ML17054C222

License Amendment Request for the Transition to Westinghouse Core Design and Safety Analyses - Proposed Technical Specification Bases Changes

ML17054C222
Person / Time
Site:	Wolf Creek
Issue date:	01/17/2017
From:	Wolf Creek
To:	Office of Nuclear Reactor Regulation
Shared Package
ML17054C103	List: ET 17-0001, License Amendment Request for the Transition to Westinghouse Core Design and Safety Analyses, Enclosure 10 - CAW-16-4500 ML17053B393 ML17054C219 ML17054C220 ML17054C221 ML17054C222 ML17054C223 ML17054C224 ML17054C226 ML17054C227 ML17054C229 ML17054C230 ML17054C232 ML17054C233 ML17054C235 ML17054C236
References
ET 17-0001
Download: ML17054C222 (40)

Text

Attachment AttachmentIVIVtoto ETET 16-00XX 17-0001 Page 2 of 30 Page 2 of 41 RCS Pressure SL B 2.1.2 B 2.0 SAFETY LIMITS (SLs)

B 2.1.2 Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND The SL on RCS pressure protects the integrity of the RCS against overpressurization. In the event of fuel cladding failure, fission products are released into the reactor coolant. The RCS then serves as the primary barrier in preventing the release of fission products into the atmosphere. By establishing an upper limit on RCS pressure, the pressure continued integrity of the RCS is ensured. According to 10 CFR 50, coolant Appendix A, GDC 14, "Reactor Coolant Pressure Boundary," and GDC 15, "Reactor Coolant System Design" (Ref. 1), the reactor pressure coolant boundary (RCPB) design conditions are not to be exceeded during normal operation and anticipated operational occurrences (AOOs).

Also, in accordance with GDC 28, "Reactivity Limits" (Ref. 1), reactivity accidents, including rod ejection, do not result in damage to the RCPB greater than limited local yielding.

The design pressure of the RCS is 2500 psia. During normal operation and AOOs, RCS pressure is limited from exceeding the design pressure by more than 10%, in accordance with Section III of the ASME Code (Ref. 2). To ensure system integrity, all RCS components are hydrostatically tested at 125% of design pressure, according to the ASME Code requirements prior to initial operation when there is no fuel in the core. Following inception of unit operation, RCS components shall be pressure tested, in accordance with the requirements of ASME Code,Section XI (Ref. 3).

Overpressurization of the RCS could result in a breach of the RCPB. If such a breach occurs in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere, raising concerns relative to limits on radioactive releases specified in 10 CFR 100, "Reactor Site Criteria" (Ref. 4).

APPLICABLE The RCS pressurizer safety valves, the main steam safety valves SAFETY ANALYSES (MSSVs), and the reactor high pressure trip have settings established to ensure that the RCS pressure SL will not be exceeded.

The RCS pressurizer safety valves are sized to prevent system pressure from exceeding the design pressure by more than 10%, as specified in Section III of the ASME Code for Nuclear Power Plant Components (Ref. 2). The transient that establishes the required relief capacity, and Wolf Creek - Unit 1 B 2.1.2-1 Revision 0

Attachment AttachmentIVIVtoto ETET16-00XX 17-0001 Page 3 of 30 Page 3 of 41 RCS Pressure SL B 2.1.2 BASES APPLICABLE hence valve size requirements and lift settings, is a turbine trip without a SAFETY ANALYSES direct reactor trip.

(continued)

Cases with and without pressurizer spray and PORVs are analyzed.

Safety valves on the secondary side are assumed to open when the steam pressure reaches the safety valve settings. Main feedwater supply is lost at the time of turbine trip and the Auxiliary Feedwater System supplies feedwater flow to ensure adequate residual and heat removal capability.

The Reactor Trip System Allowable Values in Table 3.3.1-1, together with the settings of the MSSVs, provide pressure protection for normal operation and AOOs. The reactor high pressure trip setpoint is specifically set to provide protection against overpressurization. The safety analyses for both the high pressure trip and the RCS pressurizer safety valves are performed using conservative assumptions relative to pressure control devices.

More specifically, no credit is taken for operation of the following:

a. Pressurizer power operated relief valves (PORVs);

b. Steam Generator Atmospheric Relief Valves (ARVs);

c. Condenser Steam Dump valves;

d. Reactor Control System;

e. Pressurizer Level Control System; or

f. Pressurizer spray valves.

SAFETY LIMITS The maximum transient pressure allowed in the RCS pressure vessel under the ASME Code,Section III, is 110% of design pressure. The SL on maximum allowable RCS pressure is 2735 psig.

APPLICABILITY SL 2.1.2 applies in MODES 1, 2, 3, 4, and 5 because this SL could be approached or exceeded in these MODES due to overpressurization events. The SL is not applicable in MODE 6 because of the plant conditions making it unlikely that the RCS can be pressurized.

Wolf Creek - Unit 1 B 2.1.2-2 Revision 12

Attachment IVIVtotoET Attachment ET16-00XX 17-0001 Page 4 of 30 Page 4 of 41 SDM B 3.1.1 BASES APPLICABLE with respect to potential fuel damage before a reactor trip occurs, is a SAFETY ANALYSES guillotine break of a main steam line inside containment initiated at the (continued) end of core life with RCS Tavg equal to 557°F. The positive reactivity addition from the moderator temperature decrease will terminate when the affected SG boils dry, thus terminating RCS heat removal and cooldown.

Following the MSLB, a post trip return to power may occur; however, no fuel damage occurs as a result of the post trip return to power, and THERMAL POWER does not violate the Safety Limit (SL) requirement of SL 2.1.1.

In the boron dilution analysis, the required SDM defines the reactivity difference between an initial subcritical boron concentration and the corresponding critical boron concentration. These values, in conjunction with the configuration of the RCS and the assumed dilution flow rate, directly affect the results of the analysis. This event is most limiting at the beginning of core life, when critical boron concentrations are highest.

Depending on the system initial conditions and reactivity insertion rate, the uncontrolled rod withdrawal transient is terminated by either a high power level trip or a high pressurizer pressure trip. In all cases, power level, RCS pressure, linear heat rate, and the DNBR do not exceed allowable limits.

The startup of an inactive RCP is administratively precluded in MODES 1 and 2. In MODE 3, the startup of an inactive RCP can not result in a "cold water" criticality, even if the maximum difference in temperature exists between the SG and the core. The maximum positive reactivity addition that can occur due to an inadvertent RCP start is less than half the minimum required SDM. Startup of an idle RCP cannot, therefore, produce a return to power from the hot standby condition.

The ejection of a control rod rapidly adds reactivity to the reactor core reactor core causing both the core power level and heat flux to increase with corresponding increases in reactor coolant temperatures and pressure. The ejection of a rod also produces a time dependent redistribution of core power.

SDM satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Even though it is not directly observed from the control room, SDM is considered an initial condition process variable because it is periodically monitored to ensure that the unit is operating within the bounds of accident analysis assumptions.

Wolf Creek - Unit 1 B 3.1.1-3 Revision 0

Attachment IVIVtotoET Attachment ET 16-00XX 17-0001 Page 5 of 30 Page 5 of 41 MTC B 3.1.3 BASES BACKGROUND The SRs for measurement of the MTC at the beginning and near the end (continued) of the fuel cycle are adequate to confirm that the MTC remains within its limits, since this coefficient changes slowly, due principally to the reduction in RCS boron concentration associated with fuel burnup.

APPLICABLE The acceptance criteria for the specified MTC are:

SAFETY ANALYSES

a. The MTC values must remain within the bounds of those used in the accident analysis (Ref. 2); and

b. The MTC must be such that inherently stable power operations result during normal operation and accidents, such as overheating and overcooling events.

The USAR, Chapter 15 (Ref. 2), contains analyses of accidents that result in both overheating and overcooling of the reactor core. MTC is one of the controlling parameters for core reactivity in these accidents. Both the most positive value and most negative value of the MTC are important to safety, and both values must be bounded. Values used in the analyses consider worst case conditions to ensure that the accident results are bounding (Ref. 3).

(part-power conditions) or zero (full-power conditions)

The consequences of accidents that cause core overheating must be evaluated when the MTC is positive. Such accidents include the rod withdrawal transient from either zero (Ref. 2 ) or RTP, loss of main feedwater flow, and loss of forced reactor coolant flow. The consequences of accidents that cause core overcooling must be evaluated when the MTC is negative. Such accidents include sudden feedwater flow increase and sudden decrease in feedwater temperature.

transients from either subcritical or at-power conditions In order to ensure a bounding accident analysis, the MTC is assumed to be its most limiting value for the analysis conditions appropriate to each accident. The bounding value is determined by considering rodded and unrodded conditions, whether the reactor is at full or zero power, and whether it is the BOC or EOC life. The most conservative combination appropriate to the accident is then used for the analysis (Ref. 2).

MTC values are bounded in reload safety evaluations assuming steady state conditions at BOC and EOC. An EOC measurement is conducted at conditions when the RCS boron concentration reaches a boron concentration equivalent to 300 ppm at an equilibrium, all rods out, RTP condition. The measured value may be extrapolated to project the EOC value, in order to confirm reload design predictions.

Wolf Creek - Unit 1 B 3.1.3-2 Revision 0

Attachment AttachmentIVIVtoto ETET 16-00XX 17-0001 Page 6 of 30 Page 6 of 41 MTC B 3.1.3 BASES SURVEILLANCE SR 3.1.3.2 (continued)

REQUIREMENTS

2. If the 300 ppm Surveillance limit is exceeded, it is possible that the EOC limit on MTC could be reached before the planned EOC.

Because the MTC changes slowly with core depletion, the Frequency of 14 effective full power days is sufficient to avoid exceeding the EOC limit.

3. The Surveillance limit for RTP boron concentration of 60 ppm is conservative. If the measured MTC at 60 ppm is less negative than the 60 ppm Surveillance limit, the EOC limit will not be exceeded because of the gradual manner in which MTC changes with core burnup REFERENCES 1. 10 CFR 50, Appendix A, GDC 11.

2. USAR, Chapter 15.

3. NSAG-007, Reload Safety Evaluation Methodology for the Wolf Creek Generating Station.

WCAP-9272-P-A, Revision 0, Westinghouse Reload Safety Evaluation Methodology, July 1985.

Wolf Creek - Unit 1 B 3.1.3-6 Revision 0

Attachment AttachmentIVIVtoto ETET 16-00XX 17-0001 Page 7 of 30 Page 7 of 41 Control Bank Insertion Limits B 3.1.6 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 10, GDC 26, GDC 28.

2. 10 CFR 50.46.

3. USAR, Chapter 15.

4. USAR, Section 4.3.1.5.

5. NSAG-007, Reload Safety Evaluation Methodology for the Wolf Creek Generating Station.

WCAP-9272-P-A, Revision 0, Westinghouse Reload Safety Evaluation Methodology, July 1985.

Wolf Creek - Unit 1 B 3.1.6-6 Revision 0

Attachment IVIVtotoET Attachment ET16-00XX 17-0001 Page 8 of 30 Page 8 of 41 PHYSICS TEST Exceptions - MODE 2 B 3.1.8 BASES SURVEILLANCE SR 3.1.8.4 (continued)

REQUIREMENTS The Frequency of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is based on the generally slow change in required boron concentration and on the low probability of an accident occurring without the required SDM.

REFERENCES 1. 10 CFR 50, Appendix B, Section XI.

2. 10 CFR 50.59.

3. Regulatory Guide 1.68, Revision 2, August, 1978.

4. NSAG-007, Reload Safety Evaluation Methodology for the Wolf Creek Generating Station.

WCAP-9272-P-A, Revision 0, Westinghouse Reload Safety Evaluation Methodology, July 1985.

INSERT New TS LCO 3.1.9 Bases Wolf Creek - Unit 1 B 3.1.8-6 Revision 5

Attachment IV to ET 17-0001 Page 9 of 41 RCS Boron Limitations < 500°F New Page B 3.1.9 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.9 RCS Boron Limitations < 500°F BASES BACKGROUND The control rod drive mechanisms (CRDMs) are wired into pre-selected RCCA banks, such that the RCCA banks can only be withdrawn in their proper withdrawal sequence during the normal mode of operation (i.e., not in the bank select mode). The control of the power supplied to the RCCA banks is such that no more than two RCCA banks can be withdrawn at any time.

When the RCCA banks are capable of being withdrawn from the core, i.e., power supplied to the CRDMs during an approach to criticality for reactor startup, or during maintenance and surveillance testing, there is the potential for an inadvertent RCCA bank withdrawal due to a malfunction of the control rod drive system.

Westinghouse NSAL-00-016 (Ref. 1) discussed the reactor trip functions assumed in the analysis of an Uncontrolled RCCA Bank Withdrawal from a Low Power or Subcritical Condition event (RWFS) (Ref. 2). The primary protection for an RWFS event is provided by the Power Range Neutron Flux - Low trip Function. The Source Range Neutron Flux trip Function is implicitly credited as the primary reactor trip function for an RWFS event in MODES 3, 4, or 5 since the Power Range Neutron Flux - Low trip Function is not required to be OPERABLE throughout these MODES. However, the Source Range Neutron Flux trip Function response time is listed as not applicable (Ref. 3) and that trip function is not response time tested per SR 3.3.1.16. Therefore, the Source Range Neutron Flux trip Function can not be credited to provide protection for an RWFS event in MODES 3, 4, and 5.

NSAL-00-016 also identified that the Power Range Neutron Flux - Low trip Function may not be OPERABLE at RCS temperatures significantly below the hot zero power T-avg due to calibration issues associated with shielding caused by the cold water in the downcomer region of the reactor vessel. The low RCS temperature limit for OPERABILITY of the Power Range Neutron Flux - Low trip Function is 500°F. Therefore, the Power Range Neutron Flux - Low trip Function may not provide the required protection in MODE 3 when the RCS temperature is

< 500°F, nor in MODES 4 and 5, due to the calibration issues discussed above.

Borating the RCS to greater than the all rods out (ARO) critical boron concentration when the RCCA banks are capable of being withdrawn provides sufficient SHUTDOWN MARGIN in the event of an RWFS transient when the RCS temperature is < 500°F.

APPLICABLE The RCCA bank withdrawal transient addressed by this LCO is the RWFS event.

SAFETY An RCCA bank withdrawal event at power is also analyzed, but that event is ANALYSES mitigated by equipment covered by the requirements of other Technical Wolf Creek - Unit 1 B 3.1.9-1 Revision

Attachment IV to ET 17-0001 Page 10 of 41 RCS Boron Limitations < 500°F New Page B 3.1.9 BASES APPLICABLE Specifications that are applicable in MODE 1, such as the Power Range Neutron SAFETY Flux - High, Power Range Neutron Flux Rate - High Positive Rate, and ANALYSES Overtemperature T trip Functions. The RWFS event assumes a positive (continued) reactivity insertion rate that is equal to the worth obtained from the simultaneous withdrawal of the combination of the two sequential control banks with the highest combined worth moving together with 100% overlap at the maximum withdrawal speed. The RWFS event is assumed to be terminated by the Power Range Neutron Flux - Low trip Function. The Source Range Neutron Flux and Intermediate Range Neutron Flux trip Functions are also available to terminate an RWFS event, but are not explicitly credited in the safety analyses to terminate the event.

The Power Range Neutron Flux - Low trip Function is available to provide the required protection for an RWFS event when the RCS temperature is 500°F.

This temperature limitation is due to calibration issues associated with shielding caused by cold water in the downcomer region of the reactor vessel. Additionally, although not explicitly analyzed in MODES 3, 4, and 5, the Source Range Neutron Flux trip Function is implicitly credited to provide protection for an RWFS event in these MODES.

Since there is no explicit RCCA bank withdrawal analysis that is performed in MODE 3 when the RCS temperature is below 500°F, nor in MODES 4 and 5, and the Power Range Neutron Flux - Low trip Function can not be credited to mitigate an RWFS event with the RCS temperature < 500°F, LCO 3.1.9 requires that the RCS boron concentration be greater than the ARO critical boron concentration when the Rod Control System is capable of rod withdrawal in these MODES. This requirement provides sufficient SHUTDOWN MARGIN to prevent the undesirable consequences (i.e., inadvertent criticality) that could result from an RWFS event.

RCS Boron Limitations < 500°F satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO requires that the boron concentration of the RCS be greater than the ARO critical boron concentration to provide adequate SHUTDOWN MARGIN in the event of an RWFS transient.

APPLICABILITY In the event of an RWFS transient, this LCO must be applicable to provide adequate SHUTDOWN MARGIN in the following MODES and specified conditions:

• In MODE 2 with keff < 1.0 with any RCS cold leg temperature < 500°F and with the Rod Control System capable of rod withdrawal; Wolf Creek - Unit 1 B 3.1.9-2 Revision

Attachment IV to ET 17-0001 Page 11 of 41 RCS Boron Limitations < 500°F New Page B 3.1.9 BASES APPLICABILITY

• In MODE 3 with any RCS cold leg temperature < 500°F and with the Rod (continued) Control System capable of rod withdrawal; and

• In MODES 4 and 5 with the Rod Control System capable of rod withdrawal.

In MODE 6 the requirements of LCO 3.1.9 are not applicable because the Rod Control System is not capable of rod withdrawal.

When protection is required to mitigate an RWFS event while operating under specified conditions other than those above in MODES 2 and 3, LCO 3.3.1, "Reactor Trip System," assures that the Power Range Neutron Flux - Low trip Function is OPERABLE to mitigate the event.

In MODE 1 the requirements of LCO 3.1.9 are not applicable since an uncontrolled RCCA bank withdrawal event at power would be mitigated by the Power Range Neutron Flux - High trip Function, or the Power Range Neutron Flux Rate - High Positive Rate trip Function, or the Overtemperature T trip Function, all of which are required to be OPERABLE by LCO 3.3.1, "Reactor Trip System."

Since this Specification has no LCO 3.0.4c. allowance, MODE 5 can not be entered from MODE 6 while not meeting the RCS boron concentration limits, unless the Rod Control System is incapable of rod withdrawal. The risk assessments of LCO 3.0.4.b may only be utilized for systems and components, not Criterion 2 values or parameters such as RCS boron concentration.

Therefore, a risk assessment per LCO 3.0.4b. to allow MODE changes with single or multiple system/equipment inoperabilities can not be used to allow a MODE change into, or ascending within, this LCO while not meeting the RCS boron concentration limits, even if the risk assessment specifically includes consideration of RCS boron concentration.

ACTIONS A.1 If the RCS boron concentration is not within limit, action must be taken immediately to restore the boron concentration to within limit. Borating the RCS to a boron concentration greater than ARO critical boron concentration provides sufficient SHUTDOWN MARGIN if an RWFS event should occur. Initiating action immediately to restore the boron concentration to within limit provides assurance that the LCO requirement will be restored in a timely manner. The Completion Time is reasonable, considering the low probability of an RWFS event occurring while restoring the boron concentration to within limit. Additionally, although not explicitly credited as a primary trip function, the Source Range Neutron Flux trip Function would provide protection for an RWFS event during this period of time.

Wolf Creek - Unit 1 B 3.1.9-3 Revision

Attachment IV to ET 17-0001 Page 12 of 41 RCS Boron Limitations < 500°F New Page B 3.1.9 BASES ACTIONS A.2 (continued)

If the RCS boron concentration is not within limit, an alternate action is to make the Rod Control System incapable of rod withdrawal. This action precludes an RWFS event from occurring with an inadequate SHUTDOWN MARGIN. Initiating action immediately to make the Rod Control System incapable of rod withdrawal provides adequate assurance that the plant is promptly placed in a condition in which the boron concentration requirements of the LCO are no longer required to mitigate the consequences of an RWFS event.

A.3 If the RCS boron concentration is not within limit, another alternate action is to restore all RCS cold leg temperatures to 500°F. At this RCS temperature the Power Range Neutron Flux - Low trip Function would be available to provide the necessary protection should an RWFS event occur. Initiating action immediately to restore all RCS cold leg temperatures to 500°F provides adequate assurance that the plant is promptly placed in a condition in which the boron concentration requirements of the LCO are no longer necessary.

Additionally, although not explicitly credited as a primary trip function, the Source Range Neutron Flux trip Function would provide protection for an RWFS event while RCS temperature is being increased.

Required Action A.3 is modified by a Note that states that it is not applicable in MODES 4 and 5. The Note provides assurance that this Required Action would only be taken in MODES 2 and 3 (i.e., during a plant startup) when the RCS temperature can readily be increased to 500°F. After the RCS cold leg temperatures are increased to 500°F, the requirements of LCO 3.1.9 are no longer applicable and protection for an RWFS event would be provided by the Power Range Neutron Flux - Low trip Function, which is required to be OPERABLE by LCO 3.3.1, "Reactor Trip System."

SURVEILLANCE SR 3.1.9.1 REQUIREMENTS This SR ensures that the RCS boron concentration is within limit. The boron concentration is determined periodically by chemical analysis.

A Frequency of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is adequate based on the time required to significantly dilute the RCS, the various alarms available in the control room, and the heightened awareness in the control room when the rods are capable of being withdrawn.

Wolf Creek - Unit 1 B 3.1.9-4 Revision

Attachment IV to ET 17-0001 Page 13 of 41 RCS Boron Limitations < 500°F B 3.1.9 New Page BASES REFERENCES 1. Westinghouse Nuclear Safety Advisory Letter NSAL-00-016, Rod Withdrawal from Subcritical Protection in Lower Modes, December 4, 2000.

2. USAR Section 15.4.1.

3. Technical Specification Bases Table B 3.3.1-1.

Wolf Creek - Unit 1 B 3.1.9-5 Revision

Attachment AttachmentIVIVtoto ETET 16-00XX 17-0001 Page 9 of 30 Page 14 of 41 RTS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Trip System (RTS) Instrumentation BASES BACKGROUND The RTS initiates a unit shutdown, based on the values of selected unit parameters, to protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during Anticipated Operational Occurrences (AOOs) and to assist the Engineered Safety Features (ESF) Systems in mitigating accidents.

The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying Limiting Safety System Settings (LSSS) in terms of parameters directly monitored by the RTS, as well as specifying LCOs on other reactor system parameters and equipment performance.

The LSSS, defined in this specification as the Allowable Values, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During AOOs, which are those events expected to occur one or more times during the unit life, the acceptable limits are:

1. The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the (DNBR) limit; Safety Limit value to prevent departure from nucleate boiling

2. Fuel centerline melt shall not occur; and (DNB);

3. The RCS pressure Safety Limit of 2735 psig shall not be exceeded.

Operation within the limits of Specification 2.0, "Safety Limits (SLs)," also maintains the above values and assures that offsite dose will be within the 10 CFR 20 and 10 CFR 100 criteria during AOOs.

Accidents are events that are analyzed even though they are not expected to occur during the unit life. The acceptable limit during accidents is that offsite dose shall be maintained within an acceptable fraction of 10 CFR 100 limits. Different accident categories are allowed a different fraction of these limits, based on probability of occurrence.

Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.

Wolf Creek - Unit 1 B 3.3.1-1 Revision 0

Attachment IV to ET 17-0001 Page 15 of 41 RTS Instrumentation B 3.3.1 BASES excursions APPLICABLE a. Power Range Neutron Flux - High (continued)

SAFETY ANALYSES, LCO, and levels, against a positive reactivity excursion leading to APPLICABILITY DNB during power operations. These can be caused by rod withdrawal or reductions in RCS temperature.

an uncontrolled RCCA bank The LCO requires all four of the Power Range Neutron Flux - High channels to be OPERABLE. The Trip Setpoint is 109% RTP.

In MODE 1 or 2, when a positive reactivity excursion could occur, the Power Range Neutron Flux - High trip must be OPERABLE. This Function will terminate the reactivity accurate excursion and shut down the reactor prior to reaching a (with any RCS cold leg power level that could damage the fuel. In MODE 3, 4, 5, or 6, the NIS power range detectors do not provide neutron temperature < 500 F) level indication in this range. In these MODES, the Power Range Neutron Flux - High do not have to be OPERABLE because the reactor is shut down and reactivity excursions into the power range are extremely unlikely. Other RTS 3, 4, 5, or 6 Functions and administrative controls provide protection against reactivity additions when in MODE 3, 4, 5, or 6.

b. Power Range Neutron Flux - Low The LCO requirement for the Power Range Neutron Flux - Low trip Function ensures that protection is provided against a positive reactivity excursion from low power or subcritical conditions.

The LCO requires all four of the Power Range Neutron

, such as an uncontrolled RCCA Flux - Low channels to be OPERABLE. The Trip Setpoint bank withdrawal or rod ejection, is 25% RTP. INSERT B 3.3.9-1A In MODE 1, below the Power Range Neutron Flux (P-10 setpoint), and in MODE 2, the Power Range Neutron Flux - Low trip must be OPERABLE. This Function may

be manually blocked by the operator when two out of four power range channels are greater than 10% RTP (P-10 setpoint). This Function is automatically unblocked when three out of four power range channels are below the P-10 setpoint. Above the P-10 setpoint, positive reactivity additions are mitigated by the Power Range Neutron Flux - High trip Function.

excursions Wolf Creek - Unit 1 B 3.3.1-9 Revision 0

Attachment IV to ET 17-0001 Page 16 of 41 INSERT B 3.3.1-9A with keff 1.0; and in MODE 2 with keff < 1.0, and all RCS cold leg temperatures 500°F, and the RCS boron concentration less than or equal to the all-rods-out (ARO) critical boron concentration, and the Rod Control System capable of rod withdrawal or one or more rods not fully inserted; and in MODE 3 with all RCS cold leg temperatures 500°F, and the RCS boron concentration less than or equal to the ARO critical boron concentration, and the Rod Control System capable of rod withdrawal or one or more rods not fully inserted,

Attachment IV to ET 17-0001 Page 17 of 41 RTS Instrumentation B 3.3.1 INSERT B 3.3.1-10 BASES APPLICABLE b. Power Range Neutron Flux - Low (continued)

SAFTY ANALYSES, accurately LCO, and In MODE 3, 4, 5, or 6, the Power Range Neutron APPLICABILITY Flux - Low trip Function does not have to be OPERABLE because the reactor is shut down and the NIS power range these MODES and detectors cannot detect neutron levels in this range. Other specified conditions in the RTS trip Functions and administrative controls provide Applicability. protection against positive reactivity additions or power excursions in MODE 3, 4, 5, or 6.

3. Power Range Neutron Flux Rate The Power Range Neutron Flux Rate trips use the same channels as discussed for Function 2 above.

a. Power Range Neutron Flux - High Positive Rate The Power Range Neutron Flux - High Positive Rate trip Function ensures that protection is provided against rapid increases in neutron flux that are characteristic of an RCCA drive rod housing rupture and the accompanying ejection of the RCCA. This Function compliments the Power Range Neutron Flux - High and Low Setpoint trip Functions to ensure that the criteria are met for a rod ejection from the power range. This Function also provides protection for the rod withdrawal at power event.

The LCO requires all four of the Power Range Neutron Flux - High Positive Rate channels to be OPERABLE.

In MODE 1 or 2, when there is a potential to add a large amount of positive reactivity from a rod ejection accident (REA), the Power Range Neutron Flux - High Positive Rate trip must be OPERABLE. In MODE 3, 4, 5, or 6, the Power Range Neutron Flux - High Positive Rate trip Function does not have to be OPERABLE because other RTS trip Functions and administrative controls will provide protection against positive reactivity additions. excursions.

b. Power Range Neutron Flux - High Negative Rate The Power Range Neutron Flux - High Negative Rate trip Function ensures that protection is provided for multiple rod drop accidents. At high power levels, a multiple rod drop accident could cause local flux peaking that would Wolf Creek - Unit 1 B 3.3.1-10 Revision 29

Attachment IV to ET 17-0001 Page 18 of 41 INSERT B 3.3.1-10 The Power Range Neutron Flux - Low trip Function does not have to be OPERABLE in MODE 2 with the reactor subcritical (keff < 1.0) and any combination of one or more of the following specified conditions in the Applicability, nor does this trip Function have to be OPERABLE in MODE 3 with any combination of one or more of the following specified conditions in the Applicability:

• any RCS cold leg temperature < 500°F, or

• RCS boron concentration greater than the ARO critical boron concentration, or

• Rod Control System incapable of rod withdrawal and all rods fully inserted.

Accident analysis acceptance criteria with the reactor subcritical, and any RCS cold leg temperature < 500°F, and with the Rod Control System capable of rod withdrawal are satisfied by virtue of the RCS boration requirements of LCO 3.1.9, "RCS Boron Limitations < 500°F."

Acceptance criteria are satisfied, and the protection provided by the Power Range Neutron Flux

- Low trip Function is not required, if the RCS boron concentration is greater than the ARO critical boron concentration or the Rod Control System is rendered incapable of rod withdrawal per the requirements of LCO 3.1.9.

In addition, in MODE 3 (with any RCS cold leg temperature < 500°F, or the RCS sufficiently borated, or the RCCA bank withdrawal event precluded per the specified conditions of footnote (i) in Table 3.3.1-1), 4, 5, or 6,

Attachment IV to ET 17-0001 Page 19 of 41 RTS Instrumentation B 3.3.1 BASES APPLICABLE 4. Intermediate Range Neutron Flux (continued)

SAFETY ANALYSES, LCO, and Function is required to be OPERABLE. Therefore, a third channel APPLICABILITY is unnecessary.

In MODE 1 below the P-10 setpoint, and in MODE 2, above the P-6 setpoint when there is a potential for an uncontrolled RCCA bank rod withdrawal accident during reactor startup, the an uncontrolled Intermediate Range Neutron Flux trip must be OPERABLE. RCCA bank Above the P-10 setpoint, the Power Range Neutron Flux - High Setpoint trip and the Power Range Neutron Flux - High Positive Rate trip provide core protection for a rod withdrawal accident. In MODE Modes 2 (below the P-6 setpoint), the Source Range Neutron Flux trip Function provides core protection for reactivity accidents. In MODE 3, 4, 5, or 6, the Intermediate Range Neutron Flux trip Function does not have to be OPERABLE because other RTS trip Functions and administrative controls will provide protection INSERT B against unacceptable positive reactivity additions.

3.3.1-12A

5. Source Range Neutron Flux The LCO requirement for the Source Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition. This trip Function provides redundant protection to the Power Range Neutron Flux - Low trip Function. In MODES 3, 4, and 5, administrative controls also prevent the uncontrolled withdrawal of rods. The NIS source range detectors (with any RCS cold are located external to the reactor vessel and measure neutrons leg temperature < leaking from the core. The NIS source range detectors do not 500oF) provide any inputs to control systems. The source range trip is the only RTS automatic protection function required in MODES 3, 4, and 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. Therefore, the functional capability at the specified Trip Setpoint is assumed to be available.

The LCO requires two channels of Source Range Neutron Flux to INSERT B be OPERABLE. Two OPERABLE channels are sufficient to 3.3.1-12B ensure no single random failure will disable this trip Function. The Trip Setpoint is 1.0 E5 cps. The outputs of the Function to RTS logic are not required OPERABLE in MODE 6 or when all rods are fully inserted and the Rod Control System is incapable of rod withdrawal.

Wolf Creek - Unit 1 B 3.3.1-12 Revision 0

Attachment IV to ET 17-0001 Page 20 of 41 INSERT B 3.3.1-12A In MODE 3 with all RCS cold leg temperatures 500°F, and the RCS boron concentration less than or equal to the ARO critical boron concentration, the Rod Control System capable of rod withdrawal or one or more rods not fully inserted, the Power Range Neutron Flux - Low trip Function provides protection for an uncontrolled RCCA bank withdrawal or control rod ejection event from low power or subcritical conditions.

With the Rod Control System capable of rod withdrawal in MODE 3 with any RCS cold leg temperature < 500°F, in MODE 4, or MODE 5, LCO 3.1.9, "RCS Boron Limitations < 500°F,"

requires that the RCS boron concentration be greater than the ARO critical boron concentration to ensure that sufficient SDM is available if an uncontrolled RCCA bank withdrawal event were to occur. In MODE 6, the Rod Control System is incapable of rod withdrawal and the core has a required increased SDM. Also, the NIS intermediate range detectors cannot adequately detect neutron levels present during lower temperatures.

INSERT B 3.3.1-12B In MODE 3 with all RCS cold leg temperatures 500°F, and the RCS boron concentration less than or equal to the ARO critical boron concentration, and the Rod Control System capable of rod withdrawal or one or more rods not fully inserted, the Power Range Neutron Flux - Low trip Function provides protection for an uncontrolled RCCA bank withdrawal or control rod ejection event from low power or subcritical conditions.

With the Rod Control System capable of rod withdrawal in MODE 3 with any RCS cold leg temperature < 500°F, MODE 4, and MODE 5, LCO 3.1.9, "RCS Boron Limitations < 500°F,"

requires that the RCS boron concentration be greater than the ARO critical boron concentration to ensure that sufficient SDM is available if an uncontrolled RCCA bank withdrawal event were to occur. The safety analyses do not take explicit credit for the Source Range Neutron Flux trip Function as a primary trip to mitigate an uncontrolled RCCA bank withdrawal event or control rod ejection occurring from low power or subcritical conditions since this trip Function is not tested for its response time under SR 3.3.1.16. LCO 3.1.9, "RCS Boron Limitations < 500°F,"

assures that sufficient SDM is available if an uncontrolled RCCA bank withdrawal were to occur while the plant is operating within that LCO's Applicability and specified conditions.

Attachment IV to ET 17-0001 Page 21 of 41 RTS Instrumentation B 3.3.1 BASES APPLICABLE 5. Source Range Neutron Flux (continued)

SAFETY ANALYSES, LCO, and The Source Range Neutron Flux Function provides protection for APPLICABILITY control rod withdrawal from subcritical and control rod ejection events.

In MODE 2, when below the P-6 setpoint, the Source Range Neutron Flux trip must be OPERABLE. Above the P-6 setpoint, the Intermediate Range Neutron Flux trip and the Power Range Neutron Flux - Low trip will provide core protection for reactivity accidents. Above the P-6 setpoint, the NIS source range detectors are de-energized.

In MODE 3, 4, or 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted, the Source Range Neutron Flux trip Function must also be OPERABLE. If the Rod Control System is capable of rod withdrawal, the Source Range Neutron Flux trip must be OPERABLE to provide core protection against a rod withdrawal accident. If the Rod Control System is not capable of rod withdrawal with rods fully inserted, the source range detectors are not required to trip the reactor.

However, their monitoring Function must be OPERABLE to monitor core neutron levels and provide indication of reactivity changes that may occur. The requirements for the NIS source range detectors in MODE 6 are addressed in LCO 3.9.3, "Nuclear Instrumentation."

in MODES

6. Overtemperature T 3, 4, and 5 The Overtemperature T trip Function is provided to ensure that the design limit DNBR is met. This trip Function also limits the range over which the Overpower T trip Function must provide protection. The inputs to the Overtemperature T trip include pressure, coolant temperature, axial power distribution, and reactor power as indicated by loop T assuming full reactor coolant flow. Protection from violating the DNBR limit is assured for those transients that are slow with respect to delays from the core to the measurement system. The Overtemperature T trip Function uses each loop's T as a measure of reactor power and is compared with a setpoint that is automatically varied with the following parameters:

• reactor coolant average temperature - the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature; Wolf Creek - Unit 1 B 3.3.1-13 Revision 0

Attachment AttachmentIVIVtoto ETET 16-00XX 17-0001 Page 11 of Page 22 of 41 30 RTS Instrumentation B 3.3.1 BASES APPLICABLE 9. Pressurizer Water Level - High (continued)

SAFETY ANALYSES, LCO, and In MODE 1, when there is a potential for overfilling the pressurizer, APPLICABILITY the Pressurizer Water Level - High trip must be OPERABLE. This trip Function is automatically enabled on increasing power by the The RCS flow P-7 interlock. On decreasing power, this trip Function is transmitters in each automatically blocked below P-7. Below the P-7 setpoint, loop are adjusted transients that could raise the pressurizer water level will be slow (normalized) to indicate and the operator will have sufficient time to evaluate unit 100% flow at 100%

conditions and take corrective actions.

RTP. The RCS flow is measured in accordance with SR

10. Reactor Coolant Flow - Low 3.4.1.4 to confirm that the actual flow is The Reactor Coolant Flow - Low trip Function ensures that greater than the value protection is provided against violating the DNBR limit due to low assumed in the flow in one or more RCS loops, while avoiding reactor trips due to accident analysis. normal variations in loop flow. Above the P-7 setpoint, the reactor Periodic performance of trip on low flow in two or more RCS loops is automatically enabled.

SR 3.3.1.1 and SR Above the P-8 setpoint, a loss of flow in any RCS loop will actuate 3.4.1.3 confirms that the a reactor trip. Each RCS loop has three flow detectors to monitor RCS flow instrument flow. The flow signals are not used for any control system input.

indications continue to indicate accurate flow. The LCO requires three Reactor Coolant Flow - Low channels per The value for the RCS loop to be OPERABLE in MODE 1 above P-7. The Trip Setpoint is Low Flow set point, 89.9% of loop design flow (loop design flow - 90,324 gpm).

expressed as a percentage of In MODE 1, above the P-8 setpoint, a loss of flow in one RCS loop normalized (100%) flow could result in DNB conditions in the core because of the higher is periodically verified to power level. In MODE 1, below the P-8 setpoint and above the be within acceptable tolerance with SR P-7 setpoint, a loss of flow in two or more loops is required to 3.3.1.7 and SR actuate a reactor trip because of the lower power level and the 3.3.1.10. This process greater margin to the design limit DNBR. Below the P-7 setpoint, ensures that the all reactor trips on low flow are automatically blocked since there is nominal set point insufficient heat production to generate DNB conditions.

remains consistent with the assumptions of the 11. Not Used. Normalized Flow accident analysis.

12. Undervoltage Reactor Coolant Pumps The Undervoltage RCP reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops. There is one potential transformer (PT), with a primary to secondary ratio of 14400:120, Wolf Creek - Unit 1 B 3.3.1-18 Revision 0

Attachment AttachmentIVIVtotoETET16-00XX 17-0001 Page 14 of 30 Page 23 of 41 RTS Instrumentation B 3.3.1 BASES APPLICABLE 21. Automatic Trip Logic (continued)

SAFETY ANALYSES, LCO, and breaker while the unit is at power. The reactor trip signals APPLICABILITY generated by the RTS Automatic Trip Logic cause the RTBs and associated bypass breakers to open and shut down the reactor.

The LCO requires two trains of RTS Automatic Trip Logic to be OPERABLE. Having two OPERABLE channels ensures that random failure of a single logic channel will not prevent reactor trip.

These trip Functions must be OPERABLE in MODE 1 or 2 when the reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.

The RTS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

ACTIONS A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.1-1.

In the event a channels Trip Setpoint is found nonconservative with 3.3.1-1 respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Function channels provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function channels affected. When the Required Channels in Table 3.3-1 are specified on a per loop, per SG, per bus, etc., basis, then the Condition may be entered separately for each loop, SG, bus, etc., as appropriate.

When the number of inoperable channels in a trip Function exceed those specified in one or other related Conditions associated with a trip Function, then the unit is outside the safety analysis. Therefore, LCO 3.0.3 must be immediately entered if applicable in the current MODE of operation.

A.1 Condition A applies to all RTS protection Functions. Condition A addresses the situation where one or more required channels or trains for one or more Functions are inoperable at the same time. The Required Wolf Creek - Unit 1 B 3.3.1-30 Revision 1

Attachment IV to ET 17-0001 Page 24 of 41 RTS Instrumentation B 3.3.1 BASES ACTIONS C.1, C.2.1 and C.2.2 (continued)

This action addresses the train orientation of the SSPS for these Functions. With one channel or train inoperable, the inoperable channel or train must be restored to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. If the affected Function(s) cannot be restored to OPERABLE status within the allowed 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> Completion Time, the unit must be placed in a MODE in which the requirement does not apply. To achieve this status, action must be initiated within the same 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> to fully insert all rods and the Rod Control System must be rendered incapable of rod withdrawal within the next hour (e.g., by de-energizing all CRDMs, by opening the RTBs, or de-energizing the motor generator (MG) sets). The additional hour for the latter provides sufficient time to accomplish the action in an orderly manner. With the rods fully inserted and Rod Control System incapable of rod withdrawal, these Functions are no longer required.

The Completion Time is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function, and given the low probability of an event occurring during this interval.

Risk assessments performed pursuant to LCO 3.0.4.b should consider the LCO 3.1.9, "RCS desirability of enabling the Rod Control System or allowing one or more Boron Limitations rods to be other than fully inserted in MODES 3, 4, or 5 while one train of

< 500 oF," is met Function 19 (one RTB train), Function 20 (one trip mechanism for one RTB), or Function 21 (one SSPS logic train) is inoperable and the Reactor Trip System is degraded. The risk assessment should assure that, prior to enabling the Rod Control System or allowing one or more rods to be other than fully inserted in MODES 3, 4, 04 5, procedural controls have or 5.

been implemented to maintain the RCS boron concentration sufficient to preclude criticality with all control rods fully withdrawn. The administrative controls apply prior to making this Applicability change, however, if the Applicability change took place, these controls include immediate actions to borate or insert all rods and disable rod control whenever RCS temperature is below 500qF. This would mitigate any inadvertent rod withdrawal from subcritical transient.

D.1.1, D.1.2, and D.2 Condition D applies to the Power Range Neutron Flux - High Function.

With one of the NIS power range detectors inoperable, 1/4 of the radial power distribution monitoring capability is lost. Therefore, SR 3.2.4.2 must be performed (Required Action D.1.1) within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of THERMAL POWER exceeding 75% RTP and once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter.

Calculating QPTR every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> compensates for the lost monitoring capability due to the inoperable NIS power range channel and allows Wolf Creek - Unit 1 B 3.3.1-32 Revision 20

Attachment IV to ET 17-0001 Page 25 of 41 RTS Instrumentation B 3.3.1 BASES ACTIONS U.1 and U.2 (continued)

With the unit in MODE 3, Condition C is entered if the inoperable trip mechanism has not been restored and the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted. The affected RTB shall not be bypassed while one of the diverse features is inoperable except for the time required to perform maintenance to restore the inoperable trip mechanism to OPERABLE status.

The Completion Time of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> for Required Action U.1 is reasonable considering that in this Condition there is one remaining diverse feature INSERT B 3.3.1-41 for the affected RTB, and one OPERABLE RTB capable of performing the safety function and given the low probability of an event occurring during this interval.

SURVEILLANCE The SRs for each RTS Function are identified by the SRs column of REQUIREMENTS Table 3.3.1-1 for that Function.

A Note has been added to the SR Table stating that Table 3.3.1-1 determines which SRs apply to which RTS Functions.

Note that each channel of process protection supplies both trains of the RTS. When testing Channel I, Train A and Train B must be examined.

Similarly, Train A and Train B must be examined when testing Channel II, Channel III, and Channel IV. The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.

SR 3.3.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Wolf Creek - Unit 1 B 3.3.1-43 Revision 20

Attachment IV to ET 17-0001 Page 26 of 41 INSERT B 3.3.1-41 V.1, V.2.1, V.2.2.1, V.2.2.2, and V.2.3 Condition V applies to one inoperable Power Range Neutron Flux - Low channel in MODE 1 below the P-10 setpoint and in MODE 2 with keff > 1.0. The inoperable channel must be placed in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Placing the channel in the tripped condition results in a partial trip status requiring only a one-out-of-three logic for actuation of this reactor trip function.

The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to place the inoperable channel in the tripped condition is justified in Reference 12.

The Required Action is modified by a Note. The Note allows placing an inoperable channel in the bypassed condition for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> while performing routine surveillance testing of the other channels. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> time limit is justified in Reference 12.

If the inoperable channel can not be placed in the tripped condition within the specified 72-hour Completion Time, the plant must be placed in MODE 2 with keff < 1.0 within 78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br />. In addition, within 78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> action must be initiated to either fully insert all rods and make the Rod Control System incapable of rod withdrawal or to initiate boration of the RCS to greater than the all-rods-out (ARO) critical boron concentration. Required Actions V.2.2.1 and V.2.2.2 would preclude an uncontrolled RCCA bank withdrawal accident from occurring. Required Action V.2.3 would provide sufficient SHUTDOWN MARGIN if an uncontrolled RCCA bank withdrawal event were to occur.

W.1 Condition W applies to one inoperable Power Range Neutron Flux - Low channel in MODE 2 with keff < 1.0, and all RCS cold leg temperatures 500°F, and the RCS boron concentration less than or equal to the all-rods-out (ARO) critical boron concentration, and the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. Condition W also applies to one inoperable Power Range Neutron Flux - Low channel in MODE 3 with all RCS cold leg temperatures 500°F, and the RCS boron concentration less than or equal to the ARO critical boron concentration, and the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. The inoperable channel must be placed in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Placing the channel in the tripped condition results in a partial trip status requiring only a one-out-of-three logic for actuation of this reactor trip function. The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to place the inoperable channel in the tripped condition is justified in Reference 12.

The Required Action is modified by a Note. The Note allows placing an inoperable channel in the bypassed condition for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> while performing routine surveillance testing of the other channels. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> time limit is justified in Reference 12.

Attachment IV to ET 17-0001 Page 27 of 41 INSERT B 3.3.1-41 (continued)

X.1.1, X.1.2, and X.2 Condition X applies when the Required Action and associated Completion Time of Condition W is not met or if two or more channels in the Power Neutron Flux - Low trip Function are inoperable when the plant is operating within the MODES and specified conditions in the Applicability discussed above under Condition W.

If the inoperable channel can not be placed in the tripped condition within the specified 72-hour Completion Time, or if two or more channels are inoperable, action must be initiated to fully insert all rods and to make the Rod Control System incapable of rod withdrawal. These actions will preclude an uncontrolled RCCA bank withdrawal accident from occurring.

If the inoperable channel can not be placed in the tripped condition within the specified 72-hour Completion Time, or if two or more channels are inoperable, an alternate action is to initiate boration of the RCS to greater than the all-rods-out (ARO) critical boron concentration. Borating the RCS to greater than ARO critical boron concentration would provide sufficient SDM if an uncontrolled RCCA bank withdrawal event were to occur.

Attachment IV Attachment IVtotoET ET16-00XX 17-0001 Page 16 of 30 Page 28 of 41 RTS Instrumentation B 3.3.1 TABLE B 3.3.1-1 (Page 1 of 2)

FUNCTION TRIP SETPOINT(a)

1. Manual Reactor Trip NA

2. Power Range Neutron Flux

a. High 109% of RTP

b. Low 25% of RTP

3. Power Range Neutron Flux

a. High Positive Rate 4% of RTP with a time constant 2 seconds

b. High Negative Rate 4% of RTP with a time constant 2 seconds

4. Intermediate Range Neutron Flux 25% of RTP

5. Source Range Neutron Flux 105 cps

6. Overtemperature T See Table 3.3.1-1 Note 1

7. Overpower T See Table 3.3.1-1 Note 2

8. Pressurizer Pressure

a. Low 1940 psig

b. High 2385 psig Normalized Flow

9. Pressurizer Water level - High 92% of instrument span

10. Reactor Coolant Flow - Low 89.9% of loop design flow (90,324 gpm)

11. Not Used

12. Undervoltage RCPs 10578 Vac

13. Underfrequency RCPs 57.15 Hz

14. Steam Generator (SG) Water Level 23.5% of narrow range Low - Low instrument span

15. Not Used

16. Turbine Trip

a. Low Fluid Oil Pressure 590.00 psig

b. Turbine Stop Valve Closure 1% open Wolf Creek - Unit 1 B 3.3.1-56 Revision 66

Attachment AttachmentIVIVtotoETET 16-00XX 17-0001 Page 17 of 30 Page 29 of 41 RTS Instrumentation B 3.3.1 TABLE B 3.3.1-2 (Page 1 of 2)

FUNCTIONAL UNIT RESPONSE TIME

1. Manual Reactor Trip N.A.

2. Power Range Neutron Flux

a. High 0.5 second(1)

b. Low 0.5 second(1)

3. Power Range Neutron Flux

a. High Positive Rate 0.5 second(1).

b. High Negative Rate 0.5 second(1)

4. Intermediate Range Neutron Flux N.A.

5. Source Range Neutron Flux N.A.

6. Overtemperature T 6.0 seconds(1)

7. Overpower T 6.0 seconds(1) 1.0 second

8. Pressurizer Pressure

a. Low 2.0 seconds

b. High 2.0 seconds

9. Pressurizer Water Level - High N.A.

10. Reactor Coolant Flow - Low

a. Single Loop (Above P-8) 1.0 second

b. Two Loops (Above P-7 and below P-8) 1.0 second

11. Not Used

12. Undervoltage - Reactor Coolant Pumps 1.5 seconds

13. Underfrequency - Reactor Coolant Pumps 0.6 second

14. Steam Generator Water Level - Low-Low 2.0 seconds

15. Not Used (1)

Response time of the neutron flux signal portion of the channel shall be measured from detector output or input of first electronic component in channel.

Wolf Creek - Unit 1 B 3.3.1-58 Revision 29

Attachment AttachmentIVIV to to ETET16-00XX 17-0001 Page 18 of Page 30 of 41 30 ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND The ESFAS initiates necessary safety systems, based on the values of selected unit parameters, to protect against violating core design limits and the Reactor Coolant System (RCS) pressure boundary, and to mitigate accidents.

The ESFAS instrumentation is segmented into three distinct but interconnected modules as identified below:

• Field transmitters or process sensors and instrumentation:

provide a measurable electronic signal based on the physical and Turbine Trip Low Fluid Oil Pressure characteristics of the parameter being measured;

• Signal processing equipment including 7300 Process Protection System, and Foxboro Spec 200 (for Auxiliary Feedwater Low Suction Pressure) field contacts, and protection channel sets:

provide signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board/control room/miscellaneous indications; and

• Solid State Protection System (SSPS) including input, logic, output bays and Balance of Plant (BOP) ESFAS circuitry: initiates the proper unit shutdown or engineered safety feature (ESF) actuation in accordance with the defined logic and based on the bistable outputs from the signal process control and protection system.

Field Transmitters or Sensors To meet the design demands for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters. In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS).

In some cases, the same channels also provide control system inputs. To account for calibration tolerances and instrument drift, which are assumed to occur between calibrations, statistical allowances are provided in the Trip Setpoint and Allowable Values. The OPERABILITY of each transmitter or sensor can be evaluated when its "as found" calibration data are compared against its documented acceptance criteria.

Wolf Creek - Unit 1 B 3.3.2-1 Revision 0

Attachment AttachmentIVIVtotoETET 16-00XX 17-0001 Page 20 of 30 Page 31 of 41 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 6. Auxiliary Feedwater (continued)

SAFETY ANALYSES, LCO, and SR 3.3.2.8. This limits the potential for inadvertent AFW APPLICABILITY actuations during normal startups and shutdowns. In MODES 3, 4, and 5, the MFW pumps may be normally shut down, and thus pump trip is not indicative of a condition requiring automatic AFW initiation.

h. Auxiliary Feedwater - Pump Suction Transfer on Suction Pressure - Low A low pressure signal in the AFW pump suction line protects the AFW pumps against a loss of the normal transmitters supply of water for the pumps, the CST. Three pressure switches are located on the AFW pump suction line from the CST. A low pressure signal sensed by any two of the three switches coincident with an auxiliary feedwater actuation signal will cause the emergency supply of water for both pumps to be aligned. ESW (safety grade) is automatically lined up to supply the AFW pumps to ensure an adequate supply of water for the AFW System to maintain at least one of the SGs as the heat sink for reactor decay heat and sensible heat removal.

Since the detectors are located in an area not affected by HELBs or high radiation, they will not experience any adverse environmental conditions and the Trip Setpoint reflects only steady state instrument uncertainties. The Trip Setpoint is 21.60 psia.

This Function must be OPERABLE in MODES 1, 2, and 3 to ensure a safety grade supply of water for the AFW System to maintain the SGs as the heat sink for the reactor. This Function does not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink.

In MODE 4, AFW automatic suction transfer does not need to be OPERABLE because RHR will already be in operation, or sufficient time is available to place RHR in operation, to remove decay heat.

Wolf Creek - Unit 1 B 3.3.2-28 Revision 37

Attachment IVIVtotoET Attachment ET16-00XX 17-0001 Page 21 of 30 Page 32 of 41 RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits BASES BACKGROUND These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within limits assumed in the safety analyses.

The safety analyses (Ref. 1) of normal operating conditions and anticipated operational occurrences assume initial conditions within the normal steady state envelope. The limits placed on RCS pressure, temperature, and flow rate ensure that the minimum departure from nucleate boiling ratio (DNBR) will be met for each of the transients analyzed.

The Pressurizer pressure limit is consistent with operation within the nominal operational envelope. Pressurizer pressure indications are averaged to come up with a value for comparison to the limit. A lower pressure will cause the reactor core to approach DNB limits.

The RCS coolant average temperature limit is consistent with full power operation within the nominal operational envelope. Indications of temperature are averaged to determine a value for comparison to the limit. A higher average temperature will cause the core to approach DNB limits.

The RCS total flow rate normally remains constant during an operational fuel cycle with all pumps running. The minimum RCS flow limit corresponds to that assumed for DNB analyses. Flow rate indications are averaged to come up with a value for comparison to the limit. A lower RCS flow will cause the core to approach DNB limits.

Operation for significant periods of time outside these DNB limits increases the likelihood of a fuel cladding failure in a DNB limited event.

APPLICABLE The requirements of this LCO represent the initial conditions for DNB SAFETY ANALYSES limited transients analyzed in the plant safety analyses (Ref. 1). The criteria.

safety analyses have shown that transients initiated from the limits of this LCO will result in meeting the safety analysis limit DNBR as specified in the COLR. This is the acceptance limit for the RCS DNB parameters.

Changes to the unit that could impact these parameters must be assessed for their impact on the DNBR criteria. The transients analyzed for include loss of coolant flow events and dropped or stuck rod events. A key assumption for the analysis of these events is that the core power Wolf Creek - Unit 1 B 3.4.1-1 Revision 0

Attachment IVIVtotoET Attachment ET16-00XX 17-0001 Page 22 of 30 Page 33 of 41 RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 using available BASES APPLICABLE distribution limits are satisfied per LCO 3.1.4, "Rod Group Alignment SAFETY ANALYSIS Limits; " LCO 3.1.5, "Shutdown Bank Insertion Limits;" LCO 3.1.6, (continued) "Control Bank Insertion Limits"; LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)"; and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)."

The pressurizer pressure limit and RCS average temperature limit specified in the COLR correspond to the analytical limits used in the safety analyses, with allowance for measurement uncertainty. available s

Fuel rod bowing reduces the value of DNB ratio. Credit is available to offset this reduction in the generic margin. The generic margins completely offset any rod bow penalties. This is the margin between the correlation DNBR limit and the safety analysis limit DNBR. These limits are specified in the COLR. The applicable values of rod bow penalties are referenced in the USAR.

The RCS DNB parameters satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO specifies limits on the monitored process variables - pressurizer pressure, RCS average temperature, and RCS total flow rate - to ensure In order to provide the core operates within the limits assumed in the safety analyses. These adequate DNB variables are contained in the COLR to provide operating and analysis margin, a review of the flexibility from cycle to cycle. However, the minimum RCS flow, usually past RCS flow based on the maximum analyzed steam generator tube plugging, is performance at WCGS retained in the TS LCO. Operating within these limits will result in meeting was performed and a the DNBR criterion in the event of a DNB limited transient. is value was determined The RCS total flow rate limit contains a measurement error of 2.5% based for the minimum on performing a precision heat balance and using the result to normalize measured flow (MMF). the RCS flow rate indicators. Potential fouling of the feedwater venturi, The MMF value is which might not be detected, could bias the result from the precision heat specified in the COLR, balance in a nonconservative manner.

and bounds the calculated uncertainty The effect of any fouling that might bias the flow rate measurement shall be quantified and compensated for in the RCS flow rate measurement or of 3.6% RCS flow, the venturi shall be cleaned to eliminate the fouling.

which was calculated for the RCS Flow-Cold The LCO numerical values for pressure, temperature, and flow rate Leg Elbow Tap specified in the COLR have been adjusted for instrument error.

Indication as discussed in APPLICABILITY WCAP-18083-P In MODE 1, the limits on pressurizer pressure, RCS coolant average temperature, and RCS total flow rate must be maintained during steady (Reference 2).

state operation in order to ensure DNBR criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient.

Wolf Creek - Unit 1 B 3.4.1-2 Revision 10

Attachment AttachmentIVIVtotoETET16-00XX 17-0001 Page 23 of 30 Page 34 of 41 RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEILLANCE SR 3.4.1.3 REQUIREMENTS (continued) The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Surveillance Frequency for RCS total flow rate is performed using the installed flow instrumentation. The installed flow instrumentation provides indication as a percentage of total flow rate based on the precision calorimetric heat balance. Plant procedures specify the percentage of the total flow rate required to meet the RCS total flow rate limit. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> interval has been shown by operating practice to be sufficient to regularly assess potential degradation and to verify operation within safety analysis assumptions.

SR 3.4.1.4 Measurement of RCS total flow rate by performance of a precision calorimetric heat balance once every 18 months after each refueling allows the installed RCS flow instrumentation to be normalized and verifies the actual RCS flow rate is greater than or equal to the minimum required RCS flow rate. When performing a precision heat balance, the instrumentation used for determining steam pressure, feedwater pressure, feedwater temperature, and feedwater venturi p in the calorimetric calculations shall be calibrated within 7 days prior to performing the heat balance.

The Frequency of 18 months reflects the importance of verifying flow after a refueling outage when the core has been altered, which may have caused an alteration of flow resistance.

This SR is modified by a Note that allows entry into MODE 1, without having performed the SR, and placement of the unit in the best condition for performing the SR. The Note states that the SR is not required to be performed until 7 days after 95% RTP. This exception is appropriate since the heat balance requires the plant to be at a minimum of 95% RTP to obtain the stated RCS flow accuracies and the test is only a confirmation of SR 3.4.1.4. The Surveillance shall be performed within 7 days after reaching 95% RTP.

REFERENCES 1. USAR, Chapter 15.

2. WCAP-18083-P, Revision 0, "Westinghouse Revised Thermal Design Procedure Uncertainty Calculations for the Wolf Creek Generating Station," February 2016.

Wolf Creek - Unit 1 B 3.4.1-6 Revision 0

Attachment IVIVtotoET Attachment ET16-00XX 17-0001 Page 24 of 30 Page 35 of 41 ECCS - Operating B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 ECCS - Operating BASES BACKGROUND The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA), coolant leakage greater than the capability of the normal charging system;

b. Rod ejection accident;

c. Loss of secondary coolant accident, including uncontrolled steam release or loss of feedwater; and

d. Steam generator tube rupture (SGTR).

The addition of negative reactivity is designed primarily for the loss of secondary coolant accident where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.

There are three phases of ECCS operation: injection, cold leg recirculation, and hot leg recirculation. In the injection phase, water is taken from the refueling water storage tank (RWST) and injected into the Reactor Coolant System (RCS) through the cold legs. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment sumps have enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to the containment sump for cold leg recirculation. After several hours, the ECCS flow is shifted to the hot leg recirculation phase to provide a backflush, which would reduce the boiling in the top of the core and any resulting boron precipitation.

The ECCS consists of three separate subsystems: centrifugal charging (high head), safety injection (SI) (intermediate head), and residual heat removal (RHR) (low head). Each subsystem consists of two redundant, prior to reaching the 100% capacity trains. The ECCS accumulators and the RWST are also boric acid precipitation part of the ECCS, but are not considered part of an ECCS flow path as limit described by this LCO.

The ECCS flow paths consist of piping, valves, heat exchangers,and pumps such that water from the RWST can be injected into the RCS Wolf Creek - Unit 1 B 3.5.2-1 Revision 0

Attachment IVIVtotoET Attachment ET 16-00XX 17-0001 Page 25 of 30 Page 36 of 41 MSSVs B 3.7.1 A third turbine trip analysis is performed to BASES APPLICABLE crediting reactor trip on high pressurizer pressure and operation of the SAFETY ANALYSES pressurizer safety valves. This analysis demonstrates that the maximum (continued) RCS pressure does not exceed 110% of the design pressure. All cases analyzed demonstrate that the MSSVs maintain Main Steam System integrity by limiting the maximum steam pressure to less than 110% of the steam generator design pressure.

In addition to the decreased heat removal events, reactivity insertion events may also challenge the relieving capacity of the MSSVs. The uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power event is characterized by an increase in core power and steam generation rate until reactor trip occurs when either the Overtemperature T or Power Range Neutron Flux-High setpoint is reached. Steam flow to the turbine will not increase from its initial value for this event. The increased heat transfer to the secondary side causes an increase in steam pressure and may result in opening of the MSSVs prior to reactor trip, assuming no credit for operation of the atmospheric or condenser steam dump valves. The USAR Section 15.4 safety analysis of the RCCA bank withdrawal at power event for a range of initial core power levels demonstrates that the MSSVs are capable of preventing secondary side overpressurization for this AOO.

The USAR safety analyses discussed above assume that all of the MSSVs for each steam generator are OPERABLE. If there are inoperable MSSV(s), it is necessary to limit the primary system power during steady-state operation and AOOs to a value that does not result in exceeding the combined steam flow capacity of the turbine (if available) and the remaining OPERABLE MSSVs.

OO In some circumstances it is necessary to limit the primary side heat generation that can be achieved during an A00 by reducing the setpoint of the Power Range Neutron Flux-High reactor trip function. For example, if more than one MSSV on a single steam generator is inoperable, an uncontrolled RCCA bank withdrwal at power event occurring from a partial power level may result in an increase in reactor power that exceeds the combined steam flow capacity of the turbine and the remaining OPERABLE MSSVs. Thus, for multiple inoperable MSSVs on the same steam generator it is necessary to prevent this power increase by lowering the Power Range Neutron Flux-High setpoint to an appropriate value. When the Moderator Temperature Coefficient (MTC) is positive, the reactor power may increase above the initial value during an RCS heatup event (e.g., turbine trip). Thus, for any number of inoperable MSSVs it is necessary to reduce the trip setpoint if a positive MTC may exist at partial power conditions, unless it is demonstrated by analysis that Wolf Creek - Unit 1 B 3.7.1-2 Revision 0

Attachment IV Attachment IVtotoET ET16-00XX 17-0001 Page 26 of 30 Page 37 of 41 MSSVs The maximum THERMAL POWER corresponding to the heat removal B 3.7.1 capacity of the remaining OPERABLE MSSVs is determined via a conservative analysis of the loss of load/turbine trip event with inoperable BASES MSSVs assumed.

ACTIONS Operation with less than all five MSSVs OPERABLE for each steam (continued) generator is permissible, if THERMAL POWER is limited to the relief capacity of the remaining MSSVs. This is accomplished by restricting THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam generator.

A.1 In the case of only a single inoperable MSSV on one or more steam generators when the Moderator Temperature Coefficient is not positive, a reactor power reduction alone is sufficient to limit primary side heat generation such that overpressurization of the secondary side is precluded for any RCS heatup event. Furthermore, for this case there is sufficient total steam flow capacity provided by the turbine and remaining insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Therefore, Required Action A.1 requires an appropriate reduction in reactor power within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

A sensitivity study (Ref. 7) was performed to analyze the loss of load/turbine trip event initiated from power levels based on Table 3.7.1-1 and assuming both beginning of life and end of life reactivity feedback conditions. The results of all cases studied showed that the secondary system peak pressure was maintained below 110% of the secondary system design pressure limit.

B.1 and B.2 In the case of multiple inoperable MSSVs on one or more steam generators, with a reactor power reduction alone there may be insufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Futhermore, for a single inoperable MSSV on one or more steam generators when the Moderator Temperature Coefficient is positive the reactor power may increase as a result of an RCS heatup event such that flow capacity of the remaining OPERABLE MSSVs is insufficient. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time for Required Action B.1 is consistent with A.1. An additional 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> is allowed in Required Action B.2 to reduce the setpoints. The completion time of 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> is based on a reasonable time to correct the MSSV inoperability, the time required to perform the power reduction, Wolf Creek - Unit 1 B 3.7.1-4 Revision 0

Attachment AttachmentIVIVtotoETET 16-00XX 17-0001 Page 27 of 30 Page 38 of 41 MSSVs The maximum THERMAL POWER corresponding to the heat removal B 3.7.1 capacity of the remaining OPERABLE MSSVs is determined via a conservative analysis of the loss of load/turbine trip event with inoperable BASES MSSVs assumed.

ACTIONS B.1 and B.2 (continued) operating experience in resetting all channels of protective function and on the low probability of the occurrence of a transient that could result in steam generator overpressure during this period.

A sensitivity study (Ref. 7) was performed to analyze the loss of load/turbine trip event initiated from power levels based on Table 3.7.1-1 and assuming both beginning of life and end of life reactivity feedback conditions. The results of all cases studied showed that the secondary system peak pressure was maintained below 110% of the secondary system design pressure limit.

Required Action B.2 is modified by a Note, indicating that the Power Range Neutron Flux-High reactor trip setpoint reduction is only required in MODE 1. In MODES 2 and 3 the Reactor Protection System trips specified in LCO 3.3.1, Reactor Trip System Instrumentation, provides sufficient protection.

The allowed Completion Times are reasonable based on operating experience to accomplish the Required Actions in an orderly manner without challenging unit systems.

C.1 and C.2 If the Required Actions are not completed within the associated Completion Time, or if one or more steam generators have 4 inoperable MSSVs, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.1.1 REQUIREMENTS This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint in accordance with the Inservice Testing Program.

The ASME Code (Ref. 5), requires that safety and relief valve tests be performed in accordance with ANSI/ASME OM-1-1987 (Ref. 6).

According to Reference 6, the following tests are required:

Wolf Creek - Unit 1 B 3.7.1-5 Revision 32

Attachment IVIVtotoET Attachment ET 16-00XX 17-0001 Page 28 of 30 Page 39 of 41 MSSVs B 3.7.1 BASES SURVEILLANCE SR 3.7.1.1 (continued)

REQUIREMENTS

a. Visual examination;

b. Seat tightness determination;

c. Setpoint pressure determination (lift setting); and

d. Compliance with owner's seat tightness criteria.

The ANSI/ASME Standard requires that all valves be tested every 5 years, and a minimum of 20% of the valves be tested every 24 months.

The ASME Code specifies the activities and frequencies necessary to satisfy the requirements. Table 3.7.1-2 allows a +/- 3% setpoint tolerance for OPERABILITY; however, the valves are reset to +/- 1% during the Surveillance to allow for drift. The lift settings, according to Table 3.7.1-2, correspond to ambient conditions of the valve at nominal operating temperature and pressure.

This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.

REFERENCES 1. USAR, Section 10.3.2.

2. ASME, Boiler and Pressure Vessel Code,Section III, Article NC-7000, Class 2 Components.

3. USAR, Section 15.2.

4. NRC Information Notice 94-60, Potential Overpressurization of the Main Steam System, August 22, 1994.

5. ASME Code for Operation and Maintenance of Nuclear Power Plants.

delete 6. ANSI/ASME OM-1-1987.

7. AN-94-017 Rev. 0, RETRAN-02 MSSV Analysis for ITIP 2625, M. L. Howard, May 1994.

Wolf Creek - Unit 1 B 3.7.1-6 Revision 32

Attachment AttachmentIVIVtotoETET16-00XX 17-0001 Page 29 of 30 Page 40 of 41 ARVs For the analysis of the inadvertent operation of the ECCS during power operation B 3.7.4 event in Reference 4, credit is taken for operator action to open one of the four SG ARVs to control the average of the cold leg temperatures to less than or equal to 557° BASES (the analysis conservatively models the steam dumps as not available).

F APPLICABLE In the accident analysis presented in Reference 2, the ARVs are assumed SAFETY ANALYSES to be used by the operator to cool down the unit to RHR entry conditions (continued) for accidents accompanied by a loss of offsite power. The main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the steam generator pressure below the design value.

For the recovery from a steam generator tube rupture (SGTR) event in Reference 3, the operator is required to perform a RCS cooldown using two intact steam generators to establish adequate subcooling as a necessary step to terminate the primary to secondary break flow into the ruptured steam generator. For SG overfill resulting from SGTR, RCS cooldown to RHR entry conditions using intact SG ARVs is necessary to terminate primary to secondary break flow. The time required to terminate the primary to secondary break flow for an SGTR is more critical than the time required to cool down to RHR conditions for this event and also for other accidents. Thus, the SGTR is the limiting event for the ARVs. The number of ARVs required to be OPERABLE to satisfy the SGTR accident analysis requirements is four. If a single failure of one occurs and another is associated with the ruptured SG, two ARVs would remain OPERABLE for heat removal and RCS cooldown, as discussed in Reference 3.

The ARVs are equipped with block valves in the event an ARV spuriously fails open or fails to close during use.

The ARVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Four ARV lines are required to be OPERABLE. One ARV line is required from each of four steam generators to ensure that at least two ARV lines are available to conduct a RCS cooldown following an SGTR, in which one steam generator becomes unavailable due to a SGTR, accompanied by a single, active failure of a second ARV line on an unaffected steam generator. The block valves must be OPERABLE to isolate a failed open ARV line.

Failure to meet the LCO can result in the inability to achieve subcooling, consistent with the assumptions used in the steam generator tube rupture analysis, to facilitate equalizing pressures between the Reactor Coolant System and the ruptured steam generator. Failure to meet the LCO can also impact the recovery capability following a SG overfill scenario.

An ARV is considered OPERABLE when it is capable of providing controlled relief of the main steam flow and capable of fully opening and closing on demand and not experiencing excessive seat leakage.

Excessive seat leakage, although not associated with a specific Wolf Creek - Unit 1 B 3.7.4-2 Revision 1

Attachment AttachmentIVIV to to ETET 16-00XX 17-0001 Page 30 of 30 Page 41 of 41 ARVs B 3.7.4 BASES SURVEILLANCE SR 3.7.4.2 REQUIREMENTS (continued) The function of the block valve is to isolate a failed open or leaking ARV.

Cycling the block valve both closed and open demonstrates its capability to perform this function. Performance of inservice testing or use of the block valve during unit cooldown may satisfy this requirement. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. The Frequency is acceptable from a reliability standpoint.

REFERENCES 1. USAR, Section 10.3.

2. USAR, Chapter 15.

3. USAR, Section 15.6.3.

4. USAR, Section 15.5.1.

Wolf Creek - Unit 1 B 3.7.4-5 Revision 1