ML993220023

Letter Forwarding Rev 1 to NRC-generated Proposed Change to Improved Standard Technical Specification NUREG-1431:NRC Traveler Number TSB-020 Which Was Requested for Review and Approval by Letter from Wd Beckner to Jd Davis Dated May 21, 199

ML993220023
Person / Time
Site:	Nuclear Energy Institute
Issue date:	11/01/1999
From:	Beckner W D Technical Specifications Branch
To:	Davis J W Nuclear Energy Institute
References
Download: ML993220023 (37)

Text

November 1, 1999 Mr. James Davis Nuclear Energy Institute 1776 Eye Street, N. W. Suite 300 Washington, DC 20006-2496

Dear Mr. Davis:

Enclosed is revision 1 to an NRC-generated proposed change to the Improved Standard Technical Specification NUREG-1431:

NRC traveler number TSB-020 which was requested for review and approval by letter from W.D. Beckner to J. D. Davis dated May 21, 1999. The proposed changes made by this revision more clearly document the basis for accepting the inclusion of allowable values rather than trip setpoints as the Limiting Safety System Setting (LSSS) in technical specifications.

Insert #3 in the enclosure represents the major addition from the previously proposed revision which is also added to the STS bases for the other plants in addition to the Westinghouse plants bases. We advised attendees at the joint NRC/Technical Specifications Task Force (TSTF) Owners Group meeting held October 13-14, 1999, that we intended to issue this revision.

This continues to be a High Priority request.

Please contact me at (301) 415-1161 or e-mail wdb@nrc.qov if you have any questions or need further information on these proposed changes.

Sincerely, Project No. 689

Enclosure:

As stated cc: N. Clarkson, BWOG H. Pontious, BWROG T. Weber, CEOG D. Bushbaum, WOG D. Hoffman, EXCEL V. Gilbert, NEI Original Signed By W. D. Beckner, Chief Technical Specifications Branch Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation DISTRIBUTION:

-Hard Copy "\ FILE CENTER PUBLIC RTSB Reading File DISTRIBUTION:

via E-mail RPZimmerman ECMarinos GMTracy SJCollins CSSchulten JESilber WDBeckner JACalvo BWSheron DBMatthews JRStrosnider MEMayfield SFNewberry CERossi F. Burrows RLDennig HCGarg DOCUMENT NAME: G:\RTSB\SCHULTEN\tsb-020r.wpd

• see previous concurrences OFFICE DRIP/RTSB DRIP/RTSB DRIP/RGEB NAME CSSchulten*

RLDennia*

JLBirmingham*

DATE 10/28 /99 10/28/99 .10/28/99 JRutberg MVFederline JBirmingham RTSB Staff WITS 199900021 C:DRIP/RTSB D:DRIP:NRR WDBeckner DBMatthews-4v 11/ 1 /99 10/1201/99 OFFICIAL RECORD COPYF03.ý'D ý_ RL-4c'e

'PA UNITED STATES 0 NUCLEAR REGULATORY COMMISSION "WASHINGTON, D.C. 20555-0001 November 1, 1999 Mr. James Davis Nuclear Energy Institute 1776 Eye Street, N. W. Suite 300 Washington, DC 20006-2496

Dear Mr. Davis:

Enclosed is revision 1 to an NRC-generated proposed change to the Improved Standard Technical Specification NUREG-1431:

NRC traveler number TSB-020 which was requested for review and approval by letter from W.D. Beckner to J. D. Davis dated May 21, 1999. The proposed changes made by this revision more clearly document the basis for accepting the inclusion of allowable values rather than trip setpoints as the Limiting Safety System Setting (LSSS) in technical specifications.

Insert #3 in the enclosure represents the major addition from the previously proposed revision which is also added to the STS bases for the other plants in addition to the Westinghouse plants bases. We advised attendees at the joint NRC/Technical Specifications Task Force (TSTF) Owners Group meeting held October 13-14, 1999, that we intended to issue this revision.

This continues to be a High Priority request.

Please contact me at (301) 415-1161 or e-mail wdb.nrc.qov if you have any questions or need further information on these proposed changes.

Sincerely, W. D. Beckner, Chief Technical Specifications Branch Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation Project No. 689

Enclosure:

As stated cc: N. Clarkson, BWOG H. Pontious, BWROG T. Weber, CEOG D. Bushbaum, WOG D. Hoffman, EXCEL V. Gilbert, NEI Nuclear Energy Institute cc: Mr. Ralph Beedle Senior Vice President and Chief Nuclear Officer Nuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708 Mr. Alex Marion, Director Programs Nuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708 Mr. David Modeen, Director Engineering Nuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708 Mr. Anthony Pietrangelo, Director Licensing Nuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708 Mr. Hank Sepp, Manager Regulatory and Licensing Engineering Westinghouse Electric Corporation P.O. Box 355 Pittsburgh, Pennsylvania 15230 Mr. Jim Davis, Director Operations Nuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708 Ms. Lynnette Hendricks, Director Plant Support Nuclear Energy Institute Suite 400 1776 1 Street, NW Washington, DC 20006-3708 Mr. Charles B. Brinkman, Director Washington Operations ABB-Combustion Engineering, Inc. 12300 Twinbrook Parkway, Suite 330 Rockville, Maryland 20852 Project No. 689 TSB-020, R.1 Technical Specifications Branch proposed TSTF Westinghouse Standard Technical Specifications Reactor Trip System and Engineered Safety Feature Actuation Instrumentation TSTF Change Justification Description Table 3.3.1-1, "Reactor.Trip System Instrumentation" and Table 3.3.2-1, "Engineered Safety Feature Actuation Instrumentation" are modified to replace the requirement for a "TRIP SETPOINT" with a requirement for a "NOMINAL TRIP SETPOINT." The Trip Setpoint column changes include deleting setpoint inequality signs. Additionally, a footnote is added to both the Allowable Value and Trip Setpoint columns of the tables which allows: (1) the actual trip setpoint to be set more conservative than the Nominal Trip Setpoint specified in TS in response to plant conditions, and (2) states an "as-found" trip setpoint is operable when its is outside the calibration tolerance band if the as-found value has not exceeded the associated TS Allowable Value and the channel is re-adjusted to within the established calibration tolerances.

The Bases discussion are revised to provide conforming discussion to the LCO changes and to more clearly and accurately discuss the relation between the nominal trip setpoint, the allowable value and the plant approved setpoint methodology.

Also, the Allowable Value is clarified to be the Limiting Safety System Setting required by 10 CFR 50.36. Revision 1 The proposed changes made by this revision more clearly document the basis for accepting the inclusion of allowable values rather than ýrnp setpoints as the Limiting Safety System Setting in technical specifications.

Attachment.#3 represents the major addition from the previously proposed revision which is also added to thr; STS bases for the other plants in addition to the Westinghouse plants bases.Enclosure 1 of 34 pages TSB -020, R.1 Technical Specifications Branch proposed TSTF Westinghouse Standard Technical Specifications Reactor Trip System and Engineered Safety Feature Actuation Instrumentation Reactor Trip System (RTS) Instrumentation, LCO 3.3.1 (NUREG-1431)

Insert I (I) A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the "as-left" calibration tolerance band of the Nominal Trip Setpoint.

A trip setpoint may be set more conservative than the Nominal Trip Setpoint as necessary in response to plant conditions.

Engineered Safety Feature Actuation System (ESFAS) Instrumentation, LCO 3.3.2 (NUREG-1431)

Insert 2 (k) A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the "as-left" calibration tolerance band of the Nominal Trip Setpoint.

A trip setpoint may be set more conservative than the Nominal Trip Setpoint as necessary in response to plant conditions.

B 3.3.1 Reactor Trip System (RTS) Instrumentation BASES (NUREG-1431);

B 3.3.1 Reactor Protection System (RPS) Instrumentation BASES (NUREG-1430);

B 3.3.1.1 Reactor Protection System (RPS) Instrumentation BASES(NUREG-1433, NUREG-1434);

B 3.3.1 Reactor Protective System (RPS) Instrumentation BASES (NUREG-1432)

Insert 3 Technical specifications are required by 10CFR50.36 to contain LSSS defined by the regulation as "... settings for automatic protective devices ... so chosen that automatic protective action will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytic Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded.

Any automatic protection action that occurs on reaching the Analytic Limit therefore ensures that the SL is not exceeded.

However, in practice, the actual settings for automatic protective devices must be chosen to be more conservative than the Analytic Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur. The Trip Setpoint is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytic Limit and thus ensuring that the SL would not be exceeded.

As such, the Trip Setpoint accounts for uncertainties in setting the device (e.g. calibration), uncertainties in how the device might actually perform (e.g., repeatability), changes in the point of action of the device over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g harsh accident environments).

In this manner, the Trip Setpoint plays an important role in Enclosure 2 of 34 pages TSB -020, R.1 Technical Specifications Branch proposed TSTF Westinghouse Standard Technical Specifications Reactor Trip System and Engineered Safety Feature Actuation Instrumentation ensuring that SLs are not exceeded.

As such, the Trip Setpoint meets the definition of an LSSS (Ref. 10) and could be used to meet the requirement that they be contained in the technical specifications.

Technical specifications contain values related to the operability of equipment required for safe operation of the facility.

Operable is defined in technical specifications as "... being capable of performing its safety function(s)." For automatic protective devices, the required safety function is to ensure that a SL is not exceeded and therefore the LSSS as defined by 1OCFR50.36 is the same as the operability limit for these devices. However, use of the Trip Setpoint to define operability in technical specifications and its corresponding designation as the LSSS required by 1 OCFR50.36 would be an overly restrictive requirement if it were applied as an operability limit for the "as found" value of a protective device setting during a surveillance.

This would result in technical specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the Trip Setpoint due to some drift of the setting may still be operable since drift is to be expected.

This expected drift would have been specifically accounted for in the setpoint methodology for calculating the Trip Setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as found" setting of the protective device. Therefore, the device would still be operable since it would have performed its safety function and the only corrective action required would be to reset the device to the Trip Setpoint to account for further drift during the next surveillance interval.

Use of the Trip Setpoint to define "as found" operability and its designation as the LSSS under the expected circumstances described above would result in actions required by both the rule and technical specifications that are clearly not warranted.

However, there is also some point beyond which the device would have not been able to perform its function due, for example, to greater than expected drift. This value needs to be specified in the technical specifications in order to define operability of the devices and is designated as the Allowable Value which, as stated above, is the same as the LSSS. The Allowable Value specified in Table 3.3.1-1 (Table 3.3.1.1-1 for NUREG-1433 and NUREG 1434) serves as the LSSS such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable value during the CHANNEL OPERATIONAL TEST (COT) (CHANNEL FUNCTIONAL TEST (CFT) for NUREG-1433 and NUREG-1434}.

As such, the Allowable Value differs from the Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval.

In this manner, the actual setting of the device will still meet the LSSS definition and ensure that a Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.

If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a technical specification perspective.

This requires corrective action including those actions required by 10CFR50.36 when automatic 2 Enclosure 3 of 34 pages TSB -020, R.1 Technical Specifications Branch proposed TSTF Westinghouse Standard Technical Specifications Reactor Trip System and Engineered Safety Feature Actuation Instrumentation protective devices do not function as required.

Note that, although the channel is "OPERABLE" under these circumstances, the trip setpoint should be left adjusted to a value within the established trip setpoint calibration tolerance band, in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.

[Note: Alternatively, a TS format incorporating an Allowable Value only column may be proposed by a licensee.

In this case the trip setpoint value of Table 3.3.1-1 is located in the TS Bases or in a licensee-controlled document outside the TS. Changes to the trip setpoint value would be controlled by 10CFR50.59 or administratively as appropriate, and adjusted per the setpoint methodology and applicable surveillance requirements.

At their option, the licensee may include the trip setpoint in Table 3.3.1-1 as shown, or as suggested by the licensees' setpoint methodology or license.]

B 3.3.1 Reactor Trip System (RTS) Instrumentation BASES (NUREG-1431)

Insert 4 is determined by either "as-found" calibration data evaluated during the CHANNEL CALIBRATION or by qualitative assessment of field transmitter or sensor as related to the channel behavior observed during performance of the CHANNEL CHECK. B 3.3.1 Reactor Trip System (RTS) Instrumentation BASES (NUREG-1431)

Insert 5 which incorporates all of the known uncertainties applicable to each channel. The magnitudes of these uncertainties are factored into the determination of each trip setpoint and corresponding Allowable value. The trip setpoint entered into the bistable is more conservative than that specified by the Allowable Value (LSSS) to account for measurement errors detectable by the COT. The Allowable Value serves as the Technical Specification operability limit forthe purpose of the COT. One example of such a change in measurement error is drift during the surveillance interval.

If the measured setpoint does not exceed the Allowable Value, the bistable is considered OPERABLE.

The trip setpoint is the value at which the bistable is set and is the expected value to be achieved during calibration.

The trip setpoint value ensures the LSSS and the safety analysis limits are met for surveillance interval selected when a channel is adjusted based on stated channel uncertainties.

Any bistable is considered to be properly adjusted when the "as left" setpoint value is within the band for CHANNEL CALIBRATION uncertainty allowance (i.e.,

• rack calibration

+ comparator setting uncertainties).

The trip setpoint value of Table 3.3.1-1 is therefore considered a "nominal" value (i.e., expressed as a value without inequalities) for the purposes of COT and CHANNEL CALIBRATION.

3 Enclosure 4 of 34 pages TSB -020, R.1 Technical Specifications Branch proposed TSTF Westinghouse Standard Technical Specifications Reactor Trip System and Engineered Safety Feature Actuation Instrumentation B 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES (NUREG-1431)

Insert 6 The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for ESFAS action to prevent exceeding acceptable limits such that the consequences of Design Basis Accidents (DBAs) will be acceptable.

The Allowable Value is considered a limiting value such that a channel is OPERABLE if the setpoint is found not to exceed the Allowable Value during the CHANNEL OPERATIONAL TEST (COT). Note that, although a channel is "OPERABLE" under these circumstances, the ESFAS setpoint must be left adjusted to within the established calibration tolerance band of the ESFAS setpoint in accordance with the uncertainty assumptions stated in the referenced setpoint methodology, (as-left criteria) and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.

B 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES (NUREG-1431)

Insert 7 is determined by either "as-found" calibration data evaluated during the CHANNEL CALIBRATION or by qualitative assessment of field transmitter or sensor, as related to the channel behavior observed during performance of the CHANNEL CHECK. B 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES (NUREG-1431)

Insert 8 A detailed description of the methodology used to calculate the Allowable Value and ESFAS setpoints including their explicit uncertainties, is provided in the "RTS/ESFAS Setpoint Methodology Study" (Ref. 6) which incorporates all of the known uncertainties applicable to each channel. The magnitudes of these uncertainties are factored into the determination of each ESFAS setpoint and corresponding Allowable Value. The nominal ESFAS setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for measurement errors detectable by the COT. The Allowable Value serves as the Technical Specification operability limit for the purpose of the COT. One example of such a change in measurement error is drift during the surveillance interval.

If the measured setpoint does not exceed the Allowable Value, the bistable is considered OPERABLE.

The ESFAS setpoints are the values at which the bistables are set and is the expected value to be achieved during calibration.

The ESFAS setpoint value ensures the safety analysis limits are met for the surveillance interval selected when a channel is adjusted based on stated channel uncertainties.

Any bistable is considered to be properly adjusted when the "as-left" setpoint 4 Enclosure 5 of 34 pages TSB -020, R. 1 Technical Specifications Branch proposed TSTF Westinghouse Standard Technical Specifications Reactor Trip System and Engineered Safety Feature Actuation Instrumentation value is within the band for CHANNEL CALIBRATION uncertainty allowance (i.e. calibration tolerance uncertainties).

The ESFAS setpoint value of Table 3.3.1-1 is therefore considered a "nominal value (i.e., expressed as a value without inequalities) for the purposes of the COT and CHANNEL CALIBRATION.

5 Enclosure 6 of 34 pages T-368- OZ , zQ -1 RTS Instrumentation

3.3.1 Table

3.3.1-1 (page 1 of 8) Reactor Trip System ZnstruMenttion APPLICASLE MCES at OTHER SPECIFDll REWIRED CUANNELS REQUIREMENTS UMVEILLARM C=01TION$

ALLIWASLE VALUE T*) STON~~2 1. Narut Reactor Trip 2.Power Range Neutron FLux 0. Nigh b. Low 3. Power Range Neutron Flux uRate a. Nis% Positive rate b. Nigh Negative Rate .4. intermediate Range Neutron Flux-1,2 3 (b) 6(b) s(b) 1,2 1.2 ice), 2(d) 2(e)Z 4 4 4 4 4 2 3 C St 3.3.1.14 33 3.3.1.14 3 SR 3.3.1.1 SU 3.3.1.2 SR 3.3.1.7 SR 3.3.1.11 SR 3.3.1.16 S SR 3.3.1.1 SR 3.3.1.8 SR 3.3.1.11 SR 3.3.1.16 S4 3.3.1.8 SR 3.3.1.11 NA NA MA UA 0 t111.23% V931J IRTP S 127.232 ITP I SR 3.3.1. s 16.m8% RTP SRt 3.3.1.11 wfth ties constant k M seec £ SR 3.3.1.7 S 16.31% RTP SR 3.3.1.11 with time SR 3.3.1.16 constant ,G St 3.3.1.1 S 9313% RTP 45)% ATP with time constant Asx AlTP with time Constant 13sec S z253% RTP S 93132 RTP 1253% RTP (continued) (a) Riev'ewr's Note: Unit specific Mptemontatfons mey contain only Atloable Value depending on Setpoint Study methodology us by the unit. (b) Vith Reactor Trip Breakers (iTIs) closed and Rod Control System capable of rod withdrawal. (c) Below the P-10 (Power &anoe Neutron flux) interlocks. (d) Above the P-6 (Intermediete Range Neutron flux) interlocks. (e) eow the P-6 (Intermediate ange Neutron Flux) interlocks.

.3.3-15 Rev 1, 04/07/95 Enclosure 7 of 34 pages C RINCTION C C WOG STS F RTS Instrumentation

3.3.1 Table

3.3.1-1 (pep 2 of 8) Reactor Trip System Instrumentatlon FUNCTION 5. Soure Range Neutron Flux APPLICABLE NODES OR OTHER SPECIFIED COMMITONS 2 (e)3(b) 4 (b). 5 (b) 3(f). 4(f), 5(f)6. Overtemerature AT 7. Overpower AT 1,2 1.2 REQUIRED CHANNEL$CHANNELS dOIITIONS REOUIRENINTI 2 SURVEILLANCE CMITIONS nwREOIKENT$

1.j Sa 3.3.1.1 St 3.3.1.1 SK 3.3.1.11 SM 3.3.1.16 Je1 St 3.3.1.1 SU 3.3.1.1 SL 3.3.1.11 St 3.3.1.16 S S 3.3.1.1 SR 3.3.1.11 SK 3.3.1.1 St 3.3.1.3 SM 3.3.1.6 SR 3.3.1.7 SR 3.3.1.12 SR 3.3.1.16 1 SR 3.3.1.1 SN 3.3.1.7 SR 3.3.1.12 SR 3.3.1.16 ALLOIAý VALUEN~~S 11.4 53 ES C ( .0 153 N/A Refer to Note I (Page 3.3-21) Refer to Note 2 (Pale 3.3-22)IVA Refer to Note I (Page 3.3-21) Refer to Note 2 (Page 3.3-22)(continued) (a) tevieweres Note: Unit specific ibpuVentations wmy contain only Allowable Value depeding on Setpoint Study methodology used by the unit. (b) With MTis closed and Rod Control Systm capable of rod withdrawl.

Me) Below the P-6 (Intermediate Range Neutron Flux) Interlocks. (f) 11ith-the RTIs open. In this condition, source ranee Fiunction does not provide reactor trip but does provide (irfput to the Boron Dilution Protection System (LCO 3.3.9), an3 indication.

.11 WOG STS 3.3-16 Rev 1, 04/07/95________Enclosure 8 of 34 pages.C C RTS Instrumentation

3.3.1 Table

3.3.1-I (pose 3 of 8) Reactor Trip System Irtrtmentation AUNCTrON APPLICABLE NItS OR OTHER SPECIFIE CONDITIONS S. Pressurizer Pressume a. Lmo b. Nigh 9. Pressurizer Voter L~vet -Nigh 10. Reactor Coolant Flow -Low a. Single Loop b. Two Loops its) 1.2 its)1 Ch) ¶(I)REIREUD CHANNEILS 3fTPOINTCI)ci M42 3 3 per loop 3 per loop rSVIEILLANUCE ALLUIM n SR 3.3.1.1 SR 3.3.1.7 SR 3.3.1.10 i R 3.3.1.16 nS 3.3.1.1 St 3.3.1.7 Sit 3.3.1.10 SRt 3.3.1.16 I SR 3.3.1.1 SA 3.3.1.7 SR 3.3.1.10 U SR 3.3.1.1 U 3.3.1.7 SR 3.3.1.10 Sit 3.3.1.16

• SR 3.3.1.1 Si 3.3.1.7 $1 3.3.1.10 St 3.3.1.16 (continued) ( e) oevoewerys Note: Unit specific isPlamsnmttl=

way contain only Altowabte Value depeing on Setpofnt Stud* wethodotogy used by the unit. (C) Above the P-7 (Low Power Reactor Trips Block) interlock. (h) Above the P-8 (Power Range Neutron Ftrm) interlock.

MI) Above the P-7 (Low Power Reactor Trips Stock) interlock d below the P8 (Power RangeetrM Flux) Interlock.

Pj3 t 0c:*3.3-17 Rev I, 04/07/95 Enclosure 9 of 34 pages&ii Ir+i 11 611003 S M%36 S MAN3.522 1 M8.222 ttM 1 (5.232 r , C WOG STS etzet,

-rSB-ozc R.1 RTS Instrumentation

3.3.1 Table

3.3.14 (page 4 of 8) Reactor Trip Systm lInstrumntatimn APPLICABLI NIES OR OTHER SPECIFIED CONDITIONS CMNELSI OIANNELS RESJIRENENTS SUVEILLANCE ItEUI RENENTS 11. Reactor Coolant PWp (ACP) Braker Position a. Single Loop b. Two Loops 12. Undervoltage R~fs 13. Underfrequsncy R~es 14. Stem Generator (SO) Voter Level -Low LoW 15. SG Vater Leve -Low Coincident vith Stem FIow/ Feedwater Flow Nimetch 1 Ch) '(I)Ift) 1,2 1.2 1,2 I per IMPa M2 per 132 per bum [4 per 2 per So 2 per so o R 3.3.1.1 N SR 331 NI S 3.3.1.9 SRt 3.3.1.10 Sk 3.3.1.16 N SR 3.3.1.9 SR 3.3.1.10 SR 3.3.1.16 S SR 3.3.1.1 SR 3.3.1.? SR 3.3.1.10 $ 3.3.1.16 S SR 3.3.1.1 SR 3.3.1.? SR 3.3.1.10 SR 3.3.1.16 I fiR 3.3.1.1

• SR 3.3.1+.? SR 3.3.1.10 SR 3.3.1.16 NA NA MA NA 1 1476M V ( V i 07.13z 1.57532 f It W0AS 02.331 't 00.421 02-33X S 942.532 full stem flow at RTP f low at ITP (cent itusd) (a) Reviewer#s Note: Unit specif i fiplmentationsw my contain only Allowable Value depending on Setpofnt Study methodology ued by the unit. Wg) Above the P-7 (Low Power Reactor Trips Block) interlock. (h) Above the P-8 (Power Range Neutron Flux) interlock.

()Above the P (Low Pow Reactor Trips SLock) interlock and below the P-. (Power Range Neutron Flux) Interlock.

3.3-18 Rev 1, 04/07/95 Enclosure 10 of 34 pa es C FUNCTION I C a 4 C WOG STS 2 OMWA 9ýý> ALLOW% TRIP VALUE UTPOINT(O)

CONI(DTIONS RTS Instrumentationl

3.3.1 Table

3.3.1-1 (page 5 of 8) Reactor Trip System Instrimentation APPLICABLE NODES OR OTRER SPECIFIED REWIRED CIMITIONS cUAKIELS 3MVEILLANCE C=TINSUUVIROUL REGUIREMINTS ALLM24F VALE(.)SITP0ZNRTC Oc Pi 16. Turbine Trip a. Low Fluid aIl Pressure b. Turbine Stop Valve Closure 17. Safety Injection (SI) irput from Engineered Safety Feature Actuation System CESFAS) 18. Reactor Trip System Interlocks

a. Intermediate Range Neutron flux. P.6 b. Low Power Reactor Trips Block, P-7 C. Power Range Neutron Flux, P-S d. Power Range Neutron flux, P.9 e. Power Range Neutron Mot, P-1O f. Turbine Impulse Pressure, P-13 C 1CJ) 1,2 I 1 3 4 2 tralns 2 Iper train 4 I 1,2 I P SNt 3.3.1.10 Sk 3.3.1.15 P St 3.3.1.10 SRt 3.3.1.11 a 3$ 3.3.1.j3::

pill 9psi I 1132 op"e P[C13% open VA UA R 3.3.1.11 I 16E-113 M 11-103 SM 3.3.1.13 amp 9 p T SN 3.3.1.11 St 3.3.1.13 MA NA I SNS 3.3.1.11 S 150.-232 ( 143x3 RTP SN 3.3.1.13 RTP I S4 3.3.1.11 S 0S2.23k (13032 RTP SR 3.3.1.13 NtTP$ SR 3.3.1.11 t MO.8M2 SR 3.3.1.13 RITP and S 012.233 RTP 2 T SR 3.3.1.13 $43.3.1.10 U 3.3.1.13 S V12.23% turbine power (continued) (a) Reviewer's Note: Unit specific eiplemetntations my contain only Allowable Value depsding an Setpoint Study methodology used by the unit. e) Below the P-6 (Intermediate Range Neutron flux) Interlocks. (j) Ao the. .(Power Range Neutron Flux) interlock.

M.~) :vI pow1032 Nr 3.3-19 Rev 1, 04/07/95 Enclosure 11 of 34 pages C FUCTION C.WOG STS RTS Instrumentation

3.3.1 Table

3.3.1-1 (pege 6 of 8) Reactor Trip System lmtruentation C APPLICABLE NODES .OR OTHER SPECIFID REWIIRED COOITli0$.

CNANNELS UVEILLAXCE CMIIONs REOIREMENTS ALLOLMOLE VALUE(q) SETOINT("S)(19. eactor TOIP Sreakerse~'

20. Reactor Trip Breaker Undervottae

&W Shunt Trip lediani wV 21. Automtie Trip Logic 1,2 3(b) 4 Cb) Sb) 'le 3(b) 4(b), 5 0b) 1,2 3(b) &b)), 5 0b)2 trains 2 trains Ieach per ITS per ITS 2 trains 2 trains I C 11R 3.3.1.4 U 3.3.1.4 U U 3.3.1.4 C SMt 3.3.1.4 S C St 3.3.1.5 SO 3.3.1.5 (a) evietwr's Mote: Unit specific uPtlmnntations my contain only Allowable Value dependin@

on Setpoint Study methodology used by the unit. (b) With ITST closed and Rod Control System capable of rod withdrawtl. (k) Incldfn any reactor trip bypass breakers that are racked In end closed for bypassing an iTS.-A I.WOG STS 3.3-20 Rev 1, 04/07/95 Enclosure 12 of 34 pages FLNCTION NA NA NlA IIA MA NA NA MA MA ilA I C I

o. ~7"8- O O,(R.I ESFAS Instrumentation

3.3.2 Table

3.3.2-1 (page 2 of 8) EngSneered afety Feature Actuation "ystm Instumsntation K hlEILLAICE CONDITONS ttaUIRMENTS cosn:mgs RE@UIRENEUTS ALLOWABLE TRIPN~ VALUE 5t) S!TP0INT~~(1)

1. Safety Injoction (continud)

I. 01igh Stem Flow in Two Stem Lines Coincident with Stem Line Pressure -Low 2. Containimnt Spray a. Manual Initiation

b. Autmatic Actuation Logic and Actuation helays C. Contairtmnt Pressure Nigh -3 (NHigh igh) Sfsh-3 (Two Loop Plants)4 (1.2,3(*) 2 per stem .1,23(d) 1 per atom line 1.2,3.4 2 per train, 2 trains 1,2.3.4 2 tralin 1.2,3 5 1.2,3 [32 sets of [22 SR St SR a It SR $S 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 a SR 3.3.2.8 C SR sit Sk SR I SR SR St SR SR SR SRt 3.3.2.2 3.3.2.4 3.3.2.6 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 3.3.2.1 3.3.2.5 3.3.1.9 3.3.2.10 (a)(f)IA IA INA VA S [12.313 [12.052 S [12.313 [02.05S pig psi@(cont inmed) (a) Reviewer's Note: Unit specific Implementation may contain only Allowable Value depending en Setpolnt Study. methodology used by the unit. Cc) Time constants used in the leadflag controller are t, It 502 soconds and t S [53 soconds. (d) Above the P-12 (T.,-Low Low) interlock. (e) Less than or equal to a fraction defined as AP correspondfng to [4(3% full *teo= flow below [M202 load, and AP increasing linearly from [443% full steam flow at 12032 load to [11432 full steam flow at [1003% toad. and AP corresponding to U11432 full steam flow above 100i load. (f) Less than or equalt to a function defined as AP corresponding to [t402 full tteam flow between [2 and 9M02 Ulad and then a AP increasin linearly from [IX42 stem flow at 20ol% toad to [11032 full steam fLow at [10032 toad.1 WOG STS 3.3-33 Rev 1, 04/07/95 Enclosure 13 of 34 pages FUNCTION APPLICABLE NODES t SPECIFIED

• ObOITIONS REQUIRED CHANNELS at l fa O 973Pi 7--S -02Z, Q -I ESFAS Instrumentation

3.3.2 Table

3.3.2-1 (page 3 of 8) Engineered Safety Feature Actuation System Instrumntation APPLICABLE NMo at OTHER SPECIFIED MWNITIOU RCEUIRED CHAUNNELS SURVEILLANCE CONITIONS REQUIREENTS NbMIIJAI ALLOWARLE TRIP 3. Contalneent Isolation

a. Phase A Isolation (1) Manual Initiation (2) Autoatli Actuation Logic and Actuation Relays (3) safety Injection b. Phase I Isolation (1) Manual Initiation (2) Automatic Actuation Logic and Actuation Relays (3) Contaef nt Pressure Nigh -3 (Nigh Nigh)1,2.3.4 2 1,2,3,4 2 trafns a Sa 3.3.2.8 C Sa St SR Refer to Function I (Safety Injection) functions and requirements.

1,2,3,4 2 per train, 2 trains 1.2.3,4 2 trains 1,2,3 t4]3.3.2.2 3.3.2.4 3.3.2.6 IA IA for alt initiation I SR 3.3.2.8 C SR SR SR U SR SR SR SR 3.3.2.2 3.3.2.4 3.3.2.6 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 KA NA S 912.313 6 [12.053 pelf / psi$4. Stem Line Isolation

a. Manual Initiation 1,2Mi),3ci)

b. Autoostfi Actuation Logic and Actuation ReLays 2 2 trains P SR 3.3.2.8 S SR 3.3.2.2 R 3.3.2.4 SA 3.3.2.6 (a) Reviewer's Note: Unit specific iptementations my contain methodotogy used by the unit. Mi) W KSNIVs ere closed and (de-activatedM.

Wo~s 1' 3.3-34 only Allowable Value depending on Setpoint Study-I Rev 1, 04/07/95 Enclosure 14 of 34 pages FUNCTION MA)NA IA NA NA *A (continued)

"7".5 8 -P.1 ESFAS Instrumentation

3.3.2 Table

3.3.2-1 (page 4 of 83) Engineered Safety Feature Actuation System Inetrumntation APPLICABLE MOES OR OTHER SPECIFIED CONDITIONS REQUIRED S3VEILLANCE ALL0MW3 TRIP CHANNELS CONDITIONS REQUIREMENTS VALUE .N) SETPOInTca)

(0./4. Stem Line Isolation (continued)

C. Contairment Pressure-HNIh 2 d. Stem Line Pressure (1) Low 1.20C) P()1, 3 cb)( 3Cb)Cf)(2) Negative Rate -High'I e. Nigh Steam Flow in Two Stem Lines Coincident with T.,-Low Low 3")1,2(c), 3(d)(0)t42 3 per Stem line 3 per stem line 2 per stem Line 1 per .loop S ER 3.3.2.1 S E6.612 St 3.3.2.5 psig St 3.3.2.9 Sa 3.3.2.10 SR SR Sk SR Sa S SR 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 3.3.2.1 3.3.2.5 3.3.2.9 .3.3.2.10 S SR 3.3.2.1 SU 3.3.2.5 SK 3.3.2.9 SR 3.3.2.10 D SR SR SR 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 16.353 psal a 16353" ) 6753(0) pat peal S t121.6 3ch) gli1a (h) psi/ese peil/se Me)Mf)I 1050.636F 1 155310F (continued) (a) Reviewer's Note: Unit specific isptmentatfons gay contain only Allowable Value depending en Setpoint Study methodology used by the unfit. (b) Above the P-11 (Pressurizer Pressure) interlock. (c) Time constants used in the lead/tag controller are t, I 1503 secon and ý S 1g5 secmnds.

Md) Above the P-12 CT.,-Low Low) interlock.

Me) Less than or qcual to a furntlon defined as AV corresponding to W4) full steam flow below [203X load, AP increasing linearly from 1442 full steam flow at 1203 load to 11142% full steam flow at t103% toad, and ALP orresponLing to [114% full steom flow above 100% Load. (f) Less than or equal to a functien defined as AP corresponding to [U031 full team flow between [03% and 1203K toad and then a AP Increasing linearty froam &01% stem flow Lt 120]% load to 11103% full steam flow at [1003% load. (g) Below the P-11 (Pressurizer Pressure)

Interlock. (h) TinLe constant utilized in the rate/lag controller is S 1503 secnds. C0) ExCept When all sIVs are closed and Ede-activstedl.

co~(.WOG STS 3.3-35 Rev 1, 04/07/95---......

---

-..................-..

.. E -nc losure 15 of 34 pages FUnCTIOW 7'8- O2-0) R.1 E$FAS Instrumentation

3.3.2 Table

3.3.2-1 (page 5 of 8) Engineered Safety Feature Actuation sot=m InttrMntatfon SUUVEILLANCE C:ONITIONS REQUIREtEN(ITS CHANNELS cONDITIONS REOUIRENEHTS VALUEA) SETPOIT(l)a(*-)

4. Stem Line Isolation (contirwed)

f. Nigh Stem Flow in Two Stem Lines Coincident with Stem Line Pressure -Low I. Nigh Stem Flow 1.2,Ci)# 3(I) 1.2.0I) 3(f) 1.2(1). 3(i)2 per stem line 1per stem line 2 per stem line* SR Sit SIR

• Sit SR SK SR SA SiR SiR 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 3.3.2.1 3.3.2.5 3.3.2,9 3.3.2.10 ft)(f)i Wsil p67s3iC) Pais polll S r252X of full stem flow at no load stem pressure il-"full stem flow at no load stem pressure Coincident with Safety Injection and Coincident with T.,-Low Low h. Nigh High Stem Flow Coincident with Safety Injection Refer to Function I (Safety functions and raqirment.

1,2(f). 3 (d)CI) 3(1)9 per loop 2 per stem line Injection) for all initiation

• Sit SR SRt St

• SR Sit SA Sit 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.i0 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 I [550.6*F t5533*F S 1303% of full stem flow at full load stem pressure utitstem flow at full Load stem pressure Refer to Function I (Safety Injection) for all initiation funmctions and requirments.(continued) (a) RevfeVer's Note: Unit specific iqNluentat1ms my contain only Allowable Value dcepe ins an Setpelnt Study methodology used by the wdt. (dy Above the P-t2 CT, -Low Low) interlock.

C-) -A n Oll -SIVs are closed and Ide-activatea.

)3.3-36 Rev 1, 04/07/95 Enclosure 16 of 34 pages FUICTION APPLICABLE "waES a OTtER SPECIFIED coITIONS REQUIRED J.WOG STS 7 OzO, PJ WSFAS Instrumentation

3.3.2 Table

3.3.2-1 (page 6 of 83) Engineered safety Feature Actuation System Instrimmntation REQUIRE SURVEILLANCE CHANNELS CONDITIONS REQUIREMENTS ALLOVIAULE MOMrH PrL.. TRIP S;ETPDllKr(a)X)-

S. Turbine Trip ad reed"ater Isolation

a. Automatic Actuation Logic and Actuation Relays b. so water Level -Nigh High (P-14) 9. Safety Injection

6. Auxiliary Feedater a. Automtic Actuation Logic and, Actuation Relays (Solid State Protection System) b. Autoatic Actuation Logic and Actuation Relays (salance of Plant ESFAS)I-"s 2 trains 1.2(J) 1,20j) gJI(j)013 per So 10 St 3.3.2.2 U 3.3.2.4 R 3.3.2.6 3 M) SR SA sU sit Refer to Function I (Safety Injection) for functions and requirements.

1.2,3 2 trains 1.2,3 2 trains S SRt SRt SR 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 NA IA S £34.2fl (32.422 ill initiation 3.3.2.2 3.3.2.4 3.3.2.6 S ;R 3.3.2.3 NA NA NA*A c. So Water Level -Low Low 1.2.3 03 per So S SR SR SR SR 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 S0.411 932.21%(continued) (a) Reviewer's Note: Unit specific iqmlementations my contain only Allowable Valu depending on Setpofnt Study methodology Loed by the unit. Q() Except wen all NFIVs, NFRVs, land associated bypass valves] are closed e (de-activateW for isolated by a closed meul valve).f WOG STS 3.3-37 Rev 1, 04/07/95 Enclosure 17 of 34 pages IUNCTION APPLICABLE NES OR OTHER SPEC]IIED CONDITIONS S4Pd" ESFAS Instrumentation

3.3.2 Table

3.3.2-1 (page 7 of 8) Engineered Safety Feature Actuation Systm Instrummntation REQUIRE URVEILLANCE CHANNELS CONDITIONS REGUIREKENTS ALLOWABLE TRIP

6. AutIfolry Feedmater (continued)

d. Safety Injection

e. Loss of Offsite Power f. Wihdervotrage Reactor Coolant g. Trip of all main Feedoter Puqp h; Aux Liry Feedwater Pump Sut ion Trarafer on Suct Ian Pressure -Low 7. Automatic Swftchover to Containmnt Sump a. Automatic Actuation Logic and Actuation ReLays b. Refueling Water Storage Tank CRWST) Level -Low Low Coincident with Safety Injection Refer to Furnction I (Safety Injection) for all Initiation functions amd requireaents.

1.213 533 per bus 1.2 133 per but 1.2 123 per PuW 1,2.3 M23 1.2.3,4 2 trains 1,2,3.4 F SR 3.3.2.7 N 3.3.2.9 SR 3.3.2.10 I sR sk J SR 3.3.2.7 3.3.2.9 3.3.2.10 3.3.2.8 3.3.2.9 3.3.2.10 F SR 3.3.2.1 SR 3.3.2.7 R 3.3.2.9 C SR St SR K SRt SRt SR Sit 3.3.2.2 3.3.2.4 3.3.2.6 3.3.2.1 3.3.2.5 3.3.2.9 3.3.2.10 I Z29123 v with S 0.8 sec time datoy S1693 bus kmr?03% bu voltage voltage St 3 Palo r3 Paig 6$970, 8 sec tim delay a 20.53) W1 Ipsia) -rpsio)NA*A I 015% and (r[) nd S 912 S 13 Refer to Function I (Safety Injection) for all Initiation functions and raquiromnts.(continued) (a) Revlewer~s Note: Unit specific ptaementationr my contain onLy Allowable Value depending an Setpoint Study methodology used by the unmit.WOG STS 3.3-38 9 Rev 1, 04/07/95 Enclosure 18 of 34 pages FUNCTION APPLICABLE OTHRK SPECFIED CONDITIONS

-4

!APPLICABLE OTHERNNOM1AJ..

SPECIFIED 21UNIR WAVEILLANCE ALLOWMLE [RIP FUNCTION ONDITIONS CHANNELS CODITIONS

&EWIREMNES VALUE(s) U T 7. Automatif Switchovor to Conitwuent Sumt (continued)

• . RUST Level--Low 1..3.4 4S r R 3.3.2.1 1 115]1 118Ix Low SR 3.3.2.5 SA 3.3.2.9 SR 3.3.2.10 Coincident with Refer to Function I (Safety Injection) for all initiatimn Safety Injection furctions and requirements.

and Coincident with 1,2.3,4 4 K St 3.3.2.1 i 1300 in. rfn. Contairment Sup SR 3.3.2.5 above above Level-High SR 3.3.2.9 at. r[32 ft *i. 9 ]ft 84 3.3.2.10 8. ESFAS Interlocks

a. Reactor Trip, P-4 1.2.3 1 per F SR 3.3.2.11 NA MA train, 2 trains b. Pressurizer 1.2.3 3 L SR 3.3.2.1 S [19962 % psg Pre~ssure P-11 SR 3.3.2.5 psloP SA 3.3.2.9 c. T,.-Low Low, P-12 1.2.3 112 per L SR 3.3.2.1 1 3550.638F J1532UF loop SR 3.3.2.5 Sa 3.3.2.9 Rviewerts Note: Unit specific fmplementations miy contain only Allowsbtl Value depending on Setpoint Study methodology used by the unit.WOG STS 3.3-39 Rev 1, 04/07/95 Enclosure 19 of 34 pages T, 6- o02 0 ESFAS Instrumentation

3.3.2 Table

3.3.2-1 (page 8 of 8) Engineered Safety Feature Actuation System lnstrnmentatimn I Ca) (

RTS Instrumentation B 3.3.1 ( B 3.3 INSTRUMENTATION B 3.3.1 Reactor Trip System (RTS) Instrumentation BASES BACKGROUND The RTS initiates a unit shutdown, based on the values of selected unittparameters, to protect against violating the "core fuel design limits and Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (AOOs) and to assist the Engineered Safety Features (ESF) Systems in mitigating accidents.

The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of'parameters directly monitored by the RTS, as well as specifying LCOs on other reactor system parameters and equipment performance.

he defined in this specification as the [Tr-ip t'3etpo=n;], in conjunction with the LCOs, establish the SJ-threshold for protective system action to prevent exceedin ( acceptable limits during Desttn Basis Accidents iDBAs). n During AOOs, which are those events expected to occur one or more times during the unit life, the acceptable limits are: 1. The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling (DNB); 2. Fuel centerline melt shall not occur; and 3. The RCS pressure SL of 2750 psia shall not be exceeded.

Operation within the SLs of Specification 2.0, 'Safety timits (SLs)," also maintains the above values and assures that offsite dose will be within the 10.CFR 50 and I0 CFR 100 criteria during AQOs. Accidents are events that are analyzed even though they are not expected to occur durin the unit life. The acceptable limit during accidents is tat offsite dose shall be maintained within anacceptable fraction of 10 CFR 100 limits. Different accident categories are allowed a (continued)

WOG STS B 3.3-1 Rev 1, 04/07/95 Enclosure 20 of 34 pages "7rS6 -Ozo ', I RTS Instrumentatio'n B 3.3.1 BASES BACKGROUND different fraction of these limits, based on probability of (continued) occurrence.

Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event. The RTS instrumentation is segmented into four distinct but interconnected modules as illustrated in Figure[ ], FSAR, Chapter [7] (Ref. 1), and as identified below: 1..Field transmitters or process sensors: provide a measurable electronic signal based upon the physical characteristics of the parameter being measured;

2. Signal Process Control and Protection System, including Analog Protection System, Nuclear Instrumentation System (HIS), field contacts, and protection channel sets: provides signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board/control room/miscellaneous indications;

3. Solid State Protection System (SSPS), including input, logic, and output bays: initiates proper unit shutdown and/or ESF actuation in accordance with the defined loglic, which is based on the bistable outputs *from the signal process control and protection system; and 4. Reactor trip switchgear, including reactor trip breakers (RTBs) and bypass breakers:

provides the means to interrupt power to the control rod drive mechanisms (CRD~s) and allows the rod cluster control assemblies (RCCAs), orrods," to fall into the core and shut down the reactor. The bypass breakers allow testing of the RTBs at power. Field Transmitters or Sensors To meet the design demands for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters.

To account for the calibration tolerances and instrument drift, which are assumed to occur between caljbrations, statistical allowances are provided in the.lritp/etpoint and Allowable x (continued)

WOG STS B 3.3-2 Rev 1, 04/07/95--

RTS Instrumentation B 3.3.1 BASES BACKGROUND Field Transmitters or Sensors (continued)

Signal Process Control and Protection System Generally, three orfour channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments.

The process Control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses.

These setpoints are defined in FSAR, Chapter [73 (Ref. 1), Chapter [6] (Ref. 2), and Chapter [15] (Ref. 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the SSPS for decision eva uation. Channel separation is maintained up to and through the input bays. However, not all unit parameters ( require four channels of sensor measurement and signal processing.

Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.

Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic .are sufficient-toprovide the required reliability and redundancy.

If one channel fails n a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails, such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic. Generally, if a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy.

The circuit must'be able to withstand both an input fa iure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.

Again, a single failure will neither cause nor (continued)

WOG STS B 3.3-3 Rev 1, 04/07/95 Enclosure 22 of 34 pages RTS Instrumentation/

B 3.3.1 BASES BACKGROUND Signal Process Control and Protection System (continued) prevent the protection function actuation.

These requirements are described in IEEE-279-1971 (Ref. 4). The actual number of channels required for each unit parameter is specified in Reference

1. Two logic channels are required to ensure no single random failure of a logic channel will disable the RTS. The logic channels are designed such that testing required while the reactor Is at power may be accomplished without causing trip. Provisionsto allow removing logic channels from service during maintenance are unnecessary because of the logic system's designed reliability.

he rip netpo n-s are the nominal values at which the bistables are set. Any bistable is considered to be properly adjusted when the *as left" value Is within thee "band for CHANNEL CALIBRATION accuracy (i.e., +/- rack calibration

+ comparator setting accuracy).

Y -TheY/rip detpoints used in the bistables are based on the analytipal limits stated in Reference

1. The selection of x is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those RTS channels that must function o bars environments as defined by 10 CFR 50.49 (Ref. 5), ~and Allowable Vaues specified in Table 3.3.1-1 inthaccornpanying LCO are conservative T9.a4 3eiwith respect to the analytical limits. A d s iton of the methodology used to calculate thes, ript X $etpoints, including their explicit uncertainties, is ridd in the PRTS/ESFAS Set oint Methodology Study* Ref. 6 The actua/Fo-mlnal Irip betpoint entered into the SAllowable Value to account for changes in random measurementt S* ~errors detectable by9 C-OT:. One example of such a hnet Smeasurement error is+drift during the surveillance interval.

If the measured setpotnt does. not~excee~d the Allowable Value, the bistable ts considered OPERABLE. (continued)

WOG STS B 3.3-4 Rev 1, 04/07/95 Enclosure 23 of 34 pages I X:5 b-CUZUJ RTS Instrumentation B 3.3.1 BASES BACKGROUND 4Trft Set ooint s _owble V;Luev(_cont in,-led ir -4etpoints I ththe A "sure that SLs are not violated during AOs (and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the Onset of the AOO or DBA and the equipment functions as designed).

Nlote-that in the' accompanying LCO 3.3.1, the Trip Setpoints Table 3.3.-Z are the LSSS., Each channel of the process control equipment can be tested on line to verify that the signal or setpoint accuraty is within the specified allowance requirements of Reference

2. Once a designated channel is taken out of service for testing a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated.

SRs for the channels are specified in the SRs section.

Table$3.3.1-

' are based on, the methodology described in\ hReference "6,ý.which incorporates a11 of the known. o f t hes e u n e t nt s CID eat r d t t thei d teitto n processing equipment for these channels are assumed magnitudes.

Solid State Protection System The SSPS equipment is used for the decision logtc processing of outputs from the sfgnal processng equipment bistables.

To meet the redundancy re uirements, two trains of SSPS, each performing the samelduncttons, are provided.

gf one train is taken out of service for maintenance or test purposes, thesecond traen will provide reactor trip and/or ESF actuation for the unit. If both tdaes are taken out of service oriplaced tn test, ' reactor trip will result. Each train ts packaged In its owncabinet for physical and electrical separation to satisfy separation and independence requirements.

The systemhas been desgned to trp t he event of ahloss of power, directing the unit toa safe shutdown condition.(continued)

Rev 1, 04/07/95 Enc-icsure-24- -e-f pages I r WOG STS B 3.3-5 I ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND The ESFAS initiates necessary safety systems, based on the values of selected unit parameters, to protect against violating core design limits and the Reactor Coolant System (RCS)*pressure boundary, and to mitigate accidents.

The ESFAS instrumentation is segmented into three distinct but interconnected modules as identified below: -e. Field transmitters or process sensors and instrumentation:

provide a. measurable electronic signal based on the physical characteristics of the parameter being measured;

• Signal processing equipment including analog protection system, field contacts, and protection Schannel sets: provide signal conditioning, bistable setpoint comparison,'

process algorithm actuation, ( compatible electrical.signal output to protection system devices, and control board/control room/ miscellaneous indications; and

• Solid State Protection System (SSPS) including input, logic, and output bays:. initiates the proper unit shutdown or engineered safety feature (ESF) actuation in accordance with the defined logic and based on the bistable outputs from the signal process control and protection system. Field Transmitters or Sensors To meet the design demands for redundancy and reliability, more than one, and often as. many as four, field transmitters or sensors are used to measure unit parameters.

In many cases, field transmitters'or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS). In some cases, the same channels also provide control system inputs. "To account for calibration tolerances and instrument drift, which are assumed to occur between calibrations, statistical allowances are provided'in the Trip Setpoint and Allowable

_ .(continued)

WOG STS B 3.3-61 Rev 1, 04/07/95 Encloure.

225 of. 34 pages T S8- ozo e, 2.) ESFAS Instrumentation B 3.3.2 BASES BACKGROUND Field Transmitters or Sensors (continued)

Values. The OPERABILITY of each transmitter or sensor OF A s -a Sbe evaluated when its was found" calibration data are cmared against its documented acceotanee criteria, / Sional Processing Eguigment Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments.

The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses.

These setpoints are defined in FSAR, Chapter [6] (Ref. 1), Chapter [7] (Ref. 2), and Chapter (15] (Ref. 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an out put from a bistable ts forwarded to the SSPS for decision evaluation.

Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing.

Some unit parameters'provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.

Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficlent to provide the required reliability and redundancyq If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of two logic. Generally, if a parameter is used for input to the SSPS and .a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy.

The circuit must be able to withstand both an input failure to the control system, which may then require theprotection function actuation, and a single failure in the other channels providing the protection function (continued)

WOG STS B 3.3-62 Rev 1, 04/07/95 Enclosure 26 of 34 pages "7TS8- OZ.. ESFAS Instrumentati6n B 3.3.2 BASES BACKGROUND Signal Processing EouiDment (continued) actuation.

Again, a single failure will neither cause nor prevent the protection function actuation.

These requirements are described in IEEE-279-1971 (Ref. 4). The actual number of channels required for. each unit parameter is specified in Reference

2. "The Trip Setpoints are'the nominal values at whi cte bistables are set. Any bistable Is considered to be properly adjusted when the 'as left* value is within the 2band for CHANNEL CALIBRATION accuracy.

The Trip Setpoints used in the bistables are based on the analytical limits stated in Reference

2. The selection of these Trip Setpoints is such that adequate protection is provided when all'sensor and processing time delays are taken into account. To allow forcallbration tolerances, ( instrumentation-uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must functtnfn harsh environments as defined by)10 CFR 50.49 (Ref. 5), the l r e o tsan Allowable Values specified itn Table3.3.2-ln te accompanying LCO are conservativ " dusweth respect to te ana ytical limits eta ed descripion o the methodology used to calculate the Trip Setpoints, including their explicit uncertainties, is pr.vided in the 'RTS(ESFAS Setpoint Methodology Study* (Ref. 6). The actua nominal Trip Setpoint entered into the is more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a COT. One example of such a change in measurement error is drift during the surveillance interval.

If the measured setpoint does not exceed the Allowable Value, the bistable is considered OPERARIF Sep ints rextA Ce Of k 4 *ýc Sep,--=A L .with theTAllowable Value ensure that the consequences of'Design Basis Accidents (DBAs) will be acceptable, providing the unit Is operated from within the LCOs at the onset of the DBA and the equipment functions as designed. (continued)

WOG STS B 3.3-63 Rev 1, 04/07/95 Enclosure 27 of 34 pages 7-3"56 0,R. ESFAS Instrumentation B 3.

3.2 BACKGROUND

an (continued)

Each channel can be tested on line to verify that the signal processing equipment and setpoint accuracy is within the specified allowance requirements of Reference

2. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field Instrument signal. The process equipment for the channel in test is then tested verified, and calibrated.

SRs for the channels are specified in the SR section.

Reference 6, whichninthe oownc .aes lof the e unc ant uncertainties applicableThe magnitudes.

Sof these-uncertainties atfcoeInoi dernt ios (of'each.Trip Setpioint.

All.fied snsos....sgna

[pro -cessihg equipment for thes hnesaeassumed to [operate within the altowancs fthese uncertainty-""j magnitudes.T Solid State Protection System The SSPS equipment Is used for the decision logic processing of outputs from the signal processing equipment bistables.

To meet the redundancy requirements, two trains of SSPS, each performing thesame functions, are provided.

If one train is taken out of service for maintenance or test purposes, the second train will provide ESF actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result. Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements.

The SSPS performs the decision logic for most ESF equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit. The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various (continued)

B 3.3-64 Rev 1, 04/07/95 Enclosure 28 of 34 pages BASES:1))WOG STS (

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS 5 ..2.11 (continued)

Trip Interlock, and the Frequency is once per RTB cycle. This Frequency is based on operating experience demonstrating that undetected failure of the P-4 interlock sometimes occurs when the RTB is cycled.The SR is modified by a Note setpoints during the TADOT. associated setpoint.REFERENCES that excludes verification of The Function tested has no I. FSAR, Chapter [6]. 2. FSAR, Chapter [7]. 3. FSAR, Chapter [i1]. 4. IEEE-279-1971.

5. 10 CFR 50.49. 6. RT*WWAS-Setpoint Methodology Study. 7. NUREG-1218, April 1988. 8. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.9. Technical Requirements Manual, Times." Section 15, "Response Rev 1, 04/07/95 Enclosure 29 of 34 pages WOG STS B 3.3-120-a RPS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protection System (RPS) Instrumentation BASES BACKGROUND The RPS initiates a reactor trip to protect against violating the core fuel design limits and the Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (AOOs). By tripping the reactor, the RPS also assists the Engineered Safety Feature (ESF) Systems fn mitigating accidents.

The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as the LCOs on other reactor system parameters and equipment performance.

L he LSSS, defined in this Specification as the Allowable alue, in conjunction with the LCOs, establishes the hreshold for protective system action to prevent exceeding ) tmits'during Desian Rasis Arcidnt DBAs During AOOs, which are those events expected to occur one or more times during the unit's life, the acceptable limit is: a. The departure from nucleate boiling ratio (DNBR) shall be maintained above the Safety Limit (SL) value; b. Fuel centerline melt shall not occur; and c. The RCS pressure SL of 2750 psia shall not be exceeded.

Maintaining the parameters within the above values ensures that the offsite dose will be within the 10 CFR 20 and 10 CFR 100 criteria during AO0s. Accidents are events that are analyzed even though they are not expected to occur during the unit's life. The acceptable limit during accidents is that the offsite dose shall be maintained within 10 CFR 100 limits. Meeting the acceptable'dose limit for an accident category is considered having acceptable consequences for that event. (continued)

BWOG STS 8 3.3-1 Rev 1, 04/07/95 Enclosure 30 of 34 pages RPS Instrumentation B 3.3.1.1 B 3.3 INSTRUMENTATION B 3.3.1.1 Reactor Protection System (RPS) Instrumentation BASES BACKGROUND The RPS initiates a reactor scram when one or more monitored parameters exceed their specified limits, to preserve the integrity of the fuel cladding and the Reactor Coolant System (RCS) and minimize the energy that must be absorbed following a loss of coolant accident (LOCA). This can be accomplished either automatically or manually.

The protection and monitoring functions of the RPS have been designed tO ensure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system larameters and equipment performance.

Fe LSSS are defined in this [ppecification as the Allowable Values, which, in conjunction T3 with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs) during Design Basis Accidents (DBAs). 1 The RPS, as shown in the FSAR, Figure [ ] (Ref. 1), includes sensors, relays, bypass circuits, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters.

The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level, reactor vessel pressure, neutron flux, main steam line isolation valve position, turbine control valve (TCV) fast closure, trip oil pressure, turbine stop valve (TSV) position, drywell pressure, and scram discharge volume (SDV) water level, as well as reactor mode switch in shutdown position and manual scram signals. There are at least four redundant sensor input signals from each of these parameters (with the exception of the reactor mode switch in shutdown scram signal). Most channels include electronic equipment (e.g., trip'units) that compares measured input signals with pre-established setpoints.

When the setpoint is exceeded, the channel output relay actuates, which then outputs an RPS trip signal to the trip logic. Table B 3.3.1.1-1 summarizes the diversity of sensors capable of initiating scrams during anticipated operating transients typically analyzed. (continued)

BWR/4 STS B 3.3-1 Rev 1, 04/07/95 Enclosure 31 of 34 pages RPS Instrumentation B 3.3.1.1 B 3.3 INSTRUMENTATION B 3.3.1.1 Reactor Protection System (RPS) Instrumentation BASES BACKGROUND The RPS initiates a reactor scram when one or more monitored parameters exceed their specified limit, to preserve the integrity of the fuel cladding and the Reactor Coolant System (RCS), and minimize the energy that must be absorbed following a loss of coolant accident (LOCA). This can be accomplished either automatically or manually.

The protection and monitoring functions of the RPS have been designed to ensure safe operation of the reactor. This is achieved by'specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor st arameters and equipment performa /e.The LSSS are defined in this- -- pecification as the Allowable Values, which, in conjunction "ith the LCOs, establish the threshold for protective system ction to prevent exceeding acceptable limits, includsing iafety Limits (SLs), during Design Rasi; Ar.i4dnt)

The RPS, as shown in the FSAR, Figure [ ] (Ref. 1), includes sensors, relays, bypass circuits, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters.

The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level; reactor vessel pressure; neutron flux main steam line isolation valve position;lturbine control valve (TCV) fast closure, trip oil pressure low;.turbine stop valve (TSV) trip oil pressure, low; drywell pressure and scram discharge volume (SDV) water level; as well as reactor mode switch in shutdown position and manual scram signals. There are at least four redundant sensor input signals from each of these parameters (with the exception of the reactor mode switch in shutdown scram signal). Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints.

When a setpoint is exceeded, the channel output relay actuates, which then outputs an RPS trip signal to the trip logic. Table B 3.3.1.1-1 summarizes the diversity of sensors capable of initiating scrams during anticipated operating transients typically analyzed. (continued)

BWR/6 STS B 3.3-1 Rev 1, 04/07/95 Enclosure 32 of 34 pages RPS Instrumentation-Operating (Digital)

B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protective System (RPS) Instrumentation-Operating (Digital)

BASES BACKGROUND The RPS initiates a reactor trip to protect against violating the core specified acceptable fuel design limits and breaching the reactor coolant pressure boundary (RCPB) during anticipated operational occurrences (AOOs). By tripping'thereactor, the RPS also assists the Engineered Safety Features (ESF) systems in mitigating accidents.

The protection and monitoring systems have been designed to ensure safe operationof the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters and equipment performance.

The LSSS, defined in this Specification as the Allowable Value, inconJunction with the LCOs, establish the thresholdd for protective system action to prevent exceeding acceptable) limits during Design Basis Accidents (DBAs). During AOOs, which are those events expected to occur one or more times during the plant life, the acceptable limits are: The departure from nucleate boiling ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling (DNB);

• Fuel centerline melting shall not occur; and

• The Reactor Coolant System (RCS) pressure SL of 2750 psia shall not be exceeded.

Maintaining the parameters within the above values ensures that the offsite-dose will be within the 10 CFR 50 (Ref. 1) and 10 CFR 100 (Ref. 2) criteria during AOOs. Accidents are events that are analyzed even though they are not expected to occur during the plant life. The acceptable limit during accidents Is that the offsite dose shall be maintained within-an acceptable fraction of 10 CFR 100 (Ref. 2) limits. Different accident categories allow a different fraction of these limits based on probability of (continued)

CEOG STS B 3.3-1 Rev 1, 04/07/95 Enclosure 33 of 34 pages-7Y6 -(%ý o/ );?elj. I

"-rS3- 0 Z0, R, /RPS Instrumentation-Operating (Analog) B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protective System (RPS) Instrumentation-Operating (Analog) BASES BACKGROUND The RPS initiates a reactor trip to protect against violating the core specified acceptable fuel design limits and breaching the reactor coolant pressure boundary during anticipated operational occurrences (AOOs). By tripping the reactor, the RPS also assists the Engineered Safety Features systems in mitigating accidents.

The protection and monitoring systems have been designed to ensure safe operatfon of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in'terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters and equipment performance.

The LSSS, defined in this Specification as the Allowable Value, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs). During AOOs, which are those events expected to occur one or more times during the plant life, the acceptable limits are: The departure from nucleate boiling ratio be maintained above the Safety Limit (SL) prevent departure from nucleate boiling;(DNBR) shall value to* Fuel centerline melting shall not occur; and

• The Reactor Coolant System (RCS) pressure SL of 2750 psla shall not be exceeded.

Maintaining the parameters within the above values ensures that the offslte dose will be within the 10 CFR 50 (Ref. 1) and 10 CFR 100 (Ref. 2) criteria during AOOs. Accidents are events that are analyzed even though they are not expected to occur during the plant life. The acceptable limit during accidents is that the offslte dose shall be maintained within an acceptable fraction of 10 CFR 100 (Ref. 2) limits. Different accident categories allow a different fraction of these limits based on probability of (continued)

B 3.3-1 Rev 1, 04/07/95 Enclosure 34 of 34 pages'3/4(CEOG STS/