be placed in an TWOPERABLE status for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for required surveillance without placing the trip system in the tripped co.sdition provided at least one OPERABLE channel in the same trip system j

is monitoring that parameter.

24.

The Average Power Range Monitor scram function is varied (Reference Figure 2.1-1) as a function of recirculation loop flow (V).

The trip i

setting of this function must be maintained in accordance with 2.1.A.

}

25. The APRM flow-biased neutron flux signal is fed through a time constant circuit of approximately 6 seconds. This time constant may be lowered or equivalently removed (no time delay) without affecting the operability of the flow-biased neutron flux trip channels. The APRM fixed high neutron 1

flux signal does not incorporate the time constant but responds directly to instantaneous neutron flux.

g repu: reb w:S sep udrol rod wll%.s & a core _ cdf co.Non'ay Osi t

- t or ~rt-l-el c.sse bl.es sc +ke :nem34 Flux Tr:p f%,ch=n,_

v 1

l t

i l

I i

SPW 3.1/4.1-7 Unit 2 i

. q j

TABLE 4.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRIMENTATION FUNCTIONAL TESTS MINIMJM FUNCTIONAL TEST FREQUENCIES FOR SAFETY INSTRUMENT AND CONTROL CIRCUITS Group (2)

Functional Test Minimum Freauenevf3)

E$

Mode Switch in $hutdown A

Place Mode Switch in Shutdown Each Refueling Outage rz Manuel Scram A

inip Channel and Alarm Every 3 Months IBM High Flum C

Trip Channel and Alam (4) f0nceNeek b ;ns evi x!.. ;-

-f h?r;5:'Stutw (q)

I Inoperative C

Trip Channel and Alarm (4)

[ OnceNeek L k; h?d8 ;

-d h'

5:? SS-*; (q)

APRM dec./L.JeeIC (9 )

High Flum (15% Scram)

C Trip Output Relays (4)

";'--; E; C 0 ;..; J

--?

U; d,'3.;, "; w' :3 to h _S; ) h High Flus (Flow Biased)

B Trip Output Relays (4)

OnceNeek High Flum (Fired Trip)

B Trip Output Relays (4)

OnceNeek

{

. Inoperative B

Trip Output Relays (4)

OnceNeek

[

Downscale 8

Trip Output Relays (4)

OnceNeek 7

Flow Blas 8

(6)

(6) ce High Reactor Pressure 8

Trip Channel and Alarm (7)

Once/ Month (PIS-3-22AA, 88, C, D)

High Drywell Pressure 8

Trip Channel and Alam (7)

Once/ Month (PIS-64-56 A-0)

Reactor low Water Level 8

Trip Channel and Alam (7)

Once/ Month (LIS-3-203 A-D) w

,. - -.. - +-

m e _,. ~,

-,e-w

,,,,m.,.ws

.v.

,_.,n,y_

c.,,.., _,,,..,

r:

'i NOTES POR TABLE 4.1.A 1.

Initially the minimum frequency for the indicated tests shall be once per D,*

month.

2.

A description of the three groups is included in the Bases of this specification.

3.

Functional tests are not required when the systems are not required to be OPERABLE or are operating (i.e., already tripped). If tests are missed, they shall be performed prior to returning the systems to an OPERA 8LE status.

4.

This instrumentation is exempted from the instrument channel test definition. This instrument channel functional test will consist of i

injecting a simulated electrical signal into the measurement channels.

5.

(Deleted) 6.

The functional test of the flow bias network is performed in accordance with Table 4.2.C.

7.

Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify operability of the trip end alarm functions.

8.

The functional test frequency decreased to once every three months to reduce challenges to relief valves per WUREG 0737. Item II.K.3.16.

I 9.

Not ref s,*rrtk b be-Febrmtb

.he.< *t*shtr!*,p /h. STAseTtop/ hot STArvDBV Ls t

M*0L Srem K'etJ Modt, son),'l 12. keurs aller-to,Jer-l9 f h r-SwnP /Ha T STAND 8Y Mode.

9 tru 3.1/4.1-10 Unit 2

t 3.1 BASES (Cont'd) be accommodated which would result in slow scram times or partial control rod insertion. To preclude this occurrence, level switches have been provided in the instrument volume which alarm and scrae the reactor when the volume of water reaches 50 gallons. As indicated above, there is sufficient volume in the piping to acew te the scram without a

impairment of the scram times or amount of insertion of the control

{

rods. This function shuts the reactor down while sufficient volume remains to accomunodate the discharge water and precludes the situation in i

which a scram would be required but not be able to perform its function adequately, i

A source range monitor (SRM) system is also provided to supply additional neutron level information during startup but has no scram functions.

Reference S 7.5.4 PSAR. Thus, the IRM is required in the REFUEL

~

and STARTU es In the power range the APRM system provides required protection. Re erence Section 7.5.7 PSAR. Thus, the IRM System is not required in the RUN mode. The APRMs and the IRMs provide adequate coverage in the STARTUP and intermediate range.hwh ety eeM r.d wAdreMe Q teee. ed.l codo;% o,e oe m bf The high reactor pressure, high drywell pressure, reactor low water D 'I level, low scram pilot air header pressure and scram discharge volume high level scrams are required for STARTUP and RUN modes of plant operation. They are, therefore, required to be operational for these modes of reactor operation.

e

{OPERAThe req irement to' ave the scram functions af indicated n Table 3.1 A in the EL mode is assure thyf shifting o the REFUE mode duri reactor r operation oes not diminish the n ed for the reactor -

kotectionsyst Because of the APRM downscale limit of 13 percent when in the RUN mode and high level limit of $15 percent when in the STARTUP Mode, the transition between the STARTUP and RUN Modes must be made with the APRM instrumentation indicating between 3 percent and 15 percent of rated power or a control rod scram will occur.

In addition, the IRM system must be indicating below the High Flux setting (120/125 of scale) or a scram will occur when in the STARTUP Mode. For normal operating conditions, these limits provide assurance of overlap between the IRM system and APRM system so that there are no " gaps

in the power level indications (i.e., the power level is continuously monitored from i

beginning of startup to full power and from full power to SHUTDOWN).

When power is being reduced, if a transfer to the STARTUP mode is made and the IRMs have not been fully inserted (a maloperational but not impossible condition) a control rod block immediately occurs so that reactivity insertion by control rod withdrawal cannot occur.

The low scram pilot air header pressure trip performs the same function as the high water level in the scram discharge instrument volume for fast fill events in which the high level instrument response time may be inadequate. A fast fill event is postulated for cestain degraded control air events in which the scram outlet valves unseat enough to allow 5 gpa

{

per drive leakage into the scram discharge volume but not enough to cause control rod insertion.

l BFW 3.1/4.1-16 Unit 2

' l a

4.1 BASES The minimum f unctional testing f requency used in this specification is based on a reliability analys,is using the concepts developed in reference (1). This concept was specifically adapted to-the one-out-of-two taken twice logic of the reactor' protection system._ The analysis shows that the sensors are primarily responsible for the reliability of the reactor protection system. This analysis makes use of

unsafe failure" rate experience at conventional and nuclear power plants in a reliability model for the system. An " unsafe failure

is defined as one which negates channel operability and which, due to its nature, is revealed only when j

the channel is functionally tested or attempts to respond to a real i

signal. Failure such as blown fuses, ruptured bourdon tubes.-faulted

. i amplifiers, faulted cables, etc., which result in " upscale" or *downscale*

l readings on the reactor instrumentation are " safe" and will be easily recognized by the operators during operation because they are revealed by j

en alarm or a scram.

The channels listed in Tables 4.1.A and 4.1.B are divided into three f

groups for functional testing. These are:

t A.

On-Off sensors that provide a scram trip function.

i B.

Analog devices coupled with bistable trips that provide a scram function.

l c.

Devices which only serve a useful function during some restricted mode of operation, such as STARTUP g ~~'y or for which the i

only practical test is one that can be performed at SNUTDOWN.

The sensors that make up group (A) are specifically selected from among

[

the whole f amily of industrial on-off sensors that have earned an

- 1 excellent reputation for reliable operation. During design, a goal of 0.9999 probability of success (at the 50 percent confidence level) was adopted to assure that a balanced and adequate design is achieved. The probability of success is primarily a function of the sensor failure rate and the test interval. A three-month test interval was planned for group

{

(A) sensors. This is in keeping with good operating practices, and

[

satisfies the design goal for the logic configuration utilized in the Reactor Protection System.

To satisfy the long-term objective of maintaining an adequate level of safety throughout the plant lifetime, a minimum goal of 0.9999 at the 95 percent confidence level is proposed. With the (1-out-of-2) X (2) logic.

this requires that each sensor have an availability of 0.993 at the 95 l

percent confidence level. This level of availability may be maintained by I

4 adjustingthetest interval as a function of the observed failure history t

i 1.

Reliability of Engineered Safety Features as a Punction of Testing f

Frecuency

2. M. Jacobs.

Nuclear Safety.

Vol. 9. No. 4.

(

July-August. 1968, pp. 310-312.

i BFN 3.1/4.1-17 Unit 2 m

_--m-

.w, y

y 4.1 p_Aggg (Cont'd)

The frequency of calibration of the APRM Plow Biasing Network has been established at each refueling outage. There are several instrLaments which I

must be calibrated and it will take several hours to perform the-calibration of the entire network. While the calibration is being performed, a zero flow signal will be sent to half of the APRMs resulting in a half scram and rod block condition. Thus, if the calibration were performed during operation, flux shaping would not be possible. Based on experience at other generating stations, drift of instruments, such as 1

those in the Flow Biasing Network, is not significant and therefore, to avoid spurious s am requency each refueling outage is established.

mot stemdy a # Ev'N'- (*A* *a y c..tr c.

Qor ggLtert etiI en b:*:.g

e er ~~t f.tl t.

Group (C) devices are au lve only during a given portion f the operational cycle. Por example, the IRM is active uring START JUP and inactive during full-power operat Thus, the_only test tnat is meaningful is the one performe prior td""'"& = - - --g(. e.,

the tests that are performed prior tcM3f th@nsument).

(caler.s M *Pph M4ModQ Calibration frequency of the instrument channel is divided into two groups. These are as follows:

1.

Passive type indicating devices (nat can be compared with like units on a continuous basis.

2.

Vacuum tube or semiconductor devices and detectors that drift or lose sensitivity.

Experience with passive type instruments in generating stations and substations indicates that the specified calibrations are adequate. For those devices which employ amplifiers, etc., drift specifications call for drift to be less than 0.4 percent / month:

1.e.,

in the period of a month a drift of 4 percent would occur and thus providing for adequate margin.

For the APRM system drift of electronic apparatus is not the only consideration in determining a calibration frequency. Change in power distribution and loss of chamber sensitivity dictate a calibration every seven days. Calibration on this frequency assures plant operation at or below thermal limits, f

A comparison of Tables 4.1.A and 4.1.B indicates that two instrument channels have been included in the latter table. These are: mode switch in SHUTDOW and manual scram. All of the devices or sensors associated with these scram functions are simple on-off switches and, hence, calibration during operation is not applicable, i.e.,

the switch is either on or off.

S;e s., }<s e/ 5e 172H f.o.el;w ls nel racllcJ f

h f4t. RBIMode, leslag ;s nel n)& h k

% lelck so,J.'l a t.e-s J Je,- e d e;g &.rr 4 7eP l @ Y f

M "*RY Pedt. be 4L.e. Rm Made., plac keer i.s on efe.o1;q ryer m. ) i co.,s;dere N*m I

E'*} reoso-Alt /Le i., s.,L.x \\ h es j&lt 5 Ya W

8FW 3.1/4.1-19 Unit 2

-, y

-y j

TABLE 3.1.A REACTOR PROTECT 10e8 SYSTE.t (SCRAM) INSTRUMENTATION REQUIREMENis

~

c to Min. No. of S.@

Operable n

Instr.

Hodes in which Function Channels Must Be Operab_1g w

Per Trly Shut-Startup/

l Svstesi (1)(231 1rlo Function Trio Level Settine down Refuel (7) Hot Standby Rm Action (1) 1 Mode Switch in X

X X

X 1.A Shutdown 1

Manual Scram X

X X

X 1.A IRM (16) 3 Igh Flus 1120/125 Indicated k$ X(22)

X (5) 1.A on scale 3

Inoperative X 12 X

(5) 1.A APRM (16)(24)(25) 2 High Flum (Flued Trip) i 1201 X

1. A or 1.8 2

High Flun P

(Flow Blased) See Spec. 2.1.A.1 X

1.A or I.8 2

High Flun 3 151 rated power X(21)

X(17)

(15) 1.A 7

2 Inoperative (13)

X(21)

X(17)

X 1.A 2

Downscale 1 3 Indicated on 7

Scale (11)

(11)

X(12) 1.A or 1.8 w

2 High Reactor Pressure i 1055 psig X(10) h X

1.A 2

High Drywell Pressure (14) i 2.5 psig X(8)

X(8)

X 1.A 2

Reactor low Water ns ob Level (14) 1538 above X

X X

1.A y @,

vessel aero it

". a on c

C RE r--

y-35, a

~v Y

03 N

-. ~...

l-R r

NOTES FOR TARTI 3.1. A (Cont'd)

SEP 2 71994 Not required to be OPERABLE when primary centainment integrity is not L

8.

required.

9.

(Deleted) q 10.

Not required to be OPERABLE when the reactor pressure vessel head is not bolted.to the vessel.

11. The APRM downscale trip function is only active when the reactor mode f

switch is in RUN.

12. The APRM downscale trip is automatically bypassed when the IRM.

l instrumentation is OPERABLE and not high.

l 13.

Less than 14 OPERABLE LPRMs will cause a trip system trip.-

Channel shared by Reactor Protection System and Primary Containment and 14 Reactor Vessel Isolation Control System. A channel failure may be a channel failure in each system.

15. The APRM 15 percent scram is bypassed in the RUN Mode.

16.

Channel shared by Reactor Protection System and Reactor Manual Control System (Rod Block Portion). A channel failure may be a channel failure l

in each system.

If a channel is allowed to be inoperable per Table 3.1.A the corresponding function in that same channel may be inoperable in the Reactor Manual Control System (Rod Block).

l 17.

Not required while performing low power physics tests at atmospheric pressure during or after refueling at power levels not to exceed 5 MWt.

j

18. This function must inhibit the automatic bypassing of turbine control valve fast closure or turbine trip scram and turbine stop valve closure scram whenever turbine first stage pressure is greater than or equal to j

154 psig.

19.

Action 1.A or 1.D shall be taken only if the permissive fails in such a-manner to prevent the affected RPS logic from performing its intended function. Otherwise, no action is required.

4 20.

(Deleted) e APRM High Flux and Inoperative Trips do not-have to be OPERABLE h 21.

$ *'**' " 30 if the Source Range Monitogs are connected to give a noncoincidence, High Flux scram, at 5 x 10 cys.. The SENs shall be OPERABLE per Specification 3.10.B.1.

The removal of eight (8) ahorting links-is required to provide noncoincidence high-flux scram protection from the Source Range Monitors.

i

_m

&lg rwp red w;44 o.,y u b ln,d 2 %,(n.~,a eore cd(

a 'W9. e..-

.n_ ( el osm uier.

m BFN 3.1/4.1-5 AMENDMENT NO. I 8 5 Unit 3 1

I NDTES PCR TABLE 3.1.A (Cont'd) e three required DtMs per trip channel is not required d_f. ibm 3 22.

-h

(:: - 3 7 EC 3 1f at least four UtMs (one in each core quadrant) are j

connected to give a noncoincidence, High Flux scram. The removal of four (4) shorting links is required to provide noncoincidence high-flux scram protection from the DtMs.

i

23. A channel may be placed in an inOPEstAEA status for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for required surveillance without placing the trip system in the tripped condition provided at least one OPEstABLE channel in the same trip system is monitoring that parameter.

24.

The Average power Range Monitor scram function is varied (Reference 1

Figure 2.1-1) as a function of recirculation loop flow (W). The trip setting of this function must be maintained in accordance with 2.1.A.

25. 'the APitM flow-biased neutron flux signal is fed througtva time constant circuit of approximately 6 seconds. This time constant may be lowered or l

equivalently removed (no time delay) without affecting the operability of the flow-biased neutron flux trip channels. The APINE fixed high neutron flux signal does not incorporate the time constant but responds directly j

to instantaneous neutron fluz.

l ff &O 8

.9 O

hf

{g g

on.-.-r n u;a,r. u m q n,rc., r J:..,,

/

t w

h i

L BPN-Unit 3 3.1/4.1-6

TABLE 4.1.A e to REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION FUNCTIONAL TESTS

]

MINIPRJM FUNCTIONAL TEST FREQUENCIES FOR SAFETY INSTR. AND CONTROL CIRCUITS Group (21 functional Test Minimum Freauencvf31 w

Mode Switch in Shutdown A

Place Mode Switch in Shutdown Each Refueling Outage Manual Scram A

Trip Channel and Alarm Every 3 Months IRM Once h' n :d %:,;; 3 6 High Flum C

Trip Channel and Alarm (4)

Week ere4my

?:F..

50..;-v (9)

Inoperative C

Trip Channel and Alarm (4) l Oge Week Swe4*g

.,s....

m..

7... 7.

v W&f APRM 4ef er;[5::5 S... t,,p :n:'

j o ce High Flus (151 Scram)

C Trip Outaut Relays (4) g I

P::'-1,'t:.. N ;.: red to

[

( h= 5 ^h-High Flum (Flow Blased)

B Trip Output Relays (4)

OnceNeek I

High Flun (Flued Trip) 8 Trip Output Relays (4)

OnceNeek Inoperative 5

Trip Output Relays (4)

OnceNeek Downscale 8

Trip Output Relays (4)

OnceNeek Flow Blas 8

(6)

High Reactor Pressure A

Trip Channel and Alarm Once/ Month (1)

High Drywell Pressure A

Trip Channel and Alarm Once/ Month (1)

Reactor Low Water Level A

Trip Channel and Alarm Once/ Month (1)

i l

i NDfES FOR TABLE 4.1. A 1.

Initially the minimus frequency for the indicated tests shall be once per

f..N i

Ci month.

2.

A description of the three groups is included in the Bases of this l

specification.

3.

Functional tests are not required when the systems are not required to be OPERASIA or are operating (i.e., already tripped). If tests are missed.

they shall be performed prior to returning the systems to an OPERABLE l

status.

l 4.

This instrumentation is exempted from the instrtment channel test definition. This instrument channel functional test will consist of injecting a simulated electrical signal into the measurement channels.

5.

(Deleted) 6.

The functional test of the flow bias network is performed in accordance with Table 4.2.C.

7.

Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify operability of the trip end alarm functions.

8.

Functional test frequency decreased to once/3 months to reduce the challenges to relief valves per NURs3 0737. Item II.K.3.16.

3b.

e

~

Q f

Of ModL hm RuN Medt unS$ 12. L,eurs c.Skr enke,'.,

% g_

5 MCW lHsT JTAtub gy Made..

/

A i

t I

e BPIHJnit 3 3.1/4.1-9

j 3.1 EggE (cont'd) be acca==adated which would result in slow scram times or partial control l

J'

-rod insertion.. To preclude this occurrence, level switches have been provided in the instrument volume which alarm and scram the reactor when the volume of water reaches 50 gallons. As indicated above, there is sufficient volisme in the piping to accosusodate the scram without impairment of the scram times or amount of insertion of the control rods. This function shuts the reactor down while sufficient voltame f

remains to acea==adate the discharge water and precludes the situation in which a scram would be required but not be able to perform its function

'l adequately.

A source range monitor (SRM) system is also provided to supply additional l'

neutron level information during startup but has no scram functions.

Reference

~l.5.4 FEAR. Thus, the IRM is required in the REFUEL and es.

In the power range the APRM system provides requir l

protection. Reference section 7.5.7 FBAR. Thus, the IRI* System is not required in the RUN mode. The APRMs and the IRMs ovide adequate coverage in the STARTUP end intermediate range. ud4 ehe,Mr=J w,Ade b 6

(*'#-

~

eell c

4. b *** *" *"*d Ad ene.AI:o )

The high reactor pressure, high dryw u l pressure, reactor low water level and scram discharge volume high level scrans are required for STARTUP and RUN modes of plant operation. They are, therefore, required to be operational for these modes of reactor operation.

The r rament to have scram functi as indicat in Table 3.1 4

OP in the REFUEL e is to assur that shift to the REPUBL (3

durin reactor power ration does diminish the need for the reactor i

^

pro ction systas, g N e-Because of the APRM downscale limit of 1 3 percent when in the RIAf mode l

and high level limit of $15 percent when in the STARTUP Mode, the transition between the STARTUP and RUN Modes must be made with the APRM instrumentation indicating between 3 percent and 15 percent of rated power or a control rod scram wil) occur.

In addition, the IRM system must be indicating below the Nigh Flux setting (120/125 of scale) or a scram will occur when in the STARTUP Mode. For normal operating-l conditions, these limits provide assurance of overlap between the IRM

{

system and APRM system so that there are no " gaps

in the power level j

indications (i.e., the power level is continuously monitored from i

beginning of startup to full power and from full power to shutdown).

j When power is being reduced..if a transfer to the STARTUP mode is made j

and the IRMs have not been fully inserted (a meloperational but not i

impossible condition) a control rod block insbediately occurs so that j

reactivity insertion by control rod withdrawal cannot occur.

'4.'

BFN-Unit 3 3.1/4.1-15

p.

L 4.1 EME The minimum functional testing-frequency used in this specification is f

based on a reliability analysis using the concepts developed in reference (1). This concept was specifically adapted to the one-out-of-two taken twice logic of the reactor protection system. The analysis shows that the sensors are primarily responsible for the reliability of the reactor j

protection system. This analysis makes use of " unsafe failure" rate j

experience at conventional and nuclear power plants in a reliability model for.the system. An " unsafe failure" is defined as one which negates channel operability and which, due to its nature, is revealed only when the channel is functionally tested or attempts to respond to a real signal. Failure such as blown fuses, ruptured bourdon tubes, faulted amplifiers, faulted cables, etc., which result in " upscale" or "downscale" readings on the reactor instrumentation are

safe" and will be easily recognized by the operators during operation because they are revealed by an alarm or a scram.

The channels listed in Tables 4.1.A and 4.1.B are divided into three groups for functional testing. These are:

A.

On-off sensors that provide a scram trip function.

B.

Analog devices coupled with bistable trips that provide a scram function.

I c.

Devices which only serve a useful function _during some restricted l

mode of operation, such as STARTUp C l 7 or for which the only practical test is one that can be performed at shutdown.

l The sensors that make up group (A) are specifically selected from among

)

the whole family of industrial on-off sensors that have earned an l

excellent reputation for reliable operation. During design, a goal of 0.99999 probability of success (at the 50 percent confidence level) was i

adopted to assure that a balanced and adequate design is achieved. The l

probability of success is primarily a function of the sensor failure rate

]

and the test interval. A three-month test interval was planned for group (A) sensors. This is in keeping with good operating practices, and satisfies the design goal for tte logic configuration utilized in the 1

Reactor Protection system.

t To satisfy the long-term objective of maintaining an adequate level of safety throughout the plant lifetime, a minimum goal of 0.9999 at the l

95-percent confidence level is proposed. With the (1-out-of-2) X (2) logic, this requires that each sensor have an availability of 0.993 at the 95 percent confidence level. This level of availability may be maintained l

by adjusting the test interval as a function of the observed failure f

history.1 i

i 1.

Reliability of Engineered Safety Features as a Punction of Testing l'

i Frequency, I. M. Jacobs, " Nuclear Safety," Vol. 9 No. 4, j

July-August, 1968, pp. 310-312.

l

\\ !

BPW-Unit 3 3.1/4.1-16 J

- - ~.

~.

4.1' R&BES (cont'd)

The frequency of calibration of the APitM Flow Biasing Network has been f

established at each refueling outage. There are several instrissents which must be calibrated and it will take several hours to perform the-calibration of the entire network. While the calibration is being.

l performed, a zero flow signal will be sent to half of the APRMs resulting l

.in a half' scram and rod block condition. Thus, if the calibration were performed during operation, flux shaping would not be possible. Based on experience at other generating stations, drift of instruments, such as those in the Flow Biasing Network, is not significant and therefore, to avoid spurious scrams, a calibration frequency of each refueling outage is established. S,.,g gy,,pcpyz., p. yc 4. 0r.2 L N, %

a.

( (,,-. c,a een e 4.:.g e,

-e.,41 e I ase-Wu Wu.

l Group (c) devices are active only during a given portion of the operational cycle. For example, the IRM is active during45T and inactive during full-power operation. Thus, the only test that is meaningful is the one performed (fusiik prior to M T~ r ZMS(i e.,

j the tests that are performed @ prior to(G h ot tne instrument).

(ed,-N Ao appbc.ut e.dg calibration frequency of the instrument channel is divided into two groups. These are as follows-l 1.

Passive type indicating devices that can be compared with like i

units on a continuous basis.

l 2.

Vacuum tube or semiconductor devices and detectors that drift or l

lose sensitivity.

Experience with passive type instruments in generating stations and substations indicates that the specified calibrations are adequate. For I

those devices which employ amplifiers, etc., drift specifications call for i

drift to be.less than 0.4 percent / month; i.e.,

in the period of a month a

)

' drift of.4-percent would occur and thus providing for adequate margin.

Por the APRM system drift of electronic apparatus is not the only

]

consideration in determining a calibration frequency, change in power distribution and loss of chamber sensitivity dictate a calibration every i

seven days. Calibration on this frequency assures' plant operation at or below thermal limits.

A comparison of Tables 4.1.A and 4.1.B indicates that two instrument channels have been included in the latter table. These are: mode switch in SHUTDOWN and manual scram. All of the devices or sensors associated with these scram functions are simple on-off switches and, hence, calibration during operation is not applicable, i.e., the switch is either on or off.

j

_ - = - -

/

Si.,u. inb.,p */ k rRH 4 d; ~s l' "d "'cN'd I

i., & Rudnede., test,5 ;,.,,4 repin.D de b-ca yl<Q,KI 12 s,,, g),,. e,j,,.;g p synn,p / Hor t

GY Medt. he N @N Medt.. %lve he,.r-t is 3

S on efend;q egeno < a._

,$ i-ee s;clerele*-,

'I O*h resso-eLit. /k ;, wL.1A I, ca j,4/e 04 Y P

l BFN-Unit 3 3.1/4.1-18

1 4

ENCLOSURE 3 TENNESSEE VALLEY AUTHORITY BROWN 8 FERRY NUCLEAR PLANT (BFN) l UNITS 1, 2,

AND 3 PROPOSED TECHNICAL SPECIFICATION (TS) CHANGE TS-355 REVISED PAGES 1

I.

AFFECTED PAGE-LIST Linit 1 Unit 2 Unit 3 3.1/4.1-3 3.1/4.1-3 3.1/4.1-2 3.1/4.1-6 3.1/4.1-6 3.1/4.1-5 3.1/4.1-7 3.1/4.1-7 3.1/4.1-6 3.1/4.1-8 3.1/4.1-8 3.1/4.1-7 3.1/4.1-10 3.1/4.1-10 3.1/4.1-9 3.1/4.1-16 3.1/4.1-16 3.1/4.1-15 3.1/4.1-17 3.1/4.1-17 3.1/4.1-16 3.1/4.1-19 3.1/4.1-19 3.1/4.1-18 II.

FEVISED PAGES See attached.

4 TABLE 3.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION REQUIREMENTS c: to Min. No. of 3,E Operable n

Instr.

Modes in Which Function Channels Must Be Operable Per Trip Shut-Startup/

System (1)(23) Trio Function Trio Level Settina sfstwn Refuel (7) Hot Standbv Ryn Action (11 n

1 Mode Switch in X

X X

X 1.A Shutdown 1

Manual Scram X

X X

X 1.A IRM (16)

.d 3

High Flux 1120/125 Indicated X(22)

X (5) 1.A on scale 3

Inoperative X(22)

X (5) 1.A l

APRM (16)(24)(25) 2 High Flux (Flow Blased) See Spec. 2.1.A.1 X

1.A or 1.8 2

High Flux w

(Fixed Trip) i 120%

X 1.A or 1.8 2

High Flux i 151 rated power X(21)

X(17)

(15) 1.A 2

Inoperative (13)

X(21)

X(17)

X 1.A s

,o 2

Downscale 1 3 Indicated on Scale (11)

(11)

X(12) 1.A or_1.B.

2 High Reactor Pressure i 1055 psig X(10)

X X

1.A 2

High Drywell Pressure (14) 1 2.5 psig X(8)

X(8)

X 1.A 2

Reactor Low Water Level (14) 1 538" above X

X X

1.A vessel zero

i s:

NOTES FOR TABLE 3.1.A'(Cont'd) i 8.

Not-required to be OPERABLE when primary containment integrity is not

.l required..

J 9.

(Deleted)

10. Not required to be OPERABLE when the reactor pressure vessel head is not i

bolted to the vessel.

11. The APRM downscale trip function is only active when the reactor mode switch is in RUN.

12. The APRM downscale trip is automatically bypassed when the IRM instrumentation is OPERABLE and not high.

13. Less than 14 OPERABLE LPRMs will cause a trip cystem trip.

i 14.

Channel shared by Reactor Protection System and Primary Containment and Reactor Vessel Isolation Control System. A channel failure may be a l

channel failure in each system.

15. The APRM 15 percent scram is bypassed in the RUN Mode.

l 16.

Channel shared by Reactor Protection System and Reactor Manual Control System (Rod Block Portion). A channel failure may be a channel failure.

t in each system. If a channel is allowed to be inoperable per Table 3.1.A, the corresponding function in that same channel may be inoperable in the Reactor Manual Control System (Rod Block).

17.

Not required while performing low power physics tests at atmospheric pressure during or after refueling at power levels not to exceed 5 MW(t).

j 18.

This function must inhibit the automatic bypassing of turbine' control l

valve fast closure or turbine trip scram and turbine stop valve closure f

scram whenever turbine first state pressure is greater than or equal to i

154 pais.

l

19. Action 1.A or 1.D shall be taken only if the permissive fails in such a manner to prevent the affected RPS logic from performing its intended function. Otherwise, no action is required.

20.

(Deleted) 21.-

Only required with any control rod withdrawn from a core cell containing l

one or more fuel assemblies. The APRM High Flux and Inoperative Trips do

{

nothavetobeOPERABLEiftheSourceRangeMonitgraareconnectedto i

give a noncoincidence, High Flux scram, at 5 x 10 cys. The SRMs shall be OPERABLE per Specification 3.10.B.1.

The removal of eight (8) l shorting links is required to provide noncoincidence high-flux scram j

protection from the Source Range Monitors.

j i

l l-BFN 3.1/4.1-6 Unit 1

1 NOTES'FOR TABLE 3.1.A (Cont'd) 22.

Only required with any control rod withdrawn from a core cell containing one or more fuel assemblies. For the IRM High Flux Trip runction, the three required IRMs per trip channel is not required if at least four J

IRMs (one in each core quadrant) are connected to give a noncoincidence, High Flux scram. The removal of four (4) shorting links is required to provide noncoincidence high-flux scram protection from the IRMs.

12 3. A channel may be placed in an inoperable status for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for required surveillance without placing the trip system in the tripped condition provided at least one OPERABLE channel in the same trip system i

is monitoring that parameter.

24.

The Average Power Range Monitor scram function is varied (Reference Figure 2.1-1) as a function of recirculation loop flow (W). The trip setting of this function must be maintained in accordance with 2.1.A.

25.

The APRM flow-biased neutron flux signal is fed through a time constant circuit of approximately 6 seconds. This time constant may be lowered or equivalently removed (no time delay) without affecting the operability of the flow-biased neucron flux trip channels. The APRM fixed high neutron flux signal does not incorporate the time constant but responds directly to instantaneous neutron flux.

f BFN 3.1/4.1-7 Unit 1

TABLE 4.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION FUNCTIONAL TESTS MINIMUM FUNCTIONAL TEST FREQUENCIES FOR SAFETY INSTR. AND CONTROL CIRCUITS E$

gry;till Functional Test Minimum Freauencvf3) r r :a Mode Switch in Shutdown A

Place Mode Switch.In Shutdown Each Refueling Outage Manual Scram A

Trip Channel and Alarm Every 3 Months-IRM High Flux C

Trip Channel and Alarm (4)

OnceNeek (9)

Inoperative C

Trip Channel and Alarm (4)

OnceNeek (9)

APRM High Flux (15% Scram)

C Trip Output Relays (4)

OnceNeek (9) l High Flux (Flow Biased)

B Trip Outp._t Relays (4)

OnceNeek High Flux (Fixed Trip)

B Trip Output Relays (4)

OnceNeek Inoperative B

Trip Output Relays (4)

OnceNeek Downscale B

Trip Output Relays (4)

OnceNeek u

Flow Bias B

(6)

~

High Reactor Pressure A

Trip Channel and Alarm Once/ Month (1)

/c High Drywell Pressure A

Trip Channel and Alarm Once/ Month (1)

Reactor Low Water Level A

Trip Channel and Alarm Once/ Month (1)

NOTES FOR TABLE 4.1.A l

1.

Initially the minimum frequency for the indicated tests shall be once per month.

2.

A description of the three groups is included in the Bases of this specification.

3.

Functional tests are not required when the systems are not' required to be operable or are operating (i.e., already tripped). If tests are missed, they shall be performed prior to returning the systems to an operable status.

4.

This instrumentation is exempted from the instrument channel test definition. This instrument channel functional test will consist of 1

injecting a simulated electrical signal into the measurement channels.

5.

(Deleted)

I 6.-

The functional test of the flow bias network is performed in accordance with Table 4.2.C.

i 7.

Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify

[

operability of the trip end alarm functions.

8.

The functional test frequency decreased to once/3 months to reduce challenges to relief valves per NUREG 0737, Item II.K.3.16.

9.

Not required to be performed when entering the STARTUP/ HOT STANDBY Mode from RUN Mode until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering the STARTUP/ HOT STANDBY Mode, f

9 4

.i i

i i

L BFN 3.1/4.1-10 Unit 1

. - ~ _ -

- -. ~ __

. ~.

j 3.1 A&EFa (cont'd) l be accommodated which would result in slow' scram times or partial control j

rod' insertion.-_ To preclude this occurrence, level switches have been provided in the instrtment volume which alarm and scram the reactor when

-[

the volume of water reaches 50 gallons. As indicated above, there is sufficient _ volume in the piping to accommodate the scram without impairment of the scram times or. amount of insertion of the control rods. This function shuts the reactor down while sufficient volume remains to accommodate the discharge water and precludes the situation in i

which a scram would be required but not be able to perform its function

]j adequately.

t A source range monitor (SRM) system is also provided to supply additional j

neutron level information during startup but has no scram functions.

Reference Section 7.5.4 FSAR. Thus, the IBM is required in the REFUEL

{

(with any control rod withdrawn from a core cell containing one or more fuel assemblies) and STARTUP Modes.

In the power range the APRM system-provides required protection. Reference Section 7.5.7 FSAR. Thus, the IRM System is not required in the RUN mode. The APRMs and the IRMs provide adequate coverage in the startup and intermediate range.

The high reactor pressure, high drywell pressure, reactor low water level and scram discharge volume high level scrans are required for STARTUP and i

RUN modes of plant operation. They are, therefore, required to be operational for these modes of reactor operation.

Because of the APRM downscale limit of ).,3 percent when in the RUN mode and high level limit of.(15 percent when in the STARTUP Mode, the j

transition between the STARTUP and RUN Modes must be made with the APRM instrumentatica indicating between 3 percent and 15 percent of rated power or a control rod scram will occur. In addition, the IRM system pust be indicating below the High Flux setting (120/125 of scale) or a scram will occur when in the STARTUP Mode. For normal operating conditions, these limits provide assurance of overlap between the IRM system and APRM system so that there are no " gaps" in the power level

{

indications (i.e., the power level is continuously monitored from j

beginning of startup to full power and from full power to shutdown).

l When power is being reduced, if a transfer to the STARTUP mode is made and the IRMs have not been fully inserted (a maloperational but not i

impossible condition) a control rod block immediately occurs so that j

e reactivity insertion by control rod withdrawal cannot occur.

1 l

BFN 3.1/4.1-16 Unit 1

.~

t 4.1 R& GEE

?

The minimum functional testing frequency used in this specification is based on a reliability analysis using the concepts developed in reference (1). This concept was specifically adapted to the one-out-of-two taken twice logic of the reactor protection system. The' analysis shows that the

. sensors are primarily responsible for the reliability of the reactor protection system.. This analysis makes use of " unsafe failure" rate i

experience at conventional and nuclear power plants in a reliability model for the system. An " unsafe failure" is defined as one which negates channel operability and which, due to its nature, is revealed only when the channel is functionally tested or attempts to respond to a real signal. Failure such as blown fuses, ruptured bourdon tubes, faulted

amplifiers, faulted cables, etc., which result.in " upscale" or "downscale" readings on the reactor instrumentation are " safe" and will be easily recognized by the operators during operation because they are revealed by i

an alarm or a scram, i

The channels listed in Tables 4.1.A and 4.1.B are divided into three groups for functional testing. These are:

P A.

On-Off sensors that provide a scram trip function.

B.

Analog devices coupled with bistable trips that provide a scram

.[

function.

i i

C.

Devices which only serve a useful function during some restricted mode of operation, such as STARTUP, or for which the q

l only practical test is one that can be performed at shutdown.

The sensors that make up group (A) are specifically selected from among f

the whole family of industrial on-off sensors that have earned an i

excellent reputation for reliable operation. During design, a goal of i

0.99999 probability of success (at the 50 percent confidence level) was

[

adopted to assure that a balanced and adequate design is achieved. The probability of success is primarily a function of the sensor failure rate and the test interval. A three-month test interval was planned for group (A) sensors. This is in keeping with good operating practices, and f

satisfies the design goal for the logic configuration utilized in the Reactor Protection System.

To satisfy the long-term objective of maintaining an adequate level of safety throughout the plant lifetime, a minimum goal of 0.9999 at the 95 i

percent confidence level is proposed. With the (1-out-of-2) X (2) logic, this requires that each sensor have an availability of 0.993 at the 95 e

percent confidence level. This level of availability may be maintained by adjusting the test interval as a function of the observed failure history.1 l

?

1.

Reliability of Engineered Safety Features as a Function of Testing f

Frequency, I. M. Jacobs, " Nuclear Safety," Vol. 9, No. 4, July-August, 1968, pp. 310-312.

l BFN 3.1/4.1-17 Unit 1

4.1 &&EE1'(Cont'd)

The frequency of. calibration of the APRM Flow Biasing Network has been-

.h established as each refueling outage. There are several instruments which I

must be calibrated and.it will take several hours to perform the.

calibration of the entire network. While the calibration is being i

performed, a zero flow signal will be sent to half of the APRMs resulting l

in a half scram and rod block condition. Thus, if the calibration were performed during operation, flux shaping would not'be possible. Based on experience at other generating stations, drift of instruments, such as those in the Flow Biasing Network, is not significant and therefore, to

?

avoid spurious scrams, a calibration frequency of each refueling outage is established.

Group (C) devices are active only during a given portion of the operational cycle. For example, the IRM is active during the STARTUP/ HOT STANDBY and REFUEL (with'any control rod withdrawn from a core cell l

containing one or more fuel assemblies) Modes and inactive during l

full-power operation. Thus, the only test that is meaningful is the one performed prior to entering the applicable Mode (i.e., the tests that are performed prior to use of the instrument). Since testing of the IRM j

functions is not' practical in the RUN Mode, testing is not required to be completed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering the STARTUP/ HOT STANDBY Mode from the RUN Mode.- Twelve hours is based on operating experience and in

[

consideration of providing reasonable time in which to complete the test.

j Calibration frequency of the instrument channel is divided into two groups. These are as follows:

l 1.

Passive type indicating devices that can be compared with like l

units on a continuous basis.

'j i

2.

Vacuum tube or semiconductor devices and detectors that drift or j

lose sensitivity.

)

Experience with passive type instruments in generating stations and l

substations indicates that the specified calibrations are adequate.. For j

those devices which employ amplifiers, etc., drift specifications call for j

drift to be less than 0.4 percent / month; i.e.,

in the period of a month a j

drift of 4 percent would occur and thus providing for adequate margin.

For the APRM system drift of electronic apparatus is not the only consideration in determining a calibration frequency. Change in power j

distribution and loss of chamber sensitivity dictate a calibration every-seven days. Calibration on this frequency assures plant operation at or below thermal limits.

j l

A comparison of Tables 4.1.A and 4.1.B indicates that two instrument channels have been included in the latter table. These are: mode switch 1

.in SHUTDOWN and manual scram. All of the devices or sensors associated with these scram functions are simple on-off switches and, hence, calibration during operation is not applicable, i.e.,

the switch is either on or off.

BFN 3.1/4.1-19 Unit 1

. ~..

i l

i TABLE 3.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION REQUIREMENTS c to Mirn No. of I

EQ Operable n

Instr.

Modes in which Function Channels y

Must Se Operable Per Trip Shut-Startup/

e Systet (1)(231 Trio Function Trio Level Settina down Refuel (7) Hot Standbv Run Action (1) 1 Mode Switch in X

X X

X 1.A Shutdown 1

Manual Scram X

X X

X 1.A IRM (16) 3 High Flux 1120/i25 Indicated X(22)

X (5) 1.A y

on scale 3

Inoperative X(22)

X (5) 1.A

]

APRM (16)(24)(25) 2 High Flux (Flow Blased) See Spec. 2.1.A.1 X

1.A or 1.8 2

High Flux (Fixed Trip) i 120%

X 1.A or 1.8 w

2 High Flux i 15% rated power X(21)

X(17)

(15) 1.A 2

Inoperative (13)

X(21)

X(17)

X 1.A s

2 Downscale

~ 3 Indicated on Scale (11)

(11)

X(12) 1.A or 1.5 d,

2 High Reactor Pressure i 1055 psig X(10)

X X

1.A (PIS-3-22AA,BB.C,0) 2 High Drywell Pressure (14) i 2.5 psig X(B)

X(8)

X 1.A (PIS-64-56 A-D) 2 Reactor Low Water Level (14) 1 538* above X

X X

1.A (LIS-3-203 A-0) vessel zero l

i i

NOTES FOR TABLE 3.1.1 (Cont'd) i 8.

Not required to be OPERABLE when primary containment integrity is_not l

required.

9.

(Deleted) 10.

Not required to be OPERABLE when the reactor pressure vessel head is not bolted to the vessel.

11. The APRM downscale trip function is only active when the reactor mode switch is in RUN.

12. The APRM downscale trip is automatically bypassed when the IRM i

instrumentation is OPERABLE and not high.

13. Less than 14 OPERABLE LPRMs will cause a trip system trip.

.i

(

14.

Channel shared by Reactor Protection System and Primary Containment and Reactor Vessel Isolation Control System. A channel failure may be a channel failure in each system.

15. The APRM 15 percent scram is bypassed in the RUN Mode.

16.

Channel shared by Reactor Protection System and Reactor Manual Control i

System (Rod Block Portion). A channel failure may be a channel failure in each system.

If a channel is allowed to be inoperable per i

Table 3.1.A, the corresponding function in that same channel may be inoperable in the Reactor Manual Control System (Rod Block).

17.

Not required while performing low power physics tests at atmospheric pressure during or after refueling at power levels not to exceed 5 MW(t).

18.

This function must inhibit the automatic bypassing of turbine control valve fast closure or turbine trip scram and turbine stop valve closure 4

scram whenever turbine first stage pressure is greater than or equal to 154 pais.

19.

Action 1.A or 1.D shall be taken only if the permissive fails in such a

{

manner to prevent the affected RPS logic from performing its intended I

function. Otherwise, no action is required.

I 1

20.

(Deleted) 21.

Only required with any control rod withdrawn from a core cell containing one or more fuel assemblies. The APRM High Flux and Inoperative Trips do i

nothavetobeOPERABLEiftheSourceRangeMonitgraareconnectedto d

l give a noncoincidence, High Flux scram, at 5 x 10 cps. The SRMs shall be OPERABLE per Specification 3.10.B.1.

The removal of eight (8) shorting links is required to provide noncoincidence high-flux scram j

protection from the Source Range Monitors.,

j i

BFN 3.1/4.1-6 Unit 2 I

e NOTES FOR TABLE 3.1.A (Cont'd) 22.

Only required with any control rod withdrawn from a core cell containing one or more fuel assemblies. For the IRM High Flux Trip Function, the thre.s required IRMs per trip channel is not required if at least four i

IkMs (one in each core quadrant) are connected to give a noncoincidence, High Flux scram. The removal of four (4) shorting links is required to provide noncoincidence high-flux scram protection from the IRMs.

23.

A channel may be placed in an INOPERABLE status for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for required surveillance without placing the trip system in the tripped condition provided at least one OPERABLE channel in the same trip system is monitoring that parameter.

24.

The Average Power Range Monitor scram function is varied (Reference Figure 2.1-1) as a function of recirculation loop flow (W). The trip setting of this function must be maintained in accordance with 2.1.A.

25.

The APRM flow-biased neutron flux signal is fed'through a time constant circuit of approximately 6 seconds. This time constant may be lowered or equivalently removed (no time delay) without affecting the operability of the flow-biased neutron flux trip channels. The APRM fixed high neutron flux signal does not incorporate the time constant but responds directly to instantaneous neutron flux.

I i

)

i BFN 3.1/4.1-7 Unit 2

m, l

l TABLE 4.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION FUNCTIONAL TESTS MINIMUM FUNCTIONAL TEST FREQUENCIES F04t SAFETY INSTRUMENT AND CONTROL CIRCUITS l

Group (2)

Functional Test Minimum Freauencvf3) l c t:s Q

Mode Switch in Shutdown A

Place Mode Switch in Shutdown Each Refueling Outage Manual Scram A

Trip Channel and Alam Every 3 Months n

IRM High Flux C

Trip Channel and Alam (4)

OnceNeek (9)

Inoperative C

Trip Channel and Alam (4)

Once Neek (9)

APRM High Flux (15% Scram)

C Trip Output Relays (4)

OnceNeek (9) l I

High Flux (Flow Biased)

B Trip Output Relays (4)

OnceNeek High Flux (Fixed Trip)

B Trip Output Relays (4)

OnceNeek y

Inoperative B

Trip Output Relays (4)

OnceNeek I

{

Downscale B

Trip Output Relays (4)

OnceNeek L

Flow Blas B

(6)

High Reactor Pressure B

Trip Channel and Alam (7)

Once/ Month (PIS-3-22AA, BB, C, D)

High Drywell Pressure

- B Trip Channel and Alam (7)

Once/ Month (PIS-64-56 A-0)

Reactor low Water Level B

Trip Channel and Alam (7)

Once/ Month-(LIS-3-203 A-D) i er - w

-9yi*

-,-me.-M9+'t-

'tt"e"*"Y 4-74C*MP"'TF1%W'W""TU-tP"TY r"'

T-PC"M"

-'Hr1

Tr-==t-y--

t~1

-t-M-De'----*

+W='-

wW'

= - " - -

t a

w-(#

"Ww M-"

wee

wh-

A

)

i NOTES FOR TABLE 4.1.A

1. -

Initially the minimum frequency for the indicated tests shall be once per month.

2.

A description of the three groups is included in the Bases of this j

specification.

3.

Functional tests are not required when the systems are not required to be OPERABLE or are operating (i.e., already tripped). If tests are missed,

)

they shall be performed prior to returning the systems to an OPERABLE status.

4.

This instrumentation is exempted from the instrument channel test definition. This instrument channel functional test will' consist of injecting a simulated electrical signal into the measurement channels.

5.

(Deleted) 6.

The functional test of the flow bias network is performed in accordance with Table 4.2.C.

7.

Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify operability of the trip end alarm functions.

8.

The functional test frequency decreased to once every three months to reduce challenges to relief valves per NUREG 0737, Item II.K.3.16.

t 9.

Not required to be performed when entering the STARTUP/ HOT STANDBY Mode from RUN Mode until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering the STARTUP/ HOT STANDBY Mode.

i i

t h

h l

BFN-3.1/4.1-10 Unit 2 l

'I

.1 3.1 AMER (Cont'd) j be accosmodated which would result-in slow scram times or partial control rod insertion. To preclude this occurrence, level switches have been I

provided in the instrument volume which alarm and scram the reactor when the volume of water reaches 50 gallons. As indicated above, there is sufficient volume in the piping to accommodate the scram without impairment of the scram times or amount of insertion of the control l

rods. This function shuts the reactor down while sufficient volume remains to accommodate the discharge water and. precludes the situation'in which a scram would be required but net be able to perform its function adequately.

l A source range monitor (SRM) system is also provided to supply additional l

I neutron level information during startup but has no scram functions.-.

Reference Section 7.5.4 FSAR. Thus, the IBM is required in the REFUEL (with any control rod withdrawn from a core cell containing one or more

.I i

fuel assemblies) and STARTUP Modes. In the power range the APRM system provides required protection. Reference Section 7.5.7 FSAR.. Thus, the j

IRM System is not required in the RUN mode. The APRMs.and the IRMs provide adequate coverage in the STARTUP and intermediate range.

The high reactor pressure, high drywell pressure, reactor low water level, low scram pilot air header pressure and scram discharge volume j

high level scrans are required for STARTUP and RUN modes of-plant l

operation. They are, therefore,-required to be operational for these i

modes of reactor operation.

j Because of the APRM downscale limit of 1 3 percent when in the RUN mode and high level limit of 115 percent when in the STARTUP Mode, the j

transition between the STARTUP and RUN Modes must be made with the APRM instrumentation indicating between 3 percent and 15 percent of rated power or a control rod scram will occur. In addition, the IRM system must be indicating below the High Flux setting (120/125 of scale) or a scram will occur when in the STARTUP Mode. For normal operating conditions, these limits provide assurance of overlap between the IRM

{

system and APRM system so that there are no " gaps" in the power level indications (i.e., the power level is continuously monitored from i

beginning of startup to full power and from full power to SHUTDOWN).

When power is being reduced, if a transfer to the STARTUP mode is made and the IRMs have not been fully inserted (a maloperational but not impossible condition) a control rod block immediately occurs so that reactivity insertion by control rod withdrawal cannot occur.

i The low scram pilot air header pressure trip performs the same function as the high water level in the scram discharge instrument volume for fast fill events in which the high level instrument response time may be inadequate. A fast fill event is postulated for certain degraded control air events in which the scram outlet valves unseat enough to allow 5 spa per drive leakage into the scram discharge volume but not enough to cause control rod insertion.

BFN 3.1/4.1-16 Unit 2

o

. 4.1 R&gE1 The minimum functional testing frequency used in this specification is based on a reliability analysis using the concepts developed in reference (1). This concept was specifically adapted to the one-out-of-two taken twice logic of the reactor protection system. The analysis shows that the sensors are primarily responsible for the reliability of the reactor protection system. - This analysis makes use of " unsafe failure" rate experience at conventional and nuclear power plants in a reliability model for the system.- An " unsafe failure" is defined as one which negates channel operability and which, due to its nat'are, is revealed only when the channel is functionally tested or attsarts.to respond to a real signal. Failure such as blown fuses, ruptured bourdon tubes, faulted amplifiers, faulted cables, etc., which result in " upscale" or "downscale" readings on the reactor instrumentation are " safe" and will be easily recognized by the operators during operation because they are revealed by an alarm or a scram.

The channels listed in Tables 4.1.A and 4.1.B are divided into three groups for functional testing. These are:

A.

On-Off sensors that provide a scram trip function.

B.

Analog devices coupled with bistable trips that provide a scram function.

C.

Devices which only serve a useful function during some restricted mode of operation, such as STARTUP, or for which the

-j only practical test is one that can be performed at SHUTDOWN.

The sensors that make up group (A) are specifically selected from among the whole family of industrial on-off sensors that have earned an excellent reputation for reliable operation. During design, a goal of 0.9999 probability of success (at the 50 percent confidence level) was adopted to assure that a balanced and adequate design is achieved. The probability of success is primarily a function of the sensor failure rate and the test interval. A three-month test interval was planned for group (A) sensors. This is in keeping with good operating practices, and satisfies the design sost for the logic configuration utilized in the-Reactor Protection System.

l l

To satisfy the long-term objective of maintaining an adequate level of safety throughout the plant lifetime, a minimum goal of 0.9999 at the 95 percent confidence level is proposed. With the (1-out-of-2) X (2) logic, this requires that each sensor have an availability of 0.993 at the 95 percent confidence level. This level of availability may be maintained by j

adjusting the test interval as a function of the observed failure history.1 1

1.

Reliability of Engineered Safety Features as a Function of Testing Frequency, I. M. Jacobs, " Nuclear Safety," Vol. 9, No. 4, July-August, 1968, pp. 310-312.

BFN 3.1/4.1-17 Unit 2

- - - -. ~ ~

,__y.

---r-r--

rp 4.1 B&gI& (Cont'd)'

The frequency of calibration of the APRM Flow Biasing Network has been

'j established at each refueling outage. There are several instruments which l

must be calibrated and it will take several hours to perform the I

calibration of the entire network. While the calibration is being i

performed, a zero flow signal will be sent to half of the APRMs resulting-

)

in a half scram and rod block condition. Thus, if the calibration were performed.during operation, flux shaping would not be possible. Based on experience at other generating stations, drift of instruments, such as those in the Flow Biasing Network,-is not significant and therefore, to-i avoid spurious scrams, a calibration frequency of each refueling outage'is established.

j i

Group (C) devices are active only during a given portion of the operational cycle. For example, the IRN is active during the STARTUP/ HOT' l

STANDBY and REFUEL (with any control rod withdrawn from a core cell containing one or more fuel assemblies) Modes and inactive during full-power operation. Thus, the only test that is meaningful is the.one l

performed prior to entering the applicable Mode (i.e., the tests that are performed prior to use of the-instrument). Since testing of the IBM l

functions is not practical in the RUN Mode, testing is not required to be completed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering the STARTUP/ HOT STANDBY Mode from-l the RUN Mode. Twelve hours is based on operating experience and in consideration of providing reasonable time in which to complete the test.

l Calibration frequency of the instrument channel is divided into two i

groups. These are as follows:

1 1.

Passive type indicating devices that can be compared with like units on a continuous basis.

2.

Vacuum tube or semiconductor devices and detectors that drift or lose sensitivity.

Experience with passive type instruments in generating stations and substations indicates that the specified calibrations are adequate. For those devices which employ amplifiers, etc., drift specifications call for drift to be less than 0.4 percent / month; i.e.,

in the period of a month a drift of 4 percent would occur and thus providing for adequate margin.

r For the APRM system drift of electronic apparatus is not the only l

consideration in determining a calibration frequency. Change in power i

distribution and loss of chamber sensitivity dictate a calibration every seven days.

Calibration on this frequency assures plant operation at or l

below thermal limits.

j A comparison of Tables 4.1. A and 4.1.B indicates that two instrument '

'I channela have been included in the latter table. These are: mode switch in' SHUTDOWN and manual scram. All of the devices or sensors associated with these scram functions are simple on-off switches and, hence, l

calibration during operation is not applicable, i.e.,

the switch is either i

on or off.

)

i BFN 3.1/4.1-19 Unit 2 I

i

,,_-..4-

~ - - -.

... ~.

TABLE 3.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION REQUIREMENTS C t2 Min. No. of d2 Operable Instr.

Modes in Which Function w

Channels Must Be Operable Per Trip Shut-Startup/

Svstem (1)(23) Trio Function Trio Level Settina down Refuel (7) Hot Standby Run Action ill 1

Mode Switch in X

X X

X 1.A Shutdown 1

Manual Scram X

X X

X 1.A IRM (16) 3 High Flux 1120/125 Indicated X(22)

X (5) 1.A d

on scale 3

Inoperative X(22)

X (5) 1.A l

APRM (16)(24)(25) 2 High Flux (Fixed Trip) i 120%

X 1.A or 1.B w

2 High Flux (Flow Blased) See Spec. 2.1.A.1 X

1.A or 1.B 2

High Flux i 15% rated power X(21)

X(17)

(15) 1.A 2

Inoperative (13)

X(21)

X(17)

X 1.A h

2 Downscale 1 3 Indicated on Scale (11)

(11)

X(12) 1.A or 1.8 2

High Reactor Pressure i 1055 psig X(10)

X X

1.A 2

High Drywell Pressure (14) i 2.5 psig X(8)

X(8)

X 1.A 2

Reactor Low Water Level (14) 1 538" above X

X X

1.A vessel aero

NOTES FOR TABLE 3.1.A (Cont'd) t 8.

Not required to be OPERABLE when primary containment integrity is not required.

9.

(Deleted) 10.

Not required to be OPERABLE when the reactor pressure vessel head is not 4

bolted to the vessel.

11.

The APRM downscale trip function is only active when the reactor mode switch is in RUN.

12.

The APRM downscale trip is automatically bypassed when the IRM instrumentation is OPERABLE and not high.

13.

Less than 14 OPERABLE LPRMs will cause a trip system trip.

14.

Channel shared by Reactor Protection System and Primary Containment and Reactor Vessel Isolation Control System. A channel failure may be a channel failure in each system.

15.

The APRM 15 percent scram is bypassed in the RUN Mode.

16.

Channel shared by Reactor Protection System and Reactor Manual Control System (Rod Block Portion). A channel failure may be a channel faj1ure in each system. If a channel is allowed to be inoperable per Table 3.1.A, the corresponding function in that same channel may be inoperable in the Reactor Manual Control System (Rod Block).

17.

Not required while performing low power physics tests at atmospheric pressure during or after refueling at power levels not to exceed 5 MWt.

18.

This function must inhibit the automatic bypassing of turbine control valve fast closure or turbine trip scram and turbine stop valve closure scram whenever turbine first stage pressure is greater than or equal to 154 psig.

19.

Action 1.A or 1.D shall be taken only if the permissive fails in such a manner to prevent the affected RPS logic from performing its intended function. Otherwise, no action is required.

20.

(Deleted) 21.

Only required with any control rod withdrawn from a core cell containing l

one or more fuel assemblies. The APRM High Flux and Inoperative Trips do I not have to be OPERABLE if the Source Range Monitors are connected to d

5 give a noncoincidence, High Flux scram, at 5 x 10 cps. The SRMs shall be OPERABLE per Specification 3.10.B.1.

The removal of eight (8) shorting links is required to provide noncoincidence high-flux scram protection from the Source Range Monitors.

BTN 3.1/4.1-5 Unit 3

NOTES FOR TABLE 3.1.A (C:nt'd) 22.

Only required with any control rod withdrawn from a core cell containing one or more fuel assemblies. For the IRM High Flux Trip Function, the three required IRMs per trip channel is not required if at least four IRMs (one in tach core quadrant) are connected to give a noncoincidence, High Flux scram. The removal of four (4) shorting links is required to provide noncoincidence high-flux scram protection from the IRMs.

23.

A channel may be placed in an INOPERABLE status for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for required surveillance without placing the trip system in the tripped condition provided at least one OPERABLE channel in the same trip system is monitoring that parameter.

24.

The Average Power Range Monitor scram function is varied (Reference Figure 2.1-1) as a function of recirculation loop flow (W). The trip setting of this function must be maintained in accordance with 2.1.A.

25.

The APRM flow-biased neutron flux signal is fed through a time constant circuit of approximately 6 seconds. This time constant may be lowered or equivalently removed (no time delay) without affecting the operability of the flow-biased neutron flux trip channels. The APRM fixed high neutron flux signal does not incorporate the time constant but responds directly to instantaneous neutron flux.

V BFN 3.1/4.1-6 Unit 3

e 6-TABLE 4.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION FUNCTIONAL TESTS MINIMJM FUNCTIONAL TEST FREQUENCIES FOR SAFETY INSTR. AND CONTROL CIRCUITS ew Group (2)

Functional Test 9 p Freauencvf3) om Mode Switch in Shutdown A

Place Mode Switch in Shutdown Each.

eling Outage Manual Scram A

Trip Channel and Alarm Every 3 Months s

IRM High Flus C

Trip Channel and Alam (4)

Once/ Week (9)

Inoperative C

Trip Channel and Alam (4)

OnceNeek (9)

APRM High Flum (1E? Scram)

C Trip Output Relays (4)

OnceNeek (9) l High Flun (Flow Blased)

B Trip Output Relays (4)

OnceNeek High Flux (Fixed Trip)

B Trip Output Relays (4)

OnceNeek Inoperative B

Trip Output Relays (4)

OnceNeek Downscale B

Trip Output Relays (4)

OnceNeek h

Flow Ble B

(6)

High Reactor P w n re A

Trip Channel and Alam Once/ Month (1)

High Drywell '%mre A

Trip Channel and Alam Once/ Month (1)

Reactor Low 4ter Level A

Trip Channel and Alam Once/ Month (1) d s

e u--,~wn>w<w-

-.m..

..me

-e

~- -

,wnnm

~,,-w-,e n~-~~-

,sn--

- ----~ -- -

-~,-no,ne---

~v n+

e

-w

+e<wu e,n.+

+.--ww m.

1 j

-e:

NOTES FOR TABLE 4.1.A 1.

-Initially the minimum frequency for the indicated tests shall be once per i

month.

2.

A description of the three groups is included-in the Bases of this i

specification.

l 3.

Functional tests are not required when the systems are not required to be

[

OPERABLE or are operating (i.e., already tripped).

If tests are missed, they shall be performed prior to returning the systems to an OPERABLE status.

t 4.

This instrumentation is exempted from the instrument channel test definition. This instrument channel functional test will consist'of injecting a simulated electrical signal into the measurement channels.

i 5.

(Deleted) 6.

The functional test of the flow bias network is performed in accordance with Table 4.2.C.

7.

Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify l

operability of the trip end alarm functions.

8.

Functional test frequency decreased to once/3 months to reduce the i

challenges to relief valves per NUREG 0737, Item II.K.3.16.

[

9.

Not required to be performed when entering the STARTUP/ HOT STANDBY Mode i

from RUN Mode until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering the STARTUP/ HOT STANDBY Mode.

I l

1 h

e BFN 3.1/4.1-9 Unit 3

I e

i e

l 3.1 R&1El (Cont'd)

{

be accommodated which would result in slow scram times or partial control

~

rod insertion. To preclude this occurrence, level switches have been

.provided in the instrument volume which alars and scram the reactor when the volume of water reaches 50 gallons. As indicated above, there is sufficient volume in the piping to accommodate the scram without impairment of the scram times or amount of insertion of the control rods. This function shuts the reactor down while sufficient volume remains to accommodate the discharge water and precludes the situation in which a scram would be required but not be able to perform its function adequately.

A source range monitor (SRM) system is also provided to supply additional neutron level information during startup but has no scram functions.

Reference Section 7.5.4 FSAR. Thus, the IRM is required in the REFUEL (with any control rod withdrawn from a core cell containing one or more fuel assemblies) and STARTUP Modes. In the psner range the APRM system provides required protection. Reference Se~

m 7.5.7 FSAR. Thus, the IRM System is not required in the RUN mode. Asa APRMs and the IRMs provide adequate coverage in the STARTUP and intermediate range.

The high reactor pressure, high drywell pressure, reactor low water level and scram discharge volume high level scrans are required for STARTUP and RUN modes of plant operation. They are, therefore, required to be operational for these modes of reactor operation.

Because of the APRM downscale limit of 1 3 percent when in the RUN mode and high level limit of 115 percent when in the STARTUP Mode, the transition between the STARTUP and EUN Modes must be made with the APRM instrumentation indicating between 3 percent and 15 percent of rated l

power or a control rod scram will occur. In addition, the IRM system must be indicating below the High Flux setting (120/125 of scale) or a scram will occur when in the STARTUP Mode. For normal operating conditions, these limits provide assurance of overlap between the IRM system and APRM system so that there are no " gaps" in the power level indications (i.e., the power level is continuously monitored from beginning of startup to full power and from full power to shutdown).

When power is being reduced, if a transfer to the STARTUP mode is made and the IRMs have not been fully inserted (a maloperational but not i

impossible condition) a control rod block immediately occurs so that reactivity insertion by control rod withdrawal cannot occur.

l F

BFN 3.1/4.1-15 Unit 3

\\

a

.-9 4.1 R&&E1

)

The minimum functional testing frequency used in this specification is

' based on'a reliability analysis using the concepts developed in reference-(1). This concept was specifically adapted to the one-out-of-two taken twice logic of the reactor protection system. The analysis shows that the sensors are primarily' responsible for the reliability of the reactor protection system. This analysis makes use of " unsafe failure" rate

't eFperience at Conventional and nuclear-Power plants in a reliability model for the system. An " unsafe failure" is defined as one which negates i

channel operability and which, due to its nature, is revealed only when j

the channel is functionally tested or attempts to respond to a real signal. Failure such as blown fuses, ruptured bourdon tubes, faulted i

amplifiers, faulted cables, etc., which result in " upscale" or "downscale" readings on the reactor instrumentation are " safe" and will be easily recognized by the operators during operation because they are revealed by an alarm or a scram.

The channels listed in Tables 4.1.A and 4.1.B are divided into three groups for functional testing. These are:

A.

On-Off sensors that provide a scram trip function.

B.

Analog devices coupled with bistable trips that provide a scram function.

C.

Devices which only serve a useful function during some restricted mode of operation,'such as STARTUP, or for which the

]

only practical test is one that can be performed at shutdown.

The sensors that make up group (A) are specifically selected from among the whole family of industrial on-off sensors that have earned an i

excellent reputation for reliable operation. During design, a goal of 0.99999 probability of success (at the 50 percent confidence level) was adopted to assure that a balanced and adequate design is achieved. The probability of success is primarily a function of the sensor failure rate and the test interval. A three-month test interval was planned for group (A) sensors. This is in keeping with good operating practices, and satisfies the design goal for the logic configuration utilized in the Reactor Protection System.

f To satisfy the long-term objective of maintaining an adequate level of

'I safety throughout the plant lifetime, a minimum goal of 0.9999 at the 95-percent confidence level is proposed. With the (1-out-of-2) X (2) logic, this requires that each sensor have an ava!1 ability of 0.993 at the 95 percent confidence level. This level of availability may be maintained by adjus history.gingthetestintervalasafunctionoftheobservedfailure 1.

Reliability of Engineered Safety Features as a Function of Testing l

Frequency, I. M. Jacobs, " Nuclear Safety," Vol. 9, No. 4, t

July-August, 1968, pp. 310-312.

BFN 3.1/4.1-16 i

Unit 3 i

RQ' J'

4.1 A&lEl (c:nt'd)

The frequency of calibration of the APRM Flow Biasing. Network has been established at each refueling outage. There are several instruments which-must be calibrated and it will take several hours to perform the calibration of the entire network. While the calibration is being performed, a zero flow signal will be sent to half of the APRMs resulting in a half scram and rod block condition. Thus, if the calibration were performed during operation, flux shaping would not be possible. Based on experience at other generating stations, drift of instruments, such as those in the Flow Biasing Network, is not significant and therefore, to avoid spurious scrams, a calibration frequency of each refueling outage is established.

Group (C) devices are active only during a given portion of the operational cycle. For example, the IRM is active during the STARTUP/H0T STANDBY and REFUEL (with any control rod withdrawn from a core cell containing one or more fuel assemblies) Modes and inactive during full-power operation. Thus, the only test that is meaningful is the One performed prior to entering the applicable Mode (i.e., the tests that are performed prior to use of the instrument). Since testing of the IRM functions is not practical in the RUN Mode, testing is not required to be completed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering the STARTUP/ HOT STANDBY Mode from the RUN Mode. Twelve hours is based on operating experience and in consideration of providing reasonable time in which to complete the test.

Calibration frequency of the instrument channel is divided into two groups. These are as follows:

1.

Passive type indicating devices that can be compared with like units on a continuous basis.

2.

Vacuum tube or semiconductor devices and detectors that drift or I

lose sensitivity.

l Experience with passive type instruments in generating stations and i

substations indicates that the specified calibrations are adequate. For those devices which employ amplifiers, etc., drift specifications call for drift to be less than 0.4 percent / month; i.e.,

in the period of a month a drift of.4-percent would occur and thus providing for adequate margin.

For the APRM system drift of electronic apparatus is not the only consideration in determining a calibration frequency.

Change in power j

distribution and loss of chamber sensitivity dictate a calibration every seven days. Calibration on this frequency assures plant operation at or below thermal limits.

1 A comparison of Tables 4.1.A and 4.1.B indicates that two instrument I

channels have been included in the latter table. These are: mode switch I

in SHUTDOWN and manual scram. All of the devices or sensors associated with these scram functions are simple on-off switches and, hence, calibration during operation is not applicable, i.e.,

the switch is either on or off.

i BFN 3.1/4.1-18 Unit 3

.

ML20077K246

Text

Navigation menu

Search