ML20085D634
| ML20085D634 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 06/02/1995 |
| From: | TENNESSEE VALLEY AUTHORITY |
| To: | |
| Shared Package | |
| ML18038B294 | List: |
| References | |
| NUDOCS 9506160293 | |
| Download: ML20085D634 (289) | |
Text
{{#Wiki_filter:, ENCLOSURE 2 TENNESSEE VALLEY AUTHORITY (TVA) BROWNS FERRY NUCLEAR PLANT (BFN) UNITS 1, 2, and 3 PROPOSED TECHNICAL SPECIFICATION (TS) CHANGE TS-353 MARKED PAGES I. AFFECTED PAGE LIST Unit 1 Unit 2 Unit 3 1.0-7 1.0-7 1.0-7 1.0-8 1.0-8 1.0-8 1.1/2.1-2 1.1/2.1-2 1.1/2.1-2 1.1/2.1-3 1.1/2.1-3 1.1/2.1-3 1.1/2.1-7 1.1/2.1-7 1.1/2.1-7 1.1/2.1-16 1.1/2.1-16 1.1/2.1-16 3.1/4.1-3 3.1/4.1-3 3.1/4.1-2 3.1/4.1-5 3.1/4.1-5 3.1/4.1-4 3.1/4.1-6 3.1/4.1-6 3.1/4.1-5 3.1/4.1-8 3.1/4.1-8 3.1/4.1-7 3.1/4.1-10 3.1/4.1-10 3.1/4.1-9 3.1/4.1-11 3.1/4.1-11 3.1/4.1-10 3.1/4.1-12 3.1/4.1-12 3.1/4.1-11 3.1/4.1-14 3.1/4.1-14 3.1/4.1-13 3.1/4.1-15 3.1/4.1-15 3.1/4.1-14 3.1/4.1-16 3.1/4.1-16 3.1/4.1-15 3.1/4.1-17 3.1/4.1-17 3.1/4.1-16 3.1/4.1-19 3.1/4.1-19 3.1/4.1-18 3.1/4.1-20 3.1/4.1-20 3.1/4.1-19 3.2/4.2-25 3.2/4.2-25 3.2/4.2-24 3.2/4.2-26 3.2/4.2-26 3.2/4.2-25 3.2/4.2-27 3.2/4.2-27 3.2/4.2-26 3.2/4.2-50 3.2/4.2-50 3.2/4.2-49 3.2/4.2-59 3.2/4.2-59 3.2/4.2-58 3.2/4.2-60 3.2/4.2-60 3.2/4.2-59 3.2/4.2-68 3.2/4.2-68 3.2/4.2-67 3.2/4.2-73 3.2/4.2-73a 3.2/4.2-72 3.3/4.3-8 3.3/4.3-8 3.3/4.3-8 3.3/4.3-17 3.3/4.3-17 3.3/4.3-17 3.5/4.5-18 3.5/4.5-18 3.5/4.5-18 3.5-4.5-19 3.5-4.5-19 3.5-4.5-19 3.5/4.5-20 3.5/4.5-20 3.5/4.5-20 3.5/4.5-33 3.5/4.5-31 3.5/4.5-34 3.5/4.5-34 3.5/4.5-32 3.5/4.5-35 6.0-26a 6.0-26a 6.0-26a 6.0-26b II. MARKED PAGES See attached. 9506160293 950602 PDR ADOCK 05000259 P PDR m _
/'
1.0 DEF'INITIONS (Cont'd) Q. Operating Cycle - Interval LctJeep the end of one refueling outagt for
- a particular unit and the end of the next s<osequent refueling outue for the same unit.
R. Refueline Outane - Refueling outage is the period of time between the , shutdown of the unit prior to a refueling and the startup of the uni'; , after that refueling. For the purpose of designating frequency of testing and surveillance, a refueling outage shall mean a regularly scheduled outage; however, where such outages occur within 8 months of the completion of the previous refueling outage, the required surveillance testing need not be perfomed until the next regularly scheduled outage. S. CORE ALTERATION - CORE ALTERATION shall be the movement of any fuel, sources, reactivity control components, or other components affecting reactivity within the reactor vessel with the vessel head removed and fuel in the vessel. Movement of source range monitors, intermediate range monitors, traversing in-core probes, or special movable detectors (including undervessel replace =ent) is not considered a CORE ALTERATION. Suspension of CORE ALTERATIONS shall not preclude completion of movement of a component to a safe location. T. Resetor Vessel Pressure - Unless otherwise indicated, reactor vessel pressures listed in the Technical Specifications are those measured by' t the reactor vessel steam space detectors. U. Thermal Parameters
- 1. Minimum Critical Power Ratio (MCPR) - Minimum Critical Power Ratio (MCPR) is the value of the critical power ratio. associated with the most limiting assembly in the reactor core. Critical Power Ratio (CPR) is the ratio of that power in a fuel assembly, which is calculated to cause some point in the assembly to experience '
boiling transition, to the actual assembly operating power. -
- 2. Transition Boilinz - Transition boiling means the boiling regime between nucleate and film boiling. Transition boiling is the regime in which both nucleate and film boiling occur intermittently with neither type being completely stable.
- 3. kora5a#1 mud Frit tiot/of T/mitnr Parer Ddsit /(CM1EPD) The h)6 io for 1 el sem des al azi lo tio in l 5 the or , o the wh fu ro powe d ty ( /ft for g en ue sa 17 al 1 atio to e1 tin fue rod W# ow de ity /f at t ocat n.
I 4 Averare Planar Linear Heat Generation Rate (APLHGR) - The Average
. Planar Heat Generation Rate is applicable to a specific planar height and is equal to the sum of the linear heat generation rates for all the fuel rods in the specified bundle at the specified height divided by the number of fuel rods in the fuel bundle. l
( ; BFN 1.0-7 AMENDMENTNo I g 7 l Unit 1 , b: l W
t 1.0 DEFINITIONS (Cont'd)
. CORFIAXIF FRACTT I 0F CR IICAL PO WR (CME #fP) - C0 MAXIP' .
TIO F CRIT AL POWE is the imum alue of .he ra o of ef -corre ed CPR erating imit f d in e CORE OPE ING LI S REPO divide y the etual E for ass blies n the e e. i fu / - V. Instrumentation
- 1. Instrument Calibration - An instrument calibration means the adjustment of an instrument signal output so that it corresponds, within acceptable range, and accuracy, to a known value(s) of the parameter which the instrument monitors.
- 2. Channel - A channel is an arrangement of the sensor (s) and associated components used to evaluate plant variables and produce discrete outputs used in logic. A channel terminates and loses its identity where individual channel outputs are combined in logic.
- 3. Instru ent Functional Test - An instrument functional test means
, the injection of a simulated signal into the instru=ent primary sensor to verify the proper instrument channel response, alars and/or initiating action.
4 Inst ument Check - An instrument check is qualitative determination of acceptable OPERABILITY by observation of l instrument behavior during operation. This deter =ination shall include, where possible, comparison of the instrument with other independent instruments measuring the same variable.
- 5. Loric System Functional Test - A logic system functional test means a test of all relays and contacts of a logic circuit to insure all components are OPERABLE per design intent. Where l practicable, action vill go to completion; i.e., pumps vill be started and valves operated.
l 6. Trio System - A trip system means an arrangement of instrument channel trip signals and auxiliary equipment required to initiate action to accomplish a protective trip function. A trip system may require one or more instrument channel trip signals related to one or more plant parameters in order to 6 initiate trip system action. Initiation of protective action i may require the tripping of a single trip system or the
- coincident tripping of two trip systems.
- 7. Protective Action - An action initiated by the protection system when a limit is reached. A protective action can be at a channel or system level.
- 8. Protective Punction - A system protective action which results from the protective action of the channels monitoring a particular plant condition.
l 1.0-8 AMmmrr 10. 216 1 .. l J
1.. !/,2, L._ Fuel CLADDrnG InTecRITY [ _ SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 1.1 FUEL CLADDING IMTECRITY 2.1 FUEL CLADDING Thr!'EGRITY Applicability Applicability Applies to the interrelated Applies to trip settings of variables associated with fuel the instruments and devices thermal behavior-. which are provided to prevent the reactor system safety limits from being exceeded. obiective objective
- To establish limits which To define the level of the ensure the integrity of the process variables at which ;
fuel cladding. automatic protective action , is initiated to prevent the fuel cladding integrity ! safety limit from being ; exceeded. : Soecifiestions Soecifications The limiting safety system [ settings shall be as l' specified below: , i A. Thermal Power Limits - A. Neutron Flux Trio l Settings [
- 1. Reactor Pressure >800 1. APRM Flux Scram !
psia and Core Flow Trip Setting
> 10% of Rated. (Run Mode) (Flow j biased) ~
When the reactor !
. pressure is greater a. When the Mode '
than 800 psia, the Switch is in existence of a minimum the RUN , critical power ratio position, the ; (MCPR) less than 1.07 APRM flux shall constitute scram trip , violation of the fuel setting cladding tntegrity shall be: safety limit. . s k
. MFW 1.1/2.1-1 unit 1 db
_w
i 1.1/2.1 FUEL CLADDING INTEGRITY. I SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 2.1.A Neutron Flux Trio Settings 2.1.A.l.a (Cont'd) (My p 7f gj f SS(Q'.ppV/+)geyTp l' where: S = Setting in percent of rated i thermal : power (3293 MWt) W = Loop ' recirculation flow rate'in ,, percent of rated y
- b. For no combination of loop f recirculation flow rate and core thermal ,
power shall the l APRM flux scram trip setting be allowed to exceed 120% of f rated thermal i power. i BFN 1.1/2.1-2 RENMENI M. 216 Unit 1
. -i en m . .emseep eme w gem u m -
1 l 1.1/2'1
. FUEL CLADDING INTEGRITY -
i SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING i 2.1.A Neutron Flux Trio Settings 2.1.A.l.b (Cont'd) ; E0II: These settings assume s operation within the basic i thermal hydraulic design criteria. These criteria are LEGR vithin'the limits of Specification 3.5.J and MCPR ' within the limits of Specification 3.5.K. If it is determined that either of these design criteria is being violated during operation, action shall be initiated within 15 minutes to restore operation within crescribed lim 4en re AP 11' c re ires ts for 'I r set int re ive ip/'a , ec .ic .io 4.5. .
- c. The APEM Rod Block trip setting shall be less than y or equal to the limit specified in the CORE OPERATING LIMITS REPORT.
i e l l l ETN 1.1/2.1-3 At!E2MENI E. 216 Unit 1 L ;
1 1 I ( b, # L. d LA ) IW ~ N E e FI Gu f".E. 130
. t . . . 6 , , . . . . . , , , ,
g
.w..... 4.... . - . ..... ..
. . . ,..i...,..a. . , * * . , e .
..s.. ..............%.. . . . . . .
. e . . . . e , , ,
120 _ ..,. . . . .. . . . , . . . . . . . . .. .. .. . . . .. . . . . ... .. ... . . . ... ..
. , . 1
. I
_ ..,. . . .. . . . .. , i 110 2. . .
...:..z .....u.... . . .. . . .. . .
1
- .. ~A PRM. Flo.w. . . ias B.. . S c.ram ... ; , : : : : : : .
, , , , , , . 1 100 _ . ,m . . .
f . is , ,
.7..._.. . . ....... .
j o ,
, , , , , , , , , 1 90 _ . . .... .. ..... ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
c , x . . . . . . . . ......... 0 80 _.. ......._.. ...
. e , .
a e..
..........,...........,..............,..s.........
70 . e _ ..... ........ ... . .. .......... 3 , O . _ . . . . . . . . . . . _ . . . . . . . C. p._ 60 _................. .. . . . . . . . . . . . . - Design Flow Gontrol Lme e 4 o .
, i 50 _ .,. . , . . . , . . ......a.. 2. . . . , . . , . . . . . . . . . . . . , , , .
.s , , , . , , .
o . . . .
......_s.....a..2..2....u.....
. . e , , , ,
, . . , . . . , .. . . . . . . . . . . . . , .. . , .. . , .. . , . ..,e__,. .. ..,e...,_...
. s g m
, i , . i e i i . . , , ,
6Ju MD,... u MU ge s 5*.44 a.,+,m , ,
..,..... b4 As M.la ..LE4d MlJ...,,..,... .. .. . ... ,O, . . . .
v , , . . . , , , . . . 30 _ _ _ . _ .
..,.. ,. .. . ,. . s, . . s, . _ 2 20% Pump: Speed Line : : : :
.2
.i... . .u..........................,..,...s... . . . . . . .
20 _ .. . . , _ _ , . . , . ..
-. ..-_ ~,.,..,_. .. ...,..... .. ..,. . ...,...,..... .. ......._
$ . . E . .
. . . 6 . . . . , , , . .
10 . .,.8. . . .. . . . .. . . . . . . , __.,_.r._,...c._,___.___._. l 8
. , . . _. ., .. . _ _. , ... . , .._7..__. ,
0 t . , ., , .
, =
. . t 0 10 20 30 40 50 60 70 80 90 100 110 120 Core Coolant Flow Rate (% of Design)
APRM Flow Bias Scram vs. Reactor Core Flow Fig. 2.1-2 BFN .1.1/2.1_7 A M M Dtr NO 216 .,3 Unit 1
W i 130 120 . - . . . . .. . . . . . . A PRM~ Fl o. w
. . . Bi.as
. . .S c.ram 110 - ...
..r. .u.
100 . i .
. . . , , i
.........a......a.........
. . . . . . . . . . , , t
...... .. .. ,._r... . .
. c3 90 - ..... ........... . . . . . .. .
C . , cc - .. ... t 80 0 . _ . . . . . . . ... s,.% o . . . . . . . . a . . 70 -............... ,., . .. 3 . . a 1 0 ' ' ' ...._.. . .......................... .. _..
..'.... : s
.. ....' . . . . . . -Design. How Control Line g0 _ . . ' ... .. . ... .. . .
.c. . .
. g
,o .
g . . . . . . . , 50 _ . .. . . . ....... , , i a . o . ..a,..a,.a, ..a.... Z
......,...,..a...a.-.a...a......,u..,...,........
o . . . . . i O . . . . . .
. .I .
O . . , , . ,
- . . .. . .. . . . .. . . . . .. . . k, . . ........ . . ., . . . .. . . ..
30 _...
- : : : : ; l 20% Pump: Speed Line : : : ;
i .
. .z...... .
. e 7
20 - ,., . . . - , . .
. . . . , ... ..,. . , . , e . . . . .
i , i
, . s
..p .
. . p . ., r . . e - ,. . . - 3 . 3 . 3 . . ,e . . ,e. . . p . . r . . ,. . . r. . .
1 i f 4 , -
-.w.
-s--a.. f 4
6.. ,
. I e , , , ,
...........,.4.......a..w.-4,...,..A,....,=...a......
. i i . . . ,
jQ - ..,,.e.. i f . . . . . ,
, . e 4 0 . . , , , , ,
t , ,
,-, 7..., . . . , . . . . . ., . . , . . ,. 3-.--.7. . . . .
7... ..;...., . . . , 0 - . ^ .. 0 10 20 30 40 50 60 70 80 90 100 110 120 Core Coolant Flow Rate ('. of Design) APRM Flow Bias Scram vs. Reactor Core Flow t i Fig. 2.1-2 1.1/2.1-7
j 2.1- BASES (Cont'd) F. (Deleted) G. & H. Main Steam Line Isolation on Lov Pressure and Main Steam Line Isolation Scram l The low pressure isolation of the main steam lines at 825 psig was provided to protect against rapid reactor depressurization and the renulting rapid cooldovn of the vessel. The scram feature that -f occurs when the main steam line isolation valves close shuts down j the reactor so that high power operation at low reactor pressure I does not occur, thus providing protection for the fuel cladding integrity SAFETY LIMIT. Operation of the reacter at pressures lover l f than 825 psig requires that the reactor mode switch be in the j startup position, where protection of the fuel eladding integrity SAFETY LIMIT is provided by the IRM and i'EM high neutron flux scrams. Thus, the combination of main st.. m line low pressure isolation and isolation valve. closure scram assures the availability of neutron flux scram protection over the entire range of applicability of the fuel cladding integrity SAFETY LIMIT. In l addition, the isolation valve closure scram anticipates the pressure and flux transients that occur during normal or inadvertent isolation valve closure. With the scrams set at 10 percent of valve closure, neutron flux does not increase. I.J.& K. Reactor Lew Water Level Setroint for Initiation of EPCI and RCIC Closinz Main Steam Isolation Valves, and Startinz LPCI and Core Sorav Ptmes. These syste=s maintain adequate coolant inventory and provide core ! cooling with the objective of preventing excessive clad temperatures. The design of these systems to adequately perform the intended function is based on the specified lov level scram setpoint and initiation setpoints. Transient analyses r3 rted in Section 14 of the FSAR demonstrate that these conditions result in adequate safety margins for both the fuel and the system pressure. L. References
- 1. Supplemeer:1 Reload Licensing Report of Browns Ferry Nuclear Plant, Unit 1 (applicable cycle-specific document).
- 2. GE Standard Application for Reactor Fuel, NEDE-24011-P-A and NEDE-24011-P-A-US (latest approved version).
- 3. " Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactor," NEDO-24154-P, October 1978.
4 Letter from R. H. Buchholz (GE) to P. S. Check (NRC), " Response I to NRC Request For Information On ODYN Computer Model," Se t er 5, 1980
- 6. MAC M,utA G.crG4t>ED l.oAO L NE.
Lw & #40 A it.Ts rueeovcus.ui-PecGRA M A 4A LYSE.S FoR. &_OWMS F6 PAY Woc.dAE., PLA4T-lwr 1,1 Aoo a' Repc- 32433P. BFN M IDERENI NO. 216 Unit 1
= - -
o... -- g - ;;g y s -- m d' . s TABLE 3.1.A
- REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATI0f4 REQUIREMENTS c2 en .
D@ Min. No. of et Operable
- Instr.
g Channels Node 1_in Vhich Fun & Most Be Openbit
' Per Trip Shut- Startup/
lystem (11f231 Trio Function Trio Level Settina down Refuel (7) tiot Stendbv yR Action (1) 1 Mode Switch in X X X X 1.A Shutdown 1 Hanual Scram X X X X 1.A 3 IRM (16) liigh Flun 1120/125 Indicated X(22) hO X(22) X (5) 1.A on scale 3 Inoperable X X (5) 1.A APRM (16)(24)(25) E JO6) High Flum { (Flow Blased) See Spec. 2.1.A.1 1.A or 1.8 3 0r I.[ X 2-36 O High Flum (Fined Trip) i 1201C X 1.A or 1.8 or . F ,1)(ed High Flum i 15% rated power ( X(17) (15) 1.A I e N 43(It) inoperative 13) X(17) X 1.A '! 2 inasmecad e t b 44s TarVeke u(o23 h)( "$ '.A$bII$) or I* N 2 High Reactor Pressure i 1055 psig X(10) X X 1.A 2 High Drywell Pressure (14) 1 2.5 psig X(8) X(8) X 1.A 2 Reactor Low Water Level (14) 1 538" above X X X 1.A vessel aero SW
- 4. a.a rt
. a c-A. rt f---
RE - M y- n g g .i
~ v.
N I. - . 5 _ _ ________________w
h{ NOTES FOR TABLE 3.1.A { There shall be two operable or tripped trip systems for each function. 1. If the minimum number of operable instrument channels per trip system cannot be met for one trip system, trip the inoperable channels or entire
- trip system within one hour, or, alternatively, take the below listed action for that trip function. If the minimum number of operable instrument channels cannot be met by either trip system, the appropriate action listed below (refer to right-hand column of Table) shall be taken. An inoperable channel need not be placed in the tripped condition where this would cause the trip function to occur. In these cases, the inoperable thannel shall be restored to operable status within two hours, or take the action listed below for that trip function.
A. Initiate insertion of operable rods and complete insertion of all operable rods within four hours. In refueling mode, suspend all operations involving core alterations and fully insert all operable control rods within one hour. B. Reduce power level to IRM range and place mode switch in the STARTUP/ HOT Standby position within 8 hours. C. Reduce turbine load and close main steam line isolation valves within 8 hours. 806EET D. Reduce power to less than 30 percent of rated. B >
- 2. Scram discharge volume high bypass may be used in shutdown or refuel to bypass scram discharge volume scram with control rod block for reactor protection system reset.
- 3. Bypassed if reactor pressure is less than 1055 psig and mode switch not in RUN.
- 4. Bypassed when turbine first stage pressure is less than 154 psig.
- 5. IRMs are bypassed when APRMs are onseale and the reactor mode switch is in the RUN position.
- 6. The design permits closure of any two lines without a scram being initiated.
- 7. When the reactor is suberitical and the reactor water temperature is less than 212 0 F, only the following trip functions need to be operable:
A. Mode switch in shutdown B. Manual scram
, C. High flux IRM D. Scram discharge volume high level E. e)chtls} (
BFN 3.1/4.1-5 Unit 1
e - . . . INSERT B: - E. For the APRM functions only, if only two APRM channels are OPERABLE, restore a third APRM channel to OPERABLE status or trip one of the , inoperable APRM channels within 6 hours. If only one APRM channel is OPERABLE, trip one inoperable APRM channel immediately and restore an inoperable APRM channel to OPERABLE status or initiate alternative action within 2 hours. , F. For the APRM functions only, if one voter channel is inoperable in one trip system, restore the voter channel to OPERABLE status or trip the inoperable channel or the entire trip system within 12 hours. If one voter channel is inoperable in both trip systems, restore the inoperable voter channels to OPERABLE status or initiate alternative action within 6 hours. 1 I l I
= _ ._ - _
l NOTES FOR TABLE 3.1.A (Cont'd) SEP 2 71994
- 8. Not required to be OPERABLE vhen primary containment integrity is not l1 required.
~
- 9. (Deleted) d ]
- 10. Not required to be OPERABLE vhen the reactor pressure vessel head is not bolted to the vessel, ggp /,,g
- 11. A RM d r f)dic/ ion /is [1/agdi[
7 v%n J/j le z/ea or/
- 12. P o .s e u y yller/'thf JR,X p
- 13. Less than h OPERABLZ LPRMs vill cause (4d g if pys tp.m ff .h w p q
hared by Reactor Protection System and Primary Contafr e c i 4 Chann ' F Reactor vessel Isolation Control System. A channel failure may be a channel failure in each syste=.
- 15. ~'he APRM 15 percent scram is bypassed in the RCTN Mode.
- 16. Channel shared by Reactor Protection System and Reactor Manual Control Syste= (Rod Block Portion). A channel failure may be a channel failure in each system. If a channel is allowed to be inoperable per l Table 3.1.A, the corresponding function in that same channel may be W inoperable in the Reactor Manual Control System (Rod Block).
- 17. Not required while performing lov power physics tests at atmospheric pressure during or after refueling at power levels not to exceed 5 .W(t) .
- 18. This function must inhibit the automatic bypassing of turbine control valve fast closure or turbine trip scram and turbine stop valve closure :
scram whenever turbine first state pressure is greater than or equal to . 154 psig.
- 19. Action 1.A or 1.D shall be taken only if the permissive fails in such a manner to prevent the affected RPS logic from performing its intended function. Otherwise, no action is required.
- 20. (Deleted) -l -
~
- 11. rTh . g ?
/
an op .a .v
- ip d n v t/'b o p l e . od i t e o e R Mc .t rs a e nnrce o ieg 5 l
_o cob d n , i 1 s , t5. s f The SRMs shall be ~ i The removal of eight (8) shorting l [(OPERABLEperSpecification3.10.3.1. links is required to provide nonceincidence high-flux scram protection from the @gege #,angejMgn;irt.6fg ' n ___ o i SRM.s. Mflue a5 kmf 15 BFN 3.1/4.1-6 AMENDMENT NO. 212 Unit 1 t r- e - _
Q ~ The same three (3) required APRM channels are shared by both RPS trip systems. - __ D -- Any combination of APRM upscale or inoperative trips from two different (non-bypassed) APRMs will trip all of the 2/4 voter units. x ,. . _ _ - - - INSERT E: 3 _ _ In the REFUEL Mode unless adequate shutdewn margin has been demonstrated per Specification 3.3. A.1, whenever any control rod is withdrawn from a core cell containing one or more fuel assemblies, shorting links shall be removed from the RPS circuitry to enable the Source Range Moniter (SPli) noncoincidence high-flux scram function.
,, [.. .., .
E- , . . i O r l - TABLE 4.1.A REACIOR PROTER. TION SYSTEM (SCRAM) INSTRUMENTATION FUNCTIONAL TESTS NININUH FUNCTIONAL TEST FREQUENCIES FOR SAFETY INSTR. AND CONTROL CIRCUITS Group (2.1 Functional Teti Minimum Frecuencvf3) e-Mode Switch in Shutdown A Place Mode. Switch in Shutdown Each Refueling Outage w Manual Scram A Trip Channel and Alarm Every 3 Honths IRM High Flum C Trip Channel and Alarm (4) OnceNeek During Refueling and Before Each Startup Inoperative C Trip Channel and Alarm (4) OnceNeek During Refueling and Before Each Startup APRH High Fluu (15% Scram) Trip Output Relays (4) (5) e m r: E e e 5 t : r t ,, ei,d EVER;f(,Moggs(y)
;7 ";^;ir;d t 11 4 VOTEE Logic, (to)* L'iiu s
/ , - -- - ha Onorable
- - - - EACH WLIMC, OUTA6E-High Flum (Flow Blased)- l Trip Output Relays (4) (O 0..i Nii% EVEEY (. MouMS u 2 J 4. voTEE. Lo&l C (f o) - . - - - - - - - - - - EACA CEFUELa 4G ottrA&E.
l
~ High Fluu (Flued Tr'ip) { Trip Output Relays ( ) (5) Or::.^'::k svsa,y 4 uooms g Inoperative 24 voTEE L.oG4 C ( & - * * -
Tri Out t Relays (4 5)
- g g g g 4 m g G.
0,,c ; N;; h EVER.Y (, uo4T45 21 t- Lcsec 101 EA cs4 REFosucc oorn,E. 7 m f al B rip tp Rela (4) ic e ek t F ow as ( r liigh Reactor Pressure A Trip Channel and Alarm Once/ Month (1) High Drywell Pressure A Trip Channel and Alarm Once/ Month (1) Reactor Low Water Level A Trip Channel and Alarm Once/Honth (1)
' ~
i# - f he $ Y FAsus ag g py bd W[
~
l . j
, - - -~ . - - - - . .
~
)
l i e-s mR tat! 4.t.A
- 1. Initially the minimum frequency for the indicated tests shall be ence per '
month.
- 2. A description of the three groups 1.s included in the Bases of this specificacico. i
- 3. Functicnal tests are not required wnen ene systems are not required to be >
eperacle or are operating (i.e. , already tripped) . If tests are missed. eney snail be perfor=ed prior to returning the systems to an cperacie i status.
- 4. his instrumentatien is esempted frem.'ene instrument enannel test i definition. nis instrument enannel func'tional test will consist of l injecting a simulated electric.31 signal into the measurement enannels.
1-
& $wdF ji'epLe u,
, ) 7.
- 'n'? CT.f'/ 'f**/& W""I'VP$ Lud C.
Functional test censists of the l'njectico of a simulated signal into ene . electrcnic trip circuit.y in place of tne sensor tignal to verify cperacility cf the trip end alarm functicas.
- 8. One functienal test frequency decreased to ence/3 months to reduce challenges to relief valves per .VURE:: 0"73~7, Item II.K.3.16.
1
!M
- 9. Not required to be performed when entering the STARTUP/ HOT STANDBY Mode from RUN Mode until 12 hours after entering the STARTUP/ HOT STANDBY Mode.
- 10. Functional test consists of simulating APRM trip conditions at the APRM channel outputs to check all combinations of two tripped inputs to the 2/4 voter logic in each voter channel.
- 11. Functional test consists of manually tripping the 2/4 voter f trip output, one voter channel at a time, to demonstrate that each scram contactor for each RPS trip system channel (A1, A2, B1 and B2) operates and produces a half-scram.
INSERT F: The channel functional test shall include both the APRM channels and Q e 2/4 voter channels. INSERT - G: -
! The channel functional test shall include both the APRM channels and
}
the 2/4 voter channels plus the flow input function, excluding the flow transmitters. < W 3.1/4.1-10 unit 1 y_..
va a - . ... ., , TABLE 4.1.8 REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION CALIBRATION MINIMUM Call 8 RAT 10N FREQUENCIES FOR REACTOR PROTECTION INSTRUMENT CHANNELS c ta
@ Instrument Channel Group (11 Calibration Minimum Frecuencvf21
- IRM High Flum C Comparison to APRM on Controlled Note (4)
Startups (6) APRM High Fluz Output Signal Heat Balance Once/7 Days Flow Blas Signal Calibrate Flow Blas Signal (7) Once/ Operating Cycle lLPRM Signal ' TIP System Traverse (8) Every 1000 Effective Full [LA'f f Power Hours High Reactor Pressure - A Standard Pressure Source Every 3 Months High Orywell Pressure A Standard Pressure Source Every 3 Months Reactor Low Water Level A Pressure Standard Every 3 Months "Igh Water Level in Scram 's u Discharge Volume
- Electronic Lvl Switches
% (LS-85-45-A, 8. G H) A Calibrated Water Column (5) Note (5) ! '
- Float Switches i
- (LS-85-45C-F) A Calibrated Water Column (5) Note (5)
Main Steam Line Isolation Valve Closure A Note (5) Note (5) Turbine First Stage Pressure ' Permissive (PT-1-81A, 8 & PT-1-91A, 8) 8 Standard Pressure Source Once/ Operating Cycle (9) , Turbine Control Valve Fast Closure
- n, or Turbine Trip A Standard Pressure Source Once/ Operating Cycle M
Turbine Stop Valve Closure A Note (5) Note (5)
= mu ,
to.
- ~
P s to m bd
- TQ .
)
${p 2 7 jgg4 NOTES FOR TABLE 4.1.B ;
- 1. . A description of three groups is included in the bases of this specification. ,
- 2. Calibrations are not required when the systems are not required to be i OPERABLE or are tripped. If calibrations are missed, they shall be l performed prior to returning the system to an OPERABLE status. l
- 3. (Deleted) d 4 Required frequency is initial startup following each refueling outage.
- 5. Physical inspection and actuation of these position switches will be performed once per operating cycle.
- 6. On controlled startups, overlap between the IRMs and APEMs will be verified.
- 7. The l o* iae Signa' Calib ation .11 cone st of librating the nsors f ve nyer ers, .d sig 1 off- t netv As durd .g each erati.g cyc' .
e nst r- enta on is .n ana' g type ith red ndant # ov si als t c t i c be separ Th flov eparat trip .d upse e vil be Ref'L . W . .:nct' 'nally test ed accord ng to le 4.'.C to e* ure t pro g g cf ope- tion ring e op ating c cle. fer to .1 Ba s fo furth lanat' n of libra on fre ency. q ,
- 3. A co=plete TIP system traverse calibrates the LPRM signals to the process computer. The individual LPRM meter readings vill be adjusted as a W minimum at the beginning of each operating cycle before reaching 100 percent power.
- 9. Calibration consists of the adjustment of the primary sensor and associated components so that they correspond within acceptable range and accuracy to known values of the parameter which the channel monitors, including adjustment of the electronic trip circuitry, so that its output ,
relay changes state at or more conservatively than the analog equivalent , of the trip level setting.
^
INSERT H: ~_ ,
}t The flow bias signal calibration will consist of calibrating the analog differential pressure flow sensors once per operating cycle. r l Calibration of the flow bias processing system is done once per operating cycle as part of the overall APRM instrumentation calibration.
_ w P (-
. \
BFN 3.1/4.1-12 AMENDMENT NO. 212 ) Unit 1 6 _ - _
3.1 BASES i
'/
The reactor protection system automatically initiates a reactor scram to: t
-1. Preserve the integrity of the fuel cladding.
- 2. Preserve the integrity of the reactor coolant system. l
- 3. Minimize the energy which must be absorbed following a loss of ;
coolant accident, and prevents criticality. This specification provides the limiting conditions for operation necessary to preserve the ability of the system to tolerate single failures and still perform its intended function even during periods when instrument channels may be out of service because of maintenance. When necessary, one channel may be made inoperable for brief intervals to conduct required functional tests and calibrations.
~
The reactor protection trip system is supplied, via a separate bus, by its own high inertia, ac motor-generator set. Alternate power is , available to either Reactor Protection System bus from an electrical bus ? that can receive standby electrical power. The RPS monitoring system provides an isolation between nonclass II power supply and the class lE RPS bus. This vill ensure that failure of a nonclass lE reactor protection power supply will not cause adverse interaction to the class lE Reactor Protection System. The reactor protection system is made up of two independent trip syste=s 4 (refer to Section 7.2, FSAR). There are usually four channels provided to monitor.each critical parameter, with two channels in each trip system. The outputs of the channels in a trip system are combined in a logic such that either channel trip vill trip that trip system. The + simultaneous tripping of both trip systems will produce a reactor scram. , This system meets the intent of IEEE-279 for Nuclear Power Plant Protection Systems. The system has a reliability greater than that of a ' 2-out-of-3 system and somewhat less than that of a 1-out-of-2 system. With the exception of the Average Power Range Monitor (APRM) channels, ; the Intermediate Range Monitor (IRM) ehannels, the Main Steam Isolation Valve closure and the Turbine Stop Valve closure, each trip system logic has one instrument channel. When the minimum condition for operation on the number of operable instrument channels per untripped protection trip system is met or if it cannot be met and the effected protection trip system is placed in a tripped condition, the effectiveness of the protection system is preserved; i.e., the system can tolerate a single failure d.11 perform its intended function cf scramming the cpi"';h577"/77'I777T'77777'92 m . msar - 1 I l ( l BFN 3.1/4.1-14 Unit 1 1 l l
INSERT I: The APRM system is divided into four APRM channels and four 2-out-of-4 trip voter channels. Each APRM channel provides input to each of the four voter channels. The four voter channels are divided into two groups of two each, with each group of two providing inputs to one RPS trip system. The APRM system is designed to allow one APRM channel, but no voter channels, to be bypassed. A trip from any one unbypassed APRM will result in a " half-trip" in all four of the voter units, but no trip inputs to either RPS trip system. A trip from any two unbypassed APRM channels will result in a full trip in each of the four voter channels, which in turn results in two trip inputs into each RPS trip system resulting in a full scram. Each APRM instrument channel receives input signals from forty-three (43) Local Power Range Monitors (LPFMs). A minimum of twenty (20) LPRM inputs with three (3) per axial level is required for the APPR instrument channel to be OPERABLE. Fewer than the required minimum number of LPRM inputs generates an instrument channel inoperative alarm and a control rod block but does not result in an automatic trip input to the 2-out-of-4 voters.
-- ~
I l 1 l l 1 I 1 l l l l
t t 3.1 EASIS (Cont'd) E 0 71994 Each protection trip system has one more 47 than is necessary to meet. th( minimum number required per channel. This allows the bypassing of [' one @ per otection trip system for maintenance, testing or Is/hpty' a)so Aepn Aryvfde5V96 fly @ f/yttnyi calibration.
@r/ pipp's/ ow)e fur.fR7 c e . [The bases for the scram setting for n gn f the IRM, AFRM, high reactor pressure, reactor low water level, MSIV ,
closure, turbine control valve fast closure and turbine stop valve _
-closure are discussed in Specifications 2.1 and 2.2. ,
Instrumentation (pressure switches) for the dryvell are provided to
- detect a loss of coolant accident and initiate the core standby cooling equipment. A high dryvell pressure scram is provided at the same setting as the core cooling systems (CSCS) initiation to minimite the energy which must be accommodated during a loss of coolant accident and to !
prevent return to criticality. This instrumentation is a backup to the ! reactor vessel vater level instrumentation. [' _ t A reactor mode switch is provided which actuates or bypasses the various scram functions appropriate to the particular plant operating status. Reference Section 7.2.3.7 FSAR. The manual scram function is active in all modes, thus providing for a > I manual means of rapidly inserting control rods during all modes of reactor operation. L The IRM system (120/125 scram) in conjunction with the APRM system . (15 percent scram) provides protection against excessive power levels and e short reactor-periods in the startup and intermediate power ranges. { The control rod drive scram system is designed so that all of the water which is discharged from the reactor by a scram can be accommodated in ; the discharge piping. The discharge volume tank accommodates in excess of 50 gallons of water and is the low point in the piping. No credit was ! taken for this volume in the design of the discharge piping as concerns ! the amount of water which must be accommodated during a scram. During ! normal operation the discharge volume is empty; however,.should it fill with water, the water discharged to the piping from the reactor could not r f l BFN 3.1/4.1-15 E E. I N Unit 1 4
t 3.1 BASES,(Cont'd) f be accommodated which would result in slow scram times or partial control
-( rod insertion. To preclude this occurrence level switches have been provided in the instrument volume which alarm and scram the reactor when the volume of water reaches 50 gallons. As indicated above, there is sufficient volume in the piping to accommodate the scram without impairment of the scram times or amount of insertion of the control rods. This function shuts the reactor down while sufficient volume remains to acccramodate the discharge water and precludes the. situation in which a scram'would be required but not be able to perform its function adequately.
A source range monitor (SRM) system is also provided to supply additional neutron level information during startup but has no scram functions. Reference Section 7.5.4 PSAR. Thus, the IRM is required in the REFUEL and STARTUP modes. In the power range the APRM system provides required protection. Reference Section 7.5.7 PSAR. Thus, the IRM System is not required in the RUN mode. The APRMs and the IRMs provide adequate coverage in the startup and intermediate range. The high reactor pressure. high drywell pressure, reactor low water level and scram discharge volume high level scrams are required for STARTUP and RUN modes of plant operation. They are, therefore, required to be operational for these modes of reactor operation. The requirement to have the scram functions as indicated in Table 3.1.1 operable in the REFUEL mode is to assure that shif ting to the REFUEL mode during reactor power operation does not diminish the need.for the reactor protection system. g gg
'[q W Because of the APRM downsea limit of 1 3 percent when in the RUN mode and high leveQlimit of sl5 percent when in the STARTUP Mode, the transition between the STARTUP and RUN Modes must be made with the APRM -
instrumentation indicating between 3 percent and 15 percent of rated ; powerCdr/r g6r)Crvl fo4/sgrapr $1,2' pcM. In addition. the IRM system
~
must be indicating below the Hign Flux setting (120/125 of scale) or a scram will occur when in the STARTUP Mode. For normal operating conditions, these limits provide assurance of overlap between the IRM system and APRM system so that there are no " gaps" in the power level indications (i.e.. the power level is continuously monitored from
, beginning of startup to full power and from full power to shutdown).
When power is being reduced, if a transfer to the STARTUP mode is made and the IRMs have not been fully inserted (a saloperational but not impossible condition) a control rod block immediately occurs so that reactivity insertion by control rod withdrawal cannot occur.
+
r
*/ ,
t' BFW 3.1/4.1-16 i
.$ Unit 1
=>
iwra- -.m,,
r.
~~~~ s-- -
$hN N &(
4.1 BASES cu QeyLp , The einimum functional testing frequency used in this specification is' ' based on a reliability analysis using the concepts developed in reference. * (1). This concept was specifically adapted to the one out of- two takr n twice logic of the reactor protection system. The analysis shows that the , sensors are primarily responsible for the reliability of the reactor protection system. This analysis makes use of " unsafe failure" rate ; experience at conventional and nuclear power plants in a reliability model
~
for the system. An " unsafe failure" is defined as orie which negates ' channel operability and which, due to its nature..is revealed only when the channel is functionally. tested or attempts to' respond to a real -i signal. Failure such as blown fuses, ruptured bourdon tubes, faulted > amplifiers, faulted cables, etc. which result in " upscale" or "downscale" ' readings on the reactor instrumentation are " safe" and will be easily : recognized by the operators during operation because they are revealed by ; an alarm or a scram. -
/he channels listed in Tables 4.1.A and 4.1.B are divided into three r groups for functional testing. These are:
A. On-Off sensors that provide a scram trip function. B. Analog devices coupled with bistable trips that provide a scram ,
, function. j C. Devices which only serve a useful function during some restricted mode of operation, such as STARTUP or SHUTDOWN. or for which the ;
only practical test is one that can be performed at shutdown. t The sensors that make up group (A) are specifically selected from among i the whole family of industrial on-off sensors that have earned an excellent reputation for reliable operation. During design, a goal of .; 0.99999 probability of success (at the 50 percent confidence level) was i adopted to assure that a balanced and adequate design is achieved. The , probability of success is primarily a function of the sensor failure rate i and the test interval. A three-month test interval was planned for group r (A) sensors. This is in keeping with good operating practices, and ' satisfies the design goal for the logic configuration utilized *in the - Reactor Protection System. * , To satisfy the long-ters objective of maintaining an adequate level of safety throughout the plant lifetime, a minimum goal of 0.9999 at the 95 percent confidence level is proposed. With the (1-out-of*2) X (2) logic, this requires that each sensor have an availability of 0.993 at the 95 percent confidence level. This level of availability may be maintained by l adjustin i history.gthetestintervalasafunctionoftheobservedfailure
. 1. Reliability of Engineered Safety Features as a Function of Testing Frequency. I. M. Jacobs. " Nuclear Safety." Vol. 9. No. 4 July-August, 1968, pp. 310-312.
BFW 3.1/4.1-17 Unit 1 1
, . , - r- ,,.,r- -
--w -w'> e r - ' 4 we -
4.1 BASES (Cont'd) e_ lib atio 'of e F1 Bi ing N wor has.been est 11 ed as e ch r fuel ng age The e ar sever 1 in trum ts ich mue b ca bra ed a d it will ake sever 1 ho s to erfo m th c ib ati of he ntir net rk. Whil the alibr tio is b ing rf rme , a ero low ignal wil be s nt t half ft AP s r sult ng n hal se am a d r bloc co ditio . us, i the cali rati n we e pe or dd ing oper ion, flu shap ng uld n t be poss ble. Bas d e eri nce to er nera ing stat ns, rift f in tr nts suc as ose in t e F B sin Net rk, s no sign fica t a th efo , voi spu iou ser s, cal rat n fr quer.c of ach ofu in out ge is est blis ed. _ f _ Group (C) devices are active only during a given portion of the operational cycle. For example, the IRM is active during STARTUP and inactive during full power operation. Thus, the only test that is meaningful is the one performed just prior to SHUTDOVN or STARTUP: 1.e., the tests that are performed just prior to use of the instrument. Calibration frequency of the instrument channel is divided into two groups. These are as follows:
- 1. passive type indicating devices that can be compared with like units on a continuous basis.
- 2. Vacuum tube or semiconductor devices and detectors that drift or lose sensitivity.
Experience with passive type instruments in generating stations and substations indicates that the specified calibrations are adequate. For those devices which employ amplifiers, etc., drift specifications call for drift to be less than 0.4 percent / month; i.e., in the period of a. month a drift of 4 percent would occur and thus providing for adequate margin. For the APRM system drift of electronic apparatus is not the only consideration in determining a calibration frequency. Change in power i distribution and loss of chamber sensitivity dictate a calibration every , seven days. Calibration on this frequency assures plant operation at or below thermal limits. A comparison of Tables 4.1.A and 4.1.8 indicates that two instrument channels have been included in the latter table. These are: mode switch in SHUTDOWN and manual scram. Ali of the devices or sensors associated with these scram functions are simple on-off switches and, hence, calibration during operation is not applicable, i.e., the switch is either on or off. , 7
][nsefOf BFW 3.1/4.1-19 Unit I w
INSERT J: -' The APRM and 2-out-of-4 voter channel he.rdware is prov .ed with a self-test capability which automatically checks most of the critical hardware at least once per 15 minute interval whenever the APRM channel is in the operate mode. This provides a virtually I continuous monitoring of the essential APRM trip functions. In the event a critical fault is detected, an " inoperative" trip signal results. A fault detected in non-critical hardware results in an
" inoperative" alarm. Following receipt of an " inoperative" trip or alarm signal, the operator can employ numerous diagnostic testing options to Jocate the problem. t The automatic self-test function is supplemented with a manual APRM i trip functional test, including the 2-out-of-4 voter channels and I the interface with the RPS trip systems. In combination with the virtually continuous self-testing, the manual APRM trip functional test provides adequate functional testing of the APRM trip function.
Therefore, the six-month test frequency for the manual testing provides an acceptable level of availability of the APRM. In addition to the above tests, the 2-out-of-4 voter is used to test the RPS scram contactors. The output of each voter channel is tripped to produce a scram signal into each of the RPS trip system channels (A1, A2, B1 and B2) to individually operate the respective scram contactors. The weekly test interval provides an acceptable level of availability of the scram contactors. Each APRM receives the output signals from two analog differential pressure flow transducers, one associated with recirculation loop A and the other with recirculation loop B. These differential
- pressure signals are converted into representative digital loop flow signals within the same hardware that performs the APRM functions and are added to determine a total recirculation flow. The total recirculation flow value is used by the APRM to determine the flow biased setpoints. Each total recirculation flow signal developed by an APRM is compared in the hardware that performs the RBM functions to the signals from the remaining three APRMs. An alarm is given if a preset compare level setpoint is exceeded. The flow processing is integrated with the APRM processing and is covered by the same self-test and alarm functions described earlier. As a result of the virtually continuous monitoring of the equipment performing the flow processing, and the automatic comparison of redundant flow signals, it is acceptable to calibrate this equipment once per operating cycle.
' s 9
l 4.1 BASES (Cont'd) _ P00(201993 i The sensitivity of LPRM detectors decreases with exposure to neutron flux at a slow and approximately constant rate. The APRM system, which uses the LPRM readings to detect a change in thermal power, will be calibrated every seven days using a heat balance to compensate for this change in sensitivity. The RBM system uses the LPRM reading to detect a localized change in thermal power. It applies a correction factor based on the APRM output signal to determine the percent thermal power and therefore any change in LPRM sensitivity is compensated or by the APRM calibration. The technical specification limits of CPggf'and APLHGR are l determined by the use of the process comp r or.other backup methods. These methods use LPRM readings and TIP data to determine the power distribution. Compensation in the process computer for changes in LPRM sensitivity will be made by performing a full core TIP traverse to update the computer calculated LPRM correction factors every 1000 effective full power hours. As a minimum the individual LPRM meter readings will be adjusted at the beginning of each operating cycle before reaching 100 percent power. i l l l t l l i I l i BFN 3.1/4.1-20 AMENDMENT NO.19 7 , Unit 1
+
TABLE 3.2.C INSTRUHENTATION TitAT INIIIATES R00 BLOCKS A* Hinlsue Operable bE
" Channels Per Trio Function (5) Fungilon Trip tevel_1gitino 3 hl) APRM Upscale (Flow Blas) (2) 3 hl) APRM Upscale (Startup Mode) (0) 1121 3 @l) APRM Downscale (9) 131 3 @ l) APRM Inoperative (10b) t PbtoEP--
2(7) 2(7) RSH Upscale (How Blas) h RB Downscale(9)(jJ) h f") 2(7) R8H Inoperative (10c) 6(1) IRH Upscale (8) 1108/125 of full scale 6(1) IRH Downscale (3)(8) 15/125 of full scale [ 6(1) 1RH Detector not in Startup Position (8) (11) Y 6(1) IRH Inoperative (8) (10a) U 3(1) (6) 5RH Upscale (8) i 1x10 5 c,,ng,f,,c, 3(1) (6) $RH Downscale (4)(8) 13 counts /sec. 3(1) (6) SRH Detector not in Startup Position (4)(8) (11) 3(1) (6) SRM Inoperative (8) (10a) { ( lo Blas rator <101 iff one in re ircul lon f ws
, ow as scale 51 oc ulat . (1 1 Rod Block Logic N/A P8 1(12) lingh Water Level in West 125 gal.
Scram Discharge Tank i A@ (LS-85-45L) l $ 1(12) liigh Water Level in East 125 gal. Scram Discharge Tank U (LS-85-45H) m Lea Pena, f , (g3 ) 00 l h%eltsh aa rR e(I3) 04) l yy Poav r%,e os> cM>
_ m NOTES FOR TABLE 3.2.C !
- 1. The minimum number of operable channels for each crip function is detailed for the startup and run positions of the reactor mode selector switch. The SRM, IRM, and APRM (startup mode), blocks need not be operable in "run" mode, and the APRM (flow biased) rod blocks need not be operable in "startup" mode.
With the number of OPERABLE channels less than required by the minimum OPERABLE channels per trip function requirement, place at least one inoperable channel in the tripped condition within one hour.
- 2. The trip level setting shall be as specified in the CORE OPERATING LIMITS REPORT. *
- 3. IRM downscale is bypassed when it is on its lowest range.
4 SEMs A and C downscale functions are bypassed when IRMs A, C, E, and G are above range 2. SRMs B and D downscale function is bypassed when IRMs B, D, F, anti H are above range 2. SEM detector not in startup position is bypassed when the count rate
, is 1100 CPS or the above condition is satisfied.
5. During repair or calibration of eouiement, not more than one SEM g REM# channel nor more than two ((P2tVgy)IRM channels may be bypassed. a
- c. Bypassed channels are not counted as operable channels to meet the minimum operable channel requirements. Refer to section 3.10.B for '
3 SEM requirements during core alterations.
- 6. IRM channels A, E, C, G all in range 8 or above bypasses SEM channels A and C functions.
IRM channels B, F, D, H all in range 8 or above bypasses SEM channels B and D functions.
- 7. The following operational restraints apply to the RBM only.
- a. Both RBM ehannels are bypassed when reactor power is ,130 percent or when a peripheral control rod is selected.
l
- b. The RBM need not be operable in the "startup" position of the reactor mode selector switch.
Ipsser K d.b Two RBM channels are provided and only one of these may be bypassed from the console. If the inoperable channel cannot be restored within 24 hours, the inoperable channel shall be placed in the tripped condition within one hour. j
- e. K. With both RBM channels inoperable, place at least one inoperable rod block monitor channel in the tripped condition within one hour.
BFN 3.2/4.2-26 AME2GH!NI ND. 216
. . . . . . - - . --..- -. - 1
- i
n.: t t INSERT K: -
~
~- _- _
i 7.c. The RBM need not be' OPERABLE if either of the following two f conditions is met: , (1) Reactor thermal power is 190 percent of rated and [ MCPR is 2 1 40, or [ (2) Reactor thermal power is <90 percent of rated and MCPR is 21.70, i s __ - l t e 5 l r h f
- h. !
h 3 ! i t 1 1 i l I I
[ NOTES FOR TABLE 3.2.C (Cont'd)
- 8. This function is bypassed when the mode switch is placed in 2UN.
- 9. This function is only active when the mode switch is in EUN. This function is automatically bypassed when the IRM instrumentation is OPERABLE and not high.
l
- 10. The inoperative trips are produced by the following functions:
- a. SEM and IRM (1) Local " operate-calibrate" switch not in operate.
(2) Power supply voltage lov. (3) Circuit boards not in circuit.
- b. APEM 7 yg gggg (1) Local " operate-calibrate" switch not in operate. N"*/td er- ,
(2) Less than h M inputs. (3 (Gd(Inf bd$ar@!I y6t/i;/c/ry61w0 00 4 S E L.F - T"e ST' DE,hc;rco C2mcAL/ PAvLh 3 (1) Local " operate-calibrate" switch not in operate. (2)frdr/M /ar/s drAn/!,r6@f R6M MODOLE. UMPwc,6EO) (3) REM falls to null. (4) Less than required number of D N 4=ar*= far ved selected.
- 11. e
( 5 ) SELF- TE,57- perEC.rEO D{tecTor unverse is adjusted to 1142 Cerric.AL. FA M. ) inenes, placing the detector lover position 24 inches below the lower core plate.
- 12. This function may be bypassed in the SHUTDOWN or REFUEL mode. If this function is inoperable at a time when OPERABILITY is required l the r hannel shall be tripped or administrative controls shall be ;
immediately imposed to prevent control rod withdrawal.
, )
in IMI RE
]
BFN 3.2/4.2-27 AMENIIEME 20. 216 Unit 1
a a 1 1 l r INSERT L: .
- 13. The RBM rod block trip setpoints and applicable power ranges are specified in the CORE OPERATING LIMITS REPORT (COLR).
- 14. Less than or equal to the setpoint allowable value specified i in the COLR. !
- 15. Greater than or equal to - the setpoint allowable value specified in the COLR.
2 r b I 5 f
)
b i i i P n i i V t w- - .- ,
f 3 D. t TABLE 4.2.C SURVEILLANCE REQUIREMENTS FOR IN$1RUMENTATION THAT INITIATE R00 BLOCKS d* Functlen function.Al b il (111bration (17) Inttrument Check TPE 'Ar s nce/ day (B) APRH Upscale (Flow Blas) (1) (13) onc e /Edef><t'}M Cm Aridt Upscale (Startup Mode) (1) (13) once 6 44 % dd once/ day (8) APRH Downscale a (1) (13) onceQA4npuSl once/ day (8) APRtiInoperattve (1) (13) N/A once/ day (B) fM @ e/3*v4SD % tj A RBH Upscale M4ew Blas) .(1) (13) onc e@'m(4t W) RBH Downscale (1) (13) once M E 6 het/4rf 4& D +. (1) (13) N/A Ce9f tfddy( @ RB,H Inoperative (1)(2) (13) once/3 months once/ day (B) IRH Upscale (13) once/3 months once/ day (8) IRH D'ownscale (t)(2) 1RH Detector Hot in Startup Position (2) (once operating cycle) once/cperating cycle (12) N/A-4 (1)(2) (13) N/A N/A 1RH Inoperative (t)(2) (13) once/3 months once/ day (8) SRH Upscale (1)(2) (13) once/3 months once/ day (8) SRH Downscale i 8 SRM Detector Hot in Startup Position (2) (once/ operating cycle) once/ operating cycle (12) N/A (1)(2) (13) N/A N/A SRH Inoperative nce/ eratl. cyc (20 7 F ow la omp ato (1 5) g ' F w sU cal # 1)(75) o /3 e hs Rod Block Logic (16) N/A N/A West Scram Discharge once/ quarter once/ operating cycle N/A Q a Tank Water Level liigh
- ss (LS-85-45L) Q y
.O once/ quarter once/ operating cycle N/A East Scram Discharge M Tank Water Level High o C (LS-85-45H)
G$ 8 1 i i
.g-NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2. D AND 4.2.K.
'JAN 261989 .
( rot snus Ano snug 3j ' 1.[functionaltestsshallbeperformedoncepermonth. Fost APtus Auo RBMS ' Fv9exiourt. TE.ws, saAu- ec Ptuoamp oo cs- pgp_ g pe7us.
- 2. Functional tests shall be performed before each startup with a required frequency not to exceed once per week.
- 3. This instrumentation is excepted from the functional test definition.
The functional test will consist of injecting a simulated electrical signal into the measurement channel. ,
- 4. Tested during logic system functional tests.
- 5. Refer.to Table 4.1.B. j
- 6. The logic system functional tests shall include a calibration once per operating cycle of time delay relays and timers necessary for proper functioning of the trip systems.
- 7. The functional test will consist of verifying continuity across the inhibit with a volt-ohmmeter.
- 8. Instrument checks shall be performed in accordance with the definition of '
instrument check (see Section 1.0, Definitions). An instrument check is not applicable to a particular setpoint, such as Upscale, but is a ' qualitative check that the instrument is behaving and/or indicating in an acceptable manner for the particular plant condition. Instrument-check is included in this table for convenience and to indicate that an instrument check will be performed on the instrument. Instrument checks are not required when these instruments are not required to be OPERABLE I or are tripped.
- 9. Calibration frequency shall be once/ year.
- 10. Deleted
- 11. Portion of the logic is functionally tested during outage only.
- 12. The detector will be inserted during each operating cycle and the proper amount of travel into the core verified. -
i
- 13. Functional test will consist of applying sivulated inputs (see note 3).
Local alerm lights representing upscale and downscale trips will be i verified, but no rod block will be produced at this time. The , inoperative trip will be initiated to produce a rod block (SRM and IRM i inoperative also bypassed with the mode switch in RUN). The functions ! that cannot be verified to produce a rod block directly will be verified i during the operating cycle. i f 8FN 3.2/4.2-59
,t1 AMENDMENT NU.16 4
NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2.D AND 4.2.K.(Cont'd) 14 (Deleted)
- 15. I es f1 b s mpar tor vill be este by p ting one f ng 2 sc ) an adj oting et at inp to uni
- in tain
[ ( od by o ar or db ek. e f1 bi upse e vd 1 be rifi o ser- ng loc up ale tr p 1 t du .ng erati an erif d th 560 11 odu a r d bloc dur th ope ting cle. Qt
- 16. Performed during operating cycle. Portions of the logic is checked more frequently during functional tests of the functions that produce a rod block.
- 17. This calibration consists of removing the function frem service and performing an electronic calibration of the channel.
- 18. Functional test is limited to the condition where secondary containment integrity is not required as specified in Sections 3.7.C.2 and 3.7.C.3.
- 19. Functie.tal test is limited to the time where the SGIS is required to meet the requirements of Section 4.7.C.1.a.
- 20. ICf i i a*.on f t. com rator 2q' res
- e i uts om b th - cir lac' n l I Eo s ob int .rupt d, th eby emov . e f1 bia si al th A *! and M d se -i he .eact .. is libr io can nly e pee.orm d* ing outa e.
petENg
- 21. Logic test is limited to the time where actual operation of the equipment is permissible.
's
- 22. (Deleted)
- 23. (Deleted)
- 24. This instrument check consists of comparing the thermocouple readings for all valves for consistence and for nominal expected values (not required during refueling outages). ,
l
- 25. During each refueling outage, all acoustic monitoring channels shall be ;
i calibrated. This calibration includes verification of accelerometer response due to mechanical excitation in the vicinity of the sensor. l I BFN 3.2/4.2-60 Unit 1
3.2 BASES (Cont'd) The control rod block functions are provided to generate a trip signal to block rod withdrawal if the monitored power level exceeds a preset value. The trip logic for this function is 1-out-of-n: e.g., any trip on enc of pyAPRMs,eightIRMs,orfourSRMswillresultinarodblock.
~#'
F0"R The minimum instrument channel requirements assure sufficient instrumentation to assure the single failure criteria is met. The minimum instrument channel requirements for the RBM may be reduced by one for maintenance,' testing, or calibration. This does not significantly increase the risk of an inadvertent control rod withdrawal, as the other channel is available, and the RBM is a backup system to the written sequence for withdrawal of control rods. The APRM rod block function is flow biased and provides a trip signal for blocking rod withdrawal when average reactor thermal power exceeds pre-established limits set to prevent scram actuation. The RBM rod block function provides local protection of the core; i.e., the prevention of critical power in a local region of the core, for a single rod withdrawal error from a limiting control rod pattern. If the IRM channels are in the worst condition of allowed bypass, the sealing arrangement is such that for unbypassed IRM channels, a rod block signal is generated before the detected neutrons flux has increased by more than a factor of 10. A downscale indication is an indication the instrument has failed or the instrument is not sensitive enough. In either case the instrument will not respond to changes in control rod motion and thus, control rod motion
; prevented.
The refueling interlocks also operate one logic channel, and are required for safety only when the mode switch is in the refueling position. For effective emergency core cooling for small pipe breaks, the HPCI system must function since reactor pressure does not decrease rapid enough to allow either core spray or LPCI to operate in time. The automatic pressure relief function is provided as a backup to the HPCI in the event the HPCI does not operate. The arrangement of the tripping contacts is such as to provide this function when necessary and minimize spurious operation. The trip settings given in the specification are adequate to assure the above criteria are met. The specification preserves the effectiveness of the system during periods of maintenance, testing, or calibration, and also minimizes the risk of inadvertent , operation; i.e., only one instrument channel out of service. Two radiation monitors are provided for each unit which initiate Primary Containment Isolation (Group 6 isolation valves) Reactor Building Isolation and operation of the Standby Gas Treatment System. These inetrument channels monitor the radiation in the reactor zone ventilation exhaust ducts and in the refueling zone. BFN 3.2/4.2-68 Unit 1 l
.I 4.2 BASES (Cont'd) SEP 2 21993 The conclusions to be drawn are these: [ 1. A 1-out-of-n system may be treated the same as a single channel in terms of choosing a test interval; and
- 2. more than one channel should not be bypassed for testing at any one time.
The radiation monitors in the reactor and refueling zones which initiate building isolation and standby gas treatment operation are arranged such that two sensors high (above the high level setpoint) in a single channel or one sensor downscale (below lov level setpoint) or inoperable in two channels in the same zone vill initiate a trip function. The functional testing frequencies for both the channel functional test and the high voltage power supply functional test are based on a Probabi'.istic Risk Assessment and system drift characteristics of the Reactor Building Ventilation Radiation Monitors. Tne calibration frequency is based upon the drift characteristfes of the radiation monitors. The automatic pressure relief instrumentation can be considered to be a 1-out-of-2 logic system and the discussion above applies also. The RCIC and HPCI system logic tests required by Table 4.2.B contain provisions to demonstrate that these systems will automatically restart on a RPV lov vater level signal received subsequent to a RPV high water level trip. a CMAN INSEATM > N INSERT M: The e10ctronic instrumentation comprising the APRM rod block and Rod Block. Monitor functions together with the recirculation flow i in:,crumentation for flow bias purposes is monitored by the same self-test functions as applied to the APRM function for the RPS. ' The functional frequency of every six months is based on this test monitoring automatic self-test at 15 minute intervals and on the low Calibration frequency of once per expected equipment f ailure rates .
- operating cycle is based on the drif t characteristics of the limited number of analog components, recognizing that most of the processing is performed digitally without drift of setpoint values.
BFN 3.2/4.2-73 A ENDMENT NO.19 9 ( Unit 1
3.3/4.3 REACTIVITY CONTROL - LIMITING CONDITIONS FOR OPERATION SURVEILLANCE REOUIREMENTS 3.3.B. Control Rods 4.3.B. Control Rods 3.c. If Specifications 3.3.B.3.b.1 3.b.3 When the RWM is not through 3.3.B.3.b.3 cannot OPERABLE a second , be met the reactor shall licensed operator not be started, or if the or other technically i reactor is in the RUN or qualified member of l startup modes at less than the plant staff shall 10% rated power, control rod verify that the correct < movement may be only by rod program is followed. ; actuating the manual scram " or placing the reactor mode switch in the shutdown position. ; 4 Control rods shall not be 4 Prior to control red withdrawn for startup or withdrawal for startup refueling unless at least or during refueling, two source range channels verify that at least two have an observed count rate source range channels equal to or greater than have an observed count three counts per second, rate of at least three counts per second. r .e 5. D i ope a o vi h 5.,Duigg'op4/atin t5 C. ?o
. P or . P eq al D ea er h 0.95 y e a o g* at r ei e. .95 i t* nc
? f tio al e o t e s 1 be pe- o e I rio t'v d av f j} A. Bot EBM ch is a 1 th d i t r d( )
(pgIt / be PE : t 1 as o e er 7 4 o er f r.
- b. Co trol rod thd va -
(ow) 1 e bl eked
\ ,
BFN 3.3/4.3-8 AMENHNI NO. 216 $ Unit 1
3.3/4.3 BAS.Il (Cont'd) , [5. e' od oc on r (RB is de igned o automati 11y reve ' ; f 1 age n e even of err cous od v hdra fr i oc ions of h h pov dens! dur hl pow lev op ati . " o RBM annel are ovid , and ne the may
- b ased Jrom e cons e fo ain nance d/o test g. .
Aut atic od vi drawal loc fro one o the anne vil b ek er oneou rod vi draw soo enou to even fuel amage The pecifi res icti vi one ann out f serv e co ervati ly a ure at fu d ge v 1 no oce
\ due to rod withdr al e ora en t a co iti exi s.
C. Scram Insertion Times The control rod system is designated to bring the reactor suberitical at the rate fast enough to prevent fuel damage; i.e., to prevent the MCPR from becoming less than 1.07. The limiting power transient is given in Reference 1. Analysis of this transient shows that the negative reactivity rates resulting from the scram with the average response of all the drives as given in the above specification provide the required protection, and UCPR remains greater than 1.07. On an early BWR, some degradation of control rod scram performance occurred during plant startup and was determined to be caused by particulate material (probably construction debris) plugging an internal control rod drive filter. The design of the present control rod drive (Model 7EDB144B) is grossly improved by the relocation of the filter to a location out of the scram drive path; i.e., it can no longer interfere with scram performance, even if completely blocked. [ The degraded performance of the original drive (CRD7EDB144A) under dirty operating conditions and the insensitivity of the redesigned drive (CRD7EDB144B) has been demonstrated by a series of engineering tests under simulated reactor operating conditions. The successful performance of the new drive under actual operating conditions has also been demonstrated by consistently good in-service test results for plants using the new drive and say be inferred from plants using the older model BFN
~~ ' '
3.3/4.3-17 AZ52EISDMT ND. 216 Unit l' 44w esy-ms en om e --sep04 + ves e eN" *W M' * * * ' ' 4 4 ,. . _ - - _ . - _ ,, y c - - . - ,
3.5/4.5 CORE AND CONTATNMENT COOLING SYSTEMS LIMITING CONDITIONS FOR OPERATION SURVEILLANCE REOUIREMENTS 3.5.I Averaae Planar Linear Heat 4.5.I Averaae Planar Linear ] Generation Rate Heat Generation Rate (APLHGR) l During steady-state power operation, The APLHGR shall be checked the Average Planar Linear Heat d daily during reactor Generation Rate (APLHGR) of any fuel operation at 1 25% rated assembly at any axial location shall
~
thermal power. not exceed the appropriate /APLHGR limit provided in the CORE OPERATING LIMITS REPORT. If ae any time rz Ano, FL.ow-pEPEsdD6cr* during steady state operation it is oc. PouseR- vese. ace #JT determined by normal surveillance that the limiting value for APLHCR is being exceeded, action shall be initiated within 15 minutes to restore operation to within the prescribed limits. If the APLHGR is not returned to within the prescribed limits within two (2) hours, the reactor shall be brought to the COLD SHUTD0'w'N CONDITION within 36 hours. Surveillance and corresponding action shall continue until reactor operation is within the prescribed t limits. J. Linear Heat Generation Rate (LHGR) J. Linear Heat Generation Rate (LHGR) During steady-state power operation, The LHGR shall be checked d the linear heat generation rate daily during reactor operation (LHGR) of any rod in any fuel at 1 25% rated thermal power. assembly at any axial location shall not exceed the appropriate LHGR limit provided in the CORE OPERATING LIMITS REPORT. BFN 3.5/4.5-18 AMENDMENT NO.19 7 Unit 1 a nasem
3.5/4.5 CORE AND CONTAINMENT COOLING SYSTEMS LIMITING CONDITIONS FOR OPERATION SURVEILLANCE REOUIREMENTS 3.5.J Linear Heat Generation Rate (LHGR) 4.5.J Linear Heat Generation Rate (LHGR) 3.5.J (Cont'd) If at any time during steady-state operation it is determined by normal surveillance that the limiting value for LHGR is being exceeded, action shall be initiated within 15 minutes to restore operation to within the prescribed limits. If the LHGR is not returned to within the prescribed limits within two (2) hours, the reactor shall be brought to the COLD SHUTDOWN CONDITION vithin 36 hours.
, Surveillance and corresponding action shall continue until reactor operation is within the prescribed limits.
3.5.K Minimum Critical Power Ratio 4.5.K Mini =um Critical Power (MCPR) Ratio (MCPR) The minimum critical power ratio 1. MCPR shall be checked daily
-w#N~s (MCPR) shall be equal to or during reactor power gee greaterthanthe1operatinglimit operation at 1 25% rated AFero rg MCPR (OLMCPR) as provided in the thermal power and following CORE OPERATING LIMITS REPORT. any change in power level F##* s#f f at any time during or distribution that would C }pfC4fD steady-state operation it is cause operation with a i
determined by normal LIMITING CONTROL ROD surveillance that the limiting PATTERN. value for MCPR is being (c a m G- Ls w tj d exceeded, action shall be 2. T@Mpjt initiated within 15 minutes to (.EYoe/stutWrt/d' shall restore operation to within the be determined as provided prescribed limits. If the 12 the CORE OPERATING steady-state MCPR is not 7.IMITS REPORT using: returned to within the prescribed limits within two (2) hours, the reactor shall be a. rf' U as defined in the brought to the COLD SHUTDOWN CORE OPERATING LIMITS CORDITION.within 36 hours, REPORT prior to initial surveillance and corresponding scram time measurements action shall continue until q for the cycle, reactor operation is within the performed in accordance prescribed limits. with Specification 4.3.C.1. BFN 3.5/4.5-19 AtfEMIBir 10. 216 Unit 1,
3.5/4.5 CORE AND CONTAINMENT COOLING SYSTEMS LIMITING CONDITIONS FOR OPERATION SURVEILLANCE RIOUIREMENTS 3.5.K Minimum Critical Power Ratio 4.5.K Minimum Critical Power (MCPR) Ratio (MCPR) 4.5.K.2 (Cont'd)
- b. as defined in the CORE OPERATING LIMITS REPORT following the conclusion of each scram-time surveillance test required by Speci-fications 4.3.C.1 and 4.3.C.2.
The determination of the limit must be completed within 72 hours of each
,, scram-time surveillance required by Specification 4.3.C.
L. APRM Setnoints L. APRM Setroints
-. .f
- 1. en er ec e themal PD hal be f/ / p er 12 of ated, th te ned dai kl6f6# ati of / PD shpri e act ri 1 be 1.0 or e APRtVscram ra dt rma power.
tpoi e ation sted in S tio 2.1.A dt AP ro block etpo t uat n lis di he C0
/
[ OPE TING MITS PORT shall b mult led FRP/ PD. h
- 2. Wh it i dete ed tha 3 .L.1 s not eing me ,
hou is a owed to cor et the conditi .
- 3. 3.5.L and 3 .L.2
\ cannot e met, e re tor pove shall redue.ed to
,( % of r ed the 1 ppver v thin 4 ours. f C. -
BFN 3.5/4.5-20 AMENINENT NO. 216 Unit 1 _ _ _ ___ --_--m_-.____ _ _ -- ____ '
3.5 BASES (Cont'd) 3.5.I. Average Planar Linear Heat Generation Rate (APLHGR) This specification assures that the peak cladding temperature following the postulated design basis loss-of-coolant accident will not exceed the limit specified in the 10 CFR 50, Appendix K. The peak cladding temperature following a postulated loss-of-coolant accident is primarily a function of the average heat generation rate of all the rods of a fuel assembly at any axial location and is only dependent secondarily on the rod-to-rod power distribution within an assembly. Since expected. local variations in power distribution within a fuel assembly affect the calculated peak clad temperature by less than i 20*F relative to the peak temperature for a typical fuel design, the limit on the average linear heat generation rate is
# sufficient to assure that calculated temperatures are within the
/
l )[MIEAT ! 10 CFR 50 Appendix K limit. 3.5.J. Linear Heat Generation Rate (LHGR) This specification assures that the linear heat generation rate in any rod is less than the design linear heat generation if fuel pellet densification is postulated. The LHGR shall be checked daily during reactor operation at 125 percent power to determine if fuel burnup, or control rod movement has caused changes in power distribution. For LEGR to be a limiting value below 25 percent of rated thermal power, the largest a total peaking would have to be greater than approximately 9.7 which is precluded by a considerable margin when employing any permissible control rod pattern. 3.5.K. Minimum Critical Power Ratio (MCPR) At core thermal power levels less than or equal to 25 percent, the reactor will be operating at minimum recirculation pump speed and the moderator void content will be very small. For all designated control rod patterns which may be employed at this point, operating plant experience and thermal hydraulic analysis indicated that the resulting MCPR value is in excess of requirements by a considerable margin. With this low void content, any inadvertent core flow increase would i only place operation in a more conservative mode relative to MCPR. The daily requirement for calculating MCPR above 25 percent rated thermal power is sufficient since power distribution shifts'are very slow when there have not been significant power or control rod % changes. The requirement for calculating MCPR when a limiting control rod pattern is approached ensures that MCPR will be known following a gg7 () change in power or power shape (regardless of magnitude) that could
>placeoperationatathermallimit.
3.5.L. APRM Setooints fu a iginegrty fety i ts o Sec on[.1w e b se onj l tot 1 a M fa or it n des gn imit (FR /C E PD .0 .
/e BFN 7 3.5/4.5-33 Unit 1 (OM/ /O 1 - g
INSERT N -- _ [At less than rated power conditions,. the rated APLHGR limit is adjusted by a power dependent correction factor, MAPFAC(P) . At less 3 than rated flow conditions, the rated APLHGR limit is adjusted by a f flow dependent correction factor, MAPFAC(F). The most limiting power-adjusted or flow-adjusted value is taken as the APLHGR q operating limit for the off-rated condition. The flow dependent correction factor, MAPFAC (F) , applied to the rated APLHGR limit assures that (1) the 10 CFR 50.46 limit would not be exceeded during a LOCA initiated from less than rated core flow conditions and (2) the fuel thermal mechanical design criteria would be met during abnormal operating transients initiated from less than rated core flow conditions. MAPFAC(F) values are provided in the } CORE OPERATING LIMITS REPORT. l The power dependent correction factor, MAPFAC(P), applied to the < rated APLHGR limit assures that the fuel thermal mechanical design i criteria would be met during abnormal operating transients initiated from less than rated power conditions. MAPFAC(P) values are provided in the CORE OPERATING LIMITS REPORT. , _ _
^
INSERT 0: _ At less than rated power conditions, a power dependent MCPR cperating limit, MCPR ( P) , is applicable. At less than rated flow cenditions, a flow dependent MCPR operating limit, MCPR ( F) , is applicable. The most limiting power dependent or flow dependent value is taken as the MCPR operating limit for the off-rated y condition. l l The flow dependent limit, MCPR(F), provides the thermal margin required to protect the fuel from transients resulting from inadvertent core flow increases. MCPR(F) values are provided in the CORE OPERATING LIMITS REPCRT. The power dependent limit, MCPR (P) , protects the fuel from the other limiting abnormal operating transients, including localized events such as a rod withdrawal error. MCPR(P) values are provided in the I CORE OPERATING LIMITS REPORT. --
- I I
s . . . . . .
3.5 BASES (Cont'd) ~ M AP ns* ume s at ad st to nsu th th co e t rm 1 s ente eed in a d rad si ati n v n t co it r 1 s e nser ativ th de gn ss tio . 3.5.M. Core Thermal-Hydraulic Stability The minimum margin to the onset of thermal-hydraulic instability occurs in Region I of Figure 3.5.M-1. A manually initiated scram upon entry into this region is sufficient to preclude core oscillations which could challenge the MCPR safety limit. Because the probability of thermal-hydraulic oscillations is lower and the margin to the MCPR safety limit is greater in Region II than in Region I of Figure 3.5.M-1, an immediate scram upon entry into the region is not necessary. However, in order to minimize the probability of core instability following entry into Region II, the operator will take immediate action to exit the region. Although formal surveillances are not performed while exiting Region II (delaying exit for surveillances is undesirable), an immediate manual scram will be initiated if evidence of thermal-hydraulic instability is observed. Clear indications of thermal-hydraulic instability are APRM oscillations which exceed 10 percent peak-to-peak or LPRM oscillations which exceed 30 percent peak-to-peak (approximately equivalent to APRM oscillations of 10 percent during regional oscillations). Periodic LPRM upscale or downscale alarms may also be indicators of thermal hydraulic instability and will be immediately investigated. Periodic upscale or downscale LPRM alarms vill occur before regional oscillations are large enough to threaten the MCPR safety limit. Therefore, the criteria for initiating a manual scram described in the preceding paragraph are sufficient to ensure that the MCPR safety limit will not be violated in the event that core oscillations initiate while exiting Region II. Normal operation of the reactor is restricted to thermal power and core flow conditions (i.e., outside Regions I and II) where thermal-hydraulic instabilities are very unlikely to occur. 3.5.N. References
- 1. " Fuel Densification Effects on General Electric Boiling, Water Reactor Fuel," Supplements 6, 7, and 8, NEIM-10735, August 1973.
- 2. Supplement 1 to Technical Report on Densification of General Electric Reactor Fuels, December 14, 1974 (USA Regulatory Staff).
- 3. Communication: V. A. Moore to I. S. Mitchell, " Modified GE Model for Fuel Densification," Docket 50-321, March 27, 1974.
BFN 3.5/4.5-34 Unit 1
~ _. . _ _. _ __ . _ _ .
6.9.1.5 ANNUAL RADIOLOGICAL ENVIRONMENTAL OPERATING REPORT P The Annual Radiological Environmental Operating Report covering the operation of the unit during the previous calendar year I shall be submitted before May 1 of each year. A single submittal may be made for a multi-unit station. The report J aball include summaries, interpretations, and analysis of trends-
]
of the results of the Radiological Environmental Monitoring Program for the reporting period. The material provided shall. , be consistent with the objectives outlined in (1) the CDCM and (2) Sections IV.B.2, IV.B.3, and IV.C of ' Appendix I to 10 CFR i Part 50. t 6.9.1.6 SOURCE TESTS I Results of required leak tests performed on sources if the tests reveal the presence of 0.005 microcurie or more of removable i contamination. t 6.9.1.7 CORE OPERATING LIMITS REPORT L [
- a. Core operating limits shall be established and shall be I i
documented in the CORE OPERATING LIMITS REPORT prior to each operating cycle, or prior to any remaining portion of an , operating cycle, for the following: (1) CfforSpecification3.5.I g (2) The LHCR for Specification 3.5.J g (3) 0 a%f for Specification 3.5.I/4.5 K I [ (4) The APRM Flow Biased Rod Block Trip Setting for Specification 2.1.A.1.c ble 3.2.C g gseffi g } e1 AMENIH!NI 10. 216 1 _, , li
= _ . . _. . . . _ . . . =-
g- -- - -,- + - s y ei_..-__y - , ,r , , ,-
g- , (5) Th REM ps le 1 ias)/Trg SepfingAdj2ipye j n6 gg g g)( alue or a se Table 3.2 4
- b. The analytical methods used to determine the core operating limits shall be those previously reviewed and approved by the NRC, specifically those described in General Electric Licensing Topical Report NEDE-24011-P-A, " General Electric i Standard Application for Reactor Fuel" (latest approved version).
- c. The core operating limits shall be determined such that all applicable limits (e.g., fuel thermal-mechanical limits, i core thermal-hydraulic limits, ECCS limits, nuclear limits such as shutdown margin limits, transient analysis limits,
, and accident analysis limits) of the safety analysis are met. '
- d. The CORE OPERATING LIMITS REPORT, including any mideycle ,
revisions or suppicments, shall be provided upon issuance for each reload cycle to the NEC, a 6.9.1.8 THE ANNUAL RADI0 ACTIVE EFFLUENT RELEASE REPORT The Annual Radioactive Effluent Release Report covering the operation of the unit during the previous calendar year of operation shall be submitted by April 1, of each year. The ' report shall include summaries of the quantities of radioactive liquid and gaseous effluents and solid vaste released from the unit. A single submittal may be made for a multi-unit station. The submittal should combine those sections that are common to all units at the station; however, for units with separate radvaste systems, the submittal shall specify the releases of radioactive material from each unit. The material provided , shall be (1) consistent with the objectives outlined in the ODCM and PCP and (2) in conformance with 10 CFR 50.36a and Section IV.3.1 of Appendix I to 10 CFR Part 50. BFN 6.0-26b ANNDMNI 10. 216 Unit 1. _ . _ = - - - _ . _ _ . -_ _ _ . . .
L _I N S E R T P : (1) The rated APLHGR limit; the Flow Dependent APLHGR Factor,
/ MAPFAC(F); and the Power Dependent APLHGR Factor, MAPFAC ( P) for Specification 3.5.I. / (2) The LGHR limit for Specification 3.5.J.
(3) The rated MCPR Operating Limit; the Flow Dependent MCPR l Operating Limit, MCPR (F) ; and the Power Dependent MCPR Operating Limit, MCPR (P) for Specification 3.5.K/4.5.K. (4) The APRM flow biased rod block trip setting for Specification 2.1.A.1.c and Table 3.2.C. (5) The RBM downscale trip setpoint, high power trip setpoint, intermediate power trip setpoint, low power trip setpoint, and applicable reactor thermal power ranges for each of the setpoints for Table 3.2.C. O h i s h 1
- . .- . - .- -. . - ~ . - .
j < l
- ? !
j_ 1.0 DETINITIONS (Cont'd) MAY0 01993 Q.
/ '
for a particular unit and the end of the next subs outage for the same unit. q" l - R. '! Refueline Ontare - Refueling outage is the period of time between unit shutdown the after that of the unit prior to a refueling and the startup of the refueling. of testing and surveillance, a refueling outage shall mean aFor th L[ , regularly scheduled outage; however, where such outages occur within L: - 8 months of.the completion of the previous refueling outage, the ! [ required scheduled surveillance testing need not be perfotned until the next ! s regularly outage. - A. ,
- 3. !
CORE ALTERATION - CORE ALTERATION shall be the movement of any sources, reactivity control components, or other components , i affecting reactivity within the reactor vessel with the vessel head removed and fuel in the vessel. i I
' intermediate range monitors, traversing in-core probes, or spec i movable detectors (including undervessel replacement) is not !
considered a' CORE ALTERATION. ', not preclude completion of movement of a component to a safeSu' location. . t' T. Reactor vessel Pressure - Unless otherwise indicated ! reactor vessel ! by the reactor vessel steam space detectors. pressures listed in U. Themm1 Parameters L
- 1. !
Minimum critical Power Ratio (iErk) - Miniams Critical Powe t' with the most limiting assembly in the reactor core. R Critical which is calculated to cause some point in the as , experience power. boiling transition, to the actual assembly operating ; i,
- 2. t between nucleate and film boiling..Tr===itionegime. Boiliar - Trans regime in which both nucleate and film boiling occurTransition boiling is t ,
7 intermittently with neither type being completely stable. , ( ( 3. . Cor/ Mdri # rrdtiodof1/t=ttile L.e Den /f tv (cdtpDS[ I MMt r tio, for all f al as embli jd e e re, fta all lo ati
- Ai f el r pow dans f al ses y (kW ft) or er ens y( /ft) at axiat loca ion lo tion the- ti fue r !
4 < s , Averane Pl===r Linear Heat Ceneration Rate (APfJermi - T Average Planar Beat Generation Rate is applicable to a specific [ planar height and is equal to the su of the linear heat i I at thebundle. the fuel specified height divided by the number of fue } BFN Unit 2 1.0-7 i N M MNO.214
- f i
O
-w __ ___ _.- -- '
/
~
I 1.0 MTINITIONS (Cont'd) - OCT 211993 p/. dre Dfariande Frletion/of CriticaY Power /(Cf7Ch -- re Mazia
/ jd'ra ion fC tica Powe is e == A v lue the ati of
/ th flo co ecte CPR etat 1 t fo the
[ 0 RAT MITS PO div ed by e tual PR r f , l ss li intfiecoe. V. Instrumentation
- 1. Instrument Calibration - An instrument calibration means the adjustment of an instrtament signal output so that it corresponds, within acceptable range, and accuracy,-to a known value(s) of the parameter which the instrument monitors. i I
! f
- 2. Cha$mel - A channel is an arrangement of the sensor (s) and I associated components used to evaluate plant variables and i produce discrete outputs used in logic.. A channel terminates and loses its identity where individual channel outputs are combined in logic.
- 3. Instrument runctional Test - An instrument functional test means the injection of a simulated signal into the instrument primary sensor to verify the proper instrument channel response, alarm ~}
and/or initiating action.
- 4. Instrument Check - An instrument check is qualitative l determination of acceptable operability by observation of l instrument behavior during operation. This determination shall
! include, where possible, comparison of the instrument with other ,3, independent instruments measuring the same variable.
- 5. Lorie system Punctional Test - A logic system functional test means a test of all relays and contacts of a logic circuit to insure all components are operable per design intent. Where I practicable, action will go to completion; i.e., pumps will be started and valves operated.
- 6. Trio System - A trip system means an arrangement of instrtaient channel trip signals and atutillary equipment required to initiate action to accomplish a protective trip function. A trip system may require one or more instrument channel trip signals related to one or more plant parsaeters in order to l
initiate trip system action. Initiation of protective action may require the tripping of a single trip system or the coincident tripping of two trip systema.
- 7. Protective Action - An action initiated by the protection system when a limit is reached. A protective action can be at a channel or system level.
- 8. Protective Function - A system protective action which resuits from the protective action of the channels monitoring a particular plant c.ondition.
BrN 1.o-a AMENDMENT NO. 217
)
tinit 2 ' l
I
,7 1.1/2.1 FUEL CLADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 1.1 NEL CLADDING INTEGRITY 2.1 FUEL CLADDING INTEGRITY Aeolicability Applicability Applies to the interrelated Applies to trip settings of variables associated with fuel the instruments and devices thermal behavior. which are provided to prevent the reactor system >
safety limits from being , exceeded. Obiective Obiective To establish limits which To define the lev.. of the ensure the integrity of the process variables at which fuel cladding, automatic protective action
- is initiated to prevent the fuel cladding integrity j
, safety limit from being exceeded.
Specifications Specifications The limiting safety system
, settings shall be as specified below:
A. Thermal Power Limits A. Neutron Flux Trio i Settinzs
- 1. Reactor Pressure >800 1. APRM Flux Scram ;
paia and Core Flow Trip Setting
> 10% of Rated.
(RUN Mode) (Flow Biased) When the reactor pressure is greater a. When the Mode than 800 psia, the Switch is in , aristence of a minimum the RUN- , critical power ratio position, the (MCPR) less than 1.07 APRM fluz shall constitute. scram trip : violation of the fuel setting cladding Lategrity shall be: safety limit. ; l
)
BFN 1.1/2.1-1 Unit 2
... _. _ _ . _. _. 1
.If 1.1/2.1 FUEL CLADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 2.1.A Feutron Flux Trio Settings .1 2.1.A.1.a.(Cont'd) (0 6sW+ 7/# f,)-
where: l l S = Setting in . percent of rated thermal power (3293 MWt) W = Loop recirculation flow rate in . . percent of l rated f
- b. For no combination of loop e recirculation.
flev rate and core thermal
, power shall the APRM flux scram
, trip setting be allowed to exceed 120% of rated thermal power.
BFN 1.1/2.1-1 D M No. 232 Unit 2 -
* * =~ e. .o . = o * * .a=== -.. .. - .-
1.1/2.1 FUEL CLADDING INTEGR'ITY SAFETY LIMIT LIMITING SATETY SYSTEM SETTING 2.1.A Neutron Flux Trio Settinrs 2.1.A.1.b. (Cont'd) HOIX: These settings assume operation within the basic thermal hydraulic design criteria. These criteria are
'JGR vithin the limits of Specification 3.5.J and MCPR l vithin the limits of Specification 3.5.K. If it l is determined that either of l these design criteria is being violated during operation, action shall be initiated within 15 minutes to restore operation within l~5prescribed 1 an limits. r qui e es o s: a po t e iv .
f i 3 ci ic ic 4. L
- c. The APEM Rod Block trip setting shall be less than or equal to the limit specified in the CORE OPERATING LIMITS EIPORT.
4 BFN _ , , _ , _ _ , 1.1/2.1-3 Unit 2 , l _ 1 _ _ _ _ _ _ --------- - - - - - - - - - - - - - - - ' - - - - - - - - - - - - - ~ - - - - - - - -
V l
~.
A e 4 r/f DEC 181980. 13 0 . 1 12 0 . . . . . . . . . . . . .. . . . . . . . . .. . . . .. . . . . .. . . . ... . . . .. . . . ... . . . . . . . . .. . . . .. . . . . . . . APRM Row B.ias Scram .. .i.....:.. 11 0 _.E ....i....:.... .i. .i....:....
........... .i. ..: ...i....i.... !.. .
10 0 ._- ...... . . . . . . . . . . . . . ......... p...p...p........p...p..
...p...p..p...p...p.. ....p... ....p...)....I. ... p . .. p. . . p . . . p ... p . .. F
-Q S O ._ ...... . . .......... . .........
CJ - . e - O
,C . .
**- ........... ... ... ..... ... ...... ~ -.. .~ " ~. ......... .;....~. ...~ ... ........ ;..
O 8 0 ._- ,. e cb _
...p...p...p...p...p...;
...e ..p...p.~ p...p...p
.p ..p...s- .i. . .
.i....i....s...s....p...p fQ .E....:...:........!......... . . s.i ... :, . n ' lDesien Flow Contrcl Linel .... .
u C
>s. _
g p
~ . ...,...
O c.,.
- C O 0 ._. .
O :
.s ; w _ . . . . .
.. ;../......>....;....;....;...;....>....;..> . . . . . .
i..... ..;.. . .;....;....;..
.. ,( s j> ., _
,...y
~ 3 . . . . . . . . . . . . . . . . . . . . .
50 C - r . > + - " .t ~
- t " .v ,
. .t -
"v"t"~v"+- .
*t"+ +->"""+~v-O -
. . . . . . . . . . . . . " v -.........
~.t. . . .". . ". . .v. . .>. . . .~. . . ~
. . . .v
. ~ n w . . . . . . . . . .
4 0 -.- O
- - - - - - -- - " - - - - --- - ~
U .
.-- Natural C.----
- ircu la t.i o n 1 . . . . . . . . . . . . . . . .
30 _ i~->~~.t-~.t-.'".' t. ".~~.'"*."4."".5"-'"~.'-.t~4.--'~~+.-.>-+-4.*~v~i"-
~
....j i !i i i 20 % Pumo Sp e ed Lin e
.!..........:.....:...;.....i....i.....i....
20 ._ . . . . . . . . . . . . . . . . . . . . . . . ..... 10 2 - b-++9. .i~4 .b- .b + .b - .b .b- + - b - .b
.* - .b .
. .i - - * .
.* - +. - +. - *. ~ ~ .b - .i ---
nw g 6' 4' 4' '6' ~6' '& 'g' i' 't g g -g 0 10 20 30 40 50 60 70 80 90 10 0 11 0 12 0 Core Coolant Flow Rate (% of Design) m- XPRM Row Bias Scram vs: Reactor Core Row D.. 9 Rg. 2.1-2 AMDIDMENT NO.181 BFN 1.1/2.1-7 Unit 2
.. e. em. e G
.,..y.~.. v..~.,....~..c..vna. ---. ~ ~ . e .. ~ . - - ~ ~ - . ~ ~ = - ~ ~-'m=~
_ - - , - - - - - _ _ _ - - _ _ - - _ - _ _ - _ - - - - - - - , - - , - - - _ - , - - - - , - - - , - - - - - - - - - - - - - _ _ _ - _ _ - - - _ . _ - _ _ . - _ _ - - - - _ _ _ _ - - - __-- __ __-_. J
h 130 120 . . .
.A P RM Flo. .w
. . Bia. s . . S c.ram .... . . . . . . . ,
110 _. ....... 4 ,
. ... . .s . a . . , . .
100 - ..
........a...
.......s... . . . . . .
v . . Q Q0 a . . m _ ... . . .. .. .. ...... . w. . . . 80 8 _.................
~. ~
.l a .
/ - . . . . . . . . . . . . . . . . . . , .. .... . . .. ... . . . . .. . . . . . .. ... . .....
b'9n
. . . . .1 . . . . . . . . .
. .\ . . . .
o c - oO '.
.. . . . . ...s. . . .. . . . _ Desi9n. t-low G_ ontrol une. l. . . .
c . . . o m _.... . ......... 50 c . . . .. .. . . . . . a. . . a.. ... ... .
.........s.._a...a...a....... . ._s... . . . . . . .
y . . . . . . . . . . . a . . . . . u 40 . . . . . . . . . . . [ .Natuntl C;,mug.o0.. O . . . .....,.... O . . . . . 30 .
- : : : : : : : : 20% Pump: Speed Line
... ... _s.... . _ s. _ . . .u .
20 _ _ . , . _ _ , . , .. _ _ _ .. . , . _ _.r._,._.r.,._,.__,.. 10 _..
...,____.7__,..,___7._.,__....,..
7.. 0 . . . . ,. . 0 10 20 30 40 50 60 70 80 90 100 110 120 I Core Coolant Flow Rate (* of Design) APRM Flow Bias Scram vs. Reactor Core Flow Fig. 2.1_2 1.1/2.1-7 l l
.- ~ - . --. - - - - _ .. - _ - .
I 2.1 BASES (Cont'd) F. (Deleted) - 0E 1 f' G. & H. Main Steam line Isolation on Low Pressure and Main Steam Line i Isolation Scram t The low pressure isolation of the main steam lines at 825 psig was - provided to protect against rapid reactor depressurization and the resulting rapid cooldown of the vessel.'- The scram feature that [ occurs when the main steamline isolation valves close shuts down the j reactor so that high power operation at low reactor pressure does ; not occur, thus providing protection for the fuel cladding integrity i safety limit. Operation of the reactor at pressures lower than 825 i
-psig requires that the reactor mode switch.be in the STARTUP !
position, where protection of the fuel cladding integrity safety l limit is provided by the IRM and APRM high neutron flux scrams. Thus, the combination of main steamline low pressure isolation and isolation valve closure scram assures the availability of neutron j flux scram protection over the entire range of applicability of the ; fuel cladding integrity safety limit. In addition, the isolation l valve closure scram anticipates the pressure and flux transients that occur during normal or inadvertent isolation valve closure. " With the scrams set at 10 percent of valve closure, neutron flux ; does not increase. ; I.J.& K. Reactor Low Water Level Setooint for Initiation of EPCI and RCIC ( Closine Main Steam Isolation Valves, and Startine LPCI and Core j Sorav Pumes. > ( These systems maintain adequate coolant inventory and provide core ! cooling with the objective of preventing excessive clad j temperatures. The design of these systems to adequately perform the r intended function is based on the specified low level scram setpoint and initiation setpoints. Transient analyses reported in Section 14 of the FSAR demonstrace that these conditier.s result in adequate safety margins for both the fuel and the system pressure. L. References
}
- 1. Supplemental Reload Licensing Report of Browns. Ferry Nuclear )
Plant, Unit 2 (applicable cycle-specific document).
- 2. GE Standard Applicatica for Reactor Fuel, NEDE-240ll-P-A and ,
NEDE-240ll-P-A-US (latest approved version). l
=__ -- . _.
~
a sim u m Edade) Lo,J )ru J.is,,f ud RRT3 I I I"yo ve~J ProI"~ A'y> es y $m Fuq ; N'" Ph d %I Q 2 ud .3, puc- wp3 P. l i BFN 1.1/2.1-16 , (- entt AMENDMENT N0. 214 i 1
)
9.e S
e 0 p .
-7
' $g y. TABLE 3.1.A , REACTOR PROTECTION SYSTEH (SCRAH) INSTRt! MENTATION REQUIREMENTS ' N Hin. No. of Operable Instr. Modg1 in which Function Channels Mst Be Operabh _ Per Trip Shut- Startup/ System (1)(23) Trio Function Trio Level Settina down Refuel (7) 09t Standby- Run Action (1) 1 3 1 Hode Switch in X X X X 1.A Shutdown 1 Hanual Scram X X X X 1.A IRH (16) 3 High Flum 1120/125 Indicated X(22) X(22) X (5) 1.A on scale 1 3 Inoperable X X (5) 1.A APRH (16)(24)(25) t->
,F~ 3 (88) til h Flus !
N E 3I88) fFlowBlased) See Spec. 2.1.A.1 High Flun X 1. A or. l .0 3 0f I.b !
. (Flued Trip) i 1201 X 1. A or 1.B .0" .I. E
* .2* 3(if) High Flus < 151 rated power X(17) (15) 1.A b E 3 (e s) inoperative 13) l X(17) X 1.A n N*t r V g,.
x # 2 High Reactor d Pressure i 1055 psig X(10) X X 1.A * ! (PIS-3-22AA.BB.C.D) d co pg 2 High Drywell g Pressure (14) 1 2.5 psig X(8) X(8) X 1.A m g [a (PIS-64-56 A-D) ( 2 Reactot- Low Water rt n Level (14) 1 538" above X X X 1.A 2 (LIS-3-203 A-D) vessel aero M ' D? N t- M "8 m
~ i i
i '
?-
0
. . _ _ - . _ - - . _ . - _ _ _ _ _ . . - - - - - - . _ ~ . - - - . . . . - . ~ _ - . - - - - - . , . ~ - - - - - - - , _ . . .- . ~ _ - .-- . _ - - - - - . . . . . - . , , .
- -. . _ . . - . . - . - - . _ , - - - .- , , . . - - ,--_..~/
I NOTES FOR TABLE'3.1.A
;I 1. There shall be two OPERABLE or. tripped trip systems for each function.
If the minimum number of OPERABLE instrument channels per trip system j cannot be met for one trip system, trip the INOPERABLE channels or entire ! trip system within one hour, or, alternatively, take the belov listed ! action for that trip function. If the minimum number of OPERABLE i instrument channels cannot be met by either trip system, the appropriate j action listed below (refer to right-hand column of Table) shall be , taken. An INOPERABLE channel need not be placed in the tripped condition l vhere this would cause the trip function to occur. In these cases, the , INOPEP.ABLE channel shall be restored to OPERABLE status within two hours, ! or take the action listed below for that trip function. I l A. Initiate insertion of OPERABLE rods and complete insertion of all OPERABLE rods within four hours. In refueling mode, suspend all ! operations involving core alterations and fully insert all OPERABLE i control rods within one hour. B. Reduce pcVer level to IRM range and place mode switch in the STARTUP/ HOT Standby position within 8 hours. - Reduce turbine load and close main steam line isolation valves within C. gg 8 hours. O D. Reduce power to less than 30 percent of rated.
- 2. Scram discharge volume high bypass may be used in SHUTDOWN or REFUEL to .
r 7, bypass scram discharge volume scram and scram pilot air header lov I pressure scram with control rod block for reactor protection system reset. !
- 3. (Deleted) l t
4 Bypassed when turbine first stage pressure is les.4 than 154 psig. [ S. IRMs are bypassed when APRMs are onseale and the reactor mode switch is [ in the RUN position. .
- 6. The design permits closure of any two lines without a scram being initiated.
- 7. When the reactor is suberitical and the reactor water temperature is less ,
than 212*F, only the following trip functions need to be OPERABLE: ; A. Mode switch in SHUTDOWN l B. Manual scram C. High flux IRM [ D. Scram discharge volume high level I _ v z- @ fPM 76@ Mh/d) ( F. Scram pilot air header low pressure BFN 3.1/4.1-5 Unit 2 e=*
d' .A _. F INSERT B - I E. For the APRM functions only, if only two APRM channels are OPERABLE, i restore a third APRM channel to OPERABLE status or trip one of the i inoperable APRM channels within 6 hours. If only one APRM channel l is OPERABLE, trip one inoperable APRM channel . immediately and i restore an inoperable APRM channel to OPERABLE status or initiate j alternative action within 2 hours. [ F. For the APRM functions only, if one voter channel is inoperable in ! one trip system, restore the voter channel to OPERABLE status or ! trip the inoperable channel or the entire trip system within 12 -; hours. If cne voter channel is inoperable in both trip systems, j restore the inoperable voter channels to OPERABLE status or initiate j alternative action within 6 hours. l v ' ' i s 1 I l [ s l i i i 1 I I I l l l
~ _ _
i; NOTES FOR TABLE 3.1.A (Cont'd) SEP 2 71994 l
- 8. Not required to be OPERABLE when primary containment integrity is not f:
required.
- 9. (Deleted) q
- 10. Not required to be OPERABLE vhen the reactor pressure vessel head is not '
bolted to the vessel. g< w f
- 11. RF d Ti I s/on/y if fjdct/ onf i /ctp+e pflen/the[eag[op/m9d [r30 hp/ase u lh l ibOE fako'{l%'%$EX'Y $ "$,V."$'V'f" W *# 5% l
# 13. Less th OPERABLELPRMsvillcause(dy'rfiyrffyt 4* A5!WA I IMt Mf ,
14 Channel shared by Reactor Protection System and Primary Containme t and i M k Reactor Vessel Isolation Control System. A channel failure may be a channel failure in each system. {
- 15. The APRM 15 percent scram is bypassed in the RUN Mode.
i
- 16. Channel shared by Reactor Protection System and Reactor Manual Control System (Rod Block Portion). A channel failure may be a channel failure in each syste=. If a channel is allowed to be inoperable per l [
!able 3.1.A, the corresponding function in that same channel may be inoperable in the Reactor Manual Control System (Rod Block). l
- 17. Not required while performing low power physics tests at atmospheric i pressure during or after refueling at power levels not to exceed 5 MW(t). l t
- 18. This function must inhibit the automatic bypassing of turbine control {
valve fast closure or turbine trip scram and turbine stop valve closure scram whenever turbine first stage pressure is greater than or equal to 154 psig.
- 19. Action 1.A or 1.D shall be taken only if the permissive fails in such a manner to prevent the affected RPS logic from performing its intended function. Otherwise, no action is required. [
Jt
- 20. (Deleted)
- 11. Th Hi F ur and I,nop stiv Tr ps d no* hav t e OPdAM i
*e Mo i the ou ce R e onit s .e e un e t/gide ,
5
~
o ci en , igh T ur scram at 5x ps f The SIMs shall be 7 OPERABLE per Specification 3.10.3.1. The removal of eight (a) shorting L links is required to provide noncoincidence high-fluz scram protection ! from theh(IrfejRajlgd jier31tpr)). t ht x< w, kI
% rg L AMENDMENT NO. 2 2 7 BFN 3.1/4.1-6 Unit 2 a
h
INSERT C3 The same three (3) required APRM channels are shared by both RPS trip systems. - INSERT D b _ _ 3 i Any combination of APRM upscale or inoperative trips from two different (non-bypassed) APRMs will trip all of the 2/4 voter units.
~
~. ,_ , -
5~5RT E : .3 _ _ In the REFUEL Mode unless adequate shutdown margin has been demonstrated per Specification 3.3. A.1, whenever any control rod is withdrawn from a core cell containing one or more fuel assemblies, shorting links shall be removed from the RPS circuitry to enable the t Source Range Monitor (SRM) ncncoincidence high-flux scram function. G -. t k 5 J t l l l i l
5
~
r -
.y TABLE 4:1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION FUNCTIONAL TESTS HINIMUM FUNCTIONAL TEST FREQUENCIES FOR SAFETY INSTRUMENT AND CONTR0t. CIRCUITS Group (21 Functional Test Minimum Frecuencvf3) f*
rE Mode Switch in Shutdown A
- Place Mode Switch in Shutdown Each Refueling Outage Hanual Scram A Trip Channel and Alarm Every 3 Honths IRH High Flum C Trip Channel and Alarm (4) OnceNeek During Refueling and Before Each Startup Inoperative C Trip Channel and Alarm (4) OnceNeek During Refueling and Before Each Startup APRM High Flum (15% Scram) Trip Output Relays (4) (S') ",.' -
} {. p joy ,..,J 6,g7 [
/f 119 Vo te r Lop e (to) cn_-_ -- ..
' " '" Euk Rf.<t, High Flus (Flow Blased) Trip Out ut Relays (4) y9he p
- 0. :?? :5 Fvc,y ( c .. f4 5 High Flux (Fined Trip) 1/V Ve
- La Trip Output R ays
><- )([ ) E 4. . /. ~ dwh ,
7
' (f) ^ ::?'::E fecy es. 45 Al*l Veh. L is. 10) Eu Rep oL Du h, e P Inoperative Tri Output R ays 4) (f) " :: ^> :'
,d Q 3/ V*h e lope's (IO) EverI 6 m,. 7, *3 3 own ca e I pU put lay (4 "-.~^- g x g#" ,') ( *
/ /
F1 as - 1 High Reactor Pressure B Trip Channel and Alarm (7) Once/Honth (PIS-3-22AA, BB, C, D)
'c"'dj-High Drywell Pressure B Trip Channel and Alarm (7) Once/Honth (PIS-64-56 A-D)
, Reactor Low leater Level B Trip Channel and Alarm (7) Once/Honth (LIS-3-203 A-D)
. I 2 y im V,b- Tm L- LLL 00 Gw yak l
______.___________m_ - - - - - . , , - m,. , _ ,, . - - , ,
l No-ri MR TABLE 4.1.A l* . 1. Initially the minimum frequency for the indicated tests shall be ence per [
~*;y son th.
- 2. A descriptico of the three groups is included in the Bases of tnis specificatien.
- 3. Functicnal tests are not required '-nen the systems are not required to be ;
CPERABLZ or are operating (i.e. , already tilpped). If tests are siissed. they sna11 be performed prior to returning the systems to an CPERABLZ status, i
- 4. This instrumentation Ls esempted fica the instrument channel test ;
de finitien. This instrument channel functional test will consist nt injecting a simulated electrical signal into the measurement channel $.
"W W h.c.
$? $1;*C.E' *'/**/'"" "/ "'Y'Y' 7"*Y W* ** W 4 7 runctienal test consists of the injectico of a rimulated signal Lato tne un f electronic trip circuitry in place et the senJoc signal o verify operacility of the trip end alarm functicns.
- 3. The fu'nctional test frequency decreased to ence every three mentas to reduce c.9a11enges to relief valves per NUREG 0737, Item I2.K.3.16.
- x. _
~
9.- Not required to be performed when entering ' STANDBY Mode from RUN Mode until 12 hours after entering the , STARTUP/ HOT STANDBY Mode.
- 10. Functional test consists of simulating APRM trip conditions at J the APRM channel outputs to check all combinations of two f tripped inputs to the 2/4 voter logic in each voter channel.
Functional test consists of manually tripping the 2/4 voter f 11. trip output, one voter channel at a time, to demonstrate that each scram contactor for each RPS trip system channel (A1, A2, B1 and B2) operates and produces a half-scram. ,
~
INSERT F: - -- The channel functional test shall include both the APRM channels and , (the2/4voterchannels. INSERT G: t The channel functional test shall include both the APRM channels and the 2/4 voter channels plus the flow input function, excluding the , flow transmitters. _ ,
~ _-
', ,..A f f 5FN 3.1/4.1-10 Unit 1
. e. 4 g O
. . ,. .= 1
o '
, , w. .
': b - '
I & TABLE 4.1.8 ' REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENT CALIBRATION c: w HININUM CALIBRATION FREQUENCIES FOR REAC10R PR01ECTION INSTRUMENT CIMNNELS
$ Instrument Channel Group (1)
Calibralian Minimum Frequencvf2) 9 IAH High Flum - Comparison to APRH on Controlled Startups (6) Note (4) APRH High Flus j Output. Signal Heat Balance Once/7 Days Flow Blas Signal Calibrate Flow Dias Signal (7) Once/ Operating Cycle ' h p Signal
-)
TIP System Traverse (8) Every 1000 Effective Full Power llours , High Reactor Pressure B Standard Pressure Source (PLS-3-22 AA, BB, C, D) Once/6 Honths (9) High Drywell Pressure B Standard Pressure Source Once/18 Honths (9) (PIS-64-56 A-0) Reactor Low Water Level B Pressure Standard (LIS-3-203 A-0) Once/18 Months (9) y t C High Water Level in Scram f Discharge Volume
- Float Switches I -
(LS-85-45-C-F) A Calibrated Water Column Once/18 Honths C Electronic Level Switches (LS-85-45 A, B, G H) B Calibrated Water Column Once/18 Honths (9) l Main Steam Line Isolation Valve Closure A Note (5) Note (5) ! Turbine First Stage Pressure
-Permlasive (PIS-t-81 A&B, ,
3 P15-1-91 A&B) B Standard Pressure Source E Once/18 Honths (9) t Q Turbine Stop Valve Closure A Note (5) Note (5) O , 3E: Turbine Control Valve Fast Closure on Turbine Trip A Co ! Standard Pressure Source Once/ Operating Cycle
- Low Scram Pilot Air Q
P Header Pressure (PS 85-35 A1, A Standard Pressure Source N p A2, 81, t. 82) Once/18 Honths- q to Q , I 4
,e-__ .,c- ,,w, , -.-# ....,.---,.v. e ,-,r.. .- w,..-,w-r~- . +....e+ . .+,ww+-- .-eve,..e n. -we*- . . - . *- . - , -, . - . . , .- . . - - + . - - . -mm,.-.--+ew.- . m. . ...---- --- - - . - - - - _ _
SEP 2 7 7994 NOTES FOR TABLE 4.1.B
- 1. A description of three groups is included in the bases of this specification.
(i
- 2. Calibrations are not required when the systems are not required to be OPERABLE or are tripped. If calibrations are missed, they shall be performed prior to returning the system to an OPERABLE status.
- 3. (Deleted) 4 Required frequency is initial startup fol]owing eacr refueling outage.
- 5. Physical inspection and actuation of these position switches vill be performed once per operating cycle.
- 6. On contr i ed startups, overlap between the IRMs and APRMs will be verified.
V W 7. Th F ov Bias ign Ca]fibrati n vi 1 cc ist of alibra ing td sencors, f w cc ert rs, .d s gnal ffse netv ks duri a eac. opera ing c c .
- e ine r"~ ntat ni an alog -ype ith red dant ou si nals sh W'g 4 ca b co ared TF flo comp rator trip ar upsc- e vil be f" e ion ly t see acco ding o Ta e 4.2. te en re tF pro er 7g leW g o e ati . dur ng 7..e op rati. cyc e. Ref r to .1 Bas a fo fu her plan ion f eglibr ion requ cy.
7
- 8. A complete TIP system traverse calibrates the LPRM signals to the process computer. The individual LPRM meter readings vill be adjusted as a
- minimum at the beginning of each operating cycle before reaching 100 percent power.
- 9. Calibration consists of the adjustment of the primary sensor and
{ associated components so that they correspond within acceptable range and accuracy to known values of the parameter which the channel monitors, including adjustment of the electronic trip circuitry, so that its output relay changes state at or more conservatively than the analog equivalent of the trip level setting.
^
INSERT H: .
~_
/
The flow bias signal calibration will consist of calibrating the analog differential pressure flow sensors once per operating cycle. J Calibration of the flow bias processing system is done once per operating cycle as part of the overall APRM instrumentation calibration. l I
/ , 1 BFN 3.1/4.1-12 AMENDMENT RO. 2 2 7 i Unit 2
o i 3.1 BASIS l
,e
( .The reactor protection system automatically initiates a reactor scram to:
- 1. Preserve the integrity of the fuel cladding.
- 2. Preserve the integrity of the reactor coolant systen.
- 3. Minimice the energy which must be absorbed following a loss of coolant accident, and prevents criticality.
This specification provides the limiting conditions for operation necessary to preserve the ability of the system to tolerate single failures and still perform its intended function even during periods when instrument channels may be out of service because of maintenance. When necessary, one channel may be made INOPERABLE for brief intervals to
- conduct required functional tests and calibrations.
The reactor protection trip system is supplied, via a separate bus, by its own high inertia, ac motor-generator set. Alternate power is available to either Reactor Protection System bus from an electrical bus that can receive standby electrical power. The RFS =onitoring system ' provides an isolation between nonclass II power supply and the class 1E RPS bus. This vill ensure that failure of a nonclass 1E reactor , protection power supply vill not cause adverse interaction to the , class II Reactor Protection System. l The reactor protection system is =ade up of two independent trip systems (refer to Section 7.2, FSAR). There are usually four channels provided - d ' to monitor each critical parameter, with two channels in each trip i system. The outputs of the channels in a trip system are combined in a logic such that either channel trip will trip that trip system. The simultaneous tripping of both trip systems vill produce a reactor scram. This system meets the intent of IIII-279 for Nuclear Power Plant Protection Systems. The system has a reliability greater.than that of a l 2-out-et-3 systcm and somewhat less than that of a 1-out-of-2 syatem. With the exception of the Average Power Range Monitor (APRM) channels, the Intermediate Range Monitor (IRM) channels, the Main Steam Isolation Valve closure and the Turbine Stop Valve closure, each trip system logic has one instrument channel. When the minimum condition for operation on the number of OPERABLE instrument channels per untripped protection trip system is met or if it cannot be met and the effected protection trip system is placed in a tripped condition, the effectiveness of the protection system is preserved; i.e., the system can tolerate a single failure and still perform its intended function of scr==4ne the c Lax ,
/
BFN 3.1/4.1-14 Unit 2
. -?
1
l l 4 INSERT I: -
~ -
l The APRM system is divided into four APRM channels and four 2-out- l of-4 trip voter channels. Each APRM channel provides input to each of the four voter channels. The four voter channels are divided into two groups of two each, with each group of two providing inputs to one RPS trip system. The APRM system is designed to allow one APRM channel, but no voter channels, to be bypassed. A trip from any one unbypassed APRM will result in a " half-trip" in all four of the voter units, but no trip inputs to either RPS trip system. A 1 trip from any two unbypassed APRM channels will result in a full I trip in each of the four voter channels, which in turn results in two trip inputs into each RPS trip system resulting in a full scram. Each APRM instrument channel receives input signals from forty-three (43) Local Power Range Monitors (LPRMs) A minimum of twenty (20) LPRM inputs with three (3) per axial level is required for the APRM instrument channel to be OPERABLE. Fewer than the required minimum number of LPRM inputs generates an instrument channel inoperative alarm and a control rod block but does not result in an automatic trip input to the 2-out-of-4 voters.
~
m e
t 4 3.1 EASIE (Cont'd) (I% SEP 2 71994 than is necessary to meet Each protection trip system has one more {~ jpgfg the m mum number required per channel. His allows the bypassing of onf (Er per protection trip system for maintenance. testing or
~
calibratio jn.)"(dfi c ejs )(avA /],Jfo/be/n J rarvHiedEvaf%g) f Cffr/Wyafs4nt/of n e c 1./ The bases for the scram setting for the IRM, APRM, high reactor pressure, reactor low water level, MSIV closure, turbine control valve fast closure and turbine stop valve closure are discussed in Specifications 2.1 and 2.2. Instrumentation (pressure switches) for the drywell are provided to detect a loss of coolant accident and initiate the core standby cooling equipment. A high drywell pressure scram is provided at the same setting as the core cooling systems (CSCS) initiation to minimize the energy which must be accommodated during a loss of coolant accident and to prevent return to criticality. This instrumentation is a backup to the reactor vessel water level instrumentation. _ A reactor mode switch is provided which actuates or bypasses the various scram functions appropriate to the particular plant operating status. Reference Section 7.2.3.7 FSAR. The manual scram function is active in all modes, thus providing for a manual means of rapidly inserting control rods during all modes of reactor operation. o The IRM system (120/125 scram) in conjunction with the APRM system (15 percent seron) provides protection against excessive power levels and kva short reactor periods in the startup and intermediate power ranges. The control rod drive scram system is designed so that all of the water which is discharged from the reactor by a scram can be accommodated in the discharge piping. The discharge volume tank accommodates in excess of 50 gallons of water and is the low point in the piping. No credit was taken for this volume in the design of the discharge piping as concerns the amount of water which must be accommodated during a scram. During normal operation the discharge volume is empty; however, should it fill with water, the water discharged to the piping from the reactor could not l 1 l 1 i (-_ ) 3.1/4.1-15 AMEN 0 MENT NO. 2 2 7 BFN Unit 2
I i t 3.1 BAS ES (cont'd)
- be accommodated which would result in slow scram times or partial control rod _ insertion. To preclude this occurrence, level switches have been !
provided in the instrument volume which alarm and scram the reactor when .( the volume of water reaches 50 gallons. As indicated above, there is j sufficient volume in the piping to accommodate the scram without f impairment of the scram times or amount of insertion of the control rods. This function shuts the reactor down while sufficient volume ! remains to accommodate the discharge water and precludes the situation in which a scram would be required but not be able to perform its function t adequately. ' A source range monitor (SRM) system is also provided to supply additional { neutron level information during startup but has no scram functions. 1 Reference Section 7.5.4 FSAR. Thus, the IRM is required in the REFUEL -i and STARTUP modes. In.the power range the APRM system provides required ! protection. Reference Section 7.5.7 FSAR. Thus, the IRM System is not required in the RUN mode. The APRMs and the IRMs provide adequate f coverage in the STARTUP and intermediate range. ; i The hign reactor pressure, high drywell pressure, reactor-low water s level, low scram pilot air header pressure and scram discharge volume high level scrams are required for STARTUP and RUN modes of plant ! operation. They are, therefore, required to be operational for these I modes of reactor operation. k ' The requirement to have the scram functions as indicated in Table 3.1. A i OPERABLE in the REFUEL mode is to assure that shifting to the REFUEL mode ! during reactor power operation does not diminish the need for the reactor f protection system. ' [ t lg (M
- Because of the APRM downsca e limit of > 3 percent when in the RUN mode and high levef}1imit of 115 percent when in the STARTUP Mode, the ;
transition between the STARTUP and RUN Modes must be made with the APRM j instrumentation indicating between 3 percent and 15 percent of rated ! power (og'.,A footresl t9d MrAm/w/1/ 9 Cot @. In addition, the IRM system ; must be indicating below tne Mign Flux setting (120/125 of scale) or a , scram will occur when in the STARTUP Mode. For normal operating { conditions, these limits provide assurance of overlap betWeen the IRM ; system and APRM system so that there are no " gaps" in the power level f indications. (1.e. , the power level is continuously monitored from ! beginning of startup to full power and from full power to SHUTDOWW). ! When power is being reduced. if a transfer to the STARTUP mode is made and the IRMs have not been fully inserted (a malopeiational but not [ impossible condition) a control rod block immediately occurs so that i reactivity insertion by control rod withiirawal cannot occur. The low scram pilot air header pressure trip performs the same function l
, as the high water level in the scram discharge instrument volume for f ast fill . events in which the high level instrument response time may bei
- inadequate. A fast fill event is postulated for certain degraded control {'
. air events Ln which the scram outlet valves unseat enough to allow 5 gpa per drive leakage into the scram discharge volume but not enough to cause {
control rod insertion. l s b i BFW 3.1/4.1-16 ! Unit 2 !
, y-r- gn v ,
~. l ,,. ht 0fAWS C CAlb 4.1 BASES / J.h I [' ~ Tne minimum functional testing frequency used in this specification is g-based on a reliability analysis using the concepts developed in reference ( (1). This concept was specifically adapted to the one-out-of-two taken twice logic of the reactor protection system. The analysis shows that the sensors are primarily responsible for the reliability of the reactor protection system. This analysis makes use of " unsafe failure" rate experience at conventional and nuclear power plants in a reliability model for the system. An " unsafe failure" is defined as>one which negates channel operability and which, due to its nature, is revealed only when the channel is functionally tested or attempts to respond to a real signal. Failure such as blown fuses, ruptured bourdon tubes, faulted emp11flers, faulted cables, etc., which result in " upscale" or "downscale" readings on the reactor instrumentation are " safe" and will be easily recognized by the operators during operation because they are revealed by an alarm or a scram. 4
/he channels listed in Tables 4.1.A and 4.1.B are divided into three groups for functional testing. These are: l A. On-off sensors that provide a scram trip function.
B. Analog devices coupled with bistable trips that provide a scram function. C. Devices which only serve a useful function during some restricted mode of operation, such as STARTUP or SHUTDOWN, or for which the only practical test is one that can be performed at SHUTDCN'N. E The sensors that make up group (A) are specifically selected from among " the whole family of industrial on-off sensors that have earned an excellent reputation for reliable operation. During design, a goal of 0.9999 probability of success (at the 50 percent confidence level) was adopted to assure that a balanced and adequate design is achieved. The ) probability of success is primarily a function of the sensor failure rate and the test interval. A three-month test interval was planned for group (A) sensors. This is in keeping with good operating practices, and satisfies the design goal for the logic configuration utilized in the i Reactor Protectior' System.
\
To satisfy the long-term objective of maintaining an adequate level of safety throughout the plant lifetime, a minimum goal of 0.9999 at the 95 percent confidence level is proposed. With the (1-out-of-2) X (2) logic, this requires that each sensor have an availability of 0.993 at the 95 l percent adjustin confidence level. This level of availability may be maintained by I history.gthetest interval as a function of the observed failure 1. Reliability of Engineered Safety Features as a Function of Testing Frequency. I. M. Jacobs. " Nuclear Safety," Vol. 9. No. 4. July-August. 1968. pp. 310-312. BFW 3, g/4, } _17 Unit 2 l l l
l . 4.1 BASES (Cont'd) The f eq .nc of cal brati of he RM F ow Bi sing etwor has een est lie led at .ach refue ng o tage. Th te ar seve al in trume ts ich (, mus b ca ibr ted nd i will take seve al ho s to perfo the c ibr ti no th entir net rk. Wh1 e the alib ation is b ng rf me , a er flow igna wil be ent t half of th AP a re uit g l n ha f s am nd r bl k co iti n. T s. 1 the alib tio wer per or ed rin ope atio .. flu sha ing uld t be ssi e. Bas er er ene at ther ene ating stat ons, rift f ins rume ts, such as t os in he low asi g Net rk, is n sig fica and the efor , o vo sp rio s se ams, a cal bra on f quen y of ch fue ing utage is es abli hed - Group (C) devices are active only during a given portion of the operational cycle. For example, the IRM is active during STARTUP and inactive during full power operation. Thus, the only test that is meaningful is the one performed just prior to SHUTDOWN or STARTUP: 1.e., the tests that are performed just prior to use of the instrument. Calibration frequency of the instrument channel is divided into two groups. These are as follows:
- 1. Passive type indicating devices that can be compared with like units on a continuous basis.
- 2. Vacuum tube or semiconductor devices and detectors that drift or lose sensitivity.
Experience with passive type instruments in generating stations and substations indicates that the specified calibrations are adequate. Por ^^" those devices which employ amplifiers, etc., drif t specifications call for drift to be less than 0.4 percent / month; i.e., in the period of a month a drift of 4 percent would occur and thus providing for adequate margin. . Por the APRM system drift of electronic apparatus is not the only consideration in determining a calibration frequency. Change in power distribution and loss of chamber sensitivity dictate a calibration every seven days. Calibration on this frequency assures plant operation at or below thermal limits. A comparison of Tables 4.1.A and 4.1.B indicates that two instrument channels have been included in the latter table. These are: mode switch , in SHUTDOWW and manual scram. All of the devices or sensors associated with these scram functions are simple on-off switches and, hence, calibration during operation is not applicable, i.e., the switch is either on or off. Insesf* li BPW 3.1/4.1-19 Unit 2 s.
INSERT J: - The APPN and 2-out-of-4 voter channel har:3 ware is provided with a self-test capability which automatically checks most of the critical hardware at least once per 15 minute interval whenever the APRM channel is in the operate mode. This provides a virtually I continuous monitoring of the essential APRM trip functions. In the event a critical fault is detected, an " inoperative" trip signal results. A fault detected in non-critical hardware results in an
" inoperative" alarm. Following receipt of an " inoperative" trip or alarm signal, the operator can employ numerous diagnostic testing i options to locate the problem, t The automatic self-test function is supplemented with a manual APRM '
trip functional test, including the 2-out-of-4 voter channels and I the interface with the RPS trip systems. In combination with the virtually continuous self-testing, the manual APRM trip functional test provides adequate functional testing of the APRM trip function. Therefore, the six-month test frequency for the manual testing provides an acceptable level of availability of the APRM. { I j In addition to the above tests, the 2-out-of-4 voter is used to test the RPS scram contactors. The output of each voter channel is l j tripped to produce a scram signal into each of the RPS trip system ! channels (A1, A2, B1 and B2) to individually operate the respective l scram contactors. The weekly test interval provides an acceptable level of availability of the scram contactors. Each APRM receives the output signals from two analog differential pressure flow transducers, one associated with recirculation loop A ! and the other with recirculation loop B. These differential ko pressure signals are converted into representative digital loop flow signals within the same hardware that performs the APRM functions and are added to determine a total recirculation flow. The total recirculation flow value is used by the APRM to determine the flow biased setpoints. Each total recirculation flow signal developed by an APRM is compared in the hardware that performs the RBM functions to the signals from the remaining three APRMs. An alarm is given if a preset compare level setpoint is exceeded. The flow processing is integrated with the APRM processing and is covered by the same self-test and alarm functions described earlier. As a result of the virtually continuous monitoring of the equipment performing the flow processing, and the automatic comparison of redundant flow signals, it is acceptable to calibrate this equipment once per operating cycle.
' s e
- t, !
4.1 BASES (Cont'd) MAY201993 , The sensitivity of LPRM detectors decreases with exposure to neutron flux ! at a slow and approximately constant rate.- The APRM system, which uses : the LPRM readings to detect a change in thermal power, will be calibrated j every seven days using a heat balance to compensate for this change in ' sensitivity. The REM system uses the LPRM reading to detect a localited ' change in thermal power. It applies a correction factor based on the APRM ; output signal to determine the percent thermal power and therefore any
- change in LPRM sensitivity is compensat for by the APRM calibration. .'
The technical specification limits of ' CPggandAPLHGRare determined by the use of the process co uter or other backup methods. l , These methods use LPRM readings and TIP data to determine the power distribution. Compensation in the process computer for changes in LPRM sensitivity will i be made by performing a full. core TIP traverse to update the computer calculated LPRM correction factors every 1000 effective full power hours. < As a minimum the individual LPRM meter readings vill be adjusted at the beginning of each operating cycle before reaching 100 percent power. t
$ M '6 4h i
f. f I (' BFN Unit 2 3.1/4.1-20 AMENDMENT NO. 216 I l l 1
1 TABLE 3.2.C INSTRUMENTATION THAT INIIIATES ROD BLOCKS a t, Minimum Operable I gg Channels Per Trio Function (51 r, Function Trip tevel Settina J $ 1) APRM Upscale (Flow Blas) (2) d J @.1) APRM Upscale (Startup Mode) (B) 112% I 3 hl) APRH Downscale (9) 13% j J hl) APRM Inoperative (105) 2(7) 2(7) RBH Upscale ( Blas) h ~{ 2(7) RBM Downscale (9) (/J) h ( 87,) . RBM Inoperative (10c) 6(1) IRM Upscale (8) 1108/125 of full scale 6(l) IRN Downscale (3)(8) 15/125 of full scale P 6(1) IRM Detector not in Startup Position (8) (11) N D 6(1) 1RM Inoperative (8) (10a) 3(1) (6) SRM Upscale (8) 5 1 IX10 counts /sec.
~
3(1) (6) SRM Downscale (4)(8) 13 counts /sec. 3(1) (6) 3RM Detector not in Startup Position (4)(8) (11) 3(1) (6) SPM Inoperative (8) (10a)
~
- 1) ow as C arato 11 dif 'rence nr ircul tion ' flow 2(, Flo Blas a 1115% f rey I ow U
1 Rod Block Logic N/A 1(12) liigh Water Level in West 125 gal. Scram Discharge Tank z (L$-85-45L) o 1(12) High Water Level in East 125 gal. I ' " Scram Discharge Tank i (LS-85-45H) , u Ln Pe.u, R
.,e ia) (m)D ,. / r.,h-, e Je Po~ Ra p to) (I4) e'!
Hqi Pon R .,e to) _ (1's )
THIS PACE IRTERTIONALLY LETI BLARK l BFN 3.2/4.2-25. AMSDMDfT W. 2 I 2 unit 2 emq 4
F NOTES FOR TABLE 3.2.C .
- 1. The minimum number of OPERABLE channels for each trip function is detailed for the STARTUP and EUN positions of the reactor mode selector l switch. The SEM, IRM, and APEM (STARTUP mode), blocks need not be OPERABLE in "EUN" mode, and the APEM (flow biased) rod blocks need not be OPERABLE in "STARTUP" mode.
With the number of OPERABLE channels less than required by the minimum OPERABLE channels per trip function requirement, place at least one . inoperable channel in the tripped condition within one hour.
- 2. The trip level setting shall be as specified in the CORE OPERATING LIMITS REPORT. .
- 3. IRM downscale is bypassed when it is on its lowest range.
4 SEMs A and C downscale functions are bypassed when IIMs A, C, E, and G are above range 2. SEMs B and D downscale function is bypassed when i IEMs B, D, F, and H are above range 2. SEM detector not in startup position is bypassed when the count rate is 1100 CPS or the above condition is satisfied.
- 5. During repair or calibration of_ equipment, not more than one SEM (r O88th channel nor more than two (d)pyg IIM chamels may be bypassed. "@ EBM Bypassed channels are not counted as OPERABLE channels to meet the minimum OPERABLE channel requirements. Refer to section 3.10.B for SEM requirements during core alterations.
a
- 6. IIM channels A, E, C, G all in range 8 or above bypasses SEM channels A and C functions.
IEM channels B, F, D, H all in range 8 or above bypasses SEM channels B and D functions.
- 7. The following operational restraints apply to the RBM only.
- a. Both RBM channels are bypassed when reactor power is 130 percent or when a peripheral (edge) control rod is selected,
- b. The RBM need not be OPEmm.R in the "startup" position of the
[nguf k reactor mode selector switch. 9 d f. Two IBM channels are provided and only one of these may be bypassed with the console selector. If the inoperable channel cannot be restored within 24 hours, the inoperable channel shEll be placed in the tripped condition within one hour. 6 [. With both IBM channels inoperable, place at least one inoperable rod block monitor channel in the tripped condition within one hour. BFN 3.2/4.2-26 . 232 Unit 2 i as - * ""
- - __--_u-,_ - - - - - - - _ - _ _ , _ _
INSERT K: A- -- # --- - 7.c. The REM need not be OPERABLE if either of the following two conditions is met: (1) Reactor thermal power is 290 percent of rated and MCPR is 21.40, or (2) Reactor thermal power is <90 percent of rated and MCPR is 21.70.
- - - - V' s
NOTES FOR TABLE 3.2.C'(Cont'd)
- 8. This function is bypassed when the mode switch is placed in EUN.
- 9. This function is only active when the mode switch is in EUN. This function is automatically bypassed when the IRM instrumentation is OPERABLE and not high.
- 10. The inoperative trips are produced by the following functions:
- a. SEMandIbf (1) Local " operate-calibrate" switch not in operate.
l (2) Power supply voltage lov. (3) Circuit boards not in circuit. f)ti R$0Hif Cp
- b. APEM "# WhN W
~
(1) Local " operate-calibrate" svitch not in operate. (2) Less than inputs. _ (&M*'7**/*7c 1? ?=P)$ BW' ndle wp/9,),
- c. <-
~f OfVC/'AC5*-/~JU.
(1) Local " operate-calibrate" switch not in operate.
<2) @ = M N S c D # A t*y1D RhHn,0.M y/ g (3) ESM fails to null. '
4 Less h required nn=her of LPEM in uts for rod selected, r) Selp hJ sbhJs2 enkJ pa /h
- 11. Detecto s.1erse is adjusten to 114 m 4 in es, placing the detector lower position 24 inches below the lower core piste.
- 12. This function may be bypassed in the SHUTDOWN or EEFUEL mode. If this function is inoperable ait a time when OPERABILITI is required the charmel shall be tripped or administrative controls shall be immediately imposed to prevent. control rod withdrawal.
tri le el ett d The[if#ed eC pf2d e pped/ralue r thi settid a b as pyc LIMITS ET. fPE , [ n r) S tr i GFN 3.2/4.2-27 ^* Unit 2
t INSERT L: ;
- 13. The RBM rod block trip setpoints and applicable power ranges are specified in the CORE OPERATING LIMITS REPORT (COLR).
l 1
- 14. Less than or equal to the setpoint allowable value specified
\ in the COLR. .
15, Greater than or equal to the setpoint allowable value ; specified in the COLR. _ _ - l h t 5 f t 1 1 l l l l I 4 I
r - 8 TABLE 4.2.0 SURVEILLMCE REQUIREMENTS FOR IN51RUMENIA110N IHAT INiilATE R00 BLOCKS '
- @E Function Functional Tett Calibution (171 Ini rument t Check F5
" once/ once/ day (8)
APRM Upscale (Flow 8las) (1) (13) pu /c.y cysle H APRH Upscale (Startup Mode) (1) (13) once g e once/ day (8) APRH Downscale * (1) (13) once M S once/ day (8) - APRHinoperative (1) (13) N/A once/ day (8)
/'w RBM Upacale Slas) (1) (13) once/h9h p/j)E ocf/p67 p_
RBM Downscale (1) (13) once/pp9npgM d2,(day J$)e RBM Inoperative (1) (13) N/A (h%y y (1)(2) (13) once/3 months .once/ day (8) - IRH Upscale (1)(2) (13) once/3 months once/ day (8) IRM Downscale IRM Detector Not in Startup Position (2) (once operating cycle) once/ operating cycle (12) N/A F (1)(2) (13) N/A N/A IRH Inoperative ' (1)(2) (13) once/3 months once/ day (8) SRM Upscale (1)(2) (13) once/3 months once/ day (8)' SRM Downscale SRM Detector Not in Startup Position (2) (once/ operating cycle) once/ operating cycle (12) N/A (1)(2) (13) N/A N/A Spisle. operative j
%96$fsCM at/ / / / / [1)(1)) / [ // fnce/ofera/ing/yclep0)/ ,N/A h as h al [ [ / / I bd15[ [ (( [oncpI3 dat}d / / / //A -
Rod Stock Logic (16) N/A N/A once/18 months N/A
. y West Scram Discharge Tank Water Level liigh once/ quarter >'
m @- f5 (L3-8545L) N/A M o East Scram Discharge once/ quarter once/18 months
- c)
Tank Water Level liigh (LS-8545M) g 3 m . I i i I . I D 3
J;
~
NOTES FOR TABLES 4.2. A iHRQUGH 4.2.L exceot 4.2.D AND 4.2.K h hh lhhh l fevTBh> n.lSDL P
- 1. functional tests shall be performed once per month., Fw 8PAMS M Ripts f usko u l k b S hil Q perjem ed nece pn (, ino,, h.s ,
- 2. Functional tests shall be performed before each startup with a required frequency not to exceed once per week.
- 3. This instrumentation is excepted from the functional test definition.
The functional test will consist of injecting a simulated electrical signal into the measurement channel.
- 4. Tested during logic system functional tests.
- 5. Refer to Table 4.1.B.
- 6. The logic system functional tests shall include a calibration once per operating cycle of time delay relays and timers necessary for proper ;
functioning of the trip systems. I
- 7. The functional test will consist of verifying continuity across the inhibit with a volt-ohmmeter.
- 8. Instrument checks shall be perf ormed in accordance with the definition of instrument check (see Section 1.0, Definitions). An instrument j check is not applicable to a particular setpoint, such as Upscale, but is a qualitative check that the instrument is behaving and/or !
indicating in an acceptable manner for the particular plant condition. ) Instrument check is included in this table for convenience and to indicate that an instrument check will be performed on the instrument. p Instrument checks are not required when these instruments are not required to be OPERABLE or are tripped.
- 9. Calibration frequency shall be once/ year.
- 10. Deleted
- 11. Portion of the logic is functionally tested during outage only.
- 12. The detector will be inserted during each operating cycle and the proper amount of travel into the core verified.
- 13. Functional test will consist of applying simulated inputs (see note 3). Local alarm lights representing upscale and downscale trips will be verified, but no rod block will be produced at this time. The inoperative trip will be initiated to produce a rod block (SRM and IRM inoperative also bypassed with the mode switch in RUN). The functions that cannot be verified to produce a rod block directly will be verified during the operating cycle.
( . t i l 3.2/4.2-59 AMENDMENT NU. y 5 y BFN l Unit 2 r h
I NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2.D AND 4.2.K (Cont'd) 14 (Deleted) g , Th f vb s om arat rv 1b tes ed b putti one flow unit n
- 15. the est i put t obt
" es pr d i 1/2 ser ) a d ad usti e fl v bi s up cale v 1b veri ed b n[
om rt d ock lo 1 ' sea e tr p 1 he ring o era on ver ipft t ob e i opera ing c cle. i v 11 p odu e a od block dur t Portions of the logic is checked more
- 16. Performed during operating cycle.
frequently during functional tests of the functions that produce a rod block.
- 17. This calibration consists of removing the function from service and performing an electronic calibration of the channel.
- 18. Functional test is limited to the condition where secondary containment integrity is not required as specified in Sections 3.7.C.2 and 3.7.C.3.
- 19. Functional test is limited to the time where the SGTS is required to meet the requirements of Section 4.7.C.1.a. gg
- 20. C4 ib a doyof the om7araft rr uire/ th in flow ts f bia mbsighr1 irc at n to th o o M i ter pt d, *nere repvi t 7, f ** u ,
f' *$ l " *" ?
- 21. Logic test is limited to the time where actual operation of the equipment is permissible. kn.>. .
i
- 22. (Deleted)
- 23. (Deleted)
- 24. This instrument check consists of comparing the thermocouple readings for all valves for consistence and for nominal expected values (not required during refueling outages).
- 25. During each refueling outage, all acoustic monitoring channels shall be calibrated. This calibration includes verification of accelerometer response due to mechanical excitation in the vicinity of the sensor.
T 3.2/4.2-60 AEDMET NO. 210 BFN , Unit 2
.- - -- . - - . ... - = . _ - - - . ._.-
)
3.2 BASES (Cont'd) f I The instrumentation which initiates CSCS action is arranged in a dual bus system. As for other vital instrumentation arranged in this fashion, the specification preserves the effectiveness of the system even during } periods when maintenance or testing is being performed. An exception to ! this is when logic functional testing is being performed. ! I The control rod block functions are provided to generate a trip signal to t block rod withdrawal if the monitored power level exceeds a preset i value. The rip logic for this function is 1-out-of-n: e.g., any trip on one o / PRMs, eight IRMs, or four SRMs will result in a rod block.. When the RBM is required, the minimum instrument channel requirements apply. These requirements assure sufficient instrumentation to assure the single failure criteria is met. The minimum instrument channel requirements for the RBM may be reduced by one for maintenance, testing, or calibration. This does not significantly increase the risk of an ; inadvertent control rod withdrawal, as the other channel is available, and the RBM is a backup system to the written sequence for withdrawal of control rods. The APRM rod block function is flow biased and provides a trip signal for ! blocking rod withdrawal when average reactor thermal power exceeds pre-established limits set to prevent scram actuation. i The RBM rod block function provides local protection of the core; i.e., ! the prevention of critical power in a local region of the core, for a , single rod withdrawal error from a limiting control rod pattern. , If the IRM channels are in the worst condition of allowed bypass, the sealing arrangement is such that for unbypassed IRM channels, a rod block signal is generated before the detected neutrons flux has increased by i more than a factor of 10. A downscale indication is an indication the instrument has failed or the instrument is not sensitive enough. In either case the instrument will not respond to changes in control rod motion and thas, control rod motion is prevented. The refueling interlocks also operate one logic channel, and are required for safety only when the mode switch is in the refueling position. For effective emergency core cooling for small pipe breaks, the HPCI system must function since reactor pressure does not decrease r'apid enough to allow either core spray or LPCI to operate in time. The. . . automatic pressure relief function is provided as a backup to the HPCI in the event the HPCI does not operate. The arrangement of the tripping contacts is such as to provide this function when necessary and minimize spurious operation. The trip settings given in the specification are i BFN 3.2/4.2-68 Unit 2 m ' y
7 i J ' D 4.2 BASES (Cont'd) SEP 2 21993 The best test procedure of all those examined is to perfectly stagger the tests. That is, if the test interval is four months, test one or the -
- other channel every two months. This is shown in Curve No. 5. The (
difference between Cases 4 and 5 is negligible. There may be other . arguments, however, that more strong;y' support the perfectly staggered-tests, including reductions in human error. The conclusions to be drawn are these: ;
- 1. .A 1-out-of-n system may be treated the same as a single channel in L terms of choosing a test interval; and
- 2. more than one channel should not be bypassed for testing at any one time.
The radiation monitors in the reactor and refueling zones which initiate ; building isolation and standby gas treatment operatior *.1e arranged such ; that two sensors high (above the high level setpoint) in a single channel or one sensor downscale (belov lov level setpoint) or inoperable in two channels in the same zone vill initiate a trip function. The functional testing frequencies for both the channel functional test and the high !
. voltage power supply functional test are based on a Probabilistic Risk Assessment and system drift characteristics of the Reactor Building Ventilation Radiation Monitors. The calibration frequency is based upon .
the drift characteristics of the radiation monitors. , The automatic preocure relief instrumentation can be considered to be a j 1-out-of-2 logic system and the discussion above applies also. 3 ; The RCIC and HPCI system logic tests required by Table 4.2.3 contain " i provisions to demonstrate that these systems vill automatically restart on '} a RFV low water level signal received subsequent to a'RPV high water level l trip. hMr /1 7 1
~
INSE - The electronic instrumentation comprising the APRM rod block and Rod Block Monitor functions together with the recirculation flow , instrumentation for flow bias purposes is monitored by the same i self-test functions as applied to the ApRM function for the RPS. ' l The functional test frequency of every six months is based on this > automatic self-test monitoring at 15 minute intervals and on the low !
, expected equipment f ailure rates. Calibration frequency of once per l operating cycle is based on the drif t characteristics of the limited }
number of analog components, recognizing that most of the processing .i is performed digitally without drift of setpoint values. 1 t
-- s-
.W ,
3.2/4.2-73a ENDMENTNO. 216 [ Unit 2
-1 .,
er T F
r I(; ' 3,3/4,3 REACTIVITY CONTROL CT 211993 LIMITING CONDITIONS TUR 07rRATION SURVEILfECE RE0UIREMEffrS r'
\
3.3.B. E2.ntrol Reds . 4.3.B. Control Rods 3.c. If Specifications 3.3.B.3.b.1 3.b.3 When the RWM is not through 3.3.B.3.b.3 cannot OPERABLE a second be met the reactor shall licensed operator not be started, or if the or other technically reactor is in the run or qualified member of startup modes at less than the plant staff shall 10% rated power, control rod verify that the correct movement may be only by rod program is followed. actuating the manual scram or placing the reactor mode switch in the shutdown position. 4 Control rods shall not be 4. Prior to control rod withdrawn for startup or withdrawal for startup refueling unless at least or during refueling, two source range channels verify that at least two have an observed count rate source range channels equal to or greater than three counts per second. have an observed count rate of at least three counts per second.
- 5. 1 o er t n- th 5. br ng pe ti D L
P D qua " CP r D q 1 o , to or gr at t .9 , or e er 0 5, t , i:
, i en f cti rs es o th a 1 e:
. th ch e a 1 p fo ed pri r t e I LE- o el od i ra 1 l
' o a le to e er 4 rs her af r.
- b. Co trol ro vi rv b <
2 s 11 e ock d. (pc/ch)) l (ockhl) h BTN AMENDMENT NO. 217 - 3.3/4.3_g < Unit 2 I l
. l
p .. -
- t
~3 3/4 3 BASES (Cont'd) OCT 211gg N
- 5. Th Rod Block Mo itor ( ) is desi ed to a tomatically prevent f f el d se in he event f errone s rod vi raval rom ocat as of sh power ensity d ing high over le el ope els are rovided, be ion, o RBM ch one the / ma assed rom the c nsole fa mainte e and/o test .
Au matic r d withdr al bloc from one f the. el vil bl ek erro eous rod ithdraw soon eno sh to p vent el d ge. e speci ed rest ictions vi one el ut a service onservat ely ass re that fu 1 damag vill at a cur duetofodwithdrwalerrorswhenthiscondition
-s n ists.
C. Scram Insertion Times i The control rod system is designated to bring the reactor suberitical at the rate fast enough to prevent fuel damage; i.e., to prevent the MCPR from becoming less than 1.07. The limiting power transient is given in Reference 1. Analysis of this transient shows that the negative reactivity rates.resulting from the scram with the average response of all the drives as given in the above specification provide the required-protection, and MCPR remains greater than 1.07. On an early BWR, some degradation of control red scram performance occurred during plant STARTUP and was determined to be caused by particulate material (probably construction debris) plugging an internal control rod drive filter. The design of the present control rod drive (Model 7EDB144B) is grossly improved by the relocation of the filter to a location out of the scram drive path; i.e., it can no longer interfere w with scram performance, even if completely blocked. The degraded performance of the original drive (CRD7EDB144A) under dirty operating conditions and the insensitivity of the redesigned drive (CRD7EDB1448) has been demonstrated by a series of engineering-tests under simulated reactor operating conditions. The successful performance of the new drive under actual operating conditions has also been demonstrated by consistently good in-service test results for plants using the new drive and may be inferred from plants using the older model BFN f Unit 2 3.3/4.3-17 AMENDMENT N0. 21,7
.( '
ns l'Q: i,',;
$ 77' % 51e M --tme e +*-fe v+- -ty= -
F 3.5/4.5 CORE AND CONTAINMENT COOLING SYSTE?ig FAY 2 01993
/ LIMITING CONDITIONS FOR OPERATION SURVEILLANCE REOUIREMENTS 3.5.I Average Planar Linear Heat 4.5.I Averare Planar Linear Heat q Generation Rate Generation Rate (APLHGR) l During steady-state power The AFLHGR shall be checked l operation, the Average Planar daily during reactor
}-
Linear Heat Generation Rate operation at 1 25% rated (APLHCR) of any fuel assembly thermal power. at any axial location shall not ~ exceedtheappropriate[APLHGR ' limit provided in the CORE OPERATING LIMITS REPORT. If at j any time during operation it is Ng/ [ N sit / ( ' determined by normal surveillance that the limiting 6" c,, l l value for APLHGR is being [b exceeded, action shall be initiated within 15 minutes to restore operation to within the l prescribed limits. If the l AFLHGR is not returned to within the prescribed limits within two (2) hours, the reactor shall be brought to the COLD SHUTDOWN CONDITION within 36 hours. .
' Surveillance and corresponding action shall continue until j reactor operation is within the prescribed limits.
J. LineeJ_ Heat Generation Rate (LEGR) J. Linear Heat Generation Rate (LHGR) During steady-state power operation, The LHGR shall be checked the linear heat generation rate daily during reactor fuel HGR) of any rod in any fuel > operation at 1 25% rated assembly at any axial location shall thermal power. not exceed the appropriate LHGR I I l limit provided in the CORE 1 OPERATING LIMITS REPORT. If at any j i time during operation it is determined by normal survelliance j that the limiting value for LEGE is ! being exceeded, action shall be ! initiated within 15 minutes to restore operation to within the f prescribed limits. If the LHGR is , I not returned to within the ! prescribed limits within two (2) hours, the reactor shall be brought to the COLD SHUTDOWN CONDITION k within 36 hours. Surveillance and BFN , 3.5/4.5-18 AMENDMENT NO. 214 Unit 2 IMW
- b i
. 1
3.5/4.5 CORE AND CONTAINMENT COOLING SYSTEMS DEC 0 71994 LIMITING CONDITIONS FOR OPERATION SURVEILLARCE REOUIREMENTS ( l J. Linear Heat Generation Rate (LHGR) J. Linear Heat Generation Rate (LHGR) 3.5.J (Cont'd) corresponding action shall continue until reactor operation is within the prescribed limits. 3.5.K Minimum Critical Power Ratio 4.5.K Minimum Critical Power (MCPR) Ratio (MCPR) The minimum critical power ratio 1. MCPR shall be checked daily f (MCPR) shall be equal to or during reactor power operation
~ ^
[ greater than thefoperating limit at 1 257. rated thermal power MCPR (OLMCPR) as provided in the and following any channe in power level or distribution
-ftpfri4b CORE OPERATING LIMITS REPORT.
that vould cause operation If at any time during
#g steady-state operation it is with a LIMITING CONTROL ROD
/0w-tmd., b determined by normal PATTERN.
' surveillance that the limiting a , .6 % //=.h
#r e Jt" value for MCPR is being 2. MCPR ap' pf t/4/f,2d d y p exceeded, action shall be (pn9e ympm rJahall be ,
initiated within 15 minutes to determined as provided in the
- (A4[lh restore operation to within the CORE OPERATING LIMITS REPORT g o prescribed limits. If the using:
steady-state MCPR is not # returned to within the a. b as defined in the CORE , prescribed limits within two (2) OPERATING LIMITS REPORT hours, the reactor shall be prior to initial scram brought to the COLD SHUIDOWN time measurements for the CONDITION within 36 hours, cycle, performed in ] surveillance and corresponding accordance with action shall continue until Specification 4.3.C.1. reactor operation is within the # prescribed limits. b. basdefinedintheCORE OPERATING LIMITS REPORT ? 6 following the conclusion of each scram-time surveillance test required by Specifications 4.3.C.1 and 4.3.C.2. The determination of the limit must be completed within 72 hours of each - I scram-time surveillance required by Specification 4.3.C.
^
AMENDMENT No. 2 29 BFN 3.5/4.5-19 Unit 1 , L l I
3.5/4.5 CORE AND CONTAINMENT COOLING SYSTEMS ' LIMITING CONDITIONS FOR OPERATION SURVEILLANCE RECUIREMENTS I i 3.5 Core and Containment cooling Svstems 4.5 Core and Containment Coolins Svstems L. LPRM Setooints __ L. APRM Setooints 1. er e p e re hermal F2 fCMIL D shal pov is 1 2". of rated, the d termi ed d _1y he ra io o TR / D sha 1 he re ctor is 2*. . 110, r th APRM cram rate the al ov r
- etpo at quat on lis ed
/ in 5 cti n 2. . A an the A? r ble k'setp int e at' n 11 ted i" the EE PERA ING LI.ITS pgh EI? -I sh 11 be ultipli d by FIP/C 2 FD.
- 4. men i is de er=ined that 3.5. .1 is a t bela =et 6h rs is llowed o co ect th condi on.
(9thhl)
- 3. . 3.5.'.1 and .S.L. cannot e met the re ctor over
~ shall e red" ed to 1 25% of rate thern power within 4 hours. ' M. Core Thermal-Evdraulie Stabilitv M. Core Thermal-Rvdraulie S tabiliev r
- 1. The reactor shall not be 1. Verify that the reactor is operated at a thermal power outside of Region I and II and core flow inside of of Figure 3.5.M-1:
Regions I and II of i Figure 3.5.M-1. 4. Following any increase of more than 5% rated
- 2. If legion I of Figure 3.5.M-1 thernal power while is entered, immediately Laitial core flow is less initiate a manual scram. than 45% of rated, and
- 3. If Region II of Figure 3.5.M-1 b. Follo'ving any decrease is entered: of more than 10% rated core flow while initial thermal power is greater than 40% of rated.
BFN 3.5/4.5-20 ^
- Unit 2
i 3.5 BASES (Cont'd) 3.5.1.. AveraRe Planar Linear Heat Generation Rate (APLHCR) This specification assures that the peak cladding temperature following the postulated design basis loss-of-coolant accident will not exceed the limit specified in the 10 CFR 50, Appendix K. The peak cladding temperature following a postulated loss-of-coolant accident is primarily a function of the average heat generation rate of all the rods of a fuel assembly at any axial location and is only dependent secondarily on the rod-to-rod power distribution within an assembly. Since expected local variations in power distribution , within a fuel assembly affect the calculated peak clad temperature by less than i 20*F relative to the peak temperature for a typical fuel design, the limit on the average linear heat generation rate is gpf k sufficient to assure that calculated temperatures are within the 10 CFR 50 Appendix K limit. 3.5.J. Linear Heat Generation Rate (LHGR) i This specification assures that the linear heat generation rate in any rod is less than the design linear heat generation if fuel pellet densification is postulated. The LHGR shall be checked daily during reactor operation at
- 2. 25 percent power to determine if fuel burnup, or control rod movement has caused changes in power distribution. For LHGR to be a limiting value below 25 percent of rated thermal power, the largest ,
total peaking would have to be greater than approximately 9.7 which is l precluded by a considerable margin when employing any permissible control rod pattern.
- 3.5.K. Minimum Critical Power Ratio (MCPR)
At core thermal power levels less than or equal to 25 percent, the reactor will be operating at minimum recirculation pump speed and the moderator void content will be very small. For all designated control rod patterns which may be employed at this point, operating plant ? experience and thermal hydraulic analysis indicated that the resulting ; MCPR value is in excess of requirements by a considerable margin. With this low void content, any inadvertent core flow increase would only place operation in a more conservative mode relative to MCPR. The daily requirement for calculating MCPR above 25 percent rated ; thermal power is sufficient since power distribution shifts'are very slow when there have not been significant power or control rod ., changes. The requirement for calculating MCPR when a limiting control j pf0 rod pattern is approached ensures that MCPR will be known following a change in power or power shape (regardless of magnitude) that could place operation at a thermal limit. l 3.5.L. APRM Setooints - l
~ - - - ~
~[1 0 eryti n se s ' ne to the HG it Spgif atio 3d .
if mi is e c ed e co e mati. fr etion of imi y w BFN 3.5/4.5-31 ) Unit 2 M/)
)
I
~_,
bSERTN: - At less than rated power conditions, the rated APLHGR limit is adjusted by a power dependent correction factor, MAPFAC(P) . At less than rated flow conditions, the rated APLHGR limit is adjusted by a flow dependent correction factor, MAPFAC(F). The most limiting power-adjusted or flow-adjusted value is taken as . the APLHGR ) operating limit for the off-rated condition. f- , The flow dependent correction factor, MAPFAC(F), applied to the rated APLHGR limit assures that (1) the 10 CFR 50.46 limit would not be exceeded during a LOCA initiated from less than rated core flow f f l conditions and (2) the fuel thermal mechanical design criteria would , f be met during abnormal operating transients initiated from less than rated core flow conditions. MAPFAC (F) values are provided in the / CORE OPERATING LIMITS REPORT. The power dependent correction factor, MAPFAC(P), applied to the rated APLHGR limit assures that the fuel thermal mechanical design criteria would be met during abnormal operating transients initiated
/ !
from less than rated power conditions. MAPFAC(P) values are provided in the CORE OPERATING LIMITS REPORT. . INSER .
/ At less than rated power conditions, a power dependent MCPR f operating limit, MCPR (P) , is applicable. At less than rated flow I conditions, a flow dependent MCPR operating limit, MCPR(F), is ;
applicable. The most limiting power dependent or flow dependent value is taken as the MCPR operating limit for the off-rated k condition. The flow dependent limit, MCPR(F), provides the thermal margin required to protect the fuel from transients resulting from inadvertent core flow increases-. MCPR (F) values are provided in the t CORE OPERATING LIMITS REPORT. The power dependent limit, MCPR(P), protects the fuel from the other limiting abnormal operating transients, including localized events such as a rod withdrawal error. MCPR(P) values are provided in the CORE OPERATING LIMITS REPORT.
-- ~
4 I i i I
3.5 BASES (Cont'd) dens ty CMFpFD) equal 1.0. Fo the ca e wher' CMFLP exceeds ,the fr ti of at the al over operat n is rmitt d on1 at less. t n 0-p rce rat d po er a only th AP . ser sett ngs s eq red S cif atio 3.5 .1. e ser trip etti an ro bl k tr p a ttin are djus ed to sure at no ombi tio of C 1PD nd Pw 1i reas the L R tr sient eak b on tha low by the -per ent p astic rain imit. A 6- ur me er od to a lev thi con tion is jus fled ince e ad tio al r n , gai ed b the setd ad stmen is a ve and beyon th t e su ed ' the saf 3.5.M. Core Thermal-Hydraulic Stability The minimum margin to the onset of thermal-hydraulic instability occurs in Region I of Figure 3.5.M-1. A manually initiated scram upon entry into this region is sufficient to preclude core ' oscillations which could challenge the MCPR safety limit. Because the probability of thermal-hydraulic oscillations is lower and the margin to the MCPR safety limit is greater in Region II than in Region I of figure 3.5.M-1, an immediate scram upon entry into the region is not necessary. However, in order to minimize the probability of core instability following entry into Region II, the operator will take immediate action to exit the region. Although formal surveillances are not performed while exiting Region II (delaying exit for surveillances is undesirable), an immediate manual . scram will be initiated if evidence of thermal-hydraulic instability is observed. Clear indications of thermal-hydraulic instability are APRM oscillations which exceed 10 percent peak-to-peak or LPRM oscillations which exceed 30 percent peak-to-peak (approximately . equivalent to APRM oscillations of 10 percent during regional i oscillations). Periodic LPRM upscale or downscale alarms may also be indicators of thermal hydraulic instability and will be immediately investigated. , Periodic upscale or downscale LPRM alarms will occur before regional oscillations are large enough to threaten the MCPR safety limit. Therefore, the criteria for initiating a manual scram described in the preceding paragraph are sufficient to ensure that the MCPR safety limit will not be violated in the event that core oscillations initiate while exiting Region II. Normal operation of the reactor is restricted to thermal power and core flow conditions (i.e., outside Regions I and II) where thermal-hydraulic instabilities are very unlikely to occur. f BFN 3.5/4.5-32 Unit 2 L __ _ . _ . _ _ _ _ _ _ -
( ] 6.9.1.6 SOURCE TESTS Results of required leak testa performed on sources if the tests reveal the presence of 0.005 microcurie or more of removable contamination. 6.9.1.7 CORE OPERATING LIMITS REPORT
- a. Core operating limits shall be established and shall be documented in the CORE OPERATING LIMITS REPORT prior to each operating cycle, or prior to any remaining portion of an operating cycle, for the following:
(1) AP r Specification 3.5.I (2) The LkCR for Specification 3.5.J
/
. ;m 6
he/65 (3) Th MfRfpe _ for Specification 3.5.K/4.5.K f# ff (4) The APRM Flow Biased Rod Block Trip Setting for & I
~
Specification 2.1.A.1.cg Table 3.2.Cg Sjeppegojt
-e (5) pse e( owBias[ Trip / bet /ng/td/1jdpfjd I va e or is ett for' Table 3.2.C
- b. The analytical methods used to determine the core operating limits shall be those previously reviewed and approved by the NEC, specifically those described in General Electric Licensing. Topical Report NEDE-24011-F-A, " General Electric Standard Application for Reactor Fuel" (latest approved version).
AMENDMENT NO. 232 BFN 6.0-26a , Unit 2 *
... . - - ~ -- --
INSERT P: 7 (1) The rated APLHGR limit; the Flow Dependent APLHGR Factor, MAPFAC (F) ; and the Power Dependent APLHGR Factor, MAPFAC ( P) for Specification 3.5.I. (2) The LGHR limit for Specification 3.5.J. (3) The rated MCPR Operating Limit; the Flow Dependent MCPR Operating Limit, MCPR(F), and the Power Dependent MCPR Operating Limit, MCPR(P) for Specification 3.5.K/4.5.K. l (4) The APRM flow biased rod block trip setting for Specification 2.1.A.1.c and Table 3.2.C. (5) The REM downscale trip setpoint, high power trip setpoint, intermediate power trip setpoint, low power trip setpoint, and applicable reactor thermal power ranges for each of the setpoints for Table 3.2.C.
=
~
y 11 0 DEFINITIONS (Cont'd) W 2 0 tm Occratinn Cvele - Interval between the end of one refueling outage Q. for a particular unit and the end of the next subsequent refueling outage for the same unit. R. Refueling Outare - Refueling outage is the period of time between the shutdown of the unit prior to a refueling and the startup of the unit after that refueling. For .the purpose of designating frequency of testing and surveillance, a resueling outage shall mean a 7 regularly scheduled outage; however, where such outages occur within 8 months of the completion of the previous refueling outage, the . required surveillance testing need not be performed until the next regularly scheduled outage. S. CORE ALTERATION - CORE ALTERATION shall be the move =ent of any fuel, sources, reactivity control components, or other components affecting reactivity within the reactor vessel with the vessel head removed and fuel in the vessel. Movement of source range monitors, intermediate range monitors, traversing in-core probes, or special movable detectors (including undervessel replace =ent) is not considered a CORE ALTERATION. Suspension of CORE ALTERATIONS shall not preclude completion of movement of a component to a safe location. T. Reactor vessel Pressure - Unless otherwise indicated, reactor vessel pressures listed in the Technical Specifications are those measured by the reactor vessel steam space detectors.
~-
U. Thernal Parameters
- 1. Minimum Critical Power Ratio (MCPR) - Minimum Critical Power Ratio (MCPR) is the value of the critical power ratio associated with the most limiting assembly in the reactor core. Critical Power Ratio (CPR) is the ratio of that power in a fuel assembly, which is calculated to cause some point in the assembly to ,
experience boiling transition, to the actual assembly operating l power.
- 2. Transition Boilinz - Transition boiling means the boiling regime between nucleate and film boiling. Transition boiling is the {
regime in which both nucleate and film boiling occur j intermittently with neither type being completely stable. CDELETED 3. fCore Rhximdm Fytetion of LE!nitinar Power Jensity (CMFL7D) - e h es rat , for 11 el as blie and a azia loca ons l co , of em brrn el rod over ensity (W/f f a en # 1 as bly d av4 loca on to b e 14 ting el .od we densi (W t) at t lo tion.
}
4 Average Planar Linear Heat G qeration Rate (APLHGR) - The Average Planar Heat Generation Race is applicable to a specific planar height and is equal to the sum of the linear heat generation rates for all the fuel rods in the specified bundle ( ' at the specified height divided by the nunber of fuel rods in the fuel bundle. BFN 1.0-7 Unit 3 AMENDMENT NO. I 7 0
1.0 DEFINITIONS (Cont'd) f COPE P2XIffM TRACTIOF OF ARITIWAL PQWER (bCPY- CDP T C ON C TIC P0k is he im val' of e tio of h fle -cor ete CPR per ing imit oun in t CO O RA NG ITS PO A di .ded yt act 1 CP for all ue1 ( ss lie in t e cc e. jf V. Instrumentation
- 1. Instrument Calibration - An instrument calibration means the adjustment of an instrument signal output so that it corresponds, within acceptable range, and accuracy, to a known value(s) of the parameter which the instrument monitors.
- 2. Channel - A channel is an arrangement of the sensor (s) and '
associated components used to evaluate plant variables and , produce discrete outputs used in logic. A channel terminates and loses its identity where individual channel outputs are combined in logic.
- 3. Instrument Functional Test - An instrument functional test means
- the injection of a simulated signal into the instru=ent primary sensor to verify the proper instrument channel response, alarm and/or initiating action.
4 Instrument Check - An instrument check is qualitative determination of acceptable OPERABILITY by observation of l , instrument behavior during operation. This determination shall include, where possible, comparison of the instrument with other independent instruments measuring the same variable.
- 5. Lorie System Punctional Test - A logic system functional test i means a test of all relays and contacts of a logic circuit to insure all components are OPERABLE per design intent. Where practicable, action vill go to completion; i.e., pumps vill be l
started and valves operated.
- 6. Trio System - A trip system means an arrangement of instrument channel trip signals and auxiliary equipment required to initiate action to accomplish a protective trip function. A trip system may require one or more instrument channel trip signals related to one or more plant parameters in order to initiate trip system action. Initiation of protective action may require the tripping of a single trip system or the coincident tripping of two trip systems.
- 7. Protective Action - An action initiated by the protection system when a limit is reached. A protective action can be at a channel or system level.
- 8. Protective Function - A system protective action which results from the protective action of the channels monitoring a particular plant condition.
BFN 1.0-8 AIIENDMENT NO. 190 Unit 3 ti
I 1.1/2.1 FUEL CLADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING l l 1.1 FUEL CLADDING INTEGRITY 2.1 FUEL CLADDING INTEGRITY !
- 1 Aeolicability Aeolicability Applies to the interrelated Applies to trip settings of variables associated with fuel the instruments and devices thermal behavior. which are provided to prevent the reactor system safety limits from being exceeded.
t Obiective Obiective To establish limits which To define the level of.the , ensure the integrity of the process variables at which fuel cladding. automatic protective action is initiated to prevent the fuel cladding integrity safety limit from being exceeded. Specification S~oeci fi cation The limiting safety system + settings shall be as specified below: A. Thermal Power Limits A. Neutron Flux Trio Settinus
- 1. Reactor Pressure >800 1. APEM T1ux Scram psia and Core Tiov Trip Setting ,
> 10% of Eated. (Run Mode) (Flow -'
Biased) When the reactor pressure is greater a. inten the Mode than 800 psia, the Switch is in i existence of a min 4=ne the RUN l critical power ratio position, the . (MCPE) less than 1.07 APEM flux shall constitute scram trip violation of the fuel setting , cladding integrity shall be: safety limit. { t BFN 1.1/2.1-1 Unit 3 _ , , , . _ . . . . . . . - - - . -= **~ * * " " * *
- n w
1.1/2.1 FlTEL CLADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 2.1.A Neutron Flux Trio Settings' 2.1.A.1.a (Cont'd) (d.56Wf 7/Is) L. Si / l where: S = Setting in percent of rated-thermal power ( (3293 MWt) W = Loop recirculation flow rate in
... percent of rated y
- b. For no combination of loop i recirculation flow rate and core thermal power shall the APRM flux scram trip setting be allowed to exceed 120% of rated thermal power.
BFN 1.1/2.1-2 AlfENDl!ENT NO. 190 Unit 3
- 2
1.1/2.1 FUEL CLADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 2.1.A Neutron Flux Trio Settings 2.1.A.1.b. (Cont'd) NOTE: These settings as'.me operation within the basic thermal hydraulic design l criteria. These criteria are LHGR vithin the limits of f' Specification 3.5.J and MCPR within the limits of ! Specification 3.5.K. If it is 1 . determined that either of these 1 design criteria is being violated during operation, action shall be initiated within 15 minutes to restore operation vi_ thin the prescribed limits. fprei1 A M cr e r qu re nt to s po i t re gi' n ' j Q ' e .fi at .5. . I
- c. The APRM Red Block trip setting shall be less than j or equal to the limit specified in the CORE OPERATING LIMITS REPORT.
l I i 1 i BFN 1.1/2.1-3 AfffWDHENT NO. 190 Unit 3
+ i-I
RE PL ACE. WITH MEW FIGU rte. 130 _.,m.....................w................................,....,... 120 , 110 - . , . . . , . . . .. . . . > . . -
'.---:.a.a..-..----..--
A P RM Flo -wBla s S c- ra- m- __. .. . .....,..,.......... . . , . . ~ . . , . . . . . . , . . . , . . . . . . . . . . . . . . , . . . . . . .. . . . , , , , , 100
..a,.. .
..,u...,
..,....,.....a a... .
13
.....t... . . . , . , . . . .. . . . .. . . . . . .. .. ,. ..c... .
g . .
. 90 ___.
m , x , . . m
... . . . . . ... ...:... ..:..:........ . . . .. . . .,..:.. .. ...:..:....a....... . . . .. . . ....
o 80 _ _ . . . . _ . . . . . ....... . . . . . . . . . . . . . . . . - . . . . . q . e, , , 6
.......s.. s.......,........
t 0 _ .. e ............... . 3 . o . . . . . CL Design How Contro!.., _une ... . . . , 60 o 50 _ . ..., .,.. . , . a , , . . . , ,
..,u..,...,...
o . ....,..>.. , .
. 1. . . z, . . , . . , .
. . . . . . . .. . s. . a. . a, . a, . a, . . ,. . . .. . . . .. . . . .
2 , , , , _..c.....,..,..,.. . , . . , . . . . . , . . . . . . ., . . . ., . . . .,.. . . . ,__,..,.....,..,...,. g , g . , , o 40 ..,..-. ..... ....
, . Natural C.g,rc.ulatg,..o. ..,
O , , _ , . . _ ., . . . . . . . , . . . . .g,. , .. 7_.., . . . . . . ., . . . ..., . . , . . . , _ _ _ _ _ _ _ _ . . . , .. . . . . , . . , . . . , . . . , . . . 30 20% Pump: Speed Line : : : : _... ..,...,...,..>..a.
. a., a.... a,..,.........,..,...,...,...,...,..,..a,...... . . . .. . .
20 . 1 % t , , , , , . ., 10 _ _l. _ _ _ . . . , _ _ _ ' . _ _ - ,_,..,_7'._._____'...,'...'...,...'____,.....,'___.,....,
. 0 . . , , , t .
0 - ' - ' ' ' ' - ' - ' ' * - 0 10 20 30 40 50 60 70 80 90 100 110 120 Core Coolant Flow Rate (% of Design) APRM Flow Bias Scram vs. Reactor Core Flow Fig. 2.1-2 BFN 1.1/2.1-7
. AM NDUENT NO. 190 _.;.
Unit 3 m.
..w.- t W t 130 ' i 120 _ _ . . . . . . . . . . . . .
. . .: . . l.A P R M' Fl o.
w . . .as Bi . . . ram S c . . .... . .
. . N....._....._.._ ................ ........ . . .. . . _. . . . . . .
110 .. ...;.........:... .. .. . ..
. . . .. . ... _. .._ ...... ..:. 6 .-. + .:.-. ....:. . . ;. . .: . . .
100 . . v . . . . .
...c.
c, o,,0 . . . . . . . .
. _ _ . . . . . . . ........a...... . . . . .. . . . . _ . . . . . _ . . . . . . . . . . .. . . . . . .. . . . . . . . . . . . .
\
e . . l c t . 0 80 _ . . . . _ . . . . . . . . . . . . . .
. . W . .
. . _ . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . _ f
,I
. 3 e
( -....... 3 . .
. 4 O ------'--,-,--.-- . - - - - - - - - - - - - - - ' - - - - - - - - . - - - - - - - - - - - - - - - - - - - - - - - - -.- t C. - . >
C ,
. ... . . . . . .. . . ... Desion. Flow Control Line . . . . ... .
O . . . 00 e . _ .
. . . . ........,..a,..a.. .
. . .. . . . . . . , . . . . . . . ....... .. ...a...s...........u...
2 . . e y . . . . . .
. . . . . i O . . . . . . ,
1 30 _ .. . . . . . 20% Pump: Speed Line : : : : _ ... . . .. . . . .. . . . . . ...a . a.
.s._.... .
20 _ .. i . . . , , 10 _ ..% . . .. . . . . . . . _ , .. .. .. . . _ , . . . . . _ .. . . . . . , f 0 -
~
O 10 20 30 40 50 60 70 80 90 100 110 120 Core Coolant Flow Rate (% of Design) APRM Flow Bias Scram vs. Reactor Core Flow Fig. 2.1 2 1.1/2.1-7
)
2.1 BASES (Cont'd) 01993
}. (Deleted)
/ G. & H. Main Steam Line Isolation on Low Pressure and Main Steam Line i Isolation Scram l The low pressure isolation of the main steam lines at 850 psig was I provided to protect against rapid reactor depressurization and the ; resulting rapid cooldown of the vessel. Advantage is taken of the scram feature that occurs when the main steam line isolation valves are closed, to provide for reactor shutdown so that high power operation at low reactor pressure does not occur, thus providing protection for the fuel cladding integrity safety limit. Operation of the reactor at pressures lower than 850 psig requires that the reactor mode switch be in the STARTUP position, where protection of the fuel cladding integrity safety limit is proviced by the IRM and APRM high neutron flux scrams. Thus, the combination of main steam line low pressure isolation and isolation valve closure scram assures the availability of neutron flux scram protection over the entire range of applicability of the fuel cladding integrity safety limit. In addition, the isolation valve closure scram anticipates the pressure and flux transients that occur during normal or inadvertent isolation valve closure. With the scrams set at 10 percent of valve closure, neutron flux does not increase. I.J.& K. Reactor Low Water Level Setooint for Initiation of EPCI and RCIC Closine Main Steam Isolation Valves, and Starting LPCI and Core Soray Pumes. These systems maintain adequate coolant inventory and provide core cooling with the objective of preventing excessive clad temperatures. The design of these systems to adequately perform the intended function is based on the specified low level scram setpoint and initiation setpoints. Transient analyses reported in Section 14 of the FSAR demonstrate that these conditions result in adequate safety margins for both the fuel and the system pressure. L. References l' . Supplemental Reload Licensing Report of Browns Ferry Nuclear Plant, Unit 3 (applicable cycle-specific document).
- 2. CE Standard Application for Reactor Fuel, NEDE-260ll-P-A and NEDE-240ll-P-A-US (latest approved version).
- 3. Ahmug UTOJDED LOAD L N E. LIM n A4D AzTS IMPtovEgeur PtoGRAM A4 ALYSES f'Ot BeoW45 FEAtv ,WOCLEAR PLAdr L)dir 1,2 MD 3, dEDC.-32433R
(_ arN 1.1/2.1-16 AMENDMERT NOL 17 0 Unit 3
+w -- - --
%w
- n. .
m m
,f - 7 TABLE 3.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION REQUIREMENTS d tse Min. No. of n
Operable Instr. tigfdgs in Which Function w Channels thtt Be Operable Per Trip Shut- Startup/ I System (11(23) Trio Function Trio Level Settina down Refuel (71 ligt Standby Rgn Action (11 l 1 Mode Switch in X X X X 1.A Shutdown 1 Manual Scram X X X X 1.A IRM (16) O 3 High Fluu 1120/125 Indicated X(22) X(22) X (5) 1.A on scale 3 Inoperative X X (5) 1.A APRM (16)(24)(25) E J(se) High Flus - (Flued Trip) i 120% X 1. A or 1.8 # 0FI M . E JUl) High Flum (Flow Blased) See Spec. 2.1.A.1 1. A or 1.B Oy I,8 6 P X
- y 7 (se) High Flux i 151 rated power X(17) (15) 1.A
) ( J(n) Inoperative (13) X(17) X l.A N _ _ _
T,., Voter 1.A N OY $$ 2 High Reactor Pressure i 1055 psig X(10) X X 1.A 2 High Drywell i Pressure (14) i 2.5 psig X(8) X(8) X 1.A 2 Reactor Low Water Ok Level (14) 1 538" above X X X i.A y @,. vessel aero nn c
=z C' NO F t- "
"8 4 E2s CD N
e
- _ _ - - - - _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - -_m_- -
--.m_ A -_ _ _ _ m __w _- p . ---w-+ =, aw,,a y .g ,-wv .gr,wr_p ,, . , y , 3 ,sc,+ ,,,%o
, ,_,-.%#y ,,g-,, r,3w_y,%. ,.,,~_.,myyy _
, . . ~ -- .. - - _. . _. - _ .
f
.b-NOTES FOR TABLE 3.1.A
- 1. There shall be two OPERABLE or tripped trip systems for each function.
If the minimum number of OPERABLE instrument channels per trip system cannot be met for one trip system, trip the INOPERABLE channels or entire e trip system within one hour, or, alternatively, take the below listed action for that trip function. If the minimum number of OPERABLE instrument channels cannot be met by either trip system, the appropriate action'11sted below (refer to right-hand column of Table) shall be taken. An INOPERABLE channel need not be placed in the tripped condition where this would cause the trip function to occur. In these cases, the INOPERABLE channel shall be restored to OPERABLE status within two hours, or take the action listed below for that trip function. A. Initiate insertion of OPERABLE rods and complete insertion of all , OPERABLE rods within four hours. In refueling mode, suspend all operations involving core alterations and fully insert all OPERABLE control rods within one hour. B. Reduce power level to IRM range and place mode switch in the STARTUP/ HOT STANDBY position within 8 hours. , C. Reduce turbine load and close main steam line isolation valves within 6g."f 8 hours.
..s O D. Reduce power to less than 30 percent of rated. l
- W i
\
- 2. Scram discharge volume high bypass may be used in snutdown or refuel to bypass scram discharge volume scram with control rod block for reactor ,
protection system reset. ; l
- 3. DELETED 4 Bypassed when turbine first stage pressure is less than 154 psig. l
- 5. IRMs are bypassed when APRMs are onscale and the reactor mode switch is in the RUN position.
- 6. The design permits closure of any two lines without a scram being initiated. .
When the reactor is suberitical and the reactor water temperature is less 7. than 212*F, only the following trip functions need to be OPERABLE: A. Mode switch in shutdown B. Manual scram C. High flux IRM D. Scram discharge volume high level E. af ' f BFN 3.1/4.1-4 Unit 3 y .- w on.. = r v. -_
, y .,, "
W
1 I INSERT B: - - - E. For the APRM functions only, if only two APRM channels are OPERABLE, restore a third APRM channel to OPERABLE status or trip one of the inoperable APRM channels within 6 hours. If only one APRM channel is OPERABLE, trip one inoperable APRM channel immediately and j restore an inoperable APRM channel to OPERABLE status or initiate i alternative action within 2 hours. ] F. For the APRM functions only, if one voter channel is inoperable in j one trip system, restore the voter channel to OPERABLE status or 3 trip the inoperable channel or the entire trip system within 12 l hours. If one voter channel is inoperable in both trip systems, j restore the inoperable voter channels to OPERABLE status or initiate 1 alternative action within 6 hours. i 1 i l i i l' 1 L i i l j
NOTES FOR TABLE 3.1.A (Cont'd) 8EP 2 7 199k (-
- 8. Not required to be OPERABLE when primary containment integrity is not required.
- 9. (Deleted) q
- 10. Not required to be OPERABLE vben the reactor pressure vessel head is not bolted to the vessel.
L/~ kl M5
- 11. Tb A vn a ty fip/ f tpfcpionAs/ogy jrty[ve[#((e/e apfo[ l ar MM -
3 an OPERABLELPRMsvillcause[t/i h b A+4 be% f Cb & },##
/M 14 Channel shared by Reactor Protection Syste= and Primary Containment anu h-
@ ^[ Reactor Vessel Isolation Centrol System. A channel failure may be a char.nel f ailure in each system.
- 15. he APRM 15 percent scra= is bypassed in the EUN Mode.
- 16. Channel shared by Reactor Protection System and Reactor Manual Control System (Rod Block Portion). A channel failure may be a channel failure in each system. If a channel is allowed to be inoperable per Table 3.1.A, the corresponding function in that sa=e channel say be s. , ,..
inoperable in the Reactor Manual Control System (Rod Block). l
- 17. Not required while performing low power physics tests at atmospheric pressure during or after refueling at power levels not to exceed 5 MWt.
- 13. This function must inhibit the automatic bypassing of turbine control valve fast closure or turbine trip scram and turbine stop valve closure scram whenever turbine first stage pressure is greater than or equal to 154 psig.
- 19. Action 1.1 or 1.D shall be taken only if the permissive fails in such a manner to pre. vent the affected EPS logic from performing its intended function. Othervise, no action is required.
- 20. (Deleted)
- 21. b A SM /Iig T1 a,6d I op and e rip d not har to e Pr'im# d e e ou e Mo ito s ee e te t/gi/e H)EL aode if 3 5 on inti c= H4 h F ur ser , t 5 e s/ The SEMs shall be ffERABLEperSpecification3.10.3.1. The re=oiral of eight (8) shorting links is required to provide nonceincidence high-flur scram protection fr * 'h'@/"ft*/ E*f8f MM9_tf
&lm ] TJE -
L BFN 3.1/4.1-5 AMENDMENT NO 18 5 Unit 3
l I l hNScR_ The same three (3) required APRM channels are shared by both RPS trip systems. _ Dh , Any combination of APRM upscale or inoperative trips from two different (non-bypassed) APRMs will trip all of the 2/4 voter units.
- -~ _- _- --
IN5ERT E D __ In the REFUEL Mode unless adequate shutdown margin has been demonstrated per Specification 3.3. A.1, whenever any control rod is wichdrawn from a core cell containing one or more fuel assemblies, shorting links shall be removed from the RPS circuitry to enable the Source Range Monitor (SRM) noncoincidence high-flux scram function. l 1 j ____ l
~-
r \ t .q f. TABLE 4.l.A REACTOR' PROTECTION SYSTEH (SCRAH) INSTRUHENTATION'funCilOuat TESTS HIN! HUN FUNCTIONAL TEST FEEQUENCIES FOR SAFETY INSTR. AND COMINOt CIRCul15 Graue_121 functlanaLI%L 111ninunJf couencrt 31 Hode Switch tri Shutdown A Place Hode Switch lei shutdomi Each Refueling Outage - Hanual Scram A Trip Channel and Alarm,- Every 3 Honths IRH lilah flu = C Trip Channel and Alarm (4) Once Per Week During Refueling and before Each Startup inoperative C Trip Channel and Alarm (4) Once Per m:ck During Refueling and Before Each Startup APNH High flux (in Scram) TripOutputRelays(4)(5) M:n n= ::x:w a.u EVERY (o Mo,aTus[1) ] AM 2.14 VOTE 8t. l l LOGIC. U Q ' - - 2T.$~.T $ ."Z_[ ' 2_ _ _ _ EAcu REF uEL NG OtfrA6E. l Hleh flua (flow Blased) . 1ja Trty Output metays (4) (to) ca::/m: EvfA'/ (, sAi>ntes 4 2M VDTEP. WIC. (4) - - -- - --- EAce REJuEsmG OUTA6E.' j Hish flux (flued Trip) Trip Output Relays (4) (5) 0: n '"::E Every (;, uooTHS l L8 Z) + MDTER. t.osic (#p) - -- - -~ ~ - EACA CEFUE.u@ OME Inoperative Trip output Relays (4)(5) Oac a .-t EvsRY G mom 5 g ZJ4 vovet tcrac rapp - - - - - W RESUEud ouTA6E
. ( l High Reactcr Pressure A Trip Channel and Alarm Once/Honth (1)
Histl Drysell Pressure A Trip Channel and Alarm Once/Honth (l) Reactor low IJater tevel A Trip Channel and Alarm Once/Honth ( t) EfM-Unit 3 24T9 Vole < TrieSen G,J.,k(10 Aae vak 3 5
- m----- A---_w---. _ __ _ __
NOTES FOR TABl.E 4.1.A t
,. 1. Initially the minimum frequency for the indicated tests shall be once per M montr..
A description of the three groups -is included in the Bases of this 2. specification.
- 3. Punctional tests are not requi' red unen the systests are not required to be CPERABI.3 or are operating (i.e.. already tripped) . If tests are missed, they shall be perfor: sed prior to returning the systems to an CPERABt.2 status.
- 4. This instrumentatien is exempted frcas the instrument channel test definition. This instrument channel functional test will consist of injecting a simulated electrical signal into the measurement channels.
W 6st
- gfar;yi[t=cp y 4 **b t y^= W f" v'95%
- 7. Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify operability of the trip end alara functions.
- 8. Functiorial test frequency decreased to once/3 months to reduce the
(* ., challenges to relief valves per NUREG 0737, Item II.X.3.16.
,, p
~- - _ _ _
A
\
9 Not required to be performed when entering the STARTUP/HOTT , STANDBY Mode from RUN Mode until 12 hours after entering the h\{ STARTUP/ HOT STANDBY Mode. 10. Functional test consists of simulating APRM trip conditions at j I the APRM channel outputs to check all combinations of-two j ) tripped inputs to the 2/4 voter logic in each voter channel, consists of manually tripping the 2/4 voter
- 11. Functional test one voter channel at a time, to demonstrate that trip output, ;
each scram contactor for each RPS trip system channel (A1, A2, j B1 and B2) operates and produces a half-scram. [
=~ W_ -- _
l l NSERT F: _- I l The channel functional test shall include both the APRM channels and ( the 2/4 voter channels.
~~
INSERT G: The channel functional test shall include function, excluding both the APRM th channels and the 2/4 voter channels plus the flow input flow transmitters. 5~ ~ s - (. s
-t. 3 1/4*1~9 BFw-Onit 3
TABLE 4.1.8 PEACTOR PROTECTION SYSTEM (SCRAM) INSTRtMENT CALIBRATION MINIPtJM CALIBRATION FREQUENCIES FOR REACTOR PROTECTION INSTRtMENT CHANNELS c to
@ Instrument Channel Group (1) Calibration Minimum Frecuencvf2) i u IRM High Flux C Comparison to APRM on Controlled Note (4)
Startups (6) APRM High Flux Output Signal Heat Balance Once Every 7 Days Flow Blas Signal Calibrate Flow Blas Signal (7) Once/ Operating Cycle LPRM Signal TIP System Traverse (8) Every 1000 Effective Full 7 d[ Power Hours Every 3 Months High Reactor Pressure A Standard Pressure Source High Drywell Pressure A Standard Pressure Source Every 3 Months A Pressure Standard Every 3 Months Reactor low Water Level { w High Water Level in Scram
. Olscharge Volume Float Switches ,
R A Calibrated Water Column (5) Note (5) e (LS-85-45C-F) Electronic Lv1 Switches Once/ Operating Cycle (9) Calibrated Water Column (LS-85-45-A. B. G. H) 8 4 Main Steam Line Isolation valve Closure A Note (5) Note (5) __ Turbine First Stage Pressure A Standard Pressure Source Every 6 Months Permissive Turbine Control Valve Fast Closure Once/ Operating Cycle or Turbine Trip A Standard Pressure Source Turbine Stop Valve Closure A Note (5) Note (5)
- =
5 C/3 E a A u h CC "i *
- h 00 C)I
l l I NOTES FOR TABLE 4.1.B ${p 2 7 jgg4 ,
- 1. A description of three groups is included in the Bases of this
' specification.
,* 2. Calibrations are not required when the systems are not required to be OPERABLE or are tripped. If calibrations are missed, they shall be performed prior to returning the system to an OPERABLE status.
- 3. (Deleted) _ ;
4 Required frequency i's initial startup following each refueling outage.
- 5. Physical inspection and actuation of these position switches vill be performed once per operating cycle.
~
- 6. On controlled startups, overlap between the IRMs and APRMs vill be verified.
- 7. #Ehe lo Biae signa "Cald ra on vd 1 co ist f cal rat d the ens s, ) '
f' v nye ers, d sd na ffs ne t- rks ri ach perat d 4 cy e. e .ns a=ent . ion al t with edun t f ov si als .a t i' e b comp ed. e f' v c par or tr' and apse e vil e fun iona .y te ed a ord' 4 t Table .2.C oe re t pro r p) i" b o rat dur th ope tir cycle Ref to .1 Ba s fo furt r p y pla.atio f ca'. brat on .equen . 7
. A complete TIP system traverse calibrates the LPEM signals to the procest.a.a computer. The individual LPRM meter readings vill be adjusted as a minimum at the beginning of each operating cycle before reaching 100 percent power.
- 9. Calibration consists of the adjustment of the primary sensor and associated components so that they correspond within acceptable range and ,
accuracy to known values of the parameter which the channel monitors, ) including adjustment of the electronic trip circuitry, so that its output i relay changes state at or more conservatively than the analog equivalent i of the trip level setting. I
' i
- INSERT H: ~
^ ~
_ 7 ~
^
The flow bias signal calibration will consist of calibrating the analog differential pressure flow sensors once per operating cycle. Calibration of the flow bias processing system is done once per operating calibration.cycle as part of the overall APRM instrumentation
\
( sm BFN 3.1/4.1-11 AMENDM90' NO.18 5 Unit 3 -
3.1 BASES . The reactor protection' system automatically initiates a reactor scram to:
- 1. Preserve the integrity of the fue~1 cladding.
- 2. Preserve the integrity of the reactor coolant system.
- 3. Minimize the energy which must be absorbed following a loss of coolant accident, and prevents criticality.
This specification provides the limiting conditions for op,eration necessary to preserve the ability of the system to tolerate single failures and still perform its intended function even during periods when instrument channels may be out c,f service because of maintenance. When necessary, one channel may be made IHOPERABLE for brief intervals to conduct required functional tests and calibrations.
~
The reactor protection system is made up of two independent trip systems (refer to Section 7.2, FSAR). There are usually four channels provided to monitor each critical parameter, with two channels in each trip system. The outputs of the channels in a trip system are combined in a logic such that either channel trip will trip that trip system. The simultaneous tripping of both trip systems will produce a reactor scram. This system meets the intent of IEEE-279 for Nuclear Power Plant Protection Systems. The system has a reliability greater than that of a 2-out-of-3 system and somewhat less than that of a 1-out-of-2 system. With the exception of the Average Power Range Monitor (APRM) channels, the Intermediate Range Monitor (IRM) channels, the Main Steam Isolation Valve closure and the Turbine Stop Valve closure, each trip system logic - has one instrument channel. When the minimum condition for operation on the number of OPERABLE instrument channels per.untripped protection trip system is met or if it cannot be met and the effected protection trip
. system is placed in a tripped condition, the effectiveness of the protection system is preser ed; i.e., the system can tolerate a single failure and still perform its intended function of ser==ine the a to
[ i f ey chy nely are p ovi % fo/ ear)/proty tip }
?
passAT I + /
@ BFN 3.1/4.1-13 Unit 3 .
--- - en , - ss , w
. e. > - , - _ - . .
P s i f INSERT I: h- ~ , The APRM system is divided into four APRM channels and four 2-out- i of-4 trip voter channels. Each APRM channel provides input to each of the four voter channels. The four voter channels are divided # into two groups of two each, with each group of two providing inputs ; to one RPS trip system. The APRM system is designed to allow one ! APRM channel, but no voter channels, to be bypassed. A trip from ; any one unbypassed APRM will result in a " half-trip" in all four of the voter units, but no trip inputs to either RPS trip system. A [' trip f rom any two unbypassed APRM channels will result in a full trip in each of the four voter channels, which in turn results in , two trip inputs into each RPS trip system resulting in a full scram, i Each APRM instrament channel receives input signals from forty-three (43) Local Power Range Monitors (LPRMs). A minimum of twenty (20) i ( LPRM inputs with three (3) per axial level is required for the APRM
\ instrument channel to be OPERABLE. Fewer than the required minimum '
I number of LPRM inputs generates an instrument channel inoperative - alarm and a control rod block but does not result in an automatic ! trip input to the 2-cut-of-4 voters. ! l i N f f I i i I 6 t i I i
~
.. l
, t w
3.1 BASES (Cont'd) 7* DEC 0 71994 Each protection trip system has one more /SM than is necessary to meet. . . . the minimum number required per channel, i s allows the bypassing of ( T EM G @ per protection trits system for maintenance, testing or l calibration.] dfti T sos /na-# al/Jo/beert nrov/yd fo/alnd (%r/b/py6 ore . c e an e f ne bases for the scram setting for 1 tne A m , APRM, high reactor pressure, reactor low water level, MSIV closure, turbine control valve fast closure, and turbine stop valve closure are discussed in Specifications 2.1 and 2.2. Instrumentation (pressure switches) for the dryvell are provided to detect a loss of coolant accident and initiate the core standby cooling equipment. A high dryvell pressure scram is provided at the same setting as the core cooling systems (CSCS) initiation to minimize the energy which must be accommodated during a loss of coolant accident and to prevent return to criticality. nis instrumentation is a backup to the reactor vessel water level instrumentation. A reactor mode switch is provided which actuates or bypasses the various scram functions appropriate to the particular plant operating status. Reference Section 7.2.3.7 FSAR. n e manual scram function is active in all modes, thus providing for a manual means of rapidly inserting control rods during all modes of reactor operation. n e IEM system (120/125 scram) in conjunction with the APRM system (15 percent scram) provides protection against excessive power levels and #. " short reactor periods in the startup and intermediate power ranges. ne control rod drive scram system is designed so that all of the water which is discharged frca the reactor by a scram can be accommodated in the discharge piping. ne discharge volume tank accommodates in excess of 50 gallons of water and is the low point in the piping. No credit was taken for this volume in the design of the discharge piping as concerns the amount of water which must be accommodated during a scram. During i normal operation the discharge volume is empty; however, should it fill with water, the water discharged to the piping from the reactor could not f I t h BIT 3.1/4.1-14 AMENDMENT NO.18 6 k-Unit 3 . s
=
.,e..
3.1 BASES (Cont'd)
/
be accommodated which "sould result in slow scram times or partial control
, - . rod insertion. To preclude this occurrence, level switches have been provided in the instrument volume which alarm and scram the reactor when the volume of water reaches 50 gallons. As indicated above, there is sufficient volume in the piping to acccavnodate the scram without impairment of the scram times or amount of insertion of the control rods. This function shuts the reactor down while sufficient volume remains to accommodate the discharge water and precludes the situation in which a scram would be required but not be able to perform its function adequately.
A source range monitor (SRM) system is also provided to supply additional neutron level information during startup but has no scram functions. Reference Section 7.5.4 FSAR. Thus, the IRM is required in the REFUEL and STARTUP modes. In the power range the APRM system provides required protection. Reference Section 7.5.7 FSAR. Thus, the IRI: System is not required in the RUN mode. The APRMs and the IRMs provide adequate coverage in the STARTUP and intermediate range. The high reactor pressure, high drywell pressure, reactor low water level and scram discharge volume high level scrams are required for STARTUP and RUN modes of plant cperation. They are, therefore, required to be l operational for these modes of reactor operation. I The requirement to have the scram functions as indicated in Table 3.1.1 b CPERABLE in the REFUEL mode is to assure that shif ting to the REFUEL mode during reactor power operation does not diminish the need for the reactor protection system. . rd bl~le, Because of the APRM downsca limit of ? 3 percent when in the RUN mode fQ 6F and nigh level] limit of $15 percent when in the STARTUP Mcde, the transition between the STARTUP and RUN Modes must be made with the APRM instrumentation indicating between 3 percent and 15 percent of rated powerC6/ # pbrittel Acd Acphm>will/>cegr). In addition. the IRM systes must be indicating below the High Flux setting (110/125 of scale) or a scram will occur when in'the STARTUP Mode. For normal operating . conditions, these limits provide assurance of overlap between the IRM
, system and APRM system so that there are no " gaps" in the power level indications (i.e., the power level is continuously monitored free beginning of startup to full power and from full power to shutdown).
When power is being reduced. .if a transfer to the STJUtTUP mode is made and the IRMs have not been fully inserted (a maloperational but not impossible condition) a control rod block immediately occurs so that reactivity insertion by control rod withdrawal cannot occur. j 1 I a BFN-Unit 3 3.1/4.I-15 '
. l
'/C 8 S 4.1 BASES wsq , hd espM4.,
The minimum functional testing frequency used in this specification is e based on a reliability analysis using the concepts developed in reference (1). This concept was specifically adapted to the one-out-of-two taken twice logic of the reactor protection system. The analysis shows that the sensors are primarily responsible for the reliability of the reactor protection system. This analysis makes use of " unsafe failure" rate experience at conventional and nuclear power plants in a reliability model for the system. An " unsafe failure" is defined as one which negates channel operability and which, due to its nature, is revealed only when the channel is functionally tested or attempts to respond to a real signal. Failure such as blown fuses, ruptured bourdon tubes, faulted amplifiers, faulted cables, etc., which result in " upscale" or "downscale" readings on the reactor instrumentation are " safe" and will be easily recognized by the operators during operation because they are revealed by an alarm or a scram.
/hechannelslistedinTables4.1.Aand4.1.8aredividedintothree A groups for functional testing. These are:
A. On-Off sensors that provide a scram trip function. B. Analog devices coupled with bistable trips that provide a scram function.
- c. Devices which only serve a useful function during some restricted mode of operation, such as STARTUP or SHUTDOWW, or for which the only practical test is one that can be performed at shutdown.
The sensors.that make up group (A) are specifically selected from among the whole family of industrial on-off sensors that have earned an excellent reputation for reliable operation. During design, a goal of 0.99999 probability of success (at the 50 percent confidence level) was adopted to assure that a balanced and adequate design is achieved. The probability of success is primarily a function of the sensor failure rate ; and the test interval. A three-month test interval was planned for group (A) sensors. This i; * ':eeping with good operating practices, and l satisfies the design r_ for the logic configuration utilized in the Reactor Protection System. To satisfy the long-term objective of maintaining an adequate level of safety throughout the plant lifetime, a minimum goal of 0.9999 at the 95 percent confidence level is proposed. With the (1-out-of-2) X (2) logic, this requires that each sensor have an availability of 0.993 at the 95 percent confidence level. This level of availability may be maintained by adjusting the test interval as a function of the observed failure history.1
- 1. Reliability of Engineered Safety Features as a Function of Testing Frequency, I. M. Jacobs, " Nuclear safety," Vol. 9. No. 4, July-August, 1968, pp. 310-312. _
I I BFN-Unit 3 3.1/4.1-16 I l
l 4.1 Bases (Cont'd) " \ -" The r que Cy of ca ibr tion ft APRM Flow Biaeing N twor has een < e- a ish d a ea re eli ou ge. her are ever 1 i trume ts ich s be al rat an it ill ke s er hou to erf m th l c ibr tio of e tire net rk. il the alib atio is b g rf med a z ro ow s gna will s nt t hal of e AP .s sult g in hal se a d rod bl cond ti . s, th cali at on w e p for d d ring oper ion flux ha ng uld ot b poss 1 . Ba ed xper ence at o her ner ting e at ons, rif of str. nt , su as tho" in he F ow B si Net k. is n si ifi ta t eref re, o ( av ds rio ser , cali rat on fr quer of each .ef eli ou age is e tabl shed Group (C) devices are active only during a given portion of the operational cycle. For example, the IRM is active during STARTUP and inactive during full power operation. Thus, the only test that is meaningful is the one performed just prior to SHUTDOWN or STARTUP; i.e., the tests that are performed just prior to use of the instrument. Calibration frequency of the instrument channel is divided into two groups. These are as follows:
- 1. Passive type indicating devices that can be compared with like units on a continuous basis.
- 2. Vacuum tube or semiconductor devices and detectors that drift or lose sensitivity.
Experience with passive type instruments in generating stations and substations indicates that the specified calibrations are adequate. For those devices which employ amplifiers, etc., drift specifications call for drift to be less than 0.4 percent / month; i.e., in the period of a month a drif t of .4-percent would occur and thus providing for adequate margin. For the APRM system drift of electronic apparatus is not the only consideration in determining a calibration frequency. Change in power { distribution and loss of chamber sensitivity dictate a calibration every I
- seven days. Calibration on this frequency assures' plant operation at or below thermal limits.
A comparison of Tables 4.1.A and 4.1.B indicates that two instrument channels have been included in the latter table. These are: mode switch in SHUTDOWN and manual scram. All of the devices or sensors associated with these scram functions are simple on-off switches and, hence, calibration during operation is not applicable, i.e., the switch is either on or off. l s Nh 8 % M i BFN-Unit 3 3.1/4.1-18 1 A
I l INSERT J: - The APRM and 2-out-of-4 voter channel hardware is provided with a self-test capability which automatically checks most of the critical hardware at least once per is minute interval whenever the APRM channel is in the operate mode. This provides a virtually I continuous monitoring of the essential APRM trip functions, In the event a critical fault is detected, an " inoperative" trip signal results. A fault detect 9d in non-critical hardware results in an
" inoperative" alarm. Following receipt of an " inoperative" crip or alarm signal, the operator can employ numerous diagnostic testing options to locate the problem.
The automatic self-test function is supplemented with a manual APRM trip functional test, including the 2-out-of-4 voter channels and the interface with the RPS trip systems. In combination with the virtually continuous self-testing, the manual APRM trip functional test provides adequate functional testing of the APRM trip function. Therefore, the six-month test frequency for the manual testing provides an acceptable level of availability of the APRM. In addition to the above tests, the 2-out-of-4 voter is used to test the RPS scram contactors. The output of each voter channel is tripped to produce a scram signal into each of the RPS trip system channels (A1, A2, B1 and B2) to individually operate the respective scram contactors. The weekly test interval provides an acceptable i level of availability of the scram contactors. Each APRM receives the output signals from two analog differential pressure flow transducers, one associated with recirculation loop A and the other with recirculation loop B. These differential hm pressure signals are converted into representative digital loop flow signals within the same hardware that performs the APRM functions and are added to determine a total recirculation flow. The total I recirculation flow value is used by the APRM to determine the flow biased setpoints. Each total recirculation flow signal developed by an APRM is compared in the hardware that performs the RBM functions to the signals from the remaining tPree APRMs. An alarm is given if a preset compare level setpoint is exceeded. The flow processing is integrated with the APRM processing and is covered by the same self-test and alarm functions described earlier. As a result of the virtually continuous monitoring of the equipment performing the flow processing, and the automatic comparison of redundant flow signals, it is acceptable to calibrate this equipment once per operating cycle. m
4.1 BASES (Cont'd) - MAY 2 01993 , The sensitivity of LPRM detectors decreases with exposure to neutron flux at a slow and approximately constant rate. The APRM system, which uses the LPRM readings to detect a change in thermal power, will be calibrated ' every seven days using a heat balance to compensate for this change in sensitivity. The RBM system uses the LPRM reading to detect a localized change in thermal power. It applies a correction factor based on the APRM output signal to determine the percent thermal power and therefore any change in LPRM sensitivity is compensated for by the APRM calibration. The technical specification limits of g CPRe%Ind APLHGR are l determined by the use of the process computer or other backup methods. These methods use LPRM readings and TIP data to determine the power distribution. Compensation in the process computer for changes in LPRM sensitivity will , be made by performing a full core TIP traverse to update the computer calculated LPRM correction factors every 1000 effective full power hours. As a minimum the individual LPRM meter readings will be adjusted at the beginning of each operating cycle before reaching 100 percent power. I k l 1 1 I l i l l I BFN .1/4.1-19 AMENDMENT N0.17 0 Unit 3 l
l s TABLE 3.2.C INSTRUMENTATION 11 TAI INIIIATES R00 BLOCKS c2 us Minimum Operable
$g 82 Channels Per Trio Function (5) Function
" Trio level Settina 3hl) APRM Upscale (Flow Blas) (2)
-{
3 1) APRH Upscale (Startup Hode) (B) 112% 381) APRM Downscale (9) 131 3h l) APRM Inoperative I'bwER., (10b) 2(7) 2(7) RBH Upscale (N ew Blas) h 2(7) RBH Downscale (9) (/3) RBH Inoperative h (/5') (10c) 6(1) IRH Upscale (8) 1108/125 of full scale
; u 6(l) 1RH Downscale (3)(8) 15/125 of full scale 6(1) IRH Detector not in Startup Position (8)
(11) y 6(1) IRH Inoperative (8) (10a)
$ 3(1) (6) SRH Upscale (8) i IX10 5counts /sec.
3(1) (6) 5RM Downscale (4)(8) 13 counts /sec. , 3(1) (6) SRM Detector not in Startup Position (4)(8) (11) 3(1) (6) SRM Inoperative (8) (10a) c ' re ti f 1 Rod Block Logic N/A 1(12) tilgh Water Level in West 125 gal. Scram Discharge Tank (L5-85-45L) g 1(12) High Water Level in East O 125 gal. Scram Discharge Tank (LS-85-45H) G (g.1)D i o Low foau Fw/a (us)
; y h 0em t.4*sIe fewer $%)e D3) (ID la, jh fD"U 0%) t< (83) i84 ) )
. _ - . n
NOTES FOR TABLE 3.2.C
- 1. The minimum number of operable channels for each trip function is detailed for the startup and run positions of the reactor mode selector switch. The SRM, IRM, and APRM (startup mode), blocks need not be operable in "run" mode, and the APPJi (flow biased) rod blocks need not be operable in "startup" mode.
l l With the number of OPERABLE channels less than required by the minimum OPERABLE channels per trip function requirement, place at least one inoperable channel in the tripped condition within one hour.
- 2. The trip level setting shall be as specified in the CORE OPERATING LIMITS REPORT.
- 3. IRM downscale is bypassed when it is on its lowest range.
- 4. SEMs A and C downscale functions are bypt.ssed when IRMs A, C, E, and G are above range 2. SEMs B and D downscale function is bypassed when IRMs B, D, F, and H are above range 2.
SRM detector not in startup position is bypassed when the count rate is 1100 counts per second or the above condition is satisfied. - on APR64 J
- 5. During repair or calibration _of equipment, not more than one SRM M EBMJ channel nor more than two@@p!/9 t)IRM channels may be bypassed.
Bypassed channels are not counted as operable channels to meet the minimum operable channel requirements. Refer to section 3.10.B for SRM require =ents during core alterations, w
- 6. IRM channels A, E, C, G all in range 8 or above bypasses SRM channels A and C functions.
IRM channels B, F, D, H all in range 8 or above bypasses SEM channels B and D functions.
- 7. The following operational restraints apply to the RBM only.
- a. Both REM channels are bypassed when reactor power is ,(30 percent or when a peripheral control rod is selected.
l
- b. The RBM need not be operable in the "startup" position of the ggef5 reactor mode selector switch.
K J,@ Two RBM ehannels are provided and only one of these may be bypassed from the console. If the inoperable channel cannot be restored within 24 hours, the inoperable channel shall be placed in the tripped condition within one hour. e,h With both RBM channels inoperable, place at least one inoperable rod block monitor channel in the tripped condition within one hour. BFN 3.2/4.2-25 AMENDLIENT NO. 190 Unit 3
I RT K __ _. - 7.c. The RBM need not be OPERABLE if either of the following two conditions is met: (1) Reactor thermal power is 290 percent of rated and I MCPR is 2 1 40, or j l (2) Reactor thermal power is <90 percent of rated and j MCPR is 1 1 70. ' j O P l l l s
m NOTES FOR TABLE 3.2.C (Cont'd) ~
- 8. This function is bypassed when the mode switch is placed in EUN,
- 9. This function is only active when the mode switch is in EUN. This function is automatically bypassed when the I2M insert =entation is OPERABLZ and not high. t l
- 10. The inoperative trips are produced by the following functions: ,
- a. SEM and IRM (1) Local " operate-calibrate" switch not in operate.
(2) Power supply voltage lov. (3) Circuit boards not in circuit. b. Of5 86&setAfD APEM M t h m y m p,p fp (1) Local " operate-calibrate" switch not in operate 7
' (2) Less than LPEM inputs.
r . (3)(i/ptuf papdsfoc/L:/c1/c,At/3(APR.4 vooont uee'oc4ED) ( LP -T E ST* DET ECTED CGt iT t cA (1) Local " operate-calibrate" switch not in operate. (2)(r//M dads gotAnAJfadi/J (fz.e4 uoous UMP t uc,< ED) i (3) EBM fails to null. (4)- Less than required number of LPRM inputs for rod selected. ' d5) SEi.F 7 EST_ M.m &ED C2.tTtCAt- QA_OL.T. f i
- 11. Detectat u u mf57 Ts adjusted to 114 2 inches, placing the detector icwer position 24 inches below the lower core place.
- 12. This function may be bypassed in the SHOTDOWN or REFUEL mode. If.this function is inoperable at a time when OPERABILITT is required the l ehannel shall be tripped or administrative controls shall be ,
immediately imposed to prevent control rod withdrawal. I IMIT RT m i BFN 3.2/4.2-26 AMENDtiENT NO. 190 Unit 3
. . ._,[
i 1
m 7 - INSERT L _ -_
- 13. The RBM rod block trip setpoints and applicable power ranges are specified in the CORE OPERATING LIMITS REPORT (COLR).
- 14. Less than or equal'to the setpoint allowable value specified in the COLR.
15, Greater than or equal to the setpoint allowable value specified in the COLR.
0 D TABLE 4.2.C SURVEILLANCE REQUIREMENTS FOR INSTPUMENTA110N illAT INiilAIE ROD BLOCKS yW Function Functional Tett Callbration (17) Instrument Check APRM Upscale (Flow Blas) (1) (13) once/3 :- 'h: 4 once/ day (8) APRM Upscale (Startup Mode) (1) (13) onc e 4-meau.s 4- ence/ day (8)
' once/3 -aa.h + once/ day (8)
APRM Downscale (1) (13) 1 APRH Inoperative (1) (13) N/A once/ day (8) PouxA-RSH Upscale (Hew Blas) (1) (13) once/0 ~ 4hw m /J., ::: + A RBH Downscale (1) (13) once/0 ~.."h;44 cn;;/ h, (S)4-RBH Inoperative (1) (13) N/A c ;;/h , (S) IRH Upscale (1)(2) (13) once/3 months once/ day (8) - IRH Downscale (1)(2) (13) once/3 months once/ day (8) IRM Detector Hot in Startup Position (2) (once operating cycle) once/ operating cycle (12) N/A IRH Inoperative (1)(2) N/A .4/A Qb (13) s SRM Upscale (1)(2) (15) once/3 months once/ day (8) 1 w ~ l .. (1)(2) once/3 months once/ day (8)
$ SRM Downscale (13)
SRM Detector Not in Startup Position (2) (once/ operating cycle) once/ operating cycle (12) N/A SAM Inoperative (1)(2) (13) N/A N/A
~
w as ar r ( (15) ce/o rating ycle 0) /A 81 Ups e (1)( ) c J mon N/ ! kF1 . i :n. iE Rod Block Logic (16) N/A 'N/A l i $ c West Scram Discharge once/ quarter once/ operating cycle N/A l
- E Tank Water Level liigh >t2 h (LS-8545L) once/ operating cycle N/A m
cc East Scram Discharge once/ quarter t $
- Tank Water Level liigh .o l
- H (L5-8545H) us on 40 c$
l i l l v. l
t NOTES FOR TABLES 4.2.A THROUGH 4.2.L excent 4.2.D AND 4.2.K j n U Qost. T.Rus A4D SRMjS
- 1. ' functional tests shall be performed once per month.gFOR. Aram Aeo Rags roactiouAL tssn saAA Bt. PEwoexED 04cE. PEft. 6 Mo4T45.
- 2. Functional tests shall be performed before each startup with a required frequency not to exceed once per week.
- 3. This instrumentation is excepted from the functional test definition.
The f unctional test will consist of injecting a simulated electrical signal into the measurement channel. a 4 Tested during logic system functional tests.
- 5. Refer to Table 4.1.B.
- 6. The logic system functional tests shall include a calibration once per operating cycle of time delay relays and timers necessary for proper functioning of the trip systems.
- 7. The functional test will consist of verifying continuity across the inhibit with a volt-ohmmeter.
- 8. Instrument checks shall be performed in accordance with the definition of instrument check (see Section 1.0, Definitio.,s). An instrument check is not applicable to a particular setpoint, such as Upacale, but is a qualitative check that the instrument is behaving and/or indicating in an acceptable manner for the particular plant condition. Instrument check l is included in this table for convenience and to indicate that an instrument check will be performed on the instrument. Instrument checks are not required when these instruments are not required to be operable E - - or are tripped.
- 9. Calibration frequency shall be once/ year.
- 10. (DELETED)
- 11. Portion of the logic is functionally tested during outage only.
- 12. The detector will be inserted during each operating cycle and the proper amount of travel into the core verified.
~
l l 13. Functional test will consist of applying simulated inputs (see note 3). l Local alarm lights representing upscale and downscale trips will be I verified, but no rod block will be produced at this time. The inoperative trip will be initiated to produce a rod block (SRM and IRM inoperative also bypassed with the mode switch in RUN). The functions that cannot be verified to produce a rod block directly will be verified during the operating cycle. I 1 1 BON 3.2/4.2-58 Unit 3 AMENDM9fr N0.13 5
f - NOTES FOR TABLES 4.2. A THROUGH 4.2.L excent '4.2.D AND 4.2.K (Cont 'd) A
- 14. (Deleted)
- 15. bTh fl b as e par tor ill b test by p ting ne ov 't in
(~ st' (. odu ng 2 s .am) d ad sti he t t ir t to btai com r or r b ck, e ov b s ups ale vi.1 b eri d by j o e r- ng i w 11 p odu _ a loc up cale ip 'ght ing era on ar ver d bl k du ng t e oper ting cycle. ed a[t L
- 16. Performed during operating cycle. Portions of the logic is checked more frequently during functional tests of the functions that produce a rod block.
< 17. This calibration consists of removing'the function from service and performing an electronic calibration of the channel.
- 18. Functional test is limited to the condition where secondary containment integrity is not required as specified in Sections 3.7.C.2 and 3.7.C.3.
- 19. Functional test is limited to the time where the SGTS is rsquired to meet ;
the requirements of Section 4.7.C.1.a.
]
- 20. fCa/ibr ti o the compa ator equ'.es t e inp ts om b h re ircu ati n flo bia sigr to he u'
)6op t be nte upte , the- by emov' t AP .d i ar ser ing he eact . s ibr ion an o y j g gr rme dur'. outa .
- 21. Logic test is limited to the time where actual operation of the equipment is permissible. ,
Y -mu.
- 22. (Deleted) '
- 23. (Deleted) 24 This instrument check consists of comparing the thermocouple readings for all valves for consistence and for nominal expected values (not required during refW 'ing outages).
- 25. During each refueling outage, all acoustic monitoring channels shall be calibrated. This calibration includes verification of accelerometer response due to mechanical excitation in the vicinity of the sensor.
f i BFN 3.2/4.2-59 b 16 7 ' Unit 3
3.2 EASES (Cont'd) The instrumentation which initiates CSCS action is arranged in a dual bus system. As for other vital instrumentation arranged in this fashion, the specification preserves the effectiveness of the system even during periods when maintenance or testing is being performed. An exception to this is when logic functional testing is being performed. The control rod block functions are provided to generate a trip signal to block rod withdrawal if the monitored power level exceeds a preset value. Th ip logic for this function is 1-out-of-n: e.g., any trip on one of APRMs, eight IRMs, or four SRMs will result in a rod block.
.O fg,7 The minimum instrument channel requirements assure sufficient instrumentation to assure the single failure criteria is met. The minimum instrument channel requirements for the RBM may be reduced by one for maintenance, testing, or calibration. This does not significantly increase the risk of an inadvertent control rod withdrawal, as the other channel is available, and the REM is a backup system to the written sequence for withdrawal of control rods.
The APRM rod block function is flow biased and provides a trip signal for blocking rod withdrawal when average reactor thermal power exceeds pre-established limits set to prevent scram actuation. The RBM rod block function provides local protection of the core; i.e., the prevention of critical power in a local region of the core, for a single rod withdrawal error from a limiting control rod pattern. If the IRM channels are in the worst condition of allowed bypass, the sealing arrangement is such that for unbypassed IRM channels, a rod block signal is generated before the detected neutrons flux has increased by more than a factor of 10. A downscale indication is an indication the instrument has failed or the instrument is not sensitive enough. In either case the instrument will not respond to changes in control rod motion ard thus, control rod motion is prevented. The refueling interlocks also operate one logic channel, and are required for safety only when the mode switch is in the refueling position. For effective emergency core cooling for small pipe breaks, the HPCI system must function since reactor pressure does not decrease rapid enough to allow either core spray or LPCI to operate in time. The automatic pressure relief function is provided as a backup to the'HPCI in the event the HPCI does not operate. The arrangement of the tripping contacts is such as to provide this function when necessary and minimize spurious operation. The trip settings given in the specification are adequate to assure the above criteria are met. The specification preserves the effectiveness of the system during periods of maintenance, testing, or calibration, and also minimizes the risk of inadvertent operation; i.e., only one instrument channel out of service. 1 BFN 3.2/4.2-67 l Unit 3 1 j
~ - :y LJ 4.2 BASES (Cont'd)- SEP 2 21993 :
The conclusions'to be drawn are these: [ 1. A 1-out-of-n system may be treated the same as a single channel in terms of choosing a test interval; and ,
- 2. more than one channel should not be bypassed for testing at any one time.
.The radiation monitors in the reactor and refueling zones which initiate ;
building isolation and standby gas treatment operation are arranged such ~ that two sensors high (above the high level setpoint) in a single channel or one sensor downscale (below lov level setpoint) or inoperable in two channels in the same Zone vill initiate a trip function. The functional testing frequencies for both the channel functional test and the high- ' voltage power supply functional test are based on a Probabilistic Risk. Assessment and system drift characteristics of the Reactor Building Ventilation Radiation Monitors. The calibration frequency is based upon , the drift characteristics of the radiation monitors. _ The automatic pressure relief instrumentation can be considered to be a 1-out-of-2 logic system and'the discussion above applies also, j ' I The RCIC and HPCI system logic tests required by Table 4.2.B contain i provisions to demonstrate that these systems vill automatically restart on a RPV lov vater level signal received subsequent to a EPV high water level trip. t v Zusmr M ^> INSERT M: _
- ^ %_ -
The electronic instrumentation comprising the APRM rod block and Rod Block Monitor functions together with the recirculation flow instrumentation for flow bias purposes is monitored by the same self-test functions as applied to the APRM function for the RPS. 1 I The functional test frequency of every six months'is based on this automatic self-test monitoring at 15 minute intervals and on the low expected equipment failure rates. Calibration frequency of once per operating cycle is based on the drift characteristics of the limited number of analog components, recognizing that most of the processing is performed digitally without drift of setpoint values.
* ~
v i BM 3.2/4.2-72 AMENDMElfT NO. I 72 ( Unit 3 L g
-m q 3,3/4.3 REACTIVITY CONTROL LIMITING CONDITIONS FOR OPERATION SURVEILLANCE REOUIREMENTS ,
3.3.B. Control Rods 4.3.B. Control Rods . 3.c. If Specifications 3.3.B.3.b.1 3.b.3 through 3.3.B.3.b.3 cannot When the RWM is not i OPERABLE a second be met the reactor shall licensed operator not be started, or if the or other technically l reactor is in the RUN or qualified member of startup modes at less than the plant staff shall ' lo: rated power, control rod verify that the correct l movement may be only by rod program is followed. ! actuating the nanual scram or placing the reactor mode switch in the shutdown position. 4 Control rods shall not be 4 Prior to control red withdrawn for startup or withdrawal for startup refueling unless at least or during refueling,
, two source range channels verify that at least two have an observed count rate source range channels equal to or greater than have an observed count three counts per second. rate of at least three counts per second.
s 5. Durd
/
pe atio v sh r
- 5. Du o er in th
. P or P e al D ua to t o gr ster th 0 5, o gr at an .9 ,
it er: t t ion t ta te a all e< s a th is ha erf e pr or o e E J: {vi dra al fte ' d d si ted to s) t 1 ast ne per 2
- b. Con al od i ra al t
-I s 1 b ek .
7 V (oam hve/M) U V BFN
, , , _ ,, _3.3/4.3-8 Unit 3 AIIENDMENT ,NO. 190
, _g e a- e e e hen * * * '
W m>9ED 6 *We*eu-m -
i 3.3/4.3 BASES (Cont'd) f5. e od ock oni or ,BM) s de gned oa omat ally even fuel d age nt ove den ty ev eo ere neou rod ri pove lev thdr al f m loc ion of h h ope tion. Two i Mc el are pr ided and ne t se m be as. d fro the nsol for ! nte ce d/ t ting. Aut ati rod v draw bl f mo . ft ch els i bloc erro cous od vi draw soo eno to pr ent el a spe fie restr tio with ne e e ou o serv ce s vativ ya ure ) at f Id ge v 1 no occ d' i o ro wit r al er rs v n tMs con tion ( ist.. C. Scram Insertion Times The control rod system is designed to bring the reactor suberitical at a rate fast enough to prevent fuel damage; i.e., to prevent the MCPR from becoming less than 1.07, Analysis of this transient shows that the negative reactivity rates resulting from the scram (FSAR Figure N3.6-9) with the average response of all the drives as given in the above , specification, provide the required protection, and MCPR remains greater than 1.07.
, On an early BWR, some degradation of control rod scram performance l occurred during plant startup and was determined to be caused by i particulate material (probably construction debris) plugging an internal '
control rod drive filter. The design of the present control rod drive (Model 7EDB144B) is grossly improved by the relocation of the filter to a location out of the scram drive path; i.e., it can no longer interfere ! with scram performance, even if completely blocked. The degraded performance of the original drive (CRD7EDB144A) under dirty operating conditions and the insensitivity of the redesigned drive (CRD7EDB144B) has been demonstrated by a series of engineering tests under ; simulated reactor operating conditions. The successful performance of the new drive under actual operating conditions has also been demonstrated by consistently good in-service test results for plants using the new drive ; and may be inferred from plants using the older model 6 i BFN 3.3/4.3-17 Unit 3 A!!ENDtiENT NO. 190 l i 1
. . . _ .. --- - -- 0 1
1 -
3.5/4.5 CORE AND CONTATNMENT COOLING SYSTEMS LIMITING CONDITIONS FOR OPERATION SURVEILLANCE REOUIREMENTS 3.5.I Averare Planar Linear Heat 4.5.I Average Planar Linear Heat i Generation Rate Generation Rate (APLHGR) l During steady-state power l operation, the Average Planar The APLHGR shall be checked l daily during reactor Linear Heat Generation Rate operation at 1 25% rated (APLHCR) of any fuel assembly at thermal power. any axial location _shall not exceed the appropriate'APLHCR limit - provided in the CORE OPERATING LIMITS REPORT. If at any time W% NO-D@E@N during operation it is determined by oR PO M -DEPE4 W T aormal surveillance that the limiting value for APLHGR is being exceeded, action shall be initiated within 15 minutes to restore operation to within the prescribed limits. If the APLHGR is not returned to within the prescribed
, limits within two (2) hours, the reactor shall be brought to the COLD SHUTDOWN CONDITION within 36 hours.
Surveillance and corresponding action shall continue until reactor operation is within the prescribed limits. L J. Linear Heat Generation J. Linear Heat Generation Rate (LHGR) Rate (LHGR) During steady-state power operation, The LHGR shall be checked the linear heat generation rate (LHGR) daily during reactor of any rod in any fuel assembly at any operation at 1 25% rated axial location shall not exceed the thermal power. appropriate LHGR limit provided in the CORE OPERATING LIMITS REPORT. If at any time during operation it is determined by normal surveillance that the limiting value for LHGR is being exceeded, action shall be initiated within 15 minutes to restore operation to within the prescribed limits. If the LHGR is not returned to within the prescribed limits within two (2) hours, the reactor shall be brought to the COLD SHUTDOWN CONDITION within 36 hours. Surveillance and corresponding action shall continue until reactor operation is within the prescribed limits. BFN _ ._. .. 3.5/4.5-18 Unit 3
3.5/4.5 CORE AND CONTAINMENT COOLING SYSTEMS LIMITING CONDITIONS FOR OPERATION SURVEILLANCE REOUIREMENTS 3.5.K Minimu= Critical Power Ratio 4.5.K Minimum Critical Power (MCPR) Ratio (MCPR) l The minimum critical power ratio 1. MCPR shall be checked daily (MCPR) shall be equal to or greater during reactor power operation thantheloperatinglimitMCPR at 2. 25% rated thermal power (OLMCPR) as provided in the CORE and following any change in j OPERATING LIMITS REPORT. If at any power level or distribution j time during steady-state operation that vould cause operation eoPE'j t is determined by nor=al pr#' itA -T urveillance that the limiting with a LIMITING CONTROL ROD PATTERN. pp value for MCPR is being exceeded, QN" 4 NtT , - o- r action shall be initiated within 2. The[MCPRJ)t4c Av rytJRl/ fW] { g f' f 15 minutes to restore operation to C#35 A'atWQaygshall be p within the prescribed limits. If determined as provided in the the steady-state MCPR is not CORE OPERATING LIMITS REPORT i returned to within the prescribed using: l limits within two (2) hours, the g 1 reactor shall be brought to the a. R as defined in the CORE COLD SHUTDOWN CONDITION vithin OPERATING LIMITS REPORT 36 hours, surveillance and prior to initial scram torresponding action shall continue time measurements for the until reactor operation is within cycle, performed in the prescribed limits. accordance with ) Specification 4.3.C.1.
- b. as defined in the CORE OPERATING LIMITS REPORT following the conclusion of each scram-time surveillance test required by Specifications 4.3.C.1 and 4.3.C.2.
The determination of the limit must be completed within 72 hours of each scram-time surveillance required by Specification 4.3.C. g,, . 2 u4 5-te ixxxomzur no. 1,o
, e e g . , , .g w &* .
I' 3.5/4,5 CORE AND CONTAINMENT COOLING SYSTEMS LIMITING CONDITIONS FOR OPERATION SURVEILLANCE REOUIREMENTS 3.5 Core and Containment Coolins Systems 4.5 Core and Containment Coolins Systems I L. APRM Setpoints L. APRM Setpoints I .en e th c e he a P/ PD all e po r s 25 o ra d the de e ned dai' v en , r ti of P 4 PD h 1 e eac ri 1 5% f
- j. e 1. , t eA E ser ra ed t erm p er s po t qu io li ted n ec on .1 tea ' -
ro bl ek etp in equ tio st i- the CO OF RAT . G IM 4S ) l PC s 11 e m tip ied y P/ P. pg g/
/ 2 . hte it sd e ine tha
- 3. .L.1 is oc eir me ,
hour is al oved to ( _ corr t t .e ond'.io .
. I' 3.5 . and 3.5 .2 anno b met t' r et r pove sh 11 e edu d o 12.o r e the a pov r f vi in 4 ou .
b - t l ()e/ehh ! L j i BFN 3.5/4.5-20 AIIENDl!ENT NO. 190 Unit 3
3.5 BASES (Cont'd) 3.5.I. Averare Planar Linear Heat Generation Rate (APLHGR) This specification assures that the peak cladding temperature following the postulated design basis loss-of-coolant accident will not exceed the l { limit specified in the 10 CFR 50, Appendix K.
]
l The peak cladding temperature following a postulated loss-of-coolant accident is primarily a function of the average heat generation rate of all the rods of a fuel assembly at any axial location and is only dependent secondarily on the rod-to-rod power distribution within an assembly. Since expected local variations in power distribution within a fuel assembly affect the calculated peak clad temperature by less than l 1 20*F relative to the peak temperature for a typical fuel design, the In5 f[Y limit on the average linear heat generation rate is sufficient to assure that calculated temperatures are within the 10 CFR 50 Appendix K limit. I l 1 3.5.J. Linear Heat Generation Rate (LHCR) I l This specification assures that the linear heat generation rate in any rod is less than the design linear heat generation if fuel pellet densification is postulated. The LHGR shall be checked daily during reactor operation at 2. 25 percent power to determine if fuel burnup, or control rod movement has caused changes in power distribution. For LHGR to be a limiting value below 25 percent of rated thermal power, the largest total peaking would have to I be greater than approximately 9.7 which is precluded by a considerable f margin when employing any permissible control rod pattern. 3.5.K. Minimum Critical Power Ratio (MCPR) At core thermal power levels less than or equal to 25 percent, the reactor will be operating at minimum recirculation pump speed and the moderator void content will be very small. For all designated control rod patterns which may be employed at this point, operating plant experience and thermal hydraulic analysis indicated that the resulting MCPR value is in excess of requirements by a considerable margin. With this low void content, any inadvertent core flow increase would only place operation in a more conservative mode relative to MCPR. The daily requirement for calculating MCPR above 25 percent rated thermal power is sufficient since power distribution shifts are very slow when there have not been significant power or control rod changes. The requirement for calculating MCPR when a limiting control rod pattern is approached
, f- 8 ensures that MCPR will be known following a change in power'or power shape (regardless of magnitude) that could place operation at a thermal limit.
3.5.L. APRM Setpoints ___ _ Opjrationisconsraine to th LHGR 1 (nit of S ecifica ion 3.5 . is 1 mit is re ched when ore m imum fr ction o limiti power ensi C D) e ual 1.0. For t case ere D excefds the act on of rat d th al over oper ion is, ermitte. only at'less t,han
/
__- - ._ _/ - - BFN 3.5/4.5-34 Unit 3 (pMd// l
INSERT N: _ At less than rated power conditions, the rated APLHGR limit is adjusted by a power dependent correction factor, MAPFAC(P) . At less ) than rated flow conditions, the rated APLHGR limit is adjusted by a j flow dependent correction factor, MAPFAC(F). The most limiting l power-adjusted or flow-adjusted value is taken as the APLHGR j 1 operating limit for the off-rated condition. / The flow dependent correction factor, MAPFAC(F), applied to the rated APLHGR limit assures that (1) the 10 CFR 50.46 limit would not be exceeded during a LOCA initiated from less than rated core flow conditions and (2) the fuel thermal mechanical design criteria would be met during abnormal operating transients initiated from less than rated core flow conditions. MAPFAC(F) values are provided in the CORE OPERATING LIMITS REPORT. } ' The power dependent correction factor, MAPFAC (P) , applied to the l rated APLHGR limit assures that the fuel thermal mechanical design criteria would be met during abnormal operating transients initiated ( from less than rated power conditions. MAPFAC(P) values are h provided in the CORE OPERATING LIMITS REPORT. , _ INSERT 0: _
~ ~ _ _ f ___-
At less than rated power conditions, a power dependent MCPR operating limit, MCPR(P), is applicable. At less than rated flow conditions, a flow dependent MCPR operating limit, MCPR ( F) , is applicable. The most limiting power dependent or flow dependent value is taken as the MCPR operating limit for the off-rated > condition. The flow dependent limit, MCPR ( F) , provides the thermal margin required to protect the fuel from transients resulting from l inadvertent core flow increases. MCPR(F) values are provided in the 1 CORE OPERATING LIMITS REPORT. l The power dependent limit, MCPR(P) , protects the fuel from the other limiting abnormal operating transients, including localized events such as a rod withdrawal error. MCPR (P) values are provided in the CORE OPERATING LIMITS REPORT. _ . l l l J
3.5 BASES (Cont'd) - 100 e cent ate powe and only wi.th AP ser settin s as r quired by p cifi tio 3.5. .1. e se dm tri sett ng and od bl ek t p a tt ng a ad ste to en re t at no ombi tion o CMFL an FR il inc ease the GR tr sie peak eyon that love yte o -per ent last c str n li t. six- ur ti peri to ach ey t is ndi ion just ied ince e ad itiona marg ga e y l etd a just ent i abov. and b yond hat en ured th a fet analy ~ _ , 3.5.M. Core Thermal-Hydraulic Stability l l The minimum margin to the onset of thermal-hydraulic instability occurs in Region I of Figure 3.5.M-1. A manually initiated scram upon entry into this region is sufficient to preclude core oscillations which could challenge the MCPR safety limit. Because the probability of thermal-hydraulic oscillations is lower and the margin to the MCPR safety limit is greater in Region II than in Region I of Figure 3.5.M-1, an immediate scram upon entry into the region is not necessary. However, in order to minimize the probability of core instability following entry into Region II, the operator will take immediate action to exit the region. Although formal surveillances are not performed while exiting Region II (delaying exit for surveillances is undesirable), an immediate manual scram will be initiated if evidence of thermal-hydraulic instability is observed. Clear indications of thermal-hydraulic instability are APRM oscillations which exceed 10 percent peak-to-peak or LPRM oscillations which exceed 30 percent peak-to-peak (approximately equivalent to APRM l oscillations of 10 percent during regional oscillations). Periodic I LPRM upscale or downscale alarms may also be indicators of thermal j hydraulic instability and will be immediately investigated. Periodic upscale or downscale LPRM alarms will occur before regional oscillations are large enough to threaten the MCPR safety limit. , Therefore, the criteria for initiating a manual scram described in the l preceding paragraph are sufficient to ensure that the MCPR safety l limit will not be violated in the event that core oscillations I initiate while exiting Region II. I Normal operation of the reactor is restricted to thermal power and core flow conditions (i.e. , outside Regions I and II) where thermal-hydraulic instabilities are very unlikely to occur. , 3.5.N. References
- 1. Loss-of-Coolant Accident Analysis for Browns Ferry Nuclear Plant Unit 3, NED0-24194A and Addenda.
BFN 3.5/4.5-35 Unit 3
~..
of the results of the Radiological Environmental Monitoring Program-for the reporting period. The material provided shall ' be consistent with the objectives outlines in (1) the ODCM and (2) Sections IV.B.2, IV.B.3, and IV.C of Appendix I to 10 CFR Part 50. 6.9.1.6 SOURCE TESTS
- Results of required leak tests performed on sources if the tests ,
reveal the presence of 0.005 microcurie or more of removable contamination. 6.9.1.7 CORE OPERATING LIMITS REPORT
- a. Core operating limits shall be established and shall be documented in the CORE OPERATING LIMITS REPORT prior to each ;
operating cycle, or prior to any remaining portion of an : I operating cycle, for the following': , (1) e P for Specification 3.5.I (2) The LHGR for Specification 3.5.J
~ ' ,f (3) M R pe th for Specification 3.5.I/4.5.I (4) The APRM Flow Biased Rod Block Trip Setting for Specification 2.1.A.1.c ble 3.2. Spe fi 5.Ll l ~l p .
- n. -
(5) Th RBM ps ale (T1 Bias Tri/SetfingpddAlgpe v lue r a se i for Table 3.2.C s e
- b. The analytical methods used to determine the core operating
. limits shall be those previously reviewed and approved by the NRC, specifically those described in General Electric Licensing Topical Report NEDE-240ll-P-A, " General Electric Standard Application for Reactor Fuel" (latest approved version).
BFN 6.0-26a AIENDliENT NO. 19G Unit 3 S
w INSERT P: e (1) The rated APLHGR limit; the Flow Dependent APLHGR Factor, MAPFAC (F) ; and the Power Dependent APLHGR Factor, MAPFAC (P) for Specification 3.5.I. , (2) The LGHR limit for Specification 3.5.J. (3) The rated MCPR Operating Limit; the Flow Dependent MCPR I Operating Limit, MCPR (F) ; and the Power Dependent MCPR Operating Limit, MCPR ( P) for Specification 3.5.K/4.5.K. (4j The APRM flow biased rod block trip setting for Specification 2.1.A.1.c and Table 3.2.C. (5) The REM downscale trip setpoint, high power trip setpoint, intermediate power trip setpoint, low power trip setpoint, and applicable reactor thermal power ranges for each of the setpoints for Table 3.2.C. A L
~
s A
u t ENCLOSURE 3 I TENNESSEE VALLEY AUTHORITY (TVA) BROWNS FERRY NUCLEAR PLANT (BFN) l UNITS 1, 2, and 3 PROPOSED TECHNICAL SPECIFICATION (TS) CHANGE TS-353 f REVISED PAGES , i f I. AFFECTED PAGE LIST 1 I Unit 1 Unit 2 Unit 3 1.0-7 1.0-7 1.0-7 , 1.0-8 1.0-8 1.0-8 . t 1.1/2.1-2 1.1/2.1-2 1.1/2.1-2 i 1.1/2.1-3 1.1/2.1-3 1.1/2.1-3 , 1.1/2.1-7 1.1/2.1-7 1.1/2.1-7 ' 1.1/2.1-17 1.1/2.1-16 1.1/2.1-16 . 3.1/4.1-3 3.1/4.1-3 3.1/4.1-2 ! 3.1/4.1-5 3 .1/4 .1'- 5 3.1/4.1-4
- 3.1/4.1-6 3.1/4.1-6 3.1/4.1-5 '!
3.1/4.1-7 3.1/4.1-7 3.1/4.1-6 I 3.1/4.1-8 3.1/4.1-8 3.1/4.1-7
- 3.1/4.1-10 3.1/4.1-10 3.1/4.1-9 3.1/4.1-11 3.1/4.1-11 3.1/4.1-10 -
3.1/4.1-12 3.1/4.1-12 3.1/4.1-11 ' 3.1/4.1-14 3.1/4.1-14 3.1/4.1-13 i 3.1/4.1-15 3.1/4.1-15 3.1/4.1-14 l" 3.1/4.1-16 3.1/4.1-16 3.1/4.1-15 3.1/4.1-17 3.1/4.1-17 3.1/4.1-16 ' 3.1/4.1-19 3.1/4.1-19 3.1/4.1-18 3.1/4.1-20 3.1/4.1-20 3.1/4.1-19 3.2/4.2-25 3.2/4.2-25 3.2/4.2-24 , 3.2/4.2-26 3.2/4.2-26 3.2/4.2-25 3.2/4.2-27 3.2/4.2-27 3.2/4.2-26 i 3.2/4.2-27a 3.2/4.2-27a 3.2/4.2-26a i 3.2/4.2-27b 3.2/4.2-27b 3.2/4.2-26b ! 3.2/4.2-50 3.2/4.2-50 3.2/4.2-49 ; 3.2/4.2-59 3.2/4.2-59 3.2/4.2-58 i 3.2/4.2-60 3.2/4.2-60 3.2/4.2-59 I 3.2/4.2-68 3.2/4.2-68 3.2/4.2-67 ! 3.2/4.2-73 3.2/4.2-73a 3.2/4.2-72 l 3.3/4.3-8 3.3/4.3-8 3.3/4.3-8 3.3/4.3-17 3.3/4.3-17 3.3/4.3-17 3.5/4.5-18 3.5/4.5-18 3.5/4.5-18 l 3.5-4 5-19 3.5-4.5-19 3.5-4.5-19 f 3.5/4.5-20 3.5/4.5-20 3.5/4.5-20 l 3.5/4 5-33 3.5/4.5-31 3.5/4.5-34 6 3.5/4.5-34 3.5/4.5-32 3.5/4.5-35 ! 3.5/4 5-35 3.5/4.5-33 3.5/4.5-36 ! 3.5/4.5-36 3.5/4.5-34 3.5/4.5-37 ! 3.5/4 5-37 3/5/4.5-35 3.5/4.5-38 l 6.0-26a 6.0-26a 6.0-26a , 6.0-26b 6.0-26b 6.0-26b j 6.0-26c i II. EJVISED PAGES ! See attached. l l
- w. - - -
-1.0 DEFINITIONS (Cont'd) i Q. Doeratina Cycle . Interval between the end of one refueling outage for )
a particular unit and the-end of the next subsequent refueling outage. ) for the same unit. j R. Refuelina Outane - Refueling outage is the period of time'between the shutdown of the unit prior to a refueling and the startup of the unit after that refueling. For the purpose of designating frequency of testing and surveillance, a refueling outage shall mean a regularly. ! scheduled outage; however, where such outages occur within 8 months of j the completion of the previous refueling outage, the required .1 surveillance testing need not be performed until the next regularly. ' scheduled outage. S. CORE ALTERATION - CORE ALTERATION shal1~be the movement of any fuel,. l sources, reactivity control components, or other components affecting 1 reactivity within the reactor vessel with the vessel head removed and , fuel in the vessel. Movement of source range monitors, intermediate l range monitors, traversing in-core probes, or special movable : detectors (including undervessel replacement).is not considered a CORE ALTERATION. Suspension of. CORE ALTERATIONS shall not preclude. l completion of movement of a component to a safe location.
~
T. Reactor Vessel Pressure - Unless otherwise inticated, reactor vessel pressures listed in the Technical Specifications are those. measured by i the reactor vessel steam space detectors. i U. Thermal Parameters
- 1. Minimum Critical Power Ratio (MCPR) - Minimum Critical Power Ratio (MCPR) is the value of the critical power ratio associated with {
the most limiting assembly in the reactor core. Critical Power i Ratio (CPR) is the ratio of that power in a' fuel assembly, which i is calculated to cause some point in the assembly to experience ! boiling' transition, to the actual assembly operating power. !
- 2. Transition Boillna - Transition boiling means the boiling regime between nucleate and film boiling. Transition boiling is.the ) '
regime in which both nucleate and film boiling occur ; intermittently with neither type being completely stable.
- 3. (Deleted) d
- 4. Averare Planar Linear Heat Generation Rate (APJ2 gel - The Average ;
Planar Heat Generation Rate is applicable to a specific planar i height and is equal to the sum of the linear heat generation rates ! for all the fuel rods in the specified bundle at the specified l height divided by the number of fuel rods in the fuel bundle. ; i BFN 1.0-7 Unit 1
i 1.0 DEFINITIONS (Cont'd) V. Instrumentation q ,
- 1. Instrument Calibration - An instrument calibration means the -
adjustment of an instrument signal output so that it corresponds, within acceptable range, and accuracy, to a known value(s) of the parameter which the instrument monitors. l
- 2. Channel - A channel is an arrangement of the sensor (s) and associated components used to evaluate plant variables and >
produce discrete outputs used in logic. A channel terminates and loses its identity where individual channel outputs are i combined in logic.
- 3. Instrument Punctional Tggg,- An instrument functional test means the injection of a simulated signal into the instrument primary ,
sensor to verify the proper instrument channel response, alarm , and/or initiating action. l
- 4. Instrument Check - An instrument check is qualitative determination of acceptable OPERABILITY by observation of instrument behavior during operation. This determination shall include, where possible, comparison of the instrument with other independent instruments measuring the same variable.
i
- 5. Lonic System Functional Test - A logic system functional test. l means a test of all relays and contacts of a logic circuit to insure all components are OPERABLE per design intent. Where practicable, action will go to completion; i.e., pumps will be started and valves operated.
- 6. Trio System - A trip system means an arrangement of instrument channel trip signals and auxiliary equipment required to !
i initiate action to accomplish a protective trip function. A trip system may require one or more instrument channel trip signals related to one or more plant parameters in order to i initiate trip system action. Initiation of protective action may require the tripping of a single trip system or the coincident tripping of two trip systems.
- 7. Protective Action - An action initiated by the protection system when a limit is reached. A protective action can be at a channel or system level.
- 8. Protective Function - A system protective action which results from the protective action of the channels monitoring a particular plant condition.
BFN 1.0-8 Unit 1
TABLE 4.1.B REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION CALIBRATION
*z MINIMUM CALIBRATION FREQUENCIES FOR REACTOR PROTErTION INSTRUMENT CHANNELS Instrument Channel Group (1) Calibration Minimum Freauenewf2)
IRM High Flux C Cogarison to APRM on Controlled Note (4) Startups (6) APRM High Flux i Output Signal Heat Balance Once/7 Days 1 Flow Blas Signal Calibrate Flow Blas Signal (7) Once/ Operating Cycle d LPRM Signal TIP System Traverse (8) Every1000EffectiveFull4 Power Hour: High Reactor Pressure A Standard Fressure Source Every 3 Months High Drywell Pressure A Standard Pressure Source Every 3 Months Reactor Low Water Level A Pressure Standard Every 3 Months
- High Water Level in Scram 2 Discharge Volume Electronic Lvl Switches 7 (LS-85-45-A, 8. G, H) A Calibrated Water Column (5) Note (5)
Float Switches (LS-85-45C-F) A Calibrated Water Column (5) Note (5) Main Steam Line Isolation Valve Closure A Note (5) Note (5) Turbine First Stage Pressure Permissive (PT-1-81A, B & PT-1-91A, B) B Standard Pressure Source Once/ Operating Cycle (9) Turbine Control Valve Fast Closure or Turbine Trip A Standard Pressure Source Once/ Operating Cycle Turbine Stop Valve Closure A Note (5) Note (5)
-. . -. -. -- -. - - - - .. ,- -. -- _______w
NOTES FOR TABLE 4.1.B
- 1. A description of three groups is included in the bases of this specification.
- 2. Calibrations are not required when the systems are not required to be OPERABLE or are tripped. If calibrations are missed, they shall be performed prior to returning the system to an OPERABLE status.
- 3. (Deleted)
- 4. Required frequency is initial startup following each refueling outage. '
- 5. Physical inspection and actuation of these position switches will be l performed once per operating cycle.
- 6. On controlled startups, overlap between the IRMs and APRMs will be !
verified.
- 7. The flow bias signal calibration will consist of calibrating the analog differential pressure flow sensors once per operating cycle. Calibration of the flow bias processing system is done once per operating cycle as ;
part of the overall APRM instrumentation calibration.
- 8. A complete TIP system traverse calibrates the LPRM signals to the process computer. The individual LPRM meter readings will be adjusted as a minimum at the beginning of each operating cycle before reaching 100 percent power.
- 9. Calibration consists of the adjustment of the primary sensor and associated components so that they correspond within acceptable range and accuracy to known values of the parameter which the channel monitors, including adjustment of the electronic trip circuitry, so that its output relay changes state at or more conservatively than the analog equivalent of the trip level setting.
l l
)
BFN 3.1/4.1-12 Unit 1 I
i i l 3.1 BA111 , The reactor protection system automatically initiates a reactor scram to:
- 1. Preserve the integrity of thi fuel cladding.
- 2. Preserve the integrity of the reactor coolant system.
. 3. Minimize the energy which must be absorbed following a loss of < coolant accident, and prevents criticality.
- This specification provides the limiting conditions for operation necessary to preserve the ability of the system to tolerate single !
failures and still perform its intended function even during periods when instrument channels may be out of service because of maintenance. When necessary, one channel may be made inoperable for brief intervals to conduct required functional tests and calibrations. The reactor protection trip system is supplied, via a separate bus, by 3 its own high inertia, ac motor-generator set. Alternate power is ! available to either Reactor Protection System bus from an electrical bus that can receive standby electrical power. The RPS monitoring system , provides an isolation between nonclass 1E power supply and the class lh i?R Sus. This will ensure that failure of a nonclass 1E reactor pratectics power supply will not cause adverse interaction to the ! clae9 1E Etactor Protection System. , i The reactcr protection system is made up of two independent trip systems (refer to Seccion 7.2, FSAR). There are usually four channels provided , 4 to monitor each critical parameter, with two channels in each trip system. The outputs of the channels in a trip system are combined in a logic such that either channel trip will trip that trip system. The ; simultaneous tripping of both trip systems will produce a reactor scram. t This system meets the intent of IEEE-279 for Nuclear Power Plant Protection Systems. The system has a reliability greater than that of a ,~ 2-out-of-3 system and somewhat less than that of a 1-out-of-2 system. With the exception of the Average Power Range Monitor (APRM) channels, : the Intermediate Range Monitor (IRM) channels, the Main Steam Isolation ' Valve closure and the Turbine Stop Valve closure, each trip system logic - has one instrument channel. When the minimum condition for operation on ; the number of operable instrument channels per untripped protection trip ; system is met or if it cannot be met and the effected protection trip j system is placed in a tripped condition, the effectiveness of the i protection system is preserved; i.e., the system can tolerate a single failure and still perform its intended function of scramming the t reactor. l i The APRM system is divided into four APRM channels and four 2-out-of-4 trip voter channels. Each APRM channel provides input to each of the . four voter channels. The four voter channels are divided into two groups ' of two each, with each group of two providing inputs to one RPS trip BFN 3.1/4.1-14 Unit 1
- l
3.1 BASES (Cont'd) system. The APRM system is designed to allow one APRM channel, but no voter channels, to be bypassed. A trip from any one unbypassed APRM will result in a " half-trip" in all four of the voter units, but no trip inputs to either RPS trip system. A trip from any two unbypassed APRM channels will result in a full trip in each of the four voter channels, which in turn results in two trip inputs into each RPS trip system resulting in a full scram. Each APRM instrument channel receives input signals from forty-three (43) Local Power Range Monitors (LPRMs). A minimum of twenty (20) LPRM inputs with three (3) per axial level is required for the APRM instrument channel to be OPERABLE. Fever than the required minimum number of LPRM inputs generates an instrument channel inoperative alarm and a control l rod block but does not result in an automatic trip input to the ( 2-out-of-4 voters. l Each protection trip system has one more IRM than is necessary to meet I the minimum number required per channel. This allows the bypassing of one IRM per protection trip system for maintenance, testing or l calibration. The bases for the scram setting for the IRM, APRM, high d reactor pressure, reactor low water level, MSIV closure, turbine control valve fast closure and turbine stop valve closure are discussed in Specifications 2.1 and 2.2. Instrumentation (pressure switches) for the drywell are provided to detect a loss of coolant accident and initiate the core standby cooling equipment. A high drywell pressure scram is provided at the same setting as the core cooling systems (CSCS) initiation to minimize the energy which must be accommodated during a loss of coolant accident and to prevent return to criticality. This instrumentation is a backup to the reactor vessel water level instrumentation. A reactor mode switch is provided which actuates or bypasses the various scram functions appropriate to the particular plant operating status. Reference Section 7.2.3.7 FSAR. l ( l The manual scram function is active in all modes, thus providing for a l manual means of rapidly inserting control rods during all modes of reactor operation. The IRM system (120/125 scram) in conjunction with the APRM system (15 percent scram) provides protection against excessive power levels and ( short reactor periods in the startup and intermediate power ranges. The control rod drive scram system is designed so that all of the water which is discharged from the reactor by a scram can be accommodated in the discharge piping. The discharge volume tank accommodates in excess of 50 gallons of water and is the low point in the piping. No credit was taken for this volume in the design of the discharge piping as concerns the amount of water which must be accommodated during a scram. During normal operation the discharge volume is empty; however, should it fill with water, the water discharged to the piping from the reactor could not BFN 3.1/4.1-15 Unit 1 i
3.1 BASES (Cont'd) be accommodated which would result in slow scram times or partial control rod insertion. To preclude this occurrence, level switches have been provided in the instrument volume which alarm and scram the reactor when the volume of water reaches 50 gallons. As indicated above, there is sufficient volume in the piping to accommodate the scram without impairment of the scram times or amount of insertion of the control rods. This function shuts the reactor down while sufficient volume remains to accommodate the discharge water and precludes the situation in which a scram would be required but not be able to perform its function adequately. A source range monitor (SRM) system is also provided to supply additional neutron level information during startup but has no scram functions. Reference Section 7.5.4 FSAR. Thus, the IRM is required in the REFUEL and STARTUP modes. In the power range the APRM system provides required protection. Reference Section 7.5.7 FSAR. Thus, the IRM System is not required in the RUN mode. The APRMs and the IRMs provide adequate coverage in the startup and intermediate range. The high reactor pressure, high drywell pressure, reactor low water level and scram discharge volame high level scrams are required for STARTUP and RUN modes of plant operation. They are, therefore, required to be operational for these modes of reactor operation. The requirement to have the scram functions as indicated in Table 3.1.1 operable in the REFUEL mode is to assure that shifting to the REFUEL mode during reactor power operation does not diminish the need for the reactor protection system. Because of the APRM downscale rod block limit of 1 3 percent when in the RUN mode and high level flux scram limit of 115 percent when in the STARTUP Mode, the transition between the STARTUP and RUN Modes must be made with the APRM instrumentation indicating between 3 percent and 15 percent of rated power. In addition, the IRM system must be indicating d below the High Fluz setting (120/125 of scale) or a scram will occur when in the STARTUP Mode. For normal operating conditions, these limits provide assurance of overlap between the IRM system and APRM system so that there are no " gaps" in the power level indications (i.e., the power level is continuously monitored from beginning of startup to full power and from full power to shutdown). When power is being reduced, if a transfer to the STARTUP mode is made and the IRMs have not been fully inserted (a maloperational but not impossible condition) a control rod block immediately occurs so that reactivity insertion by control rod withdrawal cannot occur. BFN 3.1/4.1-16 Unit 1
4.1 BASES The minimum functional testing frequency used in this specification is based on a reliability analysis using the concepts developed in reference (1). This concept was specifically adapted to the one-out-of-two taken twice logic of the reactor protection system. The analysis shows that the sensors are primarily responsible for the reliability of the reactor protection system. This analysis makes use of " unsafe failure" rate experience at conventional and nuclear power plants in a reliability model for the system. An " unsafe failure" is defined as one which negates channel operability and which, due to its nature, is revealed only when the channel is functionally tested or attempts to respond to a real signal. Failure such as blown fuses, ruptured bourdon tubes, faulted amplifiers, faulted cables, etc., which result in " upscale" or "downscale" l readings on the reactor instrumentation are " safe" and will be easily l recognized by the operators during operation because they are revealed by an alarm or a scram. Except for the APRMs which take credit for self-test capability, the l channels listed in Tables 4.1.A and 4.1.B are divided into three groups for functional testing. These are: A. On-Otf sensors that provide a scram trip function. B. Analog atvices coupled with bistable trips that provide a scram function. C. Devices which only serve a useful function during some restricted l node of operation, such as STARTUP or SHUTDOWN, or for which the l only practica.1 test is one that can be performed at shutdown. l
- The sensors that make up group (A) are specifically selected from among i
the whole family of industrial on-off sensors that have earned an excellent reputatica for reliable operation. During design, a goal of 0.99999 probability of success (at the 50 percent confidence level) was adopted to assure that a balanced and adequate design is achieved. The l probability of succeOs is primarily a function of the sensor failure rate and the test interval. A three-month test interval was planned for group (A) sensors. This is in keeping with good operating practices, and satisfies the design goal for the logic configuration utilized in the Reactor Protection System. To satisfy the long-term objective of maintaining an adequate level of safety throughout the plant lifetime, a minimum goal of 0.9999 at the 95 percent confidence level is proposed. With the (1-out-of-2) X (2) logic, this requires that each sensor have an availability of 0.993 at the 95 i percent confidence level. This level of availability may be maintained by I adjusting the test interval as a function of the observed failure history.1
- 1. Reliability of Engineered Safety Features as a Punction of Testing Frequency, I. M. Jacobs, " Nuclear Safety," Vol. 9, No. 4, July-August, 1968, pp. 310-312.
BFN 3.1/4.1-17 Unit 1 I l
.. J
l 4.1 BASES (Cont'd) 4 Group (C) devices are active only during a given portion of the operational cycle. For example, the IRM is active during STARTUP and inactive during full-power operation. Thus, the only test that is j meaningful is the one performed just prior to SHUTDOWN or STARTUP: 1.e., i the tests that are performed just prior to use of the instrument. Calibration frequency of the instrument channel is divided into two groups. These are as follows: ! 1. Passive type indicating devices that can be compared with like units on a continuous basis.
- 2. Vacuum tube or semiconductor devices and detectors that drift or lose sensitivity.
Experience with passive type instruments in generating stations and I substations indicates that the specified calibrations are adequate. For those devices which employ amplifiers, etc., drift specifications call for drift to be less than 0.4 percent / month; i.e., in the period of a month a drift of 4 percent would occur and thus providing for adequate margin. For the APRM system drift of electronic apparatus is not the only consideration in determining a calibration frequency. Change in power distribution and loss of chamber sensitivity dictate a calibration every seven days. Calibration on this frequency assures plant operation at or below thermal limits. A comparison of Tables 4.1.A and 4.1.B indicates that two instrument channels have been included in the latter table. These are: mode switch in SHUTDOWN and manual scram. All of the devices or sensors associated with these scram functions are simple on-off switches and, hence, calibration during operation is not applicable, i.e., the switch is either on or off. The APRM and 2-out-of-4 voter channel hardware is provided with a self-test capability which automatically checks most of the critical hardware at least once per 15 minute interval whenever the APRM channel is in the operate mode. This provides a virtually continuous monitoring of the essential APRM trip functions. In the event a critical fault is detected, an " inoperative" trip signal results. A fault detected in non-critical hardware results in an " inoperative" alarm. Following receipt of an " inoperative" trip or alarm signal, the operator can employ numerous diagnostic testing options to locate the problem. The automatic self-test function is supplemented with a manual APRM trip functional test, including the 2-out-of-4 voter channels and the interface with the RPS trip systems. In combination with the virtually continuous self-testing, the manual APRM trip functional test provides adequate functional testing of the APRM trip function. Therefore, the six-month j test frequency for the manual testing provides an acceptable level of availability of the APRM. I BFN 3.1/4.1-19 Unit 1
4.1 BASES (Cont'd) In addition to the above tests, the 2-out-of-4 voter is used to test the RPS scram contactors. The output of each voter channel is tripped to produce a scram signal into each of the RPS trip system channels (A1, A2, B1 and B2) to individually operate the respective scram contactors. The weekly test interval provides an acceptable level of availability of the scram contactors. Each APRM receives the output signals from two analog differential pressure flow transducers, one associated with recirculation loop A and the other with recirculation loop B. These differential pressure signals are converted into' representative digital loop flow signals within the same hardware that performs the APRM functions and are added to determine a total recirculation flow. The total recirculation flow value is used by the APRM to determine the flow biased setpoints. Each total recirculation flow signal developed by an APRM is compared in the hardware that performs the RBM functions to the signals from the remaining three APRMs. An alarm is given if a preset compare level setpoint it exceeded. The flow processing is integrated with the APRM processing and is covered by the same self-test and alarm functions described earlier. As a result of the virtually continuous monitoring of the equipment performing the flow processing, and the automatic comparison of redundant flow signals, it is acceptable to calibrate this equipment once per operating cycle. The sensitivity of LPRM detectors decreases with exposure to neutron flux at a slow and approximately constant rate. The APRM system, which uses the LPRM readings to detect a change in thermal power, will be calibrated every seven days using a heat balance to compensate for this change in sensitivity. The RBM system uses the LPRM reading to detect a localized change in thermal power. It applies a correction factor based on the APRM output signal to determine the percent thermal power and therefore any change in LPRM sensitivity is compensated for by the APRM calibration. The technical specification limits of CPR and APLIIGR are determined by the l use of the process computer or other backup methods. These methods use LPRM readings and TIP data to determine the power distribution. Compensation in the process computer for changes in LPRM sensitivity will be made by performing a full core TIP traverse to update the computer calculated LPRM correction factors every 1000 effective full power hours. As a minimum the individual LPRM meter readings will be adjusted at the beginning of each operating cycle before reaching 100 percent power. BPN 3.1/4.1-20 Unit 1
1.1/2.1 FUEL CT. ADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 2.1.A Neutron Flur Trio Settinas 2.1.A.1.a (Cont'd) S1(0.66W + 71%) l + where: S = Setting in ' percent of rated I thermal power (3293 MWt) W = Loop recirculation flow rate in percent of rated
- b. For no combination of loop recirculation flow rate and core thermal power shall the APRM flux scram trip setting be a116wed to exceed 120% of rated thermal power.
BFN 1.1/2.1-2 Unit 1
)
_3
- 7. -
1.1/2.1 FUEL CLADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY S? STEM SETTING 2.1.A Neutron Flu.t Trio Settinna 2.1.A.1.b (Cont'd) 5.QIg: These settings assume operation within the basic thermal hydraulic design criteria. These criteria are LHGR within the limits of Specification 3.5.J and MCPR_ , within the limits of Specification 3.5.K. If it is determined that either of these design criterie is being violated during operation, action shall be initiated within 15 minutes to restore operation within prescribed limits.
- c. The APRM Rod Block trip setting shall be less than .
or equal to the limit specified in the CORE OPERATING LIMITS REPORT. BFN 1.1/2.1-3 Unit 1 (
t I 130 <
, f . . . . . . I . , ,
. . g g 120 . .
.A P RM. Fl o.w l
. . . B.. las . S c. .ram ..... . . . . . . , ,
110
............................s..
.....,..,.........,.....,,.u...,..
100 _ ., , , ,
...........a..... . . . ,
..a............
m
.e...., . . . ., . . ,. .
V , 3.. .. . . .. ..g..... . . , , . . . , . . . , . . . , . . ,. , , e . . 9..,. 7.7...p..,..... . , . , . .
.c3 90 _. .. . .........
t . , , , g , O' _ .. . . .. . . ., . . . . . , . . ...,. 0 80 _ .. . g . .
....a..
..................1
- g. , - . . . . , . . . . . . . . . .. . . .. . . .. . . .. .
q3 70 , 3
..........r... ,...,...,...
O . Q. C 60 _ . .l ... l Desi9n. F. low Control Line o g ...... .. ....... y , , . . s , . . e 3 50 . ,. . . . . ,
..a..a,.
gg . ....,.. ,
. , . . s, . . u... . . u . . ,w . . ,.. . . , . . . . . . . . . a. . . a. . . a, . . .r,. ... .. ,.
. . . . ,u . . .
..r...,...c........
q3 . . . . . .
...,l..,1..,,..,,.. ,
40 . ..,.. y , , . . . . . .
,NaturaLC.,,rnulatino. . ., . .
o . O _ . . . . .. . . .. . . . . . .....x. ........ . . , . . . . . . . 30 .. . . , . . , . . . ......... .
- : : : : : : : : 20% Pump: Speed Line . . . . . . . . . . . . . . .
.. . . . .. . . . .. . . . . . s. . . ..a..
- r. . . . . .. . '. . .. , . . . , . . . , . . . , . . . . . . . .. . . . . . . . . :. . . :. . . ..: . . . :, . . .
20 _ . , , . . . . , . . , . , ... ..,. .
..., . . . , . . . , . . . , . . . , . . , .. . , .. . , .. . ,... ..r..,...,....
... ..................a...a,...,...,..,...,.....,...,.
--.......a,..
10 _.4 . . .. . . . .. . . . . . . , . , .. . . , . . .. , .... . 0
. . t . , . . '
t . .
............................6
.................................t t . , ,
0 _ . . . 0 10 20 30 40 50 60 70 80 90 100 110 120 Core Coolant Flow Rate (% of Design) APRM Flow Bias Scram vs. Reactor Core Flow Fig. 2.1-2 BFN 1.1/2.1-7 Unit 1 .'
2.1 BASES (Cont'd) l !. 5. Maximum Extended Load Line Limit and ARTS. Improvement Program Analyses I for Browns Ferry Nuclear Plant Unit 1, 2 and 3, NEDC-32433P. l 1 e i f e r n t I 1 6 i BFN 1.1/2.1-17 Unit 1
TABLE 3.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION REQUIREMENTS E$ r :a Min. No. of Operable
" Modes in Which Function Instr.
- Channels Must Be Operable Per Trip Shut- Startup/
Svstem (11f231 Trio Function Trio Level Settina sism!1 Refuel (71 Hot Standbv Egg Action fil 1 Mode Switch in X X X X 1.A , Shutdown ! 1 Manual Scram X X X X 1.A 1 l IRM (16) 3 High Flux 1120/125 Indicated X(22) X(21)(22) X (5) 1.A l on scale l 3 Inoperable X X (5) 1.A APRM (16)(24)(25) 3(11) High Flux (Flow Biased) See Spec. 2.1.A.1 X 1.A or 1.8 or 1.E g 3(11) High Flux
. (Fixed Trip) i 120% X 1.A or 1.B or 1.E q 3(11) High Flux i 15% rated power X(17) (15) 1.A or 1.E o 3(11) Inoperative (13) X(17) X 1.A or 1.E 2 2/4 Trip Voter (12) X X 1.A or 1.F w 2 High Reactor Pressure i 1055 psig X(10) X X 1.A 2 High Drywell Pressure (14) i 2.5 psig X(8) X(8) X 1.A 2 Reactor Low Water Level (14) 1 538" above X X X 1.A vessel zero f - _ _ - _____ _- _ __ -)
ROTES FOR TABLE 3.1.A
- 1. There shall be two operable or tripped trip systems for each function.
If the minimuni M sber of operable instrument channels per trip system cannot be met for one trip system, trip the inoperable channels or entire trip system within one hour, or, alternatively, take the below listed action for that trip function. If the minimum number of operable instrument channels cannot be met by either trip system, the appropriate action listed below (refer to right-hand column of Table) shall be taken. An inoperable channel need not be placed in the tripped condition where this would cause the trip function to occur. In these cases, the ; inoperable channel shall be restored to operable status within two hours, ; or take the action listed below for that trip function. { A. Initiate insertion of operable rods and complete insertion of all 1 operable rods within four hours. In refueling mode, suspend all l operations involving core alterations and fully insert all operable control rods within one hour. l I ! B. Reduce power level to 7RM range and place mode switch in the , l STARTUP/ HOT Standby position within 8 hours. C. Reduce turbine load and close main steam line isolation valves within , 8 hours. l D. Reduce power to less than 30 percent of rated. j i E. For the APRM functions only, if only two APRM channels are OPERABLE, I restore a third APRM channel to OPERABLE status or trip one of the i inoperable APRM channels within 6 hours. If only one APRM channel is l OPERABLE, trip one inoperable APRM channel immediately and restore an inoperable APRM channel to OPERABLE status or initiate alternative action within 2 hours. F. For the APRM functions only, if one voter channel is inoperable in one trip system, restore the voter channel to OPERABLE status or trip the inoperable-channel or the entire trip system within 12 hours. If one voter channel is inoperable in both trip systems, restore the j inoperable voter channels to OPERABLE status or initiate alternative ! 1 action within 6 hours.
- 2. Scram discharge volume high bypass may be used in shutdown or refuel to bypass scram discharge volume scram with control rod block for reactor protection system reset.
- 3. Bypassed if reactor pressure is less than 1055 psig and mode switch not in RUN.
- 4. Bypassed when turbine first stage pressure is less than 154 psig.
- 5. IRMs are bypassed when APRMs are onseale and the reactor mode switch'is in the RUN position.
BFN 3.1/4.1-5 Unit 1 J
. -- . - - ~
NOTES FOR TABLE 3.1.A (Cont'd)
- 6. The design permits closure of any two lines without a scram being
-initiated.
- 7. When the reactor is suberitical and the reactor water temperature is less than 2120 F, only the following trip functions need to be operable:
A. Mode switch in shutdown B. Manual scram C. High flux IRM D. Scram discharge volume high level E. (Deleted) d
- 8. Not required to be OPERABLE when primary containment integrity is not required.
- 9. (Deleted)
- 10. Not required to be OPERABLE when the reactor pressure vessel head is not bolted to the vessel.
- 11. The same three (3) required APRM channels are shared by both RPS trip systems.
- 12. Any combination of APRM upscale or inoperative trips from two different (non-bypassed) APRMs will trip all of the 2/4 voter units.
- 13. Less than the required minimum number of OPERABLE LPRMs will cause an instrument channel inoperative alarm.
- 14. Channel shared by Reactor Protection System and Primary Containment and Reactor Vessel Isolation Control System. A channel failure may be a channel failure in each system.
- 15. The APRM 15 percent scram is bypassed in the RUN Mode.
- 16. Channel shared by Reactor Protection System and Reactor Manual Control System (Rod Block Portion). A channel failure may be a channel failure in each system. If a channel is allowed to be inoperable per Table 3.1.A, the corresponding function in that same channel may be inoperable in the Reactor Manual Control System (Rod Block).
- 17. Not required while performing low power physics tests at atmospheric pressure during or after refueling at power levels not to exceed 5 MW(t).
- 18. This function must inhibit the automatic bypassing of turbine control valve fast closure or turbine trip scram and turbine stop valve closure scram whenever turbine first state pressure is greater than or equal to 154 psig.
BFN 3.1/4.1-6 Unit 1 \- _ tu
NOTES FOR TABLE 3.1.A (Cont'd) 19 . - Action 1.A or 1.D shall be taken only if the permissive fails in such a manner to prevent the affected RPS logic from performing its intended function. Otherwise, no action is required.
- 20. (Deleted)
- 21. In the REFUEL Mode unless adequate shutdown margin has been demonstrated '
per Specification 3.3.A.1, whenever any control rod is withdrawn from a core cell containing one or more fuel assemblies, shorting links shall be removed from the RPS circuitry to' enable the Source Range Monitor (SRM) noncoincidence high-flux scram function. The SRMs shall be OPERABLE per Specification 3.10.B.1. The removal of eight (8) shorting links is required to provide noncoincidence high-flux scram protection from the SRMs. l
- 22. The three required IRMs per trip channel is not required in the Shutdown or Refuel Modes if at least four IRMs (one in each core quadrant) are connected to give a noncoincidence, High Flux scram. The removal of four (4) shorting links is required to provide noncoincidence high-flux scram j protection from the IRMs.
- 23. A channel may be placed in an inoperable status for up to 4 hours for required surveillance without placing the trip system in the tripped l condition provided at least one OPERABLE channel in the same trip system '
is monitoring that parameter.
- 24. The Average Power Range Monite* scram function is, varied (Reference Figure 2.1-1) as a function of recirculation loop flow (W). The trip setting of this function must be maintained in accordance with 2.1.A.
- 25. The APRM flow-biased neutron flux signal is fed through a time constant circuit of approximately 6 seconds. This time constant may be lowered or equivalently removed (no time delay) without affecting the operability of the flow-biased neutron flux trip channels. The APRM fixed high neutron flux signal does not incorporate the time constant but responds directly to instantaneous neutron flux.
BFN 3.1/4.1-7 Unit 1 N .._
I TABLE 4.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION FUNCTIONAL TESTS p5 MINIPRJM FUNCTIONAL TEST FREQUENCIES FOR SAFETY INSTR. AND CONTROL CIRCUITS r2
" Group (2) Functional Test Minimum Frecuenevf31 Mode Switch in Shutdown A Place Mode Switch in Shutdown Each Refueling Outage Manual Scram A Trip Channel and Alarm Every 3 Months IRM High Flux C Trip Channel and Alann (4) OnceNeek During Refueling and Before Each Startup Inoperative C Trip Channel and Alarm (4) OnceNeek During Refueling and Before Each Startup APRM High Flux (15% Scram) Trip Output Relays (4)(5) Every 6 Months (9) 2/4 Voter Logic (10) Each Refueling Outage High Flux (Flow Biased) Trip Output Relays (4)(6) Every 6 Months w
2/4 Voter Logic (10) Each Refueling Outage E High Flux (Fixed Trip) Trip Output Relays (4)(5) Every 6 Months 2/4 Voter Logic (10) Each Refueling Outage
$ Inoperative Trip Output Relays (4)(5) Every 6 Months 2/4 Voter Logic (10) Each Refueling Outage
-1 2/4 Trip Voter Trip Scram Contactors (11) Once/ Week l
High Reactor Pressure A Trip Channel and Alarm Once/ Month (1) High Drywell Pressure A Trip Channel and Alarm Once/ Month (1) ( Reactor Low Water Level A Trip Channel and Alarm Once/ Month (1) l l l l l _ _ _ _ _ _. . _ . - . _ . ~ _ , . . _ . . . _ . . .. _ __ j
3 NOTES FOR TABLE 4.1.A
- 1. Initially the minimum frequency for the indicated tests shall be once per month.
- 2. A description of the three groups is included in the Bases of this specification.
- 3. Functional tests are not required when the systems are not required to be operable or are operating (i.e., already tripped). If tests are missed, they shall be performed prior to returning the systems to an operable status.
- 4. This instrumentation is exempted from the instrument channel test definition. This instrument channel functional test will consist of injecting a simulated electrical signal into the measurement channels.
- 5. The channel functional test shall include both the APRM channels and the 2/4 voter channels.
- 6. The channel functional test shall include both the APRM channels and the 2/4 voter channels plus the flow input function, excluding the flow transmitters.
- 7. Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify operability of the trip end alarm functions.
- 8. The functional test frequency decreased to once/3 months to reduce challenges to relief valves per NUREG 0737, Item II.K.3.16.
- 9. Not required to be performed when entering the STARTUP/ HOT STANDBY Mode from RUN Mode until 12 hours after entering the STARTUP/ HOT STANDBY Mode.
- 10. Functional test consists of simulating APRM trip conditions at the APRM channel outputs to check all combinations of two tripped inputs to the 2/4 voter logic in each voter channel.
- 11. Functional test consists of manually tripping the 2/4 voter trip output, one voter channel at a time, to demonstrate that each scram contactor for each RPS trip system channel (Al, A2, B1 and B2) operates and produces a half-scram.
I BFN 3.1/4.1-10 l Unit 1
r , 4.5 BASES (Cont'd) of the core and containment cooling system, the components which make , up the system, i.e., instrumentation, pumps, valves, etc., are tested > frequently. The pumps and motor operated injection valves are also tested in accordance with Specification 1.0.MM to assure their OPERABILITY. A simulated automatic actuation test once each cycle l combined with testing of the pumps and injection valves in accordance t with Specification 1.0.MM is deemed to be adequate testing of these systems. Monthly alignment checks of valves that are not locked or sealed in position which affect the ability of the systems to perform their intended safety function are also verified to be in the proper position. Valves which automatically reposition themselves on an initiation signal are permitted to be in a position other than normal to facilitate other operational modes of the system. When components and subsystems are out-of-service, overall core and containment cooling reliability is maintained by OPERABILITY of the remaining redundant equipment. Whenever a CSCS system or loop is made inoperable, the other CSCS systems or loops that are required to be OPERABLE shall be considered OPERABLE if they are within the required surveillance testing frequency and there is no reason to suspect they are inoperable. If the function, system, or loop under test or calibration is found inoperable or exceeds the trip level setting, the LCO and the required surveillance testing for the system or loop shall apply. Averare Planar LHGR. LHGR. and MCPR The APLHGR, LHGR, and MCPR shall be checked dally to determine if fuel burnup, or control rod movement has caused changes in power distribution. Since changes due to burnup are s.'.ow, and only a few control rods are moved daily, a daily check of power distribution is adequate. l l I I t i BFN Unit 2 3.5/4.5-34l i i
THIS PAGE INTENTIONALLY LEFT BLANK l r I 1 BFN 3.5/4.5-35 Unit 2 l
i 6.9.1.6 SOURCE TESTS Results of required leak tests performed on sources if the tests reveal the presence of 0.005 microcurie or more of removable contamination. 6.9.1.7 CORE OPERATING LIMITS REPORT
- a. Core operating limits shall be established and shall be documented in the CORE OPERATING LIMITS REPORT prior to each operating cycle, or prior to any remaining portion of an l
operating cycle, for the following: l l (1) The rated APLHGR limit; the Flow Dependent APLHGR Factor, MAPTAC(F); and the Power Dependent APLHGR Factor, MAPFAC(P) for Specification 3.5.I. (2) The LHGR limit for Specification 3.5.J l (3) The rated MCPR Operating Limit; the Flow Dependent MCPR Operating Limit, MCPR(F); and the Power Dependent MCPR Operating Limit, MCPR(P) for Specification 3.5.K/4.5.K. (4) The APRM flow biased rod block trip setting for Specification 2.1.A.1.c and Table 3.2.C. (5) The RBM downscale trip setpoint, high power trip setpoint, intermediate power trip setpoint, low power trip setpoint, and applicable reactor thermal power ranges for each of the setpoints for Table 3.2.C. BFN 6.0-26a Unit 2
7 < I F 6.9.1.7 CORE OPERATING LIMITS REPORT (Continued) !
- b. The analytical methods used to determine the core operating I limits shall be those pteviously reviewed and approved by <
"~ the NBC, specifically those described in General Electric ; Licensing Topical Report NEDE-240ll-P-A, " General Electric s Standard Application for Reactor Fuel" (latest approved version).
- c. The core operating limits shall be determined such that all applicable limits (e.g., fuel thermal-mechanical limits,-
core thermal-hydraulic limits, ECCS limits, nuclear limits i such as shutdown margin limits, transient analysis limits, and accident analysis limits) of the safety analysis are met.
- d. The CORE OPERATING LIMITS REPORT, including any midcycle revisions or supplements, shall be provided upon issuance' j for each reload cycle to the NRC. -
6.9.1.8 THE ANNUAL RADI0 ACTIVE EFFLUENT RELEASE REPORT The Annual Radioactive Effluent Release Report covering the ' operation of the unit during the previous calendar year of operation shall be submitted by April 1, of each year. The report shall include summaries of the quantities of radioactive liquid and gaseous effluents and solid waste released from the unit. A single submittal may be made for a multi-unit station. The submittal should combine those sections that are common to all units at the station; however, for units with separate radwaste systems, the submittal shall specify the releases'of I radioactive material from each unit. The material provided f i shall be (1) consistent with the objectives outlined in the ODCM and PCP and (2) in conformance with 10 CFR 50.36a and Section IV.B.1 of Appendix I to 10 CFR Part 50. i BFN Unit 2 6.0-26bl a
s
- 1. 0 . . DEFINITIONS (Cont'd) -
Q. Oneratina Cvele - Interval between the end of one refueling outage for.a particular unit and the end of the next subsequent refueling outage for the same unit. R. 'Refuelina Outare - Refueling outage is the period of time between the shutdown of the unit prior to a refueling and the startup of the unit after that refueling. For the purpose of designating frequency
~
of testing and surveillance, a refueling outage shall mean a regularly scheduled outage; however, where such outages occur within 8 months of the completion of the previous refueling outage, the required surveillance testing need not be-performed until the next regularly scheduled outage. S. CORE ALTERATION - CORE ALTERATION shall be the movement of any fuel, sources, reactivity control components, or other components affecting reactivity within the reactor vessel with the vessel head removed and fuel in the vessel. Movement of source range monitors, intermediate range monitors, traversing in-core probes, or special movable detectors (including undervessel replacement) is not considered a CORE ALTERATION. Suspension of CORE ALTERATIONS shall not preclude completion of movement of a component to a safe location. i T. Reactor Vessel Pressure - Unless otherwise indicated, reactor vessel. pressures listed in the Technical Specifications are those measured by the reactor vessel steam space detectors.
- U. Thermal Parameters
- 1. Minimum Critical Power Ratio (MCPR) - Minimum Critical Power ,
Ratio (MCPR) is the value of the critical power ratio associated i with the most limiting assembly in the reactor core. Critical l Power Ratio (CPR) is the ratio of that power in a fuel assembly, s which is calculated to cause some point in the assembly to l experience boiling transition, to the actual assembly operating ! power. ;
- 2. Transition Boilina - Transition boiling means.the boiling regime between nucleate and film boiling. Transition boiling is the j regime in which both nucleate and film boiling occur ;
intermittently with neither type being completely stable. t
- 3. (Deleted) ]
- 4. Averare Planar Linear Heat Generation Rate (APLHCR) - The l Average Planar Heat Generation Rate is applicable to a specific )'
planar height and is equal to the sum of the-linear heat generation rates for all the fuel rods in the specified bundle at the specified height divided by the number of fuel rods-in i the fuel bundle. i BFN 1.0-7 Unit 3 i L J
1.0 DEFINITIONS (Cont'd) ! V. Instrumentation ;
- 1. Instrument Calibration - An instrument calibration means the adjustment of an instrument signal output so that it ;
corresponds,.within acceptable range, and accuracy, to a known value(s) of the parameter which the instrument monitors.
- 2. Channel - A channel is an arrangement of the sensor (s) and associated components used to evaluate plant variables and l produce discrete outputs used in logic. A channel terminates ;
and loses its identity where individual channel outputs are ' combined in logic.
- 3. Instrument Functional Test - An instrument functional test means the injection of a simulated signal into the instrument primary l sensor to verify the proper instrument channel response, alarm ,
and/or initiating action.
- 4. Instrument Check - An instrument check is qualitative determination of acceptable OPERABILITY by observation of '
instrument behavior during operation. This determination'shall include, where possible, comparison of the instrument with other :
. independent instruments measuring the same variable.
I
- 5. Loric System Functional Test - A logic system functional test means a test of all relays and contacts of a logic circuit to ,
insure all components are OPERABLE per design intent. Where I practicable, action will go to completion; i.e., pumps will be ! started and valves operated. l
- 6. Trio System - A trip system means an arrangement of instrument channel trip signals and auxiliary equipment required to ,
initiate action to accomplish a protective trip function. A trip system may require one or more instrument channel trip , signals related to one or more plant parameters in order to ; initiate trip system action. Initiation of protective action . may require the tripping of a single trip system or the > coincident tripping of two trip systems. ,
- 7. Protective Action - An action initiated by the protection system when a limit is reached. A protective action can be at a l channel or system level.
l l
- 8. Protective Function - A system protective action which results '
from the protective action of the channels monitoring a particular plant condition. l c I t BFN 1.0-8 l Unit 3 1 _.- . . = - -
1.1/2.1 FUEL CLADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 2.1.A Neutron llux Trio Settinna 2.1.A.I.a (Cont'd) S1(0.66W + 71%) where: i S = Setting in percent of rated thermal , power (3293 MWt) W = Loop recirculation flow rate in percent of rated
- b. For no ,
combination of , loop recirculation flow rate and j core thermal power shall the APRM flux scram , trip setting be allowed to exceed 120% of rated thermal power. t i 8 i BFN 1.1/2.1-2 Unit 3
7 i 1.1/2.1 FUEL Cf. ADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING , i 2.1.A Neutron Flur Trio Settinum 2.1.A.1.b. (Cont'd) 59 3 : These settings assume I operation within the basic thermal hydraulic design : criteria. These criteria are LHGR within the limits of Specification 3.5.J.and MCPR 1 within the limits of ! Specification 3.5.K. If it is : determined that either of these : design criteria is being violated during operation, action shall be initiated within 15 minutes to restore operation within the prescribed limits. .
- c. The APRM Rod Bloch trip setting shall be less than or equal to the limit ,
specified in the CORE ; OPERATING LIMITS REPORT.. l t 3 f BFN 1.1/2.1-3 Unit 3
r I 130
. , . . . . . 4 . . , .
120 . . .
- .A PRM. Flo. .w. .Bia. s. . Sc.ram 110 _ .. ' * '
. , , i . . . e , , , , ,
e
,' ....i...,. . .....,'. ..
.'. - 1,. 4...'...'.... .
.. ..g..,..,....
, . . . ..,..}*..
i i p.. ..........e..e_.. t
. . . . e....,... -
100 _.*...,..e g i e . . . . . i , . .
.....J... ...s..s..... ..,....e..*...,...._4...a......,..-
.s
. . . i g t t . . . . .
.g..,...,,...,...,.. , . . ,.. .. 7...p...g... ,
. . . , . . . . . ,... .. ..y..
*T'8
, . . l g . .
90 _. ....._..... ... e
. . s . .
M . e . . g . g,. g
........e.... .
0 80 - . . .... ..... .. ....
, e O
t . . . . o 70 _ .......,..... . . . , ., .. . ...i.... . ... .
. E , ,
3
..c... . . , . . . , . . . .
O _. .. . ......... ( g , . . Q. , . 60 _ .. . ' .. . .. . ... ... Design F. low Gontrol Line ,. , , C . , , .
,O ...... .......... . . . .
i . . . , , 3 50 o . _. . . . . 2
. . . . ......s...a..
..,..u,..,....,s..,....,...,....,...s,..s..4...t...u..,u..,.
g .
. . . . . . r , . . . , . . .
u 40 _ ..... , , , , . . . . . . . . . O , . . ......,..... , , ..,. .......
, ..NaturaLCJmulatm.o . . .,.. . . . . , . . . . . . . .. . . . , , , .
o . . _ .. , . . .., . . .. .. .. . . . . . . ..x.-. 30 20% Pump: Speed Line ; : :
. ,...,...,..a... . .
. . a. _ s. . . ...................................u... . . . . . . . . . . . .. . .
20 1 10 _ . , . . . . , . . ... ,. . . ., , .. ,.. . , .. . , . . . , ...._y..., . . , . . , . . .. .. _.,. , , 0 . . 0 10 20 30 40 50 60 70 80 ' 5 90 100 110 120 t Core Coolant Flow Rate (% of Design) { APRM Flow Bias Scram vs. Reactor Core Flow : i Fig. 2.1-2 ! BFN 1.1/2.1-7 Unit 3
2.1 BASES (Cont'd) F. (Deleted) G. & H. Main Steam Line Isolation on Low Pressure and Main Steam Line Isolation Scram The low pressure isolation of the main steam lines at 850 psig was provided to protect against rapid reactor depressurization and the resulting rapid cooldown of the vessel. The scram feature that occurs when the main steam line isolation valves close shuts down the reactor so that high power operation at low reactor pressure does not occur, thus providing protection for the fuel cladding integrity SAFETY LIMIT. Operation of the reactor at pressures lower than 850 psig requires that the reactor mode switch be in the startup position, where protection of the fuel cladding integrity SAFETY LIMIT is provided by the IRM and APRM high neutron flux scrams. Thus, the combination of main steam line low pressure isolation and isolation valve closure scram assures the availability of neutron flux scram protection over the entire range of applicability of the fuel cladding integrity SAFETY LIMIT. In addit!.on, the isolation valve closure scram anticipates the pressure and flux cransients that occur during normal or inadvertent isolation valve closure. With the scrams set at 10 percent of valve closure, neutron flux does not increase. I.J.& K. Reactor Lov Water Level Setooint for Initiation of HPCI and RCIC Closinz Main Steam Isolation Valves. and Startina LPCI and Core Sorav Pumos. These systems maintain adequate coolant inventory and provide core cooling with the objective of preventing excessive clad temperatures. The design of these systems to adequately perform the intended function is based on the specified low level scram setpoint and initiation setpoints. Transient analyses reported in Section 14 of the FSAR demonstrate that these conditions result in adequate safety margins for both the fuel and the system pressure. L. References
- 1. Supplemental Reload Licensing Report of Browns Ferry Nuclear i Plant, Unit 3 (applicable cycle-specific document).
4
- 2. GE Standard Application for Reactor Fuel, NEDE-24011-P-A and NEDE-240ll-P-A-US (latest approved version).
- 3. Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Browns Ferry Nuclear Plant Unit 1, 2 and 3, NEDC-32433P. i l
BFN 1.1/2.1-16 Unit 3
- z. .
1 TA8LE 3.1.A REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION REQUIREMENTS c in Min. No. of E@ et Operable Instr. Modes in Which Function w Channels Must Be Operable Per Trip Shut- Startup/ Svstem (11f231 Trio Function Trio level Settina h Refuel (71 Hot Standbv Re Action fil 1 Mode Switch in X X X X 1.A Shutdowrt 1 Manual Scram X X X X 1.A IRM (16) i 3 High Flux 1120/125 Indicated X(22) X(21)(22) X (5) 1.A l on scale 3 Inoperative X X (5) 1.A APRM (16)(24)(25) 3(11) High Flux (Fixed Trip) i 120% X 1.A or 1.8 or 1.E 3(11) High Flux F (Flow Biased) See Spec. 2.1.A.1 X 1.A or 1.B or 1.E
- 3(11) High Flux i 15% rated power X(17) (15) 1.A or 1.E 2 3(11) Inoperative (13) X(17) X 1.A or 1.E 2 2/4 Trip Voter (12) X X 1.A or 1.F b 2 High Reactor Pressure i 1055 psig X(10) X X 1.A 2 High Drywell Pressure (14) 1 2.5 psig X(8) X(8) X 1.A 2 Reactor Low Water Level (14) 1 538" above X X X 1.A vessel zero L -- . - ,, . . -. . ., . . . . ._- . _ _ - , - . . - . - .-. . . . . . _ - . . . . -
NOTES FOR TABLE 3.1.A
- 1. There shall be two OPERABLE or tripped trip systems for each function.
If the minimum number of OPERABLE instrument channels per trip system cannot be met for one trip system, trip the INOPERABLE channels or entire trip system within one hour, or, alternatively, take the below listed action for that trip function. If the minimum number of OPERABLE instrument channels cannot be met by either trip system, the appropriate action listed below (refer to right-hand column of Table) shall be taken. An INOPERABLE channel need not be placed in the tripped condition where this would cause the trip function to occur. In these cases, the INOPERABLE channel shall be restored to OPERABLE status within two hours, or take the action listed below for that trip function. A. Initiate insertion of OPERABLE rods and complete insertion of all OPERABLE rods within four hours. In refueling mode, suspend all operations involving core alterations and fully insert all OPERABLE control rods within one hour. B. Reduce power level to IRM range and place mode switch in the STARTUP/ HOT STANDBY position within 8 hours. C. Reduce turbine load and close main steam line isolation valves within 8 hours. D. Reduce power to less than 30 percent of rated. E. For the APRM functions only, if only two APRM channels are OPERABLE, restore a third APRM channel to OPERABLE status or trip one of the. inoperable APRM channels within 6 hours. If only one APRM channel is OPERABLE, trip one inoperable APRM channel immediately and restore an inoperable APRM channel to OPERABLE status or initiate alternative action within 2 hours. F. For the APRM functions only, if one voter channel is inoperable in one trip system, restore the voter channel to OPERABLE status or trip the inoperable channel or the entire trip system within 12 hours. If one voter channel is inoperable in both trip systems, restore the inoperable voter channels to OPERABLE status or initiate alternative action within 6 hours.
- 2. Scram discharge volume high bypass may be used in shutdown or refuel to bypass scram discharge volume scram with control rod block for reactor protection system reset.
- 3. DELETED 4 Bypassed when turbine first stage pressure is less than 154 psig.
- 5. IRMs are bypassed when APRMs are onscale and the reactor mode switch is in the RUN position.
BFN 3.1/4.1-4 Unit 3
v NOTES FOR TABLE 3.1.A (Cont'd)
- 6. The design permits closure of any two lines without a scram being I initiated.
- 7. When the reactor is suberitical and the reactor water temperature is less than 2120 F, only the following trip functions need to be OPERABLE:
A. Mode switch in shutdown B. Manual scram C. High flux IRM D. Scram discharge volume high level ; E. (Deleted) q
- 8. Not required to be OPERABLE when primary containment integrity is not required.
- 9. (Deleted) ,
- 10. Not required to be OPERABLE when the reactor pressure vessel head is not bolted to the vessel.
- 11. The same three (3) required APRM channels are shared by both RPS trip systems.
- 12. Any combination of APRM upscale or inoperative trips from two different (non-bypassed) APRMs will trip all of the 2/4 voter units.
- 13. Less than the required minimum number of OPERABLE LPRMs will cause an instrument channel inoperative alarm.
- 14. Channel shared by Reactor Protection System and Primary Containment and Reactor Vessel Isolation Control System. A channel failure may be a channel failure in each system.
- 15. The APRM 15 percent scram is bypassed in the RUN Mode.
- 16. Channel shared by Reactor Protection System and Reactor Manual Control System (Rod Block Portion). A channel failure may be a channel failure in each system. If a channel is allowed to be inoperable per Table 3.1.A, the corresponding function in that same channel may be inoperable in the Reactor Manual Control System (Rod Block).
- 17. Not required while performing low power physics tests at atmospheric pressure during or after refueling at power levels not to exceed 5 MWt.
BFN 3.1/4.1-5 Unit 3
=- ,
I NOTES FOR TABLE 3.1.A (Cont'd)
- 18. This function must inhibit the automatic bypassing of turbine control valve. fast closure or turbine trip scram and turbine stop valve closure scram whenever turbine first stage pressure is greater than or equal to 154 psig. !
- 19. Action 1.A or 1.D shall be taken only if the permissive fails in such a manner to prevent the_affected RPS logic from performins its intended.
function. Otherwise, no action is required.
- 20. (Deleted)
- 21. In the REFUEL Mode unless adequate shutdown margin has been demonstrated per Specification 3.3.A.1, whenever any control rod is withdrawn from a
, core cell containing one or more fuel assemblics, shorting links shall be ' removed from the RPS circuitry to enable the Source Range Monitor (SRM) noncoincidence high-flux scram function.. The SRMs shall be OPERABLE per Specification 3.10.B.1. The removal of eight (8) shorting links is required to provide noncoincidence high-flux scram protection from the ' SRMs. l
- 22. The three required IRMs per trip channel is not required in the SHUTDOWN or REFUEL Modes if at least four IRMs (one in each core quadrant) are i connected to give a noncoincidence, High Flux scram. The removal of four *
(4) shorting links is required to provide noncoincidence high-flux scram protection from the IRMs. .
- 23. A channel may be placed in an INOPERABLE status for up to 4 hours for required surveillance without placing the trip system in the tripped j condition provided at least one OPERABLE channel in the same trip system i is monitoring that parameter. '
- 24. The Average Power Range Monitor. scram function is varied (Reference i Figure 2.1-1) as a function of recirculation loop flow (W). The trip setting of this function must be maintained in accordance with 2.1.A.
j!
- 25. The APRM flow-biased neutron flux signal is fed through a time constant i circuit of approximately 6 seconds. This time constant may be lowered or i equivalently removed (no time delay) without affecting the operability of l the flow-biased neutron flux trip channels. The APRM fixed high neutron '
flux signal does not incorporate the time constant but responds directly to instantaneous neutron flux. i i i BFN 3.1/4.1-6
- Unit 3 i
TABLE 4.1.A
$$ REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION FUNCTIONAL TESTS pZ MINIMRt FUNCTIONAL TEST FREQUENCIES FOR SAFETY INSTR. AND CONTROL CIRCUITS w Group (2) Functional Test Minimum Frecuencvf3)
Mode Switch in Shutdown A Place Mode Switch in Shutdown Each Refueling Outage Manual Scram A Trip Channel and Alarm Every 3 Months IRM High Flux C Trip Channel and Alarm (4) Once Per Week During Refueling and Before Each Startup Inoperative C Trip Channel and Alarm (4) Once Per Week During Refueling and Before Each Startup APRM High Flux (15% Scram) Trip Output Relays (4)(5) Every 6 Months (9) 2/4 Voter Logic (10) Each Refueling Outage l Y High Flux (Flow Blased) Trip Cutput Relays (4)(6) Every 6 Months y 2/4 Voter Logic (10) Each Refueling Outage High Flux (Flued Trip) Trip Output Relays (4)(5) Every 6 Months f u 2/4 voter Logic (10) Each Refueling Outage Inoperative Trip Output Relays (4)(5) Every 6 Months 2/4 Voter Logic (10) Each Refueling Outage d 2/4 Trip Voter Trip Scram Contactors (11) OnceNeek g High Reactor Pressure A Trip Channel and Alarm Once/ Month (1) 1 High Drywell Pressure A Trip Channel and Alarm Once/ Month (1) Reactor Low Water Level A Trip Channel and Alarm Once/ Month (1) l l l l i
NOTES FOR TABLE 4.1.A
- 1. Initially the minimum frequency for the indicated tests shall be once per month.
- 2. A description of the three groups is included in the Bases of this specification.
- 3. Functional tests are not required when the systems are not required to be OPERABLE or are operating (i.e., already tripped). If tests are missed,
'. they shall be performed prior to returning the systems to an OPERABLE status. )
- l. This instrumentation is exempted from the instrument channel test l 4.
( definition. This instrument channel functional test will consist of injecting a simulated electrical signal into the measurement channels.
- 5. The channel functional test shall include both the APRM channels and the 2/4 voter channels.
- 6. The channel functional test shall include both the APRM channels and the 2/4 voter channels plus the flow input function, excluding the flow transmitters.
- 7. Functional test consists of the injection of a simulated signal into the electronic trip circuitry in place of the sensor signal to verify operability of the trip end alarm functions.
- 8. Functional test frequency decreased to once/3 months to reduce the challenges to relief valves per NUREG 0737, Item.II.K.3.16.
- 9. Not required to be performed when entering the STARTUP/ HOT STANDBY Mode from RUN Mode until 12 hours after entering the STARTUP/ HOT STANDBY Mode.
- 10. Functional test consists of simulating APRM trip conditions at the APRM channel outputs to check all combinations of two tripped inputs to the ,
2/4 voter logic in each voter channel. {
- 11. Functional test consists of manually tripping the 2/4 voter trip output, one voter channel at a time, to demonstrate that each scram contactor for each RPS trip system channel (A1, A2, B1 and B2) operates and produces a half-scram.
)
l l BFN 3.1/4.1-9 Unit 3
0;; L3.5 BASES (Cont'd) probability of core instability following entry-into Region II, the operator.will take immediate action to exit the region. Although formal surveillances are not performed while exiting Region II (delaying exit for surveillances is undesirable), an immediate manual scram will be initiated if evidence of thermal-hydraulic instability is observed. Clear indications of thermal-hydraulic instability are APRM oscillations which exceed 10 percent peak-to-peak or LPRM [ oscillations which exceed 30 percent peak-to-peak (approximately equivalent to APRM oscillations of 10 percent during regional oscillations). Periodic LPRM upscale or downscale alarms may also be indicators of thermal hydraulic instability and will be immediately investigated. Periodic upscale or downscale LPRM alarms will occur before regional oscillations are large enough to threaten the MCPR safety limit. l Therefore, the r.riteria for initiating a manual scram described in the preceding paragraph are sufficient to ensure that the MCPR safety limit will not be violated in the event that core oscillations initiate whil's exiting Region II. Normal operation of the reactor is restricted to thermal power and core flow conditions (i.e., outside Regions I and II) where thermal-hydraulic instabilities are very unlikely to occur. 3.5.N. References
- 1. Loss-of-Coolant Accident Analysis for Browns Ferry Nuclear Plant Unit 2,.NEDO - 24088-1 and Addenda.
- 2. "BWR Transient Analysis Model Utilizing the RETRAN Program,"
TVA-TR81-01-A.
- 3. Generic Reload Fuel Application, Licensing Topical Report, NEDE - 24011-P-A and Addenda.
4.5 Core and Containment Coolina Systems Surveillance Freauencies The testing interval for the core and containment cooling systems is based on industry practice, quantitative reliability analysis, judgment and practicality. The core cooling systems have not been designed to be fully testable during operation. For example, in the case of the HPCI, automatic initiation during power operation would result in pumping cold water into the reactor vessel which is not desirable. Complete ADS testing during power operation causes an undesirable loss-of-coolant inventory. To increase the availability BFN Unit 2 3.5/4.5-33l
NOTES FOR TABLE 4.1.B
- 1. A description cf three groups is included in the bases of this specification.
- 2. Calibrations are not required when the systems are not required to be OPERABLE or are tripped. If calibrations are missed, they shall be performed prior to returning the system to an OPERABLE status.
- 3. (Deleted)
- 4. Required frequency is initial startup following each refueling outage.
- 5. Physical inspection and actuation of these position switches will be performed once per operating cycle.
- 6. On controlled startups, overlap between the IRMs and APRMs will be verified.
- 7. The flow bias signal calibration will consist of calibrating the analog differential pressure flow sensors once per operating cycle. Calibration of the flow bias processing system is done once per operating cycle as part of the overall APRM instrumentation calibration.
- 8. A complete TIP system traverse calibrates the LPRM signals to the process computer. The individual LPRM meter readings will be adjusted as a minimum at the beginning of each operating cycle before reaching 100 percent power. ,
- 9. Calibration consists of the adjustment of the primary sensor and associated components so that they correspond within acceptable range and accuracy to known values of the parameter which the channel monitors, including adjustment of the electronic trip circuitry, so that its output relay changes state at or more conservatively than the analog equivalent of the trip level setting.
BFN 3.1/4.1-12 Unit 2 I
3.1 BASES , The reactor protection system automatically initiates a reactor scram to:
- 1. Preserve the integrity of the fuel cladding, i
- 2. Preserve the integrity of the reactor. coolant system.
- 3. Minimize the energy which must be absorbed following a loss of coolant accident, and prevents criticality.
This specification provides the limiting conditions for operation ; necessary to preserve the ability of the system to tolerate single failures and still perform its intended function even during periods when instrument channels may be out of service because of maintenance. When necessary, one channel may be made INOPERABLE for brief intervals to conduct required functional tests and calibrations. The reactor protection trip system is supplied, via a separate bus, by its own high. inertia, ac motor-generator set.. Alternate power is available to either Reactor Protection System bus from an electrical bus j that can receive standby electrical power. The RPS monitoring system provides an isolation between nonclass 1E power supply and the class 1E RPS bus. This will ensure that failure of a nonclass 1E reactor protection power supply will not cause adverse interaction to the class 1E Reactor Protection System. ' The reactor protection system is made up of two independent trip systems f (refer to Section 7.2, FSAR). There are usually four channels provided to monitor each critical' parameter, with two channels in each trip ! system. The outputs of the channele in a trip system are combined in a logic such that either channel trip will trip that trip system. The ! simultaneous tripping of both trip systems will produce a reactor scram. ; This system meets the intent of IEEE-279 for Nuclear Power Plant ; Protection Systems. The system has a rel'iability greater than that of a
- 2-out-of-3 system and somewhat less than that of a 1-out-of-2 system. ;
With the exception.of the Average Power Range Monitor (APRM) channels, the Intermediate Range Monitor (IRM) channels, the Main Steam Isolation l Valve closure and the Turbine Stop Valve closure, each trip system logic has one instrument channel. When the minimum condition for operation on the number of OPERABLE instrument channels per untripped protection trip 'i system is met or if it cannot be met and the effected protection trip i system is placed in a tripped condition, the effectiveness of the ] protection system is preserved; i.e., the system can tolerate a single j failure and still perform its intended function of scramming the i reactor. d j l The APRM system is divided into four APRM channels and four 2-out-of-4 trip voter channels. Each APRM channel provides input to each of the four voter channels. The four voter channels are divided into two groups of two each, with each group of two providing inputs to one RPS trip BFW 3.1/4.1-14 Unit 2 1
3.1 BASES (Cont'd) system. The APRM system is designed to allow one APRM channel, but no voter channels, to be bypassed. A trip from any one unbypassed APRM will result in a " half-trip" in all four of the voter units, but no trip inputs to either RPS trip system. A trip from any two unbypassed APRM channels will result in a full trip in each of the four voter channels, which in turn results in two trip inputs into each RPS trip system resulting in a full scram. Each APRM instrument channel receives input signals from forty-three (43) Local Power Range Monitors (LPRMs). A minimum of twenty (20) LPRM inputs with three (3) per axial level is required for the APRM instrument channel to be OPERABLE. Fever than the required minimum number of LPRM inputs generates an instrument channel inoperative alarm and a control rod block but does not result in an automatic trip input to the 2-out-of-4 voters. Each protection trip system has one more IRM than is necessary to meet l the minimum number required per channel. This allows the bypassing of one IRM per protection trip system for maintenance, testing or l calibration. The bases for the scram setting for the IRM, APRM, high y reactor pressure, reactor low water level, MSIV closure, turbine control ; valve fast closure and turbine stop valve closure are discussed in Specifications 2.1 and 2.2. I Instrumentation (pressure switches) for the drywell are provided to detect a loss of coolant accident and initiate the core standby cooling equipment. A high drywell pressure scram is provided at the same setting as the core cooling systems (CSCS) initiation to minimize the energy j which must be accommodated during a loss of coolant accident and to prevent return to criticality. This instrumentation is a backup to the < reactor vessel water level instrumentation. I A reactor mode switch is provided which actuates or bypasses the various ; scram functions appropriate to the particular plant operating status. I Reference Section 7.2.3.7 FSAR. The manual scram function is active in all modes, thus providing for a manual means of rapidly inserting control rods during all modes of reactor operation. The IRM system (120/125 scram) in conjunction with the APRM system (15 percent scram) provides protection against excessive power levels and short reactor periods in the startup and intermediate power ranges. The control rod drive scram system is designed so that all of the water which is discharged from the reactor by a scram can be accommodated in I the discharge piping. The discharge volume tank accommodates in excess l of 50 gallons of water and is the low point in the piping. No credit was taken for this volume in the design of the discharge piping as concerns the amount of water which must be accommodated during a scram. During normal operation the discharge volume is empty; however, should it fill with water, the water discharged to the piping from the reactor could not BFN 3.1/4.1-15 Unit 2 I
3.1 BASES (Cont'd) be accommodated which would result in slow scram times or partial control rod insertion. To preclude this~ occurrence, level switches have'been provided in the instrument volume which alarm and scram the reactor when the volume of water reaches 50 gallons. As indicated above, there is sufficient volume in the piping to accommodate the scram without impairment of the scram times or. amount of. insertion of the control rods. This function shuts the reactor down while sufficient volume , remains to accommodate the discharge water and~ precludes the situation 1r4 ' which a scram would be required but not be able to perform its function adequately. A source range monitor (SRM) system is also provided to supply additional , neutron level information during startup but has no scram functions. Reference Section 7.5.4 FSAR. Thus, the IRM is required in the REFUEL
- and STARTUP modes. In the power range the APRM system provides required protection. Reference Section 7.5.7 FSAR. Thus, the IRM System is not ;
required in the RUN mode. The APRMs and the IRMs provide adequate coverage in the STARTUP and intermediate range. The high reactor pressure, high drywell pressure, reactor low water level, low scram pilot air header pressure and scram discharge volume high level scrams are required for STARTUP and RUN modes of plant operation. They are,.therefore, required to be operational for these modes of reactor operation. The requirement to have the scram functions as indicated in Table 3.1.A OPERABLE in the REFUEL mode is to assure that shifting to the REFUEL mode i during reactor power operation does not diminish the need for the reactor protection system. . Because of the APRM downscale rod block limit of 1 3 percent when in the RUN mode and high level flux scram limit of 115 percent when in the STARTUP Mode, the transition between the STARTUP and RUN Modes must be made with the APRM instrumentation indicating between 3 percent and 15 ; percent of rated power. In addition,'the IRM system must be indicating. i below the High Flux setting (120/125 of scale) or a scram will occur when in the STARTUP Mode. For normal. operating conditions, these limits ; provide assurance of overlap between the IRM system and APRM system so ' that there are no " gaps" in the power level indications (i.e., the power i level is continuously monitored from beginning of startup to full power , and from full power to SHUTDOWN). When power is being reduced, if a transfer to the STARTUP mode is made and the IRMs have not been fully inserted (a maloperational but not impossible condition) a control rod i block immediately occurs so that reactivity insertion by control rod ' withdrawal cannot occur. The low scram pilot air header pressure trip performs the same function as the high water level in the scram discharge instrument volume for fast i fill events in which the high level instrument response time may be i , inadequate. A fast fill event is postulated for certain degraded control > air events in which the scram outlet valves unseat enough to allow 5 spa per drive leakage into the scram discharge volume but not enough to cause control rod insertion. , 1 , BFN 3.1/4.1-16 Unit 2 9
- ., .. .,e ,
. . - . - - - .- - . .. - =. .-- . _- l 4.1 BASES The minimum functional testing frequency used in this specification is based on a reliability analysis using the concepts developed in reference 1 (1). This concept was specifically adapted to the one-out-of-two taken
- twice logic of the reactor protection system. The analysis shows that the sensors are primarily responsible for the reliability of the reactor 1 protection system. This analysis makes use of " unsafe failure" rate experience at conventional and nuclear power plants in a reliability model for the system. An " unsafe failure" is defined as one which negates channel operability and which, due to its nature, is revealed only when i the channel is functionally tested or attempts to respond to a real signal. Failure such as blown fuses, ruptured bourdon tubes, faulted amplifiers, faulted cables, etc., which result in " upscale" or "downscale" ,
readings on the reactor instrumentation are " safe" and will be easily recognized by the operators during operation because they are revealed by an alarm or a scram. , Except for the APRMs which take credit for self-test capability, the l channels listed in Tables 4.1.A and 4.1.B are divided into three groups , for functional testing. These are: l A. On-Off sensors that provide a scram trip function. B. Analog devices coupled with bistable trips that provide a scram function. C. Devices which only serve a useful function during some restricted mode of operation, such as STARTUP or SHUTDOWN, or for which the only practical test is one that can be performed at SHUTDOWN. l The sensors that make up group (A) are specifically selected from among the whole family of industrial on-off sensors that have earned an excellent reputation for reliable operation. During design, a goal of 1 0.9999 probability of success (et the 50 percent confidence level) was ' adopted to assure that a balanced and adequate design is achieved. The i probability of success is primarily a function of the sensor failure rate and the test interval. A three-month test interval was planned for group ' (A) sensors. This is in keeping with good operating practices, and satisfies the design goal for the logic configuration utilized in the Reactor Protection System. ' To satisfy the long-term objective of maintaining an adequate level of safety throughout the plant lifetime, a minimum goal of 0.9999 at the 95 percent confidence level is proposed. With the (1-out-of-2) X (2) logic, this requires that each sensor have an availability of 0.993 at the 95 j percent confidence level. This level of availability may be maintained by ' adjusting the test interval as a function of the cbserved failure history.1 i
- 1. Reliability of Engineered Safety Features as a Function of Testing Frequency, I. M. Jacobs, " Nuclear Safety," Vol. 9, No. 4, l July-August, 1968, pp. 310-312.
BFN 3.1/4.1-17 Unit 2 l l
i
'4.1 BASES (Cont'd) 4 Group (C) devices are active only during a given portion of the l operational cycle. For example, the IRM is active during STARTUP and inactive during full-power operation. Thus, the only test that is meaningful is the one performed just prior to SHUTDOWN or STARTUP: 1.e.,
the tests that are performed just prior to use of the instrument. Calibration frequency of the instrument channel is divided into two groups. These are as follows:
- 1. Passive type indicating devices that can be compared with like units on a continuous basis. !
- 2. Vacuum tube or semiconductor devices and detectors that drift or l lose sensitivity. ,
i I l Experience with passive type instruments in generating stations and ! substations indicates that the specified calibrations are adequate. For ; those devices which employ amplifiers, etc., drift specifications call for ! drift to be less than 0.4 percent / month; i.e., in the period of a month a drift of 4 percent would occur and thus providing for adequate margin. For the APRM system drift of electronic apparatus is not the only ) consideration in determining a calibration frequency. Change in power distribution and loss of chamber sensitivity dictate a calibration every seven days. Calibration on this frequency assures plant operation at or below thermal limits. A comparison of Tables 4.1.A and 4.1.B indicates that two instrument channels have been included in the latter table. These are: mode switch in SHUTDOWN and manual scram. All of the devices or sensors associated with these scram functions are simple on-off switches and, hence, calibration during operation is not applicable, i.e., the switch is either on or off. The APRM and 2-out-of-4 voter channel hardware is provided with a self-test capability which automatically checks most of the critical hardware at least once per 15 minute interval whenever the APRM channel is in the operate mode. This provides a virtually continuous monitoring of ; the essential APRM trip functions. In the event a critical fault is detected, an " inoperative" trip signal results. A fault detected in non-critical hardware results in an " inoperative" alarm. Following ) receipt of an " inoperative" trip or alarm signal, the operator can employ numerous diagnostic testing options to locate the a blem. l The automatic self-test function is supplemented with a manual APRM trip functional test, including the 2-out-of-4 voter channels and the interface with the RPS trip systems. In combination with the virtually continuous self-testing, the manual APRM trip functional test provides adequate functional testing of the APRM trip function. Therefore, the six-month test frequency for the manual testing provides an acceptable level of availability of the APRM. BTN 3.1/4.1-19 Unit 2
4.1 R&1El (Cont'd) In addition to the above tests, the 2-out-of-4 voter is used to test the l RPS scram contactors. The output of each voter channel is tripped to produce a scram signal into each of the RPS trip system channels (A1, A2, B1 and B2) to individually operate the respective scram contactors. The weekly test interval provides an acceptable level of availability of the I scram contactors. l l Each APRM receives the output signals from two analog differential j l pressure flow transducers, one associated with recirculation loop A and i i the other with recirculation loop B. These differential pressure signals are converted into representative digital loop flow signals within the same hardware that performs the APRM functions and are added to determine a total recirculation flow. The total recirculation flow value is used by l the APRM to determine the flow biased setpoints. Each total recirculation flow signal developed by an APRM is compared in the hardware that performs the RBM functions to the signals from the remaining three APRMs. An alarm is given if a preset compare level setpoint is exceeded. The flow processing is integrated with the APRM processing and is covered by the seme self-test and alarm functions described earlier. As a result of the virtually continuous monitoring of the equipment performing the flow processing, and the automatic comparison of radundant flow signals, it is acceptable to calibrate this equipment once per operating cycle. The sensitivity of LPRM detectors decreases with exposure to neutron flux at a slow and approximately constant rate. The APRM system, which uses the LPRM readings to detect a change in thermal power, will be calibrated every seven days using a heat balance to compensate for this change in sensitivity. The RBM system uses the LPRM reading to detect a localized change in thermal power. It applies a correction factor based on the APRM output signal to determine the percent thermal power and therefore any change in LPRM sensitivity is compensated for by the APRM calibration. ThetechnicalspecificationlimitsofCPRandAPLHGRaredeterminedbythed use of the process computer or other backup methods. These methods use LPRM readings and TIP data to determine the power distribution. Compensation in the process computer for changes in LPRM sensitivity will be made by performing a full core TIP traverse to update the computer calculated LPRM correction factors every 1000 effective full power hours. As a minimum the individual LPRM meter readings will be adjusted at the beginning of each operating cycle before reaching 100 percent power. BFN 3.1/4.1-20 Unit 2
TABLE 4.1.8 REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENT CALIBRATION c, MINIMJM CALIBRATION FREQUENCIES FOR REACTOR PROTECTION INSTRUMENT CHANNELS hE Instrument Channel Group (1) Calibration Minimus Freauencvf2) u IRM High Flux C Comparison to APRM on Controlled Note (4) Startups (6) APRM High Flux Output Signal Heat Balance Once Every 7 Days i Flow Blas Signal Calibrate Flow Blas Signal (7) Once/ Operating Cycle d LPRM Signal TIP System Traverse (8) Every 1000 Effective Full d Power Hours High Reactor Pressure A Standard Pressure Source Every 3 Months High Drywell Pressure A Standard Pressure Source Every 3 Months Reactor Low Water Level A Pressure Standard Every 3 Months v High Water Level in Scram Discharge Volume C Float Switches
* (LS-85-45C-F) A Calibrated Water Column (5) Note (5)
~ Electronic Lvl Switches (LS-85-45-A, B. G, H) B Calibrated Water Column Once/ Operating Cycle (9)
Main Steam Line Isolation Valve Closure A Note (5) Note (5) Turbine First Stage Pressure Permissive A Standard Pressure Source Every 6 Months Turbine Control Valve Fast Closure or Turbine Trip A Standard Pressure Source Once/ Operating Cycle Turbine Stop Valve Closure A Note (5) Note (5) < _ . . . . . _ . - - . _ _ , _. - . - - . - - - _ - . _- , -- .. _ _ ._,,- .U
NOTES FOR TABLE 4.1.B
- 1. A description of three groups is included in the Bases of this !
specification.
- 2. Calibrations are not required when the syatems are not required to be OPERABLE or are tripped. If calibrations are missed, they shall be performed prior to returning the system to an OPERABLE status.
- 3. (Deleted)
- 4. Required frequency is initial startup following each refueling outage.
- 5. Physical inspection and actuation of these position switches will be performed once per operating cycle.
- 6. On controlled startups, overlap between the IRMs and APRMs will be verified.
- 7. The flow bias signal calibration will consist of calibrating the analog differential pressure flow sensors once per operating cycle. Calibration of the flow bias processing system is done once per operating cycle as part of the overall APRM instrumentation calibration.
- 8. A complete TIP system traverse calibrates the LPRM signals to the process computer. The individual LPRM meter readings will be adjusted as a minimum at the beginning of each operating cycle before reaching 100 percent power.
- 9. Calibration consists of the adjustment of the primary sensor and associated components so that they correspond within acceptable range and accuracy to known values of the parameter which the channel monitors, including adjustment of the electronic trip circuitry, so that its output relay change state s.t or more conservatively than the analog equivalent of the trip level setting.
i BFN 3.1/4.1-11 Unit 3
3.1 RA111
'The reactor protection system automatically initiates a reactor scram to:
- 1. Preserve the integrity of the fuel cladding.
- 2. Preserve the integrity of the reactor coolant system.
- 3. Minimize the energy which must be absorbed following a loss of coolant accident, and prevents criticality.
This specification provides the limiting conditions for operation necessary to preserve the ability of the system to tolerate single failures and still perform its intended function even during periods when instrument channels may be out of service because of maintenance. .When necessary, one channel may be made INOPERABLE for brief intervals to conduct required functional tests and calibrations. The reactor protection system is made up of two independent trip systems (refer to Section 7.2, FSAR). There are usually'four channels provided to monitor each critical parameter, with two channels in each trip system. The outputs of the channels in a trip system are combined in a logic such that either channel trip will trip that trip system. The simultaneous tripping of both trip systems will produce a reactor scram. This system meets the intent of IEEE-279 for Nuclear Power Plant Protection Systems. The system has a reliability greater than that of a 2-out-of-3 system and somewhat less than that of a 1-out-of-2 system. With the exception of the Average Power Range Monitor (APRM) channels, the Intermediate Range Monitor (IRM) channels,:the Main Steam Isolation Valve closure and the Turbine Stop Valve closure, each trip system logic has one instrument channel. When the minimum condition for operation on the number of OPERABLE instrument channels per untripped protection trip system is met or if it cannot be met and the effected protection trip system is placed in a tripped condition, the effectiveness of the protection system is preserved; i.e., the system can tolerate a single failure and still perform its intended function of scramming the reactor, d The APRM system is divided into four APRM channels and four 2-out-of-4 trip voter channels. Each APRM channel provides input to each of the four voter channels. The four voter channels are divided into two groups of two each, with each group of two providing inputs to one RPS trip 4 l BFN 3.1/4.1-13 - Unit 3 i n e -, n n
7 3.1 RASIE (Cont'd) system. The APRM system is designed to allow one APRM channel, but no voter channels, to be bypassed. A trip from an,7 one unbypassed APRM will result in a " half-trip" in all four of the voter units, but no trip inputs to either RPS trip system. A trip from any two unbypassed APRM channels will result in a full trip in each of the four voter channels, which in turn results in two trip inputs into each RPS trip system 1 resulting in a full scram. Each APRM instrument channel receives input signals from forty-three (43) l Local Power Range Monitors (LPRMs). A minimum of twenty (20) LPRM inputs with three (3) per axial level is required for the APRM instrument channel to be OPERABLE. Fever than the required minimum number of LPRM inputs generates an instrument channel inoperative alarm and a control rod block but does not result in an automatic trip input to the 2-out-of-4 voters. Each protection trip system has one more IRM than is necessary to meet l the minimum number required per channel. This allows the bypassing of one IRM per protection trip system for maintenance, testing or l i calibration. The bases for the scram setting for the IRM, APRM, high 4 reactor pressure, reactor low water level, MSIV closure, turbine control valve fast closure, and turbine stop valve closure are discussed in Specifications 2.1 and 2.2. Instrumentation (pressure switches) for the drywell are provided to detect a loss of coolant accident and initiate the core standby cooling equipment. A high drywell pressure scram is provided at the same setting as the core cooling systems (CSCS) initiation to minimize the energy which must be accommodated during a loss of coolant accident and to prevent return to criticality. This instrumentation is a backup to the reactor vessel water level instrumentation. A reactor mode switch is provided which actuates or bypasses the various scram functions appropriate to the particular plant operating status. Reference Section 7.2.3.7 FSAR. The manual scram function is active in all modes, thus providing for a manual means of rapidly inserting control rods during all modes of reactor operation. - The IRM system (120/125 scram) in conjunction with the APRM system (15 percent scram) provides protection against excessive power levels and short reactor periods in the startup and intermediate power ranges. The control rod drive scram system is designed so that all of the water which is discharged from the reactor by a scram can be accommodated in the discharge piping. The discharge volume tank accommodates in excess of 50 gallons of water and is the low point in the piping. No credit was taken for this volume in the design of the discharge piping as concerns the amount of water which must be accommodated during a scram. During normal operation the discharge volume is empty; however, should it fill with water, the water discharged to the piping from the reactor could not BFN 3.1/4.1-14 Unit 3 i
3.1 BASES (Cont'd). be accommodated which would result in slow scram times or partial control
. rod insertion. To preclude this occurrence, level switches have been l
provided in the instrument volume which alarm and scram the reactor when ' the volume of water reaches 50 gallons. As indicated above, there is ' sufficient volume in the piping to accommodate the scram without impairment of the scram times or amount of insertion of the control ) rods. This function shuts the reactor down while sufficient volume remains to accommodate the discharge water and precludes the situation in ; which a scram would be required but not be able to perform its function ; adequately. l A source range monitor (SRM) system is also provided to supply additional -i neutron level information during startup but has no scram functions. !' Reference Section 7.5.4 FSAR. Thus, the IRM is required in the REFUEL and STARTUP modes. In the power range the APRM system provides required ; protection. Reference Section 7.5.7 FSAR. Thus, the IBM System is not , required in the RUN mode. The APRMs and the IRMs provide adequate ! coverage in the STARTUP and intermediate range. The high reactor pressure, high drywell pressure, reactor low water level l and scram discharge volume high level scrams are required for STARTUP and i RUN modes of plant operation. They are, therefore, required to be operational for these modes of reactor operation. The requirement to have the scram functions as indicated in Table 3.1.1 ; OPERABLE in the REFUEL mode is to assure that shifting to the REFUEL mode , during reactor power operation does not diminish the need for the reactor ! protection system. ! t Because of the APRM downscale. rod block limit of 1 3 percent when in the { RUN mode and high level flux scram limit of 115 percent when in the i STARTUP Mode, the transition between the STARTUP and RUN Modes must be made with the APRM instrumentation indicating between 3 percent and 15 I percene of rated power. In addition, the IRM system must be indicating d i below the High Flux setting (120/125 of scale) or a scram will occur when ! in the STARTUP Mode. For normal operating conditions, these limits provide assurance of overlap between the IRM system and APRM system so l that there are no " gaps" in the power level indications (i.e., the power , level is continuously monitored from beginning of startup to full power l and from full. power to shutdown). When power is being reduced, if a ! transfer to the STARTUP mode is made and the IRMs have not been fully I inserted (a maloperational but not impossible condition) a control rod block immediately occurs so that reactivity insertion by control rod withdrawal cannot occur. l t l l l 4
- BFN 3.1/4.1-15 Unit 3
4.1 BASJJ , The minimum functional testing frequency used in this specification.is based on a reliability analysis using the concepts developed in reference (1). This concept was specifically adapted to the one-out-of-two taken twice logic of the reactor protection system. The analysis shows that the sensors are primarily responsible for the reliability of the reactor j protection system. This analysis makes use of " unsafe failure" rate experience at conventional and nuclear power plants in a reliability model-for the system. An " unsafe failure" is defined as one which negates , channel operability and which, due to its nature, is revealed only when l the channel is functionally tested or attempts to respond to a real signal. Failure such as blown fuses, ruptured bourdon tubes, faulted amplifiers, faulted cables, etc., which result in " upscale" or "downscale" readings on the reactor instrumentation are " safe" and will be easily recognized by the operators during operation because they are revealed by an alarm or a scram. I Except for the APRMs which take credit for self-test capability, the l ) channels listed in Tables 4.1.A and 4.1.B are divided into three groups for functional testing. These are: l A. On-Off sensors that provide a scram trip function. 1 B. Analog devices coupled with bistable trips that provide a scram function. C. Devices which only serve a useful function during some restricted , mode of operation, such as STARTUP or SHUTDOWN, or for which the I only practical test is one that can be performed at shutdown. l The sensors that make up group (A) are specifically selected from among l the whole family of industrial on-off sensors that have earned an excellent reputation for reliable' operation. During design, a goal of ' O.99999 probability of success (at the 50 percent confidence level) was adopted to assure that a balanced and adequate design is achieved. The
. probability of success is primarily a function of the sensor failure rate and the test interval. A three-month test interval was planned for group (A) sensors. This is in keeping with good operating practices, and satisfies the design goal for the logic configuration utilized in the Reactor Protection System.
To satisfy the long-term objective of maintaining an adequate level of safety throughout the plant lifetime, a minimum goal of 0.9999 at the l 95-percent confidence level is proposed. With the (1-out-of-2) X (2) i logic, this requires that each sensor have an availability of 0.993 at the s'5 percent confidence level. This level of availability may be maintained by adjus his'.ory.ging the test interval as a function of the observed failure
- 1. Reliability of Engineered Safety Features as a Function of Testing Frequency, I. M. Jacobs, " Nuclear Safety," Vol. 9, No. 4, July-August, 1968, pp. 310-312.
BFN 3.1/4.1-16 Unit 3 l 1 N
I 4.1- B&1El (Cont'd) i 4 l Group (C) devices are active only during a given portion of the I operational cycle. For example, the IRM is active during STARTUP and ) inactive during full-power operation. Thus, the only test that is ' meaningful is the one performed just prior to SHUTDOWN or STARTUP; i.e., the tests that are performed just prior to use of the instrument. l Calibration frequency of the instrument channel is divided into two j groups. These are as follows: l
- 1. Passive type indicating devices that can be compared with like :
units on a continuous basis.
- 2. Vacuum tube or semiconductor devices and detectors that drift or ,
lose sensitivity. Experience with passiva type instruments in generating stations and substations indicates thit the specified calibrations are adequate. For ! those devices which employ amplifiers, etc., drift specifications call for ! drift to be less than 0.4 percent / month; i.e., in the period of a month a drift of .4-percent would occur and thus providing for adequate margin. For the APRM system drift of electronic apparatus is not the only consideration in determining a calibration frequency. Change in power j distribution and loss of chamber sensitivity dictate a calibration every seven days. Calibration on this frequency assures plant operation at or below thermal-limits. t A comparison of Tables 4.1.A and 4.1.B indicates that two instrument channels have been included in the latter table. These are: mode switch in SHUTDOWN and annual scram. All of the devices or sensors associated , with these scram functions are simple on-off switches and, hence, calibration during operation is not applicable, i.e., the switch is either on or off. l The APRM and 2-out-of-4 voter channel hardware is provided with a : self-test capability which automatically checks most of the critical hardware at least once per 15 minute interval whenever the APRM channel is .! in the operate mode. This provides a virtually continuous monitoring of l the essential APRM trip functions. In the event a critical fault is detected, an " inoperative" trip signal results. A fault detected in , non-critical hardware results in an " inoperative" alarm. Following ' receipt of an " inoperative" trip or alarm signal, the operator can employ i numerous diagnostic testing options to locate the problem. The automatic self-test function is supplemented with a manual APRM trip functional test, including the 2-out-of-4 voter channels and the interface with the RPS trip systems. In combination with the virtually continuous , self-testing, the manual APRM trip functional test provides adequate ' functional testing of the APRM trip function. Therefore, the six-month l test frequency for the manual testing provides an acceptable level of ' availability of the APRM. 1 l BFN 3.1/4.1-18 ; Unit 3 j s
4.1 BASES (Cont'd) In addition to the above tests, the 2-out-of-4 voter is used to test the RPS scram contactors. The output of each voter channel is tripped to produce a scram signal into each of the RPS trip system channels (Al, A2, B1 and B2) to individually operate the respective scram contactors. The weekly test interval provides an acceptable level of availability of the scram contactors. Each APRM receives the output signals from two analog differential pressure flow transducers, one associated with recirculation loop A and the other with recirculation loop B. These differential pressure signals are converted into representative digital loop flow signals within the same hardware that performs the APRM functions and are added to determine a total recirculation flow. The total recirculation flow value is used by. the APRM to determine the flow biased setpoints. Each total recirculation flow signal developed by an APRM is compared in the hardware that performs the RBM functions to the signals from the remaining three APRMs. An alarm is given if a preset compare level setpoint is exceeded. The flow processing is integrated with the APRM processing and is covered by the same self-test and alarm functions described earlier. As a result of the virtually continuous monitoring of the equipment performing the flow processing, and the automatic comparison of redundant flow signals, it is acceptable to calibrate this equipment once per operating cycle. The sensitivity of LPRM detectors decreases with exposure to neutron flux at a slow and approximately constant rate. The APRM system, which uses the LPRM readings to detect a change in thermal power, will be calibrated every seven days using a heat balance to compensate for this change in sensitivity. The RBM system uses the LPRM reading to detect a localized change in thermal power. It applies a correction factor based on the APRM output signal to determine the percent thermal power and therefore any change in LPRM sensitivity is compensated for by the APRM calibration. ThetechnicalspecificationlimitsofCPRandAPLHGRaredeterminedbythed use of the process computer or other backup methods. These methods use LPRM readings and TIP data to determine the power distribution. Compensation in the process computer for changes in LPRM sensitivity will be made by performing a full core TIP traverse to update the computer calculated LPRM correction factors every 1000 effective full power hours. As a minimum the individual LPRM meter readings will be adjusted at the beginning of each operating cycle before reaching 100 percent power. BFN 3.1/4.1-19 Unit 3
TABLE 3.2.C INSTRUMENTATION THAT INITIATES R00 BLOCKS 5? n Minimum Operable
~
Channels Per Trio Function (51 Function Trio Level Settina 3(1) APRM Upscale (Flow 8tas) (2) 3(1) APRM Upscale (Startup Mode) (8) 1121 3(1) APRM Downscale (9) 131 3(1) APRM Inoperative (10b) 2(7) ROM Upscale (Power Blas) Low Power Range (13) (14) Intermediate Power Range (13) (14) High Power Range (13) (14) 2(7) R8M Downscale (9) (13) (15) 2(7) R8M Inoperative (10c) 6(1) IRM Upscale (8) 1108/125 of full scale [ 6(1) IRM Downscale (3)(8) 15/125 of full scale 6(1) IRM Detector not in Startup Position (8) (11) 6(1) IRM Inoperative (8) (10a) 3(1) (6) SRM Upscale (8) i 1X105counts /sec. 3(1) (6) SRM Downscale (4)(8) 13 counts /sec. 3(1) (6) SRM Detector not in Startup Position (4)(8) (11) 3(1) (6) SRM Inoperative (8) (10a)
- 1 Rod Block Logic N/A 1(12) High Water Level in West 125 gal.
Scram Discharge Tank (LS-85-45L) 1(12) High Water Level in East 125 gal. Scram Discharge Tank (LS-85-45M)
NOTES FOR TABLE 3.2.C
- 1. The minimum number of operable channels for each trip function is detailed for the startup and run positions of the reactor mode selector switch. The SRM, IBM, and APRM (startup mode), blocks need not be operable in "run" mode, and the APRM (flow biased) rod blocks ,
need not be operable in "startup" mode. With the number of OPERARLE channels less than required by the minimum 0PERABLE channels per trip function requirement, place at least one inoperable channel in the tripped condition within one hour.
- 2. The trip level setting shall be as specified in the CORE OPERATING LIMITS REPORT. ,
- 3. IBM downscale is bypassed when it is on its lowest range.
- 4. SRMs A and C downscale functions are bypassed when IBMs A, C, E, and G are above range 2. SRMs B and D downscale function is bypassed when IBMs B, D, F, and H are above range 2.
SRM detector not in startup position is bypassed when the count rate is 1100 CPS or the above condition is satisfied. ;
- 5. During repair or calibration of equipment, not more than one SRM, RBM or APRM channel nor more than two IBM channels may be bypassed. ,
Bypassed channels are not counted as operable channels to meet the minimum operable channel requirements. Refer to section 3.10.B for SRM requirements during core alterations.
- 6. IBM channels A, E, C, G all in range 8 or above bypasses SRM channels i A and C functions.
IRM channels B, F, D, H all in range 8 or above bypasses SEM channels B and D functions. ;
- 7. The following operational restraints apply to the RBM only. ,
- s. Both RBM channels are bypassed when reactor power is 130 percent or when a peripheral control rod is selected.
l
- b. The RBM need not be operable in the "startup" position of the reactor mode selector switch.
- c. The RBM need not be OPERABLE if either of the following two conditions is met:
(1) Reactor thermal power is 190 percent of rated and MCPR is 11.40, or (2) Reactor thermal power is <90 percent of rated and MCPR is 11.70. I BFN 3.2/4.2-26 i Unit 1
~. .
i NOTES FOR TABLR 3.2.C (Cont'd) .
- d. Two EM channels are provided and only one of these may be l [
bypassed from the console. If the inoperable channel cannot be restored within 24 hours, the inoperable channel shall be , placed in the tripped condition within one hour. !
- e. With both RM channels inoperable, place at least one ,
l inoperable rod block monitor channel in the tripped condition within one hour. .j
- 8. This function is bypassed when the mode switch is placed in RUN. j
- 9. This function is only active when the mode switch is in RUN. This' !
function is automatically bypassed when the IM instrumentation is : OPReARIE and not high. !
- 10. The inoperative trips are produced by the following functions:
l
~
- a. SM and IBM (1) Local " operate-calibrate" switch not in operate, f (2) Power supply voltage low.
(3) Circuit boards not in circuit. f
^
- b. APRM (1) Local " operate-calibrate" switch not in operate.
(2) Less than the required minimum number of LPRM inputs. l l l (3) APRM module unplugged. l ! (4) Self-tested detected critical fault. l {
- c. RM (1) Local " operate-calibrate" switch not in operate.
(2) RM module unplugged. l 1 (3) RBM fails to null. (4) Less than required number of LPRM inputs for rod selected. (5) Self-test detected critical fault. l
- 11. Detector traverse is adjusted to 114 i 2 inches, placing the detector lower position 24 inches below the lower core plate.
BFN 3.2/4.2-27 Unit i
I
)
NOTES FOR TABLE 3.2.C (Cont'd)
- 12. This function may be bypassed in the SHUTDOWN or REFUEL mode. If this function is inoperable at a time when OPERABILITY is required the channel shall be tripped or administrative controls shall be immediately imposed to prevent control rod withdrawal.
- 13. The RBM rod block trip setpoints and applicable power ranges are specified in the CORE OPERATING LIMITS REPORT (COLR).
- 14. Less than or equal to the setpoint allowable value specified in the COLE.
- 15. Greater than or equal to the setpoint allowable value specified in the COLE.
t t 1 i i BFN 3.2/4.2-27a Unit 1 i j
- I I ..
THIS PAGE INTENTIONALLY LEFT BLANK i BFN 3.2/4.2-27b Unit 1
TABLE 4.2.C SURVEILLANCE REQUIREMENTS FOR INSTRUMENTATION THAT INITIATE ROO 8 LOCKS E Function Functional Test Calibration (17) Instnment Check , APRM Upscale (Flow Blas) (1) (13) once/ operating cycle once/ day (8) l APRM Upscale (Startup Mode) (1) (13) once/ operating cycle once/ day (8) l APRM Downscale (1) (13) once/ operating cycle once/ day (8) l APRM Inoperative (1) (13) N/A once/d'.y g3) RBM Upscale (Power Blas) (1) (13) once/ operating cycle N/A l RBM Downscale (1) (13) once/ operating cycle N/A l RBM Inoperative (1) (13) N/A N/A l IRM Upscale (1)(2) (13) once/3 months once/ day (8) IRM Downscale (1)(2) (13) once/3 months once/ day (8) IRM Detector not in Startup Position (2) (once/ operating cycle) once/ operating cycle (12) N/A k
- IRM Inoperative (1)(2) (13) N/A N/A ,
SRM Upscale (1)(2) (13) once/3 months once/ day (8) h SRM Downscale (1)(2) (13) once/3 months once/ day (8) SRM Detector not in Startup Position (2) (once/sperating cycle) once/ operating cycle (12) N/A SRM Inoperative (1)(2) (13) N/A N/A Rod Block Logic (16) N/A N/A West Scram Discharge once/ quarter once/ operating cycle N/A Tank Water Level High (LS-85-4SL) East Scram Discharge once/ quarter once/ operating cycle N/A Tank Water Level High ( LS-85-4SM)
NOTES FOR TABLES 4.2.A THROUGH 4.2.L exceot 4.2. D AND 4.2.K
- 1. For IBMs and SRMs functional tests shall be performed once per month.
For APRMs and RBMs functional tests shall be performed once per 6 months.
- 2. Functional tests shall be performed before each startup with a required frequency not to exceed once per week.
- 3. This instrumentation is excepted from the functional test definition.
The functional test will consist of injecting a simulated electrical signal into the measurement channel.
- 4. Tested during logic system functional tests.
- 5. Refer to Table 4.1.B.
- 6. The logic system functional tests shall include a calibration once per operating cycle of time delay relays and timers necessary for proper functioning of the trip systems.
1
- 7. The functional test will consist of verifying continuity across the inhibit with a volt-ohameter.
- 8. Instrument checks shall be performed in accordance with the definition of instrument check (see Section 1.0, Definitions). An instrument check is not applicable to a particular setpoint, such as Upscale, but is a qualitative check that the instrument is behaving and/or indicating in an acceptable manner for the particular plant condition. Instrument check 1 is included in this table for convenience and to indicate that an instrument check will be performed on the instrument. Instrument checks are not required when these instruments are not required to be OPERABLE or are tripped.
- 9. Calibration frequency shall be once/ year.
- 10. Deleted
- 11. Portion of the logic is functionally tested during outage only.
- 12. The detector will be inserted during each operating cycle and the proper amount of travel into the core verified.
- 13. Functional test will consist of applying simulated inputs (see note 3). '
Local alarm lights representing upscale and downscale trips will be verified, but no rod block will be produced at this time. The inoperative trip will be initiated to produce a rod block (SRM and IRM inoperative also bypassed with the mode switch in RUN). The functions that cannot be verified to produce a rod block directly will be verified during the operating cycle. BFN 3.2/4.2-59 l Unit 1 l l l +w - n' -w w
NOTES FOR TABLES 4.2.A THROUCH 4.2.L except 4.2.D AND 4.2.K (Cont'd)
- 14. (Deleted)
- 15. (Deleted) _
- 16. Performed during operating cycle. Portions of the logic is checked more frequently during functional tests of the functions that produce a rod block.
- 17. This calibration consists of removing the function from service and performing an electronic calibration of the channel.
- 18. Functional test is limited to the condition where secondary containment integrity is not required as specified in Sections 3.7.C.2 and 3.7.C.3.
- 19. Functional test is limited to the time where the SGTS is required to meet the requirements of Section 4.7.C.1.a.
- 20. (Deleted)
- 21. Logic test is limited to the time where actual operation of the equipment is permissible.
- 22. (Deleted)
- 23. (Deleted) i
- 24. This instrument check consists of comparing the thermocouple readings for all valves for consistence and for nominal expected values (not required during refueling outages).
- 25. During each refueling outage, all acoustic monitoring channels shall be calibrated. This calibration includes verification of accelerometer response due to mechanical excitation in the vicinity of the sensor.
BFN 3.2/4.2-60 Unit 1
3.2 BASES (Cont'd) The control rod block functions are provided to generate a trip signal to block rod withdrawal if the monitored power level exceeds a preset value. The trip logic for this' function is 1-out-of-n: e.g., any trip on one of four APRMs, eight IRMs, or four SEMs will result in a rod block. The minimum instrument channel requirements assure sufficient instrumentation to assure the single failure criteria is met. The minimum instrument channel requirements for the RBM may be reduced by one for maintenance, testing, or calibration. This does not significantly increase the risk of an inadvertent control rod withdrawal, as the other channel is available, and the RBM is a. backup system to the written sequence for withdrawal of control rods. The APRM rod block function is flow biased and provides a trip signal for blocking rod withdrawal when average reactor thermal power exceeds pre-established limits set to prevent scram actuation. The RBM rod block function provides local protection of the core; i.e., the prevention of critical power in a local region of the core,'for a single rod withdrawal error from a limiting contr'o1 rod pattern. If the IRM channels are in the worst condition of allowed bypass, 'the sealing arrangement is such that for unbypassed IBM channels, a rod block signal is generated before the detected neutrons flux has increased by more than a factor of 10. A downscale indication is an indication the instrument has failed or the instrument is not sensitive enough. In either case the instrument will not respond to caanges in control rod motion and thus, control rod motion is prevented. l The refueling interlocks also operate one logic channel, and are required ; for safety only when the mode switch is in the refueling position. For effective emergency core cooling for small pipe breaks, the NPCI system must function since reactor pressure does not decrease rapid f enough to allow either core spray or LPCI to operate in time. The automatic pressure relief function is provided as a backup to the HPCI in ; the event the HPCI does not operate. The arrangement of the tripping l contacts is such as to provide this function when necessary and minimize i spurious operation." The trip settings given in the specification are adequate to assure the above criteria are met. The specification , preserves the effectiveness of the system during periods of maintenance, l testing, or calibration, and also minimizes the risk of inadvertent operation; i.e., only one instrument channel out of service. Two radiation monitors are provided for each unit which initiate Primary Containment Isolation (Group 6 isolation valves) Reactor Building Isolation and operation of the Standby Gas Treatment System. These instrument channels monitor the radiation in the reactor zone ventilation exhaust ducts and in the refueling cone. BFN 3.2/4.2-68 Unit 1
i i 4.2 RASES (Cont'd) The conclusions to be drawn are these:
- 1. A 1-out-of-n system may be treated the same as a single channel in terms of choosing a test interval; and
- 2. more than one channel should not be bypassed for testing at any one l
time. The radiation monitors in the reactor and refueling zones which initiate building isolation and standby gas treatment operation are arranged such l that two sensors high (above the high level setpoint) in a single channel ! or one sensor downscale (below low level setpoint) or inoperable in two channels in the same zone will initiate a trip function. The functional - testing frequencies for both the channel functional test and the high voltage power supply functional test are based on a Probabilistic Risk Assessment and system drift characteristics of the Reactor Building Ventilation Radiation Monitors. The calibration frequency is based upon , the drift characteristics of the radiation monitors. l The automatic pressure relief instrumentation can be considered to be a ! 1-out-of-2 logic system and the discussion above applies also. I The RCIC and HPCI system logic tests required by Table 4.2.B contain provisions to demonstrate that these systems will automatically restart on a RPV low water level signal received subsequent to a RFV high water , level trip. -! The electronic instrumentation comprising the APRM rod block and Rod ! Block Monitor functions together with the recirculation flow i instrumentation for flow bias purposes is monitored by the same self-test ; functions as applied to the APRM function for the RPS. The functional , test frequency of every six_ months is based on this automatic self-test j monitoring at 15 minute intervals and on the low expected equipment ; failure rates. Calibration frequency of once per operating cycle is . based on the drift characteristics of the limited number of analog ! components, recognizing that most of the processing is performed digitally without drift of setpoint values. ; 4 6 I I BFN 3.2/4.2-73 Unit 1
3.3/4.3 DFACTIVITY CONTROL LIMITING CONDITIONS FOR OPERATION SURVEIff.AMCE REOUIREMENTS 3.3.B. Control Rods 4.3.B. ggatrol Rods 3.c. If Specifications 3.3.B.3.b.1 3.b.3 When the RWM is not through 3.3.B.3.b.3 cannot GPERABLE a second be met the reactor shall licensed operator not be started, or if the or other technically reactor is in the RUN or qualified member of startup modes at less tL*n the plant staff shall 10% rated power, control roa verify that the correct movement may be only by rod program is followed. actuating the manual scram or placing the reactor mode switch in the shutdown position.
- 4. Control rods shall not be 4. Prior to control rod withdrawn for startup or withdrawal for startup refueling unless at least or during refueling, two source range channels verify that at least two have an observed count rate source range channels equal to or greater than have an observed count three counts per second. rate of at least three counts per second, h 5. (Deleted) 5. (Deleted) y l
I BFN 3.3/4.3-8 ! Unit 1 l l l
3.3/4.3 BASES (Cont'd) ; C. Scram Insertion Times ) The control rod system is designated to bring the reactor suberitical at the rate fast enough to prevent fuel damage; i.e., to prevent the MCPR from becoming less than 1.07. The limiting power transient is given in Reference 1. Analysis of this transient shows that the negative reactivity rates resulting from the scram with the average response of all the drives as given in the above specification provide the required protection, and MCPR remains greater than 1.07. On an early BWR, some degradation of control rod scran performance l l occurred during plant startup and was determined to be caused by J particulate material (probably construction debris) plugging an internal ~ control rod drive filter. The design of the present control rod drive { (Model 7EDB1448) is grossly improved by the relocation of the filter to a location out of the scram drive path; i.e., it can no longer interfere with scram performance, even if completely blocked. The degraded performance of the original drive (CRD7RDB144A) under dirty operating conditions and the insensitivity of the redesigned drive (CRD7RDB144B) has been demonstrated by a series of engineering tests under simulated reactor operating conditions. The successful performance of the new drive under actual operating conditions has also been demonstrated by consistently good in-service test results for plants using the new drive and may be inferred from plants using the older model l i l l l I 1 i i l BFN 3.3/4.3-17 Unit 1
- ___ -_-_ - ______________ __- _ _______ _ ____ - - ______ _______________n
3.5/4.5 CORE AND CONTAINMENT COOLING SYSTEMS \ l l LIMITING CONDITIONS FOR OPERATION SURVEIff.AMCE REOUIREMENTS l [ 3.5.I Averare Planar Linear Heat 4.5.I Averane Planar Linear l Generation Rate Heat Generation Rate (APLHGR) l During steady-state power operation, The APLEGR shall be checked i the Average Planar Linear Heat daily during reactor l Generation Rate (APLHGR) of any fuel operation at 1 25% rated assembly at any axial location shall thermal power. not exceed the appropriate rated, flow-dependent or power-dependent APLHGR limit provided in the CORE OPERATING LIMITS REPORT. If at any time during steady state operation it is determined by normal surveillance that the limiting value ' for APLHGR is being exceeded, action shall be initiated within 15 minutes i to restore operation to within the prescribed limits. If the APLHGR is i not returned to within the prescribed limits within two (2) hours, the reactor shall be brought to the COLD SHUTDOWN CONDITION within 36 hours. Surveillance and corresponding action shall continue until reactor operation is within the prescribed limits. , I J. Linear Heat Generation Rate (LHGR) J. Linear Heat Generation Rate (LHGR) l l l During steady-state power operation, The LHGR shall be checked ' i l the linear heat generation rate daily during reactor operation (LHGR) of any rod in any fuel at 1 25% rated thermal power. assembly at any axial location shall not exceed the appropriate LHGR limit provided in the CORE OPERATING LIMITS REPORT. l l l BrN 3.5/4.5-18 Unit 1
3.5/4.5 CORE AND CONTAINMENT COOLING SYSTEMS LIMITING CONDITIONS FOR OPERATION SURVEITIANCE REOUIREMENTS 3.5.J Linear Heat Generation Rate (LHCR) 4.5.J Linear Heat Generation Rate (LHGR) 3.5.J (Cont'd) If at any time'during steady-state operation it is determined by normal surveillance that the limiting value for LHGR is being exceeded, action shall be initiated within 15 minutes to restore operation to within the prescribed limits. If the LHGR is not returned to within the prescribed limits within two (2) hours, the reactor shall be brought to the COLD SHUTDOWN CONDITION within 36 hours. Surveillance and corresponding action shall continue until reactor operation is within the prescribed limits. , 3.5.K Minimum Critical Power Ratio 4.5.K Minimum Critical Power (MCPR) Ratio (MCPR) The minimum critical power ratio 1. MCPR shall be checked daily (MCPR) shall be equal to or during reactor power greater than the appropriate operation at 1 25% rated rated, flow-dependent or thermal power and following power-dependent operating limit any change in power level MCPR (OLMCPR) as provided in the or distribution that would CORE OPERATING LIMITS REPORT. cause operation with a If at any time during LIMITING CONTROL ROD steady-state operation it is PATTERN. determined by normal surveillance that the limiting 2. The operating limit MCPR l value for MCPR is being shall be determined as exceeded, action shall be provided in the CORE initiated within 15 minutes to OPERATING LIMITS REPORT restore operation to within the using: prescribed limits. If the steady-state MCPR is not returned to within the prescribed limits within two (2) a. p b as defined in the hours, the reactor shall be CORE OPERATING LIMITS j brought to the COLD SHUTDOWN REPORT prior to initial ! CONDITION within 36 hours, scram time measurements surveillance and corresponding for the cycle, action shall continue until performed in accordance reactor operation is within the with Specification prescribed limits. 4.3.C.1. l BFN 3.5/4.5-19 Unit 1
3.5/4.5 CORE AND CONTAINMENT COOLING SYSTE!13, I LIMITING CONDITIONS FOR OPERATION SURVEILLANCE REOUIREMENTS
]
3.5.K Minimum Critical Power Ratio 4.5.K Minimum Critical Power I (MCPR) Ratio (MCPR) 4.5.K.2 (Cont'd)
- b. &[/ as defined in the CORE OPERATING LIMITS REPORT following the conclusion of each scram-time surveillance test required by Speci-fications 4.3.C.1 and 4.3.C.2.
The determination of the limit must be completed within 72 hours of each scram-time surveillance required by Specification 4.3.C. L. APRM Setooints L. APRM Setooints (Deleted) { (Deleted) -{ i BFN 3.5/4.5-20 i Unit 1
3.5. R&1El (Cont'd) 3.5.I. Averane Planar Linear Heat Generation Rate (APLHCR) This specification assures that the peak cladding temperature following the postulated design basis loss-of-coolant accident will not exceed the limit specified in the 10 CFR 50, Appendix K. ; The peak cladding temperature following a postulated loss-of-coolant , accident is primarily a function of the average heat generation rate
.of all the rods of a fuel, assembly at any axial location and is only dependent secondarily on the rod-to-rod power distribution within an assembly. Since expected local variations in power distribution within a fuel assembly affect the calculated peak clad temperature by less than i 20*F relative to the peak temperature for a typical fuel design, the limit on the average linear heat generation rate is sufficient to assure that cal'culated temperatures are within the ,
10 CFR 50 Appendix K limit. . At less than rated power conditions, the rated APLHGR limit is adjusted by a power dependent correction. factor, MAPFAC(P). At less than rated flow conditions, the rated APLEGE limit is adjusted by a flow dependent correction factor, MAPFAC(F). The most limiting power-adjusted or flow-adjusted value is taken as the APLEGR operating limit for the off-rated condition. ; The flow dependent correction factor, MAPFAC(F), applied to the rated APLEGR limit assures that (1) the 10 CFR 50.46 limit would not be exceeded during a LOCA initiated from less than rated core flow conditions and (2) the fuel thermal mechanical design criteria would ! be met during abnormal operating transients initiated from less than l rated core flow conditions. MAPTAC(F) values are provided in the CORE ; OPERATING LIMITS REPORT. ! The power dependent correction-factor, MAPFAC(P), applied to the rated APLHGR limit assures that the fuel thermal mechanical design criteria ; would be met during abnormal operating transients initiated from less than rated power conditions. MAPFAC(P) values are provided in the ' CORE OPERATING LIMITS REPORT. 3.5.J. Linear Heat Generation Rate (LHGR) This specification assures that the linear heat generation rate in any rod is less than the design linear heat generation if fuel pellet densification is postulated. i The LHGR shall be checked daily during reactor operation at 1 25 percent power to determine if fuel burnup, or control rod l movement has caused changes in power distribution. For LHGR to be a limiting value below 25 percent of rated thermal power, the largest total peaking would have to be greater than approximately 9.7 which is precluded by a considerable margin when employing any permissible , control rod pattern. BFN 3.5/4.5-33 Unit 1 i J
3.5 BASES (Cont'd) 3.5.K. Minimum Critical Power Ratio (MCPR) At core thermal power levels less than or equal to 25 percent, the reactor will be operating at minimum recirculation pump speed and the moderator void content will be very small. For all designated control rod patterns which may be employed at this point, operating plant experience and thermal hydraulic analysis indicated that the resulting MCPR value is in excess of requirements by a considerable margin. With this low void content, any inadvertent core flow increase would only place operation in a more conservative mode relative to MCPR. The daily requirement for calculating MCPR above 25 percent rated thermal power is sufficient since power distribution shifts are very slow when there have not been significant power or control rod channes. The requirement for calculating MCPR when a limiting control rod pattern is approached ensures that MCPR will be known following a change in power or power shape (regardless of magnitude) that could place operation at a thermal limit. At less than rated power conditions, a power dependent MCPR operating limit, MCPR(P), is applicable. At less than rated flow contltions, a flow dependent MCPR operating limit, MCPR(F), is applicable. The most limiting power dependent or flow dependent value is taken as the MCPR l operating limit for the off-rated condition. The flow dependent limit, MCPR(F), provides the thermal margin required to protect the fuel from transients resulting from inadvertent core flow increases. MCPR(F) values are provided in the CORE OPERATING LIMITS REPORT. The power dependent limit, MCPR(P), protects the fuel from the other limiting abnormal operating transients, including localized events such as a rod withdrawal error. MCPR(P) values are provided in the CORE OPERATING LIMITS REPORT. 3.5.L. APRM Setooints I
~
(Deleted) l 3.5.M. Core Thermal-Hydraulic Stability The minimum margin to the onset of thermal-hydraulic instability occurs in Region I of Figure 3.5.M-1. A manually initiated scram upon entry into this region is sufficient to preclude core oscillations which could challenge the MCPR safety limit. Because the probability of thermal-hydraulic oscillations is lower and the margin to the MCPR safety limit is greater in Region II than in Region I of Figure 3.5.M-1, an immediate scram upon entry into the region is not necessary. However, in order to minimize the probability of core instability following entry into Region II, the operator will take immediate action to exit the region. Although formal surveillances are not performed while exiting Region II BFN 3.5/4.5-34 Unit 1
.-. .- . . -. . . . ~ , . . _ ~
3 c b 3.5 BASES (Cont'd) I i (delaying exit for surveillances is undesirable), an inanediate manual scram will be initiated if evidence of thermal-hydraulic instability is observed. Clear indications of thermal-hydraulic instability are APRM oscillations which exceed 10 percent peak-to-peak or LPRM oscillations which exceed 30 percent peak-to-peak (approximately equivalent to APRM oscillations of 10 percent during regional oscillations). Periodic LPRM upscale or downscale alarms may also be indicators of thermal hydraulic instability and will be inusediately investigated. Periodic upscale or downscale LPRM alarms will occur before regional oscillations are large enough to threaten the MCPR safety limit. Therefore, the criteria for initiating a manual scram described in the preceding paragraph are sufficient to ensure that the MCPR safety limit will not be violated in the event that core oscillations t initiate while exiting Region II. Normal operation. of the reactor is restricted to thermal power and core flow conditions (i.e., outside. Regions I and II) where thermal-hydraulic instabilities are very unlikely to occur. 3.5.N. References
- 1. " Fuel Densification Effects on General Electric Sofling Water '
Reactor Fuel," Supplements 6, 7, and 8, NEIM-10735, August 1973. '
- 2. Supplement I to Technical Report on Densification of General -
Electric Reactor Fuels, December 14, 1974 (USA Regulatory Staff).
- 3. Communication: V. A. Moore to I. S. Mitchell, " Modified GE Model for Fuel Densification," Docket 50-321, March 27, 1974. )
1
- 4. Generic Reload Fuel Application, Licensing Topical Report, I NEDE-24011-P-A and Addenda.
- 5. Letter from R. H. Buchholz (GE) to P. S. Check (NRC), " Response to 1 NRC Request For Information On ODYN Computer Model," September 5, l 1980.
4.5 Core and Containment Coolina Syst=== Surveillance Freauencies
)
l 1 The testing interval-for the core and containment cooling systems is l based on industry practice, quantitative reliability analysis, judgment and practicality. The core cooling systems have not been designed to be fully testable during operation. For example, in the-ease of the HPCI, automatic initiation during power operation would result in pumping cold water into the reactor-vessel which is not desirable. Complete ADS testing during power operation causes an undesirable loss-of-coolant inventory. To increase the availability of the core and containment cooling system, the components which make up the system, i.e., instrumentation, pumps, valves, etc., are tested frequently. The pumps and motor operated injection valves are also BFN 3.5/4.5-35 l Unit 1 I i
l 4.5 BASES (Cont'd) tested in accordance with Specification 1.0.MM to assure their OPERABILITY. A simulated automatic actuation test once each cycle combined with testing of the pumps and injection valves in accordance with Specification 1.0.MM is deemed to be adequate testing of these systems. Monthly alignment checks of valves that are not locked or i sealed in position which affect the ability of the systems to perform { their intended safety function are also verified to be in the proper I position. Valves which automatically reposition themselves on an )' initiation signal are permitted to be in a position other than normal to facilitate other operational modes of the system. When components and subsystems are out-of-service, overall core and containment cooling reliability is maintained by OPERABILITY of the l remaining redundant equipment. j Whenever a CSCS system or loop is made inoperable, the other CSCS systems or loops that are required to be OPERABLE shall be considered,0PERABLE if I they are within the required surveillance testing frequency and there is I no reason to suspect they are inoperable. If the function, system, or loop under test or calibration is found inoperable or exceeds the trip level setting, the LCO and the required surveillance testing for the system or loop shall apply. l l l Avermae Planar LHGR. LHCR. and MCPR The APLHGR, LHGR, and MCPR shall be checked daily to determine if fuel burnup, or control rod movement has caused channes in power I distribution. Since changes due to burnup are slow, and only a few control rods are moved daily, a daily check of power distribution is adequate. [ 1 I I BFN 3.5/4.5-36 l Unit 1
l 1 i l i THIS PAGE INTENTIONALLY LEIT BLANK l l l l I BR 3,5f4,$_37 Unit 1
r l L 1 6.9.1.5 ANNUAL RADIOLOGICAL ENVIRONMENTAL OPERATING REPORT The Annual Radiological Environmental Operating Report covering l the operation of the unit during the previous calendar year shall be submitted before May 1 of each year. A single ] I ! submittal may be made for a multi-unit station. The report shall include summaries, interpretations, and analysis of trends of the results of the Radiological Environmental Monitoring Program for the reporting period. The material provided shall be consistent with the objectives outlined in (1) the ODCM and l (2) Sections IV.B.2 IV.B.3, and IV.C of Appendix I to 10 CFR Part 50. 6.9.1.6 SOURCE TESTS Results of required leak tests performed on sources if the tests l reveal the presence of 0.005 microcurie or more of removable contamination. l 6.9.1.7 CORE OPERATING LIMITS REPORT
- a. Core operating *timits shall be established and shall be documented 6 the CORE OPERATING LIMITS REPORT prior to each operatir.g cycle, or prior to any remaining portion of an operati.ng cycle, for the following:
(1) The rated APLHGR limit; the Flow Dependent APLEGE Factor, MAPFAC(F); and the Power Dependent APLHGR Factor, MAPFAC(P) for Specification 3.5.I. (2) The LHGR limit for Specification 3.5.J l (3) The rated MCPR Operating Limit; the Flow Dependent MCPR l Operating Limit, MCPR(F); and the Power Dependent MCPR Operating Limit, MCPR(P) for Specification 3.5.K/4.5.K. 1 i BFN 6.0-26a I Unit 1
i (4) The APRM flow biased rod block trip setting for Specification 2.1.A.1.c and Table 3.2.C. (5) The RBM downscale trip setpoint, high power trip setpoint, intermediate power trip setpoint, low power trip setpoint, and applicable reactor thermal power ranges for each of the setpoints for Table 3.2.C.
- b. The analytical methods used to determine the core operating limits shall be those previously reviewed nnd apfroved by the NRC, specifically those described in General Electric Licensing Topical Report NEDE-24011-P-A, " General Electric Standard Application for Reactor Fuel" (latest approved version).
- c. The core operating limits shall be determined such that all applicable limits (e.g., fuel thermal-mechanical limits, core thermal-hydraulic limits, ECCS limits, nuclear limits such as shutdown margin limits, transient analysis limits, and accident analysis limits) of the safety analysis are met.
- d. The CORE OPERATING LIMITS REPORT, including any midcycle revisions or supplements, shall be provided upon issuance for each reload cycle to the NRC.
6.9.1.8 THE ANNUAL RADIDACTIVE EFFLUENT RELEASE REPORT The Annual Radioactive Effluent Release Report covering the i operation of the unit during the previous calendar year of , operation shall be submitted by April 1, of each year. The report shall include summaries of the quantities of radioactive liquid and gaseous effluents and solid waste released from the i unit. A single submittal may be made for a multi-unit station. i BrN ' 6.0-26b I Unit 1 l
l J." - - m m - I TABLE 3.2.C INSTRUMENTATION THAT INITIATES ROD BLOCKS c tn "E
$ Minimum Operable ~
Channels Per Trio Function (51 Function Trio Level Settina 3(1) APRM Upscale (Flow Blas) (2) j 3(1) APRM Upscale (Startup Mode) (8) 112% 3(1) APRM Downscale (9) 13% i 3(1) APRM Inoperative (10b) 2(7) RBM Upscale (Power Blas) Low Power Range (13) (14) Intermediate Power Range (13) (14) High Power Range (13) (14) 2(7) RBM Downscale (9) (13) (15) l 2(7) RBM Inoperative (10c) 6(1) IRM Upscale (8) 1108/125 of full scale
, 6(1) IRM Downscale (3)(8) 15/125 of full scale 6(1) IRM Detector not in Startup Position (8) (11) 1 w l 6(1) IRM Inoperative (8) (10a)
SRM Upscale (8) 5 l 3(1) (6) i 1X10 counts /sec. l 3(1) (6) SRM Downscale (4)(8) 13 counts /sec. 3(1) (6) SRM Detector not in Startup Position (4)(8) (11) 3(1) (6) SRM Inoperative (8) (10a) 1 Rod Block Logic N/A 1(12) High Water Level in West 125 gal. Scram Discharge Tank (LS-85-45L) 1(12) High Water Level in East 125 gal. Scram Discharge Tank (LS-85-45M)
NOTES FOR TABLE 3.2.C
- 1. The minimum number of operable channels for each trip function is detailed for the startup and run positions of the reactor mode selector switch. The SRM, IRM, and APRM (startup mode), blocks need not be operable in "run" mode, and the APRM (flow biased) rod blocks need not be operable in "startup" mode.
With the number of OPERABLE channels less than required by the minimum OPERABLE channels per trip function requirement, place at least one inoperable channel in the tripped condition within one hour.
- 2. The trip level setting shall be as specified in the CORE OPERATING LIMITS REPORT.
- 3. IRM downscale is bypassed when it is on its lowest range.
- 4. SRMs A and C downscale functions are bypassed when IBMs A, C, E, and G are above range 2. SRMs B and D downscale function is bypassed when IRMs B, D, F, and H are above range 2.
SRM detector not in startup position is bypassed when :he count rate is 1100 CPS or the above condition is satisfied. S. During repair or calibration of equipment, not more thin one SEM, RBM or APRM channel nor more than two IRM channels may be bypassed. Bypassed channels are not counted as operable chanacis to meet the minimum operable channel requirements. Refer to section 3.10.B for SRM requirements during core alterations.
- 6. IRM channels A, E, C, G all in range 8 or a bove bypasses SRM channels A and C functions.
IRM channels B, F, D, H all in range 8 or above bypasses SRM channels B and D functions.
- 7. The following operational restraints apply to the RBM only,
- a. Both RBM channels are bypassed when reactor power is A30 percent or when a peripheral control rod is selected. l
- b. The RBM need not be operable in the "startup" position of the reactor mode selector switch.
- c. The RBM need not be OPERABLE if either of the following two conditions is met:
)
(1) Reactor thermal power is 190 percent of rated and MCPR is 11.40, or (2) Reactor thermal power is (90 percent of rated and MCPR is 11.70. 1 i l BFN 3.2/4.2-26 Unit 1 i
E I~ p NOTES FOR TARTE 3.2.C (Cont'd) f i
- d. Two RBM channels are provided and only one of these may be_ l j bypassed from the console. If the inoperable channel cannot i be restored within 24 hours, the inoperable channel shall be [
placed in the tripped condition within one hour. !
- e. With both RBM channels inoperable, place at least one_ l inoperable rod block monitor channel in the tripped condition ,
within one hour. :
- 8. This function is bypassed when the mode switch is placed in RUN. ;
- 9. This function is only active when the mode switch is in RUN. This function is automatically bypassed when the IRM instrumentation is ;
OPERABLE and not high. ;
- 10. The inoperative trips are produced by the following functions:
- a. SRM and IRM '
(1) Local " operate-calibrate" switch not in operate. l (2) Power supply voltage low. (3) Circuit boards not in circuit. l
- b. APRM ,
(1) Local " operate-calibrate" switch not in operate. (2) Less than the required minimum number of LPRM inputs. -l l (3) APRM module unplugged. l f (4) Self-tested detected critical fault. l l I
- c. RBM l (1) Local " operate-calibrate" switch not in operate. !
.l (2) RBM module unplugged.
l l (3) RBM fails to null. ! (4) Less than required number of LPRM inputs for rod selected. 7 i (5) Self-test detected critical fault. l l
- 11. Detector traverse is adjusted to 114 i 2 inches, f.eeing the detector ;
lower position 24 inches below the lower core plaa. i BFN 3.2/4.2-27 i Unit 1 ! i
NOTES FOR TARM 3.2.C (Cont'd)
- 12. This function may be bypassed in the SHUTDOWN or REFUEL mode. If this function is inoperable at a time when OPERASILITY is required the channel shall be tripped or administrative controls shall be immediately. imposed to prevent control rod withdrawal.
- 13. The RBM rod block trip setpoints and applicable power ranges are specified in the CORE OPERATING LIMITS REPORT (COLR).
- 14. Less than or equal to the setpoint allowable value specified in the COLR. ,
l 15. Greater than or equal to the setpoint allowable value specified in the COLE. l l l I i l l I i BFN 3.2/4.2-27a Unit 1 i l J
,i ., THIS PAGE INTENTIONALLY LEFT BLANK i l l i 1 l I Em 3.2/4.2-27b Unit 1
l
- TABLE 4.2.C l SURVEILLANCE REQUIREMENTS FOR INSTRUNENTATION THAT INITIATE R00 BLOCKS Function Functional Test Calibration (171 Instrument Check APRM Upscale (Flow Blas) (1) (13) once/ operating cycle once/ day (8) l APRM Upscale (Startup Mode) (1) (13) once/ operating cycle once/ day (8) l l
l APRM Downscale (1) (13) once/ operating cycle once/ day (8) l APRM Inoperative (1) (13) N/A once/ day (8) l RBM Upscale (Power Blas) (1) (13) once/ operating cycle N/A l RBM Downscale (1) (13) once/ operating cycle N/A l RBPt Inoperative (1) (13) N/A N/A l IRM Upscale (1)(2) (13) once/3 months once/ day (8) IRM Downscale (1)(2) (13) once/3 months once/ day (8) k IRM Detector not in Startup Position (2) (once/ operating cycle) once/ operating cycle (12) N/A
- IRM Inoperative (1)(2) (13) N/A N/A g SRM Upscale (1)(2) (13) once/3 senths once/ day (8)
SRM Downscale (1)(2) (13) once/3 months once/ day (8) SRM Detector not in Startup Position (2) (once/ operating cycle) once/ operating cycle (12) N/A SRM Inoperative (1)(2) (13) N/A N/A Rod Block Logic (16) N/A N/A West Scram Discharge once/ quarter once/ operating cycle N/#. Tank Water Level High (LS-8S-45L) East Scram Discharge once/ quarter once/ operating cycle N/A Tank Water Level High (LS-85-45N)
NOTES FOR TABLES 4.2.A THROUGH 4.2.L excent 4.2. D AND 4.2.K
- 1. For IRMs and SRMs functional tests shall be performed once per month.
For APRMs and RBMs functional tests shall be performed once per 6 months.
- 2. Functional tests shall be performed before each startup with a required frequency not to exceed once per week.
- 3. This instrumentation is excepted from the functional test definition.
The functional test will consist of injecting a simulated electrical signal into the measurement channel.
- 4. Tested during logic system functional tests.
- 5. Refer to Table 4.1.B.
- 6. The logic system functional tests shall include a calibration once per operating cycle of time delay relays and timers necessary for proper functioning of the trip systems.
- 7. The functional test will consist of verifying continuity across the inhibit with a volt-ohameter.
- 8. Instrument checks shall be performed in accordance with the definition of instrument check (see Section 1.0, Definitions). An instrument check is not applicable to a particular setpoint, such as Upscale, but is a qualitative check that the instrument is behaving and/or indicating in an acceptable manner for the particular plant condition. Instrument check is included in this table for convenience and to indicate that an instrument check will be performed on the instrument. Instrument checks are not required when these instruments are not required to be OPERABLE or are tripped.
- 9. Calibration frequency shall be once/ year.
- 10. Deleted
- 11. Portion of the logic is functionally tested during outage only.
- 12. The detector will be inserted during each operating cycle and the proper amount of travel into the core verified.
- 13. Functional test will consist of applying simulated inputs (see note 3).
Local alarm lights representing upscale and downscale trips will be verified, but no rod block will be produced at this time. The inoperative trip will be initiated to produce a rod block (SRM and IRM inoperative also bypassed with the mode switch in RUN). The functions that cannot be verified to produce a rod block directly will be verified during the operating cycle. BFN 3.2/4.2-59 Unit 1
NOTES FOR TABLES 4.2.A THROUGH 4.2.L except 4.2.D AND 4.2.K (Cont'd)
- 14. (Deleted)
- 15. (Deleted) _
- 16. Performed during operating cycle. Portions of the logic is checked more frequently during functional tests of the functions that produce a rod block.
- 17. This calibration consists of removing the function from service and performing an electronic calibration of the channel.
- 18. Funutional test is limited to the condition where secondary containment integrity is not required as specified in Sections 3.7.C.2 and 3.7.C.3.
- 19. Functional test is limited to the time where the SGTS is required to meet the requirements of Section 4.7.C.1.a. !
l
- 20. (Deleted) -
- 21. Logic test is limited to the time where actual operation of the equipment is permissible.
- 22. (Deleted)
- 23. (Deleted)
- 24. This instrument check consists of comparing the thermocouple readings for all valves for consistence and for nominal expected values (not required during refueling outages).
- 25. During each refueling outage, all acoustic monitoring channels shall be l calibrated. This calibration includes verification of accelerometer response due to mechanical excitation in the vicinity of the sensor.
I BFN 3.2/4.2-60 Unit 1
3.2 BASES (Cont'd) The control rod block functions are provided to generate a trip signal to block rod withdrawal if the monitored power level exceeds a preset value. The trip logic for this function is 1-out-of-n: e.g., any trip on one of four APRMs, eight IRMs, or four SRMs will result in a rod block. The minimum instrument channel requirements assure sufficient instrumentation to assure the single failure criteria is met. The i minimum instrument channel requirements for the RBM may be reduced by one for maintenance, testing, or calibration. This does not significantly increase the risk of an inadvertent control rod withdrawal, as the other channel is available, e.nd the RBM is a. backup system to the written sequence for withdrawal of control rods. The APRM rod block function is , flow biased and provides a trip signal for blocking rod withdrawal when average reactor thermal power exceeds pre-established limits set to prevent scram actuation. The RBM rod block function provides local protection of the core; i.e., the prevention of critical power in a local region of the core,'for a single rod withdrawal error from a limiting contr'o1 rod pattern. If the IRM channels are in the worst condition of allowed bypass,'the sealing arrangement is such that for unbypassed IRM channels, a rod block signal is generated before the detected neutrons flux has increased by more than a factor of 10. A downscale indication is an indication the instrument has failed or the instrument is not sensitive enough. In either case the in'strument will not respond to changes in control rod motion and thus, control rod motion is prevented. The refueling interlocks also operate one logic channel, and are required for safety only when the mode switch is in the refueling position. For effective emergency core cooling for small pipe breaks, the HPCI system must function since reactor pressure does not decrease rapid enough to allow either core spray or LPCI to operate in time. The automatic pressure relief function is provided as a backup to the HPCI in the event the HPCI does not operate. The arrangement of the tripping contacts is such as to provide this function when necessary and minimize spurious operation,' The trip settings given in the specification are adequate to assure the above criteria are met. The specification preserves the effectiveness of the system during periods of maintenance, testing, or calibration, and also minimizes the risk of inadvertent i operation; i.e., only one instrument channel out of service. Two radiation monitors are providau ?nt each unit which initiate Primary Containment Isolation (Group 6 isolation valves) Reactor Building Isolation and operation of the Standby Gas Treatment System. These instrument channels monitor the radiation in the reactor zone ventilation exhaust ducts and in the refueling zone. I BFN 3.2/4.2-68 Unit 1
V + 4.2 BAET4 (Cont'd) The conclusions to be drawn are these
- 1. A 1-out-of-n system may be treated the same as a single channel in terms of choosing a test interval; and
- 2. more than one channel should not be bypassed for testing at any one time.
The radiation monitors in the reactor and refueling zones which initiate building isolation and standby gas treatment operation are arranged such that two sensors high (above the high level setpoint) in a single channel or one sensor downscale (below low level setpoint) or inoperable in two channels in the same zone will initiate a trip func: ion. The functional testing frequencies for both the channel functional test and the high voltage power supply functional test are based on a Probabilistic Risk Assessment and system drift characteristics of the Reactor Building Ventilation Erdiation Monitors. The calibration frequency is based upon the drift characteristics of the radiation monitors. The automatic pressure relief instrumentation can be considered to be a 1-out-of-2 logic system and the discussion above applies also. The RCIC and HPCI system logic tests required by Table 4.2.B contain provisions to demonstrate that these systems will automatically restart on a RPV low water level signal received subsequent to a RPV high water level trip. The electronic instrumentation comprising the APRM rod block and Rod Block Monitor functions together with the recirculation flow instrumentation for flow bias purposes is monitored by the same self-test functions as applied to the APRM function for the RPS. The functional test frequency of every six months is based on this automatic self-test monitoring at 15 minute intervals and on the low expected equipment failure rates. Calibration frequency of once per operating cycle is based on the drift characteristics of the limited number of analog components, recognizing that most of the processing is performed digitally without drift of setpoint values. BFN 3.2/4.2-73 Unit 1
, - - - e .w - - - m .
3.3/4.3 REACTIVITY CONTROL LIMITING CONDITIONS FOR OPERATION SURVEILLANCE REOUIREMENTS 3.3.B. Control Rods 4.3.B. Control Rode 3.c. If Specifications 3.3.B.3.b.1 3.b.3 When the RWM is not 4 through 3.3.B.3.b.3 cannot OPERABLE a second be met the reactor shall licensed operator not be started, or if the or other technically reactor is in the RUN or qualified member of , startup modes at less than the plant staff shall 10% rated power, control rod verify that the correct movement may be only by rod program is followed. actuating the manual scram , or placing the reactor mode switch in the shutdown position.
- 4. Control rods shall not be 4. Prior to control rod ,
withdrawn for startup or withdrawal for startup refueling unless at least or during refueling, two source range channels verify that at least two have an observed count rate source range channels equal to or greater than have an observed count three counts per second. rate of at least three counts per second. h 5. (Deleted) 5. (Deleted) y l BFN 3.3/4.3-8 Unit 1 I l l i
3.3/4.3 BASES (Cont'd) C. Scram Insertion Times i The control rod system is designated to bring the reactor suberitical at ! the rate fast enough to prevent fuel damage; i.e., to prevent'the MCPR from becoming less than 1.07. The limiting power transient is given in Reference 1. Analysis of this transient shows that the negative reactivity rates resulting from the scram with the average response of all the drives as given in the above specification provide the required protection, and MCPR remains greater than 1.07. On an early BWR, some degradation of control rod scram performance ! occurred during plant startup and was determined to be caused by particulate material (probably construction debris) plugging an internal
~
I control rod drive filter. The design of the present control rod drive , (Model 7RDB144B) is grossly improved by the relocation of the filter to a location out of the scram drive path; i.e., it can no longer interfere with scram performance, even if completely blocked. The degraded performance of the original drive (CRD7RDB144A) under dirty > operating conditions and the insensitivity of the redesigned drive (CRD7RDB144B) has been demonstrated by a series of engineering tests under simulated reactor operating conditions. The successful performance : of the new drive under actual operating conditions has also been ! demonstrated by consistently good in-service test results for plants ' using the new drive and may be inferred from plants using the older model t i l 1 BTN 3.3/4.3-17 UL.it 1
3.5/4.5 CORE AND CONTAINMENT COOLING SYSTEMS LYMITING CONDITIONS FOR OPERATION SURVEILLANCE REOUIREMENTS I 3.5.I Avermae Pl===r Linear Heat 4.5.I Averaae Pl===r Linear Generation Rate Heat Generation Rate { (APLHGR) t During steady-state power operation, The APLHGR shall be checked ! the Average Planar Linear Heat daily during reactor ! Generation Rate (APLHGR) of any fuel operation at 1 23% rated .! assembly at any axial location shall thermal power. ! not exceed,the appropriate rated, ; flow-dependent or power-dependent i APLHCR limit provided in the CORE 3 OPERATING LIMITS REPORT. If at any time during steady state operation ) it is determined by normal ; survelliance that the limiting value for APLHGR is being exceeded, action shall be initiated within 15 minutes to restore operation to within the prescribed limits. If the APLHGR is not returned to within the prescribed i limits within two (2) hours, the reactor shall be brought to the COLD ! SHUTDOWN CONDITION within 36 hours. ! Surveillance and corresponding ' action shall continue until reactor operation is within the prescribed limits. J. Linear Heat Generation Rate (LHGR) J. Linear Heat Generation Ratg_ (LHGR) During steady-state power operation, The LHGR shall be checked the linear heat generation rate daily during reactor operation (LHGR) of any rod in any fuel at 1 25% rated thermal power. assembly at any axial location shall not exceed the appropriate LHGR l limit provided in the CORE OPERATING l LIMITS REPORT. l l BFN 3.5/4.5-18 Unit 1
r 3.5/4.5 CORE AND CONTAINMENT COOLING SYSTEMS LIMITING CONDITIONS FOR OPERATION SURVEITf.AMCE REOUIREMENTS 3.5.J Linear Heat Generation Rate (LHGR) 4.5.J Linear Heat Generation Rate (LHGR) 3.5.J (Cont'd) If at any time during steady-state operation it is determined by normal surveillance that the limiting value for LHGR is being ' exceeded, action shall be initiated within 15 minutes to restore operation to within the prescribed limits. If the LHGR is not returned to within the prescribed limits within two (2) hours, the reactor shall be brought to the COLD SHUTDOWN CONDITION within 36 hours. Surveillance and corresponding action shall continue until reactor operation is within the prescribed limits. 3.5.K Minimum Critical Power Ratio 4.5.K Minimum Critical Power (MCPR) Ratio (MCPR) The minimum critical power ratio 1. MCPR shall be checked daily (MCPR) shall be equal to or during reactor power greater than the appropriate operation at 1 25% rated rated, flow-dependent or thermal power and following power-dependent operating limit any change in power level MCPR (OLMCPR) as provided in the or distribution that would CORE OPERATING LIMITS REPORT. cause operation with a If at any time during LIMITING CONTROL ROD steady-state operation it is PATTERN. determined by normal , surveillance that the limiting 2. The operating limit MCPR l value for MCPR is being shall be determined as exceeded, action shall be provided in the CORE initiated within 15 minutes to OPERATING LIMITS REPORT restore operation to within the using: prescribed limits. If the steady-state MCPR is not returned to within the ' prescribed limits within two (2) a. b as defined in the hours, the reactor shall be CORE OPERATING LIMITS brought to the COLD SHUTDOWN REPORT prior to initial CONDITION within 36 hours, scram time measurements surveillance and corresponding for the cycle, ' action shall continue until performed in accordance ! reactor operation is within the with Specification prescribed limits. 4.3.C.1. BFN 3.5/4.5-19 Unit 1 1
3.5/4.5 CORE AND CONTAIMMENT COOLING SYSTEMS LIMITING CONDITIONS FOR OPERATION SURVEIT.T.AMCE REOUIREMENTS 3.5.K Minimum Critical Power Ratio 4.5.K Minimum Critical Power (MCPR) Ratio (MCPR) 4.5.K.2 (Cont'd)
- b. Dasdefinedinthe CORE OPERATING LIMITS REPORT following the ,
conclusion of each ] scram-time surveillance j test required by Speci-fications 4.3.C.1 and ; 4.3.C.2. j The determination of the limit must be completed within 72 ) hours of each J scram-time surveillance I required by Specification 4.3.C. ] q I L. APRM Setooints L. APRM Setooints h (Deleted) (Deleted) ] 4 BFN 3.5/4.5-20 Unit 1 i J
. , , . . . . . - - - . - - - .- - .- . . - . . ~ _ ~.- -
f 3.5 RASES (Cont'd)
~
3.5.I. Averman Planar Linear Heat Generation Rate (APLHCR) This specification assures that the peak cladding temperature ; following the postulated design basis loss-of-coolant accident will I not exceed the limit specified in the 10 CFR 50, Appendix K. ; t Thetpeak cladding temperature following a postulated loss-of-coolant accident is primarily a function of the average heat generation rate ! of all_the rods of a fuel, assembly at any axial location and is only i dependent secondarily on the rod-to-rod power distribution within an : , assembly. Since expected local _ variations in power distribution l within a fuel assembly affect the calculated peak clad temperature by ; less than i 20*F relative to the peak temperature for a typical _ fuel .i' design, the limit on the average linear heat generation rate is sufficient to assure that cal'culated' temperatures are within the 10 CFR 50 Appendix K limit. i At less than rated power conditions, the rated APLHGR 1 Lait is_ f adjusted by a power dependent correction factor, MAPEAC(P). At less than rated flow conditions, the rated APLHGR limit is adjusted by a flow dependent correction factor, MAPFAC(F). The most limiting power-adjusted or flow-adjusted value is'taken as the APLEGR operating , limit for the off-rated condition. i
-The flow dependent correction factor, MAPEAC(F), applied to the rated ;
APLHGR limit assures that (1) the 10 CFR 50.46 limit would not be, ! exceeded during a LOCA initiated from less'than rated core flow conditions and (2) the fuel thermal mechanical design criteria would be met during abnormal operating transients initiated from less than rated core flow conditions. MAPFAC(F) values are provided in the CORE , OPERATING LIMITS REPORT. 1 i The power dependent correction factor, MAPTAC(P), applied to the rated l APLHGR limit assures that the fuel thermal mechanical design criteria ; would be met during abnormal operating transients initiated from less than rated power conditions. MAPFAC(P) values are provided in the . CORE OPERATING LIMITS REPORT. ; 3.5.J. Linear Heat Generation Rate (LHCR) This specification assures that the linear heat generation rate in any rod is less than the design linear heat generation if fuel pellet , densification is postulated. The LHGR shall be checked daily during reactor operation at 1 25 percent power to determine if fuel burnup, or control rod , movement has caused changes in power distribution. For LHGR to be a limiting value below 25 percent of rated thermal power, the largest , total peaking would have to be greater than approximately 9.7 which is l precluded by a considerable margin when employing any permissible I control rod pattern. BFN 3.5/4.5-33 Unit 1 i l l
3.5 BAREE (Cont'd) 3.5.K. Minimum Critical Power Ratio (MCPR) At core thermal power levels less than or equal to 25 percent, the reactor will be operating at minimum recirculation pump speed and the moderator void content will be very small. For all designated control rod patterns which may be employed at this point, operating plant experience and thermal hydraulic analysis indicated that the resulting MCPR value is in excess of requirements by a considerable margin. With this low void content, any inadvertent core flow increase would only place operation in a more conservative mode relative to MCPR. The daily requirement for calculating MCPR above 25 percent rated thermal power is sufficient since power distribution shifts are very slow when there have not been significant power or control rod changes. The requirement for calculating MCPR when a limiting control rod pattern is approached ensures that MCPR will be known following a change in power or power shape (regardless of magnitude) that could place operation at a thermal limit. At less than rated power conditions, a power dependent MCPR operating limit, MCPR(P), is applicable. At less than rated flow conditions, a flow dependent MCPR operating limit, MCPR(F), is applicable. The most limiting power dependent or flow dependent value is taken as the MCPR operating limit for the off-rated condition. The flow dependent limit, MCPR(F), provides the thermal margin required to protect the fuel from transients resulting from inadvertent core flow increases. MCPR(F) values are provided in the CORE OPERATING LIMIIS REPORT. The power dependent limit, MCPR(P), protects the fuel from the other limiting abnormal operating transients, including localized events such as a rod withdrawal error. MCPR(P) values are provided in the CORE OPERATING LIMITS REPORT. 3.5.L. APRM Setooints (Deleted) 3.5.M. Core Thermal-Hydraulic Stability The minimum margin to the onset of thermal-hydraulic instability occurs in Region I of Figure 3.5.M-1. A manually initiated scram upon entry into this region is sufficient to preclude core oscillations which could challenge the MCPR safety limit. Because the probability of thermal-hydraulic oscillations is lower and the margin to the MCPR safety limit is greater in Region II than in Region I of Figure 3.5.M-1, an immediate scram upon entry into the region is not necessary. However, in order to minimize the probability of core instability following entry into Region II, the operator will take immediate action to exit the region. Although l formal surveillances are not performed while exiting Region II l I 1 BFN 3.5/4.5-34 Unit 1
v
.3.5 BASES (Cont'd)
(delaying exit for surveillances is undesirable), an ismediate manual scram will be initiated if evidence of thermal-hydraulic instability is observed. Clear indications of thermal-hydraulic instability are APRM oscillations which exceed 10 percent peak-to-peak or LPRM oscillations which exceed 30 percent peak-to-peak (approximately equivalent to APRM oscillations of 10 percent during regional oscillations). Periodic-LPRM upscale or downscale alarms may also be' indicators of thermal hydraulic instability and will be immediately investigated.
=
Periodic upscale or downscale LPRM alarms will occur before regional oscillations are large enough to threaten the MCPR safety limit. l Therefore, the criteria for initiating a manual scram described in the , I preceding paragraph are sufficient to ensure that the MCPR safety y limit will not be violated in the event that core oscillations initiate while exiting Region II. Normal operation of the reactor is restricted to thermal power and core flow conditions (i.e., outside Regions I and II) where thermal-hydraulic instabilities are very unlikely to occur. 3.5.N. References
- 1. " Fuel Densification Effects on General Electric Boiling Water Reactor Fuel," Supplements 6, 7, and 8, NEIM-10735, August 1973.
- 2. Supplement I to Technical Report on Densification of General Electric Reactor Fuels, December 14, 1974 (USA Regulatory Staff).
! 3. Communication: V. A. Moore to I. S. Mitchell, " Modified GE Model for Fuel Densification," Docket 50-321, March 27, 1974.
- 4. Generic Reload Fuel Application, Licensing Topical Report, NEDE-24011-P-A and Addenda.
- 5. Letter from R. H. Buchholz (GE) to P. S. Check (NRC), " Response to l NRC Request For Information On ODYN Computer Model," September 5, i 1980.
l l 4.5 Core and Containment Coo 11nn Svotems Surveillance Freauencies The testing interval for the core and containment cooling systems is based on industry practice, quantitative reliability analysis, judgment and practicality. The core cooling systems have not been designed to be fully testable during operation. For example, in the case of the HPCI, automatic initiation during power operation would .i result in pumping cold water into the reactor vessel which is not desirable. Complete ADS testing during power operation causes an undesirable loss-of-coolant inventory. To increase the availability of the core and containment cooling system, the components which make up the system, i.e., instrumentation, pumps, valves, etc., are tested frequently. The pumps and motor operated injection valves are also BFN 3.5/4.5-35 l Unit 1 l _ __ ___ - -_ _D
4.5 BASES (Cont'd) tested in accordance with Specification 1.0.MM to assure their OPERABILITY. A simulated automatic actuation test once each cycle combined with testing of the pumps and injection valve. in accordance with Specification 1.0.MM is deemed to be adequate testing of these systems. Monthly alignment checks of valves that are not locked or sealed in position which affect the ability of the systems to perform their intended safety function are also verified to be in the proper position. Valves which automatically reposition themselves on an initiation signal are permitted to be in a position other than normal to facilitate other operational modes of the system. When components and subsystems are out-of-service, overall core and containment cooling reliability is maintained by OPERABILITY of the remaining redundant equipment. , Whenever a CSCS system or loop is made inoperable, the other CSCS systems l or loops that are required to be OPERABLE shall be considered, OPERABLE if they are within the required surveillance testing frequency and there is no reason to suspect they are inoperable. If the function, system, or loop under test or calibration is found inoperable or exceeds the trip level setting, the LCO and the required surveillance testing for the system or loop shall apply. Averate Planar LHCR. LHGR. and MCPR The APLHGR, LHGR, and MCPR shall be checked daily to determine if fuel burnup, or control rod movement has caused changes in power distribution. Since changes due to burnup are slow, and only a few control rods are moved daily, a daily check of power distribution is adequate. BFN 3.5/4.5-36 l Unit 1 J
1 THIS PAGE INTENTIONALLY LEFT BLANK l e 4 l l 1 l l l 1 BFN 3.5/4.5-37 Unit 1 l 1 J
6.9.1.5 ANNUAL RADIOLOGICAL ENVIRONMENTAL OPERATING REPORT The Annual Radiological Environmental Operating Report covering the operation.of the unit during the previous calendar year -! shall be submitted before May 1 of each year. A single
.f submittal may be made for a multi-unit station. The report .;
shall include summaries, interpretations, and analysis of trends . of the results of the Radiological Environmental Monitoring , Program for the reporting period. The material provided shall be consistent with the objectives outlined in (1) the ODCM and (2) Sections IV.B.2, IV.B.3, and IV.C of Appendix I to 10 CFR Part 50. t 6.9.1.6 SOURCE TESTS 1 Results of required leak tests performed on sources if the tests ! I reveal the presence of 0.005 microcurie or more of removable contamination. j i s 6.9.1.7 CORE OPERATING LIMITS REPORT-
- a. Core operating limits shall be established and shall be ,
documented in the CORE OPERATING LIMITS REPORT prior to each ; operating cycle, or prior to any remaining portion of an operating cycle, for the following-i (1) The rated APLHGR limit; the Flow Dependent APLHGR Factor, MAPFAC(F); and the Power Dependent APLHGR Factor, MAPFAC(P) for Specification 3.5.I. l l (2) The LHGR limit for Specification 3.5.J l (3) The rated MCPR Operating Limit; the Flow Dependent MCPR I Operating Limit, MCPR(F); tnd the Power Dependent MCPR Operating Limit, MCPR(P) for Specification 3.5.K/4.5.K. i l BFN 6.0-26a Unit 1
1 (4) The APRM flow biased rod block trip setting for Specification 2.1.A.1.c and Table 3.2.C. (5) The RBM downscale trip setpoint, high power trip setpoint, intermediate power trip setpoint, low power trip setpoint, and applicable reactor thermal power ranges for each of the setpoints for Table 3.2.C.
- b. The analytical methods used to determine the core operating limits shall be those previously reviewed and approved by the NRC, specifically those described in General Electric Licensing Topical Report NEDE-24011-P-A, " General Electric Standard Application for Reactor Fuel" (latest approved version).
- c. The core operating limits shall be determined such that all applicable limits (e.g., fuel thermal-mechanical limits, core thermal-hydraulic limits, ECCS limits, nuclear limits such as shutdown margin limits, transient analysis limits, and accident analysis limits) of the safety analysis are met.
- d. The CORE OPERATING LIMITS REPORT, including any midcycle revisions or supplements, shall be provided upon issuance for each reload cycle to the NRC.
l 6.9.1.8 THE ANNUAL RADI0 ACTIVE EFFLUENT RELEASE REPORT l The Annual Radioactive Effluent Release Report covering the operation of the unit during the previous calendar year of operation shall be submitted by April 1, of each year. The report shall include summaries of the quantities of radioactive liquid and gaseous effluents and solid waste released from the unit. A single submittal may be made for a multi-unit station. BFN 6.0-26b Unit 1 i
r-The submittal should combine those sections that are common to all units at the station; however, for units with separate radwaste systems, the submittal shall specify the releases of I radioactive material from each unit. The material provided shall be (1) consistent with the objectives outlined in the ODCM and PCP and (2) in conformance with 10 CFR 50.36a and Section IV.B.1 of Appendix I to 10 CFR Part 50. ,
)
b
!l i
s i 5 h l BFN 6.0-26c l
- Unit 1
+
l 1.0 DEFINITIONS (Cont'd) Q. Operatina Cycle - Interval between the end of one refueling outage for a particular unit and the end of the next subsequent refueling outage for the same unit. R. Refueline Outane - Refueling outage is the period of time between the shutdown of the unit prior to a refueling and the startup of the unit after that refueling. For the purpose of designating frequency of testing and surveillance, a refueling outage shall mean a regularly scheduled outage; however, where such outages occur within 8 months of the completion of the previous refueling outage, the required surveillance testing need not be performed until the next regularly scheduled outage. S. CORE ALTERATION - CORE ALTERATION shall be the movement of any fuel, sources, reactivity control components, or other components affecting reactivity within the reactor vessel with the vessel head removed and fuel in the vessel. Movement of source range monitors, intermediate range monitors, traversing in-core probes, or special movable detectors (including undervessel replacement) is not considered a CORE ALTERATION. Suspension of CORE ALTERATIONS shall not preclude completion of movement of a component to a safe location. T. Reactor Vessel Pressure - Unless otherwise indicated, reactor vessel pressures listed in the Technical Specifications are those measured by the reactor vessel steam space detectors. U. Thermal Parameters
- 1. Minimum Critical Power Ratio (MCPR) - Minimum Critical Power Ratio (MCPR) is the value of the critical power ratio associated with the most limiting assembly in the reactor core. Critical Power Ratio (CPR) is the ratio of that power in a fuel assembly, which is calculated to cause some point in the assembly to experience boiling transition, to the actual assembly operating power.
- 2. Transition Boiling - Transition boiling means the boiling regime between nucleate and film boiling. Transition boiling is the regime in which both nucleate and film boiling occur intermittently with neither type being completely stable.
- 3. (Deleted) q
- 4. Average Planar Linear Heat Generation Rate (APLHGR) - The Average Planar Heat Generation Rate is applicable to a specific planar height and is equal to the sum of the linear heat generation rates for all the fuel rods in the specified bundle at the specified height divided by the number of fuel rods in the fuel bundle.
BFN 1.0-7 Unit 2 d_
1.0 DEFINITIONS (Cont'd) d V. Instrumentation
- 1. Instrument Calibration - An instrument calibration means the adjustment of an instrument signal output so that it corresponds, within acceptable range, and accuracy, to a known i value(s) of the parameter which the instrument monitors. 1
- 2. Channel - A channel is an arrangement of the sensor (s) and associated components used to evaluate plant variables and produce discrete outputs used in logic. .A channel terminates and loses its identity where individual channel outputs are combined in logic.
- 3. Instrument Functional Test - An instrument functional test means the injection of a simulated signal into the instrument primary i sensor to verify the proper instrument channel response, alarm I and/or initiating action.
- 4. Instrument Check - An instrument check is qualitative 5 determination of acceptable operability by observation of l instrument behavior during operation. This determination shall include, where possible, comparison of the instrument with other independent instruments measuring the same variable. ;
- 5. Loale System Functional test - A logic system functional test means a test of all relays and contacts of a logic circuit to insure all components are operable per design intent. Where practicable, action will go to completion; i.e., pumps will be started and valves operated.
- 6. Trio System - A trip system means an arrangement of instrument channel trip signals and auxiliary equipment required to initiate action to accomplish a protective trip function. A trip system may require one or more instrument channel trip signals related to one or more plant parameters in order to initiate trip system action. Initiation of protective action may require the tripping of a single trip system or the coincident tripping of two trip systems.
- 7. Protective Action - An action initiated by the protection system when a limit is reached. A protective action can be at a channel or system level.
l 8. Protective Function - A system protective action which results l from the protective action of the channels acnitoring a particular plant condition. 1 I l BFN 1.0-8 l Unit 2 ' L . _ _ ___ _____ ____________ ___ _ _- _ _ _ - ..
/
1.1/2.1 FUEL CLADDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 2.1.A Neutron Flur Trio Settinus 2.1.A.1.a (Cont'd) S1(0.66W + 71%) where: , S = Setting in percent of rated thermal power (3293 MWt) , W = Loop' , recirculation flow rate in percent of rated >
- b. For no combination of loop recirculation flow rate and core thermal power shall the APRM flux scram trip setting be allowed to exceed 120% of.
rated thermal power. BFN 1.1/2.1-2 Unit 2
1.1/2.1 FUEL CLAnDING INTEGRITY SAFETY LIMIT LIMITING SAFETY SYSTEM SETTING 2.1.A Neutron Flur Trio Settinna 2.1.A.1.b. (Cont'd) l l EDII: These settings assume operation within the basic thermal hydraulia design criteria. These criteria are LEGR within the limits of Specification 3.5.J and MCPR within the limits of Specification 3.5.K. If it is determined that either of these design criteria is being violated during operation, action shall be initiated within 15 minutes to restore operation within prescribed limits. _
- c. The APRM Rod Block trip setting shall be less than or equal to the limit specified in the CORE OPERATING LIMITS REPORT.
BFN 1.1/2.1-3 Unit 2
. _- -_____-____-__-_________________-___________-_____-___________________-__________-___-____a
- m. -
1 i 130 i _.m.......s........................1 . .
. e , s .
, i 120 - ..,..........
e . . , ,
. i
. n . . . . *
- i , , . . .
oW
.' Cram
, 1
. las . , , . . .
l 110 .
. 6 .
e , . e ,
, . * . i 1 100 - ..
g i n ,
. , e
, g ,
..t.. ....;
i i . i . . , 4
.d..
. s..s.....
. e e . , , , .
s
. .....;.......s..i._e,4,...,.....
s . , , i
.e......,...,...g...
e . g e . s . . i , . i , , , ,
.....y.. .p......,,...,...,...,...,..$..,.
e s . . . , . q3 y . 7 . . g . ,. . . .. . . ,. . . , , 90
. I . .
g
. . 4 O .
e . g g, .
. ...................,...,...a,. . . . . . .,............... . . . .. . . . , . .
q3 _..............., ., .. .. .... . . ..
. i , ,
3 O . Q. : 3 ,
. l , . - - , ,
Dest n Flow Gontrol Line , C . , C) . . .
. i s . s a _ .. .
i . . . q; . . , . . . , ....,...a,..a,. a. .. .. . . . . . , ....,u... . . . . . . , . , , 2
... ...a...a...s...s..z..u..,...,.......
o g,
..c..,...,.......}}