ML20153D585
| ML20153D585 | |
| Person / Time | |
|---|---|
| Issue date: | 10/31/1997 |
| From: | Boger B, Dunning T, Zimmerman R NRC (Affiliation Not Assigned) |
| To: | |
| Shared Package | |
| ML20153D328 | List: |
| References | |
| NUDOCS 9809250104 | |
| Download: ML20153D585 (33) | |
Text
. .- - - . - . . _ _ _ . . - . _ . . . . _ . . _ _ . - _ . . . - .
so ..
4 AD-HOC REVIEW PANEL REPORT ON THE DIFFERING PROFESSIONAL VIEW OF MR. FREDERICK BURROWS b /b/3//77 i Zim an, Chair Ad-Hoc Review Panel l
W /##7 Bruce A. er, Member Ad Hoc Review Panel
/ I) k 7
( ( /; '
Thomas G. DunninJ, Member Ad-Hoc Review Panel i
'Jhv9950l04
EXECUTIVE
SUMMARY
In a memorandum dated March 17,1997, the differing professional view of Mr. Fred Burrows, an electrical engineer in the Electrical Engineering Branch (EELB), was forwarded to the Director, NRR, regarding Technical Specifications (TS) trip setpoints (TSPs) and allowable values (AVs)
- for instrumentation. An ad-hoc review panel, appointed by the Director, NRR, through a memorandum dated March 24,1997, was formed to review the differing professional view and make recomrmndations based on its findings. The members of the Ad-Hoc Review Panel were Roy Zimmerman as Chair, Bruce Boger as a management member, and Tom Dunning as a staff member as recommended by Mr. Burrows. Anthony Mendiola served as technical assistant to the Panel.
Mr. Burrows provided two concems. The first concem is that 10 CFR 50.36, " Technical Specifications," requires the TSP by itself be considered the Limiting Safety System Setting (LSSS), and a closely related second concem is that the NRC Improved Standard Technical Specifications (ISTS)' should focus on the TSP, not the AV, since it is only the TSP that accounts for all known instrument errors.
The Panel conducted meetings with Mr. Burrows and members of the following branches:
Instrumentation and Controls Branch (HICB), Technical Specification Branch (TSB) and EELB.
Additional discussions were held with senior members of the Office of General Counsel (OGC) and the Office of Enforcement (OE).
Mr. Burrows identified the concems that TS which do not include TSPs (i.e., NRC's actions on the TS for nine of the eleven facilities that converted to the format of the ISTS) are inconsistent with the regulatory requirements for LSSS and the associated TS Bases have emphasized the importance of AVs in lieu of providing appropriate emphasis on the importance of TSPs in establishing instrument operability. The Panel found that these concoms are primarily administrative in nature (i.e., related to compliance with 50.36) and do not adversely affect the safe operation of reactors that are subject to TS requirements that do not include TSPs.
Additional concems were developed during discussions with Mr. Burrows and subsequent Panel deliberations. Likewise, the Panel found that the issues identified during these discussions and deliberations do not adversely affect the safe operation of reactors due to TS requirements associated with those issues.
The following summarizes the Panel's findings on the concems raised during its review.
Recommendations are provided after the discussion of the findings in the body of the report. The first two concems are from Mr. Burrows' memorandum, the next four concems were raised by Mr. Burrows during discussions with the Panel, and the Panel developed the remaining four concems during its deliberations.
- 1. The Panel considered the concem that plant TS that are based on the ISTS that include and designate AVs as LSSS, in lieu of TSPs, are inconsistent with requirements for LSSS as stated in 10 CFR 50.36. Further, Regulatory Position 3 in the staff's draft Regulatory Guide DG 1054, the proposed Revision 3 to Regulatory Guide (RG) 1.105, " Instrument I
j ISTS is denned as the current version of the NRC's Standard Technical Speedcations. STS refers to the predous versions of the Standard Technical Speedcations.
]
I 2
u --w - -- - --
, , ,,- - - - - - - , -,, w ,r ,---,---
. j i Setpoints for Safety-Related Systems," which states that AVs must be specified in the TS to meet 10 CFR 50.36, is similarty inconsistent with those reo.uirements.
The Panel found this concem to be complex and its resolution required considerable discussion with members of the technical and legal staffs. The Panel found that both '
TSPs and AVs are important in determining instrument operability. In addition, the j approach and treatment of TSPs and AVs have not been consistent in industry and regulatory guidance, since over time either one or both have been deemed to be the LSSS. The Panel recognized that the 10 CFR 50.36 requirement for an LSSS to be a setting "so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded" could reasonably be considered to apply to either TSPs or AVs in the context that those terms have meaning with regard to the operability of an i associated channel. However, the Panel concluded that the LSSS is that setting for an !
automatic protective device that is manually ediusted so that the device will initiste an automatic protective action and that setting is the TSP. Therefore, the Panel agrees with Mr. Burrows that it is the TSP, not the AV, that satisfies the regulatory requirement for the LSSS. (in contrast, the AV is not a setting that is used to adjust a protective device to initiate an automatic protective action. Rather, the AV is the limiting 'as found* value of an observed protective device sett;ng that due to changes over time, primarily instrument drift during the surveillance interval, would not exceed the allowances for such uncertainties used to establish the value of a TSP and that, at the time it is observed, satisfies the the operability goal of the regulatory requirement for the LSSS. That goalis an automatic protective action that would correct an abnormal situation before a safety limit is exceeded.) In addition, the Panel found that 10 CFR 50.36 does not provide a sufficient regulatory basis for NRC to require AVs to be included in the ISTS or plant TS as stated in the staff's draft of Revision 3 to RG 1.105 (DG-1054).
4
- 2. The Panel considered Mr. Burrows' concem the'. the ISTS should focus on the TSPs ('as left" values) not on the AVs. It is his opinion that an instrument channel can only be considered operable if it is adjusted to the TSP within the calibration tolerance specified in the associated setpoint calculations since it is only the TSP (not the AV) that accounts
, for all the instrumentation errors, and it is so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded.
As noted above, the Panel acknowledges the importance of both TSPs and AVs in the determination of instrumentation operability. However, the Panel found that only the TSP satisfies the requirements of 10 CFR 50.36 for the LSSS. In addition, because the TSP is used to adjust protective devices during surveillances, the Panel agrees with Mr. Burrows that the ISTS Bases have not placed sufficient emphasis on the importance of the TSP in establishing operability during surveillances and its use in operability determinations.
During Panel discussions with Mr. Burrows, four additional concems were brought forth. They are summarized as follows:
i 3. The Panel considered Mr. Burrows' concem that TS values should be stated as a value with a
- percent tolerance to provide a more precise setpoint. This format for TSPs is currently used for electrical system loss of voltage and undervoltage trip functions. Mr.
Burrows' believes that this TSP format should also be used in lieu of that currently used for instrumentation system trip functions that are values stated as a single sided bounding limit with s or 2 notation.
3
- e. . .
e The Panel found that the use of single sided bounding limits for TSPs is consistent with the regulatory requirement for the LSSS. The Panel could not identify a regulatory basis for imposing TSPs expressed as a
- tolerance. Therefore, the Panel disagrees that TSPs should be stated as a value with a t tolerance in lieu of a single sided bounding limit.
- 4. The Panel considered Mr. Burrows' concem that Technical Branch (TB) preparation of Safety Evaluation Reports (SERs) that involve setpoint changes have been requested by NRR Project Managers (PMs) with unrealistic due dates. Additionally, Mr. Burrows raised a concem about those instances where a PM drafts the SER and TB concurrence has i been requested by the PM with an unrealistic due date.
The Panel found that due dates should be discussed with and agreed upon by the TB before the start of work in accordance with NRR Office Letter 803.
- 5. The Panel considered Mr. Burrows' concems that there had been instances where Project Managers (PMs) had (1) reviewed and accepted licensees' amendment requests for TSP changes without seeking the review or concurrences of the TB with the primary responsibility for the review of the TSP being changed, or (2) requested reviews or concurrences by a TB that did not have the primary responsibility for the TSP being changed.
The Panel concluded that PM reviews of license amendments are justified where the PM
, has sufficient technical knowledge to perform an evaluation of TSP changes. The Panel notes that PM reviews have been a significant factorin reducing the backlog of open licensing actions. However, the Panel also found that PMs should request concurrence from the appropriate TB to ensure that the evaluation is consistent with current practice.
- 6. The Panel considered Mr. Burrows' concem that there are NRC setpoint methodology documents for reviewers (specifically BTP PSB-1) that are inconsistent in the guidance provided for reviews of this area.
The Panel found that BTP PSB 1 is inconsistent with the ISTS.
The Panel developed four other related concems during its review.
, 7. The Panel developed and considered the concem that the NRC needs to confirm that processes are in place to control changes to TSPs where only AVs are included in the TS.
The Panel reviewed a sample of the stars SERs for TS amendments that proposed to
, relocate TSPs to licensee controlled documents and noted that the SERs had stated the stars finding tW adequate controls (10 CFR 50.5g) were in place for any subsequent
, licensee change to TSPs that would be relocated. Based on discussions with the Lead Reviewers for the remainir.g SERs for TS amendments that proposed to relocate TSPs to licensee controlled documents, it was confirmed that similar findings were made, in those SERs, with regard to the existence of adequate controls for any subsequent changes to TSPs that would be relocated.
4
Inspections conducted by TSB for the Crystal River (the first TS conversion) verified that the TSPs were relocated to licensee controlled documents that are subject to the change controls of 10 CFR 50.5g. Subsequent inspections for TS conversions are being performed by Regional personnel using the' guidance in the NRC Inspection Manual (Tl 2515/130, " improved Standard Technical Specification implementation Audits") that includes audits for verification of relocated requirements as follows: ;
4
- a. Verify that a sample of TS requirements listed as relocated in the licensee conversion submittal were relocated to the specified location.
- b. For those requirements sampled above that were re!ocated and subsequently modified, again relocated, or deleted, ensure, in accordance with Section 03.01.b.1, that the appropriate controls were used.
The Panel found that there are sufficient provisions within the NRC inspection program to confirm that processes are in place to adequately control changes to TSPs, in the interim, where only AVs are included in the TS. For the long term, the Panel's recommendations address restoring TSPs to TS consistent with the Panel's finding noted in item 1 above.
- 8. The Panel developed and considered the concem whether the NRC has adequate assessment tools in place to verify that licensees are adequately determining instrumentation setpoints.
The Panel found that the staff has the necessary regulatory tools (e.g.,10 CFR 50.54(f)
Letters and the ongoing Architect / Engineer Design Team inspections) to provide
- h. formation to assess licensee setpoint methodology and to ensure that appropriate findings are made on licensee practices in this rarea.
- 9. The Panel developed and considered the hypothetical question of what action the ISTS would require if a licensee identified an "as found" setting that was less conservative than the TSP.
The Panel examined the ISTS for all four NSSS Vendors and found that the requirements related to protective device settings are expressed in terms of requiring and demonstrating operability and that specific requirements are not set forth with regard to TSPs or AVs. Thus, one must rely on the guidance in the TS Bases on TSPs and AVs to 4 obtain the proper application of operability requirements for protective device settings.
Based on the majority of the statements included in the ISTS Bases for Reactor Trip System instruments, the panel concluded that an "as found" setting that is less conservative than the TSP would be adjusted consistent with the TSP.
Following discussions with the management and staff of TSB and HICB, the Panel also i
found that there was a consensus based on staff experiones that licensees would adjust an "as found" value that exceeds a TSP to a value consistent with the TSP.
Nevertheless, the Panel found the statements in the ISTS and its Bases lack clarity and specificity with regard to the relationship between operability and the use of TSPs and AVs.
i i
5 l
a 1
i .. ..
4 1 10. The Panel developed and considered the hypothetical question of what action the ISTS 4
. would specify if a licensee identified an "as left" setting that was inadvertently left less conservative than the TSP.
4 The Panel found that a channel would be incperable since its surveillance r64uirements would not have been met since the "as left" setting was less conservative than the TSP.
, Action would have to be taken to restore the channel to operable status by adjusting its i setting to a value that is equal to or conservative with its TSP or other remedial actions 4
such as placing the channelin trip would have to be taken as stated in the TS. The
, Panel also found that the required actions are independent of whether or not the "as left"
- value had exceeded its AV.
i i
i l
l 5
4 4
3 6
4 ,
i .
1
[ INTRODUCTION
! In a memorandum dated March 17,1997, the differing professional view of Mr. Fred Burrows j
(See Enclosure 1), an electrical engineer in the Electrical Engineering Branch (EELB), was i forwarded to the Director, NRR, regarding Technical Specification (TS) trip setpoints (TSPs) and
! allowable values (AVs) for instrumentation. An ad-hoc review panel, appointed by the Director, i
NRR, through a memorandum dated March 24,1997 (See Enclosure 2), was formed to review l
the di#ering professional view and make appropriate recommendations. The members of the
, Ad-Hoc Review Panel were Roy Zimmerman as Chair, Bruce Boger as a management member, j and Tom Dunning as a staff member as recommended by Mr. Burrows. Anthony Mendiola 4
served as technical assistant to the Panel.
l Mr. Burrows provided two concems. The first concem is that 10 CFR 50.36, " Technical j' Specifications," requires the TSP by itself be considered the Limiting Safety System Setting (LSSS), and a closely related second concem is that the NRC Improved Standard Technical Specifications (ISTS)2 should focus on the TSP, not the AV, since it is only the TSP that accounts for all known instrument errors.
I j The Panel conducted meetings with Mr. Burrows and members of the following branches:
- Instrumentation and Controls Branch (HICB), Technical Specification Branch (TSB) and EELB.
4 Additional discussions were held with senior members of the Office of General Counsel (OGC) and the Office of Enforcement (OE).
l This report provides relevant background information, reviews of identified concems and i'
developed issues, and the Panel's recommendations. Enclosure 3 provides a listing of documents reviewed by the Panel. Enclosure 4 provides a historical summary of the i requirements for Limiting Safety System Settings (LSSS), trip setpoints (TSPs), and allowable
! values (AVs) as contained in the (1) the Code of Federal Regulations, (2) Standard Technical I
Specifications (STS), and (3) industry and NRC guidance on TSPs and AVs that was used by the Panel as background material for the discussion of the issues provided in this report. The Panel notes that the meaning and method for determining an AV as addressed in the industry guidance have changed over time. For its deliberations, the Panel used the AV as it was defined at the time that the NRC issued its guidance on TSPs and AVs (RG 1.105, Revision 2, " instrument Setpoints for Safety Related Systems," issued February 1986).
BACKGROUND A. Defined Terms This section provides definitions for key terms used throughout the report.
iSTS is denned as the current version of the NRC's Standard Technical Spec 4cabons. STS refers to the previous versions of the Standard Technical Specscatons.
7
.+ ..
Allowable Value (AV)- As defined in the Instrument Society of America (ISA) Standard, ISA-3 2
S67.04-1994 , "Setpoints for Nuclear Safsty Related Instrumentation," is the limiting value that
} the trip setpoint may have when tested pet'odically, beyond which appropriate action must be
- taken.'
f Trip Satpoint (TSP)- As defined in ISA S67.04-1994, a predetermined value for actuation of the
- final setpoint device to initiate a protective action.
- 1 Limitina Safety System Settina (LSSS)- As defined in 10 CFR 50.36(c)(1)(ii)(A), Limiting Safety i System Settings for nuclear re, actors are settings for automatic protective devices related to
- those variables having significant safety functions. Where a limiting safety system setting is j specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is j exceeded.
l As Found Value - As defined in ISA S67.04-1994, the condition in which a channel, or portion of j a channel, is found after a period of operation and before recalibration (if necessary).
l As Left Value - As defined in ISA-S67.04-1994, the condition in which a channel, or portion of a j channel, is left after calibration or final setpoint device setpoint verification.
- Safety Limit (SL)- As defined in 10 CFR 50.36 (c)(1), Safety Limits for nuclear reactors are limits
! upon important process variables that are found to be necessary to reasonably protect the l fntegrity of certain of the physical barriers that guard against the uncontrolled release of radioactivity, f AnaMical Limit (AL)- As ' defined in ISA-S67.04-1994, the limit of a measured or calculated
{ variable established by the Safety Analysis to ensure that the Safety Limit is not exceeded.
1 Additionalinformation on this terminology is contained in Enclosure 4 of this report. The i relationships between these definitions are shown on Figure 1 of the ISA Standard. A copy of l this figure from the 1982,1988, and 1994 versions of the ISA Standard is provided in Enclosures
- 5,6, and 7, respectively.
l
- This standard is currently under consideration by the NRC for endorsement via Draft
! Regulatcry Guide (RG) DG-1045, "Setpoints for Safety-Related Instrumentation (Proposed i Revision 3 to RG 1.105)." The current version of RG 1.105 endorses the 1982 version of the ISA standard.
- The 1982 version of the ISA Standard identifies the AV by how it is determined, i.e., as j differing from the TSP by the drift in that portion of the instrument channel which is tested when 4 the setpoint is determined. The 1988 version of the ISA Standard increased the instrument
] uncertainties used to determine the alawance between the TSP and AV to include instrument i calibration uncertainties and instrument uncertainties during normal operation, in addition to 1 instrument drift as specified in the 1982 version. Also, the 1988 version included the AV as a I defined term stating that the instrument channelis declared inoperable during a surveillance
- when an AV is exceeded, but removed this clarification in the 1994 version of the AV stated i above.
8
B. Technical Soecification Reauirements This section provides a brief summary of the requirements for LSSS, TSPs, and AVs as specified '
in STS and used as a model for the TS of operating nuclear power plants.
The earty drafts of the STS for Westinghouse Plants, NUREG-0452, (circa 1974) had a section on LSSS under Chapter 2, " Safety Limits and LSSS." This section specified that the Reactor Trip System (RTS) Instrumentation setpoints shall be set consistent with the TSP values shown in Table 2.2-1. Actions required the adjustment of the setpoint consistent with the TSP value when it was less conservative than the value specified in the table.
Administrative Controls in the eariy versions of the STS, and in plant TS at that time, imposed a requirement for an abnormal occurrence report (subsequently called a licensee event report) whenever an instrument channel was found to be inoperable. Consequently, a large number of reports were required because normal instrument drift caused setpoints to change during a surveillance interval such that the "as found" value often exceeded the TSP when the next 1
surveillance was performed.
Subsequent changes to the draft STS proposed in the fall of 1975 added AVs to Table 2.21 for the RTS functions. The AV was determined by adding the channel uncertainty due to instrument drift to the TSP value. Thus, a RTS channel would be capable of performing its safety function when the "as found" value of a protective device setting exceeded the TSP, so long as it did not exceed the AV, i.e., instrument drift did not exceed the allowance for this uncertainty that was used to determine the TSP. However, the instrument setting would be adjusted so that the "as left" value did not exceed the TSP as specified by the LSSS cpecification for the RTS, or as specified by the LCO for the ESFAS instrumentation. This action, adjusting the setpoint to not exceed the TSP, restores the margin for instrument drift that may occur over the next surveillance interval.
When AVs were added to the STS, new actions specified the remedial measures to be taken when a setpoint exceeded the AV The new actions were to (1) declare the channelinoperable and (2) apply the applicable action statement requirement of Specification 3.3.1.1 (the Limiting Condition for Operation for the RTS), until the channel is restored to OPERABLE status with its setpoint adjusted consistent with the TSP. The layer actioii, adjusting the setting to restore the channel to operable status, would be taken as part of a surveillance that determined that the protective device sitting exceeded its AV. NUREG 0452 was finalized and issued in June of 1978.
! With the addition of AVs to plant TS, a basis was provWed for a finding that a, channel was operable wher, its setpoint was found to exceed the TSP but not the AV. This significantly reduced the number of abnormal occurrence reports that licensees had to submit when instrument drift, which occurs during the surveillance interval, caused a setpoint to be found that exceeded its TSP.
In September 1992, the ISTS were issued as a series of NUREG documents (1430-1434) for each of the Nuclear Steam Supply System (NCSS) vendors. Changes were proposed by the vendor Owner's Groups and subsequently raviewed and approved by the staff. Changes were
- made in the manner that setpoint requirements were specified. The section on LSSS for the RTS was removed and the setpoint table was moved to the LCO for the RTS. The LCOs for tho 3
9 4
RTS and ESFAS were changed to specify that the associated instrumentation shall be operable, but without the earlier reference to the adjustment of setpoints consistent with the TSP.
For NSSS vendors other than Westinghouse (W), the tables for the RTS and ESFAS LCOs listed only the AVs and not the TSPs. For these non-W NSSS vendors, the ISTS Bases state that the AV is the LSSS.
! The ISTS for Westinghouse plants include both TSPs and the AVs. However, a footnote for the l TSP column of the LCO Table provides the option, on a unit specific implementation basis, to include only AVs. The associated Bases states that the TSP is the LSSS, but with TSP in l brackets to indicate that it may be different on plant specific basis, i.e., it could be the AV if the l ' TS Table used a single column format that did not include TSPs.
i
, 1 C. Discussion of Mr. Burrows' Concems This section provides a summary of the concems raised by Mr. Burrows that led to the statement of his dinering professional view, in a memorandum to J. Wermiel (HICB) and C. Grimes (TSB) dated March 6,1996, Mr. Burrows expressed the concem that the recent stan efforts to improve and simplify Westinghouse Standard Technical Specifications have undermined efforts in the 1980's to produce a meaningful and technically concise approach to satisfy 10 CFR 50.36. Specifically, it was his opinion that the use of an AV to determine operability for an instrumentation channel in lieu of the channel's TSP in TS does not satisfy 10 CFR 50.36 and is not consistent with actual plant calculations that establish setpoints and with plant procedures that maintain the validity of those '
setpoints.
In their response dated April 2,1996, C. Grimes and J. Wermiel stated that it was not clear if Mr.
Burrows had raised a particular technical concem or p olicy concem regarding the appropriate means to reflect setpoint calculations and related maintenance practices into TS requirements.
They also requested that Mr. Burrows document his concems so that they could be addressed before a revision to Regulatory Guide 1.105, " Instrument Setpoints for Safety Systems," or further changes to the ISTS were made.
in a memorandum to J. Wermiel and C. Grimes dated August 9,1996, Mr. Burrows provided his comments on the proposed Revision 3 to Regulatory Guide 1.105. In addition, Mr. Burrows questioned whether the staff was consistently applying 10 CFR 50.36 and stated that the staff was downplaying the importance of the TSP and that the TSP is the only setting that will satisfy 10 CFR 50.36. In a response of August 29,1996, C. Grimes and J. Wermiel stated that Mr.
Burrows' comments would be considered along with those obtained from the public.
When N appeared to him that his comments and those made by Westinghouse (letter to the NRC dated December 19,1996), would produce no change in the staffs approach to the importance of a channel's TSP, Mr. Burrows stated his differing professional view in a memorandum to his supervisor dated March 17,1997. He addressed two concoms as stated below.
- 1. Regulatory Position 3 in the staffs draft Regulatory Guide DG-1045 (Proposed Revision 3 to Regulatory Guide 1.105, circa October 1996) states that "the allowable value, in l conjunction with the trip setpoint, will determine the limits on instrument operability and 10
1 must be specified in the TS in order to meet 10 CFR 50.36. The LSSS should be l
developed in accordance with the setpoint methodology based on the standard, with the '
l allowable value listed in the TS and the rela.tionship of the trip setpoint to the allowable j value must be documented and controlled by the setpoint methodology."
4 Kowever,10 CFR 50.36 states that TS will include LSSS and "where a limiting safety
] system setting is specified for a variable on which a safety limit has been placed, the .
- setting must be so chosen that automatic protective action will correct the abnormal ,,
i situation before a safety limit is exceeded." in a typical setpoint methodology for l instrumentation, it is only the TSP that satisfies this requirement since its value (not the i AV) accounts for all the instrumentation ermrs. This is supported by ISA S67.04-1994,
! "Setpoints for Nuclear Safety-Related Instrumentation."
) Further, the standard states that "an allowance shall be provided between the trip
- setpoint and the analyticallimit to ensure a trip before the analyticallimit is reached" and j "the trip setpoint should be the value that the final sospoint device is set to actuate."
i Therefore, it is Mr. Burrows' view that 10 CFR 50.36 requires the TSP by itself be
- considered the LSSS.
i
! 2. In the TS for Westinghouse plants issued in the 1980's, an LCO for safety-related
- instrumentation would typically state that an instrument channel was operable if its setpoint was set consistent with values shown for the TSPs. Contrary to this, the current i
Westinghouse ISTS states in the Bases that "if the measured setpoint does not exceed j the allowable value, the bistable is considered operable." It is Mr. Burrows' opinion that j sn instrument channel can only be considered operable if it is adjusted to the TSP within i the calibration tolerance specified in the associated setpoint calculations since, as stated
! it is so chosen that automatic protective action will correct the abnormal situation before a
- safety limit is exceeded.
i l It is Mr, Burrows' view that the TS should focus on the TSP and not the AV. He indicated j that the sole purpose of an AV is to use it as a limit for instrument uncertainties actually i encountered during periodic testing. If actual test results exceed the AV, then the corresponding assumptions in the setpoint methodology must be revisited to ensure l
! continued validity of the TSP selection. He indicated that his view is supported by ISA S67.04-1994.
l PANEL REVIEW
$ A. Panel Findinas on Mr. Burrows' Oriainal Concems 1
- 1. The Panel considered Mr. Burrows' concem that plant TS that are based on the ISTS that include and designate AVs as LSSS, in lieu of TSPs, are inconsistent with requirements for LSSS as stated in 10 CFR 50.36. Furthermore, Regulatory Position 3 in the stafi's
{ draft Regulatory Guide DG-1054 (proposed Revision 3 to Regulatory Guide 1.105 on j instrument Setpoints for Safety-Related Systems) stating that AVs must be specified in j the TS in order to meet 10 CFR 50.36, is similariy inconsistent with those requirements.
] 11 I
I
l As noted by Mr. Burrows,10 CFR 50.36 establishes the requirement for TS to include LSSS as stated under the section on Defined Terms above. The panel confirmed that the current ISTS allow either TSPs and AVs, or AVs alone, to be included in plant TS when converting to the format of the ISTS, and allow the Bases to describe either the TSP or the AV as the LSSS. Thus, the issue is whether these options satisfy the regulatory requirement for an LSSS.
The Panel found this concem to be complex and its resolution required considerable discussion with members of the technical and legal staffs. The Panel found that both TSPs and AVs are important in determining instrument operability. In addition, the approach and treatment of TSPs and AVs have not been consistent in industry and regulatory guidance, since over time either one or both have been deemed to be the LSSS. l To better appreciate the relationship between the AV and the TSP, the Panel considered the typical process by which instruments are periodically tested. In this process a technician determines the "as found" value of an instrument setting (protective device trip actuation point) and compares it to the TSP. If the "as found" value is not conservative with the TSP, the technician adjusts the protective device to actuate at a value ("as left")
that is consistent with the TSP. This provides the appropriate margins forinstrument uncertainties, over the next surveillance interval, to ensure that protective actions could i be initiated in response to an abnormal situation such that safety limits would not be exceeded. In addition, if the setting had been found to be nonconservative with respect to the AV, additional actions should be taken by the licensee to assess the unexpected response and consider its implication on operability. However, such follow-up actions are not imposed by any specific TS requirement.
The Panel next considered whether 10 CFR 50.36 could be reasonably read to allow either TSP or AV to be the LSSS. If the regulation is read from the perspective that a
- " setting"is the act of adjusting the instrumentation to a desired actuation point (i.e., the instrument is " set," resulting in a trip setpoint " setting"), then this is consistent with the adjustment of the "as left" value noted above and would dictate that the TSP is the LSSS.
Altemately, if the regulation is read from the perspective that a " setting"is the actuation point of the instrumentation, then this is consistent with both the "as found" and "as taft" values noted above and would allow either the TSP or the AV to be the LSSS. Therefore, 10 CFR 50.36 could reasonably be read as allowing the use of either the TSP or the AV
[ as the LSSS.
1
, The Panel explored the use of either TSP or AV as the LSSS in the ISTS and plant TS with senior members of the Offices of the General Counsel (OGC) and of Enforcement (OE). It was the opinion expressed by the OGC and OE representatives that the value i included in the ISTS table on trip system instrumentation (without consideration of information contained in the Bases section) was the only TS value to which the licensee
- could be held accountable for the adjustment of instrumentation settings. Its the Panel's conclusion, therefore, that if the TS table contains only the TSP, then a licensee must adjust the instrumentation consistent with this value, which is the "as left" value noted
- previously. However, if the TS table contains only the AV, then conceivably a licensee
! could adjust the instrumentation setting to that value, which is not consistent with the "as
- left" value noted previously and would not give the assurances that all instrumentation t
uncertainties had been considered in establishing the setting used at the start of a 12 i
j ., , ,
a 1
4 surveillance interval. (The Panel recognized that licensees whose TS include only AVs control protective device settings in accordance with plant procedures that are required to '
j be maintained by TS and these procedures would require protective devices settings that
- are consistent with the TSP.) Accordingly, the Panel found that the 10 CFR 50.36 l 1 requirement for automatic protective action to correct an abnormal situation before a l safety limit is exceeded would not be satisfied by reliance solely upon a plant TS table
! that contained only the AV.
}
Therefore, the Panel concluded that the LSSS is that setting for an automatic protective j device that is manually ad1usted so that the device will initiate an automatic protective i
action and that setting is the TSP. In contrast, the AV is not a setting used to adjust a i protective device to initiate an automatic protective action. Rather, the AV is the limiting
, 'as found* value of an observed protective device setting that due to changes over time, i primarily instrument drift during the surveillance interval, would not exceed the allowances for such uncertainties as used to establish the value of a TSP and, at the time it is i observed, would satisfy the regulatory requirement for the LSSS. Therefore, the Panel 1 agrees with Mr. Burrows that it is the TSP, not the AV, that satisfies the regulatory j requirement for the LSSS. In addition, the Panel found that 10 CFR 50.36 does not
{ plant TS as stated in the staff's draft of Revision 3 to RG 1.105 (DG-1054).
!' 2.
The Panel considered Mr. Burrows' concem that the ISTS should focus on the TSPs ("as left" value) not on the AVs. It is his opinion that an instrument channel can only be i considered operable if it is adjusted to the TSP within the calibration tolerance specified l in the associated setpoint calculations since it is only the TSP (not the AV) that accounts l for all the instrumentation errors and it is so chosen that automatic protective action will
- correct the abnormal situation before a safety limit is exceeded. .
2 As noted above, the Panel acknowiedges the role that both the TSP and AV have played j in the determination ofinstrumentation operability. However, the Panel found that only
! the TSP satisfies the requirements of 10 CFR 50.36 for the LSSS. Accordingly, the Panel j agrees with Mr. Burrows that the ISTS and plant TS should include TSPs.
j B. Panet Findinas on Mr. Burrows' Additional Concems During Panel discussions with Mr. Burrows, four additional concems were brought forth. They are summarized, along with the Panel's findings, as follows:
]
k 3. The Panel considered Mr. Burrows' concem that TS values should be stated as a value I with a i percent tolerance to provide a more precise setpoint. This format for TSPs is f currently used for electrical system loss of voltage and undervoltage trip functions. Mr.
- Burrows believes this TSP format should also be used in lieu of that cunrently used for
]
instrumentation system trip functions that are values stated as a single sided bounding limit with s or 2 notation.
The Panel found that the use of single sided bounding limits for TSPs is consistent with regulatory requirement for the LSSS and do not restrict the licensees' use of settings that
! are more conservative than the TS bounding limit. The Panel found that where TSPs j were specified as a value with a
- tolerance (double sided bounding limits), that the 1
13 Y
d 4
- - , . . . , . - . . - . , , - , - . . , , . , _ - . _._.,, ~.-. ~ ., ..- -- _ . . -
.. .. l l
Bases had not provided a rationale to exclude the use of a more conservative setting than allowed by the tolerance. The least conservative setting allowed by the tolerance would be equivalent to a TSP value when stated as a single sided bounding limit. The '
Panel could not identify a regulatory basis for imposing TSPs expressed as a i tolerance.
Therefore, the Panel disagrees that TSPs should be stated as a value with a i tolerance in lieu of a single sided bounding limit and recommends no staff action.
- 4. The Panel considered Mr. Burrows' concem that Technical Branch (TB) preparation of Safety Evaluation Reports (SERs) that involve setpoint changes have been requested by NRR Project Managers (PMs) with unrealistic due dates. Additionally, Mr. Burrows raised a concem about those instances where a PM drafts the SER and TB concurrence has been requested by the PM with an unrealistic due date.
The Panel found that due dates should be discussed with and agreed upon by the TB before the start of work in accordance with NRR Office Letter 803.
- 5. The Panel considered Mr. Burrows' concems that there had been instances where Project Managers (PMs) had (1) reviewed and accepted licensees' amendment requests for TSP changes without seeking the review or concurrences of the TB with the primary responsibility for the review of the TSP being changed, or (2) requested reviews or concurrences by a TB that did not have the primary responsibility for the TSP being changed.
The Panel concluded that PM reviews of license amendments are justified where the PM has sufficient technical knowledge to perform an evaluation of TSP changes. The Panel notes that PM reviews have been a significant factor in reducing the backlog of open licensing actions. However, the Panel also found that PMs should request concurrence from the appropriate TB to ensure that the evaluation is consistent with current practice.
- 6. The Panel considered Mr. Burrows' concem that there are NRC setpoint methodology documents for reviewers (specifically BTP PSB-1) that are inconsistent in the guidance provided for reviews of this area.
The Panel found that the mance in BTP PSB-1 which requires reviewers to confirm that both TSPs and AVs for the degraded voltage protection are in the TS under review is inconsistent with the ISTS that include only one or the other. As noted above, the Panel's findings with respect to the 10 CFR 50.36 requirements for LSSS are not consistent with the guidance contained in the staff's draft of RG 1.105. The Panelis unaware of any other NRC setpoint methodology documents which provides guidance for reviews in this area.
C. Discussion of Panet Develooed Concems The Panel identified four other related concems during its review that it considered and made recommendations as appropriate.
- 7. The Panel developed and considered the concem that the NRC needs to confirm that processes are in place to control changes to TSPs where only AVs are included in the TS.
14
3 9 3
)
! To date TS have been issued for 11 facilities based on conversion to the ISTS. All but j two of these facilities (Ginna and Vogtle), have TS with only AVs. The Panel examined i the stats SERs for Clinton, Hatch Units 1 and 2, Peach Bottom Units 2 and 3, and San l Onofre Units 2 and 3 for TS amendments that proposed to relocate TSPs to licensee i controlled documents. These SERs stated the stars finding that adequate controls j (10 CFR 50.59) were in place for any subsequent licensee change to TSPs that would be j relocated. Based on discussions with the Lead Reviewers for the remaining SERs for TS l amendments that proposed to relocate TSPs to licensee controlled documents, it was l confirmed that similar findings were made, in those SERs, with regard to the existence of adequate controls for any subsequent chenges to TSPs that would be relocated.
i
! Inspections conducted by TSB for the Crystal River (the first TS conversion) verified that the TSPs were relocated to licensee controlled documents that are subject to the change controls of 10 CFR 50.5g. Subsequent inspections for TS conversions are being i performed by Regional personnel using the guidance in the NRC laspection Manual l i (Tl 2515/130, *lmproved Standard Technical Specification Implementation Audits") that includes audits for verification of relocated requirements as follows:
l a. Verify that a sample of TS requirements listed as relocated in the licensee conversion submittal were relocated to the specified location.
4
- b. For those requirements sampled above that were relocated and subsequently modified, again relocated, or deleted, ensure, in accordance with Section 03.01.b.1, l
] that the appropriate controls were used.
3 l The Panel found that there are sufficient provisions within the NRC inspection program to ;
j confirm that processes are in place to adequately control changes to TSPs, in the interim, 1 1 where only AVs are included in the TS. For the long term, the Panel's recommendations I j address restoring TSPs to TS consistent with the Panel's finding noted in item 1 above, l i
{ 8. The Panel developed and considered the concem whether the NRC has adequate i assessment tools in place to verify that licensees are adequately determining instrumentation setpoints.
i i' The Panel found that the staff has the necessary regulatory tools (e.g.,10 CFR 50.54(f)
Letters and the ongoing Architect / Engineer Design Team Inspections) to provide information to assess licensee setpoint methodology and to ensure that appropriate
- findings are made on licensee practices in this area.
I
- 9. The Danel developed and considered the hypothetical question of what action the ISTS
! would require if a licensee identified an "as found" setting that was less conservative than
! meTSP.
I i The Panel examined the ISTS for all four NSSS Vendors and found that the requirements l
related to protective device settings are expressed in terms of requiring and i demonstrating operability and that specific requirements are not set forth with regard to
! obtain the proper application of operability requirements for protective device settings.
( Based on the majority of the statements included in the ISTS Bases for Reactor Trip i i
i j 15 I
i i
4-
^ --
1 System instruments, the panel concluded inat an "as found" setting that is less conservative than the TSP would be adjusted consistent with the TSP.
l The Panel held discussions with the management and staff of TSB and HlCB on how
! was agreement that AVs are considered for operability determinations when surveillances i are performed and that instrument channel settings are reset when they are found to exceed TSP values. There also was agreement that TSPs are applied as a setting that
- an instrument channel must satisfy at the conc;usion of a surveillance.
However, the Panel found that there is not consistency on how adjustments of instrument channel settings ars to be made to assure that the TSP requirements are met. In 4 RG 1.105 (Revision 2,1986), the " upper setpoint limit" as used in Figure 1 of the ISA l Standard (See Enclosure 5) is stated to tie the same as " trip setpoints" as used in the 1
STS, in that drift above the " trip setpoint"(in the STS) requires readjustment. However, i
the Bases for the ISTS for Babcock and Wilcox (B&W) Plams (NUREG-1430) and
- Westinghouse plants (NUREG-1431) include the following statement under a discussion
j The Trip Setpoints are the nominal values at which the bistables are set. Any l bistable is considered properly adjusted when the "as left" value is within the j band for CHANNEL CAllBRATION accuracy (i.e., t rack calibration
+ compart. tor setting accuracy).
l The point in question is whether this statement modifies the TS requirements for TSPs that are stated as single sided bounding limits. For example, if a TSP is stated as s 1800 psig and the band for channel calibration accuracy is 20 psig, would an "as left' setting of 1
1820 psig, or less but >1800 psig, satisfy the TS requirement of s 1800 psig. The HICB j
and TSB staff confirmed that an instrument channel setting of > 18';0 psig would not satisfy the TS requirement, even if the deviation from bounding TS limit was within the band for calibration accuracy as stated in the associated TS Bases.
l in contrast, Westinghouse (W) stated their position on this matter in their December 19, i 1996, letter providing comments on Draft Regulatory Guide DG-1045 (RG 1.105 Rev.3).
Westinghouse indicated that TSPs are nominal values and that adjustment tolerances about the spedfied value are appropriate because such uncertainties have been factored
. into the setpoint analysis. Thus, W indicates that the allowance noted in the Bases can
! be applied to the TS bounding limits and that the Bases for W plants TS have included
! such statements since 1981.
j The Panel's finding on this matter is consistent with the staff's position that the Bases j may not alter the TS requirements. However, the Panel concludes that some licensees t
may apply the TS requirements for TSPs in a way that is consistent with the stated W i position and as implied by the statements included in the TS Bases. With respect to
- safety significance, the Panel concludes that the use of the allowance stated in the Bases j when adjusting instrument settings should not create a safety concem when the i allowance is property factored into the setpoint analysis. Nevertheless, the use of such allowances stated in the Bases of TS to deviate from TSPs stated in specifications are
]
contrary to compliance with the TS requirements for bounding TSPs.
i i
i 16 4 .
o ..
The Panel also considered the application of fixed limits on TSPs in the manner used in Watts Bar TS. The staff accepted TS that removed the indicators, i.e., the s and a symbols, that bounded the values of specified TSPs that were renamed as " Nominal Trip Setpoints." The intent appears to be to allow deviations from the specified TSPs us!ng the Bases statements on a channel being " property adjusted when the as left value is within the band for CHANNEL CALIBRATION accuracy." The Panel finds this modification of the TSP requirements by statements in the Bases to be similar to the ,
case above.
The Panel further considered the ISTS for 'he Diesel Generator- Loss of Voltage Start (NUREG-1432, " Standard Technical Specifications - Combustion Engineering Plants) and for the Emergency Diesel Generator Loss of Power Start (NUREG-1430, Standard Technical Specifications - Babcock & Wilcox Plants), that include surveillance requirements ststing: " Perform CHANNEL CALIBRATIONS with setpoint Allowable Value(s) as follows:" which rnight be misapplied to mean that the setting is to be adjusted to the stated AV, rather than the TSP that is not included in the ISTS.
In summary, the Panel found that there was a conseasus bssed on staff experience that licensees would adjust an "as found" value that exceeds a TSP to a value consistent with the TSP. Nevertheless, the Panel found the statemems in the ISTS and its Bases lack clarity and specificity with regard to the relationship behveen operability and the use of TSPs and AVs.
- 10. The Panel developed and considered the hypothetical quesibn of what action the ISTS would specify when a licensee identified an "as left" se+ ting that was inadvertently left less conservative than the TSP but was conservative with respect to the AV.
The Panel found that a channel would be inoperable since its surveillance requirements would not have been met since the *as left" setting was less conservative than the TSP.
Action would have to be taken to restore the channel to operable status by adjusting its setting to a value that is equal to or conservative with its TSP or other remedial actions such as placing the channel in trip would have to be taken as stated in the TS. The Panel also found that the required actions are independent of whether or not the 'as left" value had exceeded its AV.
E, Pendina Proposal for Modification of ISTS A proposal was submitted to the TSB on April 11,1997, by EELB to modify the ISTS for all NSSS vendors to require, among other things, both TSPs and AVs for the loss of voltage and degraded voltage trip fuachons, an area of the EELD primary review responsibility. A stated basis for this change was to comply with BTP PSB-1 which requires TS to include Teos and AVs for voltage protection sensors and associated time delay devices. This proposed char,7e would restore TSP to the ISYS.
The Panel did not attempt to evaluate the proposed change, but has stated its finding that a regulatory basis does not exist in 10 CFR 50.36 for NRC to require TS to include AVs.
Nevertheless, the Panel recognizes the need for the staff to consider the proposed modifications of the ISTS in light of the Panel's findings.
17
E. Panet Recommendations Based on the preceding discussion, the Panel's has the following recommendations.
- 1. The Panel recommends that following appropriate staff review of the Panel's findings, the staff hold a public meeting with the NSSS Owners Groups to, (1) provide the NRC staff position that 10 CFR 50.36 requires the TSP to be the LSSS, (2) discuss the staff position ,
on the use of TS Bases to comply with TSP limits, and (3) discuss the need to revise the !
ISTS accordingly. i l
- 2. The Panel recommends that following the meeting with the industry, the staff initiate '
actions necessary to update the ISTS in accordance with agency procedures (i.e., !
50.109) for new staff positions to incorporate TSPs in the LCO Tables, consistent with the l requirements for LSSS required by 10 CFR 50.36.
- 3. The Panel recommends that the staff meet with the licensees for the nine plants that ,
have converted to the ISTS by relocating TSPs to licensee controlled documents to l discuss means to bring their TS into compliance with 10 CFR 50.36 as discussed in '
Recommendations 1 and 2 above.
- 4. The Panel recornmends that the staff ensure that TS Bases do not inappropriately suggest that ptotective Tevices could be adjusted beyond the TSP limits. The Panel
, recommends that the staff provide guidance to licensees on compliance with TSP limits, with emphasis on those situations where the TS Bases state that channels are considered operable when a TSP limit is exceeded by a tolerance that was treated as an instrument uncertainty in the establishment of the TSP. Because W has indicated (See item 13 of Enclosure 3) that this practice was intended for W plants licensed since 1981, this guidance is not restricted to plants that have converted to the ISTS with the Bases statement noted above. The Panel recommends that a generic communication should be issued to address the following:
- a. Guidance on adjusting setpoints to comply with the TS limits,
- b. Guidance on TS changes for a licensee amendment request that could be submitted and that would incorporate a calibration tolerance or allowance for adjusting trip setpoints to satisfy the specified TSP limits. A suggested model TS is provided in Enclosure 8 for the staffs consideration.
- 5. The Panel recommends that the staff develop a plan providing the proper emphasis on TSPs in the ISTS Bases versus the current emphasis on the use of AVs for operability determinations.
- 6. The Panel recommends that the staff assure consistency between the Panel's findings on TSPs and AVs and the next revision of RG 1.105. The Panel recommends that the staff review documents for instrumentation setpoints, specifically BTP PSB 1, and to modify them as necessary to reflect the findings of the Panel.
- 7. The Panel recommends that the technical staff in Headquarters and the Regions be informed of the staffs actions on the Panel's findings as appropriate.
18
l l 8. The Panel recommends that the staff review procedures and guidance for PMs on l
handling licensing actions to ensure that clear guidance is provided for establishing due dates and identifying appropriate technical branches with review responsibility.
I l
l l
l l
l 1
L h
19 i
h
. o ,
Enclosure 1 Memo, Burrows to Thatcher, dated March 17,1997 DWering Professional View Concoming Technical Specification Setpoints and Allowable l
1 Values forinstrumentation l
l l
l l
i 20 i
l
__ _ . . . - _ - _ _ _ _ - . . - - - - - - - - - - - " - - ' ' - - - ~ ' ~ ~ ~ " ~ ~ ^ ^ ^ ^ ^ ~ *
' y,' ~s%
[
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 2000M001 '
March 17,1997 MEMORANDUM TO: Dale F. Thatcher, Section Chief Advanced Designs Section and Electrical Components Electrical Engineering Branch Division of Engineering FROM: ~ Frederick H. Burrows, Electrical Eng er .
Advanced Designs Section and Electrical Components Ilectrical Engineering Branch Division of Engineering
SUBJECT:
DIFFERING. PROFESSIONAL VIEW CONCERNING TECHNICAL SPECIFICATION SETPOINTS AND ALLOWABLE VALUES FOR INSTRUMENTATION Attached is the subject Differing Professional View (DPV) which you should forward to our Office Director per the latest DPV policy guidelines.
Tom Dunning (TSB/NRR) and Virgil Beaston (EELB/NRR) are two qualified individuals who are willing to serve on the review panel for this DPV.
Attachment:
As stated e
o g
l0*% i UNITED STATES g
- } NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. acceHoo1 A...../
DJf[ERING PROFE5510dAL VIEW CONCERNING TECHNICAL SP/CIFICATION SETPOINTS AN,D ALLOWABLE VALUES
,,,f0R INST (tUMENTATION 11 f.RLDERICK H. BURROWS In a memorandum to J. Werniel and C. Grimes dated March 6, 1996, I expressed a concern that the recent staff efforts to improve and simplify Westinghouse Standard Technical Specifications (STS) have undermined efforts in the 1980s to produce a meaningful and technical concise approach'to satisfy I') UR 50.36. Specifically, it is my opinion that the use of an allowable value to determine operability for an instrumentation channel in lieu of the channel's trip setpoint in technical specifications (TS) does not satisfy 10 CFR 50.36 and is not censistent with actual plant calculations that establish setpoints and with plant procedures that maintain the validity of those setpoints.
In a response of April 2,1996, C. Grimes and J. Werniel stated that it was not clear if I had raised a particular technical concern or policy concern regarding the appropriate means to reflect setpoint calculations and related maintenance practices into TS requirements. They also requested that I document w concerns so that they could be addressed before a revision to Regulatory Guide 1.105, " Instrument Setpoints for Safety Systems," or further improvements to the STS were made.
Instead of .riting a Differing Professional View to stay with the normal channels to express my con (DPV) cerns at that in the hopetime, thatI those chose efforts and the inputs from cthers, such as Westinghouse, would convince the staff of what I believe is their failure to produce STS that satisfy 10 CFR 50.36. 'Accordingly, in a memorandum to J. Wersial and C. Grimes dated
- August 9, 1996, I provided sy comments on the proposed Revision 3 to Regulatory Guide 1.105. In tha. meno I questioned whether the staff was consistently applying 10 CFR 50.36 and stated that the staff was downplaying the i rtance of the nominal trip setpoint, and that the nominal setpoint is the on y setting that will satisfy 10 CFR 50.36. In a response 'of August 29, 1996. C. Grimes an<1 J. Wersial stated that my comments would be considered along with those obtained from the public.
Now it appears that my commients and those by Westinghouse wi11 ' produce no change in the staff's approach to undermining the important of a channel's trip setpoint. Therefore, with this DPY, I wish to express my concerns as follows.
- 1. Regulatory Position 5 in the staff's draft Regulatory Guide DG-1045 (Proposed (circa October 1996) Revision 3 to Regulatory Guide 1.105) states:
The. allowable value, in conjunction with the trip setpoint, will determine the limits on instrument ATTADOtENT
9 operability and must be specified in the TS in order to meet 10 CFR 50.36. The LSSS should be developed in accordance with the setpoint methodology based on the standard, with the ai;o . le value listed in the TS '
and the relationship of the trip setpoint to the -
allowable value z.ust be documented and controlled by the setpoint methodology.
10 CFR 50.36 states that TS will include limiting safety system settings (LSSS) and "where a limiting safety system setting is specified for a variable on which a safety Ibit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded." In a typical setpoint methodology for instrumentation, it is only the trip setpoint which satisfies this requirement since its value accountsforalltheinstrumentationerrors.(pndnottheallowablevalue) This is supported by ISA-567.04-1994 which states that " trip setpoints in nuclear safety-related instruments shall be selected to provide sufficient allowance between the tri uncertainties."p Further, setpointthe andstandard the safety limitthat states to actsunt for "an allowance shall be provided between the trip setpoint and the analytical limit to ensure a trip before the analytical limit is reached" and "the trip setpoint should be the value that the final setpoint device is set to actuate."
Therefore, it is my view that the trip.setpoint by itself should be considered the LSSS. To use the allowable value as the LSSS or to include it as part of an LSSS (as the above quote from the draft revision to Regulatory Guide 1.105 does) serves no useful purpose and only adds confusion to TS.
- 2. In the TS for Westinghouse plants issued in the 1980s, a Limiting Condition of Operation (LCO) for safety-related instrumentation would typically state that an instrument channel was operable if its setpoint was set consistent with values shown for the trip setpoints. Contrary to this, the current Westinghouse STS states in the Bases that "if the measured setpoint does not exceed the allowable value, the bistable is considered operab'.e." It is my opinion that an instrument cleannel can only be considered operable if it is adjusted to the trip setpoint within the calibration tolerance specified in the associated setpoint cal:ulations since, as stated above, it is only the trip setpoint value (and not the allowable value) that accounts for all the instrumentation errers, and it is so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded.
' ISA-567.04-1994 states that an allowable value may include instrument celibration uncertainties, instrument uncertainties during normal operation, and instrument drift associated with the portion of the instrument channel being tested. It further states that the allowance for the trip setpoint shall account for all applicable design-basis events and process uncertainties (including those associated with the allowable value) unless they were included in the determination of the analytical limit.
. i ..'
l l
From my viewpoint, the TS should fccus on the trip setpoint value and not the allowable value. The sole purpose of an allowable value is to use it as a limit for instrument uncertainties actually encountered during periodic testing. If actual test results exen j the allowable value, then the corresponding assumptions in the setpoint methodology must be revisited to
' ensure continued validity of the trip setpoint selection. This is supported by ISA-567.04-1994, which states:
The purpose of the allowable value is to identify a value that, if exceeded, may mean that the instrument has not performed within the assumptions of the setpoint calculation. A channel whose trip setpoint as-found condition exceeds the allowable value should be evaluated for operability taking into account the setpoint calculation methodology.
In this quote, " operability" means future operability based on the revisited setpoint methodology assumptions and the setpoint set back to the specified trip setpoint value.
f I
i i
l
Enclosure 2 i
l 1
I l
l I l Memo, Samuel J. Collins, Director, NRR, dated March 24,1997 Differing Professional View (DPV) Panel l
l l
t 1
i I
l .
(
I 21 l
t l
. _ . . . _ _ _ _ _ _ . . . _ _ _ _ . . _ _ _ _ _ . _ . _ . . . _ . _ . _ _ . . _ _ - . _ _ _ . . ~ _ _
pa:eoug j '4 UNITED STATES s* 3' NUCLEAR REGULATORY COMMISSION I
WASHINGTON. D.C. 20086 4001 t
- \,....,*/ March 24, 1997 1
I MEMORANDUM TO: Roy P. Zimmerman Associate Director for Projects
/8ruceA.Boger, Director Division of Reactor Controls and Human Factors FROM:
Office of Nuclear Reactor Regulation h rector *
SUBJECT:
DIFrERING PROFESSIONAL VIEW (DPV) PANEL In acco; dance with NUREG/BR-0161 (attached), I hereby designate Roy Zimerman as the Chair of the ad-hoc DPV review panel and Bruce Boger as a panel member i
for the attached DPV. Management Directive and Handbook 10.159 are also
- attached.
~
The submitter of the DPV has provided a list of qualified individuals to serve 1 on the panel, from which one member can be selected by the Panel Chair.
I.
Please complete your review and provide your recommendation to me by May 9, 1997.
! Attachments:
1
- 1. DPV
.-3. Management Directive and Handbook 10.159 cc w/o attachments:
B. Sheron, DE J. Calvo,-DE
, F. Burrows, DE
. - _ . - . . ~ . - - - - . . - . - _ _ _ . - _ . . _ _ _ - . - . - . . . . _ - . - . - - . - . . .
Enclosure 3 Documents Reviewed by Panel
- 1. Memo, Burrows to Wermiel/ Grimes, dated 5/6/96 Westin9 house Standard Technical Specifications - Requirements for Electrical / Instrumentation Control Systems
- 2. Memo, Wermiel/ Grimes to Burrows, dated 4/2/96 Technical Specification Requirements for instrumentation and Control Systems
- 3. Copy of 10 CFR 50.36 Technical Specifications
- 4. RG 1.105, Revision 2, February 1986 Instrument Setpoints for Safety Related Systems
- 5. Memo, Burrows to Wermiel/ Grimes, dated 8/9/96 Proposed Revision to Regulatory Guide 1.105, " instrumentation Setpoints for Safety Systems"
- 6. Memo, Wermiel/ Grimes to ButTows, dated 8/29/96 Proposed Revision 3 to Regulatory Guide 1,105, " Instrument Setpoints for Safety Systems"
- 7. Copy of Draft Regulatory Guide DG-1045, Preposed Rev 3 to Regulatory Guide 1.105, October 1996 Instrument Setpoints for Safety Systems
- 8. Copy of ISA S67.04-1994 Setpoints for Nuclear Safety Related Instrumentation
- 9. Memo, Burrows to Thatcher, dated 03/17/97 Differing Professional View Concerning Technical Specification Setpoints and Allowable Values for instrumentation
- 10. ISA-S67.041982 Setpoints for Nuclear Safety Related instrumentation used in Nuclear Power Plants
- 11. Copy of Westinghouse Standardized Technical Specifications, Section 3.3, instrumentation and Bases
- 12. Copies of Public Comments provided to the draft of Revision 3 to Regulatory Guide 1.105.
- s. January 9,1997, letter from Duke Power
- b. December 19,1996, letter from Westinghouse Electric Corporation
- c. December 23,1996, letter from Nebraska Public Power District
- d. March 4,1997, letter from Mr. W. Brown
- 13. Westinghouse letter to NRC dated December 19,1996 22
.. s.
1 Comments on Dran Regulatcry Guide DG-1045 (RG 1.105 Rev 3)"Setpoints for Safety Related Instrumentation' )
)
l i
1 I
l l
1 I
l l
R
- 23 1
I Enclosure 4 Backaround on LSSS. Trio Setooints and Allowable Values This enclosure provides a tilstorical summary of the requirements for Limiting Safety System .
Settings (LSSS), Trip Setpoints (TSPs), and Allowable Values (AVs). The first part addresses regulatory requirements as specified in the Code of Federal Regulations. The second part addresses requirements as specified in Standard Technical Specifications (STS) that are used as a model for the Technical Specifications (TS) of operating nuclear power plants. The third part addresses industry and NRC guidance on TSPs and AVs.
Part 1: Code of Federal Regulations Federal Register, Volume 31, Number 158, Page 10891 (31 FR 108g1)
On Tuesday, August 16,1966, the Atomic Energy Commission proposed changes to $50.36,
" Technical Specifications" of Title 10, Part 50 o' the Code of Federal Regulations (10 CFR 50.36) to add requirements for safety limits, maximum safety system settings, and minimum conditions for operation. The statement of consideration noted that maximum safety system settings would be established at levels sufficiently low so that anticipated abnormal situations could be corrected without exceeding safety limits. The proposed wording for section (d)(1)(ii) was:
Maximum safety system settings are settings for automatic protective devices related to the variables on which safety limits have been placed pursuant to su'odivision (1) of this subparagraph (1). A maximum safety system setting shall be so chosen that automatic protective action will correct the most severe abnormal situation anticipated before a safety limit is exceeded. If the automatic safety system does not function as required, the licensee shall take appropriate corrective action, notify the Commission, review the matter and record the results of the review and corrective action taken and the reasons
- therefor.
Federal Register, Volume 31, Number 190, Page 12781 (31 FR 12781)
On Tuesday, December 17,1968, the Atomic Energy Commission finalized the rulemaking action on TS by modifying the proposed changes to $50.36 by subst;tuting the word " limiting" for the words " maximum" and " minimum" in describing safety system settings and conditions for operation, respectively. Other changes wars maos to the proposed $50.36 based on public comments. One change was to change tha scope of variables from those "on which safety limits have been plaerf to these "having significar! safety functions." The appropriate corrective action for s 3,ystem that does not function as required were modified by removing " corrective" to oescribe them and to note that they may include shutting down the reactor. The modified requirements for section (c)(1)(ii) were stated as:
Limiting safety system settings are settirigs for automatic protective devices related to those variable having significant safety functiona. Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting shall be so 4 chosen that automatic protective action will correct the most severe abnormal situation anticipated before a safety limit is exceeded if, during operation, the automatic safety 1
24 1
system does not function as required, the licensee shall take appropriate action, which may indude shutting down the reactor. He shall notify the Commission, review the matter and record the results of the review, including the basis for corrective measures taken.
The Panel found that the change in scope for LSSS to include not just variables for which a safety limit has been placed but to include those having significant safety functions extends the
- consideration of the 10 CFR 50.36 requirements for LSSS to all safety functions included in TS.
Federal Register, Volume 38, Number 84, Page 10815 (38 FR 10815)
On Wednesday, May 2,1973, the Atomic Energy Commission issued proposed amendments to
$50.36 to add provisions for TS for fuel reprocessing plants, that include a new section (c)(1)(ii)(B) on limiting control settings for fuel reprocessing plants. The limiting control settings for fuel reprocessing plants are settings for automatic alarm or protective devices related to those variables having significant safety functions. With this change, a number of minor editorial and clarifying changes were included for $50.36. The requirements for limiting safety system setting for nuclear reactors was renumbered as section (c)(1)(ii)(A). The requirements for hmiting safety system settings for nuclear reactors were modified by removing "most severe" to describe the abnormal situation anticipated for choosing a setting to correct before a safety limit is exceeded. Likewise, the corrective measures were expanded with the underiined changes as follows:
He shall notify the Commission, review the matter and record the results of the review, including the cause of the conditions and the basis for corrective action taken to oreclude reoccurrence.
Federal Register, Volume 39, Number 130, Page 24626 (39 FR 24626)
On Friday, July 5,1974, the Atomic Energy Commission amended $50.36 to add requirements for fuel reprocessing plants and editorial changes proposed in 38 FR 10815 as noted above.
Federal Register, Volume 53, Number 103, Page 19240 ( 53 FR 19240)
On Friday, May 27,1988, the Nuclear Regulatory Commission amended $50.36 as a part of the incorporation of broad regulatory changes with regard to records retention periods. The changes to the requirements for limiting safety system settings substituted "The licensee" for "He" in stating the requirement of whom shall notify the Commission and take corrective actions when an automatic safety system does not function at required.
Part 2: STS Guidance The earty drafts of the STS for Westinghouse Plants, NUREG-0452, (circa 1974) had a section on LSSS under Chapter 2," Safety Limits and LSSS." This section specified that the Reactor Trip System (RTS) Instrumentation setpoints be set consistent with the TSP values shown in Table 2.2-1. Early drafts of the STS also included requirements for TSPs under Limiting Condition for Operation (LCO) 3.3.2 for the Engineered Safety Features Actuation System (ESFAS) that were similar to those specified in the Chapter 2 section on LSSS for the RTS.
Administrative Controls in the earty versions of the STS, and in plant TS at that time, imposed a requirement for an abnormal occurrence report (later renamed as a licensee event report) 25
whenever an instrument channel was found to be inoperable. Consequently, a large number of reports were required because normal instnJment drift caused setpoints to change during a surveillance interval such that the "as found" value often exceeded the TSP when the next surveillance was performed.
Subsequent changes to the draft STS proposed in the fall of 1975 added AVs to Table 2.2-1 for the RTS functions. The AV was determined by adding the channel uncertainty due to instrument i
drift to the TSP. Thus, a RTS channet would be capable of performing its safety function when the "as found" value of a protective device setting exceeded the TSP, so long as it did not exceed the AV, i.e., instrument drift did not exceed the allowance for this uncertainty that was used to determine the TSP. However, the instrument setting would be adjusted so that the "as left" value did not exceed the TSP as specified by the LSSS specification for the RTS, or as specified by the LCO for the ESFAS instrumentation. This action, adjusting the setpoint to not exceed the TSP, restores the margin for instrument drift that may occur over the next surveillance interval.
When AVs were added to the STS, new actions specified the remedial measures to be taken when a setpoint exceeded the AV. The new actions were to (1) declare the channelinoperable and (2) apply the applicable action statement requirement of Specification 3.3.1.1 (the Limiting Condition for Operation for the RTS), until the channel is restored to OPERABLE status with its setpoint adjusted consistent with the TSP value. The latter action, adjusting the setting to restore the channel to operable status, would be taken as part of the surveillance that determined that the protective setting exceeded its AV. Hence, having restored the channel to operable status to complete tne surveillance requirement, there would be no need to implement the new TS actions that werte added to the STS. NUREG-0452 was finalized and issued in June of 1978.
With the addition of AVs to plant TS, a basis was provided for a finding that a channel was operable when its setpoint was found to exceed the TSP but not the AV. This significantly reduced the number of abnormal occurrence reports that licensees had to submit when instrument drift, which occurs during the surveillance interval, caused a setpoint to be found that exceeded its TSP.
Subsequent revisions of the Westinghouse STS, NUREG-0452, were issued up to and including Revision 4, dated Fall 1981, but without any significant change to the guidance on TSPs and AVs. In June of 1987, the staff issued an updated version of the STS for Westinghouse (W) plants titled "W STS Desk Reference" to be used as necessary and appropriate to determine the difference between current licensing practice for W plants and that documented in NUREG-0452, Rev. 4. What is significant about this version of the W STS is the manner in which AVs were treated. In addition, to the specification of TSPs and AVs for each trip function, three additional columns of data were added for the Reactor Trip System (RTS) and Engineered Safety Features Actuation System (ESFAS) instrumentation tables. One column was labeled as a " Total Allowance, (TA)," a second as " Sensor Error (S)," and the third was just identified as the letter "Z." The action requirements stated that with an RTS or ESFAS instrumentation or interiock setpoint less conservative than the AV shown in the table, adjust the setpoint consistent with the TSP value of the table and determine within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> that a equation, relating the values of the three new table entries, TA, S, and Z, and the "as measured" rack error for the affected channel, was satisfied. If these requirements were not met, the attemative was to declare the channel inoperable and apply the applicable action statement requirement, for an inoperable channel, until the channel is restored to operable status with its setpoint adjusted consistent with the TSP.
, 26 L
. , o. ,
in September 1992, the improved Standard Technical Specifications (ISTS) were issued as a series of NUREG documents (1430-1434) for each of the Nuclear Steam Supply System (NSSS) vendors. Changes were proposed by the vendor Owner's Groups and subsequently reviewed and approved by the staff. Changes were made in the manner that setpoint requirements were specified. The section on LSSS for the RTS was removed and the setpoint table was moved to the LCO for the RTS. The LCOs for the RTS and ESFAS were changed to specify that the associated instrumentation shall be operable, but without the eariier reference to the adjustment of setpoints consisterit with the TSP.
For NSSS vendors other than W, the tables for the RTS and ESFAS LCOs listed only the AVs and not the TSPs. For these non-W NSSS vendors, the ISTS Bases state that the AV is the LSSS.
The ISTS for Westinghouse plants include both the TSP and the AV, however a footnote for the TSP column of the LCO Table provides the option of a unit specific implementation to include only the AV. The associated Bases states that the TSP is the LSSS, but with the TSP in brackets to indicate that it may be different on plant specific basis, i.e., it could be the AV if the TS Table used a single column format that did not include the TSP. The W ISTS dropped the three additional column factors that were added in the Staff's document titled "W STS Desk Reference," noted above.
Part 3: Industry and NRC Guidance in addition to the guidance provided in tne early versions of the STS and subsequent ISTS, TSPs and AVs have been addressed in an industry standard that has been revised a number of times, and an NRC Regulatory GuSe that was issued based on the original version of the industry standard.
Initial Industry Guidance The Instrument Society of America (ISA) issued a' standard, ISA S67.04, "Setpoints for Nuclear Safety-Related instrumentation Used in Nuclear Power Plants,"in 1982. The Preface to this standard notes that setpoint drift is a problem which has led to numerous abnormal occurrence reports and that the ISA sponsored a review of the setpoint drift problem in April 1975 by establishing the committee that developed this standard. Figure 1 of the standard (See Enclosure 5) shows the relationship between a safety limit (SL), the AV, and the TSP. The standard defined setpoint as:
A predetermined level at which a bistable device changes state to indicate that the quantity under surveillance has recched the selected value.
The standard addresses the instrument uncertainties that are to be considered when establishing the AV to assure that it is chosen so that the SL will not be exceeded for anticipated operational occurrences and accidents. Since most instrument uncertainties are expressed as i values, that are normally distributed, it is very improbable that all uncertainties would ever occur at the stated value at the same time and in the non-conservative direction. An algebraic sum of the uncertainties would greatly over-estimate the uncertainty in obtaining a trip at the desired value of the monitored parameter (s). Hence, the standard endorses the use of the " square root of the d
sum of the squares" method for combining instrument uncertainties, to determine the value of an 27 4
. . h .. , ,
AV that is conservative with respect to the value of the measured parameter assumed by the safety analysis to initiate a protective action and that prevents a SL from being exceeded.
in addition, the standard requires that the TSP shall be a value which allows for drift and l adjustment. Specincally, the standard requires that the TSP be chosen so that the corresponding AV is not exceeded due to (1) drift of that portion of the instrument channel which is tested when the setpoint is determined, and (2) actual setting of the setpoint within an .
alloweble tolerance of upper and lower setpoint limits about the TSP, also shown on Figure 1. ,
The ISA standard also addressed periodic testing by noting the following:
if the "as found" setpoint indecates the setpoint is within the "no readjustment" band (see Figure 1) or that calculations based on the analog value would result in setpoints within the "no readjustment" band, documentation of the rt aults is the only required action, if the "as found" setpoint exceeds the upper setpoint l.mit, readjustment shall be performed to bring this channel back within the "no readjustment" band, if the "as found" setpoint is below the lower setpoint limit, readjustment may be made to avoid unnecessary trips, but is not mandatory.
Thus, while the standard defined a lower setpoint limit, it did not consider compliance with it to be a safety significant matter, nor one that it would be address by TS.
NRC Guidance NRC issued Regulatory Guide (RG) 1.105, " Instrument Setpoints for Safety-Related Systems,"
Revision 2 in February 1987 which endorsed the ISA Standard, ISA S67.04-1982. The RG also discussed key terms used by the ISA standard that are not defined or have unclear application, and "for convenience" (sic), provided the following information:
The term " upper setpoint limit" as used in Figure 1 of the standard is the same as " trip setpoints" as used in aforementioned STS in that drift above the " upper setpoint limit" (standard) or " trip setpoint" (STS) requires readjustment.
With the clarification of the TSP as the upper setpoint limit as stated in the RG, the difference between the TSP and the AV is reduced to just the instrument drift. Another clarification made by the RG was:
The term " allowable value" as used in the standard is consistent with the usage in the bases sections of the STS (citation to NUREGs was provided)
The Bases for the Section 2.2, "LSSS," of the cited STS address the Reactor Trip System Instrumentation Setpoints as follows:
Operation with a trip set less conservative that its Trip Setpoint but within its specified Allowable Value is acceptable on the basis that the difference between each Trip Setpoint and the Allowable Value is equal to or less than the drift allowance assumed for each trip in the safety analyses.
The Panel notes that there are two precautions that should be taken when reading this statement. The first is that it doesn't say that the "as left" value of an instrument setting may be 28
v.". '
less conservative than the TSP. The LSSS requirement stated in the STS is that the reactor trip system instrumentation setpoints shall be set consistent with the Trip Setpoint values shown in Table 2.21 which are stated as a single side bounding limit,i.e, s or :r than a stated value.
' Hence, this situation, where an instrument setting is less conservative than the TSP, requires an adjustment that would have to be made as a part of any surveillance procedure that determines the channel setting.
The sr.,cond precaution is with regard the stated basis for acceptable operation, "the difference between each Trip Setpoint and the Allowable Value is equal to or less than the drift allowance assumed for each trip in the safety analysis." The approach stated in the ISA standard is to first determine an AV based on all uncertainties other than instrument drift (that drift being for that portion of the instrument channel which is tested when the setpoint is determined) and then dotermine the TSP such that the difference between the TSP and the AV is at least equal to the drift allowance assumed in the safety analysis, but surely not by using a value "less than" that as implied by the quoted basis. The quoted statement would only apply if the TSP is first determined based on consideration of allinstrument uncertainties including instrument drift, and then the AV was determined in a manner that satisfied the quoted basis. In this case, an AV would be conservative if the quoted statement were true.
Subsecuent Revisions of Industrv Guidance ISA-S67.041987, with a shortened title "Setpoints for Nuclear Safety-Related Instrumentation,"
was issued with the stamp "ANS/lSA 67.041988 Approved February 4,1988." The Preface of the standard stated:
The purpose of this revision is for clarification and to reflect current industry practice. The term " Trip Setpoint"is now consistent with the terminology used in the NRC Standard Technical Specifications and reflects what was previously know as " Upper Setpoint Limit."
This version of the standard made a number of changes, only some of which are discussed here.
One change was to state that "each LSSS normally has two components, called a trip setpoint and its allowable value." In contrast, the Paners finding is that the LSSS is the TSP, a value that is used to adjust a protective device to assure that is capable of performing its safety function.
The standard addresses the topic " Safety Analysis" as follows:
The safety analysis establishes an analyticallimit in terms of a measured or calculated variable and a specific time after that value is reached to begin protective action.
Satisfying these two constraints will ensure that the safety limit will not be exceeded during anticipated operational occurrences and design basis events. (The standard i states that design limits for Engineered Safety Features are treated the same as safety limits.) Choosing a limiting safety setting (LSSS) to begin protective action before the analytical limit is reached will ensure that the consequences of a design basis event are not more severe than the safety analysis predicted. An LSSS, derived from an analytical 4
limit, is published in the technical specifications and maintained by plant operating procedures.
This discussion implies that the LSSS is the single value limit used to initiate a protective action, namely, the TSP.
29 1
9 , e JO e
This version of the standard defined the term " analytical limit" as:
Limit of a measured or calculated variable established by the safety analysis to ensure
- that a safety limit is not exceeded.
The defined term "setpoint" as used in the prior version of the standard was change to " trip 3 setpoint" and retained its prior definition as:
- A predetermined level at which a bistable device changes state to indicate that the
! quantity under surveillance has reached the selected value."
Another change was to define the AV as:
The limiting value that the trip setpoint can have when tested periodically, beyond which the instrument channel is declared inoperable and corrective action must be taken.
The Panel found that this appears to be an improvement to clarify the purpose of the allowable value.
The 1988 version of the standard stated the requirements for the trip setpoint as follows:
An allowance shall be provided between the trip setpoint and the analyticallimit to ensure a trip before the analytical limit is reached. The allowance used shall account for all applicable design basis events and the process instrument uncertainties listed below unless they were included in the determination of the analyticallimit.
The Panel notes that this approach differs from the prior version of the standard that first determines an AV and, then based on that value, determines a TSP.
The requirements for the AV were stated as:
The uncertainties of that portion of the instrument channel being tested to be used to determine the allowance between the trip setpoint and the Allowable Value are:
- 1. Instrumen*, Calibration Uncertainties
- 2. Instrument Uncertainties During Normal Operation
- 3. Instrument Drift This change increases the difference between the AV and the TSP that one would calculate based on specification data for those uncertainties as compared to determinations of AVs based on the previous version of the Standard that only considered instrument drift, since the considerson of the "no adjustment" band was effectively eliminated by the RG position that the
" upper s itpoint" limit is equivalent to the TSP stated in TS.
The ISA Standard was subsequently revised and issued as ISA-S67.04, Part 1, Approved September 1994. This version of the ISA standard revised the definition of the AV to state:
30
...s.
, A limiting value that the trip setpoint may have when tested periodically, beyond which
) appropriate action shall be taken.
The Panel notes that " appropriate action"is broader in its implications but less definitive than previously stated as a being a condition that the instrument channelis declared inoperable.
However, with the 5 column format for setpoint infonnation in the Staff's Desk Reference version l of the W STS, those TS requirements provide an option for a conclusion that a channel could be operable when the AV is exceeded if the equation using the other setpoint column data is satisfied. Hence, the AV is not always as a bounding limit for operability determinations.
l This version of the standard also defined the terms related to trip setpoints as determined during surveillances as follows:
as found: The condition in which a channel, or portion of a channel, is found after a period of operation and before re-calibration (if necessary).
The Panel developed the view that this is the value of a measured parameter at which a protective device would initiate a safety action as determined during a surveillance test conducted after a period of time (the surveillance interval), but before any adjustment of the device setting has been made.
l as left: The condition in which a channel, or portion of a channel, is left after calibration or final setpoint device setpoint verification.
The Panel developed the view that this is the value of a measured parameter at which a protective device would initiate a safety action as determined during a periodic test, after any adjustment of the device setting has been made, when it is determined that such adjustment is necessary based on the "as found value."
The 1994 version of the standard also restored the "no adjustment" band about the TSP that was defined as a " region of calibration tolerance (acceptable as left condition)" on Figure 1 of the standard (See Enclosure 8). The Figure notation is that the calibration tolerance is addressed in Section 4.3.1 of the standard. The Panel assumes that the calibration tolerance is included as part of instrument calibration uncertainties attributed to the calibration method, item a) 3), but the standard is not clear on where a calibration tolerance is placed in the defined list of instrument uncertainty considerations. The Preface to the standard retained the clarification made in the 1987 revision about the TSP being what was previously know as the " upper setpoint limit" but did not address the restoration of that term, " upper setpoint limit *, in the current (1994) version of the standard.
Part 2 of the ISA Standard," Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation," was issued at the same time as Part 1. With regard to calibration tolerance, Part 2 of the standard implies that there are situations where a calibration tolerance may be used for and in lieu of the actual reference accuracy in the setpoint uncertainty calculation and without including the calibration tolerance as a separate term. Part 2 of the standard also provided three methods for determining TSPs and AVs based on the value of the Analytical Umit (AL) and instrument uncertainties. The first method determines both the TSP and AV using the AL and the uncertainties between it (the AL) and remaining two term, TSP and AV, A second method determines the value of the TSP using the AL and all uncertainties between it (the AL) and the TSP, and then subsequently using that TSP to determine the AV 31
$ , ' '. . o ,
based on the uncertainties between these two terms. The third method is similar to the second, but first determines the AV based upon uncertainties between the AL and AV, and then uses that AV to determine the TSP based on the uncertainties between it (the TSP) and the AV. Needless to say, the different methods will yield diMerent results. Likewise, depending upon the method used, the treatment of the calibration tolerance as an uncertainty, including those cases where the standard would allow one to ignore the reference accuracy noted above, will yield yet different results with regards to the difference between TSPs and AVs.
32
%* * .o o Enclosure 5 l
l Figure 1 of ISA Std S67.04 (1982) l l
I l
i l
l I
I 33 i
1 l
1 i
--