RS-24-032, Response to Request for Additional Information Related to License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion

Response to Request for Additional Information Related to License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion

ML24096B782
Person / Time
Site:	Quad Cities
Issue date:	04/05/2024
From:	Humphrey M Constellation Energy Generation
To:	Office of Nuclear Reactor Regulation, Document Control Desk
References
RS-24-032
Download: ML24096B782 (1)

Text

4300 Winfield Road Warrenville, IL 60555 630 657 2000 Office 10 CFR 50.90 RS-24-032 April 5, 2024 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Quad Cities Nuclear Power Station, Units 1 and 2 Renewed Facility Operating License Nos. DPR-29 and DPR-30 NRC Docket Nos. 50-254 and 50-265

Subject:

Response to Request for Additional Information Related to License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b"

References:

1. Letter from P.R. Simpson (Constellation Energy Generation LLC) to U.S.

NRC,

Subject:

License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," dated June 8, 2023 (ADAMS Access No. ML23159A249)

2. Email from R. Kuntz (U.S. NRC) to R. Steinman (Constellation Energy Generation, LLC),

Subject:

Request for Additional Information RE: TSTF-505 and 10 CFR 50.69 license amendments, dated March 6, 2024 (ADAMS Accession No. ML24066A153)

3. Letter from M. Humphrey (Constellation Energy Generation LLC) to U.S.

NRC,

Subject:

Response to Request for Additional Information Related to License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," dated March 19, 2024 (ADAMS Access No. ML24079A122)

In the Reference 1 letter, Constellation Energy Generation, LLC (CEG) requested an amendment to Renewed Facility Operating License Nos. DPR-29 and DPR-30 for Quad Cities Nuclear Power Station (QCNPS) Units 1 and 2. The proposed amendment would modify the Technical Specifications (TS) requirements to permit the use of Risk Informed Completion Times (RICTs) in accordance with TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b," (ADAMS Accession No. ML18183A493).

Reference 2 identified additional information needed to support the NRC review of Reference 1.

April 5, 2024 U.S. Nuclear Regulatory Commission Page 2 Reference 3 provided the requested additional information, except for the response to EICB RAI-01. Attachment 1 provides the response to EICB RAI-01. As part of this response, an omission in Reference 1 Enclosure 1 Section 5 was identified. This omission is corrected in of this submittal, which provides a new complete copy of Section 5 the replaces the prior version in its entirety.

CEG has reviewed the information supporting the finding of no significant hazards consideration, and the environmental consideration that were previously provided to the NRC in Reference 1.

The additional information provided in this submittal does not affect the bases for concluding that the proposed license amendment does not involve a significant hazards consideration. In addition, the information provided in this submittal does not affect the bases for concluding that neither an environmental impact statement nor an environmental assessment needs to be prepared in connection with the proposed amendment.

CEG is notifying the State of Illinois of this supplement to a previous application for a change to the operating license by sending a copy of this letter and its attachments to the designated State Official in accordance with 10 CFR 50.91, "Notice for public comment; State consultation,"

paragraph (b).

There are no regulatory commitments contained in this letter. Should you have any questions concerning this letter, please contact Ms. Rebecca L. Steinman at (779) 231-6162.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 5th day of April 2024.

Respectfully, Mark Humphrey Sr. Manager Licensing Constellation Energy Generation, LLC Attachments:

1. Response to Request for Additional Information EICB RAI-01

2. Revised Copy of TSTF-505 LAR Enclosure 1 Section 5, "Evaluation of Instrumentation and Control Systems" cc:

Regional Administrator - NRC Region III NRC Senior Resident Inspector - QCNPS NRC Project Manager, NRR - QCNPS Illinois Emergency Management Agency - Division of Nuclear Safety

Humphrey, Mark D.

Digitally signed by Humphrey, Mark D.

Date: 2024.04.05 15:45:15

-05'00'

ATTACHMENT 1 Quad Cities Nuclear Power Station Docket Nos. 50-254 and 50-265 Facility Operating License Nos. DPR-29 and DPR-30 Response to Request for Additional Information Related to License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" Response to Request for Additional Information EICB RAI-01

QCNPS Request to Adopt TSTF-505 Response to Request for Additional Information Page 1 of 2 Docket Nos. 50-254 and 50-265 REQUEST FOR ADDITIONAL INFORMATION LICENSE AMENDMENT REQUESTS TO REVISE TECHNICAL SPECIFICATIONS TO ADOPT TSTF-505, REVISION 2 AND IMPLEMENT 10 CFR 50.69 CONSTELLATION ENERGY GENERATION, LLC QUAD CITIES NUCLEAR POWER STATION, UNITS 1 AND 2 DOCKET NOS. 50-254 AND 50-265 By letters dated June 8, 2023 (Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML23159A249 and ML23159A253, respectively), Constellation Energy Generation, LLC (Constellation, the licensee) submitted two license amendment requests (LARs) for Quad Cities Nuclear Power Station (Quad Cities), Units 1 and 2. The proposed amendments would modify Renewed License Nos. DPR-29 and DPR-30, and the Technical Specifications (TSs) to adopt Technical Specifications Task Force (TSTF) Traveler TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times, RITSTF [Risk-Informed Technical Specification Task Force] Initiative 4b" (ML18183A493), and to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations, Part 50 (10 CFR 50), section 50.69, "Risk-informed categorization and treatment of structures, systems, and components [SSCs] for nuclear power reactors."

The NRC staff has determined that additional information is needed to support its review. The following is the NRC staff's draft request for additional information.

EICB RAI-01 In Section 3.1.2.3 "Evaluation of Instrumentation and Control Systems" of the TSTF-505 Revision 2 Model Safety Evaluation, the NRC clarifies that the basis of the staff's safety evaluation is to consider "a number of potential plant conditions allowed by the new TSs" and to consider "what redundant or diverse means were available to assist the licensee in responding to various plant conditions." The TSTF-505 Revision 2 position recommends that "at least one redundant or diverse means (e.g., other automatic features or manual action) to accomplish the safety functions (e.g., reactor trip, safety injection, or containment isolation) remain available during the use of the RICT." This approach is consistent with maintaining a sufficient level of defense-in-depth in accordance with RG 1.174, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk Informed Decisions on Plant Specific Changes to the Licensing Basis,"

(ML100910006), and the guidance in Revision 1 of RG 1.177, "An Approach for Plant Specific, Risk Informed Decisionmaking: Technical Specifications," (ML100910008), which further describe the regulatory position with respect to defense-in-depth (including diversity). of the TSTF-505 LAR lists the functions of the Instrumentation and Control Systems and their design logics; however, this list does not provide NRC staff adequate information to verify that at least one redundant or diverse means will remain available to accomplish the intended I&C safety functions during the proposed risk informed completion time.

QCNPS Request to Adopt TSTF-505 Response to Request for Additional Information Page 2 of 2 Docket Nos. 50-254 and 50-265 Describe other means that exist to initiate the safety function for each plant accident condition that each affected I&C function is currently designed to address. The evaluation of "diverse means," should identify the conditions that the functional unit responds to, and for each condition, other means (e.g., diversity, redundancy, or operator actions) that can be used.

Alternatively, provide additional information to demonstrate that defense-in-depth is maintained during the extended completion times for each function. This information is needed to demonstrate compliance with 10 CFR 50.36(c), and consistency with the implementing guidance in RG 1.174 and the TSTF-505, Revision 2.

Constellation Response to EICB RAI-01 TSTF-505 LAR Enclosure 1 Section 5, "Evaluation of Instrumentation and Control Systems" described the design of the Quad Cities Nuclear Power Station (QCNPS) logic systems for seven instrumentation Technical Specifications (TS) sections but did not explicitly discuss how each function is used to address design basis transients/accidents. The originally submitted tables in each subsection were annotated such that the redundancy and logic table in each subsection is designated "a" and a new table, designated "b" was added to provide additional information related to the diverse means available to mitigate transients/accidents each identified instrumentation and control function is designed to prevent. Additionally, during preparation of this response, it was noted that the discussion of TS 3.3.6.3 relief valve instrumentation was missing from the originally submitted version of TSTF-505 LAR Enclosure 1 Section 5. A revised copy of Section 5 with revision bars to indicate the edits from the original LAR version to add the TS 3.3.6.3 discussion and the new "b" diversity summary tables is included as Attachment 2 to this transmittal letter.

The "Diverse Instrumentation" column of the new "b" tables tabulate all the means by which the logic addresses the column "Transient/Accident" as listed in the Updated Final Safety Analysis Report (UFSAR). The lists presented in these new tables does not represent any change in the way defense in depth is achieved; it only reflects those functions which can affect the associated logic (e.g., automatic or manual relays within the reactor protection system (RPS)).

As such, this table represents the current licensing basis with no proposed changes to system redundancy, independence, and diversity in the TSTF-505 LAR.

While the manual actions listed in these new tables are provided by design, they are not the primary means of mitigating the accident/transient listed. Each instrumentation logic is provided with redundant channels which are credited in the licensing basis for successfully performing the function. If enough of the redundant channels fail, such that a loss of function occurs, then a RICT cannot be applied as described in the TSTF-505 LAR and the associated TS markups.

Since a RICT would not be calculated under the loss of automatic function circumstance, the PRA modeling of the manual actions listed in the new tables, either directly or through the use of surrogates, has no impact.

ATTACHMENT 2 Quad Cities Nuclear Power Station Docket Nos. 50-254 and 50-265 Facility Operating License Nos. DPR-29 and DPR-30 Response to Request for Additional Information Related to License Amendment Request to Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" Revised Copy of TSTF-505 LAR Enclosure 1 Section 5, "Evaluation of Instrumentation and Control Systems"

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-28 Table E1-3: TSTF-505, Revision 2, Table 1 TS that Require Additional Justification TS Description TSTF-505 TS QCNPS TS Additional Justification Reactor Building-to-Suppression Chamber Vacuum Breakers -

Two or more lines with one or more reactor building-to-suppression chamber vacuum breakers inoperable for opening.

3.6.1.7.D 3.6.1.7.E The QCNPS TS for 3.6.1.7.E are for, Two lines with one or more reactor building-to-suppression chamber vacuum breakers inoperable for opening. This is an implementation item identified in Attachment 5. The model will be updated to include these SSCs prior to exercising the RICT program for this TS.

Under certain configurations with one or more reactor building-to-suppression chamber vacuum breakers on two or more lines, a loss of function may occur. Therefore, a Note is added to the Completion Time which prohibits applying a RICT when the function is not maintained.

Main Turbine Bypass System -

Requirements of the LCO not met or Main Turbine Bypass System inoperable.

3.7.7.A 3.7.7.A N/A - TSTF-505 changes are excluded.

5. Evaluation of Instrumentation and Control Systems The following Instrumentation TS Sections are included in the TSTF-505 application for QCNPS:

x TS 3.3.1.1 - Reactor Protection System (RPS) Instrumentation x

TS 3.3.2.2 - Feedwater System and Main Turbine High Water Level Trip Instrumentation x

TS 3.3.4.1 - Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT)

Instrumentation x

TS 3.3.5.1 - Emergency Core Cooling System (ECCS) Instrumentation x

TS 3.3.5.3 - Reactor Core Isolation Cooling (RCIC) System Instrumentation x

TS 3.3.6.1 - Primary Containment Isolation Instrumentation x

TS 3.3.6.3 - Relief Valve Instrumentation x

TS 3.3.8.1 - Loss of Power (LOP) Instrumentation

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-29 QCNPS TS Section 3.3 LCOs were developed to assure that QCNPS maintains necessary redundancy and diversity, compliant with the intent of "single failure" design criterion as defined in IEEE-279-1968 and diversity requirements as defined in Topical Report NEDO-10139, "Compliance of Protection Systems to Industry Criteria: GE BWR Nuclear Steam Supply System."

5.1 TS 3.3.1.1 - RPS Instrumentation The RPS Instrumentation employs diversity in the number and variety of different inputs which will actuate the associated equipment. The RPS, as described in the QCNPS Updated Final Safety Analysis Report (UFSAR), Section 7.2s, includes sensors, relays, bypass circuits, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters. The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level, reactor vessel pressure, neutron flux, main steam line isolation valve position, turbine control valve fast closure oil pressure, turbine stop valve position, drywell pressure, and scram discharge volume water level, as well as reactor mode switch in shutdown position, manual scram signals, and RPS channel test switch scram signals. There are at least four independent sensor input signals from each of these parameters (except for the reactor mode switch in shutdown and manual scram signals). Some channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an RPS trip signal to the trip logic. Table E1-4a presents the TS 3.3.1.1 logic descriptions for all the functions listed in TS Table 3.3.1.1-1. Table E1-4b summarizes the diverse means available to mitigate accidents for which each identified instrumentation and control function is designed to prevent.

Table E1-4a: RPS Instrumentation Redundancy Function Logic Logic Description Intermediate Range Monitors (IRMs) 1.a - Neutron Flux-High 2 / 8 The IRM System is divided into two trip systems, with four IRM channels inputting to each trip system.

One channel in each trip system is allowed to be bypassed. One IRM channel tripped in each RPS trip system causes a SCRAM. The eight channels are arranged in a one-out-of-four taken twice logic 1.b - Inop 2 / 8 See Function 1.a.

Average Power Range Monitors (APRMs) 2.a - Neutron FluxHigh, Setdown 2 / 6 There are six channels of APRM. Three of the APRM channels provide trip inputs to one RPS trip system, and the other three APRM channels feed the other RPS trip system. The system is designed to allow one channel in each trip system to be bypassed. Any one APRM channel in a trip system can cause the associated trip system to trip. Both trip systems must trip for a reactor scram in what is effectively a one-out-of-two taken twice logic (or

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-30 Table E1-4a: RPS Instrumentation Redundancy Function Logic Logic Description one-out-of-three taken twice if no APRMs are bypassed).

2.b - Flow Biased Neutron FluxHigh 2 / 6 See Function 2.a above.

2.c - Fixed Neutron Flux-High 2 / 6 See Function 2.a above.

2.d - Inop 2 / 6 See Function 2.a above.

For any APRM, anytime its APRM mode switch is moved to any position other than "Operate," an APRM module is unplugged, or the APRM has too few LPRM inputs (< 50%), an inoperative trip signal will be received by the RPS, unless the APRM is bypassed. Since only one APRM in each trip system may be bypassed, only one APRM in each trip system may be inoperable without resulting in an RPS trip signal.

3 - Reactor Vessel Steam Dome PressureHigh 2 / 4 Four channels, with two channels in each RPS trip system, arranged in a one-out-of-two taken twice logic.

4 - Reactor Vessel Water LevelLow 2 / 4 Four channels, with two channels in each RPS trip system, are arranged in a one-out-of-two taken twice logic.

5 - Main Steam Isolation ValveClosure 6 / 16 Each of the eight MSIVs has two position switches; one inputs to RPS trip system A while the other inputs to RPS trip system B. Thus, each RPS trip system receives an input from eight Main Steam Isolation Valve - Closure channels. The logic is arranged such that either the inboard or outboard valve on three or more of the main steam lines must be < 90% open in order for a SCRAM to occur.

6 - Drywell Pressure High 2 / 4 Four channels, with two channels in each RPS trip system, arranged in a one-out-of-two taken twice logic.

Scram Discharge Volume Water LevelHigh 7.a - Float Switch 2 / 4 Scram discharge volume (SDV) high water level inputs to the RPS are from two float-type and two differential pressure-type level sensors on each of the SDVs. They are arranged such that a float-type and a differential pressure-type level sensor for each channel are connected to each SDV. An actuation of any level switch causes a channel trip; an actuation of two level switches, one in each trip system, causes a scram (one-out-of-two taken twice logic).

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-31 Table E1-4a: RPS Instrumentation Redundancy Function Logic Logic Description 7.b - Differential Pressure Switch 2 / 4 See Function 7.a above.

8 - Turbine Stop Valve-Closure 6 / 8 Signals are initiated from position switches located on each of the four Turbine Stop Valves (TSV). A position switch with two independent contacts is associated with each TSV; one of the two switch contacts provides input to RPS trip system A; the other to RPS trip system B. Thus, each RPS trip system receives an input from four Turbine Stop Valve - Closure channels, each consisting of one position switch (which is common to a channel in the other RPS trip system) and a switch contact. The logic for the Turbine Stop Valve - Closure function is such that three or more TSVs must be < 90% open to produce a scram.

9 - Turbine Control Valve Fast Closure, Trip Oil PressureLow 2 / 4 Four channels of Turbine Control Valve Fast Closure, Trip Oil Pressure - Low function, with two channels in each trip system arranged in a one-out-of-two taken twice logic.

10 - Turbine Condenser Vacuum-Low 2 / 4 Four channels of Turbine Condenser Vacuum - Low function, with two channels in each trip system arranged in a one-out-of-two logic taken twice logic.

11 - Reactor Mode Switch Shutdown Position 2 / 2 Each RPS trip system contains one Manual Scram logic channel that is redundant to the two automatic trip channels. Actuation of both Manual Scram logic channels will result in a full reactor scram. The Reactor Mode Switch is a single mechanical switch which provides a direct input into both Manual Scram channels when placed in the Shutdown position.

12 - Manual Scram 2 / 2 Each RPS Trip System contains one Manual Scram logic channel that is redundant to the two automatic trip channels. Actuation of both Manual Scram logic channels will result in a full reactor scram. There is one Manual Scram push button channel for each of the RPS manual scram logic channels

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-32 Table E1-4b: RPS Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident Intermediate Range Monitors (IRMs) 1.a - Neutron Flux-High None None

1) Automatic Initiation a) IRM Neutron Flux - High b) APRM Neutron Flux - High (Setdown)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position None 1.b - Inop None None Manual SCRAM None Average Power Range Monitors (APRMs) 2.a - Neutron Flux High, Setdown None None

1) Automatic Initiation a) APRM Neutron Flux - High (Setdown) b) IRM Neutron Flux - High

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position None 2.b - Flow Biased Neutron FluxHigh None None

1) Automatic Initiation a) APRM Neutron Flux - High (Flow Biased) b) APRM Neutron Flux - High (Fixed)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position None 2.c - Fixed Neutron Flux-High 15.1.1 Decrease in Feedwater Temperature

1) Automatic Initiation a) APRM Neutron Flux - High (Fixed) b) APRM Neutron Flux - High (Flow Biased)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-33 Table E1-4b: RPS Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident 15.2.1 Steam Pressure Regulator Failed Downscale

1) Automatic Initiation a) APRM Neutron Flux - High (Fixed) b) APRM Neutron Flux - High (Flow Biased)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 15.2.8 Loss of Stator Cooling

1) Automatic Initiation a) APRM Neutron Flux - High (Fixed) b) APRM Neutron Flux - High (Flow Biased)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 15.3.2 Recirculation Flow Controller Failure (malfunction) Zero Speed Demand Decreasing Flow

1) Automatic Initiation a) APRM Neutron Flux - High (Flow Biased) b) APRM Neutron Flux - High (Fixed)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 15.4.2 Control Rod Withdrawal Error at Power

1) Automatic Initiation a) IRM Neutron Flux-High b) APRM Neutron Flux - High (Setdown)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 15.4.5 Recirculation Loop Flow Controller Failure with Increasing Flow

1) Automatic Initiation a) APRM Neutron Flux - High (Flow Biased) b) APRM Neutron Flux - High (Fixed)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch Shutdown Position AOT

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-34 Table E1-4b: RPS Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident 15.4.10 Control Rod Drop Accident (CRDA)

1) Automatic Initiation a) APRM Neutron Flux - High (Fixed) b) APRM Neutron Flux - High (Flow Biased) c) APRM Neutron Flux - High (Setdown) d) IRM Neutron Flux - High

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position DBA 2.d - Inop None None

1) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position None 3 - Reactor Vessel Steam Dome PressureHigh 15.2.8 Loss of Stator Cooling

1) Automatic Initiation a) Reactor Vessel Steam Dome Pressure - High b) APRM Neutron Flux - High (Fixed) c) APRM neutron Flux - High (Flow Biased)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 4 - Reactor Vessel Water LevelLow 15.2.7 Loss of Normal Feedwater Flow

1) Automatic Initiation a) Reactor Vessel Level - Low

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 15.6.5 LOCA Inside Primary Containment

1) Automatic Initiation a) Reactor Vessel Level - Low b) Drywell Pressure High

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position DBA

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-35 Table E1-4b: RPS Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident 5 - Main Steam Isolation Valve Closure 15.1.3 Increase in Steam Flow / Pressure Regulator Failure -

Open

1) Automatic Initiation a) MSIV Closure b) APRM Neutron Flux - High (Fixed) c) APRM Neutron Flux - High (Flow Biased)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 15.2.4 Main Steam Isolation Valve (MSIV) Closure

1) Automatic Initiation a) APRM Neutron Flux - High (Fixed) b) APRM Neutron Flux - High (Flow Biased)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 15.6.4 Steam System Line Break Outside Containment

1) Automatic Initiation a) Reactor Vessel Level - Low b) Main Steam Isolation Valve (MSIV) - Closure

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position DBA 6 - Drywell PressureHigh 6.2.1.3.2 15.6.5 LOCA Inside Primary Containment

1) Automatic Initiation a) Drywell Pressure High b) Reactor Vessel Level - Low

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position DBA

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-36 Table E1-4b: RPS Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident Scram Discharge Volume Water LevelHigh 7.a - Float Switch None None

1) Automatic Initiation a) SDV D/P1 Trip Unit b) SDV Level Switch

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position None 7.b - Differential Pressure Switch None None See 7.a None 8 - Turbine Stop Valve-Closure 15.2.2 Load Reject (bounds Loss of Offsite AC Power)

1) Automatic Initiation a) TSV2 - Closure b) TCV3 Fast Closure

2) Manual Initiation a) Manual SCRAM a) Reactor Mode Switch - Shutdown Position AOT 15.2.3 Turbine Trip

1) Automatic Initiation a) TSV - Closure

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 15.2.5 Loss of Condenser Vacuum (bounded by Turbine Trip Without Bypass event)

1) Automatic Initiation a) TSV - Closure

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 1 Scram Discharge Volume differential pressure 2 Turbine Stop Valve 3 Turbine Control Valve

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-37 Table E1-4b: RPS Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident 9 - Turbine Control Valve Fast Closure, Trip Oil Pressure Low 15.2.2 Load Reject (bounds 15.2.6, Loss of Offsite AC power)

1) Automatic Initiation a) TCV Fast Closure, EHC4 Oil Pressure - Low b) TSV - Closure c) Reactor Vessel Steam Dome Pressure - High d) APRM Neutron Flux - High (Fixed) e) APRM Neutron Flux - High (Flow Biased)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 10 - Turbine Condenser Vacuum-Low None None

1) Automatic Initiation a) Turbine Condenser Vacuum - Low

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position AOT 11 - Reactor Mode Switch Shutdown Position None None

1) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position None 12 - Manual Scram None None

1) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch - Shutdown Position None 4 Electrohydraulic control

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-38 5.2 TS 3.3.2.2 - Feedwater Pump and Main Turbine High Water Level Trip Instrumentation The Feedwater Pump and Main Turbine High Water Level Trip Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a feedwater pump and main turbine trip signal to the trip logic. Table E1-5a below presents the logic descriptions for the functions in TS 3.3.2.2. Table E1-5b summarizes the diverse means available to mitigate accidents for which each identified instrumentation and control function is designed to prevent.

Table E1-5a: Feedwater Pump and Main Turbine High Water Level Trip Instrumentation Redundancy Function Logic Logic Description Reactor Vessel Water LevelHigh 2 / 4 There are two independent high water level trip systems each containing two channels of high water level. The outputs of the channels in a trip system are combined in a one-out-of-two taken twice logic so that both trip systems must trip to result in an initiation logic that trips the three feedwater pumps and the main turbine.

Table E1-5b: Feedwater Pump and Main Turbine High Water Level Trip Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient /

Accident Reactor Vessel Water Level High 15.1.2 Feedwater Controller Failure-Maximum Demand or Increase in Feedwater Flow

1) Automatic Initiation a) Reactor Vessel Water Level -

High b) TSV - Closure c) Reactor Pressure - High d) APRM Neutron Flux - High (Fixed) e) APRM Neutron Flux - High (Flow Biased)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch -

Shutdown Position AOT

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-39 Table E1-5b: Feedwater Pump and Main Turbine High Water Level Trip Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient /

Accident 15.5.1 Inadvertent Initiation of High Pressure Coolant Injection During Power Operation

1) Automatic Initiation a) Reactor Vessel Water Level -

High b) TSV - Closure c) Reactor Pressure - High d) APRM Neutron Flux - High (Fixed) e) APRM Neutron Flux - High (Flow Biased)

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch -

Shutdown Position AOT 5.3 TS 3.3.4.1 - ATWS-RPT Instrumentation The ATWS-RPT Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The ATWS-RPT System, as described in UFSAR Section 7.8, includes sensors, relays, bypass capability, circuit breakers, and switches that are necessary to cause initiation of an RPT. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an ATWS-RPT signal to the trip logic. Table E1-6a below presents the logic descriptions for the functions in TS 3.3.4.1. Table E1-6b summarizes the diverse means available to mitigate accidents for which each identified instrumentation and control function is designed to prevent.

Table E1-6a: ATWS-RPT Instrumentation Redundancy Function Logic Logic Description Reactor Vessel Water LevelLow Low 2 / 4 The ATWS-RPT trip logic consists of two independent trip systems, with two channels of Reactor Steam Dome Pressure - High and two channels of Reactor Vessel Water Level - Low Low in each trip system. Each ATWS-RPT trip system is a two-out-of-two logic for each function. Thus, either two Reactor Vessel Water Level - Low Low or two Reactor Pressure - High signals are needed to trip a trip system. The output of either trip system will trip both recirculation pumps motor breakers.

Reactor Vessel Steam Dome PressureHigh 2 / 4 The ATWS-RPT trip logic consists of two independent trip systems, with two channels of Reactor Steam Dome Pressure - High and two

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-40 channels of Reactor Vessel Water Level - Low Low in each trip system. Each ATWS-RPT trip system is a two-out-of-two logic for each function. Thus, either two Reactor Vessel Water Level - Low Low or two Reactor Pressure - High signals are needed to trip a trip system. The output of either trip system will trip both recirculation pumps motor breakers.

Table E1-6b: ATWS-RPT Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient /

Accident Reactor Vessel Water LevelLow Low 15.8 Anticipated Transient Without Scram (ATWS)

1) Automatic Initiation a) Reactor Vessel Level - Low Low

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch -

Shutdown Position ATWS Reactor Vessel Steam Dome Pressure High 15.8 ATWS

1) Automatic Initiation a) Reactor Vessel Steam Dome Pressure - High

2) Manual Initiation a) Manual SCRAM b) Reactor Mode Switch -

Shutdown Position ATWS 5.4 TS 3.3.5.1 - ECCS Instrumentation The ECCS instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The ECCS instrumentation actuates CS, LPCI, HPCI, ADS, and the emergency DGs The ECCS Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. Table E1-7a below presents the TS 3.3.5.1 logic descriptions for the functions listed in TS Table 3.3.5.1-1.

Table E1-7b summarizes the diverse means available to mitigate accidents for which each identified instrumentation and control function is designed to prevent.

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-41 Table E1-7a: ECCS Instrumentation Redundancy Function Logic Logic Description Core Spray (CS) System Function 1.a - Reactor Vessel Water LevelLow Low 2 / 4 Reactor water level is monitored by four redundant differential pressure instruments, which are, in turn, connected to four trip units. The outputs of these trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic (i.e., two trip systems) to initiate CS.

Function 1.b - Drywell PressureHigh 2 / 4 Drywell pressure is monitored by four redundant pressure switches, which are, in turn, connected to four trip units. The outputs of these trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic (i.e., two trip systems) to initiate CS.

Function 1.c - Reactor Steam Dome Pressure Low (Permissive) 1 / 2 The Reactor Steam Dome Pressure - Low (permissive) variable is monitored by two pressure switches connected to relays arranged in a one-out-of-two logic to provide permissive for opening injection valve of low pressure ECCS subsystems.

Function 1.d - Core Spray Pump Discharge Flow Low (Bypass) 1 / 1 The CS pump discharge flow is monitored by a flow switch (one per each of the two CS pumps). When the pump is running and discharge flow is low enough so that pump overheating may occur, the minimum flow return line valve is opened. The valve is automatically closed if flow is above the minimum flow setpoint to allow the full system flow assumed in the accident analysis.

Function 1.e - Core Spray Pump Start-Time Delay Relay 1 / 1 There is one time delay relay per CS pump.

Low Pressure Coolant Injection (LPCI) System Function 2.a - Reactor Vessel Water LevelLow Low 2 / 4 See Function 1.a above (same logic for LPCI).

Function 2.b - Drywell PressureHigh 2 / 4 See Function 1.b above (same logic for LPCI).

Function 2.c - Reactor Steam Dome Pressure Low (Permissive) 1 / 2 See Function 1.c above (same logic for LPCI).

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-42 Table E1-7a: ECCS Instrumentation Redundancy Function Logic Logic Description Function 2.d - Reactor Steam Dome Pressure Low (Break Detection) 2 / 4 The Reactor Steam Dome variable is monitored by four pressure switches, which are, in turn, connected to multiple relays whose contacts are arranged in a one-out-of-two taken twice logic.

These instruments function to initiate closure of the recirculation pump discharge valves to ensure that LPCI flow does not bypass the core when it injects into the recirculation lines.

Function 2.e - Low Pressure Coolant Injection Pump Start-Time Delay Relay Pumps B and D

1 / 1 See Function 1.e. There is one time delay relay per LPCI pump loop.

Function 2.f - Low Pressure Coolant Injection Pump Discharge FlowLow (Bypass) 1 / 1 See Function 1.d above (same logic for LPCI; 1 flow switch for each of the two RHR loops).

Function 2.g -

Recirculation Pump Differential Pressure-High (Break Detection) 4 / 8 Recirculation Pump Differential Pressure-High (Break Detection) signals are initiated from eight differential pressure switches, four of which sense the pressure differential between the suction and discharge of each of the two recirculation pumps.

The relay outputs are arranged in a one-out-of-two taken twice logic for each pump.

Function 2.h -

Recirculation Riser Differential Pressure High (Break Detection) 2 / 4 Recirculation Riser Differential PressureHigh (Break Detection) signals are initiated from four differential pressure switches that sense the pressure differential between the A recirculation loop riser and the B recirculation loop riser. If, after a small time delay, the pressure in loop A is not indicating higher than loop B pressure, the logic will select the B loop for injection. If recirculation loop A pressure is indicating higher than loop B pressure, the logic will select the A loop for LPCI injection.

The Recirculation Riser Differential PressureHigh (Break Detection) output signals are combined in a one-out-of-two taken twice logic Function 2.i -

Recirculation Pump Differential Pressure Time DelayRelay (Break Detection) 2 / 2 Recirculation Pump Differential Pressure Time DelayRelay (Break Detection) signals are initiated by two time delay relays; one time delay relay per each of the two loops.

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-43 Table E1-7a: ECCS Instrumentation Redundancy Function Logic Logic Description Function 2.j - Reactor Steam Dome Pressure Time Delay Relay (Break Detection) 2 / 2 Reactor Steam Dome Pressure Time DelayRelay (Break Detection) signals are initiated from two time delay relays; one for each loop.

Function 2.k -

Recirculation Riser Differential Pressure Time DelayRelay (Break Detection) 2 / 2 Recirculation Riser Differential Pressure Time DelayRelay (Break Detection) signals are initiated by two time delay relays; one for each loop.

High Pressure Coolant Injection (HPCI) System Function 3.a - Reactor Vessel Water Level -Low Low 2 / 4 Four independent transmitters are connected to multiple trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic to initiate HPCI.

Function 3.b - Drywell Pressure High 2 / 4 Four independent pressure switches are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic to initiate HPCI.

Function 3.c - Reactor Vessel Water Level High 2 / 2 Reactor Vessel Water Level - High signals for HPCI are initiated from two differential pressure instruments from the narrow range water level measurement instrumentation. Both signals are required in order to close the HPCI injection valve.

Function 3.d -

Contaminated Condensate Storage Tank (CCST) Level Low 1 / 2 (per CCST)

Contaminated Condensate Storage Tank Level Low signals are initiated from four level switches (two associated with each CCST). The output from these switches are provided to the logic of HPCI system. The logic is arranged such that any level switch can cause the suppression pool suction valves to open and the CCST suction valve of both units to close.

Function 3.e -

Suppression Pool Water LevelHigh 1 / 2 Suppression Pool Water LevelHigh signals are initiated from two level switches. The logic is arranged such that either switch can cause the suppression pool suction valves to open and the CCST suction valve to close.

Function 3.f - High Pressure Coolant Injection Pump Discharge Flow Low (Bypass) 1 / 1 One differential pressure switch is used to detect the HPCI System flow rate. The logic is arranged such that the switch causes the minimum flow valve to open. The logic will close the minimum flow valve once the closure setpoint is exceeded.

Function 3.g - Manual Initiation 1 / 1 There is one manual initiation push button for the HPCI system.

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-44 Table E1-7a: ECCS Instrumentation Redundancy Function Logic Logic Description Automatic Depressurization System (ADS) Trip Systems A & B Function 4.a/5.a -

Reactor Vessel Water LevelLow Low 2 / 4 Reactor Vessel Water LevelLow Low signals are initiated from four differential pressure instruments.

Two channels input to ADS trip system A, while the other two channels input to ADS trip System B.

The ADS logic (low low reactor vessel and high drywell pressure) in each trip system is arranged in two strings. Each string has a contact from a Reactor Vessel Water Level-Low Low and Drywell PressureHigh function channel. In addition, each string receives a contact input of a pressure switch associated with each CS and LPCI pump via the use of auxiliary relays and one string includes the ADS initiation timer. All contacts in both logic strings must close, the ADS initiation timer must time out, and a CS or LPCI pump discharge pressure signal must be present to initiate an ADS trip system. Either the A or B trip system will cause all the ADS relief valves to open.

Function 4.b/5.b - Drywell PressureHigh 2 / 4 Drywell PressureHigh signals are initiated from four pressure switches that sense drywell pressure (two for each trip system). See Function 4.a/5.a for logic description.

Function 4.c/5.c -

Automatic Depressurization System Initiation Timer 1 / 2 There are two Automatic Depressurization System Initiation Timer relays, one in each of the two ADS trip systems. See Function 4.a/5.a for logic description.

Function 4.d/5.d - Core Spray Pump Discharge Pressure-High 2 / 4 Two pressure switches (twelve total) on the discharge of each core spray and each LPCI pump are connected through relays in redundant groups so that each ADS trip system is blocked from actuating unless at least one low pressure pump shows verified discharge pressure. In order to generate an ADS permissive in one trip system, it is necessary that only one pump (both channels for the pump) indicate the high discharge pressure condition. See Function 4.a/5.a for logic description.

Function 4.e/5.e - Low Pressure Coolant Injection Pump Discharge Pressure-High 2 / 8 See Function 4.d/5.d above for logic description.

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-45 Table E1-7a: ECCS Instrumentation Redundancy Function Logic Logic Description Function 4.f/5.f -

Automatic Depressurization System Low Low Water Level Actuation Timer 1 / 2 There are two Automatic Depressurization System Low Low Water Level Actuation Timer relays, one in each of the two ADS trip systems. Either the A or B trip system will cause all the ADS relief valves to open.

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-46 Table E1-7b: ECCS Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident Core Spray (CS) System Function 1.a -

Reactor Vessel Water LevelLow Low 6.3 15.6.5 LOCA

1) Automatic Initiation a) Reactor Vessel Water Level - Low Low (coincident with Reactor Steam Dome Pressure-Low (permissive)) OR Drywell Pressure-High

2) Manual Initiation DBA Function 1.b -

Drywell Pressure High 6.3 15.6.5 LOCA

1) Automatic Initiation a) Reactor Vessel Water Level - Low Low (coincident with Reactor Steam Dome Pressure-Low (permissive)) OR Drywell Pressure-High

2) Manual Initiation DBA Function 1.c -

Reactor Steam Dome PressureLow (Permissive) 6.3 15.6.5 LOCA

1) Automatic Initiation a) Reactor Steam Dome Pressure - Low (permissive)

2) Manual Initiation DBA Function 1.d - Core Spray Pump Discharge Flow Low (Bypass) 6.3 15.6.5 LOCA

1) Automatic Initiation a) Core Spray Pump Discharge Flow - Low (Bypass)

2) Manual Initiation DBA Function 1.e - Core Spray Pump Start-Time Delay Relay 6.3 15.6.5 LOCA

1) Automatic a) Core Spray Pump Start-Time Delay Relay

2) Manual Initiation DBA Low Pressure Coolant Injection (LPCI) System Function 2.a -

Reactor Vessel Water LevelLow Low 6.3 15.6.5 LOCA

1) Automatic Initiation a) Reactor Vessel Water Level - Low Low (coincident with Reactor Steam Dome Pressure-Low (permissive)) OR Drywell Pressure-High

2) Manual Initiation DBA

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-47 Table E1-7b: ECCS Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident Function 2.b -

Drywell Pressure High 6.3 15.6.5 LOCA

1) Automatic Initiation a) Reactor Vessel Water Level - Low Low (coincident with Reactor Steam Dome Pressure-Low (permissive)) OR Drywell Pressure-High

2) Manual Initiation DBA Function 2.c -

Reactor Steam Dome Pressure Low (Permissive) 6.3 15.6.5 LOCA

1) Automatic Initiation a) Reactor Steam Dome Pressure - Low (permissive)

2) Manual Initiation DBA Function 2.d -

Reactor Steam Dome PressureLow (Break Detection) 6.3 15.6.5 LOCA

1) Automatic a) Reactor Steam Dome Pressure-Low (Break Detection)

2) Manual DBA Function 2.e - Low Pressure Coolant Injection Pump Start-Time Delay Relay Pumps B and D 6.3 15.6.5 LOCA

1) Automatic a) Low Pressure Coolant Injection Pump Start-Time Delay Relay Pumps B and D

2) Manual Initiation DBA Function 2.f - Low Pressure Coolant Injection Pump Discharge Flow Low (Bypass)

None (loss of LPCI flow due to min. flow bypass not isolating is an analyzed condition)

None (loss of LPCI flow due to minimum flow bypass not isolating is an analyzed condition)

1) Automatic Initiation a) Low Pressure Coolant Injection Pump Discharge Flow-Low (Bypass)

2) Manual Initiation None Function 2.g -

Recirculation Pump Differential Pressure-High (Break Detection) 6.3 15.6.5 LOCA

1) Automatic a) Recirculation Pump Differential Pressure-High (Break Detection)

DBA

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-48 Table E1-7b: ECCS Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident Function 2.h -

Recirculation Riser Differential PressureHigh (Break Detection) 6.3 15.6.5 LOCA

1) Automatic a) Recirculation Riser Differential Pressure-High (Break Detection)

DBA Function 2.i -

Recirculation Pump Differential Pressure Time DelayRelay (Break Detection) 6.3 15.6.5 LOCA

1) Automatic a) Recirculation Pump Differential Pressure Time Delay-Relay (Break Detection)

DBA Function 2.j -

Reactor Steam Dome Pressure Time Delay Relay (Break Detection) 6.3 15.6.5 LOCA

1) Automatic a) Reactor Steam Dome Pressure Time Delay-Relay (Break Detection)

DBA Function 2.k -

Recirculation Riser Differential Pressure Time DelayRelay (Break Detection) 6.3 15.6.5 LOCA

1) Automatic a) Recirculation Riser Differential Pressure Time Delay-Relay (Break Detection)

DBA High Pressure Coolant Injection (HPCI) System Function 3.a -

Reactor Vessel Water Level -Low Low 6.3 15.6.5 LOCA

1) Automatic Initiation a) Reactor Vessel Water Vessel - Low Low

2) Manual Initiation DBA Function 3.b -

Drywell Pressure High 6.3 15.6.5 LOCA

1) Automatic Initiation a) Drywell Pressure - High

2) Manual Initiation DBA Function 3.c -

Reactor Vessel Water Level High None None

1) Automatic a) Reactor Vessel Water Level - High

2) Manual turbine trip None

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-49 Table E1-7b: ECCS Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident Function 3.d -

Contaminated Condensate Storage Tank (CCST) Level Low 6.3 15.6.5 LOCA

1) Automatic a) Contaminated Condensate Storage Tank (CCST)

Level -Low

2) Manual Realignment DBA Function 3.e -

Suppression Pool Water LevelHigh 6.3 15.6.5 LOCA

1) Automatic a) Suppression Pool Water Level - High

2) Manual Realignment DBA Function 3.f - High Pressure Coolant Injection Pump Discharge Flow Low (Bypass) 6.3 15.6.5 LOCA

1) Automatic a) High Pressure Coolant Injection Pump Discharge Flow - Low (Bypass)

2) Manual DBA Function 3.g -

Manual Initiation None None

1) Manual Initiation None Automatic Depressurization System (ADS) Trip Systems A & B Function 4.a/5.a -

Reactor Vessel Water LevelLow Low 6.3 15.6.5 LOCA

1) Automatic Initiation a) Reactor Vessel Water Level - Low Low

2) Manual Initiation DBA Function 4.b/5.b -

Drywell Pressure High 6.3 15.6.5 LOCA

1) Automatic Initiation a) Drywell Pressure - High

2) Manual Initiation DBA Function 4.c/5.c -

Automatic Depressurization System Initiation Timer 6.3 15.6.5 LOCA

1) Automatic Initiation a) Automatic Depressurization System Initiation Timer

2) Manual Initiation DBA

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-50 Table E1-7b: ECCS Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident Function 4.d/5.d -

Core Spray Pump Discharge Pressure-High 6.3 15.6.5 LOCA

1) Automatic Initiation a) Core Spray Pump Discharge Pressure - High

2) Manual Initiation DBA Function 4.e/5.e -

Low Pressure Coolant Injection Pump Discharge Pressure-High 6.3 15.6.5 LOCA

1) Automatic Initiation a) Low Pressure Coolant Injection Pump Discharge Pressure - High

2) Manual Initiation DBA Function 4.f/5.f -

Automatic Depressurization System Low Low Water Level Actuation Timer None None

1) Automatic Initiation a) Automatic Depressurization System Low Low Water Level Actuation Time

2) Manual Initiation None

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-51 5.5 TS 3.3.5.3 - RCIC System Instrumentation The RCIC System instrumentation initiates actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is unavailable. RCIC Instrumentation employs diversity in the number of different inputs which will actuate the associated equipment.

Table E1-8a below presents the TS 3.3.5.3 logic descriptions for the functions listed in TS Table 3.3.5.3-1. Table E1-8b summarizes the diverse means available to mitigate accidents for which each identified instrumentation and control function is designed to prevent.

Table E1-8a: RCIC System Instrumentation Redundancy Function Logic Logic Description Function 1 - Reactor Vessel Water LevelLow Low 2 / 4 Four transmitters are connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic arrangement.

Function 2 - Reactor Vessel Water LevelHigh 2 / 2 The Reactor Vessel Water Level - High trip is arranged in a two-out-of-two logic.

Function 3 -

Contaminated Condensate Storage Tank (CCST) Level-Low 1 / 2 (per CCST)

Contaminated Condensate Storage Tank Level Low signals are initiated from four level switches (two associated with each CCST). The output from these switches are provided to the logics of both HPCI Systems. The logic is arranged such that any level switch can cause the suppression pool suction valves to open and the CCST suction valve of both units to close.

Function 4 - Suppression Pool Water LevelHigh 1 / 2 Suppression pool water level signals are initiated from two level switches in a one-out-of-two logic Function 5 - Manual Initiation 1 / 1 There is one manual initiation push button for the RCIC system.

Table E1-8b: RCIC System Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient /

Accident Function 1 -

Reactor Vessel Water LevelLow Low 15.2.7 Loss of Feedwater Flow

1) Automatic Initiation a) Reactor Vessel Water Level

- Low Low

2) Manual Initiation AOT

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-52 Table E1-8b: RCIC System Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient /

Accident 15.8.2 Loss of Normal AC Power

1) Automatic Initiation a) Reactor Vessel Water Level

- Low Low

2) Manual Initiation ATWS 15.8.3 Loss of Normal Feedwater Flow

1) Automatic Initiation a) Reactor Vessel Water Level

- Low Low

2) Manual Initiation ATWS Function 2 -

Reactor Vessel Water LevelHigh None None

1) Automatic Initiation a) Reactor Vessel Water Level-High

2) Manually secure None Function 3 -

Contaminated Condensate Storage Tank (CCST) Level-Low None None

1) Automatic Initiation a) Contaminated Condensate Storage Tank (CCST) Level -

Low

2) Manually Swap Suction Source None Function 4 -

Suppression Pool Water LevelHigh None None

1) Automatic turbine trip a) Suppression Pool Water Level-High

2) Manually swap suction source None Function 5 -

Manual Initiation None None

1) Manual Initiation None 5.6 TS 3.3.6.1 - Primary Containment Isolation Instrumentation Primary containment isolation instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary (RCPB) isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a primary containment isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logics are (a) reactor vessel water level, (b) area ambient temperatures, (c) main steam line (MSL) flow measurement, (d) SLC system initiation, (e) main steam line pressure, (f) HPCI and RCIC steam line flow, (g) drywell radiation and pressure, (h) HPCI and RCIC steam line pressure, and (i) reactor vessel pressure. Redundant sensor input signals from each parameter are provided for initiation of isolation. The only exception is SLC system initiation. Primary

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-53 containment isolation instrumentation has inputs to the trip logic of the isolation functions listed below. Table E1-9a below presents the TS 3.3.6.1 logic descriptions for all the functions listed in TS Table 3.3.6.1-1. Table E1-9b summarizes the diverse means available to mitigate accidents for which each identified instrumentation and control function is designed to prevent.

Table E1-9a: Primary Containment Isolation Instrumentation Redundancy

Function Logic Logic Description Main Steam Line Isolation Function 1.a - Reactor Vessel Water LevelLow Low 2 / 4 The Reactor Vessel Water LevelLow Low, the Main Steam Line PressureLow, and the Main Steam Line PressureTimer Functions receive inputs from four channels. One channel associated with each Function inputs to one of four trip strings.

Two trip strings make up a trip system and both trip systems must trip to cause an isolation of all main steam isolation valves (MSIVs), MSL drain valves, and recirculation loop sample isolation valves. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system.

The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation.

Function 1.b - Main Steam Line Pressure Low 2 / 4 See Function 1.a above.

Function 1.c - Main Steam Line Pressure Timer 2 / 4 See Function 1.a above.

Function 1.d - Main Steam Line Flow-High 2 / 4 The Main Steam Line Flow - High and Main Steam Tunnel Temperature - High Functions each contain 16 channels. Each PCIS trip channel receives four inputs from each of these functions, one flow input from each MSL and one temperature input from each of the four areas monitored. Any one of these inputs will trip the associated PCIS trip channel.

The four PCIS trip channels are arranged in a one-out-of-two taken twice logic.

Function 1.e - Main Steam Line Tunnel TemperatureHigh 2 / 4 See Function 1.d above.

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-54 Table E1-9a: Primary Containment Isolation Instrumentation Redundancy

Function Logic Logic Description Primary Containment Isolation Function 2.a - Reactor Vessel Water LevelLow 2 / 4 The Reactor Vessel Water LevelLow and Drywell Pressure-High Functions receive inputs from four channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the PCIVs identified in Reference 1 of TS B 3.3.6.1 (Reference [4]). Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation.

Function 2.b - Drywell PressureHigh 2 / 4 See Function 2.a above.

Function 2.c - Drywell RadiationHigh 2 / 4 The Drywell RadiationHigh Function receives input from two radiation detector assemblies each connected to a switch. Each switch actuates two contacts. Each contact inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the PCIVs identified in Reference 1 of TS B 3.3.6.1 (Reference [4]). The contacts associated with the same switch provide input to both trip strings in the same trip system. Any contact will trip the associated trip string. The trip strings are arranged in a one-out-of-two taken twice logic. A channel is considered to include a radiation detector assembly, a switch, and one of two contacts.

HPCI System Isolation Function 3.a - HPCI Steam Line Flow-High 2 / 2 (for both isolation valves)

The HPCI Steam FlowHigh and HPCI Steam Flow Timer Functions each receive input from two channels, with each channel in one trip system using a one-out-of-one logic. Each of the two trip systems is connected to one of the two valves on the HPCI Steam supply penetration.

Function 3.b - HPCI Steam Line Flow-Timer 2 / 2 See Function 3.a above.

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-55 Table E1-9a: Primary Containment Isolation Instrumentation Redundancy

Function Logic Logic Description Function 3.c - HPCI Steam Supply Line PressureLow 4 / 4 (for both isolation valves)

The HPCI and RCIC Steam Supply Line Pressure Low Functions receive inputs from four steam supply pressure channels for each system. The outputs from HPCI steam supply pressure channels are each connected to two two-out-of-two trip systems. Each trip system isolates one valve on the HPCI steam supply penetration.

Function 3.d - Drywell PressureHigh 4 / 4 (for both isolation valves)

The HPCI Drywell PressureHigh Function receives input from four channels. Two channels provide input to one trip system and the other two channels provide input to a second trip system. In addition, four HPCI Steam Supply Line Pressure Low Function channels are also connected to these trip systems. Each of the two trip systems receives input from two additional HPCI Steam Supply Line PressureLow Function channels. Each trip system is arranged such that one channel associated with each Function must trip in order to initiate isolation of one HPCI vacuum breaker isolation valve. The logic in each trip system is one-out-of-two for each Function.

Function 3.e - HPCI Turbine Area TemperatureHigh 4 / 4 (for both HPCI valves)

The HPCI Turbine Area TemperatureHigh Function receives input from four channels. Two channels monitor the area near the steam supply line while the other two channels monitor the temperature near the turbine exhaust rupture disc.

Each of the two trip systems receives input from one channel in each of the two areas. Each trip system is arranged such that both channels must trip in order to initiate isolation. This is effectively a two-out-of-two logic arrangement. Each of the two trip systems is connected to one of the two valves on the HPCI steam supply penetration.

RCIC System Isolation Function 4.a - RCIC Steam Line Flow-High 1 / 2 The RCIC Steam FlowHigh and RCIC Steam FlowTimer Functions each receive input from two channels. Each channel is connected to two trip systems, each using a one-out-of-two logic. Each of the two trip systems is connected to both RCIC steam supply isolation valves, such that any trip system will isolate both valves.

Function 4.b - RCIC Steam Line Flow-Timer 1 / 2 See Function 4.a above.

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-56 Table E1-9a: Primary Containment Isolation Instrumentation Redundancy

Function Logic Logic Description Function 4.c - RCIC Steam Supply Line PressureLow 2 / 4 The HPCI and RCIC Steam Supply Line Pressure Low Functions receive inputs from four steam supply pressure channels for each system. The RCIC Steam Supply Line PressureLow channels are arranged in a one one-out-of-two twice trip system. The trip system is connected to both RCIC steam supply isolation valves.

Function 4.d - RCIC Turbine Area TemperatureHigh 2 / 4 The RCIC Turbine Area TemperatureHigh Function receives input from four channels. The four channels monitor the area near the RCIC turbine. Each of the two trip systems receives input from the four channels. Each trip system is arranged in a one-out-of-two taken twice logic to initiate isolation. Each of the two trip systems is connected to both RCIC steam supply isolation valves, such that any trip system will isolate both valves.

Reactor Water Cleanup System Isolation Function 5.a - SLC System Initiation 1 / 1 The SLC System Initiation Function receives input from the SLC initiation switch. The switch provides trip signal inputs to both trip systems in any position other than "OFF". The other switch positions are SYS 1, SYS 2, SYS 1+2 and SYS 2+1. For the purpose of this Specification, the SLC initiation switch is considered to provide 1 channel input into each trip system. Each of the two trip systems is connected to one of the two RWCU valves.

Function 5.b - Reactor Vessel Water LevelLow 2 / 4 The Reactor Vessel Water LevelLow Isolation Function receives input from four reactor vessel water level channels. Each channel inputs into one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the reactor water cleanup (RWCU) valves. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation.

RHR Shutdown Cooling System Isolation Function 6.a - Reactor Vessel PressureHigh 2 / 2 (for both valves)

The Reactor Vessel Pressure-High Function receives input from two channels, both of which provide input to both trip systems. Any channel will trip both trip systems. This is a one-out-of-two logic for each trip system. Each of the two trip systems is

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-57 Table E1-9a: Primary Containment Isolation Instrumentation Redundancy

Function Logic Logic Description connected to one of the two valves on the RHR SDC suction penetration.

Function 6.b - Reactor Vessel Water LevelLow 2 / 4 The Reactor Vessel Water LevelLow function receives input from four reactor vessel water level channels. Each channel inputs into one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the RHR SDC suction isolation valves. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system.

The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation.

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-58 Table E1-9b: Primary Containment Isolation Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident Main Steam Line Isolation Function 1.a -

Reactor Vessel Water LevelLow Low 15.6.5 LOCA

1) Automatic Initiation a) Water Level - Low Low

2) Manual Isolation DBA 15.6.4 3.6.1.1.4.1 Steam System Line Break Outside Containment (MSLB)

1) Automatic Initiation a) Water Level - Low Low b) Main Steam Isolation Valve (MSIV) - Closure

2) Manual Isolation DBA Function 1.b - Main Steam Line PressureLow 15.1.3 Failure of the Pressure Regulator - Open (or Increase in Steam Flow)

1) Automatic Initiation a) Main Steam Line Pressure - Low

2) Manual Isolation AOT Function 1.c - Main Steam Line PressureTimer See 1.b See 1.b See 1.b See 1.b Function 1.d - Main Steam Line Flow-High 15.6.4 Main Steam Line Break

1) Automatic Initiation a) Main Steam Line Flow - High b) Main Steam Line Tunnel Area Temperature - High

2) Manual Isolation DBA Function 1.e - Main Steam Line Tunnel TemperatureHigh None None

1) Automatic Initiation a) Main Steam Line Flow - High b) Main Steam Line Tunnel Area Temperature - High

2) Manual Isolation None Primary Containment Isolation Function 2.a -

Reactor Vessel Water LevelLow 15.6.5 LOCA

1) Automatic Initiation a) Reactor Vessel Water Level - Low b) Drywell Pressure - High

2) Manual Isolation DBA

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-59 Table E1-9b: Primary Containment Isolation Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident Function 2.b -

Drywell Pressure High 15.6.5 LOCA

1) Automatic Initiation a) Drywell Pressure - High b) Reactor Vessel Water Level - Low

2) Manual Isolation DBA Function 2.c -

Drywell Radiation High None None

1) Automatic Initiation a) Drywell Radiation - High

2) Manual Isolation None HPCI System Isolation Function 3.a - HPCI Steam Line Flow-High 7.3 15.6.4 15.6.5 LOCAs (Bounded by Recirculation or MSL breaks)

1) Automatic Initiation a) HPCI Steam Line Flow - High

2) Manual Isolation DBA Function 3.b - HPCI Steam Line Flow-Timer 7.3 15.6.4 15.6.5 LOCAs (Bounded by Recirculation or MSL breaks)

1) Automatic Initiation

a. HPCI Steam Line Flow-Time

2) Manual Isolation DBA Function 3.c - HPCI Steam Supply Line PressureLow 7.3 15.6.4 15.6.5 LOCAs (Bounded by Recirculation or MSL breaks)

1) Automatic Initiation a) HPCI Steam Supply Line Pressure - Low

2) Manual Isolation DBA Function 3.d -

Drywell Pressure High 7.3 15.6.4 15.6.5 LOCA, MSLB (Indirectly assumed because turbine exhaust leakage path not assumed to contribute to offsite dose)

1) Automatic Initiation a) HPCI Steam Supply Line Pressure - Low

2) Manual Isolation DBA Function 3.e - HPCI Turbine Area TemperatureHigh 7.3 15.6.4 15.6.5 LOCAs (Bounded by recirculation or MSL breaks)

1) Automatic Initiation a) HPCI Equipment Area Temperature - High

2) Manual Isolation None RCIC System Isolation Function 4.a - RCIC Steam Line Flow-High 7.3 15.6.4 15.6.5 LOCAs (Bounded by recirculation or MSL breaks)

1) Automatic Initiation a) RCIC Steam Supply Pressure - Low

2) Manual Isolation DBA Function 4.b - RCIC Steam Line Flow-Timer 7.3 15.6.4 15.6.5 LOCAs (Bounded by recirculation or MSL breaks)

1) Automatic Initiation a) RCIC Steam Line Flow-Timer

2) Manual Isolation DBA

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-60 Table E1-9b: Primary Containment Isolation Instrumentation Diversity Function Credited Safety Analysis Event Diverse Instrumentation Event UFSAR Section Transient / Accident Function 4.c - RCIC Steam Supply Line PressureLow 7.3 15.6.4 15.6.5 LOCAs (Bounded by recirculation or MSL breaks)

1) Automatic Initiation a) RCIC Steam Supply Line Pressure - Low

2) Manual Isolation DBA Function 4.d - RCIC Turbine Area TemperatureHigh 7.3 15.6.4 15.6.5 LOCAs (Bounded by recirculation or MSL breaks)

1) Automatic Initiation a) RCIC Equipment Area Temperature - High

2) Manual Isolation DBA Reactor Water Cleanup System Isolation Function 5.a - SLC System Initiation 7.3 9.3.5 15.6.5 15.8 ATWS, LOCA

1) Automatic Initiation a) SLC System Initiation

2) Manual Isolation ATWS, LOCA Function 5.b -

Reactor Vessel Water LevelLow 15.6.4 15.6.5 LOCA (Bounded by recirculation or MSL breaks)

1) Automatic Initiation a) Reactor Vessel Water Level -Low

2) Manual Isolation DBA RHR Shutdown Cooling System Isolation Function 6.a -

Reactor Vessel PressureHigh None None

1) Automatic Initiation a) Reactor Vessel Pressure - High

2) Manual Isolation None Function 6.b -

Reactor Vessel Water LevelLow 15.6.4 15.6.5 LOCA (Bounded by recirculation or MSL breaks)

1) Automatic Initiation a) Reactor Vessel Water Level Low

2) Manual Isolation DBA

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-61 5.7 TS 3.3.6.3 - Relief Valve Instrumentation The low set portion of relief valve instrumentation is designed to mitigate the effects of postulated thrust loads on the relief valve discharge lines by preventing subsequent actuations with an elevated water leg in the discharge line. It also mitigates the effects of postulated pressure loads on the torus shell or suppression pool by preventing multiple actuations in rapid succession of the relief valve subsequent to their initial actuation. The low set function of relief valve instrumentation is contained within the control logic of the two relief valves that are set to initiate first on an overpressure event. The relief valve instrumentation, as a whole, is designed to mitigate the effects of overpressurization transients via the relief mode of five relief valves.

The relief valve instrumentation logic consists of separate channels for each of the five relief valves with each channel controlling one associated relief valve. Each channel contains a high pressure (PSH) switch and a low pressure (PSL) switch. The pressure switches sense reactor pressure from the upstream side of the relief valve to open the associated relief valve on a sensed high reactor pressure and close the valve following a reduction in reactor pressure.

Actuation of the associated relief valve is accomplished via closure of the PSH on a sensed high reactor pressure, which energizes the relief valve solenoid to open the valve. The PSL closes to seal in the actuation signal and opens when reactor pressure has decreased below the low pressure setpoint of the switch to de-energize the solenoid and allow the relief valve to close.

The relief valve high pressure setpoints are set such that two of the five relief valves (i.e., the Low Set Relief Valves) will actuate at a pressure that is approximately twenty pounds lower than the remaining three relief valves (i.e., the Relief Valves). The lower pressure settings are intended to reduce the frequency of multiple relief discharges.

Two Low Set Relief Valve Reactuation Time Delay channels are included in the associated control logic for the two relief valves designated to open at the lower reactor pressure (i.e., the Low Set Relief Valves). Each channel consists of a time delay dropout relay and its associated contacts. The channels are arranged in a two-out-of-two logic arrangement for each low set relief valve. The Low Set Relief Valve Reactuation Time Delay Function ensures a time delay of approximately 10 seconds occurs between the closure of the associated relief valve and any subsequent opening of the valve by preventing the reopening of the valve. In this fashion, the low set portion of relief valve instrumentation increases the time between (or prevents) subsequent actuations to allow the high water leg created from the initial relief valve opening to return to (or fall below) its normal water level; thus, reducing thrust loads from subsequent actuations to within their design limits.

Table E1-10a below presents the TS 3.3.6.3 logic descriptions for all the functions listed in TS Table 3.3.6.3-1.

Main Steam Relief Valve functions do not offer any functional diversity. If they do not function automatically, they may be operated manually assuming power is available. The Target Rock Safety Relief Valve can function electrically or function solely on reactor pressure. The purpose of the relief and safety valves is to prevent over-pressurizing of the reactor coolant pressure boundary including the reactor pressure vessel (RPV). The relief valves are designed to rapidly depressurize the RPV in the event of a small break LOCA where HPCI malfunctions so that core spray and the low pressure coolant injection (LPCI) mode of the residual heat removal

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-62 (RHR) system will function to protect the fuel barrier [Reference 4, Section 5.2.2.1]. Note that the safety valves are sized to protect the Reactor Pressure Vessel (RPV) against overpressure during a MSIV closure without direct scram on valve position event, a turbine trip with a failure of the turbine bypass system and without direct scram on turbine stop valve position event, or a load reject with a failure of the turbine bypass system and without direct scram on turbine control valve fast closure event.

Table E1-10a: Relief Valve Instrumentation Redundancy

Function Logic Logic Description Function 1.a - Reactor Vessel Pressure Setpoint 1 / 1 (on a per low set relief valve basis)

The relief valve instrumentation logic consists of separate channels for each of the five relief valves with each channel controlling one associated relief valve. Each channel contains a high pressure (PSH) switch and a low pressure (PSL) switch. The pressure switches sense reactor pressure from the upstream side of the relief valve to open the associated relief valve on a sensed high reactor pressure and close the valve following a reduction in reactor pressure. Actuation of the associated relief valve is accomplished via closure of the PSH on a sensed high reactor pressure, which energizes the relief valve solenoid to open the valve. The PSL closes to seal in the actuation signal and opens when reactor pressure has decreased below the low pressure setpoint of the switch to de-energize the solenoid and allow the relief valve to close. The relief valve high pressure setpoints are set such that two of the five relief valves (i.e., the Low Set Relief Valves) will actuate at a pressure that is approximately twenty pounds lower than the remaining three relief valves (i.e., the Relief Valves).

The lower pressure settings are intended to reduce the frequency of multiple relief discharges.

Note: Two low set relief valves are provided and one low set relief valve can perform the low set function.

Function 1.b -

Reactuation Time Delay 2 / 2 (on a per low set relief valve basis)

Two Low Set Relief Valve Reactuation Time Delay channels are included in the associated control logic for the two relief valves designated to open at the lower reactor pressure (i.e., the Low Set Relief Valves). Each channel consists of a time delay dropout relay and its associated contacts. The channels are arranged in a two-out-of-two logic arrangement for each low set relief valve. The Low Set Relief Valve Reactuation Time Delay Function ensures a time delay of approximately 10 seconds

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-63 Table E1-10a: Relief Valve Instrumentation Redundancy

Function Logic Logic Description occurs between the closure of the associated relief valve and any subsequent opening of the valve by preventing the reopening of the valve. In this fashion, the low set portion of relief valve instrumentation increases the time between (or prevents) subsequent actuations to allow the high water leg created from the initial relief valve opening to return to (or fall below) its normal water level; thus, reducing thrust loads from subsequent actuations to within their design limits.

Relief Valves Function 2.a - Reactor Vessel Pressure Setpoint 1 / 1 (on a per relief valve basis)

See Function 1.a 5.8 TS 3.3.8.1 - LOP Instrumentation The LOP design creates defense-in-depth from the redundancy of the channels for the Initiation Function.

Successful operation of the required safety functions of the Emergency Core Cooling Systems (ECCS) is dependent upon the availability of adequate power sources for energizing the various components such as pump motors, motor operated valves, and the associated control components. The LOP instrumentation monitors the 4160 V Essential Service System (ESS) buses. Offsite power is the preferred source of power for the 4160 V ESS buses. If the monitors determine that insufficient voltage is available, the buses are disconnected from the offsite power sources and connected to the onsite diesel generator (DG) power sources.

Each 4160 V ESS bus has its own independent LOP instrumentation and associated trip logic.

The voltage for each bus is monitored at two levels, which can be considered as two different undervoltage Functions: Loss of Voltage and Degraded Voltage.

Each Division 1 and 2 4160 V ESS Bus Loss of Voltage and Degraded Voltage Function is monitored by two undervoltage relays for each ESS bus, whose outputs are arranged in a two-out-of-two logic configuration (Reference [5]). When, on decreasing voltage, the 4160 V ESS Bus Undervoltage (Loss of Voltage) Function setpoint has been exceeded on both relay channels, the Loss of Voltage Function sends a LOP signal to the respective bus load shedding scheme and starts the associated DG. For the Degraded Voltage Function, one Bus Undervoltage/Time Delay Function (two channels) and one Time Delay Function (one channel) are included. The Time Delay Function associated with the Bus Undervoltage relay is inherent to the Bus Undervoltage - Degraded Voltage relay and is nominally adjusted to seven seconds to prevent circuit initiation caused by grid disturbances and motor starting transients. The Bus Undervoltage/Time Delay Function provides input to the Time Delay Function. The Time Delay

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-64 Function relay is nominally adjusted to five minutes to allow time for the operator to attempt to restore normal bus voltage. When a Bus Undervoltage/Time Delay Function setpoint has been exceeded and persists for seven seconds on both relay channels, a control room annunciator (continued) alerts the operator of the degraded voltage condition and the five minute Time Delay Function timer is initiated. If the degraded voltage condition does not clear within five minutes, the five minute Time Delay Function relay sends a LOP signal to the respective bus load shedding scheme and starts the associated DG. If a degraded voltage condition exists coincident with an ECCS actuation signal, the five minute Time Delay Function is bypassed such that load shedding and the associated DG start will be initiated following the seven second time delay (Bus Undervoltage/Time Delay Function).

Accident analyses credit the loading of the DGs based on the loss of offsite power coincident with a loss of coolant accident (LOCA). The diesel starting and loading times have been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power.

Table E1-11a below presents the TS 3.3.8.1 logic descriptions for all the functions listed in TS Table 3.3.8.1-1. The LOP instrumentation functions do not offer any functional diversity. The LOP instrumentation is required to function in any accident with a loss of offsite power.

Table E1-11a: LOP Instrumentation Redundancy

Function Logic Logic Description 4160 V Essential Service System Bus Undervoltage (Loss of Voltage)

Function 1 - Loss of Voltage 2 / 2 (for each 4kV ESS bus)

The Loss of Voltage Function is monitored by two undervoltage relay pairs for each Division 4160 V ESS Bus, where outputs are arranged in a two-out-of-two logic configuration. When, on decreasing voltage, the 4160 V ESS Bus Undervoltage (Loss of Voltage) Function setpoint has been exceeded on both relay channels, the Loss of Voltage Function sends a LOP signal to the respective bus load shedding scheme and starts the associated DG.

4160 V Essential Service System Bus Undervoltage (Degraded Voltage)

Function 2.a - Bus Undervoltage/Time Delay 2 / 2 (for each 4kV ESS bus)

Each Division 1 and 2 4160 V ESS Bus Loss of Voltage and Degraded Voltage Function is monitored by two undervoltage relays for each ESS bus, whose outputs are arranged in a two-out-of-two logic configuration. For the Degraded Voltage Function, one Bus Undervoltage/Time Delay Function (two channels) and one Time Delay Function (one channel) are included. The Bus Undervoltage/Time Delay Function provides input to the Time Delay Function. The Time Delay Function relay is nominally adjusted to five minutes to allow time for the operator to attempt to restore normal bus voltage. When a Bus Undervoltage/Time Delay

License Amendment Request Adopt Risk Informed Completion Times TSTF-505 Docket Nos. 50-254 and 50-265 List of Revised Required Actions to Corresponding PRA Functions E1-65 Table E1-11a: LOP Instrumentation Redundancy

Function Logic Logic Description Function setpoint has been exceeded and persists for seven seconds on both relay channels, a control room annunciator alerts the operator of the degraded voltage condition, and the five minute Time Delay Function timer is initiated. If the degraded voltage condition does not clear within five minutes, the five minute Time Delay Function relay sends a LOP signal to the respective bus load shedding scheme and starts the associated DG. If a degraded voltage condition exists coincident with an ECCS actuation signal, the five minute Time Delay Function is bypassed such that load shedding and the associated DG start will be initiated following the seven second time delay (Bus Undervoltage/Time Delay Function).

Function 2.b - Time Delay (No LOCA) 1 / 1 (for each 4kV ESS bus)

See Function 2.a logic description above.

6. Regulatory Guide 1.174, Revision 3, Section 2.1.1 - Defense-in-Depth In accordance with the principles contained within Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 3, defense-in-depth consists of several elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

1) Preserve a reasonable balance among the layers of defense.

x Current TS reflect this balance by allowing one sensor module or channel to be placed in trip, while preserving the fundamental safety function of the applicable system. Tripping an inoperable channel does not affect the number of channels required to provide the safety function. Even in the TS condition for two channels in a function inoperable, the fundamental safety function is preserved since sufficient operable channels remain in the function.

2) Preserve adequate capability of design features without an overreliance on programmatic activities as compensatory measures.

x No programmatic activities are relied upon as compensatory measures when one or two channels of the applicable instrumentation are inoperable. The remaining operable channels for that function are fully capable of performing the safety function of the applicable system.