ML072681096

Surry, Units 1 & 2, Proposed Technical Specifications Change Revised Setting Limits and Overtemperature T/Overpower at T Time Constants.

ML072681096
Person / Time
Site:	Surry
Issue date:	09/19/2007
From:	Bischof G T Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
07-0470 EE-0116, Rev. 3
Download: ML072681096 (196)

Text

VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 September 19, 2007 U.S. Nuclear Regulatory Commission Serial No. 07-0470 Attention:

Document Control Desk SPS-LIC/CGL RO Washington, D.C. 20555 Docket Nos. 50-280 50-281 License Nos. DPR-32 DPR-37 VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNITS I AND 2 PROPOSED TECHNICAL SPECIFICATIONS CHANGE REVISED SETTING LIMITS AND OVERTEMPERATURE AT/OVERPOWER AT TIME CONSTANTS Pursuant to 10 CFR 50.90, Virginia Electric and Power Company (Dominion) requests amendments, in the form of changes to the Technical Specifications (TS) to Facility Operating License Numbers DPR-32 and DPR-37 for Surry Power Station Units 1 and 2, respectively.

The proposed change revises various TS setting limits and the overtemperature AT/overpower AT time constants in TS 2.3 and TS 3.7. The methodology for determining the revised setting limits and time constants is in agreement with Methods 1 and 2 in ISA-RP67.04, Part I1. Associated TS Basis revisions are included for the NRC's information.

A discussion of the proposed TS change is provided in Attachment

1. The marked-up and proposed TS pages reflecting the proposed change are provided in Attachments 2 and 3, respectively.

Attachment 4 presents the technical basis for the Surry revised setting limits and time constants.

We have evaluated the proposed TS change and have determined that it does not involve a significant hazards consideration as defined in 10 CFR 50.92, and the basis for that determination is included in Attachment

1. We have also determined that operation with the proposed change will not result in any significant increase in the amount of effluents that may be released offsite and no significant increase in individual or cumulative occupational radiation exposure.

Therefore, the proposed amendment is eligible for categorical exclusion as set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed change. The basis for our determination that the change does not involve any significant increase in effluents or radiation exposure is also included in Attachment

1. The proposed changes have been reviewed and approved by the Station Nuclear Safety and Operating Committee.

Serial No. 07-0470 Docket Nos. 50-280, 50-281 Page 2 of 3 Approval of this proposed TS change is requested by September 30, 2008. Dominion requests a 60-day implementation period following NRC approval of the requested license amendments.

If you have any questions or require additional information, please contact Mr. Gary D. Miller at (804) 273-2771.Very truly yours, Gerald T. Bischof Vice President

-Nuclear Engineering Attachments:

1. Discussion of Change 2. Marked-up Technical Specifications Pages 3. Proposed Technical Specifications Pages 4. Technical Report EE-0116, Revision 3 with Addendum 1 (North Anna results not included.)

Commitments made in this letter: None.COMMONWEALTH OF VIRGINIA ))COUNTY OF HENRICO )The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Gerald T. Bischof, who is Vice President

-Nuclear Engineering, of Virginia Electric and Power Company. He has affirmed before me that he is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of his knowledge and belief.Acknowledged before me the .7NL- day of +/-&;, , 2007.My Commission Expires: ,,/V 3/ , Notary Public c=m L MUM I B Serial No. 07-0470 Docket Nos. 50-280, 50-281 Page 3 of 3 cc: U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW Suite 23 T85 Atlanta, Georgia 30303 NRC Senior Resident Inspector Surry Power Station State Health Commissioner Virginia Department of Health James Madison Building -7 th Floor 109 Governor Street Room 730 Richmond, Virginia 23219 Mr. S. P. Lingam NRC Project Manager -Surry U. S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Mail Stop 8G9A Rockville, Maryland 20852 Mr. R. A. Jervey NRC Project Manager -North Anna U. S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Mail Stop 8G9A Rockville, Maryland 20852 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 Discussion of Change Revised Setting Limits and Overtemperature AT / Overpower AT Time Constants Surry Power Station Units I and 2 Virginia Electric and Power Company (Dominion)

Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 DISCUSSION OF CHANGE

1.0 INTRODUCTION

Pursuant to 10 CFR 50.90, Virginia Electric and Power Company (Dominion) requests revisions to the Technical Specifications (TS) for Surry Power Station Units 1 and 2.The proposed change revises: the Limiting Safety System Setting (LSSS) for the Reactor High Pressure Trip in TS 2.2 Basis; the LSSS for the Source Range High Flux, High Pressurizer Pressure, Low Pressurizer Pressure, Reactor Coolant Flow Low, High Pressurizer Water Level, Low-Low Steam Generator Water Level, Low Steam Generator Water Level, P-7 (Unblock), P-8, and P-10 functions in TS 2.3; the time constants for the Overtemperature AT and Overpower AT Reactor Trips in TS 2.3; the LSSS for the Source Range High Flux, High Pressurizer Water Level, P-7, and P-8 functions in TS 2.3 Basis; the LSSS for P-7 and Pressurizer Pressure (P-11) in TS 3.1;the Setting Limit for P-7, P-10, Pressurizer Pressure (P-11), Tavg (P-12), High & High Containment Pressure, Pressurizer Low-Low Pressure, High Differential Pressure Between Steam Line and Steam Line Header, Low Steam Line Pressure, Steam Generator Water Level Low-Low, Low Intake Canal Level, RWST Level Low (Unit 1), RWST Level Low-Low (Unit 2) and Steam Generator Water Level High-High in TS 3.7;new Setting Limits for High and High-High Containment Pressure and corrects typos in TS 3.7 Basis; and the Setting Limit for Low Intake Canal Level in TS 4.1. Reactor Trip functions with Safety Analysis Limits have been denoted in Table 3.7-1. Likewise, Engineered Safety Feature functions with Safety Analysis Limits have been denoted in Tables 3.7-2, 3.7-3, and 3.7-4. The TS Basis revisions are included for the NRC's information.

The proposed change has been reviewed, and it has been determined that the change has no adverse safety impact and that no significant hazards consideration exists as defined in 10 CFR 50.92. In addition, it has been determined that the change qualifies for categorical exclusion from an environmental assessment as set forth in 10 CFR 51.22(c)(9);

therefore, no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed change.2.0 BACKGROUND Limitinq Safety System Settings: Historically, for plants that have used Westinghouse Standardized Technical Specifications (STS), two values have been provided for each Reactor Trip System (RTS) and Engineered Safety Feature Actuation System (ESFAS) trip function.

They are referred to as the "Nominal Trip Setpoint" and the "Allowable Value" (in reference to Surry Power Station, the Allowable Value, Limiting Safety System Setting "LSSS" and the Setting Limit are the same). The difference in percent of span between the Nominal Page 1 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 Trip Setpoint and the Allowable Value was calculated, in most cases, based on a summation of the errors associated with the rack components and rack drift.For linear, non-complex trip functions, this value normally worked out to be between 1.0 % and 2.0 % of span. For complex trip functions or functions that had limited margin with respect to the Safety Analysis Limit, other calculational methods were used to determine the difference between the Nominal Trip Setpoint and the Allowable Value.For plants that do not use the Westinghouse STS version of TS, such as Surry, normally only one setpoint value (assumed to be the Limiting Safety System Setting or Setting Limit at Surry) is provided in the text with no guidance as to how to set the actual "Nominal" Trip Setpoint in the plant.Based on the early versions of the Westinghouse STS, the original definition of the LSSS (i.e., the Allowable Value) was stated as follows: "A setting chosen to prevent exceeding a Safety Analysis Limit." This Allowable Value was intended to be used during monthly or quarterly Functional Testing as a "flag" such that if a bistable (comparator)

Trip Setpoint exceeded this value, the protection channel would be declared inoperable and plant staff would be required to initiate corrective action. The intended significance of this value is that it is the point where if the value is exceeded, the implication is that the actual rack electronics and/or associated rack error components have exceeded the values assumed in the Channel Statistical Allowance (CSA) Calculation and consequently, the margin with respect to the Safety Analysis Limit has been reduced.Some plants, such as North Anna Power Station, have adopted Improved Technical Specifications (ITS). Within the North Anna ITS and ITS Bases, Allowable Values are explicitly defined and are uniquely associated with each Reactor Trip System (RTS) and Engineered Safety Feature Actuation System (ESFAS) function, to include Backup Trips and Permissives.

Surry Power Station has not adopted ITS at this time. For plants licensed before 1974, prior to the introduction of Standardized Technical Specifications (STS), the setpoints (i.e., TS Limits) included in their custom TS (CTS) for RTS and ESFAS instrumentation were based on the plant specific setpoint study and/or based on settings provided in the Westinghouse Precautions, Limitations and Setpoints (PLS) document.

The RTS and ESFAS trip setpoints specified in CTS did not include allowances for instrument uncertainties associated with channel functional testing (i.e., the Channel Operational Test (COT)). These allowances were left to the licensee to address and justify, as is the case for Surry. In many cases, the original CTS setpoints for RTS and ESFAS instrumentation have been determined to be unacceptable based on today's standards and setpoint methodologies.

To address this discrepancy, Surveillance Limits were issued for Surry Power Station in 1995. These Surveillance Limits were incorporated into the applicable surveillance procedures and they are used in conjunction with the original CTS setpoints to ensure that RTS and ESFAS functions will operate in Page 2 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 accordance with the Dominion Setpoint Methodology and the applicable CSA calculation assumptions.

The objective of the proposed license amendment request is to change selected current Technical Specifications' RTS and ESFAS Setting Limits to values that are consistent with the Dominion Setpoint Methodology detailed in Attachment 4 (Technical Report EE-0116 (Ref. 10.1)).10 CFR 50.36(c)(1)(ii)(A) states that the Limiting Safety System Setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded.

At Surry Power Station the Allowable Value (AV) serves as the Limiting Safety System Setting (LSSS) such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value during the Channel Functional Test (i.e., the COT). As such, the Allowable Value differs from the Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval.

In this manner, the actual setting of the device will still meet the LSSS definition and ensure that a Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.

If the actual setting of the device is found to have exceeded the Allowable Value, the device would be considered inoperable from a TS perspective.

This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.2.1 The Dominion Methodology On August 13, 2003, NRC Staff met with members of the ISA-67.04 committee and other industry groups in Rockville, Maryland to discuss instrument setpoint methodology and present their position.

The major area of discussion centered around the instrument setpoint methodology in Standard ISA-$67.04 and Recommended Practice ISA-RP67.04, which is used by many licensees for determining protection system instrumentation setpoints.

Part II of the standard, not endorsed by the NRC Staff, includes the three methods for calculating the Allowable Values used in TS, which represent the Limiting Safety System Settings (LSSS). As stated by the NRC, Methods 1 and 2 determine Allowable Values that are sufficiently conservative and are acceptable to the NRC Staff. According to the NRC, Method 3 does not appear to provide an acceptable degree of conservatism and is of concern to the NRC Staff.On October 8, 2003, Dominion attended a meeting with the NRC and the Nuclear Energy Institute (NEI) in Rockville, Maryland to discuss NRC concerns associated with the Allowable Values. The Allowable Values of interest are those associated with Reactor Protection System (RPS) and ESFAS functions that are credited in the Plant Specific Safety Analysis.

The NRC expressed a basic concern that they have identified a number of plants that used a method to calculate Allowable Values for RPS and ESFAS functions that will reduce or eliminate margin to the Analytical Limit (AL), i.e., the Safety Analysis Limit (SAL). In the worst case scenario, the margin may be negative such that the protection function is operating outside of the analyzed region.Page 3 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 Dominion agrees with the NRC position and their concerns with Method 3. Technical Report EE-01 16 was revised to bring Surry's methodology for determining Allowable Values into agreement with Methods 1 and 2 in ISA-RP67.04, Part II (Ref. 10.9). In addition, it is Dominion's position that the Analytical Limit will be protected if: 1. The distance between the Actual Trip Setpoint and the Analytical Limit is equal to or greater than the Total Loop Uncertainty for that channel and 2. The distance between the Actual Allowable Value and the Analytical Limit is equal to or greater than the non-COT error components of the Total Loop Uncertainty and 3. The distance between the Actual Trip Setpoint and the Actual Allowable Value is equal to the COT error components of the Total Loop Uncertainty without any excessive margin included.ISA-S67.04, Part II (Ref. 10.8) describes three methods for calculating the Allowable Value. The following base line parameters will be used to illustrate how the Allowable Value is calculated using the Dominion Methodology:

Analytical Limit (AL) = 6.00 PSIG Total Instrument Loop Uncertainty (TLU) = 1.39 PSIG Calculated Instrument Uncertainties used for COT (COT) = 1.10 PSIG Calculated Instrument Uncertainties not used for COT (non-COT)

= 0.85 PSIG Notes: 1. COT is the Channel Operational Test.2. COT Instrument Uncertainties are made up of the portion of the loop that is tested during the COT. For Surry these error components are: Rack Calibration Accuracy (RCA or M1, M2 ... Mn)Rack Comparator Setting Accuracy (RCSA or Mn)Rack Drift (RD)3. Non-COT Instrument Uncertainties are made up of the portion of the loop that is not tested during the COT. For Surry these error components may include: Systematic Error (SE)Environmental Allowance (EA)Process Measurement Accuracy (PMA)Primary Element Accuracy (PEA)Sensor Calibration Accuracy and Sensor Measuring

& Test Equipment (SCA +SMTE)Sensor Drift (SD)Sensor Pressure Effect(s) (SPE)Page 4 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 Sensor Temperature Effect (STE)Sensor Power Supply Effect (SPSE)Rack Measuring and Test Equipment (RMTE or M1MTE, M2MTE ... MnMTE)Rack Temperature Effect (RTE)4. At Dominion the Total Loop Uncertainty (TLU) is referred to as the Channel Statistical Allowance (CSA), the Limiting Trip Setpoint (LTS) is referred to as the Calculated Setpoint (CAL SP), the Analytical Limit (AL) is referred to as the Safety Analysis Limit (SAL), the Nominal Setpoint (NSP) is referred to as the Actual Setpoint (ACT SP), and The Limiting Safety System Setting (LSSS) is also referred to as the Allowable Value (AV).Both the Trip Setpoint and the AV must be properly established in order to adequately protect the Analytical Limit.TYPICAL SURRY POWER STATION METHOD FOR MOST FUNCTIONS:

TLU = 1.39 NON COT = 0.85 COT = 0.54 CSA COT= 1.10 AL = 6.00 PSIG CAL AV = 5.15 PSIG CAL SP = 4.61 PSIG ACT AV < 4.61 PSIG ACT SP = 3.51 PSIG LEGEND: TLU = TOTAL LOOP UNCERTAINTY AL = ANALYTICAL LIMIT (SAL) CAL AV = CALCULATED ALLOWABLE VALUE ACT AV = ACTUAL ALLOWABLE VALUE NON COT = NON TESTED LOOP UNCERTAINTY COT = TESTED LOOP UNCERTAINTY CAL SP = CALCULATED SETPOINT ACT SP = ACTUAL SETPOINT For most RPS and ESFAS functions, Dominion's methodology is more conservative than either Method 1 or 2. The interval between the Trip Setpoint and the AV is maintained as described in Methods 1 and 2. For some functions a small amount of additional margin is included between the Trip Setpoint and the AV, however, additional margin is also included between the AV and AL. In fact, for most functions at Surry Power Station, the AV is a full Total Loop Uncertainty value away from the AL. This Page 5 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 eliminates the concerns associated with Method 3 and provides additional assurance that the integrity of the AL is maintained.

Overtemperature AT Time Constants:

Based on the results of Technical Report EE-0116, the LSSS for the time constants (i.e., 'ri and O2) associated with the Overtemperature AT (OTAT) Reactor Trip as specified in TS Item 2.3.A.2(d) will be revised to account for the actual values installed in the plant and for dynamic instrumentation tolerances.

The revised LSSS values for these time constants are provided in Technical Report EE-0116. The revised LSSS values given in Technical Report EE-0116 do not affect the actual time constants installed in the plant for the OTAT Reactor Trip Function.Overpower AT Time Constant: Based on the results of Technical Report EE-0116, the LSSS for the time constant (i.e., -3) associated with the Overpower AT (OPAT) Reactor Trip as specified in TS Item 2.3.A.2(e) will be revised to account for the actual value installed in the plant and for dynamic instrumentation tolerances.

The existing time constant for the Overpower AT Reactor Trip does not take into consideration the +/- 10 % time constant tolerance given by the manufacturer and the instrument calibration procedures.

The time constant is being changed to account for the tolerance.

The revised LSSS values given in Technical Report EE-0116 will not affect the actual time constant installed in the plant for the OPAT Reactor Trip Function.

This is a backup reactor trip and is not credited in the Surry UFSAR Chapter 14 Safety Analysis.Permissives P-7 and P-1 0, Block/Unblock Reactor Trips at Low Power: Permissives P-7 and P-10 are not specifically modeled in the Safety Analysis but are assumed to be available.

The current Setting Limits are based on the original Westinghouse Precautions, Limitations and Setpoints (PLS) document and do not account for the instrument accuracy.

The P-7 and P-10 Setting Limits are being changed to account for the uncertainties associated with functional testing, i.e., the COT.3.0 LICENSING BASIS TS Amendments that have revised setpoint setting limits include:* 176/175, dated April 21, 1993 -increased the limit for the intermediate range high flux reactor trip setpoint.0 203/203, dated August 3, 1995 -revised RPS/ESFAS setpoints associated with the core uprate from 2441 MWt to 2546 MWt.* 206/206, dated December 28, 1995 -included a new setpoint for steam generator high-high level and more restrictive setting limits for certain RPS/ESFAS setpoints.

Page 6 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1* 224/224, dated March 21, 2001 -revised setting limits for degraded voltage/loss of voltage (undervoltage) setpoints.

• 250/249, dated October 12, 2006 -established the setting limit for the RWST low level coincident with high-high containment pressure associated with changes related to GS1-1 91 and Generic Letter 2004-02.4.0 PROPOSED CHANGE 4.1 Description of Proposed Change The proposed change revises TS 2.3 to reflect new LSSS. TS 3.1, TS 3.7, and TS 4.1 are being revised to reflect new Setting Limits. The Limiting Safety System Setting and Setting Limit are also referred to as the AV at Dominion.

The changes increase the margin from the LSSS or Setting Limit to the AL and thus, ultimately, the Safety Limit.Therefore, the known concerns with Method 3 of ISA-$67.04, Part II, have been addressed in the proposed change.The proposed change also revises TS 2.2 Basis, TS 2.3 Basis and TS 3.7 Basis to reflect the new LSSS and Setting Limits. Associated Basis changes are necessary for consistency with the TS revisions.

The TS Basis revisions are detailed in Section 4.2 and are included in this transmittal for the NRC's information.

The proposed change will provide new AVs for the following functions:

0 Source Range Neutron Flux High Reactor Trip Present Allowable Value: _ 106 counts/sec New Allowable Value: _ 1.51 x 105 counts/sec

• Pressurizer Low Pressure Reactor Trip Present Allowable Value: _ 1860 psig New Allowable Value: _ 1875 psig* Pressurizer High Pressure Reactor Trip Present Allowable Value: < 2385 psig New Allowable Value: < 2380 psig 0 Reactor Coolant Flow Low Reactor Trip Present Allowable Value: _ 90% of normal indicated flow New Allowable Value: _ 91% of normal indicated flow 0 Pressurizer High Level Reactor Trip Present Allowable Value: < 92% of span New Allowable Value: < 89.12% of span* Steam Generator Water Level Low-Low Reactor Trip/SI Page 7 of 35 Ij Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 Present Allowable Value: _ 14.5% of narrow range instrument span New Allowable Value: _ 16.0% of narrow range instrument span* Steam Generator Water Level Low Coincident Reactor Trip Present Allowable Value: > 15% of narrow range instrument span New Allowable Value: > 19% of narrow range instrument span* Permissive P-7, Unblock High Power Reactor Trips Present Allowable Value: _> 10% of rated power New Allowable Value: prior to or when power increases to 11% of rated power* Permissive P-1 0, Unblock Low Power Reactor Trips Present Allowable Value: < 10% of rated power New Allowable Value: prior to or when power decreases to 7% of rated power Permissive P-8, Power Range Neutron Flux Present Allowable Value: > 50% of rated power New Allowable Value: prior to or when the power range nuclear flux increases to 37% of rated power Source Range High Flux Present Allowable Value: <5 x 10-11 amperes New Allowable Value: prior to or when the intermediate range nuclear flux decreases to 5 x 10-11 amperes Containment Pressure -High Present Allowable Value: < 19 psia New Allowable Value: < 18.5 psia Containment Pressure -High-High Present Allowable Value: < 25 psia New Allowable Value: 24 psia Pressurizer Pressure -Low-Low Present Allowable Value: > 1,760 psig New Allowable Value: > 1,770 psig High Differential Pressure Between Steam Line and Steam Line Header Present Allowable Value: < 150 psig New Allowable Value: < 135 psid Steam Line Pressure -Low Present Allowable Value: > 500 psig New Allowable Value: _ 510 psig Page 8 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 Low Intake Canal Level Present Allowable Value: 23 feet-6 inches New Allowable Value: 23 feet-5.85 inches Steam Generator Water Level -High-High Present Allowable Value: < 80% of narrow range New Allowable Value: < 76% of narrow range* Refueling Water Storage Tank Level -Low (Unit 1)Initiation of Recirculation:

Present Allowable Value: _ 11.25%New Allowable Value: 12.7%Mode Transfer System: Present Allowable Value: < 15.75%New Allowable Value: < 14.3%* Refueling Water Storage Tank Level -Low Low (Unit 2)Initiation of Recirculation:

Present Allowable Value: > 11.25%New Allowable Value: _ 12.7%Mode Transfer System: Present Allowable Value: _ 15.75%New Allowable Value: 14.3%* Pressurizer Pressure, P-I 1 Present Allowable Value: < 2000 psig New Allowable Value: < 2010 psig* TAVG, P-12 Present Allowable Value: < 543' F New Allowable Value: < 5450 F In TS 2.3 the change will provide new -ri and "C 2 time constants for the Overtemperature AT Reactor Trip and a new C3 time constant for the Overpower AT Reactor Trip. These changes to the time constants are to account for the time constant tolerance provided by the manufacturer and the actual values installed in the plant as specified in the instrument calibration procedures.

• j Present Allowable Value: = 25 seconds New Allowable Value: > 29.7 seconds Page 9 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 T2 Present Allowable Value: = 3 seconds New Allowable Value: 4.4 seconds* T3 Present Allowable Value: = 10 seconds New Allowable Value: > 9.0 seconds In TS 2.3 a note is added to the Overtemperature AT and Overpower AT specifications to indicate the channel's maximum Trip Setpoint and the difference between "% of AT span" and "% of AT power".In Table 3.7-1 the following Functional Units are noted with an asterisk (*) as having an SAL associated with their Reactor Trip function.

The associated note is added to the bottom of each page in Table 3.7-1.* Nuclear Flux Power Range" Nuclear Flux Intermediate Range* Nuclear Flux Source Range* Overtemperature AT* Low Pressurizer Pressure" Hi Pressurizer Pressure" Pressurizer

-Hi Water Level* Low Flow Reactor Coolant* Lo-Lo Steam Generator Water Level* Power range neutron flux, P-8 In Table 3.7-2 the following Functional Units are identified with an asterisk (*) as having an SAL associated with their Engineered Safeguards Action function.

The associated note is added to the bottom of each page in Table 3.7-2." High containment pressure" High differential pressure between any steam line and the steam header* Pressurizer low-low pressure* High steam flow in 2/3 steam lines coincident with low Tavg or low steam line pressure* Steam line flow* Tavg" Steam line pressure" High containment pressure (Hi-Hi)* Steam generator water level low-low" Low intake canal level* RWST Level -Low (Unit 1)Page 10 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 Note: This function will become RWST Level Low-Low when TS Amendment 250 is implemented during the Unit 1 2007 refueling outage." RWST Level -Low-Low (Unit 2)" RWST Level -Low Coincident with High High Containment Pressure (Unit 2)In Table 3.7-3 the following Functional Units are identified with an asterisk (*) as having a SAL associated with their Engineered Safeguards Action function.

The associated note is added to the bottom of each page in Table 3.7-3.* High containment pressure* High containment pressure (Hi-Hi setpoint)" High steam flow in 2/3 lines coincident with 2/3 low Tavg or 2/3 low steam pressures* High containment pressure (Hi-Hi setpoint)" Steam generator water-level high-high In Table 3.7-4 the following Functional Units are identified with an asterisk (*) as having an SAL associated with their Engineered Safeguards Action function.

The associated note is added to the bottom of each page in Table 3.7-4." High Containment Pressure (High Containment Pressure Signal)* High-High Containment Pressure (High-High Containment Pressure Signals)* Pressurizer Low-Low Pressure* High Differential Pressure Between Steam Line and the Steam Line Header* High Steam Flow in 2/3 Steam Lines Coincident with Low Tavg or Low Steam Line Pressure* Steam Generator Water Level Low-Low* Low Intake Canal Level" RWST Level-Low* RWST Level-Low-Low" Steam Generator Water Level High-High" RWST Level Low (coincident with High High Containment Pressure)Setpoint changes will be required to implement this TS change. The setpoint changes will be performed using the Dominion Design Change Process.4.2 Specific Revisions The following specific TS revisions are proposed to address the known concerns with Method 3 of ISA-$67.04, Part II and to account for actual plant settings and instrument accuracy associated with the time constants used for the Overtemperature and Overpower AT functions.

The following TS Basis revisions are necessary for consistency with the TS revisions and are included in this transmittal for the NRC's information.

Page 11 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 The italicized note at the end of each change (bullet) provides reference to the specific section in Technical Report EE-01 16 where the new values were derived. The note itself is not to be included as part of the changes to the TS.* A portion of the Basis for TS 2.2 currently states: The nominal settings of the power-operated relief valves at 2335 psig, the reactor high pressure trip at 2385 psig and the safety valves at 2485 psig are established to assure never reaching the Reactor Coolant System pressure safety limit.The above portion of the Basis for TS 2.2 is revised as follows: The nominal settings of the power-operated relief valves at 2335 psig, the reactor high pressure trip at 2380 psig and the safety valves at 2485 psig are established to assure never reaching the Reactor Coolant System pressure safety limit.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.8 for technical basis.* TS 2.3.A.1.(c) currently states: (c) High flux, source range (high set point) -Neutron flux 106 counts/sec.

TS 2.3.A.1.(c) is revised as follows: (c) High flux, source range (high set point) -Neutron flux 1.51 x 105 counts/sec.

Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.4 for technical basis.* TS 2.3.A.2.(b) currently states: (b) High pressurizer pressure -< 2385 psig.TS 2.3.A.2.(b) is revised as follows: (b) High pressurizer pressure -< 2380 psig.Note: See Technical Report EE-0 116 (Attachment

4) Section 4.3.8 for technical basis.* TS 2.3.A.2.(c) currently states: (c) Low pressurizer pressure ->_ 1860 psig.TS 2.3.A.2.(c) is revised as follows: (c) Low pressurizer pressure -> 1875 psig.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.7 for technical basis.Page 12 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1* A portion of TS 2.3.A.2.(d) currently states:-q = 25 seconds T2 = 3 seconds The above portion of TS 2.3.A.2.(d) is revised as follows: , ! 29.7 seconds T2 < 4.4 seconds The channel's maximum Trip Setpoint shall not exceed its computed Trip Setpoint by more than 2.0% of the AT span. (Note that 2.0% of the AT span is equal to 3.0% AT Power.)Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.5 for technical basis.* A portion of TS 2.3.A.2.(e) currently states: T3 = 10 seconds The above portion of TS 2.3.A.2.(e) is revised as follows: T3 > 9.0 seconds The channel's maximum Trip Setpoint shall not exceed its computed Trip Setpoint by more than 2.0% of the AT span. (Note that 2.0% of the AT span is equal to 3.0% AT Power.)Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.6 for technical basis.* TS 2.3.A.2.(f) currently states: (f) Low reactor coolant loop flow = > 90% of normal indicated loop flow as measured at elbow taps in each loop TS 2.3.A.2.(f) is revised as follows: (f) Low reactor coolant loop flow -> 91% of normal indicated loop flow as measured at elbow taps is each loop Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.9 for technical basis.* TS 2.3.A.3.(a) currently states: (a) High pressurizer water level -< 92% of span Page 13 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 TS 2.3.A.3.(a) is revised as follows: (a) High pressurizer water level -< 89.12% of span Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.12 for technical basis.* TS 2.3.A.3.(b) currently states: (b) Low-low steam generator water level -__ 14.5% of narrow range instrument span TS 2.3.A.3.(b) is revised as follows: (b) Low-low steam generator water level -> 16% of narrow range instrument span Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.13 for technical basis.* TS 2.3.A.3.(c) currently states: (c) Low steam generator water level -_> 15% of narrow range instrument span in coincidence with steam/feedwater mismatch flow -< 1.0 x 106 lbs/hr TS 2.3.A.3.(c) is revised as follows: (c) Low steam generator water level -> 19% of narrow range instrument span in coincidence with steam/feedwater mismatch flow -_< 1.0 x 106 lbs/hr Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.14 for technical basis.* TS 2.3.B.1 currently states: 1. The reactor trip on low pressurizer pressure, high pressurizer level, turbine trip, and low reactor coolant flow for two or more loops shall be unblocked when power > 10% of rated power.TS 2.3.B.1 is revised as follows: 1. The reactor trip on low pressurizer pressure, high pressurizer level, turbine trip, and low reactor coolant flow for two or more loops shall be unblocked prior to or when power increases to 11 % of rated power.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.18 for technical basis.Page 14 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 TS 2.3.B.2 currently states: 2. The single loop loss of flow reactor trip shall be unblocked when the power range nuclear flux _> 50% of rated power.TS 2.3.B.2 is revised as follows: 2. The single loop loss of flow reactor trip shall be unblocked prior to or when the power range nuclear flux increases to 37% of rated power.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.19 for technical basis.* TS 2.3.B.3 currently states: 3. The power range high flux, low setpoint trip and the intermediate range high flux, high setpoint trip shall be unblocked when power _< 10% of rated power.TS 2.3.B.3 is revised as follows: 3. The power range high flux, low setpoint trip and the intermediate range high flux, high setpoint trip shall be unblocked prior to or when power decreases to 7% of rated power.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.20 for technical basis.* TS 2.3.B.4 currently states: 4. The source range high flux, high setpoint trip shall be unblocked when the intermediate range nuclear flux is < 5 x 10-11 amperes..TS 2.3.B.4 is revised as follows: 4. The source range high flux, high setpoint trip shall be unblocked prior to or when the intermediate range nuclear flux decreases to 5 x 10-11 amperes.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.17 for technical basis.* A portion of the Basis for TS 2.3 currently states: The Source Range channels will initiate a reactor trip at about 106 counts per second unless manually blocked when P-6 becomes active.The above portion of the Basis for TS 2.3 is revised as follows: Page 15 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 The Source Range channels will initiate a reactor trip at about 1.51 x 10 5 counts per second unless manually blocked when P-6 becomes active.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.4 for technical basis." In TS 2.3 Basis insert the following:, Refer to Technical Report EE-0116 for justification of the dynamic limits (time constants) for the Overtemperature AT and Overpower AT Reactor Trip functions." A portion of the Basis for TS 2.3 currently states: Approximately 1154 ft 3 of water corresponds to 92% of span.The above portion of the Basis for TS 2.3 is revised as follows: Approximately 1125 ft 3 of water corresponds to 89.12% of span.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.12 for technical basis.* A portion of the Basis for TS 2.3 currently states: Above 10% power, an automatic reactor trip will occur if two or more reactor coolant pumps are lost.The above portion of the Basis for TS 2.3 is revised as follows: Above 11% power, an automatic reactor trip will occur if two or more reactor coolant pumps are lost.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.18 for technical basis.* A portion of the Basis for TS 2.3 currently states: Above 50%, an automatic reactor trip will occur if any pump is lost or de-energized.

The above portion of the Basis for TS 2.3 is revised as follows: Above 37%, an automatic reactor trip will occur if any pump is lost or de-energized.

Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.19 for technical basis.* A portion of the Basis for TS 2.3 currently states: Upon turbine trip, at greater than 10% power, the reactor is tripped to reduce the severity of the ensuing transient.

Page 16 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 The above portion of the Basis for TS 2.3 is revised as follows: Upon turbine trip, at greater than 11 % power, the reactor is tripped to reduce the severity of the ensuing transient.

Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.18 for technical basis.* In TS 2.3 Basis insert the following as Insert "A": Permissive P-7 is made up of input signals from Turbine First Stage Pressure and NIS Power Range. Signals to the P-7 and P-10 permissives are supplied from the same bistables in the NIS Power Range drawers. P-7 and P-10 will both enable and block functions from the "trip" and "reset" points of these bistables.

The calibration procedures for the NIS Power Range bistables set the nominal trip setpoints associated with the two permissives such that they will trip whenever the measured reactor power level reaches 10 % power (increasing).

The P-7 input from Turbine First Stage Pressure is set to trip at 10 % Turbine Load (increasing).

When two out of four of the NIS Power Range channels trip or if one of the two Turbine First Stage Pressure channels trip the following occurs: " Permissive P-7 allows reactor trip on the following:

low flow, reactor coolant pump breakers open in more than one loop, undervoltage (RCP busses), underfrequency (RCP) busses, turbine trip, pressurizer low pressure, and pressurizer high level." Permissive P-10 allows manual block of intermediate range reactor trip, allows manual block of power range (low setpoint) reactor trip, allows manual block of intermediate range rod stop (P-I), and automatically blocks source range reactor trip (P-6) and provides an input to P-7.The "trip" and "reset" of a bistable cannot be the same point. It is physically not possible.

There must be a deadband between. the "trip" and "reset" points. The calibration procedures for the NIS Power Range bistables set the nominal reset points for the two permissives such that they reset whenever the measured reactor power level reaches 8% power (decreasing).

The P-7 input from Turbine First Stage Pressure is set to reset at 8.8 % Turbine Load (decreasing).

When three out of four of the NIS Power Range channels reset or if two out of the two Turbine First Stage Pressure channels reset the following occurs:* Permissive P-7 blocks reactor trip on the following:

low flow, reactor coolant pump breakers open in more than one loop, undervoltage, underfrequency, turbine trip, pressurizer low pressure, and pressurizer high level.When three out of four of the NIS Power Range channels reset the following occurs: Page 17 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 Permissive P-10 defeats automatically the manual block of intermediate range reactor trip, defeats automatically the manual block of power range (low setpoint)reactor trip, and defeats automatically the manual block of intermediate range rod stop (P1).There are no specific Safety Analysis Limits associated with Permissives P-7 and P-10. However, they are "Assumed Available" by Nuclear Analysis and Fuel. Since P-7 and P-10 are permissives for functions with Safety Analysis Limits, for conservatism, they will be treated as if they had a Limiting Safety System Setting. In order to account for instrumentation errors, 1% of reactor power is added to the P-7 and P-10 safety functions.

This results in a Limiting Safety System Setting for the P-7 enable interlock of 11% of reactor power. The Limiting Safety System Setting for the P-1 0 (defeat block) interlock is 7% of reactor power.The methodology for determining the Limiting Safety System Settings (LSSS) found in TS 2.3 was developed in Technical Report EE-01 16. The Limiting Safety System Setting must be chosen so that automatic protective action will correct an abnormal situation before the safety limit is exceeded.

At Surry Power Station the Allowable Value (AV) serves as the Limiting Safety System Setting such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value during the Channel Functional Test (which is also referred to as the Channel Operational Test or COT). As such, the Allowable Value differs from the Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval.

In this manner, the actual setting of the device will still meet the LSSS definition and ensure that the Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.

If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a Technical Specification perspective.

This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.Technical Report EE-01 16 verifies that Surry's methodology for determining Allowable Values is in agreement with the intent of ISA Standard S67.04, Methods 1 and 2. In addition, it is Dominion's position that the Analytical Limit will be protected if: 1. the distance between the Trip Setpoint and the Analytical Limit is equal to or greater than the Total Loop Uncertainty for that channel and 2. the distance between the Allowable Value and the Analytical Limit is equal to or greater than the non-COT error components of the Total Loop Uncertainty and 3. the distance between the Trip Setpoint and the Allowable Value is equal to the COT error components of the Total Loop Uncertainty without any excessive margin included.Page 18 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 Both the Trip Setpoint and the Allowable Value must be properly established in order to adequately protect the Analytical Limit.The References in TS 2.3 are revised from FSAR to UFSAR.TS 3.1.A.1.b currently states: b. If an unscheduled loss of one or more reactor coolant pumps occurs while operating below 10% RATED POWER (P-7) and results in less than two pumps in service, the affected plant shall be shutdown and the reactor made subcritical by inserting all control banks into the core. The shutdown rods may remain withdrawn.

TS 3.1 .A.l.b is revised as follows: b. If an unscheduled loss of one or more reactor coolant pumps occurs while operating below 11% RATED POWER (P-7) and results in less than two pumps in service, the affected plant shall be shutdown and the reactor made subcritical by inserting all control banks into the core. The shutdown rods may remain withdrawn.

Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.18 for technical basis.* The note in TS 3.1.A.6 currently states:* Automatic actuation capability may be blocked when Reactor Coolant System pressure is below 2000 psig.The above note in TS 3.1.A.6 is revised as follows:* Automatic actuation capability may be blocked when Reactor Coolant System pressure is below 2010 psig.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.14 for technical basis.* A portion of the Basis for TS 3.7 currently states: The engineered safeguards instrumentation has been designed to sense these effects of the loss-of-coolant accident by detecting low pressurizer pressure to generator signals actuating the SIS active phase.The above portion of the Basis for TS 3.7 is revised as follows to correct a typographical error: Page 19 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 The engineered safeguards instrumentation has been designed to sense these effects of the loss-of-coolant accident by detecting low pressurizer pressure to generate signals actuating the SIS active phase.* A portion of the Basis for TS 3.7 currently states: This actuation signal acts as a backup to the low pressurizer pressure actuation of the SIS and also adds diversity to protection against loss of coolant.The above portion of the Basis for TS 3.7 is revised as follows to correct a typographical error: This actuation signal acts as a backup to the low pressurizer pressure actuation of the SIS and also adds diversity to protect against loss of coolant." A portion of the Basis for TS 3.7 under Setting Limits currently states: The high containment pressure limit is set at about 10% of design containment pressure.The above portion of the Basis for TS 3.7 is revised as follows: The high containment pressure limit is set at about 8% of design containment pressure.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.2 for technical basis.* A portion of the Basis for TS 3.7 under Setting Limits currently states: The high-high containment pressure limit is set at about 23% of design containment pressure.The above portion of the Basis for TS 3.7 is revised as follows: The high-high containment pressure limit is set at about 21% of design containment pressure.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.3 for technical basis.* In TS 3.7 Basis insert the following as Insert "B": The methodology for determining the Setting Limits (SL) found in TS 3.7 was developed in Technical Report EE-01 16. The Setting Limits must be chosen so that automatic protective action will correct an abnormal situation before the Safety Limit is exceeded.

At Surry Power Station the Allowable Value (AV) serves as the Setting Limit such that a channel is OPERABLE if the trip setpoint is found not to exceed Page 20 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 the Allowable Value during the Channel Functional Test (which is also referred to as the Channel Operational Test or COT). As such, the Allowable Value differs from the Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval.

In this manner, the actual setting of the device will still meet the Setting Limit definition and ensure that the Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.

If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a Technical Specification perspective.

This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.Technical Report EE-01 16 verifies that Surry's methodology for determining Allowable Values is in agreement with the intent of ISA Standard S67.04, Methods 1 and 2. In addition, it is Dominion's position that the Analytical Limit will be protected if: 1. the distance between the Trip Setpoint and the Analytical Limit is equal to or greater than the Total Loop Uncertainty for that channel and 2. the distance between the Allowable Value and the Analytical Limit is equal to or greater than the non-COT error components of the Total Loop Uncertainty and 3. the distance between the Trip Setpoint and the Allowable Value is equal to the COT error components of the Total Loop Uncertainty without any excessive margin included.Both the Trip Setpoint and the Allowable Value must be properly established in order to adequately protect the Analytical Limit.This note is to be inserted into the bottom of each page in Table 3.7-1: There is a Safety Analysis Limit associated with this Reactor Trip function.

If during calibration the setpoint is found to be conservative with respect to the Limiting Safety System Setting but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59. -This note applies to the following Table 3.7-1 Functional Unit items, which are revised to include an asterisk: 2. Nuclear Flux Power Range*3. Nuclear Flux Intermediate Range*4. Nuclear Flux Source Range*5. Overtemperature AT*Page 21 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 7. Low Pressurizer Pressure*8. Hi Pressurizer Pressure*9. Pressurizer

-Hi Water Level*10. Low Flow*12. Lo-Lo Steam Generator Water Level*20.c. Power range neutron flux, P-8** Table 3.7-1, ACTION 3.b currently states: b. Above the P-6 (Block of Source Range Reactor Trip) setpoint, but below 10% of RATED POWER, decrease power below P-6 or, increase THERMAL POWER above 10% of RATED POWER within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.Table 3.7-1, ACTION 3.b is revised as follows: b. Above the P-6 (Block of Source Range Reactor Trip) setpoint, but below 7% of RATED POWER, decrease power below P-6 or, increase THERMAL POWER above 11% of RATED POWER within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.Note: See Technical Report EE-0116 (Attachment

4) Sections 4.3.18 and 4.3.20 for technical basis.* Table 3.7-1, ACTION 3.c currently states: c. Above 10% of RATED POWER, POWER OPERATION may continue.Table 3.7-1, ACTION 3.c is revised as follows: c. Above 11% of RATED POWER, POWER OPERATION may continue.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.18 for technical basis.* Table 3.7-2, Item 1.c (under Permissible Bypass Conditions) currently states: Primary pressure less than 2000 psig, except when reactor is critical Table 3.7-2, Item 1.c (under Permissible Bypass Conditions) is revised as follows: Primary pressure less than 2010 psig, except when reactor is critical Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.14 for technical basis.Page 22 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1* Table 3.7-2, Item 1.d (under Permissible Bypass Conditions) currently states: Primary pressure less than 2000 psig, except when reactor is critical Table 3.7-2, Item 1.d (under Permissible Bypass Conditions) is revised as follows: Primary pressure less than 2010 psig, except when reactor is critical Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.14 for technical basis.0 Table 3.7-2, Item 1.e.1) (under Permissible Bypass Conditions) currently states: Reactor coolant Tavg less than 5430 during heatup and cooldown Table 3.7-2, Item 1.e.1) (under Permissible Bypass Conditions) is revised as follows: Reactor coolant Tavg less than 5450 during heatup and cooldown Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.15 for technical basis.* Table 3.7-2, Item 1.e.2) (under Permissible Bypass Conditions) currently states: Reactor coolant Tavg less than 5430 during heatup and cooldown Table 3.7-2, Item 1.e.2) (under Permissible Bypass Conditions) is revised as follows: Reactor coolant Tavg less than 5450 during heatup and cooldown Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.15 for technical basis.* Table 3.7-2, Item 1.e.3) (under Permissible Bypass Conditions) currently states: Reactor coolant Tavg less than 5430 during heatup and cooldown Table 3.7-2, Item 1.e.3) (under Permissible Bypass Conditions) is revised as follows: Reactor coolant Tavg less than 5450 during heatup and cooldown Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.15 for technical basis.* This note is to be inserted into the bottom of each page in Table 3.7-2:* There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.Page 23 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 This note applies to the following Table 3.7-2 Functional Unit items, which are revised to include an asterisk: 1.b. High containment pressure*1.c. High differential pressure between any steam line and the steam header*1 .d. Pressurizer low-low pressure*1.e. High steam flow in 2/3 steam lines coincident with low Tavg or low steam line Pressure*1.e.1) Steam line flow*1.e.2) Tavg*1.e.3) Steam line pressure*2.b. High containment pressure (Hi-Hi)*3.a. Steam generator water level low-low*5.a. Low intake canal level*(Unit 1) 7. a. RWST Level -Low*(Unit 2) 7. a. RWST Level -Low-Low*(Unit 2) 8. a. RWST Level -Low Coincident with High High Containment Pressure*" This note is to be inserted into the bottom of each page in Table 3.7-3:* There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.This note applies to the following Table 3.7-3 Functional Unit items, which are revised to include an asterisk: 1.b.1) High containment pressure*1.c.1) High containment pressure (Hi-Hi setpoint)*

2.a. High steam flow in 2/3 lines coincident with 2/3 low Tavg or 2/3 low steam pressures*

2.b. High containment pressure (Hi-Hi setpoint)*

3.a. Steam generator water-level high-high*

• Table 3.7-4, Item 1 (under Setting Limit) currently states:< 19 psia Table 3.7-4, Item 1 (under Setting Limit) is revised as follows:< 18.5 psia Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.2 for technical basis.Page 24 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1* Table 3.7-4, Item 2 (under Setting Limit) currently states:< 25 psia Table 3.7-4, Item 2 (under Setting Limit) is revised as follows:< 24 psia Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.3 for technical basis.* Table 3.7-4, Item 3 (under Setting Limit) currently states:_> 1,760 psig Table 3.7-4, Item 3 (under Setting Limit) is revised as follows:_> 1,770 psig Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.4 for technical basis.* Table 3.7-4, Item 4 (under Setting Limit) currently states:< 150 psig Table 3.7-4, Item 4 (under Setting Limit) is revised as follows:<135 psid Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.5 for technical basis.* A portion of Table 3.7-4, Item 5 (under Setting Limit) currently states:_> 500 psig steam line pressure The above portion of Table 3.7-4, Item 5 (under Setting Limit) is revised as follows:_> 510 psig steam line pressure Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.8 for technical basis.* Table 3.7-4, Item 6.a (under Setting Limit) currently states:>_ 14.5% narrow range Table 3.7-4, Item 6.a (under Setting Limit) is revised as follows:> 16.0% narrow range Note: See Technical Report EE-01 16 (Attachment

4) Section 4.3.13 for technical basis.Page 25 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1* Table 3.7-4, Item 8.a (under Setting Limit) currently states: 23 feet-6 inches Table 3.7-4, Item 8.a (under Setting Limit) is revised as follows: 23 feet-5.85 inches Note: See Technical Report EE-0116 (Attachment

4) Section 4.4.10 for technical basis., Table 3.7-4, (Unit 1) Item 9.a (under Setting Limit) currently states:>11.25%<15.75%Table 3.7-4, (Unit 1) Item 9.a (under Setting Limit) is revised as follows:> 12.7%<14.3%Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.12 for technical basis.* Table 3.7-4, (Unit 2) Item 9.a (under Setting Limit) currently states:>11.25%<15.75%Table 3.7-4, (Unit 2) Item 9.a (under Setting Limit) is revised as follows:> 12.7%<14.3%Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.12 for technical basis.* Table 3.7-4, Item 10.a (under Setting Limit) currently states:_< 80% narrow range Table 3.7-4, Item 10.a (under Setting Limit) is revised as follows:< 76% narrow range Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.11 for technical basis.Page 26 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1" This note is to be inserted into the bottom of each page in Table 3.7-4: There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.This note applies to the following Table 3.7-4 Functional Unit items, which are revised to include an asterisk: 1. High Containment Pressure (High Containment Pressure Signal)*2. High-High Containment Pressure (High-High Containment Pressure Signals)*3. Pressurizer Low-Low Pressure*4. High Differential Pressure Between Steam Line and the Steam Line Header*5. High Steam Flow in 2/3 Steam Lines*Coincident with Low Tavg or Low Steam Line Pressure*6a. Steam Generator Water Level Low-Low*8a. Low Intake Canal Level*(Unit 1) 9a. RWST Level-Low*(Unit 2) 9a. RWST Level-Low-Low*

1Oa. Steam Generator Water Level High-High*(Unit 2) 11. RWST Level Low (coincident with High High Containment Pressure)*" Table 4.1-1 Footnote 1, Item "Check" states: Check Consists of verifying for an indicated intake canal level greater than 23'-6" that all four low level sensor channel alarms are not in an alarm state.Table 4.1-1 Footnote 1, Item "Check" is revised as follows: Check Consists of verifying for an indicated intake canal level greater than 23'-5.85" that all four low level sensor channel alarms are not in an alarm state.Note: See Technical Report EE-01 16 (Attachment

4) Section 4.4.10 for technical basis.5.0 TECHNICAL BASIS OF PROPOSED CHANGE 5.1 Limiting Safety System Setting and Setting Limit Changes (Allowable Values)The basis for the changes to the LSSSs and Setting Limits is found in Attachment 4 (Technical Report EE-01 16). As a result of these changes to the TS, setpoint changes will be required for the Pressurizer Low Pressure Reactor Trip Function, the Pressurizer Pressure Low Low ESFAS Function and for Permissive P-7 (i.e. the Turbine First Stage Pressure input to P-7). These setpoint changes will be implemented using the Page 27 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 Dominion Design Change Process. The justification for the revised Allowable Values and the Overtemperature AT and Overpower AT (OPAT) Reactor Trip time constants is provided in Technical Report EE-0116. The revised LSSSs and Setting Limits will provide additional assurance that a Safety Limit will not be exceeded between instrument calibration intervals.

The AVs were re-evaluated and changes made via Technical Report EE-01 16 as a result of NRC concerns with the method in which the AVs were determined.

This concern was identified in RIS 2006-17, "NRC Staff Position on the Requirements of 10 CFR 50.36, 'Technical Specifications', Regarding Limiting Safety System Settings During Periodic Testing and Calibration of Instrument Channels", dated August 24, 2006.5.2 Overtemperature AT Time Constants The basis for the changes to the Overtemperature AT time constants is found in Attachment 4 (Technical Report EE-01 16).The installed "nominal" Lead (-ri) and Lag (2) Time Constants used for the dynamic compensation associated with TAVG are set for 33 seconds and 4 seconds, respectively.

A lead time constant of 33 seconds and lag time constant of 4 seconds is more conservative than the current TS settings of 25 seconds and 3 seconds for Tr1 and r2, respectively.

The actual "nominal" lead/lag ratio of 33/4 installed in the plant on both units has been shown analytically to provide a faster response (i.e., will cause a reactor trip earlier) than the current TS lead/lag ratio of 25/3 for all postulated ramp rates used in the Safety Analysis for the Overtemperature AT Reactor Trip Function.

The revised TS limits for -ri and -%2 are based on the installed lead and lag settings in the plant, noting the + 10% of the desired Time Constant tolerance as given by the manufacturer and the Instrument Calibration Procedure.

Thus, the revised TS limit for -11 is > 29.7 Seconds (i.e., 33 seconds -3.3 seconds) and the revised TS limit for T2 is 4.4 seconds (i.e., 4 seconds + 0.4 seconds).

The figure below compares the ramp response of a 29.7/4.4 lead/lag setting versus the current TS lead/lag setting of 25/3.The TAVG ramp rate used in the figure (i.e., + 10 OF / minute) approximates the Surry TAVG response for an Uncontrolled Rod Withdrawal from Full Power terminated by the OTAT Reactor Trip.As shown below, for ramp time < 6 seconds (i.e., time t 12, the lag time constant), the ramp response of the current TS lead/lag setting of 25/3 is slightly more conservative than the revised setting of 29.7/4.4.

However, after approximately two lag time constants, the output response of the revised TS lead/lag settings is more conservative and will cause the OTAT Reactor Trip to come in sooner than the current settings.Also, based on Technical Report EE-01 16, there are no Safety Analysis cases that credit the OTAT Reactor Trip for event termination times less than 20 seconds.Page 28 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 Lead Lag Response 25/3 vs. 29.7/4.4-TAVG Ramp ---.25/3 Lead Lag --29.7/4.4 Lead Lag ]584.0 582.0 580.0 2 578.0 576.0 574.0 572.0 10 15 20 25 30 35 Time (Seconds)5.3 Overpower AT Time Constant The basis for the changes to the Overpower AT time constant is found in Technical Report EE-01 16. The time constant for the Overpower AT TAVG rate penalty (i.e., "r3) is not credited in the Chapter 14 Safety Analysis.

The TS Limit for -3 will be changed from 10 Seconds to > 9.0 Seconds. The reduction of 1 second from the original 'r3 time constant of 10 seconds takes into account the + 10% of the desired time constant tolerance as given by the manufacturer and the instrument calibration procedure.

6.0 SAFETY

SIGNIFICANCE

6.1 Limiting

Safety System Setting and Setting Limit Changes (Allowable Values)The changes to the TS provide new LSSSs and Setting Limits for Reactor Trip and ESF functions.

The proposed LSSSs and Setting Limits will assure that the Analytical Limit (Safety Analysis Limit) will not be violated as a result of normal and expected instrument drift between calibration intervals.

The changes do not alter the design features or impact any accident analysis and the margin of safety as defined in any TS is not being reduced. The new Allowable Values do not increase the consequences of any accident nor is a new accident mode or Page 29 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 precursor being generated as a result. The new Allowable Values have a positive impact on the reactor protection and engineered safeguards equipment and their ability to mitigate the consequences of any accident.As a result of these changes to the TS, setpoint changes will be required for the Pressurizer Low Pressure Reactor Trip Function, the Pressurizer Pressure Low Low ESFAS Function and for Permissive P-7 (i.e. the Turbine First Stage Pressure input to P-7). These setpoint changes will be implemented using the Dominion Design Change Process.6.2 Overtemperature AT Time Constants Based on Technical Report EE-01 16, there are no Safety Analysis cases that credit the OTAT Reactor Trip for event termination times less than 20 seconds.The Rod Withdrawal at Power (RWAP) event is the most limiting -OTAT terminated event in the terms of margin to Departure from Nucleate Boiling (DNB). Dominion performed an evaluation to assess the impact of the 10% deviation in the OTAT lead/lag coefficients.

The evaluation involved the performance of RWAP cases assuming the maximum reactivity insertion rate that resulted in an OTAT reactor trip.Sensitivity cases demonstrated that the maximum adverse DNB ratio (DNBR) impact of variation in lead/lag coefficients is obtained when the lead coefficient is decreased 10%below its nominal value, and the lag coefficient is increased 10% above its nominal value. The sensitivity evaluation also considered the difference between the actual (installed) lead/lag coefficients and the values prescribed in the TS. It was determined that the actual (installed) coefficients are conservative with respect to the TS lead/lag coefficients for the limiting OTAT -terminated DNBR cases.The evaluation concluded that a 10% tolerance about the nominal lead/lag coefficients in the OTAT channels does not significantly affect the results of the currently applicable accident analyses and that the nominal installed OTAT lead/lag coefficients are conservative with respect to the TS OTAT lead/lag coefficients.

Therefore, changing the TS OTAT lead/lag coefficients to values closer to the actual (installed) values is a change in the conservative direction.

6.3 Overpower

AT Time Constant The OPAT Reactor Trip function is not credited in any transient analysis as the source of reactor protection.

Therefore, the calibration tolerance does not affect the results of any transient analyses.

The tolerance is sufficiently small to ensure that the OPAT Reactor Trip continues to serve as an operable reactor protection function which is diverse from the nuclear overpower (high neutron flux) reactor trip.Page 30 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 7.0 SIGNIFICANT HAZARDS CONSIDERATION Virginia Electric and Power Company (Dominion) is proposing revisions to the Technical Specifications (TS) for Surry Power Station Units 1 and 2. The following portions of the TS are impacted:

the Limiting Safety System Setting (LSSS) for the Source Range High Flux, High Pressurizer Pressure, Low Pressurizer Pressure, High Pressurizer Water Level, Low-Low Steam Generator Water Level, Low Steam Generator Water Level, P-7 (Unblock), and P-8 functions in TS 2.3; the time constants for the Overtemperature AT and Overpower AT Reactor Trips in TS 2.3; the LSSS for P-7 and Pressurizer Pressure (P-11) in TS 3.1; the Setting Limit for Pressurizer Pressure (P-11), Tavg (P-12), High Containment Pressure, High-High Containment Pressure, Pressurizer Low-Low Pressure, Low Steam Line Pressure, Steam Generator Water Level Low-Low, Low Intake Canal Level, and Steam Generator Water Level High-High in TS 3.7; and the Setting Limit for Low Intake Canal Level in TS 4.1. Reactor Trip functions with Safety Analysis Limits have been denoted in Table 3.7-1. Likewise, Engineered Safety Feature functions with Safety Analysis Limits have been denoted in Tables 3.7-2, 3.7-3, and 3.7-4.Dominion has reviewed the requirements of 10 CFR 50.92 as they relate to the proposed changes to the Surry Power Station Units 1 and 2 TS and has determined that a significant hazards consideration does not exist. The basis for this determination is provided as follows: 1. Does the proposed license amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

No. The proposed change revises LSSSs and Setting Limits to ensure that Safety Limits are not exceeded as a result of normal and expected instrument drift between calibration intervals.

The new Allowable Values (LSSSs and Setting Limits) were derived to meet the intent of RIS 2006-17, "NRC Staff Position on the Requirements of 10 CFR 50.36, 'Technical Specifications', Regarding Limiting Safety System Settings During Periodic Testing and Calibration of Instrument Channels", dated August 24, 2006.The proposed TS change does not change any of the previously evaluated accidents in the Updated Final Safety Analysis Report (UFSAR). Rather, the proposed change ensures that Reactor Trip System and Engineered Safety Function Actuation System actuations occur as designed and within Safety Limits.In addition, it increases the probability that a malfunctioning instrument channel will be identified.

This change is not considered to represent a significant increase in the probability or consequences of an accident, since it will decrease the probability of the malfunction of a system, structure or component (SSC), thereby decreasing the probability or consequences of an accident previously evaluated.

Specifically, the change is conservative in nature since it will increase the likelihood that a Page 31 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 malfunctioning instrument channel will be identified prior to that channel exceeding its Safety Limit.2. Does the proposed license amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

No. The proposed change revises LSSSs and Setting Limits to ensure that Safety Limits are not exceeded as a result of normal and expected instrument drift between calibration intervals.

The change is conservative and is intended to ensure the safety analysis is maintained.

Specifically, the proposed change is intended to identify a malfunctioning channel prior to its exceeding the Safety Limit sooner than the current instrument setting methodology.

Therefore the proposed change will not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?No. The proposed change revises LSSSs and Setting Limits to ensure that Safety Limits are not exceeded as a result of normal and expected instrument drift between calibration intervals.

The new Allowable Values (LSSS and Setting Limits) were derived to meet the intent of RIS 2006-17, "NRC Staff Position on the Requirements of 10 CFR 50.36, 'Technical Specifications', Regarding Limiting Safety System Settings During Periodic Testing and Calibration of Instrument Channels", dated August 24, 2006.Channel Statistical Allowance (CSA) calculations have been performed on channels with an associated Safety Analysis Limit to determine the instrument channel uncertainty.

Channel Operational Test (COT) errors are associated with those portions of the instrument channel tested to verify channel operability.

These COT errors were extracted from the CSA to derive an Allowable Value for the channel.The Allowable Value is set at a distance from the Actual (Nominal)

Trip Setpoint equal to the COT errors (with some minimal additional margin on some channels).

The overall result is a reduction in the distance between the Allowable Value and the Nominal Trip Setpoint.

Consequently, for a malfunctioning channel, the Allowable Value will be exceeded with less drift and, therefore, corrective action will be initiated sooner after implementation of the proposed change. This will increase the likelihood that the Safety Analysis Limit for the channel is not exceeded.The distance between the Safety Analysis Limit and the Nominal Trip Setpoint has not been decreased; therefore, the safety margin has been not reduced. The likelihood that a malfunctioning channel is identified prior to exceeding its Safety Analysis Limit has increased.

Therefore, the proposed amendment does not involve a significant reduction in a margin of safety.Page 32 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 8.0 ENVIRONMENTAL ASSESSMENT This amendment request meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9) as follows: (i) The amendment involves no significant hazards consideration.

As described above, the proposed TS change does not involve a significant hazards consideration.(ii) There is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.The proposed TS change lowers the threshold at which corrective action will be initiated for an instrument channel suspected of malfunctioning.

Therefore, there is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.(iii)There is no significant increase in individual or cumulative occupational radiation exposure.The proposed TS change does not involve the installation of any new equipment or a physical change to any structures, systems, or components (SSCs) at Surry Power Station. Small setpoint changes will be required for the Pressurizer Low Pressure Reactor Trip Function, the Pressurizer Pressure Low Low ESFAS Function and for Permissive P-7 (i.e. the Turbine First Stage Pressure input to P-7) to accommodate the revised Allowable Values associated with these functions.

These setpoint changes are in conservative and thus will increase the margin of safety associated with each function.

Therefore, there is no significant increase in individual or cumulative occupational radiation exposure.Based on the above assessment, Dominion concludes that the proposed change meets the criteria specified in 10 CFR 51.22 for a categorical exclusion from the requirements of 10 CFR 51.22 relative to requiring a specific environmental assessment or impact statement by the Commission.

9.0 CONCLUSION

The proposed changes to the TS revise LSSSs and Setting Limits to ensure that Safety Analysis Limits are not exceeded as a result of normal and expected instrument drift between calibration intervals.

The new Allowable Values (LSSSs and Setting Limits)were derived to meet the intent of RIS 2006-17, "NRC 'Staff Position on the Requirements of 10 CFR 50.36, 'Technical Specifications', Regarding Limiting Safety System Settings During Periodic Testing and Calibration of Instrument Channels", dated August 24, 2006.Page 33 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 The proposed TS change does not involve the installation of any new equipment or a physical change to any structures, systems, or components (SSCs) at Surry Power Station. Small setpoint changes will be required for the Pressurizer Low Pressure Reactor Trip Function, the Pressurizer Pressure Low Low ESFAS Function and for Permissive P-7 (i.e. the Turbine First Stage Pressure input to P-7) to accommodate the revised Allowable Values associated with these functions.

These setpoint changes are in the conservative direction and thus will increase the margin of safety associated with each function.

The proposed TS change lowers the threshold at which corrective action will be initiated for an instrument channel suspected of malfunctioning.

The Station Nuclear Safety and Operating Committee (SNSOC) has reviewed the proposed change, and it has been concluded that this change does not have an adverse impact on safety, does not involve a significant hazards consideration, and will not endanger the health and safety of the public.

10.0 REFERENCES

10.1 Technical Report EE-0116, Revision 3 with Addendum 1, "Allowable Values for North Anna Improved Technical Specifications (ITS), Tables 3.3.1-1 and 3.3.2-1 and Setting Limits for Surry Custom Technical Specifications (CTS), Sections 2.3 and 3.7" 10.2 RIS 2006-17, "NRC Staff Position on the Requirements of 10 CFR 50.36,'Technical Specifications', Regarding Limiting Safety System Settings During Periodic Testing and Calibration of Instrument Channels", dated August 24, 2006 10.3 Letter from Mr. Ledyard B. Marsh, Office of Nuclear Reactor Regulation to Mr.Alex Marion, Nuclear Energy Institute dated June 17, 2004, "NRC Comments on"ISA S67.04 Method for Determining Trip Setpoints and Allowable Values for Safety-Related Instrumentation" 10.4 Letter from Mr. Hukan C. Garg, Office of Nuclear Reactor Regulation dated September 8, 2003, "Summary of Meeting Held on August 13, 2003, with Members of the Instrumentation and Automation Society (ISA) 67.04 Committee Regarding Methods for Determining Allowable Value for Safety-Related Instrumentation (TAC No. MB4306)" 10.5 TSTF-493, Revision 1, "Clarify Application of Setpoint Methodology for LSSS Functions", dated October 2, 2006 10.6 Regulatory Guide 1.105, Revision 3, "Setpoints for Safety-Related.

Instrumentation", December 1999 Page 34 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 1 10.7 ANSI/ISA-S67.04, Part I -1994, "Setpoints for Nuclear Safety-Related Instrumentation", Instrument Society of America, August 24, 1995 10.8 ISA-$67.04, Part II, "Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation", International Society for Measurement and Control, 1994 10.9 ISA-RP67.04.02-2000, Part II, "Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation", International Society for Measurement and Control, 2000 Page 35 of 35 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 2 Marked-up Technical Specifications Pages Revised Setting Limits and Overtemperature AT / Overpower AT Time Constants Surry Power Station Units 1 and 2 Virginia Electric and Power Company (Dominion)

TS 2.2-2 The nominal settings of the p erated relief valves at 2335 psig, the reactor high pressure trip at' psig and the safety valves at 2485 psig are established to assure never reaching the Reactor Coolant System pressure safety limit. The initial hydrostatic test has been conducted at 3107 psig to assure the integrity of the Reactor Coolant System.1) UFSAR Section 4 2) UFSAR Section 4.3 01 k Amendment Nos. Q444Ad-2W TS 2.3-1..-4--2--9-3--

2.3 LIMITING

SAFETY SYSTEM SETTINGS, PROTECTIVE INSTRUMENTATION Applies to trip and permissive settings for instruments monitoring reactor power;and reactor coolant pressure, temperature, and flow; and pressurizer level.To provide for automatic protective action in the event that the principal process variables approach a safety limit.A. Protective instrumentation settings for reactor trip shall be as follows: 1. Startup Protection (a) High flux, power range (low set point) -< 25% of rated power.(b) High flux, intermediate range (high set point) -current equivalent to .40% of full power.(c) High flux, source range (high set point) -Neutron flux counts/sec.

2. Core Protection (a) High flux, power range (high set point) -_< 109% of rated power.Amendment Nos. 176 -nd 175_

TS 2.3-2 (b) High pressurizer pressure -Sa lpsig.(c) Low pressurizer pressure -> (d) Overtemperature AT AT < A~o [ 1-K2(++ tlS ATAT 0[K 1-K 2 (1 t 2 S) (T- T') + K 3 (P- P')- f(AI)]where AT 0 = Indicated AT at rated thermal power, OF T = Average coolant temperature, OF T'= 573.0°F P = Pressurizer pressure, psig P' = 2235 psig Ki = 1.135 K2 = 0.01072 K 3 =

Al = 6 where and are the percent power in the top and bottom halves of the core respectively, and qt + qb is total core power in percent of rated power f(AI) = function of Al, percent of rated core power as shown in Figure 2.3-1 t seconds~~

4--(e) Overpower AT AT_< ATo [K 4-K5 (1 t 3 S)T- K6 (T- T')-f(Ai)]+ t 3 s)TTrf-)The. CA-)a.vAneJ1*S Mr'ec'.uvv L"e s&pov rh't exc&e~4 -V ~~v~pwiýe-Th9~-ktpx b,-r paw'v is +,3o) ~ o6&Amendment Nos.

2 .-%9o o 2. t igoi -A- sPA4) s where uaJ -o 3. o -r ?avi ee-C)ATo = Indicated AT at rated thermal power, OF T = Average coolant temperature, 'F T'= Averane coolant temperature measured at nominal conditions and rated power, OF K 4 = A constant = 1.089 K 5= 0 for decreasing average temperature A constant, for increasing average temperature 0.02/°F K 6 = 0 for T<T'= 0.001086 forT > T'f(AI) as defined in (d) above,,-_-14e[e onds [ (f) Low reactor coolant loop flow of normal indicated loop flow as measured at elbow taps in each loop (g) Low reactor coolant pump motor frequency

-_> 57.5 Hz (h) Reactor coolant pump under voltage -> 70% of normal voltage 3. Other reactor trip settings (a) High pressurizer water level _ f span (b) Low-low steam generator water level -+4-S% of narrow range instrument span (c) Low steam generator water level _ of narrow range instrument span in coincidence with steam/feedwater mismatch flow -< 1.0 x 106 lbs/hr (d) Turbine trip (e) Safety injection

-Trip settings for Safety Injection are detailed in TS Section 3.7.Amendment Nos. .6 .d...6 TS 2.3-4 B. Protective instrumentation settings for reactor trip interlocks shall be as follows: 1. The reactor trip on low pressurizer pressure, high pressurizer level, turbine trip tor coolant flow for two or more loops shall be unbl ~ r o '0rp-F--189 of rated power.2. The single loop loss of flow reactor trip shall be unblocked when the power range nuclear flux.--&49%

o.Lratepower.

3. The power range high flux, low setpoint trip an iate range high flux, high setpoint trip shall be unbc e en power C-of rated wer.4. The source range high flux, high setpoint trip shall be unblocked when the intermediate range nuclear flux 5 x 10-1 amperes.Basis The power range reactor trip low setpoint provides protection in the power range for a power excursion beginning from low power. This trip value was used in the safety analysis.(1) The Source Range High Flux Trip provides reactor core protection during shutdown (COLD SHUTDOWN, INTERMEDIATE SHUTDOWN, and HOT SHUTDOWN) when the reactor trip breakers are closed and reactor power is below the permissive P-6. The Source and Intermediate Range trips in addition to the Power Range trips provide core protection during Amendment Nos.

5 TS 2.3-5 reactor startup when the rea or is critical.

The Source Range channels will initiate a reactor trip at about counts per second unless manually blocked when P-6 becomes active. The Intermediate Range channels will initiate a reactor trip at a current level proportional to < 40% of RATED POWER unless manually blocked when P-10 becomes active. In the accident analyses, bounding transient analysis results are based on reactivity excursions from an initially critical condition, where the Source Range trip is assumed to be blocked. Accidents initiated form a subcritical condition would produce less severe results, since the Source Range trip would provide core protection at a lower power level. No credit is taken for operation of the Intermediate Range High Flux trip. However, its functional capability is required by this specification to enhance the overall reliability of the Reactor Protection System.The high and low pressurizer pressure reactor trips limit the pressure range in which reactor operation is permitted.

The high pressurizer pressure reactor trip is also a backup to the pressurizer code safety valves for overpressure protection, and is therefore set lower than the set pressure for these valves (2485 psig). The low pressurizer pressure reactor trip also trips the reactor in the unlikely event of a loss-of-coolant accident.(3)The overtemperature AT reactor trip provides core protection against DNB for all combinations of pressure, power, coolant temperature, and axial power distribution, provided only that the transient is slow with respect to piping transit delays from the core to the temperature detectors (about 3 seconds), and pressure is within the range between high and low pressure reactor trips. With normal axial power distribution, the reactor trip limit, with allowance for errors,(2) is always below the core safety limit as shown on TS Figure 2.1-1. If axial peaks are greater than design, as indicated by the difference between top and bottom power range nuclear detectors, the reactor limit is automatically reduced.(4)(5)

The overpower and overtemperature protection system setpoints have been revised to include effects of fuel densification on core safety limits and to apply to 100% of design flow. The revised setpoints in the Technical Specifications will ensure that the combination of power, temperature, and pressure will not exceed the revised Amendment Nos.

TS 2.3-6 core safety limits as shown in Figures 2.1-1 through 2.1-3. The reactor 1 is prevented from reaching the overpower limit condition by action of the nuclear overpower and overpower AT trips. The overpower limit criteria is that core power be prevented from reaching a value at which fuel pellet centerline melting would occur. The overpower protection system set points include the .effects of fuel densification.

In order to operate with a r eactor coolant loop out of service (tvo-loop operation) and with the stop valves of the inactive loop either open or closed, the overtemperature AT trip setpoin.t calculation has to be modified by the adjustment of the variable K 1. This adjustment, based on Limits of two-loop operation, provides sufficient margin to DNB for the aforementioned transients during two loop operation.

The required adjustment and subsequent mandatory calibrations are made in the protective system racks by qualified technicians*

in the same manner as adjustments before initial startup and normal calibrations for three-loop operation.

The overpower AT reactor trip prevents power density anywhere in the core from exceeding 118% of design power density as discussed Section 7 and specified in Section 14.2.2 of the FSAR and includes corrections for axial power distribution, change in density and beat capacity of water with temperature, and dynamic com-pensation for piping delays from the core to the loop temperature detectors.

The specified "etpoints meet this requirement and include allowance for instrument errors.used here, a qualified technician means a who meets the requirements of ANS-3. Re shall have a mnium of two years of working experience in his speciality and at least one year of related technical (-tr a in i n g .*As use he e, a qu ali i dt ec n c a meanst te chnicia who mees b theG r&i IJ i SCiv t c y s--nk 2 r ).J W 40 ' -T'kc K (a-c 9 4 4 1 " -.. e ,.,, ,'- ( -ýiý vn. ft = C MW I: ) _Cwe~eopirýLTT&_

T a" DVPV" o " C" TS 2.3-7 The low flow reactor trip protects the core against DNB in the event of a sudden loss of power to one or more reactor coolant pumps. The undervoltage reactor trip protects against a decrease in Reactor Coolant System flow caused by a loss of voltage to the reactor coolant pump busses. The underfrequency reactor trip (opens RCP supply breakers and) protects against a decrease in Reactor Coolant System flow caused by a frequency decay on the reactor coolant pump busses. The undervoltage and underfrequency reactor trips are expected to occur prior to the low flow trip setpoint being reached for low flow events caused by undervoltage or underfrequency, respectively.

The accident analysis conservatively ignores the undervoltage and underfrequency trips and assumes reactor protection is provided by the low flow trip. The undervoltage and underfrequency reactor trips are retained as back-up protection.

The high pressurizer water level reaR!VL-tPgS protects the pressurizer valves against water relief. Approximately---9 ft of water corresponds

'T °/%-of span. The specified setpoint allows margin for instrument error(7) and transient level overshoot beyond this trip setting so that the trip function prevents the water level from reaching the safety valves.The low-low steam generator water level reactor trip protects against loss of feedwater flow accidents.

The specified setpoint assures that there will be sufficient water inventory in the steam generators at the time of trip to allow for starting delays for the Auxiliary Feedwater System.(7)The specified reactor trips are blocked at low power where they are not required for protection and would otherwise interfere with normal unit operations.

The prescribed setpoint above which these trips are unblocked assures their availability in the power range where needed.Above P1 power, an autom~c_ýeactor trip will occur if two or more reactor coolant pumps are lost. Above dW%, an automatic reactor trip will occur if any pump is lost or de-energized.

This latter trip Amendment Nos. 29 -t&

TS 2.3-8 will prevent the minimum value of the DNBR from going below the applicable design as a result of the decrease in Reactor Coolant System flow associated with the loss of a single reactor coolant pump.Although not necessary for core protection, other reactor trips provide additional protection.

The steam/feedwater flow mismatch which is coincident with a low steam generator water level is designed for and provides protection from a sudden loss of the reactor's heat sink. Upon the actuation of the safety injection circuitry, the reactor is tripped to-decrease the severity of the accident condition.

Upon turbine trip, at greater thar-,44-/o power, the reactor is tripped to reduce the severity of the ensuing transient.

References (1) UFSAR Section 14.2.1 (2) U FSAR Section 14.2 (3) L)FSAR Section 14.5 (4) U FSAR Section 7.2 (5) F FSAR Section 3.2.2 k6) tFSAR Section 14.2.9 (7) U FSAR Section 7.2 .....Amendment Nos. -;i;;6-Insert "A" for TS 2.3 Basis -insert on page TS 2.3-8: Permissive P-7 is made up of input signals from Turbine First Stage Pressure and NIS Power Range. Signals to the P-7 and P-10 permissives are supplied from the same bistables in the NIS Power Range drawers. P-7 and P-10 will both enable and block functions from the "trip" and "reset" points of these bistables.

The calibration procedures for the NIS Power Range bistables set the nominal trip setpoints associated with the two permissives such that they will trip whenever the measured reactor power level reaches 10 % power (increasing).

The P-7 input from Turbine First Stage Pressure is set to trip at 10 % Turbine Load (increasing).

When two out of four of the NIS Power Range channels trip or if one of the two Turbine First Stage Pressure channels trip the following occurs: " Permissive P-7 allows reactor trip on the following:

low flow, reactor coolant pump breakers open in more than one loop, undervoltage (RCP busses), underfrequency (RCP) busses, turbine trip, pressurizer low pressure, and pressurizer high level.* Permissive P-10 allows manual block of intermediate range reactor trip, allows manual block of power range (low setpoint) reactor trip, allows manual block of intermediate range rod stop (P-i), and automatically blocks source range reactor trip (P-6) and provides an input to P-7.The "trip" and "reset" of a bistable cannot be the same point. It is physically not possible.

There must be a deadband between the "trip" and "reset" points. The calibration procedures for the NIS Power Range bistables set the nominal reset points for the two permissives such that they reset whenever the measured reactor power level reaches 8% power (decreasing).

The P-7 input from Turbine First Stage Pressure is set to reset at 8.8 % Turbine Load (decreasing).

When three out of four of the NIS Power Range channels reset or if two out of the two Turbine First Stage Pressure channels reset the following occurs: Permissive P-7 blocks reactor trip on the following:

low flow, reactor coolant pump breakers open in more than one loop, undervoltage, underfrequency, turbine trip, pressurizer low pressure, and pressurizer high level.When three out of four of the NIS Power Range channels reset the following occurs:* Permissive P-10 defeats automatically the manual block of intermediate range reactor trip, defeats automatically the manual block of power range (low setpoint)reactor trip, and defeats automatically the manual block of intermediate range rod stop (P1).There are no specific Safety Analysis Limits associated with Permissives P-7 and P-1 0.However, they are "Assumed Available" by Nuclear Analysis and Fuel. Since P-7 and P-10 are permissives for functions with Safety Analysis Limits, for conservatism, they will be treated as if they had a Limiting Safety System Setting. In order to account for instrumentation errors, 1% of reactor power is added to the P-7 and P-10 safety functions.

This results in a Limiting Safety System Setting for the P-7 enable interlock of 11% of reactor power. The Limiting Safety System Setting for the P-10 (defeat block) interlock is 7% of reactor power.The methodology for determining the Limiting Safety System Settings (LSSS) found in TS 2.3 was developed in Technical Report EE-01 16. The Limiting Safety System Setting must be chosen so that automatic protective action will correct an abnormal situation before the safety limit is exceeded.

At Surry Power Station the Allowable Value (AV) serves as the Limiting Safety System Setting such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value during the Channel Functional Test (which is also referred to as the Channel Operational Test or COT). As such, the Allowable Value differs from the Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval.

In this manner, the actual setting of the device will still meet the LSSS definition and ensure that the Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.

If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a Technical Specification perspective.

This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.Technical Report EE-01 16 verifies that Surry's methodology for determining Allowable Values is in agreement with the intent of ISA Standard S67.04, Methods 1 and 2. In addition, it is Dominion's position that the Analytical Limit will be protected if: 1. the distance between the Trip Setpoint and the Analytical Limit is equal to or greater than the Total Loop Uncertainty for that channel and 2. the distance between the Allowable Value and the Analytical Limit is equal to or greater than the non-COT error components of the Total Loop Uncertainty and 3. the distance between the Trip Setpoint and the Allowable Value is equal to the COT error components of the Total Loop Uncertainty without any excessive margin included.Both the Trip Setpoint and the Allowable Value must be properly established in order to adequately protect the Analytical Limit.

TS 3.1-2 b. If an unschedtlid loss of one or more reactor coolant pumps occurs while operating below---0%

RATED POWER (P-7) and results in less than two pumps in service, the affected plant shall be shutdown and the reactor made subcritical by inserting all control banks into the core. The shutdown rods may remain withdrawn.

c. When the average reactor coolant loop temperature is greater than 350'F, the following conditions shall be met: 1. At least two reactor coolant loops shall be OPERABLE.2. At least one reactor coolant loop shall be in operation.

d. When the average reactor coolant loop temperature is less than or equal to 350'F, the following conditions shall be met: I. A minimum of two non-isolated loops, consisting of any combination of reactor coolant loops or residual heat removal loops, shall be OPERABLE, except as specified below: (a) One RHR loop may be inoperable for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing provided the other RHR loop is OPERABLE and in operation.(b) During REFUELING OPERATIONS the residual heat removal loop may be removed from operation as specified in TS 3.10.A.4.2. At least one reactor coolant loop or one residual heat removal loop shall be in operation, except as specified in Specification 3.1O.A.4.Amendment Nos. -238 ,rd 237 TS 3.1-4a 4e 6. Relief Valves Two power operated relief valves (PORVs) and their associated

, block valves shall be OPERABLE*

whenever the Reactor Coolant System average temperature is >_350 0 F.a. With one or both PORVs inoperable but capable of being manually cycled, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> either restore the PORV(s) to OPERABLE status or close the associated block valve(s)and maintain power to the associated block valve(s).ý Otherwise, be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce Reactor Coolant System average temperature to <350°F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.b. -With one PORV inoperable and not capable of being manually cycled, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> either restore the PORV to OPERABLE status or capable of being manually cycled or close the associated block valve and remove power from the block valve. In addition, restore the PORV to OPERABLE status or capable of being manually cycled within the following 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Otherwise, be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce Reactor Coolant System average temperature to <350°F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.c. With both PORVs inoperable and not capable of being manually cycled, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> restore at least 1 PORV to OPERABLE status or capable of being manually cycled.Otherwise, close the associated block valves and remove power from the block valves. In addition, be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce Reactor Coolant System average temperature to <350°F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.*Automatic actuation capability may be blocked when Reactor Coolant System pressure is below 299 psig. --Amendment Nos. +98 amd TS 3.7-4-e'8-e8-=Instrumentation has been provided to sense accident conditions and to initiate operation of the Engineered Safety Features.(0)

Safety Injection System Actuation Protection against a loss-of-coolant or steam line break accident is provided by automatic actuation of the Safety. Injection System (SIS) which provides4 emergency cooling and reduction of reactivity.

The loss-of-coolant accident is characterized by depressurization of the Reactor Coolant System and rapid loss of reactor coolant to the containment.

The engineered safeguards instrumentation has been designed to sense these effects of the loss-of-coolant accident by detecting low pressurizer pressure to Ajeofetm signals actuating the SIS active phase, The SIS active phase is also actuated by a high containment pressure signal brought about by loss of high enthalpy coolant to the containment.

This actuation signal acts as a backup to the low pressurizer pressure actuation of the SIS and also adds diversity to j;.9tGG~i9R against loss of coolant.Signals are also provided to actuate the SIS upon sensing the effects of a steam line break accident.

Therefore, SIS actuation following a steam line break is designed to occur upon sensing high differential steam pressure between the steam header and steam generator line or upon sensing high steam line flow in coincidence with low reactor coolant average temperature or low steam line pressure.The increase in the extraction of RCS heat following a steam line break results in reactor coolant temperature and pressure reduction.

For this reason, protection against a steam line break accident is also provided by low pressurizer pressure actuating safety injection.

Protection is also provided for a steam line break in the containment by actuation of SIS upon sensing high containment pressure.F Amendment Nos. 188 reduces the consequences of a steam line break inside the containment by stopping the entry of feedwater.

Auxiliary Feedwater System Actuation The automatic initiation of auxiliary feedwater flow to the steam generators by instruments identified in Table 3.7-2 ensures that the Reactor Coolant System decay heat can be removed following loss of main feedwater flow. This is consistent with the requirements of the "TMI-2 Lessons Learned Task Force Status Report," NUREG-0578, item 2.1.7.b.Setting Limits 1. The high containment pressure limit is set at about% of design containment pressure.

Initiation of safety injection protects against loss of coolant(2) or steam line break(3) accidents as discussed in the safety analysis.

uti)2. The high-high containment pressure limit is set at about 4ý of design containment pressure..

Initiation of containment spray and steam line isolation protects against large loss-of-coolant(2) or steam line break accidents(3) as discussed in the safety analysis.3. The pressurizer low pressure setpoint for safety injection actuation is set substantially below system operating pressure limits. However, it is sufficiently high to protect against a loss-of-coolant accident as shown in the safety analysis.(2) The setting limit (in units of psig) is based on nominal atmospheric pressure.4. The steam line high differential pressure limit is set well below the differential pressure expected in the event of a large steam line break accident as shown in the safety analysis.(3)5. The high steam line flow differential pressure setpoint is constant at 40%full flow between no load and 20% load and increasing linearly to 110%of full flow at full load in order to protect against large steam line break accidents.

The coincident low Tavg setting limit for SIS and steam line isolation initiation is set below its HOT SHUTDOWN value. The coincident Amendment Nos. 2"-46-- amd TS 3.7-7 steam line pressure setting limit is set below the full load operating pressure.

The safety analysis shows that these settings provide protection in the event of a large steam line break. (3)IN 6 e e -" ", 11 Accident Monitoring Instrumentation The primary purpose of accident monitoring instrumentation is to display unit parameters that provide information required by the control room operators during and following accident conditions.

In response to NUREG-0737 and Regulatory Guide (RG) 1.97, Revision 3, a programmatic approach was developed in defining the RG 1.97-required equipment for Surry. The Surry RG 1.97 program review examined existing instrumentation with respect to the RG 1.97 design and qualification requirements.

The operability of RG 1.97 instrumentation ensures that sufficient information is available on selected unit parameters to monitor and assess unit status and response during and following an accident.

The availability of accident monitoring instrumentation is important so that the consequences of corrective actions can be observed and the need for and magnitude of further actions can be determined.

RG 1.97 applied a graded approach to post-accident indication by using a matrix of variable types versus variable categories.

RG 1.97 delineates design and qualification criteria for the instrumentation used to measure five variable types (Types A, B, C, D, and E). These criteria are divided into three separate categories (Categories 1, 2, and 3), providing a graded approach that depended on the importance to safety of the measurement of a specific variable.

Category 1 variables, listed in Table 3.7-6, are defined as follows: Category 1 -are the key variables deemed risk significant because they are needed to:* Determine whether other systems important to safety are performing their intended functions,* Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release, and* Provide information regarding the release of radioactive materials to allow early indication of the need to initiate action necessary to protect the public and to estimate the magnitude of any impending threat.The RG 1.97 criteria on redundancy requirements apply to Category 1 variables only and address single-failure criteria and supporting features, including power sources.Failures of the instrumentation, its supporting features, and/or its power source resulting in less than the required number of channels necessitate entry into the required actions.Amendment Nos. 4.7-ai4-2,4 Insert "B" for TS 3.7 Basis -insert on page TS 3.7-7: The methodology for determining the Setting Limits (SL) found in TS 3.7 was developed in Technical Report EE-01 16. The Setting Limits must be chosen so that automatic protective action will correct an abnormal situation before the safety limit is exceeded.At Surry Power Station the Allowable Value (AV) serves as the Setting Limit such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value during the Channel Functional Test (which is also referred to as the Channel Operational Test or COT). As such, the Allowable Value differs from the Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval.

In this manner, the actual setting of the device will still meet the Setting Limit definition and ensure that the Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.

If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a Technical Specification perspective.

This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.Technical Report EE-0116 verifies that Surry's methodology for determining Allowable Values is in agreement with the intent of ISA Standard S67.04, Methods 1 and 2. In addition, it is Dominion's position that the Analytical Limit will be protected if: 4. the distance between the Trip Setpoint and the Analytical Limit is equal to or greater than the Total Loop Uncertainty for that channel and 5. the distance between the Allowable Value and the Analytical Limit is equal to or greater than the non-COT error components of the Total Loop Uncertainty and 6. the distance between the Trip Setpoint and the Allowable Value is equal to the COT error components of the Total Loop Uncertainty without any excessive margin included.Both the Trip Setpoint and the Allowable Value must be properly established in order to adequately protect the Analytical Limit.

TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Minimum al Number OPERABLE Channels Channels Channels To TripPermissible Bypass Conditions 1.2.3.4.5.6.7.8.Functional Unit (Manual Nuclear Flux Power Range *Nuclear Flux Intermediate Range *Nuclear Flux Source Range a. Below P-6 -Note A b. Shutdown -Note B Overtemperature AT Overpower AT Low Pressurizer Pressure Hi Pressurizer Pressure *2 4 2 2 2 3 3 3 3 3f 2 3 2 2 1 2 2 2 2 1 2 1 1 0 2 2 2 2 Low trip setting at P- 10 P-10 P-6 P-7 Operator Action 1 2 3 4 5 6 6 7 6 4-Cb 0~z 0 C,, Note A -With the reactor trip breakers closed and the control rod drive system capable of rod withdrawal.

Note B -With the reactor trip breakers open.I N',S E 1Z "C H~J2'~1 0 1%-. 1" 1 I,, TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Total Number Functional Unit Of Channels 9. Pressurizer-Hi Water Level-* 3 10. Low Flow **" 3/loop Minimum OPERABLE Channels 2 2/loop in each operating loop Channels To Trip 2 2/loop in any operating loop 2/loop in any 2 operating loops Permissible Bypass Conditions Operator Action P-7 7 P-8 7 P-7 7 11. Turbine Trip a. Stop valve closure b. Low fluid oil pressure 12. Lo-Lo Steam Generator Water Level *X-13. Underfrequency 4KV Bu's 14. Undervoltage 4KV Bus 15. Safety Injection (SI) Input From ESF> 16. Reactor Coolant Pump Breaker Position i~~ý GI R ý T LC'CE H oi 4 3 3/loop 3-1/bus 3- l/bus 2 1 2 2/loop in each operating loop 2 2 2 4 2 2/loop in any operating loops 2 2 1 1 2 P-7 P-7 P-7 P-7 7 7 6 7 7 11 9 9 4-1/breaker 1/breaker per operating loop P-8 P-7 C/-

.. .I, TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Functional Unit 17. Low steam generator water level with steam/feedwater flow mismatch Total Number Of Channels 2/loop-level and 2/loop-flow mismatch Minimum OPERABLE Channels 1/loop-level and 2/loop-flow mismatch or 2/loop-level and 1/loop-flow mismatch 2 1 2 2 3 Channels To Trip I/loop-level coincident with l/loop-flow mismatch in same loop 1 1 Permissible Bypass Conditions Operator Action 6 8 18. a. Reactor Trip Breakers b. Reactor Trip Bypass Breakers -Note C 19. Automatic Trip Logic 20. Reactor Trip System Interlocks

-Note D a. Intermediate range neutron flux, P-6 b. Low power reactor trips block, P-7 Power range neutron flux, P-10 and 2 2 2 2 4 I I 11 13 13 C0 C L 2 Turbine impulse pressure 2 2 1 13 c. Power range neutron flux, P-8 4 3 2 13 d. Power range neutron flux, P-10 4 3 2 13 e. Turbine impulse pressure 2 2 1 13 Note C -With the Reactor Trip Breaker open for surveillance testing in accordance with Specification Table 4.1-1 (Item 30)Note D -Reactor Trip System Interlocks are described in Table 4.1-A A-3 C/2 (jJ 14I S EIT 1'c"I Insert "C" for Table 3.7-1 -insert at the bottom of pages TS 3.7-10. TS 3.7-11, and TS 3.7-12: There is a Safety Analysis Limit associated with this Reactor Trip function.

If during calibration the setpoint is found to be conservative with respect to the Limiting Safety System Setting but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.

TS 3.7-14 TABLE 3.7-1 (Continued)

4. The QUADRANT POWER TILT shall be determined to be within the limit when above 75 percent of RATED POWER with one Power Range Channel inoperable by using the moveable incore detectors to confirm that the normalized symmetric power distribution, obtained from 2 sets of 4 symmetric thimble locations or a full-core flux map, is consistent with the indicated QUADRANT POWER TILT at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement, be in at least HOT SHUTDOWN within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> ACTION 3. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement and with the THERMAL POWER level: a. Below the P-6 (Block of Source Range Reactor Trip) setpoint, restore the inoperable channel to OPERABLE status prior to increasing THERMAL POWER above the P-6 Setpoint.b. Abov e P-6 (Block of Source Range Reactor Trip) setpoint, but below1% of RATED POWER, d(c, se power below P-6 or, increase THERMAL POWER above % of RATED POWER within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.c. AboveX'Yo of RATED POWER, POWER OPERATION may continue.Amendment Nos.

TABLE 3.7-2 ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Funcjnal Unit Total Number Of Channels Minimum OPERABLE Channels Channels To Trip Permissible Bypass Conditions Operator Actions 1. SAFETY INJECTION (SI)a. Manual b. High containment pressure c. High differential pressure between any steam line and the steam header -*d. Pressurizer low-low pressure e. High steam flow in 2/3 steam lines coincident with low Tavg or low steam line pressure*1) Steam line flow *2) Tavg 3) Steam line pressure*f. Automatic actuation logic 2 2 1 21 4 3/steam line 3 3 2/steam line 2 3 2/steam line on any steam line 2 Prim ry epressure less thanA f Dpsig, except when reactor is critical PrImn Zrure less than psig, except when reactor is critical Reactor olarnt Tavg less than- during heatup a wn r6451 Reactor cWlant Tavg less thaf 5W? during heatup, a wn Reactor r~ant Tavg less than'43' during heatup and cooldown 17 20 20 -2/steam line 1/loop 1/line 2 1/steam line I/loop any two loops 1/line any two loops 2 1/steam line any two lines 1/loop any two-loops i 1/line any two loops 20_20 20 14 co 1 I t4 5 E-.T "1 -),:

--1, I," TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Functional Unit 2. CONTAINMENT SPRAY a. Manual b. High containment pressure (Hi-Hi) *c. Automatic actuation logic 3. AUXILIARY FEEDWATER a. Steam generator water level low-low *1) Start motor driven pumps Total Number Of-Channels 1 set 4 Minimum OPERABLE Channels 1 set 3 Channels To Trip Permissible Bypass Conditions Operator Actions 1 set*3 15 17 14 4__.2 2 1 Cr3 cr3 2) Starts turbine driven pump b. RCP undervoltage starts turbine driven pump c. Safety injection

-start motor driven pumps d. Station blackout -start motor driven pumps 3/steam generator 3/steam generator 3 2/steam generator 2/steam generator 2 2/steam generator any 1 generator 2/steam generator any 2 generators 2 20 20 20 See #1 above (all SI initiating functions and requirements)

I/bus 2 transfer buses/unit 1/bus 2 transfer buses/unit 2 24+ Must actuate 2 switches simultaneously

-3 1WSEPT`1D'1 TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Total Number Of Channels Minimum OPERABLE Channels Channels To Trip Permissible Operator Bypass Conditions Actions Functional Unit 3. AUXILIARY FEEDWATER (continued)

e. Trip of main feedwater pumps -2/MFW 1/MFW pump 2-1 start motor driven pumps pump MFV f. Automatic actuation logic 2 2 4. LOSS OF POWER a. 4.16 kv emergency bus 3/bus 2/bus 2 undervoltage (loss of voltage)b. 4.16 kv emergency bus 3/bus 2/bus 2 undervoltage (degraded voltage)5. NON-ESSENTIAL SERVICE WATER ISOLATION a. Low intake canal level 4 3 b. Automatic actuation logic 2 2 6. ENGINEERED SAFEGAURDS ACTUATION INTERLOCKS

-Note A a. Pressurizer pressure, P- 11 3 2 b. Low-low Tavg, P-12 3 2 c. Reactor trip, P-4 2 2 (Unit 1) 7. RECIRCULATION MODE TRANSFER a. RWST Level -Low

• 4 3 b. Automatic Actuation Logic 2 2 and Actuation Relays (Unit 2) 7. RECIRCULATION MODE TRANSFER a. RWST Level -Low-Low -) 4 3 b. Automatic Actuation Logic and 2 2 Actuation Relays Note A -Engineered Safeguards Actuation Interlocks are described in Table 4.1-A each/ pump 1/bus/bus 3 1 2 2 1 24 22 26 26 CD z 0 20 14 23 23 24 25 14 25 14 2 1 2 1 t- ___D 0l-I MSE CT ? D" TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Total Number OPERABLE Of Channels Channels (Unit 2) 8.Functional Unit RECIRCULATION SPRAY a. RWST Level -Low Coincident with High High Containment Pressure *b. Automatic Actuation Logic and Actuation Relays Channels Permissible Operator To Trip Bypass Conditions Actions 4 2 3 2 2 20 14 q >I IW~SC--T LL-b" z 4-p0 TABLE 3.7-3 INSTRUMENT OPERATING CONDITIONS FOR ISOLATION FUNCTIONS Total Minimum Number OPERABLE Channels Permissit Unit Of Channels Channels To Trip Bypass Cond lie titions Operator Actions Functional

1. CONTAINMENT ISOLATION a. Phase I 1) Safety Injection (SI)2) Automatic initiation logic 3) Manual b. Phase 2 1) High containment pressure-*

2) Automatic actuation logic 3) Manual c. Phase 3 1) High containment pressure (Hi-Hi setpoint)

• 2) Automatic actuation logic 3) Manual See Item #1, Table 3.7-2 (all SI initiating functions and requirements) 2 2 1 2 2 1 4 2 2 4 2 1 set 3 2 2 3 2 1 set 3 1 1 14 21 17.14 21 17 14 15 4-(t CD z 0 1 1 set*2. STEAMLINE ISOLATION a. High steam flow in 2/3 lines coincident with 2/3 low Tavg or 2/3 low steam pressures,,* Must actuate 2 switches simultaneously W SEIT Sb ,*See Item #1.e Table 3.7-2 for operability requirements t4<_-_

TABLE 3.7-3 (Continued)

INSTRUMENT OPERATING CONDITIONS FOR ISOLATION FUNCTIONS Total Number Of Channels Minimum OPERABLE Channels Functional Unit Channels To Trip Permissible Bypass Conditions Operator Actions STEAMLINE ISOLATION (continued)

b. High containment pressure (Hi-Hi setpoint)

• 4 3 3 17 21 22 c. Manual 1/steamline 1/steamline 1/steamline 1 d. Automatic actuation logic 3. TURBINE TRIP AND FEEDWATER ISOLATION 2 2 When all MFRV, SG FWIV & associated bypass valves are closed& deactivated or isolated by manual valves.z 0 CD a. Steam generator water-level high-high

• b. Automatic actuation logic and actuation relay 3/steam generator 2/steam generator 2 2/in any one steam generator 20 22 2 1 c. Safety injection See Item #1 Table 3.7-2 (all SI initiating functions and requirements)

INISET PD"~4-_-3 TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING Functional UniL 1 High Containment Pressure (High Containment Pressure Signal) *2 High-High Containment Pressure (High-High Containment Pressure Signals) *3 Pressurizer Low-Low Pressure 4 High Differential Pressure Between Steam Line and the Steam Line Header *5 High Steam Flow in 2/3 Steam Lines ý*Channel Action a) Safety Injection b) Containment Vacuum Pump Trip c) High Press. Containment Isolation d) Safety Injection Containment Isolation e) F.W. Line Isolation a) Containment Spray b) Recirculation Spray c) Steam Line Isolation d) High-High Press. Containment Isolation a) Safety Injection b) Safety Injection Containment Isolation c) F.W. Line Isolation a) Safety Injection b) Safety Injection Containment Isolation c) F.W. Line Isolation a) Safety Injection b) Steam Line Isolation c) Safety Injection Containment Isolation d) F.W. Line Isolation psia5 40% (at zero load) of full steam flow5 40% (at 20% load) of full steam flow!9 110% (at full load) of full steam flow 47-0 I Coincident with Low Tavg or Low Steam Line Pressure =N S R kDI-> 541 -F Tavgsteam line pressure ('I

.,- -TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No. Functional Unit 6 AUXILIARY FEEDWATER a. Steam Generator Water Level Low-Low Aa b. RCP Undervoltage

c. Safety Injection d. Station Blackout e. Main Feedwater Pump Trip 7 LOSS OF POWER a. 4.16 KV Emergency Bus Undervoltage (Loss of Voltage)b. 4.16 KV Emergency Bus Undervoltage (Degraded Voltage)Channel Action Aux. Feedwater Initiation S/G Blowdown Isolation Aux. Feedwater Initiation Aux. Feedwater Initiation Aux. Feedwater Initiation Aux. Feedwater Initiation Emergency Bus Separation and Diesel start Emergency Bus Separation and Diesel start Isolation of Service Water flow to non-essential loads Initiation of Recirculation Mode Transfer System Initiation of Recirculation Mode Transfer System ettin Limit_>iO% narrow range_> 70% nominal All S.I. setpoints> 46.7% nominal N.A.CD z 0Z 8 NON-ESSENTIAL SERVICE WATER ISOLATION a. Low Intake Canal Level (Unit 1) 9 RECIRCULATION MODE TRANSFER a. RWST Level-Low "1> 2975 volts and < 3265 volts with a 2 (+5, -0.1) second time delay> 3830 volts and < 3881 volts with a 60 (+/-3.0) second time delay (Non CLS, Non SI)7 (+/-0.35) second time delay (CLS or SI Conditions) 23 feet- inches>!r-(Unit 2)9 RECIRCULATION MODE TRANSFER a. RWST Level-Low-Low

• imSERT "'-D" TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No. Functional Unit 10 TURBINE TRIP AND FEEDWATER ISOLATION a. Steam Generator Water Level High-High

• Channel Action Turbine Trip Feedwater Isolation Recirculation Spray Pump Start Setting Limit<540% narrow range (Unit 2) 11 RWST Level Low (coincident with High High Containment Pressure) -S.>59%<61%I I1s C RT "D " I.0-z 0 cj~hON Insert "D" for Tables 3.7-2. 3.7-3. and 3.7-4 -insert at the bottom of pages TS 3.7-18, TS 3.7-19, TS 3.7-20, TS 3.7-20a, TS 3.7-21. TS 3.7-22, TS 3.7-25, TS 3.7-26. and TS 3.7-26a: There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.

TABLE 4. 1-1 (Continued)

MINIMUM FREQUENCIES FOR CHECK, CALIBRATIONS AND TEST OF INSTRUMENT CHANNELS Channel Description

39. Steam/Feedwater Flow and Low S/G Water Level 40. Intake Canal Low (See Footnote 1)41. Turbine Trip and Feedwater Isolation a. Steam generator water level high b. Automatic actuation logic and actuation relay 42. Reactor Trip System Interlocks

a. Intermediate range neutron flux, P-6 b. Low reactor trips block, P-7 c. Power range neutron flux, P-8 d. Power range neutron flux, P-10 e. Turbine impulse pressure Check Calibrate Test Remarks S R Q (1) 1) The provisions of Specification 4.0.4 are not applicable D R M(2), Q(2)1) Logic Test 2) Channel Electronics Test S R R N.A.Q M(1) 1) Automatic actuation logic only, actuation relays tested each refueling R(2) 1) Neutron detectors may be excluded from the calibration

2) The provisions of Specification 4.0.4 are not applicable.

R(2)N.A. R(l)N.A. R(1)N.A. R(l)N.A. R(1)N.A. R*R(2)R(2)CDý:l C1.0 C,, R Footnote 1: Check Calibration Consists of verifying for an indicated intake canal level greater than 23'-f" that all four low level sensor channel alarms are not in an alarm state.Consists of uncovering the level sensor and measuring the time response and voltage signals for the immersed and dry conditions.

It also verifies the proper action of instrument channel from sensor to electronics to channel output relays and annunciator.

Only the two available sensors on the shutdown unit would be tested.1) The logic test verifies the three out of four logic development for each train by using the channel test switches for that train.2) Channel electronics test verifies that electronics module responds properly to a superimposed differential millivolt signal which is equivalent to the sensor detecting a "dry" condition.

1 Tests V-(02 T)00 (=r Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 3 Proposed Technical Specifications Pages Revised Setting Limits and Overtemperature AT / Overpower AT Time Constants Surry Power Station Units I and 2 Virginia Electric and Power Company (Dominion)

TS 2.2-2 The nominal settings of the power-operated relief valves at 2335 psig, the reactor high pressure trip at 2380 psig and the safety valves at 2485 psig are established to assure never reaching the Reactor Coolant System pressure safety limit. The initial hydrostatic test has been conducted at 3107 psig to assure the integrity of the Reactor Coolant System.1) UFSAR Section 4 2) UFSAR Section 4.3 Amendment Nos.

TS 2.3-1 2.3 LIMITING SAFETY SYSTEM SETTINGS, PROTECTIVE INSTRUMENTATION Applicability Applies to trip and permissive settings for instruments monitoring reactor power; and reactor coolant pressure, temperature, and flow; and pressurizer level.Objective To provide for automatic protective action in the event that the principal process variables approach a safety limit.Specification A. Protective instrumentation settings for reactor trip shall be as follows: 1. Startup Protection (a) High flux, power range (low set point) -< 25% of rated power.(b) High flux, intermediate range (high set point) -current equivalent to < 40% of full power.(c) High flux, source range (high set point) -Neutron flux < 1.51 x 10 5 counts/sec.

2. Core Protection (a) High flux, power range (high set point) -< 109% of rated power.Amendment Nos.

TS 2.3-2 (b) High pressurizer pressure -< 2380 psig.(c) Low pressurizer pressure -> 1875 psig.(d) Overtemperature AT AT! <ATo[KI -21 + t A A+[tK 2 (- (T- T') + K 3 (P -P') -f(AI)]where AT 0 = Indicated AT at rated thermal power, 'F T = Average coolant temperature, 'F T'= 573.0°F P = Pressurizer pressure, psig P' = 2235 psig K, = 1.135 K2 = 0.01072 K 3 = 0.000566 AI = qt -qb, where qt and qb are the percent power in the top and bottom halves of the core respectively, and qt + qb is total core power in percent of rated power f(AI) = function of Al, percent of rated core power as shown in Figure 2.3-1 tj > 29.7 seconds t 2 < 4.4 seconds The channel's maximum Trip Setpoint shall not exceed its computed Trip Setpoint by more than 2.0% of the AT span. (Note that 2.0% of the AT span is equal to 3.0% AT Power.)(e) Overpower AT ATATo[K 4 K" tK( 3sT-K 6 (T-T') -f(AI)]_< -

dT-K(-T)Amendment Nos.

TS 2.3-3 where AT 0 = Indicated AT at rated thermal power, 'F T = Average coolant temperature, 'F T'= Average coolant temperature measured at nominal conditions and rated power, 'F K4 = A constant = 1.089 K 5 = 0 for decreasing average temperature A constant, for increasing average temperature 0.02/°F K6 =0 for T < T'= 0.001086 for T > T'f(AI) as defined in (d) above"t 3 > 9.0 seconds The channel's maximum Trip Setpoint shall not exceed its computed Trip Setpoint by more than 2.0% of the AT span. (Note that 2.0% of the AT span is equal to 3.0% of AT Power.)(f) Low reactor coolant loop flow - 91% of normal indicated loop flow as measured at elbow taps in each loop (g) Low reactor coolant pump motor frequency

-> 57.5 Hz (h) Reactor coolant pump under voltage -> 70% of normal voltage 3. Other reactor trip settings (a) High pressurizer water level -< 89.12% of span (b) Low-low steam generator water level -> 16% of narrow range instrument span (c) Low steam generator water level -> 19% of narrow range instrument span in coincidence with steam/feedwater mismatch flow -_ 1.0 x 106 lbs/hr (d) Turbine trip (e) Safety injection

-Trip settings for Safety Injection are detailed in TS Section 3.7.Amendment Nos.

TS 2.3-4 B. Protective instrumentation settings for reactor trip interlocks shall be as follows: 1. The reactor trip on low pressurizer pressure, high pressurizer level, turbine trip, and low reactor coolant flow for two or more loops shall be unblocked prior to or when power increases to 11 % of rated power.2. The single loop loss of flow reactor trip shall be unblocked prior to or when the power range nuclear flux increases to 37% of rated power.3. The power range"high flux, low setpoint trip and the intermediate range high flux, high setpoint trip shall be unblocked prior to or when power decreases to 7% of rated power.4. The source range high flux, high setpoint trip shall be unblocked prior to or when the intermediate range nuclear flux decreases to 5 x 10-11 amperes.Basis The power range reactor trip low setpoint provides protection in the power range for a power excursion beginning from low power. This trip value was used in the safety analysis.(')

The Source Range High Flux Trip provides reactor core protection during shutdown (COLD SHUTDOWN, INTERMEDIATE SHUTDOWN, and HOT SHUTDOWN) when the reactor trip breakers are closed and reactor power is below the permissive P-6. The Source and Intermediate Range trips in addition to the Power Range trips provide core protection during reactor startup when the reactor is critical.

The Source Range channels will initiate a reactor trip at about 1.51 x 105 counts per second unless manually blocked when P-6 becomes active. The Intermediate Range channels will initiate a reactor trip at a current level proportional to < 40% of RATED POWER unless manually blocked when P-10 becomes active. In the accident analyses, bounding transient analysis results are based on reactivity excursions from an initially critical condition, where the Source Range trip is assumed to be blocked. Accidents initiated form a subcritical condition would produce less severe results, since the Source Range trip would provide core protection at a lower power level. No credit is taken for operation of the Intermediate Range High Flux trip. However, its functional capability is required by this specification to enhance the overall reliability of the Reactor Protection System.The high and low pressurizer pressure reactor trips limit the pressure range in which reactor operation is permitted.

The high pressurizer pressure reactor trip is also a backup to the pressurizer code safety valves for overpressure protection, and is therefore set lower than the set pressure for these valves (2485 psig). The low pressurizer pressure reactor trip also trips the reactor in the unlikely event of a loss-of-coolant accident.(')

Amendment Nos.

TS 2.3-5 The overtemperature AT reactor trip provides core protection against DNB for all combinations of pressure, power, coolant temperature, and axial power distribution, provided only that the transient is slow with respect to piping transit delays from the core to the temperature detectors (about 3 seconds), and pressure is within the range between high and low pressure reactor trips.With normal axial power distribution, the reactor trip limit, with allowance for errors,(2) is always below the core safety limit as shown on TS Figure 2.1-1. If axial peaks are greater than design, as indicated by the difference between top and bottom power range nuclear detectors, the reactor limit is automatically reduced.(4)(5)The overpower and overtemperature protection system setpoints have been revised to include effects of fuel densification on core safety limits and to apply to 100% of design flow. The revised setpoints in the Technical Specifications will ensure that the combination of power, temperature, and pressure will not exceed the revised core safety limits as shown in Figures 2.1-1 through 2.1-3. The reactor is prevented from reaching the overpower limit condition by action of the nuclear overpower and overpower AT trips. The overpower limit criteria is that core power be prevented from reaching a value at which fuel pellet centerline melting would occur. The overpower protection system set points include the effects of fuel densification.

In order to operate with a reactor coolant loop out of service (two-loop operation) and with the stop valves of the inactive loop either open or closed, the overtemperature AT trip setpoint calculation has to be modified by the adjustment of the variable K 1.This adjustment, based on limits of two-loop operation, provides sufficient margin to DNB for the aforementioned transients during two loop operation.

The required adjustment and subsequent mandatory calibrations are made in the protective system racks by qualified technicians*

in the same manner as adjustments before initial startup and normal calibrations for three-loop operation.

The overpower AT reactor trip prevents power density anywhere in the core from exceeding 118%of design power density as discussed Section 7 and specified in Section 14.2.2 of the FSAR and includes corrections for axial power distribution, change in density and heat capacity of water with temperature, and dynamic compensation for piping delays from the core to the loop temperature detectors.

The specified setpoints meet this requirement and include allowance for instrument errors.(2)

Refer to Technical Report EE-01 16 for justification of the dynamic limits (time constants) for the Overtemperature AT and Overpower AT Reactor Trip functions.

• As used here, a qualified technician means a technician who meets the requirements of ANS-3.He shall have a minimum of two years of working experience in his speciality and at least one year of related technical training.Amendment Nos.

TS 2.3-6 The low flow reactor trip protects the core against DNB in the event of a sudden loss of power to one or more reactor coolant pumps. The undervoltage reactor trip protects against a decrease in Reactor Coolant System flow caused by a loss of voltage to the reactor coolant pump busses. The underfrequency reactor trip (opens RCP supply breakers and) protects against a decrease in Reactor Coolant System flow caused by a frequency decay on the reactor coolant pump busses.The undervoltage and underfrequency reactor trips are expected to occur prior to the low flow trip setpoint being reached for low flow events caused by undervoltage or underfrequency, respectively.

The accident analysis conservatively ignores the undervoltage and underfrequency trips and assumes reactor protection is provided by the low flow trip. The undervoltage and underfrequency reactor trips are retained as backup protection.

The high pressurizer water level reactor trip protects the pressurizer safety valves against water relief. Approximately 1125 ft 3 of water corresponds to 89.12% of span. The specified setpoint allows margin for instrument error(7) and transient level overshoot beyond this trip setting so that the trip function prevents the water level from reaching the safety valves.The low-low steam generator water level reactor trip protects against loss of feedwater flow accidents.

The specified setpoint assures that there will be sufficient water inventory in the steam generators at the time of trip to allow for starting delays for the Auxiliary Feedwater System.(7)

The specified reactor trips are blocked at low power where they are not required for protection and would otherwise interfere with normal unit operations.

The prescribed setpoint above which these trips are unblocked assures their availability in the power range where needed.Above 11% power, an automatic reactor trip will occur if two or more reactor coolant pumps are lost. Above 37%, an automatic reactor trip will occur if any pump is lost or de-energized.

This latter trip will prevent the minimum value of the DNBR from going below the applicable design as a result of the decrease of Reactor Coolant System flow associated with the loss of a single reactor coolant pump.Although not necessary for core protection, other reactor trips provide additional protection.

The steam/feedwater flow mismatch which is coincident with a low steam generator water level is designed for and provides protection from a sudden loss of the reactor's heat sink. Upon the actuation of the safety injection circuitry, the reactor is tripped to decrease the severity of the accident condition.

Upon turbine trip, at greater than 11 % power, the reactor is tripped to reduce the severity of the ensuing transient.

Amendment Nos.

TS 2.3-7 Permissive P-7 is made up of input signals from Turbine First Stage Pressure and NIS Power Range. Signals to the P-7 and P-10 permissives are supplied from the same bistables in the NIS Power Range drawers. P-7 and P-10 will both enable and block functions from the "trip" and"reset" points of these bistables.

The calibration procedures for the NIS Power Range bistables set the nominal trip setpoints associated with the two permissives such that they will trip whenever the measured reactor power level reaches 10% power (increasing).

When two out of four of the NIS Power Range channels trip or if one of the two Turbine First Stage Pressure channels trip the following occurs:* Permissive P-7 allows reactor trip on the following:

low flow, reactor coolant pump breakers open in more than one loop, undervoltage (RCP busses), underfrequency (RCP busses), turbine trip, pressurizer low pressure, and pressurizer high pressure." Permissive P-10 allows manual block of intermediate range reactor trip, allows manual block of power range (low setpoint) reactor trip, allows manual block of intermediate range rod stop (P-1), and automatically blocks source range reactor trip (P-6) and provides an input to P-7.The "trip" and "reset" of a bistable cannot be the same point. It is physically not possible.

There must be a deadband between the "trip" and "reset" points. The calibration procedures for the NIS Power Range bistables set the nominal reset points for the two permissives such that they reset whenever the measured reactor power level reaches 8% power (decreasing).

The P-7 input from Turbine First Stage Pressure is set to reset at 8.8% Turbine Load (decreasing).

When three out of four of the NIS Power Range channels reset or if two out of the two Turbine First Stage Pressure channels reset the following occurs:* Permissive P-7 blocks reactor trip on the following:

low flow, reactor coolant pump breakers open in more than one loop, undervoltage, underfrequency, turbine trip, pressurizer low pressure, and pressurizer high pressure.When three out of four of the NIS Power Range channels reset the following occurs:* Permissive P-10 defeats automatically the manual block of intermediate range reactor trip, defeats automatically the manual block of power range (low setpoint) reactor trip, and defeats automatically the manual block of intermediate range rod stop (P- 1).Amendment Nos.

TS 2.3-8 There are no specific Safety Analysis Limits associated with Permissives P-7 and P-10. However, they are "Assumed Available" by Nuclear Analysis and Fuel. Since P-7 and P-10 are permissives for functions with Safety Analysis Limits, for conservatism, they will be treated as if they had a Limiting Safety System Setting. In order to account for instrumentation errors, 1% of reactor power is added to the P-7 and P-10 safety functions.

This results in a Limiting Safety System Setting for the P-7 enable interlock of 11% of reactor power. The Limiting Safety System Setting for the P-10 (defeat block) interlock is 7% of reactor power.The methodology for determining the Limiting Safety System Settings (LSSS) found in TS 2.3 was developed in Technical Report EE-01 16. The Limiting Safety System Setting must be chosen so that automatic protective action will correct an abnormal situation before the safety limit is exceeded.

At Surry Power Station the Allowable Value (AV) serves as the Limiting Safety System Setting such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value during the Channel Functional Test (which is also referred to as the Channel Operational Test or COT). As such, the Allowable Value differs from the Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval.

In this manner, the actual setting of the device will still meet the LSSS definition and ensure that the Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.

If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a Technical Specification perspective.

This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.Technical Report EE-01 16 verifies that Surry's methodology for determining Allowable Values is in agreement with the intent of ISA Standard S67.04, Methods 1 and 2. In addition, it is Dominion's position that the Analytical Limit will be protected if: 1. the distance between the Trip Setpoint and the Analytical Limit is equal to or greater than the Total Loop Uncertainty for that channel and 2. the distance between the Allowable Value and the Analytical Limit is equal to or greater than the non-COT error components of the Total Loop Uncertainty and 3. the distance between the Trip Setpoint and the Allowable Value is equal to the COT error components of the Total Loop Uncertainty without any excessive margin included.Amendment Nos.

TS 2.3-9 1 Both the Trip Setpoint and the Allowable Value must be properly established in order to adequately protect the Analytical Limit.References (1) UFSAR Section 14.2.1 (2) UFSAR Section 14.2 (3) UFSAR Section 14.5 (4) UFSAR Section 7.2 (5) UFSAR Section 3.2.2 (6) UFSAR Section 14.2.9 (7) UFSAR Section 7.2 Amendment Nos.

TS 3.1-2 b. If an unscheduled loss of one or more reactor coolant pumps occurs while operating below 11 % RATED POWER (P-7) and results in less than two pumps in service, the affected plant shall be shutdown and the reactor made subcritical by inserting all control banks into the core. The shutdown rods may remain withdrawn.

c. When the average reactor coolant loop temperature is greater than 350'F, the following conditions shall be met: 1. At least two reactor coolant loops shall be OPERABLE.2. At least one reactor coolant loop shall be in operation.

d. When the average reactor coolant loop temperature is less than or equal to 350'F, the following conditions shall be met: 1. A minimum of two non-isolated loops, consisting of any combination of reactor coolant loops or residual heat removal loops, shall be OPERABLE, except as specified below: (a) One RHR loop may be inoperable for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing provided the other RHR loop is OPERABLE and in operation.(b) During REFUELING OPERATIONS the residual heat removal loop may be removed from operation as specified in TS 3.1O.A.4.2. At least one reactor coolant loop or one residual heat removal loop shall be in operation, except as specified in Specification 3.1O.A.4.Amendment Nos.

TS 3.1-4a 6. Relief Valves Two power operated relief valves (PORVs) and their associated block valves shall be OPERABLE*

whenever the Reactor Coolant System average temperature is > 350°E a. With one or both PORVs inoperable but capable of being manually cycled, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> either restore the PORV(s) to OPERABLE status or close the associated block valve(s) and maintain power to the associated block valve(s).Otherwise, be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce Reactor Coolant System average temperature to < 350'F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.b. With one PORV inoperable and not capable of being manually cycled, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> either restore the PORV to OPERABLE status or capable of being manually cycled or close the associated block valve and remove power from the block valve. In addition, restore the PORV to OPERABLE status or capable of being manually cycled within the following 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Otherwise, be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce Reactor Coolant System average temperature to < 350'F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.c. With both PORVs inoperable and not capable of being manually cycled, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> restore at least 1 PORV to OPERABLE status or capable of being manually cycled. Otherwise, close the associated block valves and remove power from the block valves. In addition, be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce Reactor Coolant System average temperature to< 350'F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.Automatic actuation capability may be blocked when Reactor Coolant System pressure is below 2010 psig.Amendment Nos.

TS 3.7-4 Instrumentation has been provided to sense accident conditions and to initiate operation of the Engineered Safety Features.(1)

Safety Injection System Actuation Protection against a loss-of-coolant or steam line break accident is provided by automatic actuation of the Safety Injection System (SIS) which provides emergency cooling and reduction of reactivity.

The loss-of-coolant accident is characterized by depressurization of the Reactor Coolant System and rapid loss of reactor coolant to the containment.

The engineered safeguards instrumentation has been designed to sense these effects of the loss-of-coolant accident by detecting low pressurizer pressure to generate signals actuating the SIS active phase. The SIS active phase is also actuated by a high containment pressure signal brought about by loss of high enthalpy coolant to the containment.

This actuation signal acts as a backup to the low pressurizer pressure actuation of the SIS and also adds diversity to protect against loss of coolant.Signals are also provided to actuate the SIS upon sensing the effects of a steam line break accident.

Therefore, SIS actuation following a steam line break is designed to occur upon sensing high differential steam pressure between the steam header and steam generator line or upon sensing high steam line flow in coincidence with low reactor coolant average temperature or low steam line pressure.The increase in the extraction of RCS heat following a steam line break results in reactor coolant temperature and pressure reduction.

For this reason, protection against a steam line break accident is also provided by low pressurizer pressure actuating safety injection.

Protection is also provided for a steam line break in the containment by actuation of SIS upon sensing high containment pressure.Amendment Nos.

TS 3.7-6 reduces the consequences of a steam line break inside the containment by stopping the entry of feedwater.

Auxiliary Feedwater System Actuation The automatic initiation of auxiliary feedwater flow to the steam generators by instruments identified in Table 3.7-2 ensures that the Reactor Coolant System decay heat can be removed following loss of main feedwater flow. This is consistent with the requirements of the "TMI-2 Lessons Learned Task Force Status Report," NUREG-0578, item 2.1.7.b.Setting Limits 1. The high containment pressure limit is set at about 8% of design containment pressure.Initiation of safety injection protects against loss of coolant(2) or steam line break(3)accidents as discussed in the safety analysis.2. The high-high containment pressure limit is set at about 21% of design containment pressure.

Initiation of containment spray and steam line isolation protects against large loss-of-coolant(2) or steam line break accidents(3) as discussed in the safety analysis.3. The pressurizer low pressure setpoint for safety injection actuation is set substantially below system operating pressure limits. However, it is sufficiently high to protect against a loss-of-coolant accident as shown in the safety analysis.(2)

The setting limit (in units of psig) is based on nominal atmospheric pressure.4. The steam line high differential pressure limit is set well below the differential pressure expected in the event of a large steam line break accident as shown in the safety analysis.(3)

5. The high steam line flow differential pressure setpoint is constant at 40% full flow between no load and 20% load and increasing linearly to 110% of full flow at full load in order to protect against large steam line break accidents.

The coincident low Tavg setting limit for SIS and steam line isolation initiation is set below its HOT SHUTDOWN value. The coincident steam line pressure setting limit is set below the full load operating pressure.

The safety analysis shows that these settings provide protection in the event of a large steam line break.(3)Amendment Nos.

TS 3.7-7 The methodology for determining the Setting Limits (SL) found in TS 3.7 was developed in Technical Report EE-01 16. The Setting Limits must be chosen so that automatic protective action will correct an abnormal situation before the safety limit is exceeded.

At Surry Power Station the Allowable Value (AV) serves as the Setting Limit such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value during the Channel Functional Test (which is also referred to as the Channel Operational Test or COT). As such, the Allowable Value differs from the Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval.

In this manner, the actual setting of the device will still meet the Setting Limit definition and ensure that the Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.

If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable from a Technical Specification perspective.

This requires corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.Technical Report EE-01 16 verifies that Surry's methodology for determining Allowable Values is in agreement with the intent of ISA Standard S67.04, Methods I and 2. In addition, it is Dominion's position that the Analytical Limit will be protected if: 1. the distance between the Trip Setpoint and the Analytical Limit is equal to or greater than the Total Loop Uncertainty for that channel and 2. the distance between the Allowable Value and the Analytical Limit is equal to or greater than the non-COT error components of the Total Loop Uncertainty and 3. the distance between the Trip Setpoint and the Allowable Value is equal to the COT error components of the Total Loop Uncertainty without any excessive margin included.Both the Trip Setpoint and the Allowable Value must be properly established in order to adequately protect the Analytical Limit.

TS 3.7-7a I Accident Monitoring Instrumentation The primary purpose of accident monitoring instrumentation is to display unit parameters that provide information required by the control room operators during and following accident conditions.

In response to NUREG-0737 and Regulatory Guide (RG) 1.97, Revision 3, a programmatic approach was developed in defining the RG 1.97-required equipment for Surry. The Surry RG 1.97 program review examined existing instrumentation with respect to the RG 1.97 design and qualification requirements.

The operability of RG 1.97 instrumentation ensures that sufficient information is available on selected unit parameters to monitor and assess unit status and response during and following an accident.

The availability of accident monitoring instrumentation is important so that the consequences of corrective actions can be observed and the need for and magnitude of further actions can be determined.

RG 1.97 applied a graded approach to post-accident indication by using a matrix of variable types versus variable categories.

RG 1.97 delineates design and qualification criteria for the instrumentation used to measure five variable types (Types A, B, C, D, and E). These criteria are divided into three separate categories (Categories 1, 2, and 3), providing a graded approach that depended on the importance to safety of the measurement of a specific variable.

Category 1 variables, listed in Table 3.7-6, are defined as follows: Category I -are the key variables deemed risk significant because they are needed to: " Determine whether other systems important to safety are performing their intended functions,* Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release, and" Provide information regarding the release of radioactive materials to allow early indication of the need to initiate action necessary to protect the public and to estimate the magnitude of any impending threat.The RG 1.97 criteria on redundancy requirements apply to Category I variables only and address single-failure criteria and supporting features, including power sources.Failures of the instrumentation, its supporting features, and/or its power source resulting in less than the required number of channels necessitate entry into the required actions.Amendment Nos.

TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Minimum Total Number OPERABLE Channels Permissible Functional Unit Of Channels Channels To Trip Bypass Conditions Operator Action 1. Manual 2 2 1 1 2. Nuclear Flux Power Range* 4 3 2 Low trip setting at P-10 2 3. Nuclear Flux Intermediate Range* 2 2 1 P-10 3 4. Nuclear Flux Source Range* P-6 a. Below P-6 -Note A 2 2 1 4 b. Shutdown -Note B 2 1 0 5 5. Overtemperature AT* 3 2 2 6 6. Overpower AT 3 2 2 6 7. Low Pressurizer Pressure*

3 2 2 P-7 7 8. Hi Pressurizer Pressure*

3 2 2 6 Note A -With the reactor trip breakers closed and the control rod drive system capable of rod withdrawal.

1 Note B -With the reactor trip breakers open.(D C

• There is a Safety Analysis Limit associated with this Reactor Trip function.

If during calibration the setpoint is found to be conservative with respect to the Limiting Safety System Setting but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.H-cd TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Functional Unit 9. Pressurizer-Hi Water Level*10. Low Flow*Total Number Of Channels 3 3/loop Minimum OPERABLE Channels 2 2/loop in each operating loop 11. Turbine Trip a. Stop valve closure b. Low fluid oil pressure 12. Lo-Lo Steam Generator Water Level*13. Underfrequency 4KV Bus 14. Undervoltage 4KV Bus 15. Safety Injection (SI) Input From ESF 16. Reactor Coolant Pump Breaker Position 4 3 3/loop 3-1/bus 3-1/bus 2 1 2 2/loop in each operating loop 2 2 2 Channels To Trip 2 2/loop in any operating loop 2/loop in any 2 operating loops 4 2 2/loop in any operating loops 2 2 1 2 P-7 Permissible Bypass Conditions Operator Action P-7 7 P-8 7 I I 7 P-7 P-7 7 7 6 I P-7 P-7 7 7 11 9 9 z 0 cj, 1/breaker 1/breaker per operating loop P-8 P-7* There is a Safety Analysis Limit associated with this Reactor Trip function.

If during calibration the setpoint is found to be conservative with respect to the Limiting Safety System Setting but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.UP)H Functional Unit 17. Low steam generator water level with steam/feedwater flow mismatch 18. a. Reactor Trip Breakers b. Reactor Trip Bypass Breakers -Note C 19. Automatic Trip Logic 20. Reactor Trip System Interlocks

-Note D a. Intermediate range neutron flux, P-6 b. Low power reactor trips block, P-7 Power range neutron flux, P-10 and Turbine impulse pressure c. Power range neutron flux, P-8*d. Power range neutron flux, P- 10 e. Turbine impulse pressure TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Minimum Total Number OPERABLE Channel Of Channels Channels To Trip 2/loop-level and 1/loop-level 1/loop-lev 2/loop-flow and 2/loop- coincider mismatch flow mismatch with 1/loo or 2/loop-level flow and l/loop-flow mismatct mismatch in same lo 2 2 1 2 1 1 S el It p-op Permissible Bypass Conditions Operator Action 6 8 11 2 2 4 2 4 4 2 2 2 3 2 3 3 2 2 1 2 2 1 13 13 13 13 13 13 z 0 Note C -With the Reactor Trip Breaker open for surveillance testing in accordance with Specification Table 4.1-1 (Item 30)Note D -Reactor Trio System Interlocks are described in Table 4.1-A* There is a Safety Analysis Limit associated with this Reactor Trip function.

If during calibration the setpoint is found to be conservative with respect to the Limiting Safety System Setting but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.t-3 C43 TS 3.7-14 TABLE 3.7-1 (Continued)

4. The QUADRANT POWER TILT shall be determined to be within the limit when above 75 percent of RATED POWER with one Power Range Channel inoperable by using the moveable incore detectors to confirm that the normalized symmetric power distribution, obtained from 2 sets of 4 symmetric thimble locations or a full-core flux map, is consistent with the indicated QUADRANT POWER TILT at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.With the number of OPERABLE channels one less than requiredby the Minimum OPERABLE Channels requirement, be in at least HOT SHUTDOWN within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> ACTION 3. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement and with the THERMAL POWER level: a. Below the P-6 (Block of Source Range Reactor Trip) setpoint, restore the inoperable channel to OPERABLE status prior to increasing THERMAL POWER above the P-6 Setpoint.b. Above the P-6 (Block of Source Range Reactor Trip) setpoint, but below 7% of RATED POWER, decrease power below P-6 or, increase THERMAL POWER above 11 % of RATED POWER within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.c. Above 11% of RATED POWER, POWER OPERATION may continue.Amendment Nos.

TABLE 3.7-2 ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Total Minimum Number OPERABLE Channels Of Channels Channels To Trip Permissible Bypass Conditions Operator Actions Functional Unit 1. SAFETY INJECTION (SI)a. Manual 2 2 b. High containment pressure*

4 3 3 c. High differential pressure between 3/steam line 2/steam line 2/steam line Primary pressure less than any steam line and the steam on any steam 2010 psig, except when reactor is header* line critical 21 17 20 d. Pressurizer low-low pressure*e. High steam flow in 2/3 steam lines coincident with low Tavg or low steam line pressure*1) Steam line flow*3 2 2 Primary pressure less than 2010 psig, except when reactor is critical 20 1 2/steam line I/steam line 1/steam line any two lines Reactor coolant Tavg less than 5450 during heatup and cooldown 2) Tavg*1/loop 1/loop any two loops 1/line 1/line any two loops z C cj1 3) Steam line pressure*f. Automatic actuation logic I/loop any Reactor coolant Tavg less than 5450 two loops during heatup and cooldown I/line any two Reactor coolant Tavg less than 545'loops during heatup and cooldown I 20 I 20 20 2 2 14* There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.00 TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Total Number Functional Unit Of Channels Minimum OPERABLE Channels Channels To Trip Permissible Bypass Conditions Operator Actions 2. CONTAINMENT SPRAY a. Manual b. High containment pressure (Hi-Hi)*c. Automatic actuation logic 3. AUXILIARY FEEDWATER a. Steam generator water level low-low*1) Start motor driven pumps 2) Starts turbine driven pump b. RCP undervoltage starts turbine driven pump c. Safety injection

-start motor driven pumps d. Station blackout -start motor driven pumps I set 4 2 1 set 3 2 I seto 3 1 15 17 14 3/steam generator 3/steam generator 3 2/steam generator 2/steam generator 2 2/steam generator any I generator 2/steam generator any 2 generators 2 20 20 CL z 0?I~See #1 above (all SI initiating functions and requirements) 20 24 I/bus 1/bus 2 transfer 2 transfer buses/unit buses/unit 2* Must actuate 2 switches simultaneously

• There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefimed calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.H TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Total NumberOPERABLE Permissible Channels Bypass Operator To Trip Conditions Actions Functional Unit Of Channels Channels 3. AUXILIARY FEEDWATER (continued)

e. Trip of main feedwater pumps -start motor driven pumps f. Automatic actuation logic 4. LOSS OF POWER a. 4.16 kv emergency bus undervoltage (loss of voltage)b. 4.16 kv emergency bus undervoltage (degraded voltage)5. NON-ESSENTIAL SERVICE WATER ISOLATION a. Low intake canal level*b. Automatic actuation logic 6. ENGINEERED SAFEGAURDS ACTUATION INTERLOCKS

-Note A a. Pressurizer pressure, P-Il b. Low-low Tavg, P-12 2/MFW pump 2 3/bus 3/bus 4 2 3 3 1/MFW pump 2 2/bus 2/bus 3 2 2 2 2-1 each MFW pump 1 2/bus 2/bus 3 1 2 2 1 2 I 2 1 24 22 26 26 20 14 23 23 24 25 14 25 14 c. Reactor trip, P-4 2 2> (Unit 1) 7. RECIRCULATION MODE TRANSFER a. RWST Level -Low* 4 3 b. Automatic Actuation Logic and Actuation Relays 2 2 E (Unit 2) 7. RECIRCULATION MODE TRANSFER a. RWST Level -Low-Low* 4 3 Zb. Automatic Actuation Logic and Actuation Relays 2 2 Note A -Engineered Safeguards Actuation Interlocks are described in Table 4.1-A I* There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.

TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Total NumberOPERABLE Of Channels Channels Functional Unit (Unit 2) 8. RECIRCULATION SPRAY a. RWST Level -Low Coincident with High High Containment Pressure*b. Automatic Actuation Logic and Actuation Relays Channels To Trip 2 1 Permissible Bypass Operator Conditions Actions 20 14 4 2 3 2* There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.CD z 0?I, C, tQ TABLE 3.7-3 INSTRUMENT OPERATING CONDITIONS FOR ISOLATION FUNCTIONS Total Minimum Number OPERABLE Channels Permissit Unit Of Channels Channels To Trip Bypass Cond le Litions Operator Actions Functional

1. CONTAINMENT ISOLATION a. Phase I 1) Safety Injection (SI)2) Automatic initiation logic 3) Manual b. Phase 2 1) High containment pressure*2) Automatic actuation logic 3) Manual c. Phase 3 1) High containment pressure (Hi-Hi setpoint)*

2) Automatic actuation logic 3) Manual 2. STEAMLINE ISOLATION a. High steam flow in 2/3 lines coincident with 2/3 low Tag or 2/3 low steam pressures*

• Must actuate 2 switches simultaneously See Item #1, Table 3.7-2 (all SI initiating functions and requirements) 2 2 4 2 2 4 2 2 3 2 2 3 1 1 3 1 1 14 21 17 14 21 17 14 15 3 1 1 set*2 1 set 2 1 set n z C See Item #1 .e Table 3.7-2 for operability requirements

• There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.

TABLE 3.7-3 (Continued)

INSTRUMENT OPERATING CONDITIONS FOR ISOLATION FUNCTIONS Total Number Of Channels Minimum OPERABLE Channels Channels To Trip Permissible Bypass Conditions Operator Actions Functional Unit STEAMLINE ISOLATION (continued)

b. High containment pressure (Hi-Hi setpoint)*

4 3 3 17 21 22 I c. Manual l/steamline 1/steamline 1/steamline 1 d. Automatic actuation logic 3. TURBINE TRIP AND FEEDWATER ISOLATION 2 2 When all MFRV, SG FWIV & associated bypass valves are closed& deactivated or isolated by manual valves.0.0 cjn a. Steam generator water-level high-high*

b. Automatic actuation logic and actuation relay c. Safety injection 3/steam generator 2 2/steam generator 2 2/in any one steam generator 20 22 I 1 See Item #1 Table 3.7-2 (all SI initiating functions and requirements)

• There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.t,,3 TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No. Functional Unit 1 High Containment Pressure (High Containment Pressure Signal)*2 High-High Containment Pressure (High-High Containment Pressure Signals)*3 Pressurizer Low-Low Pressure*4 High Differential Pressure Between Steam Line and the Steam Line Header*Channel Action a) Safety Injection b) Containment Vacuum Pump Trip c) High Press. Containment Isolation d) Safety Injection Containment Isolation e) F.W. Line Isolation a) Containment Spray b) Recirculation Spray c) Steam Line Isolation d) High- High Press. Containment Isolation a) Safety Injection b) Safety Injection Containment Isolation c) F.W. Line Isolation a) Safety Injection b) Safety Injection Containment Isolation c) F.W. Line Isolation Setting Limit< 18.5 psia< 24 psia I> 1,770 psig< 135 psid 5 High Steam Flow in 2/3 Steam Lines* a) Safety Injection< 40% (at zero load) of full steam flow< 40% (at 20% load) of full steam flow< 110% (at full load) of full steam flow CD:Z 0 b) Steam Line Isolation c) Safety Injection Containment Isolation d) F.W. Line Isolation Coincident with Low Tavg or Low Steam Line Pressure*> 541 0 F Tavg> 510 psig steam line pressure I* There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.590a.

TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No. Functional Unit 6 AUXILIARY FEEDWATER a. Steam Generator Water Level Low-Low*b. RCP Undervoltage

c. Safety Injection d. Station Blackout e. Main Feedwater Pump Trip 7 LOSS OF POWER a. 4.16 KV Emergency Bus Undervoltage (Loss of Voltage)b. 4.16 KV Emergency Bus Undervoltage (Degraded Voltage)8 NON-ESSENTIAL SERVICE WATER ISOLATION a. Low Intake Canal Level*Channel Action Aux. Feedwater Initiation S/G Blowdown Isolation Aux. Feedwater Initiation Aux. Feedwater Initiation Aux. Feedwater Initiation Aux. Feedwater Initiation Setting Limit> 16.0% narrow range> 70% nominal All S.I. setpoints>_ 46.7% nominal N.A.Emergency Bus Separation and Diesel start Emergency Bus Separation and Diesel start Isolation of Service Water flow to non-essential loads> 2975 volts and < 3265 volts with a 2 (+5, -0.1) second time delay> 3830 volts and < 3881 volts with a 60 (+/- 3.0) second time delay (Non CLS, Non SI)7 (+/-0.35) second time delay (CLS or SI Conditions)

CD z 23 feet-5.85 inches I* There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.C\

TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No. Functional Unit (Unit 1) 9 RECIRCULATION MODE TRANSFER a. RWST Level-Low*(Unit 2) 9 RECIRCULATION MODE TRANSFER a. RWST Level-Low-Low*

Channel Action Initiation of Recirculation Mode Transfer Sy'stem Initiation of Recirculation Mode Transfer System Turbine Trip Feedwater Isolation Recirculation Spray Pump Start Setting Limit> 12.7%< 14.3%> 12.7%< 14.3%< 76% narrow range> 59%<61%10 TURBINE TRIP AND FEEDWATER ISOLATION a. Steam Generator Water Level High-High*(Unit 2) 11 RWST Level Low (coincident with High High Containment Pressure)*

I* There is a Safety Analysis Limit associated with this ESF function.

If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The methodologies used to determine the calibration tolerance are specified in a document controlled under 10 CFR 50.59.z 0 (-)

TABLE 4.1-1 (Continued)

MINIMUM FREQUENCIES FOR CHECK, CALIBRATIONS AND TEST OF INSTRUMENT CHANNELS Channel Description

39. Steam/Feedwater Flow and Low S/G Water Level 40. Intake Canal Low (See Footnote 1)41. Turbine Trip and Feedwater Isolation a. Steam generator water level high b. Automatic actuation logic and actuation relay 42. Reactor Trip System Interlocks

a. Intermediate range neutron flux, P-6 b. Low reactor trips block, P-7 c. Power range neutron flux, P-8 d. Power range neutron flux, P-10 e. Turbine impulse pressure Footnote 1: Check Calibrate Test Remarks S R Q(M) 1) The provisions of Specification 4.0.4 are not applicable D R M(l), 1) Logic Test Q(2) 2) Channel Electronics Test S R R N.A.Q M(l) 1) Automatic actuation logic only, actuation relays tested each refueling R(2) 1) Neutron detectors may be excluded from the calibration

2) The provisions of Specification 4.0.4 are not applicable.

R(2)R(2)N.A. R(l)N.A.N.A.R(I)R(1)z 0 N.A. R(1)N.A. R R(2)R Check Consists of verifying for an indicated intake canal level greater than 23'-5.85" that all four low level sensor channel alarms are not in an alarm state.Calibration Consists of uncovering the level sensor and measuring the time response and voltage signals for the immersed and dry conditions.

It also verifies the proper action of instrument channel from sensor to electronics to channel output relays and annunciator.

Only the two available sensors on the shutdown unit would be tested.Tests 1) The logic test verifies the three out of four logic development for each train by using the channel test switches for that train.2) Channel electronics test verifies that electronics module responds properly to a superimposed differential millivolt signal which is equivalent to the sensor detecting a "dry" condition.

C,., 00 Serial No. 07-0470 Docket Nos. 50-280/281 Attachment 4 Technical Report EE-0116, Revision 3 with Addendum 1 (North Anna results not included.)

Revised Setting Limits and Overtemperature AT / Overpower AT Time Constants Surry Power Station Units I and 2 Virginia Electric and Power Company (Dominion)

NDC 3.1 Atahmn', Technical Report Addendum Technical Report Number Rev. No. Addendum.

No. QA. Cat.EE-0116 3 1 SR Title: ALLOWABLE VALUES FOR NORTH ANNA IMPROVED TECHNICAL SPECIFICATIONS (ITS) TABLES 3.3.1-1 AND 3.3.2-1 AND SETTING LIMITS FOR SURRY CUSTOM TECHNICAL SPECIFICATIONS (CTS), SECTIONS 2.3 AND 3.7 Reason for Change: Technical Report EE-01 16, Revision 3 did not address the Turbine First Stage Pressure input to Permissive P-7 for Surry Power Station. This addendum revises the discussion on Page 104 to add the current and proposed Trip and Reset Setpoints for the Turbine First Stage Pressure inputs to Permissive P-7. Note that the proposed Allowable Value for Permissive P-7, as detailed in Technical Report EE-01 16, Revision 3 is still valid for both the NIS and Turbine First Stage Pressure inputs to Permissive P-7 at Surry Power Station.Description of Changes (Pages Added/Removed):

This Addendum replaces Page 104 of Technical Report EE-01 16, Revision 3 with the attached page 104 denoted as Technical Report EE-01 16, Revision 3, Addendum 1, Page 104 of 134.In accordance with NDCM 3.11 the "Required Actions" and "Tracking Mechanism" will be documented in Engineering Transmittal ET-CEE-06-0020, Rev. 1 'Transmittal of Safety Review, Programs Review Checklist (PRC) and Design Input Information based on the results of Technical Report EE-01 16, Rev. 3 with Addendum 1". In addition, the results of Technical Report EE-01 16, Rev. 3, Addendum 1 will be screened as part of ET-CEE-06-0020, Rev. 1 and will not be repeated herein.Prepared by (Print name) SDiaiure Date: Donald McGrath _._____ L-/ ____ Q 7 Reviewed by (Print name) Sign Date: J. D. Desrochers VAA -,- /- 0 7 Approved by (Print name) flat Date-B. R. Morrison ___/_/_(Feb 2006)

) Dominion-Technical Report Cover Sheet Page 1 of 1 Rev. 3 NDM31 Atac TECHNICAL REPORT No. EE-0116 ALLOWABLE VALUES FOR NORTH ANNA IMPROVED TECHNICAL SPECIFICATIONS (ITS) TABLES 3.3.1-1 AND 3.3.2-1 AND SETTING LIMITS FOR SURRY CUSTOM TECHNICAL SPECIFICATIONS (CTS), SECTIONS 2.3 AND 3.7 NORTH ANNA POWER STATION AND SURRY POWER STATION NED, I&C/COMPUTERS NUCLEAR ENGINEERING DOMINION December 2006 Prepared B,7- .Prenared BV: ZSQ1J 4_. v: Date Date/?--I?-o (Da e Date/Date QA Category SR Key Words: Allowable Values Improved Technical Specifications Setting Limits Setpoints Reactor Trip System Instrumentation ESFAS Instrumentation (June 2006)

EE-0116 Revision 3 Record of Revision Rev 0 Original Issue.Rev 1 1. Changed the calculation of the Allowable Values for North Anna's High Steam Flow in 2/3 Steam Lines ESFAS initiation on Page 23. The revised Allowable Values are based on using only 1 Rack Drift (RD) term for the function.

This change yields more conservative Allowable Values.2. Changed the calculation of the Allowable Values for Surry's High Steam Flow in 2/3 Steam Lines ESFAS initiation on Pages 29 and 30.The revised Allowable Values are based on using only 1 Rack Drift (RD)term for the function.

This change yields more conservative Allowable Values.3. Changed the Allowable Values and verbiage on Page 42 for the North Anna High Steam Flow in 2/3 Steam Lines ESFAS initiation.

4. Deleted the Allowable Values for the enable manual block of Safety Injection for North Anna Permissives P-11 and P-12 and revised the verbiage accordingly on Page 47.5. Changed the Allowable.Values and verbiage on Page 56 for the Surry High Steam Flow in 2/3 Steam Lines ESFAS initiation.

6. Deleted the Allowable Values for the enable manual block of Safety Injection for Surry Permissives P- 11 and P- 12 and revised the verbiage accordingly on Page 63.Rev 2 1. Page 16 -Changed Rack Drift term RD 4 from 1.0 % span to 0.0 % span in Figure 3.2-5 to obtain a more conservative Allowable Value for the OTAT Reactor Trip Setpoint.2. Page 18 -Changed Rack Drift term RD 4 from 1.0 % span to 0.0 % span to be consistent with Calculation EE-0415. This change yields a more conservative Allowable Value for the OTAT Reactor Trip Setpoint.3. Page 24 -Changed Rack Drift term RD 4 from 1.0 % span to 0.0 % span in Figure 3.3-2 to obtain a more conservative Allowable Value for the OTAT Reactor Trip Setpoint.i EE-0116 Revision 3 4. Page 25 -Changed Rack Drift term RD 4 from 1.0 % span to 0.0 % span to be consistent with Calculation EE-0434. This change yields a more conservative Allowable Value for the OTAT Reactor Trip Setpoint.5. Pages 25 and 26 -Revised calculations shown in Methods la through 2b based on Rack Drift Term RD 4 = 0.0 % span.6. Page 31 -Changed Rack Drift term RD 4 from 1.0 % span to 0.0 % span in Figure 3.3-4 to obtain a more conservative Allowable Value for the OPAT Reactor Trip Setpoint.7. Page 32 -Changed Rack Drift term RD 4 from 1.0 % span to 0.0 % span to be consistent with Calculation EE-0415. This change yields a more conservative Allowable Value for the OPAT Reactor Trip Setpoint.

The Allowable Value calculation shown on Page 32 was revised based on RD 3= 0.0 % span.8. Pages 34 and 35 -Revised NAPS OTAT Reactor Trip Allowable Value and associated verbiage in Item 4.1.8.9. Page 47 -Added another Allowable Value for NAPS Permissive P-12 and revised associated verbiage in Item 4.2.38.10. Page 49 -Revised SPS OTAT Reactor Trip Allowable Value and associated verbiage in Item 4.3.6.11. Page 49 -Revised verbiage associated with the SPS OPAT Reactor Trip Allowable Value in Item 4.3.7.12. Page 63 -Added another Allowable Value for SPS Permissive P-12 and revised associated verbiage in Item 4.4.42.Rev 3 Revision 3 to this Technical Report is a major revision.

The Allowable Values for North Anna's ITS and the Setting Limits for Surry's CTS are derived and based on Methods 1 or 2 as described in Part II of ISA-RP67.04.02-2000.

This revision will require a complete review from cover to cover. This Technical Report will be used as the design basis for Technical Specifications Change Request 318 at Surry Power Station. In addition, this Technical Report will also be used as the design input for a future Technical Specifications Change Request for North Anna to change selected Allowable Values as noted in this report. In accordance with NDCM 3.11 the "Required Actions" and 'Tracking Mechanism" will be documented in Engineering Transmittal ET-CEE-06-0020, Rev. 0 'Transmittal of CDS and PRC for Technical Report EE-01 16, Rev. 3". In addition, the results of Technical Report EE-01 16, Rev. 3 will be screened as part of ET-CEE-06-0020, rev.0 and will not be repeated herein.ii EE-0116 Revision 3 Page I of 134 TABLE OF CONTENTS SECTION PAGE

1.0 INTRODUCTION

1.1 Purpose

1.2 Scope 2.0 OVERVIEW 2 2 2 3 3 6 6 6 8 8 9 2.1 Definitions 2.2 The Significance of the Allowable Value 2.2.1 Background

2.2.2 Addressing

Recent NRC Concerns Associated With Allowable Values 2.2.3 The NRC Position Concerning the LSSS and AV 2.2.4 The ISA, NEI and Various Industry Groups Position Concerning the LSSS and AV 2.2.5 The Dominion Virginia Power Position Concerning the LSSS and AV 3.0 METHODOLOGY

3.1 Introduction

3.2 Functional Groups for RTS and ESFAS Instrumentation 3.3 The Instrumentation, Systems and Automation (ISA) Methodologies used to Calculate Allowable Values 3.3.1 Method 1 3.3.2 Method 2 3.3.3 Method 3 3.3.4 Method 3 with additional margin 3.4 Methodology for Determining North Anna "Allowable Values" and Surry "Setting Limits" 3.4.1 Primary RTS and ESFAS Trips and Permissives credited in the Safety Analysis 3.4.2 Backup RTS and ESFAS Trips and Permissives not credited in the Safety Analysis 3.4.3 Calculating Actual Allowable Values for North Anna and Setting Limits for Surry 4.0 RESULTS 4.1 Allowable Values for North Anna ITS Table 3.3.1-1 (RTS Instrumentation)

4.2 Allowable

Values for North Anna ITS Table 3.3.2-1 (ESFAS Instrumentation)

4.3 Setting

Limits for Surry Power Station Custom Technical Specifications, Section 2.3, Limiting Safety System Settings, Protective Instrumentation and Protective Instrumentation Settings for Reactor trip Interlocks.

4.4 Setting

Limits for Surry Power Station Custom Technical Specifications, Table 3.7-4, Engineered Safety Features Actuation System Instrumentation Setting Limits and Table 3.7-2, Engineered Safety Features Actuation System Instrumentation Operating Conditions 10 10 10 19 20 21 21 22 23 23 25 25 33 33 56 81 108

5.0 REFERENCES

129 EE-0116 Page 2 of 134 Revision 3

1.0 INTRODUCTION

1.1 Purpose

The purpose of this document is to provide a comprehensive and controlled reference which details the bases for the Allowable Values that appear in North Anna Power Station Improved Technical Specifications (ITS) and the Setting Limit Values that appear in Surry Power Station Custom Technical Specifications (CTS).1.2 Scope* This document provides the basis for the Allowable Values to be used in North Anna Power Station Improved Technical Specifications, Table 3.3.1-1, Reactor Trip System Instrumentation (NAPS).* This document provides the basis for the Allowable Values to be used in North Anna Power Station Improved Technical Specifications, Table 3.3.2-1, Engineered Safety Feature Actuation System Instrumentation (NAPS)." This document provides the basis for the Setting Limit Values to be used in Surry Power Station Custom Technical Specifications, Section 2.3, Limiting Safety System Settings, Protective Instrumentation." This document provides the basis for the Setting Limit Values to be used in Surry Power Station Custom Technical Specifications, Table 3.7-4, Engineered Safety Feature System Initiation Limits Instrument Setting and Table 3.7-2, Engineered Safeguards Action Instrument Operating Conditions.

EE-0116 Page 3 of 134 Revision 3 2.0 OVERVIEW 2.1 Definitions Accuracy -A degree of conformity of an indicated value to a recognized, accepted standard value or ideal value.Allowable Value -Also known as the "Limiting Safety System Setting (LSSS)" is the threshold value used to determine channel operability during the performance of channel functional tests and channel calibrations.

Analytical Limit (AL) -The setpoint value assumed in the Safety Analysis.

In the context of this document, the Analytical Limit is the same as the Safety Analysis Limit (SAL).Calibrated Range -The calibration span of the sensor/transmitter as it applies to the indicated process range of the loop/system.

Channel Statistical Allowance (CSA) -The total instrument loop uncertainty (usually expressed in percent of instrument span) where non-interactive error components are combined statistically and interactive error components are summed arithmetically in accordance with Dominion Virginia Power Standard STD-EEN-0304 (Ref. 5.5). The generic CSA equation and a summary of error terms are provided below in Table 2.1.Channel Operational Test (COT) -A COT shall be the injection of a simulated or actual signal into the channel as close to the sensor as practicable to verify OPERABILITY of all devices in the channel required for channel OPERABILITY.

The COT shall include adjustments, as necessary, of the required alarm, interlock, and trip setpoints required for channel OPERABILITY such that the setpoints are within the necessary range and accuracy.

The COT may be performed by means of any series of sequential, overlapping, or total channel steps. In the context of this document, the Channel Operational Test is the same as a Channel Periodic Test or Channel Functional Test.Instrument Loop -An arrangement or chain of modules or components as required to generate one or more protective/control signals and/or- provide indication and recording functions.

An Instrument Loop normally includes the following five elements; the process, a transmitter/sensor, process electronics, indications and/or automatic control elements.Margin -The resultant value when the Channel Statistical Allowance (CSA) value is subtracted from the Total Allowance Value (usually expressed in percent of span or the process/signal values corresponding to these).Module -A generic term for a Westinghouse Nuclear Instrumentation Module, Westinghouse 7300 Series PC Card or a Westinghouse/Hagan 7100 Electronic Module.Nominal Trip Setpoint -The desired setpoint for the variable.

Initial calibration and subsequent re-calibrations should be made at the Nominal Trip Setpoint value specified in approved plant documentation.

EE-0116 Page 4 of 134 Revision 3 Operating Margin -The difference between the nominal operating value for the process parameter and the most limiting trip/alarm setpoint/control limit (usually expressed in percent of span or the process/signal values corresponding to these).Process Range -The upper and lower limits of the operating region for a device, e.g., for a Pressurizer Pressure Transmitter, 0 to 3000 PSIG, for Steam Generator Level, 0 to 100 % Level. This is not necessarily the calibrated range of the device, e.g., for the Pressurizer Pressure Transmitter, the typical calibrated range is 1700 to 2500 PSIG.Rack Error Components

-These are the error terms associated with the process modules that are used to develop a Channel Statistical Allowance (CSA) value for a particular trip/alarm function.

These rack error components are the calibration tolerances associated with the process modules for a module calibration (M1, M2 ... Mn) or (RCA & RCSA) for string calibration and an uncertainty value to account for Rack Drift (RD). These rack error components are combined statistically to determine the maximum allowable error which, ideally, should be used to determine the Allowable Value/Setting Limit.Safety Analysis Limit (SAL) -The setpoint value assumed in the Safety Analysis.Setting Limit -The Setting Limit is a term used in the Surry Power Station CTS to define the threshold value used to determine channel operability during the performance of channel functional tests and channel calibrations.

In the context of this document, the CTS Setting Limit used for Surry Power Station is equivalent to the ITS Allowable Value used for North Anna Power Station.Span -The difference between the upper and lower range values of a process parameter or the signal values corresponding to these.Tolerance

-The allowable deviation from an ideal calculated value.Total Allowance

-The difference between the Nominal Trip Setpoint and the Safety Analysis Limit (usually expressed in percent of span or the process/signal values corresponding to these).Total Loop Uncertainty (TLU) -The total instrument loop uncertainty (usually expressed in percent of instrument span) where non-interactive error components are combined statistically and interactive error components are summed arithmetically in accordance with Dominion Virginia Power Standard STD-EEN-0304 (Ref. 5.5). In the context of this document, the Total Loop Uncertainty (TLU) is the same as the Channel Statistical Allowance (CSA). The generic CSA equation and a summary of error terms are provided below in Table 2.1.

EE-0116 Revision 3 Page 5 of 134 Table 2.1: Channel Statistical Allowance (CSA) Equation and Error Term Definitions CSA = SE + [EA 2 + PMA 2 + PEA 2 + (SCA+SMTE) 2 + SD 2 + SPE 2 + STE 2 + SPSE 2 + (MI+M1MTE) 2 +(M2+M2MTE) 2 + ... + (Mn+MnMTE) 2 + RD 2 + RTE 2 + RIRA 2 i]2 Systematic Error (SE) Systematic Error is treated as a bias (unidirectional) and is always placed outside of the radical. Examples of Systematic Error are transmitter reference leg heatup, uncorrected Sensor Pressure Effects (SPE) and the SG Mid Deck Plate bias.Environmental Allowance (EA) Environmental Allowance is normally associated with instrument loop sensors and equipment that is subjected to a HARSH environment during DBE and/or PDBE conditions.

EA is made up of Insulation Resistance (IR) Effects, Radiation Effects (RE), Steam Pressure Temperature Effects (SPTE) and Seismic Mounting Effects (SME).Process Measurement Accuracy (PMA) Process Measurement Accuracy is an allowance for non-instrument related effects that directly influence the accuracy of the instrument loop. Examples of PMA are fluid stratification effects on temperature measurement and the effects of fluid density changes on level measurement.

Primary Element Accuracy (PEA) Primary Element Accuracy is an allowance for the inaccuracies of the system element that quantitatively converts the measured variable energy into a form suitable for measurement.

Sensor Calibration Accuracy (SCA) Sensor Calibration Accuracy is a number or quantity that defines a limit that errors will not exceed when a sensor is used under specified operating conditions, i.e., the calibration accuracy of the sensor.Sensor Measuring

& Test Equipment (SMTE) Sensor Measuring

& Test Equipment is associated with the accuracy of the Measuring and Test Equipment (M&TE) used to calibrate the loop sensor(s).

Examples of SMTE are Test Gauges and Digital Multimeters (DMM).Sensor Drift (SD) Sensor Drift is an allowance for the change in the input versus output relationship of the sensor over a period of time under specified reference operating conditions.

Sensor Pressure Effects (SPE) Sensor Pressure Effects are allowances for the steady-state pressure applied to a device. Normally, SPE applies only for differential pressure devices and is associated with the change in input-output relationship due to a change in static pressure.

SPE is divided into two terms, Static Pressure Zero Effect (SPZE) and Static Pressure Span Effect (SPSE).Sensor Temperature Effects (STE) Sensor Temperature Effect is an allowance for the effects of changes in the ambient temperature surrounding the sensor.Sensor Power Supply Effect (SPSE) Sensor Power Supply Effect is an allowance for the effects of changes in the power supply voltage applied to the sensor.Module Calibration Accuracy (Ml through Mn) Module M1 to Mn is an Allowance for the accuracy of an assembly of interconnected components that constitute an identifiable device, instrument, or piece of equipment.

A module can be disconnected, removed as a unit and replaced with a spare. It has definable performance characteristics that permit it to be tested as a unit.Module Measuring

& Test Equipment (MnMTE) Module Measuring

& Test Equipment is associated with the accuracy of the Measuring and Test Equipment (M&TE) used to calibrate the loop module(s).

Examples of MnMTE are Decade Boxes, Digital Multimeters (DMM), Test Point Resistors (TPR), Oscilloscopes and Recorders.

Rack Drift (RD) Rack Drift is an allowance for the change in the input versus output relationship of the Rack Modules (Ml through Mn) over a period of time under specified reference operating conditions.

Rack Temperature Effect (RTE) Sensor Temperature Effect is an allowance for the effects of changes in the ambient temperature surrounding the Process Racks.Rack Readability Allowance (RRA) Rack Readability Allowance is an allowance for the inability, to read analog indicators because of parallax distortion.

EE-0116 Page 6 of 134 Revision 3 2.2 The Significance of the Allowable Value 2.2.1 Background Historically, for plants that have used Westinghouse Standardized Technical Specifications (STS) such as North Anna, two values have been provided for each Reactor Trip System (RTS) and Engineered Safety Features Actuation System (ESFAS) trip function; they are referred to as the "Nominal Trip Setpoint" and the "Allowable Value" (in the context of this document, the Allowable Value, Limiting Safety System Setting "LSSS" and the Setting Limit are the same). The difference in percent of span between the Nominal Trip Setpoint and the Allowable Value was calculated, in most cases, based on a summation of the errors associated with the rack components and rack drift. For linear, non-complex trip functions, this value normally worked out to be between 1.0 % and 2.0 % of span. For complex trip functions or functions that had limited margin with respect to the Safety Analysis Limit, other calculational methods were used to determine the difference between the Nominal Trip Setpoint and the Allowable Value. For plants that do not use the Westinghouse STS version of Technical Specifications such as Surry, normally only one setpoint value (assumed to be the Setting Limit at Surry) is provided in the text with no guidance as to how to set the actual "Nominal" Trip Setpoint in the plant.Based on the early versions of the Westinghouse STS, the original definition of the LSSS (i.e., the Allowable Value) was stated as follows: "A setting chosen to prevent exceeding a Safety Analysis Limit".This Allowable Value was intended to be used during monthly or quarterly Functional Testing as a "flag" such that if a bistable (comparator)

Trip Setpoint exceeded this value, the protection channel would be declared inoperable and plant staff would be required to initiate corrective action. The intended significance of this value is that it is the point where if the value is exceeded, the implication is that the actual rack electronics and/or associated rack error components have exceeded the values assumed in the Channel Statistical Allowance (CSA) Calculation and consequently, the margin with respect to the Safety Analysis Limit has been reduced.The Allowable Value takes on added significance when there is little or no retained/available margin with respect to the Safety Analysis Limit and conversely takes on reduced significance in proportion to the amount of retained/available margin.2.2.2 Addressing Recent NRC Concerns Associated with Allowable Values Dominion Virginia Power Corporate I&C Engineering attended a meeting with the Nuclear Regulatory Commission (NRC) and Nuclear Energy Institute (NEI) in Rockville, MD on October 8, 2003 to evaluate NRC concerns associated with the "Allowable Values" used in Technical Specifications.

The "Allowable Values" of interest are those associated with Reactor Protection System (RPS) (e.g., also known as the Reactor Trip System "RTS") and Engineered Safety Features Actuation System (ESFAS) Functions that are credited in the Plant Specific Safety Analysis.

The NRC expressed a basic concern at the meeting where they have identified various plants that use a method to calculate "Allowable Values" for RTS and ESFAS functions that will reduce or eliminate margin to the Analytical Limit (AL), i.e., also known as the Safety EE-0116 Page 7 of 134 Revision 3 Analysis Limit (SAL). In the worst case scenario, the margin may be determined to be negative such that the protection function is operating outside of the analyzed region.On August 13, 2003, NRC Staff met with members of the ISA 67.04 committee and other industry groups in Rockville, MD to discuss instrument setpoint methodology and lay out their position.

The major area of discussion centered around the instrument setpoint methodology recommended in ISA Standard S67.04 used by many licensees for determining protection system instrumentation setpoints.

Part H of the standard, not endorsed by the NRC Staff, includes three methods for calculating "Allowable Values" which represent the "Limiting Safety System Settings" (LSSS) as described in 10CFR50.36.

As stated by the NRC, Methods 1 and 2 determine "Allowable Values" that are sufficiently conservative and are acceptable to the NRC Staff. According to the NRC, Method 3 does not appear to provide an acceptable degree of conservatism and is of concern to the NRC Staff. In addition, there is also a disagreement between the NRC Staff and NEIISA/Some Industry Groups as to the meaning/intent of the LSSS. These items will be addressed in this document as they apply to Surry and North Anna.As of August 2002 North Anna adopted Improved Technical Specifications (ITS). Within the North Anna ITS and ITS Bases, Allowable Values are explicitly defined and are uniquely associated with each RTS and ESFAS function, to include Backup Trips and Permissives.

The bases for the Allowable Values specified in North Anna's ITS are described in this Technical Report, noting that significant changes to the methodology used to calculate Allowable Values will be included in this revision.Surry Power Station has not adopted ITS and has decided to continue using their Custom Technical Specifications (CTS). For plants licensed before 1974, prior to the introduction of Standardized Technical Specifications (STS), the setpoints (i.e., Technical Specification Limits) included in CTS for RTS and ESFAS instrumentation were based on the plant specific setpoint study and/or based on settings provided in the Westinghouse Precautions, Limitations and Setpoints (PLS) document.

The RTS and ESFAS trip setpoints specified in CTS did not include allowances for instrument uncertainties associated with channel functional testing (i.e., the COT). These allowances were left up to the licensee to deal with and justify. At the present time, this applies to Surry. In many cases, the original CTS setpoints for RTS and ESFAS instrumentation have been determined to be unacceptable based on today's standards and setpoint methodologies.

To address this discrepancy, Surveillance Limits were issued to Surry Power Station in 1995 via Engineering Transmittal ET CEE 95-037 (Ref. 5.14). These Surveillance Limits are used in conjunction with the original CTS setpoints to ensure that RTS and ESFAS functions will operate in accordance with the setpoint methodology detailed in Dominion Virginia Power Standard STD-GN-0030 (Ref. 5.6) and the applicable CSA Calculation assumptions.

The near term plan is to prepare a Technical Specification Change Request (TSCR) to change selected CTS, RTS and ESFAS Setting Limits to values that are consistent with the setpoint methodology detailed in this document (Reference Request for Engineering Assistance REA 03-0083/4942).

The following subsections will focus on the meaning/intent of the Limiting Safety System Setting (LSSS)and the Allowable Value (AV) as understood by the NRC, ISA/NEI/Various Industry Groups and Dominion Virginia Power.

EE-0116 Page 8 of 134 Revision 3 2.2.3 The NRC Staff position concerning the LSSS and AV The following LSSS information is based on information from the NRC presentation to the ISA 67.04 Committee on August 13, 2003.JOCFR50.36(C)(1)(ii)(A) defines the Limiting Safety System Setting (LSSS) as the setting that must be chosen so that the automatic protective action will correct the abnormal situation before a safety limit is exceeded.New Improved TS Bases defines allowable value (AV) to be equivalent to LSSS and defines that a channel is operable if the trip setpoint is found not to exceed the AV during the Channel Operational Test (COT).In summary, the NRC Staff believes that the Allowable Value (AV) is equivalent to the Limiting Safety System Setting (LSSS).2.2.4 The ISA/NEI/Various Industry Groups position concerning the LSSS and AV The following information is based on the ISA 67.04 Subcommittee handout from August 13, 2003.Position Statements

• The difference between the Allowable Value (AV) and the Analytical Limit (AL) is not a direct defense of the AL.* The Trip Setpoint (TSP) protects the AL." The AV confirms the TSP.Summary* Reg Guide 1.105 endorses the calculation of the TSP using statistical methods." The AV, based on a portion of the errors, does not invalidate the TSP." The TSP protects the AL." The AV validates an error contribution assumption via periodic surveillance testing.* As long as the AV is not exceeded, the channel is OPERABLE.* During Surveillance Testing, the AV serves as the LSSS.* The errors between the AV and the AL are not part of the LSSS as defined by 10CFR50.36.

In summary, ISAINEI/Various Industry Groups believe that the Allowable Value (AV) is equivalent to the Limiting Safety System Setting (LSSS). However, their position is that the TSP is used to protect the Analytical Limit (AL). All of the items listed above are true, with the exception of "The TSP protects the AL". This is the statement that is under dispute.

EE-0116 Page 9 of 134 Revision 3 2.2.5 The Dominion Virginia Power position concerning the LSSS and AV The following definition of the Allowable Value is taken from North Anna Power Station ITS Bases, Page B.3.3.1-2, Revision 0.Use of the Trip Setpoint to define "as found" OPERABILITY and its designation as the LSSS under the expected circumstances described above would result in actions required by both the rule and technical specifications that are clearly not warranted.

However, there is also some point beyond which the device would have not been able to perform its function due, for example, to greater than expected drift.This value needs to be specified in the technical specifications in order to define OPERABILITY of the devices and is designated as the Allowable Value which, as stated above, is the same as the LSSS.The following definition of the Allowable Value is taken from the North Anna ITS Bases, Page B.3.3.1-3, Revision 0.The Allowable Value specified in Table 3.3.1-1 serves as the LSSS such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value during the CHANNEL OPERATIONAL TEST (COT). As such, the Allowable Value differs from the Trip Setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval.

In this manner, the actual setting of the device will still meet the LSSS definition and ensure that a Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.

If the actual setting of the device is found to have exceeded the Allowable Value the device would be considered inoperable for a technical specification perspective.

This requires corrective action including those actions required by 10CFR50.36 when automatic protective devices do not function as required.

Note that, although the channel is "OPERABLE" under these circumstances, the trip setpoint should be left adjusted to a value within the established trip setpoint calibration tolerance band, in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.As can be seen, the ITS Bases definition of the LSSS and the AV is consistent with the NRC Staff position.

Because the AV is the only value provided in ITS and thus the Operating License, it is the only value the NRC has available to use when evaluating plant submittals.

It is also the only value that we use to determine the OPERABILITY of RTS and ESFAS channels during the COT. Therefore, it is Dominion's position that the Analytical Limit will be protected if: 1. the distance between the Trip Setpoint and the Analytical Limit is equal to or greater than the Total Loop Uncertainty for that channel and 2. the distance between the Allowable Value and the Analytical Limit is equal to or greater than the NON-COT error components of the Total Loop Uncertainty and 3. the distance between the Trip Setpoint and the Allowable Value is equal to the COT error components of the Total Loop Uncertainty without any excessive margin included.Both the Trip Setpoint and the Allowable Value must be properly established in order to adequately protect the Analytical Limit.

EE-0116 Page 10 of 134 Revision 3 3.0 METHODOLOGY

3.1 Introduction

Many Westinghouse Plants continue to use Westinghouse or other Engineering Firms to perform some or all of their Safety Analysis Functions.

In addition, Westinghouse has also performed the RTS and ESFAS Setpoint Study for many of their plants. Typically, the Setpoint Study for these plants included the development of Channel Statistical Allowance (CSA) Calculations for Primary and some of the Backup RTS and ESFAS Trip Functions.

Derived from these Setpoint Studies and CSA Calculations are the Allowable Values that appear in various versions of Standardized Technical Specifications (STS). For the Westinghouse Plants that use Custom Technical Specifications (CTS), the setpoint values specified for RTS and ESFAS Trip Functions are not defined as Allowable Values and typically, they are the same setpoint values as those found in the original Precautions, Limitations and Setpoints (PLS) Document for that particular plant. Presently, based on Surry's Custom Technical Specifications, this is the case for many of the RTS and ESFAS trips.Dominion Virginia Power is unique in the fact that a majority of the UFSAR Chapter 14 (Surry) and Chapter 15 (North Anna) Safety Analysis is performed in house by the Corporate Nuclear Analysis & Fuels Department.

In addition, Channel Statistical Allowance Calculations for Primary and Backup RTS and ESFAS Trip Functions are performed in house by the Corporate ElectricalI&C/Computers Department.

Because Dominion Virginia Power performs their own Safety Analysis and CSA Calculations, the methodology used to determine Improved Technical Specifications (NUREG-1431 "ITS") Allowable Values for North Anna and Setting Limits for Surry Custom Technical Specifications will be similar and in some cases more conservative than that used by Westinghouse in the past to determine Allowable Values for later versions of Standardized Technical Specifications.

In addition, the methods used in this Technical Report to calculate the limiting values for North Anna and Surry will be consistent with the requirements of Methods 1 or 2 as described in ISA-RP67.04.02-2000 (Ref 5.43).3.2 Functional Groups for RTS and ESFAS Instrumentation.

Based on Dominion Virginia Power Technical Report NE-0994 (Ref. 5.1), the Reactor Trip System (RTS) and the Engineered Safety Features Actuation System (ESFAS) Instrumentation at North Anna and Surry can be divided into two major categories, i.e., Primary Trip Functions and Backup Trip Functions.

Primary Trip Functions are credited in the Plant Safety Analysis and have an associated Analytical Limit (i.e., Safety Analysis Limit). Backup Trip Functions are not credited in the Plant Safety Analysis but are included in the Reactor Trip System and the Engineered Safety Features Actuation System to enhance the overall effectiveness of the system.Primary Trip Functions include the following:

• Primary Reactor Trip Functions* Primary Reactor Trip Permissives

• Primary ESFAS Actuation Functions* Primary ESFAS Permissives EE-0116 Page 11 of 134 Revision 3 Backup Trip Functions include the following: " Backup Reactor Trip Functions* Backup Reactor Trip Permissives

• Backup ESFAS Permissives In addition to the above, there are three basic functional groups of Westinghouse Nuclear Instrumentation System (NIS), 7100 and 7300 Instrumentation that develop the majority of the RTS and ESFAS trips. These basic functional groups are divided into the three categories listed below: 1. Single parameter protection function 2. Dual parameter protection function 3. Multiple parameter protection function (i.e., more than two process parameters)

Different methods are used to calculate or validate the Allowable Values for North Anna and Setting Limits for Surry depending on whether the function is considered to be Primary or Backup. In addition, the functional group category will also effect how the Allowable Value or Setting Limit is calculated.

Some examples of functional groups are given below.Single Parameter Protection Functions* Power Range Neutron Flux High and Low Reactor Trips" Pressurizer High and Low Pressure Reactor Trips* Low Reactor Coolant Flow Reactor Trip" Containment Hi- 1, Hi-2 and Hi-3 (North Anna only) Pressure ESFAS initiation" Compensated Low Steam Line Pressure ESFAS initiation" Steam Generator Lo-2 Level ESFAS initiation Dual Parameter Protection Functions* High Steam Flow in 2/3 Lines ESFAS initiation 0 Surry High AP Steam Line vs. Steam Header ESFAS initiation

• North Anna High AP Steam Line vs. Steam Line ESFAS initiation Multiple Parameter Protection Functions* Steam Flow Feed Flow Mismatch Reactor Trip" Overpower AT Reactor Trip" Overtemperature AT Reactor Trip EE-0116 Revision 3 Page 12 of 134 Single Parameter Protection Functions North Anna The Nuclear Steam Supply System (NSSS) Protection and Control System at North Anna is made up of the Westinghouse Nuclear Instrumentation System (NIS) and the Westinghouse 7300 Series Process Control System. Most of the RTS and ESFAS trips generated from these systems are single parameter protection functions.

Figures 3.2-1 and 3.2-2 illustrate the configuration of the Westinghouse NIS and the 7300 Process Control System.Westinghouse Nuclear Instrumentation System -Power Range Reactor Trips N1301 I QU Current Meter Imps N1303%Power Meter (Di Io IT- NC306 1T 00. High Flux I SSPS o.Test Switch ihFu C, RX Trip i Trains U- Bistable A & B S+/-1.0%High Voltage Summing &Power Supply Level Amplifier t5NC305 To O/ I T~ ITest Switch ss s T est S wit h =1 Low Flux S S P S RX Trip Trains O' BistableP]&

I +/- 1.0% %Far I N1302 Near Field I Rack QL Current Meter Rack Field Figure 3.2-1 EE-0116 Revision 3 Page 13 of 134 Refer to Figure 3.2-1 : CSA Calculations performed for Reactor Trips generated by NIS typically include rack error terms associated with the meter indications (i.e., Amps, % Full Power, Counts Per Second, etc.) and the bistables that generate the trip.In the case of the Power Range High Flux Reactor Trip as shown on Figure 3.2-1, the rack error terms as defined in CSA Calculation EE-0063 (Ref. 5.15) are: (MI + M1TE) + (M5 + M5MTE) + RD + RTE Where: M1 MIMTE M5 M5MTE RD RTE= Module 1, Summing and Level Amplifier

= + 0.100 %= Module 1 Measuring and Test Equipment

= + 0.112 %= Module 5, Bistable Relay Driver = + 0.833 %= Module 5 Measuring and Test Equipment

= + 0.923 %= Rack Drift = + 1.000 %= Rack Temperature Effects = + 0.500 %Westinghouse 7300 Process Control System Low Reactor Coolant Flow Reactor Trip Foxboro E13DH+1- 0.75 %(NCTG01)Far Field (NLPG02)+/- 0.1 %+/-0.25%(MAX)(NALGO0)+/- 0.25%(MAX)(NC Sa, I TG01)Rack Near Field Rack Figure 3.2-2 Refer to Figure 3.2-2: CSA Calculations performed for Reactor Trips generated by the Westinghouse 7300 Process Control System include rack error terms associated with the PC Cards that perform signal modification and the bistables that generate the trip.In the case of the Low Reactor Coolant Flow Reactor Trip as shown on Figure 3.2-2, the rack error terms as defined in CSA Calculation EE-0060 (Ref. 5.21) are: (M1 + M1MTE) + (M2 + M2MTE) + RD + RTE EE-0116 Revision 3 Page 14 of 134 Where: Ml M1MTE M2 M2MTE RD RTE= Module 1, Loop Power Supply = + 0.100 %= Module I Measuring and Test Equipment

= + 0.153 %= Module 2, Analog Comparator "Bistable" = + 0.250 %= Module 2 Measuring and Test Equipment

= + 0.030 %= Rack Drift = + 1.000 %= Rack Temperature Effects = + 0.500 %These rack error terms along with other error terms from the CSA Calculation will be used to validate the existing Allowable Values at North Anna or to calculate revised Allowable Values, if necessary.

Surry The NSSS Protection and Control System at Surry uses the same Westinghouse Nuclear Instrumentation System (NIS) as North Anna. However, a majority of NSSS Protection and Control is developed from the Westinghouse/Hagan 7100 Series Process Control System. Like North Anna, most of the RTS and ESFAS trips generated from these systems are single parameter protection functions.

For the Westinghouse NIS, Figure 3.2-1 is also applicable for Surry. Figure 3.2-3 illustrates the configuration of the Westinghouse/Hagan 7100 Process Control System for a single input protection function.Westinghouse 7100 Process Control System Low Reactor Coolant Flow Reactor Trip Test Point Resistor TO RPS Relay Logic Rosemount 1153+/- 0.5 %131-118+/- 0.5%Technipower PM-38+1- 0.0%Fi2ure 3.2-3 Refer to Figure 3.2-3 : CSA Calculations performed for Reactor Trips generated by the Westinghouse/Hagan 7100 Process Control System also include rack error terms associated with the modules that perform signal modification and the bistables that generate the trip. The Westinghouse 7100 Process Control System mainly operates using current loops where the power supplies are not used as signal converters.

In many cases, for a single parameter protection function, the only rack module that will have a tolerance associated with it will be the Signal Comparator (i.e., the Bistable).

EE-0116 Revision 3 Page 15 of 134 In the case of Surry's Low Reactor Coolant Flow Reactor Trip as shown in Figure 3.2-3, the rack error terms from CSA Calculation EE-0 183 (Ref. 5.34) are:.(RCAcoMPAR

+ RMTE) + RD + RTE Where: RCAcoMPAR RMTE RD RTE= Rack Comparator Setting Accuracy = +/- 0.50 %= Rack Measuring and Test Equipment

= + 0.15 %= Rack Drift = + 1.00 %= Rack Temperature Effects = + 0.50 %Note the difference between North Anna's rack error terms compared with the rack error terms listed above for Surry. The error terms for the Loop Power Supply are not included in Surry's CSA Calculation because it is not used as a signal converter.

Dual Parameter Protection Functions Figure 3.2-4 illustrates a typical dual input protection function for North Anna. Channel Statistical Allowance Calculations for dual parameter protection functions are different than single parameter functions.

For example, there are more rack error terms associated with the development of the trip than a single parameter function.

The rack error terms associated with North Anna's High Steam Flow in 2/3 Lines ESFAS trip based on Calculation EE-0736 (Ref. 5.23) are given below: Westinghouse 7300 Process Control System High Steam Flow in 213 Lines ESFAS -Channel 3 (NLPGO2) (NSAG02)Foxboro Ell-GM (NCTG02) /_ 0.1 % +- 0.5 %+1- 0.75 % +/-0.25% (MAX)(MAX)Figure 3.2-4 EE-0116 Page 16 of 134 Revision 3 (Ml + MlMTE) + (M13 + M13MTE) + (M14 + M14MTE) + (M15 + M15MTE) + RD + RTE Where: M1 = Steam Flow Loop Power Supply Accuracy = +/- 0.10 %M1MTE = Module M l Measuring and Test Equipment

= + 0.153 %M13 = Turbine Load Loop Power Supply Accuracy = +/- 0.10 %M13MTE = Module M13 Measuring and Test Equipment

= + 0.153 %M14 = High Steam Flow Setpoint Summator Accuracy = + 0.50 %M14MTE = Module M14 Measuring and Test Equipment

= + 0.042 %M15 = High Steam Flow Comparator Setting Accuracy = + 0.50 %M15MTE = Module M15 Measuring and Test Equipment

= + 0.042 %RD = Rack Drift = + 1.00 %RTE = Rack Temperature Effects = + 0.50 %The rack error terms described in the example above along with other error terms from the CSA Calculation will be used to validate the existing Allowable Values at North Anna or to calculate revised Allowable Values, if necessary.

The configuration of dual parameter protection functions at Surry is similar to North Anna's. The major differences between the rack error components for both plants are based on the process control equipment as illustrated above for single input protection functions.

Multiple Parameter Protection Functions There are two multiple parameter protection functions at North Anna and three multiple parameter functions at Surry. Figure 3.2-5 is a block diagram that illustrates Surry's Overtemperature AT Reactor Trip configuration.

The configuration of North Anna's Overtemperature AT Reactor Trip is similar to Surry's noting that the process control equipment is different.

As can be seen from Figure 3.2-5, the Overtemperature AT Reactor Trip function is derived from four process parameters, they are: " THOT AVE" TCOLD* Pressurizer Pressure* Function of Delta Flux (FAI) made up of Upper Flux (Qu) and Lower Flux (QL)

EE-0116 Revision 3 Page 17 of 134-t Surry Power Station Overtemperature Delta T Protection Channet Test Sw itch Delta T Channel RD1 = +/- 1.0 % span RCA1 = +/- 0.5 % span OTDT Setpoint= 0 % Deviation Low Level"a Amplifier Thot 3 Chann el Test Sw itch R)( Trip span-1 T Average Channel RD2 = -W- 1.0 % span RCA2 = +/- 0.5 % span-I RCA5 = +/- 0.5 % span-t Fdl Penalty Channel RD4 = +1- 0.0 % span RCA4 = +/- 0.5 % span QL Channel Test Sw itch Figure 3.2-5 The Overtemperature AT Reactor Trip function is further broken down into channels as defined below: " AT Channel, made up of THOT AvE and TCOLD" TAVG Channel, made up of THOTAvW and TCOLD" Pressurizer Pressure Channel" Function of Delta Flux (FAI), made up of Qu and QL Because there are five inputs to Surry's Overtemperature AT function, the rack error components will be grouped as channel inputs versus a string of modules as shown above for the Dual Parameter Function example. This type of assessment will yield a conservative and valid Allowable Value using the four step method described above. CSA Calculation EE-0415 (Ref. 5.31) was performed using a module calibration method, which for a multiple-parameter function will result in a very conservative CSA value. However, using a module calibration method for a complex, multiple-parameter function will result in an Allowable Value or Setting Limit that is non-conservative.

The rack error components for each Overtemperature AT input channel is given below.

EE-0116 Page 18 of 134 Revision 3 AT Channel = (RCA 1 + RMTE 1) + RD 1 + RTE 1 TAVG Channel = (RCA 2 + RMTE 2) + RD 2 + RTE2 Pressurizer Pressure Channel = (RCA 3 + RMTE 3) + RD 3 + RTE 3 FAI Channel = (RCA 4 + RMTE 4) + RD 4 + RTE 4 OTAT Setpoint = (RCA 5 + RMTE 5)OTAT Bistable = (RCSA + RMTE 6)Where: RCA 1 = AT Channel Calibration Accuracy = + 0.50 %RMTE 1 = AT Channel Rack Measuring and Test Equipment

= + 0.26 %RD 1 = AT Channel Rack Drift = + 1.00 %RTE 1 = AT Channel Rack Temperature Effect = + 0.50 %RCA 2 = TAVG Channel Calibration Accuracy = + 0.50 %RMTE 2 = TAVG Channel Rack Measuring and Test Equipment

= + 0.26 %RD 2 = TAVG Channel Rack Drift = + 1.00 %RTE 2 = TAVG Channel Rack Temperature Effect = + 0.50 %RCA 3 = Pressurizer Pressure Channel Calibration Accuracy = + 0.50 %RMTE 3 = Pressurizer Pressure Channel Rack Measuring and Test Equipment

= + 0.21 %RD 3 = Pressurizer Pressure Channel Rack Drift = + 0.00 %RTE 3 = Pressurizer Pressure Channel Rack Temperature Effect = + 0.00 %RCA 4 = FAI Channel Calibration Accuracy = + 0.50 %RMTE 4 = FAI Channel Rack Measuring and Test Equipment

= + 0.21 %RD 4 = FAI Channel Rack Drift = + 0.00 %RTE 4 = FAI Channel Rack Temperature Effect = + 0.00 %RCA 5 = OTAT Setpoint Summator Calibration Accuracy = +/- 0.50 %RMTE 5 = OTAT Setpoint Summator Rack Measuring and Test Equipment

= + 0.21 %RCSA = OTAT Reactor Trip Bistable = + 0.50 %RMTE 6 = OTAT Reactor Trip Bistable Rack Measuring and Test Equipment

= + 0.21 %Some of the error terms listed above will be used to determine the Setting Limit Value for Surry's Overtemperature AT Reactor Trip. Similar error terms will be used throughout this document to evaluate the other multiple parameter protection functions at both plants.

EE-0116 Page 19 of 134 Revision 3 3.3 The Instrumentation, Systems and Automation Society (ISA) Methodologies used to calculate Allowable Values The following base line parameters will be used to illustrate how the Allowable Value is calculated using Methods 1, 2 and 3 from ISA-RP67.04.02-2000 and ISA-RP67.04-Part 11-1994.Analytical Limit (AL) = 6.00 PSIG Total Instrument Loop Uncertainty (TLU) = 1.39 PSIG Calculated Instrument Uncertainties used for COT (COT) = 1.10 PSIG Calculated Instrument Uncertainties not used for COT (NON-COT)

= 0.85 PSIG Notes: 1. In the context of this document, the Analytical Limit (AL) and the Safety Analysis Limit have the same meaning.2. In the context of this document, Total Instrument Loop Uncertainty (TLU) and the Channel Statistical Allowance (CSA) have the same meaning.3. COT means Channel Operational Test.4. COT Instrument Uncertainties are made up of the portion of the loop that is tested during the COT.For Surry and North Anna, these error components are:* Rack or Module Calibration Accuracy (RCA or Ml, M2 ... Mn)* Rack Comparator Setting Accuracy or Comparator Module Calibration Accuracy (RCSA or Mn)* Rack Drift (RD)5. NON-COT Instrument Uncertainties are made up of the portion of the loop that is not tested during the COT. For Surry and North Anna, these error components may include:* Systematic Error (SE)* Environmental Allowance (EA)* Process Measurement Accuracy (PMA)* Primary Element Accuracy (PEA)* Sensor Calibration Accuracy and Sensor Measuring and Test Equipment (SCA + SMTE)* Sensor Drift (SD)* Sensor Pressure Effect(s) (SPE)* Sensor Temperature Effect (STE)* Sensor Power Supply Effect (SPSE)* Rack Measuring and Test Equipment (RMTE or M1MTE, M2MTE ... MnMTE)* Rack Temperature Effect (RTE)

EE-0116 Page 20 of 134 Revision 3 3.3.1 Method 1 Method 1 has been evaluated by the NRC Staff and was found to be an acceptable method to be used to calculate Allowable Values. Method 1 uses a TLU equal to 1.39 PSIG. The TLU was arrived at statistically using the Square Root Sum of the Squares (SRSS) method of combining channel error components.

This is an accepted industry standard and is used here at Dominion Virginia Power. The channel error components used for the COT are equal to 1.10 PSIG and the error components used for the NON-COT are equal to 0.85. With a TLU equal to 1.39 PSIG and NON-COT errors equal 0.85 PSIG, then statistically, the COT error would be equal to 1.10 PSIG as shown below.[(0.85)2 + (1.10)2] 1, = 1.39 or [(1.39)2 _ (0.85)2] / = 1.10 If the COT error allowance were to be removed from the TLU, the statistical combination of the NON-COT error allowances would be equal to 0.85 PSIG. This means that the LSSS would have to be set such that the margin of 0.85 PSIG is maintained between the AV and the AL. To accomplish this using a COT error allowance of 1.10 PSIG, a determinant assessment must be used such that the COT allowance can only be equal to the TLU minus the NON-COT allowance, i.e., COT = 1.39 PSIG -0.85 PSIG = 0.54 PSIG. In Method 1, the user decides that for the Channel Operational Test, the full COT allowance of 1.10 PSIG is to be retained.

To maintain the full COT error allowance, the actual trip setpoint (ACT SP) is set below the calculated trip setpoint (CAL SP). Note that the difference between the CAL SP and the Allowable Value (AV) is 0.54 PSIG. The remainder of the desired COT allowance of 1.10 PSIG is obtained by lowering the ACT SP below the CAL SP by 0.56 PSIG to yield the ACT SP value of 4.05 PSIG. Method 1 ensures that the full NON-COT allowance of 0.85 PSIG is available under all conditions for the non-tested channel error components.

METHOD 1: AL = 6.00 PSIG NON COT = 0.85 TLU = 1.39 .. .1.39IF --AV = 5.15 PSIG COT= 1.10---------- CAL SP = 4.61 PSIG'ACT SP = 4.05 PSIG LEGEND: TLU = TOTAL LOOP UNCERTAINTY AL = ANALYTICAL LIMIT (SAL) AV = ALLOWABLE VALUE NON COT = NON TESTED LOOP UNCERTAINTY COT = TESTED LOOP UNCERTAINTY CAL SP = CALCULATED SETPOINT ACT SP = ACTUAL SETPOINT Figure 3.3-1 EE-0116 Page 21 of 134 Revision 3 3.3.2 Method 2 Method 2 has been evaluated by the NRC Staff and was found to be an acceptable method to be used to calculate Allowable Values. Method 2 is essentially the same as Method 1 with the exception that the ACT SP is set equal to the CAL SP (i.e., 4.61 PSIG). This method does not allow for the full value of the COT error components as determined in the TLU (i.e., CSA Calculation).

In some cases, this could cause the plant to find the AS FOUND Trip Setpoint outside of the AV more often than would be the case using Method 1. Like Method 1, Method 2 ensures that the statistical combination of the NON-COT error allowances (equal to 0.85 PSIG) is maintained between the AV and the AL under all conditions.

METHOD 2: AL = 6.00 PSIG NON COr = 0.85 TLU 1.39-AV = 5.15 PSIG COT = 0.54 CAL & ACT SP = 4.61 PSIG LEGEND: TLU = TOTAL LOOP UNCERTAINTY AL = ANALYTICAL LIMIT (SAL) AV = ALLOWABLE VALUE NON COT = NON TESTED LOOP UNCERTAINTY COT = TESTED LOOP UNCERTAINTY CAL SP = CALCULATED SETPOINT ACT SP = ACTUAL SETPOINT Figure 3.3-2 3.3.3 Method 3 Method 3 has been evaluated by the NRC Staff and was found to be an unacceptable method to be used to calculate Allowable Values. Method 3 has been used to calculate the Allowable Value in many Westinghouse Plants that used early versions of Standardized Technical Specifications (STS) as discussed above in Section 3.1. Using a determinant assessment, Method 3 does ensure that the full NON-COT uncertainty allowance is maintained between the AV and the AL. To ensure that the NON-COT uncertainty allowance is maintained under all conditions, the AV must be set for < 5.15 PSIG. As can be seen from the illustration below, the AV using Method 3 is set for 5.71 PSIG, i.e., CAL SP/ACT SP + COT= 5.71 PSIG. If the rack error components are allowed an offset of 1.10 PSIG before the channel is declared INOPERABLE, then the allowance for the NON-COT uncertainty is decreased to 0.29 PSIG. If the AS FOUND COT error was found to be (+) 1.05 PSIG and the AS FOUND NON-COT error was determined to be (+) 0.85 PSIG, then the channel trip function would have exceeded the Analytical Limit (i.e., SAL) and should be declared INOPERABLE.

However, in accordance with Technical Specifications, the channel does not have to be declared INOPERABLE until the AS FOUND Trip Setpoint exceeds the Allowable Value. This is the concern that the NRC Staff has with Method 3. In the case of Method 3 using EE-0116 Page 22 of 134 Revision 3 a determinant assessment, the AV does not protect the AL and does not identify an inoperable channel under all operating conditions.

METHOD 3: AL = 6.00 PSIG NON COT = 0.29 TLU =-1.39 ..f -AV = 5.71 PSIG COT 1.10..... -CAL & ACT SP = 4.61 PSIG LEGEND: TLU = TOTAL LOOP UNCERTAINTY AL = ANALYTICAL LIMIT (SAL) AV = ALLOWABLE VALUE NON COT = NON TESTED LOOP UNCERTAINTY COT = TESTED LOOP UNCERTAINTY CAL SP =CALCULATED SETPOINT ACT SP = ACTUAL SETPOINT Figure 3.3-3 3.3.4 Method 3 with Additional Margin Method 3 using additional margin for the ACT SP has been evaluated by the NRC Staff and was found to be an unacceptable method to be used to calculate Allowable Values. Method 3 with additional margin is identical to Method 3 with the exception that the ACT SP is set below the CAL SP. In the case used for this illustration, the ACT SP is set for 4.00 PSIG which provides a margin of 0.61 PSIG to the CAL SP and 1.71 PSIG to the AV. This method actually yields less conservative results than Method 3 for two reasons. First, the AV is still set for 5.71 PSIG yielding a NON-COT allowance of 0.29 PSIG. As discussed above, using a determinant assessment, the NON-COT allowance of 0.29 PSIG does not fully account for the statistical combination of the non-tested loop error components.

Second, the calculated COT allowance was determined to be 1.10 PSIG. Allowing an error of 1.71 PSIG between the ACT SP and the AV is beyond the assumptions used to develop the TLU (i.e., CSA Calculation).

Allowing an error of 1.71 PSIG for the Trip Setpoint before the channel is declared INOPERABLE is inconsistent with the applicable TLU assumptions and will not ensure that the rack components are operating within the assumptions of the CSA Calculation and/or the manufacturer specifications.

Also note that the difference between the ACT SP and the AV is larger than the calculated TLU for the entire channel.

EE-0116 Page 23 of 134 Revision 3 METHOD 3 WITH ADDITIONAL MARGIN: T AL = 6.00 PSIG NON COT = 0.29 TLU = 1.39 -5 COT. = 1.1----- -CAL SP =4.61 PSIG ACT SP = 4.00 PSIG LEGEND: TLU = TOTAL LOOP UNCERTAINTY AL = ANALYTICAL LIMIT (SAL) AV = ALLOWABLE VALUE NON COT = NON TESTED LOOP UNCERTAINTY COT = TESTED LOOP UNCERTAINTY CAL SP = CALCULATED SETPOINT ACT SP = ACTUAL SETPOINT Figure 3.3-4 3.4 Methodology for Determining North Anna "Allowable Values" and Surry "Setting Limits" 3.4.1 Primary RTS and ESFAS Trips and Permissives credited in the Safety Analysis A four step process is used to determine Allowable Values or Setting Limits for Primary RTS and ESFAS Trip Functions and Permissives at North Anna and Surry Power Stations that are credited in the Safety Analysis.

This four step process is based on the requirements of Methods 1 or 2 as described in ISA-RP67.04.02-2000 (Ref 5.43). In the order of operation, the four steps are described below and they are illustrated in Figure 3.4-1 1. Determine the Minimum (decreasing trip) or Maximum (increasing trip) Trip Setpoint (MTS). The Maximum Trip Setpoint is arrived at by subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL). The Minimum Trip Setpoint is arrived at by adding the Total Loop Uncertainty (TLU) to the Analytical Limit (AL).2. Determine the Minimum (decreasing trip) or Maximum (increasing trip) Allowable Value/Setting Limit (MAV). This Minimum Allowable Value/Setting Limit is arrived at by adding the statistical combination (i.e., Square Root of the Sum of the Squares "SRRS") of the NON COT Loop Error Components (i.e., the loop error terms that are not tested or quantified during the Channel Operational Test "COT") to the Analytical Limit (AL). The Maximum Allowable Value/Setting Limit is arrived at by subtracting the statistical combination of the NON COT Loop Error Components from the Analytical Limit (AL).

EE-0116 Revision 3 Page 24 of 134 3. Determine the Actual Trip Setpoint (ATS). After the MTS is determined in step 1, the current Nominal Trip Setpoint for the function can be evaluated for acceptability.

It may be desirable to move the current Nominal Trip Setpoint in a more conservative direction to obtain additional margin to the Analytical Limit and/or to allow for the full COT error allowance between the Actual Trip Setpoint and the Actual Allowable Value. Conversely, the current Nominal Trip Setpoint may be overly conservative resulting in reduced operating margin. If there is sufficient margin to the Analytical Limit, then it may be desirable to move the existing Nominal Trip Setpoint in the non-conservative direction to obtain additional operating margin. In all cases, the ATS must be set equal to or, preferably, conservative with respect to the MTS.4. Determine the Actual Allowable Value (AV). After MAV is determined in step 2, the Actual Allowable Value can be determined based on the ATS. The AV for an increasing trip function is arrived at by adding the statistical combination (i.e., Square Root of the Sum of the Squares"SRRS") of the COT Loop Error Components (i.e., the loop error terms that are tested or quantified during the Channel Operational Test "COT") to the Actual Trip Setpoint (ATS). The AV for a decreasing trip function is arrived at by subtracting the statistical combination of the COT Loop Error Components from the Actual Trip Setpoint (ATS). In all cases, the AV must be set equal to or, preferably, conservative with respect to the MAV.FOUR STEP PROCESS FOR INCREASING TRIP I NON COT ERRORS TOTAL LOOP UNCERTAINTY (TLU) .......COT ERRORS Analytical Limit (AL)Maximum Allowable Value (MAV)(STEP 2)Maximum Trip Setpoint (MTS)(STEP 1)Actual Allowable Value (AV)(STEP 4)Actual Trip Setpoint (ATS)(STEP 3)MARGIN COT ERRORS Figure 3.4-1 EE-0116 Page 25 of 134 Revision 3 3.4.2 Backup RTS and ESFAS Trips and Permissives not credited in the Safety Analysis A two step process is used to determine Allowable Values or Setting Limits for Backup RTS and ESFAS Functions at North Anna and Surry Power Stations that are not credited in the Safety Analysis.

Backup RTS and ESFAS Trip Functions do not have a documented Analytical Limit; therefore, Minimum/Maximum Trip Setpoints and Allowable Values do not need to be calculated.

In some cases for Backup Trips, a TLU (i.e., CSA Calculation) may not be available to perform the process described below.In such a case, the process is subjective and should be based on the best available information.

The two step process is described below.1. Determine the Actual Trip Setpoint (ATS). The current Nominal Trip Setpoint for the function should be evaluated for acceptability.

It may be desirable to move the current Nominal Trip Setpoint in a more conservative direction to obtain additional margin to ensure the function will support the associated Primary Trip, if applicable.

Conversely, the current Nominal Trip Setpoint may be overly conservative resulting in reduced operating margin. If there is sufficient margin with respect to the associated Analytical Limit (if applicable), then it may be desirable to move the existing Nominal Trip Setpoint in the non-conservative direction to obtain additional operating margin.2. Determine the Actual Allowable Value (AV). The AV for an increasing trip function is arrived at by adding the statistical combination (i.e., Square Root of the Sum of the Squares "SRRS") of the COT Loop Error Components (i.e., the loop error terms that are tested or quantified during the Channel Operational Test "COT") to the Actual Trip Setpoint (ATS). The AV for a decreasing trip function is arrived at by subtracting the statistical combination of the COT Loop Error Components from the Actual Trip Setpoint (ATS).3.4.3 Calculating Actual Allowable Values for North Anna and Setting Limits for Surry The existing Allowable Values for North Anna and Setting Limit Values for Surry will be evaluated to determine if they are acceptable based on the requirements of Methods 1 or 2 as described in ISA-RP67.04.02-2000 (Ref 5.43). Examples of the methodology used for North Anna and Surry are provided below.North Anna The current Allowable Value for North Anna's Pressurizer High Water Level Reactor Trip that appears in Improved Technical Specifications (Ref 5.8) will be evaluated based on the four step method described in Section 3.4.1 to ensure that it is bounded by the CSA Calculation of record and by the Safety Analysis assumptions documented in Technical Report NE-0994 (Ref. 5.1).Given Information:

Analytical Limit/Safety Analysis Limit = 100.0 % Narrow Range Level (Ref. 5.1)Current Allowable Value = < 93.0 % Narrow Range Level (Ref. 5.8)

EE-0116 Page 26 of 134 Revision 3 Current Trip Setpoint = 92.0 % Narrow Range Level (Refs. 5.2 & 5.54)Total Loop Uncertainty/Channel Statistical Allowance

= + 6.887 % Narrow Range Level (Ref. 5.20)Type of Trip = Increasing Trip, Normally Energized (Ref. 5.54)Functional Group = Primary Trip, Single Parameter Protection Function (Refs. 5.1, 5.2 & 5.54)Step 1 -Determine the Maximum (increasing trip) Trip Setpoint (MTS)The Maximum Trip Setpoint (MTS) is equal to the Analytical Limit (AL) minus the Total Loop Uncertainty (TLU). Thus, the MTS is equal to: MTS = 100.0 % -6.887 %MTS = 93.113 % Narrow Range Level Step 2 -Determine the Maximum Allowable Value (MAV)The Maximum Allowable Value (MAV) is equal to the Analytical Limit (AL) minus the NON-COT loop error components taken from the Total Loop Uncertainty (TLU) calculation.

The NON-COT loop error components from CSA Calculation EE-0058, Rev. 2 (Ref. 5.20) are detailed below: Process Measurement Accuracy (PMA) = +/- 2.000 % of span Primary Element Accuracy (PEA) = + 0.000 % of span Sensor Calibration Accuracy + Sensor Measuring

& Test Equipment (SCA+SMTE)

= + 0.744 % of span Sensor Drift (SD) = + 0.788 % of span Sensor Pressure Effects (SPE) +/- 5.917 % of span Sensor Temperature Effects (STE) = + 2.418 % of span Sensor Power Supply Effect (SPSE) = +/- 0.000 % of span Module 1 Measuring and Test Equipment (MlMTE) = + 0.153 % of span Module 2 Measuring and Test Equipment (M2MTE) = + 0.03 % of span Rack Temperature Effect (RTE) = + 0.500 % of span Combining the NON-COT loop error components using the Square Root of the Sum of the Squares (SRSS) method as described in Dominion Virginia Power Standard STD-EEN-0304, Rev. 4 (Ref. 5.5), we have the following NON-COT total error: NON-COTenor

= + [PMA2 + PEA2 + (SCA+SMTE) 2 + SD2 + SPE2 + STE2 + SPSE2 + M1MTE 2 +M2MTE 2 + RTE 2] 1/2 NON-COTerror

= + [2.0 + 0.02 + (0.5+0.244)2

+ 0.7882 + 5.9172 + 2.4182 + 0.02 + 0.1532 + 0.032 +0.5 21 1/2 NON-COTerror

= + 6.805 % Narrow Range Level EE-0116 Page 27 of 134 Revision 3 The Maximum Allowable Value (MAV) for an increasing trip based on the requirements of Methods 1 or 2 as described in ISA-RP67.04.02-2000 (Ref. 5.43) is determined by subtracting the total NON-COT error from the Analytical Limit as shown below.MAV = 100.0 % -6.805 %MAV = 93.195 % Narrow Range Level Step 3 -Determine the Actual Trip Setpoint (ATS)As determined in Step 1, the Maximum Trip Setpoint is equal to 93.113 % Narrow Range Level. The current Nominal Trip Setpoint for this function is 92.0 % Narrow Range Level. The current setpoint is conservative with respect to the Maximum Trip Setpoint.

The nominal operating band for pressurizer level at 100 % power is 64.5 % Level + 5.0 % Level. Subtracting the worst case normal operating level of 69.5% from the Nominal Trip Setpoint of 92.0 % yields an operating margin of 22.5 % level. This operating margin encompasses the entire Total Loop Uncertainty and should allow for stable operation.

Therefore, the current Nominal Trip Setpoint of 92.0 % Narrow Range Level will be retained.Step 4 -Determine the Actual Allowable Value (AV)For a single input protection function, the Allowable Value will be determined based on the following rack error components

• Rack Calibration Accuracy (RCA)* Rack Comparator Setting Accuracy (RCSA)* Rack Drift (RD)Note : The RCA and RCSA terms used above are typically defined in Dominion Virginia Power CSA Calculations as Module Tolerances and are designated as M 1 , M 2 ... Mn. For the purposes of this report, the Terms RCA 1 , RCA 2 , RCA, and RCSA are the same as M 1 , M 2 and Mn as used in the CSA Calculations.

There are two rack error terms that are not included in the calculation of the Allowable Value, Rack Measuring and Test Equipment (RMTE) and Rack Temperature Effect (RTE). These rack error terms are not included because they cannot be evaluated/quantified during the performance of the COT.Normally, M&TE is checked on a periodic basis (i.e., every quarter, six months or year). Rack Temperature Effects are not really ever checked or quantified.

The Emergency Switchgear Room at both plants is designed to maintain a relatively constant temperature.

If the temperature changes by more than a nominal amount, the effects on the process instrumentation are normally not evaluated unless a loop or loops are deviating from their nominal process value(s) as indicated in the control room.In addition, by not using these error components, the calculated Allowable Value will be more conservative and easily quantified during or immediately subsequent to functional testing.The methodology used to calculate the Allowable Value will be based on the Square Root Sum of the Squares (SRSS) of the three rack error terms listed above, noting that each rack error term will be treated as an independent variable.

This method will yield a Rack Allowance and thus an Allowable EE-0116 Page 28 of 134 Revision 3 Value that will be consistent with the assumptions of the CSA Calculation of record. Note the example below using the North Anna Pressurizer High Water Level Reactor Trip.As determined in Step 2, the Maximum Allowable Value is equal to 93.195 % Narrow Range Level. The current ITS Allowable Value for this function is < 93.0 % Narrow Range Level. The current ITS Allowable Value is conservative with respect to the Maximum Allowable Value (MAV) and is also conservative with respect to the calculated Allowable Value if it were based on the COT error components taken from Calculation EE-0058, Rev. 2 (Ref. 5.20) as shown below.The Actual Allowable Value (AV) is equal to the Actual Trip Setpoint plus the COT loop error components taken from the Total Loop Uncertainty (TLU) calculation.

The COT loop error components from CSA Calculation EE-0058, Rev. 2 (Ref. 5.20) are detailed below: Module 1 -Westinghouse NLPG02 Card (Ml) = +/- 0.10 % of span Module 2 -Westinghouse NALG02 Card (M2) = + 0.25 % of span Rack Drift (RD) = +/- 1.0 % of span Combining the COT loop error components using the Square Root of the Sum of the Squares (SRSS)method as described in Dominion Virginia Power Standard STD-EEN-0304, Rev. 4 (Ref. 5.5), we have the following COT total error: COTerror= (M12 + M2 + RD') 1/2 COTeror (0.102 + 0.25 + 1.0)1/2 COTerror = + 1.036 % Narrow Range Level As described in Step 4 above, the Actual Allowable Value (AV) for an increasing trip is determined by adding the total COT error the Actual Trip Setpoint as shown below.AV = 92.0 % + 1.036 %AV = 93.036 % Narrow Range Level The calculated Actual Allowable Value of 93.036 % Narrow Range Level will be rounded back to 93.0% Narrow Range Level which is consistent with the current ITS Allowable Value for this function.Thus, the Actual Allowable Value for North Anna Pressurizer High Water Level Reactor Trip is: AV = < 93.0 % Narrow Range Level Steps 1 through 4 as they apply for North Anna's Pressurizer High Water Level Reactor Trip are illustrated below in Figure 3.4-3a.

EE-0116 Revision 3 Page 29 of 134 NORTH ANNA'S PRESSURIZER HIGH WATER LEVEL REACTOR TRIP A3 Z-Z Go OR cn 0 w 9 z u)Cn 0 n-C.)cc z z-Z Analytical Limit (AL)100.00 NR Level Maximum Allowable Value (MAV)93.195 %NR Level Maximum Trip Setpoint (MTS)93.113 %NR Level Actual Allowable Value (AV)93.00 %NR Level Actual Trip Setpoint (ATS)92.00 %NR Level High Operating Limit 69.50 %NR Level Nominal Operating Setpoint 64.50 %NR Level SAFETY MARGIN 1.113 % NR Level 0) 4 C-)OPERATING MARGIN 22.50 %NR Level Figure 3.4-3a Surry The current Setting Limit for Surry's Pressurizer High Water Level Reactor Trip that appears in Custom Technical Specifications (Ref. 5.7) will be evaluated based on the four step method described in Section 3.4.1 to ensure that it is bounded by the CSA Calculation of record and by the Safety Analysis assumptions documented in Technical Report NE-0994 (Ref. 5.1).Given Information:

Analytical Limit/Safety Analysis Limit = 100.0 % Narrow Range Level (Ref. 5.1)Current Allowable Value (i.e., Setting Limit) = < 92.0 % Narrow Range Level (Ref. 5.7)Current Trip Setpoint = 88.0 % Narrow Range Level (Refs. 5.2 & 5.67)

EE-0116 Page 30 of 134 Revision 3 Total Loop Uncertainty/Channel Statistical Allowance

= + 7.894 % Narrow Range Level (Ref. 5.33)Type of Trip = Increasing Trip, Normally Energized (Ref. 5.67)Functional Group = Primary Trip, Single Parameter Protection Function (Refs. 5.1, 5.2 & 5.67)Step 1 -Determine the Maximum (increasing trip) Trip Setpoint (MTS)The Maximum Trip Setpoint (MTS) is equal to the Analytical Limit (AL) minus the Total Loop Uncertainty (TLU). Thus, the MTS is equal to: MTS = 100.0 % -7.894 %MTS = 92.106 % Narrow Range Level Step 2 -Determine the Maximum Allowable Value (MAV)The Maximum Allowable Value (MAV) is equal to the Analytical Limit (AL) minus the NON-COT loop error components taken from the Total Loop Uncertainty (TLU) calculation.

The NON-COT loop error components from CSA Calculation EE-0458, Rev. 1 (Ref. 5.33) are detailed below: Process Measurement Accuracy (PMA) = +/- 2.000 % of span Primary Element Accuracy (PEA) = + 0.000 % of span Sensor Calibration Accuracy + Sensor Measuring

& Test Equipment (SCA+SMTE)

= + 0.817 % of span Sensor Drift (SD) = +/- 0.838 % of span Sensor Pressure Effects (SPE) +/- 6.984 % of span Sensor Temperature Effects (STE) = + 2.550 % of span Sensor Power Supply Effect (SPSE) = +/- 0.000 % of span Module 1 Measuring and Test Equipment (M1MTE) = + 0.00 % of span Module 4 Measuring and Test Equipment (M4MTE) = + 0.150 % of span Rack Temperature Effect (RTE) = + 0.500 % of span Combining the NON-COT loop error components using the Square Root of the Sum of the Squares (SRSS) method as described in Dominion Virginia Power Standard STD-EEN-0304, Rev. 4 (Ref. 5.5), we have the following NON-COT total error: NON COTe,-or = _ [PMA2 + PEA2 + (SCA+SMTE) 2 + SD 2 + SPE2 + STE2 + SPSE2 + M1MTE2 +M4MTE2 + RTE 2] 1/2 NON COTeror = + [2.02 + 0.02 + (0.5+0.317)2+

0.8382 +6.9842 + 2.5502 + 0.02 + 0.02 + 0.1502 +0.52] 1/2 NON COTerror = + 7.805 % Narrow Range Level EE-0116 Page 31 of 134 Revision 3 The Maximum Allowable Value (MAV) for an increasing trip based on the requirements of Methods 1 or 2 as described in ISA-RP67.04.02-2000 (Ref. 5.43) is determined by subtracting the total NON-COT error from the Analytical Limit as shown below.MAV = 100.0 % -7.805 %MAV = 92.195 % Narrow Range Level Step 3 -Determine the Actual Trip Setpoint (ATS)As determined in Step 1, the Maximum Trip Setpoint is equal to 92.106 % Narrow Range Level. The current Nominal Trip Setpoint for this function at Surry is 88.0 % Narrow Range Level. The current setpoint is conservative with respect to the Maximum Trip Setpoint.

The nominal operating band for pressurizer level at 100 % power is 53.7 % Level + 5.0 % Level. Subtracting the worst case normal operating level of 58.7 % from the Nominal Trip Setpoint of 88.0 % yields an operating margin of 29.3 %level. This operating margin encompasses the entire Total Loop Uncertainty and should allow for stable operation.

Therefore, the current Nominal Trip Setpoint of 88.0 % Narrow Range Level will be retained.Step 4 -Determine the Actual Allowable Value (AV)As determined in Step 2, the Maximum Allowable Value is equal to 92.195 % Narrow Range Level. The current Setting Limit value for this function is < 92.0 % Narrow Range Level. The current Setting Limit value is conservative with respect to the Maximum Allowable Value (MAV) however, it is non-conservative with respect to the calculated Allowable Value if it were based on the COT error components taken from Calculation EE-0458, Rev. 1 (Ref. 5.33) as shown below.The Actual Allowable Value (i.e., Setting Limit) is equal to the Actual Trip Setpoint plus the COT loop error components taken from the Total Loop Uncertainty (TLU) calculation.

The COT loop error components from CSA Calculation EE-0458, Rev. 1 (Ref. 5.33) are detailed below: Module 1 -Technipower PM-38 Loop Power Supply (MI) = +/- 0.00 % of span Module 4 -Hagan Model 139-118 Comparator Module (M4) = + 0.50 % of span Rack Drift (RD) = +/- 1.0 % of span Combining the COT loop error components using the Square Root of the Sum of the Squares (SRSS)method as described in Dominion Virginia Power Standard STD-EEN-0304, Rev. 4 (Ref. 5.5), we have the following COT total error: COTerror = +/- (Ml 2 + M4 2 + RD)2 1/2 COTerror = +/- (0.02 +0.5 + 1.02) 1/2 COTeror = + 1.12 % Narrow Range Level EE-0116 Revision 3 Page 32 of 134 As described in Step 4 above, the Actual Allowable Value (AV) for an increasing trip is determined by adding the total COT error the Actual Trip Setpoint as shown below.AV = 88.00 % + 1.12 % = 89.12 % Narrow Range Level The current CTS Setting Limit of < 92.0 % Narrow Range Level will be changed to < 89.12 % Narrow Range Level as shown above.AV (i.e., Setting Limit) = < 89.12 % Narrow Range Level Steps 1 through 4 as they apply for Surry's Pressurizer High Water Level Reactor Trip are illustrated below in Figure 3.4-3b.SURRY'S PRESSURIZER HIGH WATER LEVEL REACTOR TRIP-0 0 10 Z.-0 C,)0 LU I-0 cc 0 0 0 CU CR 0 zS SAFETY MARGIN 4.106 % NR Level OPERATING MARGIN 29.30 % NR Level Analytical Limit (AL)100 % NR Level Maximum Allowable Value (MAV)92.195 % NR Level Maximum Trip Setpoint (MTS)92.106 % NR Level Actual Allowable Value (AV)89.12 % NR Level Actual Trip Setpoint (ATS)88.00 % NR Level High Operating Limit 58.70 % NR Level Nominal Operating Setpoint 53.70 % NR Level-Cn- 17 --cc cc 0 Z cr cc >ui N 0 Figure 3.4-3b EE-0116 Page 33 of 134 Revision 3 4.0 RESULTS 4.1 Allowable Value or North Anna ITS able 3.3.1-1 (RTS Ins mentation)

/~~~ReactorTis 4.1.1 nual Reactor Trip Allowable Value -/A (Refs .2 & 5.8)There is no ecific RTS Trip Setpoi associated with this iction.4.1.2 Pow Ran e Neutron Flu i h Set oint Reacto rip Allowable Value: 110.0 % RTP (Refs. 5.1, 5.2, 5.15 & 5.46)Subtracting th otal Loop Uncertaint (TLU) from the Ana ical Limit (AL) yie s a Maximum Tri Setpoint S) of 112.06 % ed Thermal Power TP). Subtractin he NON COT or compo nts from the Analyc imit yields a Maxi mAllowable Value AV) of 112.467 TP.Npoint of 109.0 % RT s conservative wit espect to the Maxi u Trip tpoint and the Actual owable Value of 11 .% RTP is conserv e with respect to t Maximum Allowable Value. T rAllowable Value o 110.0 % RTP is b ed on maintaining oRinal Trip Setpoint value of 0 % RTP.The statist' combination of the OT and NON COT ror components fro GSA Calculation

-0063 ( .5.15) are given belo .The COT and NO COT error compone s are used in Figur 4.1.2 to d rmine the Maximu p Setpomnt (MTS) the Maximum Allo le Value (MAy).NON COT,,,,, =SE+ MA, 1 + PMA 2 2+ TE 2+ M5MTE 2+ E2)12 NON COTerror .0 +(1.667 2 + 4.167 2 0.112 2+0.923 2+0. 1/2 NON C er,,o= +4.611%0of s + 5.533 %RTP C r er+/- (M1 2 +M5 2 2) 1/2 COTerror+/-

(0.1 2+ .833 + 1.0) 1/2 COTer.....

+ .05 % of span + 1.56 % RTP See Fi re 4.1.2 for specific det s.ýW y4k A va r.L,+ o EE-0116 Page 81 of 134 Revision 3 4.3 Setting Limits for Surry Power Station Custom Technical Specifications, Section 2.3, Limiting Safety System Settings, Protective Instrumentation and Protective Instrumentation Settings for Reactor Trip Interlocks.

Note: In the context of this document, the terms Allowable Value and Setting Limit and Limiting Safety System Setting (LSSS) have the same meaning and intent.Reactor Trips 4.3.1 Power Range Neutron Flux High Setpoint Reactor Trip Allowable Value: < 109.0 % RTP (Refs. 5.1, 5.2, 5.7, 5.28 & 5.81)Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 110.48 % Rated Thermal Power (RTP). Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 111.08 % RTP.The Actual Nominal Trip Setpoint of 107.0 % RTP is conservative with respect to the Maximum Trip Setpoint and the Actual Allowable Value of 109.0 % RTP is conservative with respect to the Maximum Allowable Value. This Allowable Value of < 109.0 % RTP is based on maintaining a Nominal Trip Setpoint value of 107.0 % RTP.The calculated Allowable Value for this function is < 108.697 % RTP. The 0.303 % RTP offset is accommodated in the 3.48 % RTP Safety Margin for this trip as illustrated in Figure 4.3.1.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0198 (Ref. 5.28) are given below. The COT and NON COT error components are used in Figure 4.3.1 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).NON COTeror = SE + (PMA 1 2 + PMA 2 2 + RMTE 2 + RTE 2) 1/2 NON COTerror = 0.0 + (2.0002 + 5.0002+ 2.0002 +0.52) 1/2 NON COTeror = + 5.766 % of span = + 6.920 % RTP COTerror = +/- (RCA +RD2) II COTo, = +/- (1.02 + 1.02) 1/2 COT,,o, = + 1.414 % of span = + 1.697 % RTP See Figure 4.3.1 for specific details.

EE-0116 Revision 3 Page 82 of 134 SURRY'S POWER RANGE NEUTRON FLUX HIGH REACTOR TRIP Analytical Limit (AL)118.00 % RTP 0 I-j 0 z 0-C14 e.J (0 cc 0 cc W I--0 z 0 z n-0 I--0 C.)0.I-0-OR a-I-n-0 CD d SAFETY MARGIN 3.48 % RTP N Maximum Allowable Value (MAV)111.08 % RTP Maximum Trip Setpoint (MTS)110.48 % RTP Actual Allowable Value (AV)109.00 % RTP Actual Trip Setpoint (ATS)107 % RTP High Operating Limit 102.00 % RTP Nominal Operating Setpoint 100.00 % RTP OPERATING MARGI 5.00 % RTP Figure 4.3.1 4.3.2 Power Range Neutron Flux Low Setpoint Reactor Trip Allowable Value: < 25.0 % RTP (Refs. 5.1, 5.2, 5.7, 5.28 & 5.81)Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 27.48 % Rated Thermal Power (RTP). Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 28.08 % RTP. The Actual Nominal Trip Setpoint of 23.0 % RTP is conservative with respect to the Maximum Trip Setpoint and the Actual Allowable Value of 25.0 % RTP is conservative with respect to the Maximum Allowable EE-0116 Page 83 of 134 Revision 3 Value. This Allowable Value of < 25.0 % RTP is based on maintaining a Nominal Trip Setpoint value of 23.0 % RTP.The calculated Allowable Value for this function is < 24.70 % RTP. The 0.30 % RTP offset is accommodated in the 4.48 % RTP Safety Margin for this trip as illustrated in Figure 4.3.2.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0198 (Ref. 5.28) are given below. The COT and NON COT error components are used in Figure 4.3.2 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).NON COTerror = SE + (PMAI2 + PMA 2 2 + RMTE 2 + RTE 2) 1/2 NON COTerror = 0.0 +/- (2.0002 + 5.0002 + 2.0002 +0.52) 1 NON COTerror = + 5.766 % of span = + 6.920 % RTP COTerror = + (M2 + RD2) 1/2 COT e'or = +/- (1.0 2 + 1.02) 1/2 COTeror = +/- 1.414 % of span =+ 1.697 % RTP See Figure 4.3.2 for specific details.

EE-0116 Revision 3 Page 84 of 134 SURRY'S POWER RANGE NEUTRON FLUX LOW SETPOINT REACTOR TRIP a.0 z 0-0 N~(n 0 I-l 0 z 0 U)0 ILl I-0 UJ Analytical Limit (AL)35.0 % RTP I'--n"I-0 (0 0-SAFETY MARGIN 4.48 % RTP N Maximum Allowable Value (MAV)28.08 % RTP Maximum Trip Setpoint (MTS)27.48 % RTP Actual Allowable Value (AV)25.0 % RTP Actual Trip Setpoint (ATS)23.0 % RTP High Operating Limit 11.0 % RTP Nominal Operating Setpoint 10.0 % RTP OPERATING MARGI 12.0 % RTP Figure 4.3.2 EE-0116 Page 85 of 134 Revision 3 4.3.3 Intermediate Range Neutron Flux High Reactor Trip Allowable Value: < 40.0 % RTP (Refs. 5.1, 5.2, 5.7, 5.29 & 5.82)Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 88.18 % Rated Thermal Power (RTP). Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 89.627 % RTP. The Actual Nominal Trip Setpoint of 35.0 % RTP is conservative with respect to the Maximum Trip Setpoint and the Actual Allowable Value of 40.0 % RTP is conservative with respect to the Maximum Allowable Value. This Allowable Value of < 40.0 % RTP is based on maintaining a Nominal Trip Setpoint value of 35.0 % RTP.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0722 (Ref. 5.29) are given below. The COT and NON COT error components are used in Figure 4.3.3 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).NON COTeror = SE + (EA2 + PMA2 + PEA2 + SCA2 + SD + SPE 2+ RTE 2 + RRA 2) 1/2 NON COTeror = 0.0 + (0.02 + 8.498 + 0.02 + 0.52 + 1.02 + 0.02 + 0.02 + 0.52 + 1.02)1/2 NON COTeor = +/- 8.644 % of span = + 10.373 % RTP COTe,,or = +/- [(M4 + M4MTE)2 + RD2) 1/2 COTeror = +/- [(1.003 + 3.622)2 + 1.002] 1/2 COT"ror = + 4.732 % of span = + 5.678 % RTP Note: The M4MTE was included in the COTerrr formula due to the meter being used for the adjustment of the bistable.See Figure 4.3.3 for specific details.

EE-0116 Revision 3 Page 86 of 134 SURRY'S INTERMEDIATE RANGE HIGH FLUX REACTOR TRIP 0>0I-JzR z 0 (L I-u)ac 0 cc cc Lu 0 i 0 I-0 LU 0 C.-Analytical Limit (AL)100.00 % RTP 0.I-C, I-I.-Maximum Allowable Value (MAV)89.627 % RTP Maximum Trip Setpoint (MTS)88.18 % RTP Actual Allowable Value (AV)40.0 % RTP Actual Trip Setpoint (ATS)35.00 % RTP SAFETY MARGIN,, 53.18 % RTP OPERATING MARGIN 26.00 % RTP High Operating Limit 9.00 % RTP Nominal Operating Setpoint 8.00 % RTP Figure 4.3.3 EE-0116 Page 87 of 134 Revision 3 4.3.4 Source Range Neutron Flux High Reactor Trip Allowable Value: (Refs. 5.1, 5.2, 5.7, 5.30, 5.82)Subtracting the Total Loop Uncertainty (TLU = + 0.93

• 10 5 and -0.48

• 105) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 1.21

• 106 Counts Per Second (CPS). Subtracting the NON COT error components from the AnalyticalLimit yields a Maximum Allowable Value (MAV) of 1.27

• 106 CPS. The Actual Nominal Trip Setpoint of 1.0

• 105 CPS is conservative with respect to the Maximum Trip Setpoint.

The current Allowable Value of < 1.00

• 106 CPS is conservative with respect to the Maximum Allowable Value. The current Allowable Value < 1.00

• 106 is not consistent with the calculated Allowable Values using the COT errors shown below. The Allowable Value will be changed from < 1.00

• 106 to < 1.51

• 10 5 CPS to conform to the methodology described in Sections 3.3.1 and 3.3.2.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0719 (Ref. 5.30) are given below. The COT and NON COT error components are used in Figure 4.3.4 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).NON COTeror = SE + (PMA2 + PEA + (SCA+SMTE)2

+ SD2 + SPE 2+ SPSE 2 + M1MTE 2 + M2MTE 2+ RTE2 + RRA2)112 NON COTo, = 0.0 + (0.02 + 0.02 + (0.0+0.0)2

+ 0.02 + 0.02 + 0.02 + 1.817 + 1.02 +0.5 2+0.02)12 NON COT,,,o, = + 2.133 % of linear span= + 0.34*105 CPS and -0.25*105 CPS (Based on Trip Setpoint of 1.0*105 CPS)= 0.34* 105 CPS(1COTerror = +/- (M1 2 + M2 2 + RD2) 1/2 COTIIer = +/- (1.617 2+ 1.6172+ 1.92) 112 COT,.o, = + 2.973 % of linear span= + 0.51*105 CPS and -0.34* 105 CPS (Based on the Nominal Trip Setpoint of 1.0*105 CPS)= 0.51* 105 CPS, 2>(1) Nominal Trip Setpoint = 1.0

• 105 CPS =: log 1.0

• 105 = 5.0 (on a 0 to 6 Decade scale)Analytical Limit = 1.3

• 10 6 CPS > log 1.3

• 106 6.11394 (on a 0 to 6 Decade scale)Full CSA = + 4.744 % of linear span => (4.744 %/100 %)

• 6 Decades = + 0.28464 Decade High Trip Setpoint = 5.0 + 0.28464 = 5.28464 => antilog 5.28464 = 1.93

• 10'Low Trip Setpoint = 5.0 -0.28464 = 4.71536 = antilog 4.71536 = 0.52

• 10'CSAN+) = 1.93

• 10' -1.0

• 10' = 0.93

• 10' and CSA(.) = 1.0

• 10' -0.52

• 10' = 0.48

• 10'Full CSA = (+) 0.93

• 10' CPS and (-) 0.48

• 10' CPS (2) The most conservative value is used regardless of sign.

EE-0116 Revision 3 Page 88 of 134 SURRY'S SOURCE RANGE NEUTRON FLUX HIGH REACTOR TRIP DJ 0 z U)0.(.)U, 0 0 u)cc 0 cc w 0 z 0 W cc 0 C,, U)C.C.)cv, Analytical Limit (AL)1.3

• 106 CPS Maximum Allowable Value (MAV)1.27

• 106 CPS Maximum Trip Setpoint (MTS)1.21

• 106 CPS Actual Allowable Value (AV)1.51

• 105 CPS Actual Trip Setpoint (ATS)1.00

• 105 CPS SAFETY MARGIN 1.11* 106 CPS OPERATING MARGIN 2.00

• 104 CPS High Operating Limit 8.00

• 104 CPS Nominal Operating Limit 3.00

• 104 CPS Figure 4.3.4 EE-0116 Page 89 of 134 Revision 3 4.3.5 Overtemperature AT Reactor Trip Allowable Value: See below (Refs. 5.1, 5.2, 5.7, 5.31, 5.69, 5.71, 5.72, 5.73 & 5.74)The Overtemperature AT (OTAT) Reactor Trip Setpoint equation in terms of process units is: AT< ATP)[KI (( + Dt T +/- P f(AI)]Where: (Equation 4.3.5)ATo = Indicated AT at rated thermal power, OF T = Average coolant temperature, OF T' = 573.0 OF P = Pressurizer pressure, psig P9 = 2235 psig Ki = 1.135 K2 = 0.01072 K 3 = 0.000566 AI = qt -qb, where qt and qb are percent power in the top and bottom halves of the core respectively, and qt + qb is total core power in percent of rated power.f(AI) = function of Al, percent of rated core power as shown in Surry TS Figure 2.3-1.j ~2947 se~ojids<.4 seconds.The Overtemperature AT (OTAT) Reactor Trip Setpoint is variable and is constantly calculated based on actual plant conditions.

For this reason, the Allowable Value cannot be expressed as a constant.Further, the OTAT Reactor Trip will be analyzed for the following three conditions:

• OTAT Reactor Trip with no FAI* OTAT Reactor Trip with (+) FAI a OTAT Reactor Trip with (-) FAI Note: FAI is the Delta Flux Penalty generated from the Upper and Lower Power Range Neutron Flux Detectors (i.e., Qu and QL).Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields the following Maximum Trip Setpoints (MTS) for the three OTAT Reactor Trip conditions described above:* MTS for OTAT Reactor Trip with no FAI = 123.2 % -7.956 % = 115.24 % AT Power* MTS for OTAT Reactor Trip with (+) FAI = 128.9 % -9.788 % = 119.11 % AT Power* MTS for OTAT Reactor Trip with (-) FAI= 131.3 % -11.355 %= 119.95 % AT Power EE-0116 Page 90 of 134 Revision 3 Subtracting the NON COT error components from the Analytical Limit yields the following Maximum Allowable Values (MAV) for the three OTAT Reactor Trip conditions described above:* MAV for OTAT Reactor Trip with no FAI = 123.2 % -6.060 % = 117.14 % AT Power* MAV for OTAT Reactor Trip with (+) FAI -128.9 % -8.319 % = 120.58 % AT Power" MAV for OTAT Reactor Trip with (-) FAI = 131.3 % -10.116%= 121.18 % AT Power For the most limiting condition (i.e., OTAT Reactor Trip with no FAI) the Actual Nominal Trip Setpoint of 111.5 % AT Power (e.g., based on TAVG = 573.0 'F) is conservative with respect to the Maximum Trip Setpoint of 115.24 % AT Power and the Actual Allowable Value of 114.5 % AT Power is conservative with respect to the Maximum Allowable Value of 117.14 % AT Power. This Allowable Value of < 114.5 % AT Power is based on maintaining a Nominal Trip Setpoint value of 111.5 % AT Power. Note that this analysis is based on static conditions such that dynamic components are not considered.

The statistical combination of the COT and NON COT error components from CSA Calculation EE-0415 (Ref. 5.31) with the appropriate modifications described in Section 3.2 for the OTAT Reactor Trip are given below. The COT and NON COT error components are used in Figure 4.3.5b to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV) for the most limiting condition.

OTAT Reactor Trip with no FAI NON COTerror = [EAnon2 + PMATAVG2 + PMAAT 2 + PEA 2 + (SCARTD +SMTERTD)2

+ (SCARTD+SMTERTD)2 + (SCARTD +SMTERTD)2

+ (SCARTD +SMTERTD)2

+ (4

• SDRTD 2) + STERTD2 + PMAXMTRR2+ (SCAXMTR +SMTEXMTR)2

+ SDXMTR2 + STEXMTR 2 + FLUX 1 2 + RMTE 1 2 + RMTE 2 2 + RMTE 3 2 +2 '2 '2 22 RMTE 4 + RMTE 5 + RMTE 6 + RDTAVG + RDAT2 + RTE2]1/2 Where the following RMTE Terms are taken from Calculation EE-0415 (Ref. 5.31): RMTE 1 2 = AT Channel Measuring and Test Equipment

= (MIMTE 2 + M2MTE 2 + M3MTE 2 +M4MTE2 + M5MTE 2 + M6MTE 2) 1/2 RMTEI 2 = (0.2482 + 0.2482 + 0.248 + 0.244 + 0.302 + 0.26) 12 = 0.634 % of span RMTE 2 2 = TAVG Channel Measuring and Test Equipment

= (M1MTE 2 + M2MTE 2 + M3MTE 2 +M4MTE2 + M5MTE 2 + M7MTE2 + M30MTE2 + M31MTE 2) 1/2 RMTE 2 2 = (0.2482 +0.2482 +0.248 + 0.2442 +0.302 +0.262 + 0.212' + 0.2122)1/2

= 0.701% of span RMTE 3 2 = Pressurizer Pressure Channel Measuring and Test Equipment

= M45MTE 2 RMTE 3 2= 0.212 % of span RMTE 4 2= FAI Channel Measuring and Test Equipment

= (M49MTE 2+ M52MTE 2) 1/2 EE-0116 Page 91 of 134 Revision 3 RMTE 4 2 = (0.02 + 0.2122) 1/2 = 0.212 % of span RMTE 5 2 = OTAT Setpoint Summator Measuring and Test Equipment

= M32MTE RMTE 5 2 = 0.30 % of span RMTE 6 2 = OTAT Reactor Trip Bistable Measuring and Test Equipment

= M33MTE RMTE 6 2 = 0.212 % of span Thus, the NON COTer,(, is equal to: NON COTerror = [0.002 + 1.702 + 1.302 + 0.002 + (0.417+0.167)2

+ (0.417+0.167)2

+ (0.417+0.167)2

+(0.417+0.167)2

+ (4

• 0.252) + 0.002 + 0.002 + (0.50+0.404)2

+0.752 + 2.3192 +0.002 +0.6342 + 0.7012+ 0.212 + 0.2122 + 0.3002 + 0.2122 + 1.002 + 1.002 + 0.500211/2 NON COTeor =(+/- 4.040 % of span= + 6.060 % AT Power COTerror = +/- (RCA12 + RCA 2 2 + RCA 3 2 +RCA 4 2 + RCA 5 2 + RCA 6 2 + RDTAVG2 + RDAT2) 1/2 COTerror = +/- (0.52 + 0.5 + 0.52 + 0.52 + 0.52 + 0.52 + 1.02 + 1.02) 1/2 COTerror = + 1.871 % of span = + 2.806 % AT Power OTAT Reactor Trip with (W) FAL NON COTerror = [EAnon 2 + PMATAVG 2 + PMAATT 2 + PEA 2 + (SCARTD +SMTERTD)2 + (SCARTD+SMTERTD)2 + (SCARTD +SMTERTD)2 + (SCARTD +SMTERTD)2

+ (4

• SDRTD 2) + STERTD 2 + PMAXMTR 2+ (SCAXMTR +SMTEXMTR)2

+ SDxMTR2 + STEXMTR 2 + FLUX 2 2 + RMTE12 + RMTE 2 2 + RMTE 3 2 +RMTE 4 2 + RMTE 5 2 + RMTE 6 + RDTAVG2 + RDAT2 + RTE2] 1/2 NON COTerror = [0.002 + 1.702 + 1.302 + 0.002 + (0.417+0.167)2

+ (0.417+0.167)2

+ (0.417+0.167)2

+(0.417+0.167)2

+ (4

• 0.252) + 0.002 + 0.002 + (0.50+0.404)2

+0.752 +2.3 192 + 3.802 + 0.6342 + 0.7012+ 0.212 2+ 0.2122 + 0.3002 + 0.2122 + 1.002 + 1.002 + 0.5002]1/2 NON COTerror = + 5.546 % of span = + 8.319 % AT Power COTerror = +/- (RCAI2 + RCA 2 2 + RCA 3 2 +RCA42 + RCA 5 2 + RCA6 2 + RDTAVG2 + RDAT2) 1/2 COTer.or = +/- (0.52 + 0.5 + 0.52 + 0.52 + 0.52 + 0.52 + 1.02 + 1.02) 1/2 COTro, = + 1.871 % of span = + 2.806 % AT Power EE-0116 Page 92 of 134 Revision 3 OTAT Reactor Trip with (-) FAT NON COTerror = [EA 0 no 2 + PMATAVG 2 + PMAAT 2 + PEA 2 + (SCARTD +SMTERTD)2 + (SCARTD+SMTERTD)2

+ (SCARTD +SMTERTD)2 + (SCARTD +SMTERTD)2

+ (4

• SDRTD 2) + STERTD2 + PMAXMTR2+ (SCAXMTR +SMTEXMTR) 2 + SDXMTR2 + STEXMTR 2 + FLUX 3 2 + RMTE 1 2 + RMTE 2 2 + RMTE 3 2 +RMTE 4 2 + RMTE 5 2 + RMTE 6 2 + RDTAVG2 + RDAT2 + RTE2]1/2 NON COT.o. = [0.002 + 1.702 + 1.302 + 0.002 + (0.417+0.167)2

+ (0.417+0.167)2

+ (0.417+0.167)2

+(0.417+0.167)2

+ (4

• 0.252) + 0.002 + 0.002 + (0.50+0.404)2

+ 0.752 + 2.3 192 + 5.402 + 0.6342 + 0.7012+ 0.2122+ 0.2122 + 0.3002 + 0.2122 + 1.002 + 1.002 + 0.5002]1/2 NON COTerror " + 6.744 % of span = + 10.116 % AT Power COTerror = +/- (RCA12 + RCA 2 2 + RCA 3 2 +RCA 4 2 + RCA 5 2 + RCA 6 2 + RDTAVG 2 + RDAT2)1/2 COTeror = + (0.52 +0.52 + 0.52 +0.52+ 0.52 + 0.52 + 1.02 + 1.02) 1/2 COT'ror = + 1.871 % of span = + 2.806 % AT Power See Figure 4.3.5b for specific details associated with the OTAT Reactor Trip with no FAI.Revised Time Constants for Equation 4.3.5, Overtemperature AT Reactor Trip Equation The installed "nominal" Lead (Tri) and Lag (Q 2) Time Constants used for the dynamic compensation associated with TAVG (T) as detailed in Equation 4.3.5 are set for 33 seconds and 4 seconds, respectively.

As stated in Reference 5.71, a lead time constant of 33 seconds and lag time constant of 4 seconds is more conservative than the current Technical Specifications settings of 25 seconds and 3 seconds for x, and 'r 2 , respectively.

The actual "nominal" lead/lag ratio of 33/4 installed in the plant on both units has been shown analytically to provide a faster response (i.e., will cause a reactor trip earlier) than the current Technical Specifications lead/lag ratio of 25/3 for all postulated ramp rates used in the Safety Analysis for the Overtemperature AT Reactor Trip Function.

The revised Technical Specification limits for "t and "r 2 are based on the installed lead and lag settings in the plant, noting the + 10 % of the desired Time Constant tolerance as given by the manufacturer and the Instrument Calibration Procedure (Refs.5.69 and 5.73). Thus, the revised Technical Specification limit for Tm is 29.7 Seconds (i.e., 33 seconds -3.3 seconds) and the revised Technical Specification limit for "c2 is 4.4 seconds (i.e., 4 seconds + 0.4 seconds).

Figure 4.3.5a compares the ramp response of a 29.7/4.4 lead/lag setting versus the current Technical Specifications lead/lag setting of 25/3. The TAVG ramp rate used in Figure 4.3.5a (i.e., + 10 OF/ Minute) approximates the Surry TAVO response for an Uncontrolled Rod Withdrawal from Full Power terminated by the OTAT Reactor Trip for a 0.8 pcm/sec insertion rate as shown in NA&F Calculation SM-932, Rev. 0, Figure 14.2-4 (Ref. 5.74). As shown in Figure 4.3.5a, for ramp time < 7 seconds (i.e., time = 2 lag time constants), the ramp response of the current Technical Specification lead/lag setting of 25/3 is slightly more conservative than the revised setting of 29.7/4.4.

However, after two lag time constants, the output response of the revised Technical Specification lead/lag settings is more conservative and will cause the OTAT Reactor Trip to come in sooner than the current settings.

Also EE-0116 Revision 3 Page 93 of 134 note that based on Reference 5.74, there are no Safety Analysis cases that credit the OTAT Reactor Trip for event termination times less than 20 seconds.Lead Lag Response 25/3 vs. 29.7/4.4'-T AVG Ramp --2513 Lead Lag --29.7/4.4 Lead Lag I 584.0 582.0 580.0 5- 878.0 1-576.0 574.0 572.0 0 5 10 15 20 25 30 Time (Seconds)Figure 4.3.5a SURRY'S OVERTEMPERATURE DELTA T REACTOR TRIP 35 U)o9 I-o M 0 U)a.0 cc Cr.-r F SAFETY MARGIN 3.74 % DELTA T POWER OPERATING MARGIN 9.50 % DELTA T POWER Analytical Limit (AL)123.20 % Delta T Power Maximum Allowable Value (MAV)117.14 % Delta T Power Maximum Trip Setpoint (MTS)115.24 % Delta T Power Actual Allowable Value (AV)114.50 % Delta T Power Actual Trip Setpoint (ATS)111.50 % Delta T Power High Operating Limit 102.00 % Delta T Power Nominal Operating Limit 100.00 % Delta T Power Figure 4.3.5b EE-0116 Page 94 of 134 Revision 3 4.3.6 Overpower AT Reactor Trip Allowable Value: See below (Refs. 5.1, 5.2, 5.7, 5.31, 5.69, 5.73, 5.75 & 5.76)nTrsp, maxuTp Seto9t slia1not exceed its com 'rpetpoint byom oretia 2. 0 1'c oftihe AT. span, j NQt t Oa%'2.0 '/c ftAT spa is equatq9 3.90 P6 ýýyoye)The Overpower AT (OPAT) Reactor Trip Setpoint equation in terms of process units is: AT- AT 0[KK 4--5 T -K 6 (T --T)-f(AI)]

Where: (Equation 4.3.6)ATo = Indicated AT at rated thermal power, °F T = Average coolant temperature, OF T' = Average coolant temperature measured at nominal conditions and rated power, OF K 4 = A constant = 1.089 K(5 = 0 for decreasing average temperature A constant, for increasing average temperature 0.02/°F K6 =0 forT_<T'0.001086 for T > T'f(AI) = function of Al, percent of rated core power as shown in Surry TS Figure 2.3-1.The Overpower AT Reactor Trip Setpoint is variable and is constantly calculated based on actual plant conditions.

For this reason, the Allowable Value cannot be expressed as a constant.

The Overpower AT Reactor Trip is a backup reactor trip function and is not credited in the Surry UFSAR Chapter 14 Safety Analysis.

However, the FAI portion of the Overpower AT Reactor Trip is credited in NA&F Calculation SM-0933, Rev. 0 (Ref. 5.75) and NA&F Technical Report NE-680, Rev. 1 (Ref. 5.76). The FAI reset function is used to reduce the Overpower AT Reactor Trip setpoint (Surry) and Overtemperature AT Reactor Trip setpoint (North Anna and Surry) to compensate for axial power distribution effects. This compensating term, which is a function of AI, the axial flux difference, is derived on the basis of a set of bounding non-symmetric axial power distributions.

Finally, the time constant for the Overpower AT TAVG rate penalty (i.e., t 3) is not credited in the Chapter 14 Safety Analysis, Calculation SM-0933 or Technical Report NE-680.The Allowable Value of 2.0 % of the AT span is consistent with the original design basis for this function and is conservative with respect to the CSA Calculation assumptions (Ref. 5.31). The revised Technical Specification Limit for T 3 as described in Equation 4.3.6 above will be changed from 10 Seconds to > 9.0 Seconds. The reduction of 1 second from the original t 3 time constant of 10 seconds takes into account the + 10 % of the desired Time Constant tolerance as given by the manufacturer and the Instrument Calibration Procedure (Ref. 5.69).

EE-0116 Page 95 of 134 Revision 3 4.3.7 Pressurizer Low Pressure Reactor Trip Allowable Value: > Po (Refs. 5.1, 5.2, 5.7, 5.32 & 5.68)Adding the Total Loop Uncertainty (TLU) to the Analytical Limit (AL) yields a Minimum Trip Setpoint (MTS) of 1872.37 PSIG. Adding the NON COT error components to the Analytical Limit yields a Minimum Allowable Value (MAV) of 1869.48 PSIG. The Actual Nominal Trip Setpoint of 1875 PSIG is conservative with respect to the Minimum Trip Setpoint.

The current Allowable Value of > 1860 PSIG is non-conservative with respect to the Minimum Allowable Value. The current Allowable Value> 1860 PSIG will be changed to > 1875 PSIG to conform to the requirements of Methods I and 2 as described in Sections 3.3.1 and 3.3.2. In addition, the Nominal Trip Setpoint value of 1875.0 PSIG will be changed to 1885.0 PSIG. The revised Nominal Trip Setpoint value of 1885 PSIG will allow a 10.00 PSIG margin to be used for the COT error components.

The revised Allowable Value of_> 1875 PSIG is approximately equal to the calculated value using the CSA rack error terms from Calculation EE-0514.The calculated Allowable Value for this function is > 1875.20 PSIG based on the revised setpoint of 1885 PSIG and using the COT error components.

The 0.20 PSIG offset is accommodated in the 12.63 PSIG Safety Margin for this trip as illustrated in Figure 4.3.7.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0514 (Ref. 5.32) are given below. The COT and NON COT error components are used in Figure 4.3.7 to determine the Minimum Trip Setpoint (MTS) and the Minimum Allowable Value (MAV).NON COTeor = SE + [PMA 2 + PEA 2 + (SCA+SMTE) 2 + SD 2 + SPE 2 + STE 2 + SPSE 2 + M1MTE 2 +M4MTE2 + M5MTE 2 + RTE2] " NON COTeror = 0.0 + [0.02 + 0.02 + 0.9042 + 0.752 + 0.02 + 2.0132 + 0.02 + 0.02 + 0.1502 + 0.2122 +0.5211/2 NON COTerro = + 2.398 % of span = + 19.184 PSIG COTerro = +/- (M1 2 + M42 + M52 + RD 2) 1/2 COTerror = +/- (0.02 +0.52+ 0.52 + 1.02)112 COTrror = + 1.225 % of span = + 9.800 PSIG See Figure 4.3.7 for specific details.

EE-0116 Revision 3 Page 96 of 134 SURRY'S PRESSURIZER LOW PRESSURE REACTOR TRIP Nominal Operating Limit 2235 PSIG Low Operating Limit 2210 PSIG Actual Trip Setpoint (ATS)1885 PSIG 0 0-4 m 0 (n p 0 0+OPERATING MARGIN 325 PSIG (Static)SAFETY MARGIN 12.63 PSIG (Static)Actual Allowable Value (AV)1875.00 PSIG Minimum Trip Setpoint (MTS)1872.37 PSIG Minimum Allowable Value (MAV)1869.48 PSIG Analytical Limit (AL)1850.3 PSIG I II f m M00-n M 0 z 0 9 0 cn-0 Cn C A z Zr 0 0-'U 1sh D OD cn-Figure 4.3.7 4.3.8 Pressurizer High Pressure Reactor Trip Allowable Value: 8 SIG (Refs. 5.1, 5.2, 5.7, 5.32 & 5.68)Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 2388.98 PSIG. Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 2391.20 PSIG. The Actual Nominal Trip Setpoint of 2370 PSIG is conservative with respect to the Maximum Trip Setpoint.

The current Actual Allowable Value of < 2385 PSIG is conservative with respect to the Maximum Allowable Value. The current Allowable Value < 2385 PSIG will be changed to < 2380 PSIG to conform to the requirements of Methods 1 and 2 as described in Sections 3.3.1 and 3.3.2. This is based on the Nominal Trip Setpoint value of 2370.0 PSIG. The Nominal Trip Setpoint value of 2370 PSIG will allow a 10.0 PSIG margin to EE-0116 Page 97 of 134 Revision 3 be used for the COT error components.

The Allowable Value of < 2380 PSIG is sufficiently close enough to the calculated value using the CSA rack error terms from Calculation EE-0514 (Ref 5.32).The calculated Allowable Value for this function is < 2378.94 PSIG. The 1.06 PSIG offset is accommodated in the 18.98 PSIG Safety Margin for this trip as illustrated in Figure 4.3.8.In this case, the current Allowable Value of < 2385.0 PSIG will be changed to < 2380.0.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0514 (Ref. 5.32) are given below. The COT and NON COT error components are used in Figure 4.3.8 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).NON COTerror = SE + [PMAý + PEAý + (SCA+SMTE)2

+ SD2 + SPE + STE2 + SPSE2 + MIMTE2 +M4MTE 2 + RTE 2]1 I 2 NON COTe0or=.0

+ [0.02 + 0.02 +0.9042 +0.752+0.02

+2.0132 + 0.02 + 0.02 + 0.15' + 0.52 +]1/2 NON COTerror = + 2.388 % of span = + 19.104 PSIG COTe'or = + (M12 + M42 + RD2) 1/2 COTerror = +/- (0.02 + 0.52 + 1.02) 1/2 COTr~or = + 1.118 % of span= + 8.944 PSIG See Figure 4.3.8 for specific details.

EE-0116 Revision 3 Page 98 of 134 SURRY'S PRESSURIZER HIGH PRESSURE REACTOR TRIP z C, U)0~Cv)U)0 LI-0 0 U)0 U.]Analytical Limit (AL)2410.3 PSIG C, Ci cm SAFETY MARGIN 18.98 PSIG N Maximum Allowable Value (MAV)2391.20 Maximum Trip Setpoint (MTS)2388.98 PSIG Actual Allowable Value (AV)2380.00 PSIG Actual Trip Setpoint (ATS)2370 PSIG High Operating Limit 2260 PSIG Nominal Operating Setpoint 2235 PSIG OPERATING MARGI 110 PSIG Figure 4.3.8 EE-0116 Page 99 of 134 Revision 3 4.3.9 Reactor Coolant Flow Low Reactor Trip Allowable Value: >ý91.0 ( Flow 1n(N aIed (Refs. 5.1, 5.2, 5.7, 5.34 & 5.66)Adding the Total Loop Uncertainty (TLU) to the Analytical Limit (AL) yields a Minimum Trip Setpoint (MTS) of 89.93 % Flow. Adding the NON COT error components to the Analytical Limit yields a Minimum Allowable Value (MAV) of 89.63 % Flow. The current Nominal Trip Setpoint of 92.0 %Flow is conservative with respect to the Minimum Trip Setpoint and the Actual Allowable Value of >90.0 % Flow is conservative with respect to the Minimum Allowable Value. The current Allowable Value of > 90.0 % Flow is non-conservative with respect to the calculated value using the CSA rack error terms from Calculation EE-0183 (Ref 5.34). The current Allowable Value of > 90.0 % Flow will be changed to > 91.0 % Flow to conform to the methodology described in Sections 3.3.1 and 3.3.2.The calculated Allowable Value for this function is > 90.738 % Flow. The 0.262 % Flow offset is accommodated in the 2.067 % Flow Safety Margin for this trip as illustrated in Figure 4.3.9.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0183 (Ref. 5.34) are given below. The COT and NON COT error components are used in Figure 4.3.9 to determine the Minimum Trip Setpoint (MTS) and the Minimum Allowable Value (MAV).NON COTerror (AP span) = [(SCA+SMTE) 2 + SD 2 + SPE 2 + STE2 + M6MTE 2] 1 2 NON COTeror (AP span) = [(0.50+0.169),2

+ 0.3572 + 0.02 + 1.2882 +0.1142]1/2 NON COTerror (AP span) = + 1.499 % of AP span = + 0.978 % of Flow span @ 92 % Flow NON COTe,,or (Flow span) = (PMA + PEA2 + RTE2) 112 NON COTe,,,o (Flow span) = (1.9002 + 0.02 + 0.52) 1/2 NON COTeo, (Flow span) = 1.965 % of Flow span TOTAL NON COTerror (Flow span) = (1.9652 + 0.9782) 112 = 2.195 % of Flow span = 2.634 % Flow @92.0 % Flow (e.g., the Nominal Trip Setpoint).

COT,,,or (AP span) = +/- (M6 2) 1/2 COTeror (AP span) = +/- (0.52) 1/2 COTor (AP span) = + 0.50 % of AP span = + 0.326 % of Flow span @ 92 % Flow COTe,,or (Flow span) = RD = 1.0 % of Flow span TOTAL COTerror (Flow span) = (0.3262 + 1.02) 12 = 1.052 % of Flow span = 1.262 % Flow @ 92.0 %Flow (e.g., the Nominal trip Setpoint).

EE-0116 Page 100 of 134 Revision 3 See Figure 4.3.9 for specific details.SURRY'S LOW REACTOR COOLANT FLOW REACTOR TRIP OPERATING MARGIN 6.0 % Flow SAFETY MARGIN 2.067 % Flow-I 0 0.CD 0A Nominal Operating Limit 100 % Flow Low Operating Limit 98.0 % Flow Actual Trip Setpoint (ATS)92.0 % Flow Actual Allowable Value (AV)91.0 % Flow Minimum Trip Setpoint (MTS)89.93 % Flow 0.0 0 0 cc z Lo N-C,, W 0 0 0 0 0 Z-0-CD.Ciu 1--Minimum Allowable Value (MAV)89.634 % Flow 0 0-0 N Analytical Limit (AL)87.0 % Flow Figure 4.3.9 4.3.10 Reactor Coolant Pump Undervoltage 4.3.11 Reactor Coolant Pump Underfrequency Altqyv ble Vahi-e': "This A %fa e Vt1"", be P I ýiya,--QA. _0 tp 110 al -P , , -J, EF ower.---Jý xjkg ----

EE-0116 Page 101 of 134 Revision 3 4.3.12 Pressurizer High Level Reactor Trip Allowable Value: j -1 (HotJ (Refs. 5.1, 5.2, 5.7, 5.33, 5.67 & 5.87)The analysis for Surry's Pressurizer High Level Reactor Trip was performed in Section 3.4.3 and the specific details are illustrated in Figure 3.4.3.b.Note: According to Technical Specification 2.3 Basis, 1154 ft 3 is equal to 92 % of level span. The revised LSSS is equal to 89.12 % of level span. According to Technical Report NE-1381, Revision 0, Page 12, 1 % level in the Pressurizer is equal to 74.0 gallons and 1 gallon is equal to 0.13368 ft 3.Then 92 % -89.12 % = 2.88 % level span. So 2.88 % level span

• 74 gallons per % span = 213.12 gallons, taking 213.12 gallons

• 0.13368 ft 3 per gallon = 28.49 ft 3.Subtracting this volume of 28.49 ft 3 from the original volume of 1154 ft 3 yeilds a new volume of 1125.5 ft 3 at 89.12% level.4.3.13 Steam Generator Water Level Low Low Reactor Trip/SI Allowable Value: 16.0 -Narrow RN Le (Refs. 5.1, 5.2, 5.7, 5.35 & 5.60)The analysis for Steam Generator Water Level Low Low Reactor Trip will be based on HARSHIDBE Conditions which will bound both the Reactor Trip and ESFAS Initiation Functions.

Adding the Total Loop Uncertainty (TLU) to the Analytical Limit (AL) yields a Minimum Trip Setpoint (MTS) of 14.764% NR Level. Adding the NON COT error components to the Analytical Limit yields a Minimum Allowable Value (MAV) of 14.426 % NR Level. The Actual Nominal Trip Setpoint of 17.0 % NR Level is conservative with respect to the Minimum Trip Setpoint and the Actual Allowable Value of >14.5 % NR Level is non-conservative with respect to the Minimum Allowable Value. In this case, the current Allowable Value of > 14.5 % NR Level will be changed to > 16.0 % NR Level to meet the requirements of Methods 1 and 2 as discussed in Sections 3.3.1 and 3.3.2. In addition, the new Allowable Value is conservative with respect to the calculated value using the CSA rack error terms from Calculation EE-0432 (Ref 5.35). This Allowable Value of > 16.0 % NR Level is based on maintaining a Nominal Trip Setpoint value of 17.0 % NR Level.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0432 (Ref. 5.35) are given below. The COT and NON COT error components are used in Figure 4.3.13 to determine the Minimum Trip Setpoint (MTS) and the Minimum Allowable Value (MAV).NON COTerror = PMADBE + IR + SPTE + REDBE +/- (PEA2 + (SCA+SMTE)2

+ SD2 + SPE 2 + STE 2 +M1MTE2 + M3MTE2 + RTE 2) 1/2 NON COTeror = 8.75 + 0.265 +3.510 + 0.0 + [0.02 + (0.5+0.361)2

+ 0.28 12 + 1.1582 + 1.0872 + 0.02 +0.1502 + 0.52]j/2 NON COTerror = + 14.426 % of span = + 14.426 % NR Level (worst case).COTertor = +/- (M1 2 + M3 2 + RD 2) 1/2 COTerror = +/- (0.02 +0.52 + 1.02)1 COTerror = + 1.118 % of span = + 1.118 % NR level EE-0116 Page 102 of 134 Revision 3 See Figure 4.3.13 for specific details.SURRY'S STEAM GENERATOR LO-2 LEVEL REACTOR TRIP ESFAS INITIATION Nominal Operating Limit 44.0 % NR Level Low Operating Limit 39.0 % NR Level Actual Trip Setpoint (ATS)17.0 % NR Level Actual Allowable Value (AV)16.00 % NR Level Minimum Trip Setpoint (MTS)14.764 % NR Level Minimum Allowable Value (MAV)14.426 % NR Level Analytical Limit (AL)0.0 % NR Level (DBE)0 m z (n 0 -a O a A o o m m z M -O0 z m OPERATING MARGIN 22.0 % NR Level SAFETY MARGIN 2.236 % NR Level--F a z Z.~~0-4 0)z 0 Figure 4.3.13 4.3.14 Steam Generator Water Level Low Coincident Reactor Trip Allowable Value: 9.19.0:7 Narrow anp-vl (Refs. 5.1, 5.2, 5.7, 5.35 & 5.60)In this case, the current value of > 15.0 % NR Level will be changed to > 19.0 % to ensure it is conservative with respect to the calculated value of the CSA rack error terms from Calculation EE-0432 (Ref 5.35). The Steam Generator Water Level Low Coincident Reactor Trip is a backup reactor trip function and is not credited in the UFSAR Chapter 14 Safety Analysis.

EE-0116 Page 103 of 134 Revision 3 The current Allowable Value > 15.0 % NR Level will be changed to > 19.0 % NR Level to conform to the requirements of Methods 1 and 2 as described in Sections 3.3.1 and 3.3.2. This Allowable Value of> 19.0 % NR Level is based on maintaining a Nominal Trip Setpoint value of 20.0 % Level.4.3.15 Steam Flow Feed Flow Mismatch Coincident Reactor Trip Allowable Value: < 1.0

• 106 lbs/hr (i.e., nominal steam flow at RTP = 3.7533

• 106 lbs/hr)(Refs. 5.1, 5.2, 5.7 & 5.36)This Allowable Value of < 1.0

• 106 lbs/hr is based on maintaining a Nominal Trip Setpoint value of 0.709

• 106 lbs/hr. In this case, the current Allowable Value of < 1.0

• 106 lbs/hr is equal to 26.64 % of nominal steam flow at RTP (i.e., Flownom).

The current Allowable Value will be retained because it is conservative with respect to the calculated value based on the CSA rack error terms from Calculation EE-0355 (Ref 5.36). In addition, the current Allowable Value is conservative with respect to the nominal value used in later versions of Technical Specifications (i.e., = 40.0 % of nominal flow at RTP).The Steam Flow Feed Flow Mismatch Coincident Reactor Trip is a backup reactor trip function and is not credited in the Surry UFSAR Chapter 14 Safety Analysis.4.3.16 Safety Inlection (SI) Input from Engineered Safety Features Actuation System (ESFAS)See Section 4.4.Reactor Trip Permissives Note: In the context of this document, the terms Allowable Value and Setting Limit and Limiting Safety System Setting (LSSS) have the same meaning and intent.4.3.17 Permissive P-6. Intermediate Range Neutron Flux Allowable Value: T he s-ource rang-hig'hfu*high setlnttrlIpsIalb.unIbockeprl o to oi wniiethi.

te mtiedliate..range inuclear flrx decreases to 5 Aimp (Refs. 5.1, 5.2, 5.7,5.29 & 5.57)This Allowable Value of 5

• 10- Amps is based on maintaining a Nominal Trip Setpoint value of 1

• i0-° Amps (1). In this case, the current Allowable Value of 5

• 10-11 Amps will be retained because it is equal to the calibration accuracy of the device. Note that this function is assumed to be available in the UFSAR Chapter 14 Safety Analysis but no specific setpoint is assumed (Ref 5.1).(1) The inequality signs have been removed from the text in order to clarify the actual operation of the"unblock" portion of the permissive function.

EE-0116 Page 104 of 134 Revision 3, Addendum 1 4.3.18 Permissive P-7, Block Low Power Reactor Trips Allowable Value: The reactor trip on low pressurizer pressure, high pressurizer level, turbine trip, and low reactor coolant flow for two or more loops shall be unblocked prior to or when power increases to (Refs. 5.1, 5.2, 5.7, 5.28, 5.38 & 5.63)Permissive P-7 is made up of input signals from Turbine First Stage Pressure and NIS Power Range.Signals to the P-7 and P-10 permissives are supplied from the same bistables in the NIS Power Range drawers. P-7 and P-10 will both enable and block functions from the "trip" and "reset" points of these bistables.

The calibration procedures for the NIS Power Range bistables set the nominal trip setpoints associated with the two permissives such that they will trip whenever the measured reactor power level reaches 10 % power (increasing).

The P-7 input from Turbine First Stage Pressure is currently set to trip at 11.12 % Turbine Load (increasing).

When two out of four of the NIS Power Range channels trip or if one of the two Turbine First Stage Pressure channels trip the following occurs: Permissive P-7 allows reactor trip on the following:

low flow, reactor coolant pump breakers open in more than one loop, undervoltage (RCP busses), underfrequency (RCP) busses, turbine trip, pressurizer low pressure, and pressurizer high level.The "trip" and "reset" of a bistable cannot be the same point. It is physically not possible..:

There must be a deadband between the "trip" and "reset" points. The -calibration procedures, for the NI& Power Range bistables set the nominal reset points for the two pernmissives such'that they reset whenever ,.the measured reactor power level reaches 8% power (decreasing).

The P-7 input from Turbine First Stage.,Pressure is set to reset at 10 % Turbine Load (decreasing)..

When:three out of four of the NIS Power Range channels reset or if two out of the two Turibine First Stage Pressuire channels reset the following occurs:* Permissive P-7 blocks reactor trip on the following:

low flow, reactor coolant pump breakers open in more than one loop, undervoltage, underfrequency, turbine trip, pressurizer low pressure, and pressurizer high level.There is no specific Safety Analysis Limit associated with Permissive P-7. However, Permissive P-7 is"Assumed Available" by Nuclear Analysis and Fuel. Since P-7 is a permissive for functions with Safety Analysis Limits, for conservatism, it will be treated as if it had a Limiting Safety System Setting. In order to account for instrumentation (COT) errors, 1% of reactor power will be added to the P-7 safety function.This results in a Limiting Safety System Setting for the P-7 enable interlock of 11% of reactor power (i.e., Turbine Load). The Trip Setpoint for the Turbine First Stage Pressure Inputs to Permissive P-7 will be changed to 10 % Turbine Load (increasing) and the Reset Setpoint will be changed to 8.8 % Turbine Load (decreasing).

EE-0116 Page 105 of 134 Revision 3 4.3.19 Permissive P-8. Power Range Neutron Flux Allowable Value: The single loop loss of flow reactor trip shall be unblocked prior to or when the power range nuclear flux increases to %f rated (Refs. 5.1, 5.2, 5.7, 5.28 & 5.82)Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 52.48 % Rated Thermal Power (RTP). Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 53.08 % RTP. The Actual Nominal Trip Setpoint of 35.0 % RTP is conservative with respect to the Maximum Trip Setpoint and the current Allowable Value of 50.0 % RTP is conservative with respect to the Maximum Allowable Value (1). The current Allowable Value of 50.0 % RTP will be changed to 37.0 % RTP to conform to the requirements of Methods 1 and 2 as described in Sections 3.3.1 and 3.3.2. The revised Allowable Value of 37.0 % RTP is conservative with respect to the Maximum Allowable Value but is non-conservative with respect to the calculated Allowable Value using the CSA rack error terms from Calculation EE-0198 (Ref. 5.28). The calculated Allowable Value for this function is 36.70 % RTP. The 0.3 % RTP offset is accommodated in the 17.48 % RTP Safety Margin for this trip as illustrated in Figure 4.3.19.This Allowable Value of 37.0 % RTP is based on maintaining a Nominal Trip Setpoint value of 35.0 %RTP.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0198 (Ref. 5.28) are given below. The COT and NON COT error components are used in Figure 4.3.19 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).NON COT,,or = SE + (PMA 1 2 + PMA 2 2 + RMTE 2 + RTE 2) 1,2 NON COTero, = 0.0 + (2.02 + 5.02 + 2.02 + 0.52) 1/2 NON COTror = + 5.766 % of span = + 6.919 % RTP COTr.o. = +/- (RCA' + RD 2) 1/2 COTerror = +/- (1.02 + 1.02) 1/2 COTerror = + 1.414 % of span = + 1.697 % RTP See Figure 4.3.19 for specific details.(1) The inequality signs have been removed from the text in order to clarify the actual operation of the"unblock" portion of the permissive function.

EE-0116 Revision 3 Page 106 of 134 SURRY'S POWER RANGE REACTOR TRIP PERMISSIVE P-8 CL 0 z I.0-0 co u)X C,,, 0 LU 0 0 z_LU 0 Analytical Limit (AL)60.00 % RTP 0.ýT--0 0-Lq SAFETY MARGIN 17.48 % RTP NJ Maximum Allowable Value (MAV)53.08 % RTP Maximum Trip Setpoint (MTS)52.48 % RTP Actual Allowable Value (AV)37.00 % RTP Actual Trip Setpoint (ATS)35.00 % RTP High Operating Limit 11.00 % RTP Nominal Operating Setpoint 10.00 % RTP OPERATING MARGII 19.00 % RTP Figure 4.3.19 EE-0116 Page 107 of 134 Revision 3 4.3.20 Permissive P-10, Power Range Neutron Flux Allowable Values : The power range high flux, low setpoint trip and the intermediate range high flux, high setpoint trip shall be unblocked prior to or when power decreases to o o, ed owe. (Refs. 5.1, 5.2, 5.7 & 5.82)Signals to the P-10 permissive are supplied from bistables in the NIS Power Range drawers. The P-10 permissive enables and blocks functions based on the "trip" and "reset" points of the bistable.

The calibration procedures for the NIS Power Range bistables set the nominal trip setpoint such that it will trip whenever the measured reactor power level reaches 10 % power (increasing).

When two out of four of these channels trip the following occurs:* Permissive P-10: enables manualblock of intermediate range reactor trip, allows manual block of power range (low setpoint) reactor trip, allows manual block of intermediate range rod stop (P-1), and automatically blocks source range reactor trip (P-6).* These bistables also provide one of two inputs to Permissive P-7 to enable certain at power reactor trips (see section 4.3.18 for Permissive P-7).The calibration procedures for the NIS Power Range bistables set the nominal reset point for Permissive P-10 such that it is reset whenever the measured reactor power level reaches 8 % power (decreasing).

When three out of four of these channels reset the following occurs:* Permissive P-10: defeats the manual block of the intermediate range reactor trip, defeats the manual block of power range (low setpoint) reactor trip, and defeats the manual block of intermediate range rod stop." These bistables also provide one of two inputs to Permissive P-7 to block certain at power trips (see section 4.3.18 for Permissive P-7)There is no specific Safety Analysis Limit associated with Permissive P-10. However, it is "Assumed Available" by Nuclear Analysis and Fuel. Since P-10 is a permissive for functions with Safety Analysis Limits and provides an input for Permissive P-7, for conservatism, it will be treated as if it had an Allowable Value. In order to account for instrumentation (COT) errors, 1 % of reactor power is added to the P-10 safety function.

The power range high flux, low setpoint trip and the intermediate range high flux, high setpoint trip shall be unblocked prior to or when power decreases to 7 % of rated power. This results in an Allowable Value for the P-10 (defeat block) interlock of 7 % of reactor power.This Allowable Value of 7.0 % RTP is based on maintaining a Nominal Reset value of 8.0 % RTP decreasing.

The revised Allowable Value of 7 % RTP is conservative with respect to the calculated value using the CSA rack error terms from Calculation EE-0198 (Ref 5.28).

EE-0116 Page 108 of 134 Revision 3 4.4 Setting Limits for Surry Power Station Custom Technical Specifications, Table 3.7-4, Engineered Safety Features Actuation System Instrumentation Setting Limits and Table 3.7-2, Engineered Safety Features Actuation System Instrumentation Operating Conditions Note: In the context of this document, the terms Allowable Value, Setting Limit and Limiting Safety System Setting (LSSS) have the same meaning and intent.4.4.1 Safety Injection, Manual Initiation Allowable Value: N/A There is no specific ESFAS Trip Setpoint associated with this function.4.4.2 Containment Pressure -High Allowable Value: <i (Refs. 5.1, 5.2, 5.7, 5.39 & 5.61)Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 20.463 PSIA. Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 20.731 PSIA. The Actual Nominal Trip Setpoint of 17.7 PSIA is conservative with respect to the Maximum Trip Setpoint and the Actual Allowable Value of < 19.0 PSIA is conservative with respect to the Maximum Allowable Value. The current Allowable Value of < 19.0 PSIA will be changed to < 18.5 PSIA to conform to the requirements of Methods 1 and 2 as described in Sections 3.3.1 and 3.3.2. The revised Allowable Value of < 18.5 PSIA is conservative with respect to the calculated Maximum Allowable Value but is non-conservative with respect to the calculated Allowable Value using the CSA rack error terms from Calculation EE-0131 (Ref.5.39).

The calculated Allowable Value for this function is < 18.427 PSIA. The 0.073 PSIA offset is accommodated in the 2.763 PSIA Safety Margin for this trip as illustrated in Figure 4.4.2.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0131 (Ref. 5.39) are given below. The COT and NON COT error components are used in Figure 4.4.2 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).NON COTerror = [PMA 2 + PEA 2 + (SCA+SMTE)2

+ SD 2+ STE2 + SPE2 + SPSE2 + M1MTE2 +M4MTE2 + RTE2] 1/2 NON COTerror = [0.02 + 0.02 + (0.5+0.215)2

+ 0.3082 + 1.1582 + 0.02 + 0.02 + 0.02 + 0.1502 + 0.52] 1/2 NON COTerror = + 1.490 % of span = + 0.969 PSIA COTeor = +/- (M12 + M42 + RD2) 112 COTerror = +/- (0.02 +0.5 + 1.02)1 COTeror = + 1.118 % of span = + 0.727 PSIA EE-0116 Revision 3 Page 109 of 134 See Figure 4.4.2 for specific details.SURRY'S CONTAINMENT PRESSURE HI-1 ESFAS INITIATION Analytical Limit (AL)21.7 PSIA 0 10 z 5 N.0 1--0 o z (n,, 01 rw I.-0 9 Cn CIO 0.C-4 NS SAFETY MARGIN 2.763 PSIA PERATING MARGIN 6.2 PSIA Maximum Allowable Value (MAV)20.731 PSIA Maximum Trip Setpoint (MTS)20.463 PSIA Actual Allowable Value (AV)18.50 PSIA Actual Trip Setpoint (ATS)17.7 PSIA 0O High Operating Limit 11.5 PSIA Nominal Operating Limit 9.5 PSIA Figure 4.4.2 4.4.3 Containment Pressure High -Hiih Allowable Value <24.00 PSIA (Refs. 5.1, 5.7, 5.39 & 5.61)Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 25.763 PSIA. Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 26.031 PSIA. The Actual Nominal Trip Setpoint of 23.00 PSIA is conservative with respect to the Maximum Trip Setpoint and the Actual Allowable Value of < 25.00 PSIA is conservative with respect to the Maximum Allowable Value. The Allowable Value of < 25.00 PSIA will be changed to < 24.00 PSIA to conform to the requirements of Methods 1 and 2 as described in Sections 3.3.1 and 3.3.2. The revised allowable value of < 24.00 PSIA is conservative with respect to the calculated Maximum Allowable Value but is non-conservative with respect to the calculated Allowable Value using the CSA rack error terms from Calculation EE-0131 (Ref. 5.39).

EE-0116 Revision 3 Page 110 of 134 The calculated Allowable Value for this function is < 23.727 PSIA. The 0.273 PSIA offset is accommodated in the 2.763 PSIA Safety Margin for this function as illustrated in Figure 4.4.3. The statistical combination of the COT and NON COT error components from CSA Calculation EE-0131 (Ref. 5.39) are given below. The COT and NON COT error components are used in Figure 4.4.3 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).NON COTerror = (PMA 2 + PEA 2 + (SCA+SMTE) 2 + SD 2 + SPE 2 + STE 2 + SPSE 2 + M1MTE 2 +M4MTE2 + RTE2) 1/2 NON COTeror = [0.02 + 0.02 + (0.5+0.215)2

+ 0.3082 + 1.1582 + 0.02 + 0.02 + 0.02 + 0.1502 +0.52) 1/2 NON COTerror = + 1.490 % of span = + 0.969 PSIA COTeror = +/- (M1 2 + M4 2 + RD 2) 1/2 COTeor = +/- (0.02 + 0.52+ 1.02) 1/2 COT,,o, = + 1.118 % of span = + 0.727 PSIA SURRY'S CONTAINMENT PRESSURE HI-HI ESFAS INITIATION Analytical Limit (AL)27.0 PSIA 0.0.-I 0 z 0, ZU In I.1C-cc 0 cc w c-0 0 0 z In 0 I-0 0'n X 0 W.I I-0 0 N ii C 0.Ca a, d CL 10 N Maximum Allowable Value (MAV)26.031 PSIA Maximum Trip Setpoint (MTS)25.763 PSIA Actual Allowable Value (AV)24.00 PSIA Actual Trip Setpoint (ATS)23.00 PSIA SAFETY MARGIN 2.763 PSIA OPERATING MARGII 11.0 PSIA High Operating Limit 12.0 PSIA Nominal Operating Setpoint 10.5 PSIA Figure 4.4.3 EE-0116 Page 111 of 134 Revision 3 4.4.4 Pressurizer Pressure Low-Low Allowable Value: >,'P7O _J (Refs. 5.1, 5.2, 5.8, 5.32 & 5.68)Adding the Total Loop Uncertainty (TLU) to the Analytical Limit (AL) yields a Minimum Trip Setpoint (MTS) of 1771.06 PSIG. Adding the NON COT error components to the Analytical Limit yields a Minimum Allowable Value (MAV) of 1770.40 PSIG. The Actual Nominal Trip Setpoint of 1775 PSIG is conservative with respect to the Minimum Trip Setpoint and the Actual Allowable Value of 1760 PSIG is non-conservative with respect to the Minimum Allowable Value. The current Allowable Value> 1760 PSIG will be changed to > 1770 PSIG to conform to the requirements of Methods 1 and 2 as described in Sections 3.3.1 and 3.3.2. In addition, the Nominal Trip Setpoint value of 1775.0 PSIG will be changed to 1780.0 PSIG. The revised Nominal Trip Setpoint value of 1780 PSIG will allow a 10.00 PSIG margin to be used for the COT error components.

The revised Allowable Value of> 1770 PSIG is conservative with respect to the calculated Minimum Allowable Value but is non-conservative with respect to the calculated Allowable Value using the CSA rack error terms from Calculation EE-0514.The calculated Allowable Value for this function is > 1771.056 PSIG based on the revised setpoint of 1780 PSIG and using the COT error components.

The 1.056 PSIG offset is accommodated in the 8.94 PSIG Safety Margin for this trip as illustrated in Figure 4.4.4.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0514 (Ref. 5.32) are given below. The COT and NON COT error components are used in Figure 4.4.4 to determine the Minimum Trip Setpoint (MTS) and the Minimum Allowable Value (MAV).NON COTerror = SE + IR + [PMA2 + SPTE2 + REDBE2 + PEA2 + (SCA+SMTE)2

+ SD2 + SPE2 + STE2+ SPSE 2 + M1MTE2 + M4MTE 2 + RTE2]'12 NON COTeror = 0.0 + .245 + [0.02 + 8.02 + 1.688 2+0.02 + (0.5 + 0.404)2 +0.752 + 0.02 + 2.0132 + 0.02+0.02 +0.152+0.52]1f2 NON COTerror --8.273 % or + 8.763 % of span = + 70.104 PSIG (worst case)COTero+/- = +/- (M1 + M42 + RD2) 11 COTror = +/- (0 + 0.5 2+ 1.02) 1/2 COTro = + 1.118 % of span = + 8.944 PSIG See Figure 4.4.4 for specific details.

EE-0116 Revision 3 Page 112 of 134 SURRY'S PRESSURIZER LO-LO PRESSURE ESFAS INITIATION Nominal Operating Limit 2235 PSIG Low Operating Limit 2210 PSIG Actual Trip Setpoint (ATS)1780 PSIG Minimum Trip Setpoint (MTS)1771.06 PSIG Actual Allowable Value (AV)1770 PSIG Minimum Allowable Value (MAV)1770.40 PSIG Analytical Limit (AL)1700.3 PSIG cn 0 X I-O o 00 cc~0 I.-0 0 U)2i 0 z 4 OPERATING MARGIN 430 PSIG SAFETY MARGIN 8.94 PSIG (Static)03'I-[.-j 0>0i z I.-03 I.0 U-05 Figure 4.4.4 4.4.5 High Differential Pressure Steam Lines Versus Steam Header ESFAS Initiation Allowable Value: <135.0 PS (Refs. 5.1, 5.2, 5.7, 5.36 & 5.65)Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 130.63 PSID. Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 135.60 PSID. The Actual Nominal Trip Setpoint of 120.0 PSID is conservative with respect to the Maximum Trip Setpoint.

However, the current Allowable Value of < 150.0 PSID is non-conservative with respect to the Maximum Allowable Value. The current Allowable Value will be changed from < 150.0 PSID to < 135.0 PSID in order to conform to the requirements of Methods 1 and 2 as described in Sections 3.3.1 and 3.3.2. The revised Allowable Value EE-0116 Page 113 of 134 Revision 3 of < 135.0 PSID is based on maintaining a Nominal Trip Setpoint value of 120.0 PSID. The revised Allowable Value of < 135.0 PSID is conservative with respect to the calculated COTerror shown below.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0355 (Ref. 5.36) are given below. The COT and NON COT error components are used in Figure 4.4.5 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).NON COTerorcsa 7 = [EA 2 + PMA2 + PEA2 + (SCA+SMTE) 2 + SD 2 + SPE 2 + STE 2 + SPSE2 +M1OMTE2] 112 NON COTerror csa7 = [0.02 + 0.02 + 0.02 + (0.5 + 0.207)2 + 0.4292 + 0.02 + 1.4752 + 0.02 + 0.02] 1/2 NON COTenor csa7 = +/- 1.691 % of span = + 23.674 PSID NON COTerror csa 14 [EA 2_+ PMA2 + PEA2 + (SCA+SMTE)2

+ SD2 + SPE + STE + SPSE2 +M17MTE + M18MTE2] 1/2 NON COTerror csa1 4 = [0.02 + 0.02 + 0.02 + (0.5 + 0.207)2 + 0.4292 + 0.02 + 1.4752 + 0.02 + 0.02 + 0.1582]1/2 NON COTerror csa1 4 = +/- 1.698 % of span = + 23.772 PSID NON COTerrorr 4 = (M19MTE 2 + RTE 2) 1/2 NON COTerrorr 4 = [0.2122 + 0.52) 1/2 NON COTerrorr 4 = +/- 0.543 % of span = + 7.602 PSID TOTAL NON COTerror = (NON COTerro.r csa7 2 + NON COTerror csa 142 + NON COTeor r42)1/2 TOTAL NON COTeror = (1.6912 + 1.6982 + 0.5432) 1/2 TOTAL NON COTeor = 2.457 % of span = + 34.40 PSID COTerror = +/- (M10 2 + M172 + M182 + M19 2 + RD 2) 1/2 COTerror = +/- (0.02 + 0.02 + 0.52 + 0.52 + 1.02)1/2 COTeor = +/- 1.225 % of span = + 17.15 PSID See Figure 4.4.5 for-specific details.

EE-0116 Revision 3 Page 114 of 134 SURRY'S HI dP STM LINE VS STM HDR ESFAS INITIATION 0-Z a.0')Analytical Limit (AL)170.0 PSID Maximum Allowable Value (MAV)135.60 PSID Actual Allowable Value (AV)135.0 PSID Maximum Trip Setpoint (MTS)130.63 PSID Actual Trip Setpoint (ATS)120.00 PSID SAFETY MARGIN 10.63 PSID OPERATING MARGIN 100.00 PSID High Operating Limit 20.0 PSID Nominal Operating Limit 0.0 PSID Figure 4.4.5 4.4.6 High Steam Flow in 2/3 Steam Lines Allowable Values :< 40.0 % of full steam flow (at zero load)< 40.0 % of full steam flow (at 20 % load)< 110.0 % of full steam flow (at full load)(Refs. 5.1, 5.2, 5.7, 5.12, 5.38 & 5.62)Subtracting the Total Loop Uncertainty (TLU = 5.982 % of AP span ) from the Analytical Limit (AL =20.76 % of AP span at 0 % power, the most limiting condition) yields a Maximum Trip Setpoint (MTS)of 14.778 % of AP span. Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 14.981 % of AP span. The Actual Nominal Trip Setpoint of 8.30 % of AP span (at 0 % power, the most limiting condition) is conservative with respect to the Maximum Trip Setpoint.

The current Allowable Value of < 9.23 % of AP span (e.g., which is equivalent to 40 % of full steam flow at RTP) is conservative with respect to the Maximum Allowable EE-0116 Page 115 of 134 Revision 3 Value. This Allowable Value of < 9.23 % of AP span is based on maintaining a Nominal Trip Setpoint value of 8.30 % of AP span. See Figure 4.4.6 for specific details.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0457 (Ref. 5,38) are given below. The COT and NON COT error components are used in Figure 4.4.6 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).CSAstm flow NON COTerror = [EA + PMA + PEA + (SCA+SMTE) 2 + SD2 + SPSE2 + STE 2 + SPE2 +M1MTE 2 + M2MTE + RTE2] 1/2 CSAstm flow NON COT.ror = [0.02 + 5.1272 + 0.02 + (0.0+0.0)2

+ 0.4902 + 0.02 + 1.6382 + 1.331 + 0.02 +0.2122 + 0.52]1/2 CSAstm flow NON COTerror = +/- 5.592 % of AP span CSAtfsp NON COTerror = [EA 2 + PMA 2 + PEA 2 + (SCA+SMTE)2

+ SD2 + SPSE2 + STE 2 + SPE2 +M1MTE 2 + M2MTE 2 +M5MTE 2] 1/2 CSAtfsp NON COTerr = [0.02 + 0.02 + 0.02 + (0.5+0.219)2

+ 0.3212 + 0.02 + 1.1912 + 0.02 + 0.02 +0.2122 +0.2122 ] 1/2 CSAtfsp NON COTe,,or = + 1.459 % of AP span TOTAL NON COTror = +/- (5.592 + 1.4592)1/2

= + 5.779 % of AP span CSA 6 & 7 COTerror (M12 + M2 +M12 + M22 + M52 + RD2)1/2 CSA 6&7 COTerror = (0.02 + 0.5 + 0.02 + 0.52 + 1.02) 1/2 CSA 6&7 COTerror = +/- 1.225 % of AP span See Figure 4.4.6 for specific details.

EE-0116 Revision 3 Page 116 of 134 SURRY'S HI STEAM FLOW IN TWO STEAM LINES ESFAS INITIATION CL 0 >U z 0.0 04 00 q., ItO Un 0 M 0 o Ui z_CC '0.00 L) C4 Cni 0 0 CC a 0M Analytical Limit (AL)20.76 % dP span SAFETY MARGIN 6.478 % dP span Maximum Allowable Value (MAV)14.98 % dP span Maximum Trip Setpoint (MTS)14.778 % dP span Actual Allowable Value (AV)9.23 % dP span Actual Trip Setpoint (ATS)8.30 %/ dP span High Operating Limit 2.60 % dP span (Based on SF/FF Mismatch Rx Trip)Nominal Operating Limit 2.9 % dP span (20 % of Flownom)OPERATING MARGIN 5.7 % dP span Figure 4.4.6 Notes: Flowina,, = 4.4 MPPH and FlOWnom = 3.7533 MPPH. Based on Technical Report EE-0100, Appendix 18-5 (Ref.5.12), the equation used to convert from % Flownom to % AP span is : % AP span = ((% Flown,,, / Flowa,,)2 / 1.26169))

• 100. See the example below for the conversion of the Analytical Limit of 60 % of FloWnom to % AP span: ((0.6

• 3.7533) / 4.4)2 / 1.26169))

• 100 = 20.76 % AP span EE-0116 Page 117 of 134 Revision 3 4.4.7 Low TAVG Allowable Value: > 541.0 OF (Refs. 5.1, 5.2, 5.7, 5.31 & 5.69)Adding the Total Loop Uncertainty (TLU) to the Analytical Limit (AL) yields a Minimum Trip Setpoint (MTS) of 541.1 °F. Adding the NON COT error components to the Analytical Limit yields a Minimum Allowable Value (MAV) of 540.276 OF. The Actual Nominal Trip Setpoint of 543.0 °F is conservative with respect to the Minimum Trip Setpoint and the Actual Allowable Value of > 541.0 °F is conservative with respect to the Minimum Allowable Value. This Allowable Value of > 541.0 °F is based on maintaining a Nominal Trip Setpoint value of 543.0 OF. The actual Allowable Value of >541.0 OF is slightly less than the calculated Allowable Value of > 541.342 OF. The 0.342 °F offset is accommodated in the Safety Margin of 1.898 °F. See Figure 4.4.7 for specific details.The statistical combination of the COT and NON COT error components from CSA Calculation EE-0415 (Ref. 5.31) are given below. The COT and NON COT error components are used in Figure 4.4.7 to determine the Minimum Trip Setpoint (MTS) and the Minimum Allowable Value (MAV).CSA 1 1 NON COTerr.or

= [PMATAVG2

+ (SCARTD+SMTERTD)2

+ (SCARTD+SMTERTD)2

+(SCARTD+SMTERTD)2

+ (SCARTD+SMTERTD) 2 + (4

• SDRTD2)+ M1MTE 2 + M2MTE + M3MTE2 +M4MTE2 + M5MTE 2 + M7MTE 2 + M 11MTE 2 + RTE2]112 CSA 1 3 NON COTeor = [1.702 + (0.417+0.167)2

+ (0.417+0.167)2

+ (0.417+0.167)2

+ (0.417+0.167)2

+(4

• 0.252) + 0.2482 + 0.2482 + 0.2482 + 0.2442 + 0.32 + 0.2602 + 0.1502 + 0.52] 1/2 CSA 1 3 NON COTerror = + 2.276 % of span = + 2.276 °F CSA1 3 COTerror = -(M1 2 + M2 2 + M3 2 + M4 2 + M5 2 + M7 2 + M, 12 + RD2) 1/2 CSA 3 COTerror = -- (0.52 + 0.52 + 0.52 + 0.52 + 0.52 + 0.52 + 052 + 1.02)1/2 CSA1 3 COTerror = + 1.658 % of span = + 1.658 °F EE-0116 Revision 3 Page 118 of 134 SURRY'S LOW TAVG ESFAS INITIATION Nominal Operating Limit 547 *F Low Operating Limit 545'F Actual Trip Setpoint (ATS)543 oF Minimum Trip Setpoint (MTS)541.102 'F Actual Allowable Value (AV)541 'F Minimum Allowable Value (MAV)540.276 'F Analytical Limit (AL)538 °F 0 0--4 m 51K 0 0 0-4 0 m o-n o U, z 0 z 0 A0 -4'1 0 Mn OPERATING MARGIN 2.0 'F SAFETY MARGIN 1.898 °F A a z 0 M -iC 41 Figure 4.4.7 4.4.8 Steam Line Pressure -Low Allowable Value:> 510.0 ESIG (Refs. 5.1, 5.2, 5.7, 5.36 & 5.65)Adding the Total Loop Uncertainty (TLU) to the Analytical Limit (AL) yields a Minimum Trip Setpoint (MTS) of 456.11 PSIG. Adding the NON COT error components to the Analytical Limit yields a Minimum Allowable Value (MAV) of 450.09 PSIG. The Actual Nominal Trip Setpoint of 525 PSIG is conservative with respect to the Minimum Trip Setpoint and the Actual Allowable Value of > 500 PSIG is conservative with respect to the Minimum Allowable Value. The current Allowable Value of > 500 PSIG will be changed to > 510 PSIG to conform to the requirements of Methods 1 and 2 as described in Sections 3.3.1 and 3.3.2. The revised Allowable Value of > 510 PSIG is conservative with respect to the calculated value using the CSA rack error terms from Calculation EE-0355 (Ref.5.36).

The calculated Allowable Value for this function is 507.85 PSIG.

EE-0116 Revision 3 Page 119 of 134 The statistical combination of the COT and NON COT error components from CSA Calculation EE-0355 (Ref. 5.36) are given below. The COT and NON COT error components are used in Figure 4.4.8 to determine the Minimum Trip Setpoint (MTS) and the Minimum Allowable Value (MAV).NON COTe,,or = + [EA2 + PMA2 + PEA2 + (SCA+SMTE)2

+ SD2 + SPE2 + STE2 + SPSE2 + M1OMTE2+ M11MTE2 + M12MTE2 + RTE2]1/2 NON COTerror = + [0.02 + 0.02 + 0.02 + (0.5+0.207)2

+ 0.4292 + 0.02 + 1.4752 + 0.02 + 0.02 + 0.1582 +0.052 + 0.52 ]1/2 NON COTerror = + 1.771 % of span = + 24.79 PSIG COTerror = +/- (M102 +M112 + +M122 + RD2) 1 2 COTerror = +/- (0.02 + 0.52+0.52

+ 1.02) 1/2 COTerror = +/- 1.225 % of span = + 17.15 PSIG SURRY'S STEAM LINE PRESSURE LOW ESFAS INITIATION Nominal Operating Limit 800 PSIG Low Operating Limit 755 PSIG Actual Trip Setpoint (ATS)525 PSIG Actual Allowable Value (AV)510 PSIG Minimum Trip Setpoint (MTS)456.11 PSIG Minimum Allowable Value (MAV)450.09 PSIG Analytical Limit (AL)425.3 PSIG 0-41 ml 0 OPERATING MARGIN 230 PSIG (Static)SAFETY MARGIN 68.89 PSIG (Static)A 0 0-I m 0 z 0 z 0 0.-4 m 0 C'n:-4 (0 0 z 0-4>M -C P 00 Dl M)Figure 4.4.8 EE-0116 Page 120 of 134 Revision 3 4.4.9 Steam Generator Water Level Low Low Reactor Trip/SI See item 4.3.13.4.4.10 Low Intake Canal Level Allowable Value: 23fe inches (Refs. 5.1, 5.2, 5.7, 5.77, 5.78, 5.79 & 5.80)Adding the Total Loop Uncertainty (TLU) to the Analytical Limit (AL) yields a Minimum Trip Setpoint (MTS) of 23 feet-5.66 inches. Adding the NON COT error components to the Analytical Limit yields a Minimum Allowable Value (MAV) of 23 feet-5.63 inches. The Actual Nominal Trip Setpoint of 23 feet-6 inches conservative with respect to the Minimum Trip Setpoint and the Actual Allowable Value of 23 feet-6 inches is conservative with respect to the Minimum Allowable Value. However, the current Allowable Value is set equal to the Nominal Trip Setpoint.

In this case, the Allowable Value will be changed from 23 feet-6 inches to 23 feet-5.85 inches. This revised Allowable Value will allow a 0.15 inch margin to be used for the COT error components.

The revised Allowable Value of 23 feet-5.85 inches is conservative with respect to the calculated value using the CSA rack error terms from Calculation EE-0724 (Ref. 5.77) and Engineering Transmittal CEE 98-005 (Ref. 5.78).The statistical combination of the COT and NON COT error components from CSA Calculation EE-0724 (Ref. 5.77) and Engineering Transmittal CEE 98-005 (Ref. 5.78) are given below. The COT and NON COT error components are used in Figure 4.4.10 to determine the Minimum Trip Setpoint (MTS)and the Minimum Allowable Value (MAV).NON COTeor = SE + [EA + PMA + PEA2 + (SCA+SMTE)2

+ SD 2 + SPE 2 + RCA 2 + RTE2] 1,2 NON COTeo, = 56.43 + [0.02 + 0.02 + 0.02 + (5.53 + 0.25)2 + 0.02 + 0.02 + 0.02 + 0.322] 11 NON COT,,or = 56.43 + 5.789 seconds = 50.641 seconds to 62.22 seconds Converting seconds to inches : Calculation ME-0318 (Ref. 5.79) and Engineering Transmittal CEE 98-005 (Ref. 5.78) indicates that with a loss of power, the drop in canal level is linear with respect to time.In 66 seconds, canal level will drop 5.972 inches. Thus, 5.972 inches/66 seconds = 0.0904848 inches/second.

NON COTerror = 50.641 seconds

• 0.0904848 inches = 4.58 inches to 62.22 seconds

• 0.0904848 inches= 5.63 inches (worst case).COTeor = (RMTE 2 + RD2) 1/2 COTeor = (1.702 + 0.642) 1/2 = 1.816 seconds COTeror = + 1.816 seconds

• 0.0904848 inches = 0.1643 inches Figure 4.4.10 for specific details.

EE-0116 Revision 3 Page 121 of 134 SURRYS LOW INTAKE CANAL LEVEL ESFAS INITIATION Nominal Operating Limit Variable (> 24 feet)Low Operating Limit 24 feet Actual Trip Setpoint (ATS)23 feet-6 inches Actual Allowable Value (AV)23 feet-5.85 inches Minimum Trip Setpoint (MTS)23 feet-5.66 inches Minimum Allowable Value (MAV)23 feet-5.63 inches Analytical Limit (AL)23 feet S01 0 Ln m um mmm m+OPERATING MARGIN 6 inches SAFETY MARGIN 0.34 inches m 6 m W CD:.CD to a I!01 01 01 Figure 4.4.10 4.4.11 SG Water Level -High High Allowable Value: %Narrw Rgange ,,N Lev I (Refs. 5.1, 5.2, 5.7, 5.35 & 5.60)Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 85.46 % NR Level. Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 85.80 % NR Level. The Actual Nominal Trip Setpoint of 75.0 % NR Level is conservative with respect to the Maximum Trip Setpoint and the Actual Allowable Value of < 80.0 % NR Level is conservative with respect to the Maximum Allowable Value.The Allowable Value of < 80.0 % NR Level will be changed to < 76.0 % NR Level to conform to the requirements of Methods 1 and 2 as described in Sections 3.3.1 and 3.3.2. The revised allowable value of < 76.0 % NR Level is conservative with respect to the calculated value using CSA rack error terms from Calculation EE-0432 (Ref. 5.35).

EE-0116 Revision 3 Page 122 of 134 The statistical combination of the COT and NON COT error components from CSA Calculation EE-0432 (Ref. 5.35) are given below. The COT and NON COT error components are used in Figure 4.4.11 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).NON COTeror = SE + PMA 2 + [PEA2 + (SCA+SMTE) 2 + SD 2 + SPE2 + STE2 + M1MTE2 + M3MTE2 +RTE2] 1/2 NON COTeror -= 0.0 + (-8.70) + [0.02 + (0.5+0.361)2

+ 0.2812 + 1.1582 + 1.0872 + 0.02 + 0.1502 +0.5211/2 NON COTerr = -10.601 % of span = -10.601 % NR Level COTeror = + (M1 2 + M32 + RD2) 112 COTerror = +/- (0.02 + 0.52 + 1.02) 1/2 COTrror = + 1.118 % of span = + 1.118 % NR Level SURRY'S STEAM GENERATOR HI-2 LEVEL ESFAS INITIATION

---

J 1 C)z 0 uJ 0 z 0 z z ci--0 I--0 0 z 0 Analytical Limit (AL)96.4 % NR Level Maximum Allowable Value (MAV)85.799 % NR Level Maximum Trip Setpoint (MTS)85.461 % NR Level SAFETY MARGIN 10.461 % NR Level OPERATING MARGIN 26.0 % NR Level-Actual Allowable Value (AV)76.00 % NR Level z Actual Trip Setpoint (ATS)75.00 % NR Level High Operating Limit 49.0 % NR Level Nominal Operating Limit 44.0 % NR Level Figure 4.4.11 EE-0116 Page 123 of 134 Revision 3 4.4.12 Refueling Water Storage Tank Level Low -Low RMT Initiation Allowable Values: eve,7n (Refs. 5.1, 5.2, 5.7, 5.41 & 5.58)There are two Analytical Limits and thus two Allowable Values associated with this function.

The Analytical Limits are > 11.25 % WR Level and < 15.75 % WR Level. The corresponding Allowable Values are > 11.25 % WR Level and < 15.75 % WR Level. Both Allowable Values will be analyzed below.Analysis for > 11.25 % Wide Range (WR) Level Adding the Total Loop Uncertainty (TLU) to the Analytical Limit (AL) yields a Minimum Trip Setpoint (MTS) of 13.049 % WR Level. Adding the NON COT error components to the Analytical Limit yields a Minimum Allowable Value (MAV) of 12.605 % WR Level. The Actual Nominal Trip Setpoint of 13.5 % WR Level is conservative with respect to the Minimum Trip Setpoint.

The Actual Allowable Value of > 11.25 % WR Level is non-conservative with respect to the Minimum Allowable Value. The Allowable Value of > 11.25 % WR Level will be changed to > 12.7 % WR Level to conform to the requirements of Methods 1 and 2 as described in Sections 3.3.1 and 3.3.2. The revised Allowable Value of > 12.7 % WR Level is conservative with respect to the calculated value using CSA rack error terms from Calculation EE-0 112 (Ref. 5.41).The statistical combination of the COT and NON COT error components from CSA Calculation EE-0112 (Ref. 5.41) are given below. The COT and NON COT error components are used in Figure 4.4.12 to determine the Minimum Trip Setpoint (MTS) and the Minimum Allowable Value (MAV).NON COTerror = SE + [EA 2 + PMA 2 + PEA 2 + (SCA+SMTE) 2 + SD 2 + SPE 2 + STE 2 + SPSE 2 +M1MTE2 + M3MTE2 + RTE2]I/2 NON COT,,or = 0.0 + [0.02 + 0.02 + 0.02 + (0.5+0.234)2

+ 0.2702 + 0.02 + 0.9762 + 0.02 + 0.02 + 0.1502+0.5 ]2 NON COT,,,, = + 1.355 % of span COTerror = (M12 +M32 + RD2) 12 COTerro, = +/- (0.02 +0.52 + 1.02) 1/2 COTro, = + 1.118 % of span EE-0116 Page 124 of 134 Revision 3 Analysis for < 15.75 % Wide Range (WR) Level Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 13.951 % WR Level. Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 14.395 % WR Level. The Actual Nominal Trip Setpoint of 13.5 % WR Level is conservative with respect to the Maximum Trip Setpoint.The Actual Allowable Value of < 15.75 % WR Level is non-conservative with respect to the Maximum Allowable Value. The Allowable Value of< 15.75 % WR Level will be changed to < 14.3 % WR Level to conform to the requirements of Methods 1 and 2 as described in Sections 3.3.1 and 3.3.2. The revised Allowable Value of < 14.3 % WR Level is conservative with respect to the calculated value using CSA rack error terms from Calculation EE-0 112 (Ref. 5.41).The statistical combination of the COT and NON COT error components from CSA Calculation EE-0112 (Ref. 5.41) are given below. The COT and NON COT error components are used in Figure 4.4.12 to determine the Maximum Trip Setpoint (MTS) and the Maximum Allowable Value (MAV).NON COTerror = SE + [EA 2 + PMA 2 + PEA 2 + (SCA+SMTE) 2 + SD 2 + SPE 2 + STE 2 + SPSE 2 +M1MTE2 + M3MTE + RTE2]1/2 NON COT"or = 0.0 + [0.02 + 0.02 + 0.02 + (0.5+0.234)2

+ 0.2702 + 0.02 + 0.9762 + 0.02 + 0.02 + 0.1502+0.5211/2 NON COT,.ro = + 1.355 % of span COT.ror = +/- (M12 +M32 + RD2) 1/2 COTerror = +/- (0.02 +0.5 + 1.02) 1/2 COT,,or = + 1.118 % of span See Figure 4.4.12 for specific details.

EE-0116 Revision 3 Page 125 of 134 SURRY'S RWST LEVEL LOW- LOW RMT ESFAS INITIATION OPERATING MARGIN 83.2 % WR Level Nominal Operating Limit 97.6 % WR Level Low Operating Limit 96.7 % WR Level High Analytical Limit (AL)15.75 % WR Level 0.0).0I z CD CD-J 9Otn Z Wn SAFETY MARGIN 0.451% WR Level ii 00 3 Un)00 CC cc~M LU SAFETY MARGIN 0.451 % WR Level Maximum Allowable Value (MAV)14.395 % WR Level Actual Allowable Value (AV)14.300 % WR Level Maximum Trip Setpoint (MTS)13.951 % WR Level Actual Trip Setpoint (ATS)13.5 % WR Level Minimum Trip Setpoint (MTS)13.049 % WR Level Actual Allowable Value (AV)12.700 % WR Level Minimum Allowable Value (MAV)12.605 % WR Level Low Analytical Limit (AL)11.25 % WR Level U)u 0 o 0 z., f X*I-- , zcr=U 0J Figure 4.4.12 EE-0116 Page 126 of 134 Revision 3 4.4.13 Refueling Water Storage Tank Level -Low Inside/Outside Recirculation Spray Pump Interlock Allowable Values: > 59.0 % Wide Range (WR) Level and < 61.0 % Wide Range (WR) Level (Refs. 5.1, 5.2, 5.7, 5.41, 5.58 & 5.83)There are two Analytical Limits and thus two Setting Limits associated with this new function.

The Analytical Limits are based on input from the Nuclear Analysis and Fuel group and Technical Report NE- 1460 (Reference 5.83). The Analytical Limits are > 57.50 % WR Level and < 62.50 % WR Level. The corresponding Setting Limits to be used in Technical Specifications are > 59.00 % WR Level and < 61.00 % WR Level. Both Setting Limits will be analyzed below.Analysis for > 59.00 % Wide Range (WR) Level Adding the Total Loop Uncertainty (TLU) to the Analytical Limit (AL) yields a Minimum Trip Setpoint (MTS)of 59.299 % WR Level. Adding the NON COT error components to the Analytical Limit yields a Mijimum Allowable Value (MAV) of 58.855 % WR Level. The Actual Nominal Trip Setpoint of 60.00 % WR Level is conservative with respect to the Minimum Trip Setpoint.

The Actual Allowable Value of> 59.00 % WR Level is conservative with respect to the Minimum Allowable Value. This Allowable Value of> 59.00 % WR Level is based on maintaining a Nominal Trip Setpoint value of 60.00 % WR Level. The Allowable Value of > 59.00% WR Level is conservative with respect to the calculated value using rack error terms (i.e., COT error terms)from Dominion Channel Statistical Allowance (CSA) Calculation EE-01 12 (Reference 5.41).Analysis for < 61.00 % Wide Range (WR) Level Subtracting the Total Loop Uncertainty (TLU) from the Analytical Limit (AL) yields a Maximum Trip Setpoint (MTS) of 60.701 % WR Level. Subtracting the NON COT error components from the Analytical Limit yields a Maximum Allowable Value (MAV) of 61.145 % WR Level. The Actual Nominal Trip Setpoint of 60.00 %WR Level is conservative with respect to the Maximum Trip Setpoint.

The Actual Allowable Value of < 61.00% WR Level is conservative with respect to the Maximum Allowable Value. This Allowable Value of < 61.00% WR Level is based on maintaining a Nominal Trip Setpoint value of 60.00 % WR Level. The Allowable Value of < 61.00 % WR Level is conservative with respect to the calculated value using rack error terms (i.e., COT error terms) from Dominion Channel Statistical Allowance (CSA) Calculation EE-0 112 (Reference 5.41).The statistical combination of the COT and NON COT error components from CSA Calculation EE-01 12 are given below. The COT and NON COT error components are used in Figure 4.4.13 to determine the Minimum/Maximum Trip Setpoints (MTS) and the Minimum/Maximum Allowable Values (MAV).NON COTeor = SE + [EA2 + PMA2 + PEA2 + (SCA+SMTE)2

+ SD2 + SPE + STEa + SPSE 2 + M1MTE2 +M3MTE2 + RTE2] 1/f NON COTerror = 0.0 + [0.02 + 0.02 + 0.02 + (0.5+0.234)2

+ 0.2702 + 0.02 + 0.972 + 0.0 + 0.02 + 0.1502 +0.5211/2 NON COTerror = + 1.355 % of span COTerror = +/- (MI 2+M3 2+ RD2) V2 EE-0116 Page 127 of 134 Revision 3 COT ,or = +/- (0.02 +0.5 + 1.02) 'COTeor = +/- 1.118 % of span See Figure 4.4.13 for specific details.SURRY'S RWST LEVEL LO ESFAS INITIATION Nominal Operating Limit 97.6 % WR Level OPERATING MARGIN 36.70 % WR Level Low Operating Limit 96.7 % WR Level High Analytical Limit (AL)62.50 % WR Level tj 0 10 z e-j I-9on ZW CC L) -0 110 SAFETY MARGIN 0.701% WR Level SAFETY MARGIN 0.701 % WR Level (fli 0 Maximum Allowable Value (MAV)61.145 % WR Level Actual Allowable Value (AV)61.00 % WR Level Maximum Trip Setpoint (MTS)60.701 % WR Level Actual Trip Setpoint (ATS)60.0 % WR Level Minimum Trip Setpoint (MTS)59.299 % WR Level Actual Allowable Value 59.0 % WR Level Minimum Allowable Value 58.855 % WR Level Low Analytical Limit (AL)57.50 % WR Level a4.01--z.J I-In Figure 4.4.13 Note: The COT errors are based on the Minimum Trip Setpoint value minus the Minimum Allowable value and the Actual Trip Setpoint value minus the Actual Allowable Value.

EE-0116 Page 128 of 134 Revision 3 ESFAS Permissives Note: In the context of this document, the terms Allowable Value and Setting Limit and Limiting Safety System Setting (LSSS) have the same meaning and intent.4.4.14 Pressurizer Pressure, P-11 Allowable Value: 12 PS1 d, (Refs. 5.1, 5.2, 5.7, 5.32 & 5.44)Only one Allowable Value will be provided for the P-11 function.

The automatic disabling of the manual block of safety injection on increasing pressure is the portion of this function that is important to safety. The revised Allowable Value of < 2010 PSIG is based on maintaining a Nominal Trip Setpoint value of 2000 PSIG. In this case, the current Allowable Value of < 2000 PSIG is set equal to the Nominal Trip Setpoint.

Changing the Allowable Value to < 2010 PSIG will take into account the tolerances associated with the CSA rack error terms from Calculation EE-0514 (Ref 5.32). The calculated Allowable Value for this function is < 2008.9 PSIG. Note that this function is assumed to be available in the Safety Analysis but no specific setpoint is assumed. The proposed Allowable Value for Surry is the same as the Allowable Value in North Anna's Improved Technical Specifications for the automatic disabling of the manual block of safety injection.

4.4.15 _.TAv, P-12 Allowable Value: <545:OoI" (Refs. 5.1, 5.2, 5.7, 5.31, 5.69)Only one Allowable Value will be provided for the P-12 function.

The automatic disabling of the manual block of the High Steam Flow in 2/3 Lines or Low Steam Pressure coincident with Low TAVG on increasing temperature is the portion of this function that is important to safety. The revised Allowable Value of < 545.0 °F is based on maintaining a Nominal Trip Setpoint value of < 544.0 OF In this case, the current Allowable Value of < 543.0 °F is set equal to the Nominal Trip Setpoint of the Low TAvG Interlock (see section 4.4.7). Changing the Allowable Value to < 545.0 OF will take into account the tolerances associated with the CSA rack error terms from Calculation EE-0415 (Ref 5.31). The revised Allowable Value for this function is conservative with respect to the calculated value of < 545.658 OF (See COTerror from item 4.4.7). Note that this function is assumed to be available in the Safety Analysis but no specific setpoint is assumed.

EE-0116 Page 129 of 134 Revision 3

5.0 REFERENCES

5.1 Technical

Report NE-0994, Revision 13, Safety Analysis Limits for Technical Specification Instrumentation

-Companion to EE-0101 -Surry and North Anna Power Stations, Dated 10-31-05.5.2 Technical Report EE-0101, Revision 9, Setpoint Basis Document -Analytical Limits, Setpoints and Calculations for Technical Specification Instrumentation At North Anna and Surry Power Stations, Dated 06-27-06.5.3 Westinghouse

-NAPS Reactor Protection System/Engineered Safety Features Actuation System Setpoint Methodology (NRC Letter -S/N 541, Dated 09-28-78).

5.4 Engineering

Transmittal CEE 99-0028, Revision 0, Response to Open Items ITS LCO 3.3.1, Surry Power Station Units 1 and 2, Dated 10-29-99.5.5 Dominion Virginia Power STD-EEN-0304, Revision 4, Instrument Uncertainty Calculations.

5.6 Dominion

Virginia Power STD-GN-0030, Revision 7, Nuclear Plant Setpoints.

5.7 Surry

Power Station Technical Specifications.

5.8 North

Anna Power Station Technical Specifications.

5.9 USNRC

Regulatory Guide 1.105, Revision 3 (December 1999), Setpoints for Safety-Related Instrumentation.

5.10 Improved Thermal Design Procedure, Instrument Uncertainties for North Anna Units 1 & 2 Core Uprating C. R. Tuley July 1986, Westinghouse Electric Corporation.

5.11 Dominion Virginia Power Technical Report EE-0099, Revision 0 (AR), North Anna Instrument Tolerance Document.5.12 Dominion Virginia Power Technical Report EE-0100, Revision 2 with Appendices 12 and 18.5.13 Dominion Virginia Power Technical Report EE-0085, Revision 2 with Appendices 12 and 18 5.14 Engineering Transmittal CEE 95-037, Revision 2, Surveillance Limits for Surry Power Station RPS and ESFAS Instrumentation, Dated 03-20-02.5.15 Dominion Virginia Power Calculation EE-0063, Revision 1, CSA for North Anna NIS Power Range Trips.5.16 Dominion Virginia Power Calculation EE-0738, Revision 1, Add. OOA, CSA for North Anna NIS Intermediate Range Trips.5.17 Dominion Virginia Power Calculation EE-07 10, Revision 0, CSA for North Anna NIS Source Range Trips.

EE-0116 Page 130 of 134 Revision 3 5.18 Dominion Virginia Power Calculation EE-0434, Revision 1, CSA for North Anna AT and TAVG Protection.

5.19 Dominion Virginia Power Calculation EE-0069, Revision 3, with Add 00A, CSA for North Anna Pressurizer Pressure Protection.

5.20 Dominion Virginia Power Calculation EE-0058, Revision 2, CSA for North Anna Pressurizer Level Protection.

5.21 Dominion Virginia Power Calculation EE-0060, Revision 2, CSA for North Anna Reactor Coolant Flow Protection.

5.22 Dominion Virginia Power Calculation EE-0492, Revision 2, CSA for North Anna Steam Generator Narrow Range Level Protection.

5.23 Dominion Virginia Power Calculation EE-0736, Revision 1, CSA for North Anna Steam Flow, Steam Pressure and Feedwater Flow Protection.

5.24 Dominion Virginia Power Calculation EE-0524, Revision 0 with ADD OA and OB, CSA for North Anna RCP Undervoltage and Underfrequency Protection.

5.25 Dominion Virginia Power Calculation EE-0052, Revision 2, with Add. OOA, North Anna Containment Narrow Range Pressure Uncertainty.

5.26 Dominion Virginia Power Calculation EE-0121, Revision 3, North Anna Main Steam Pressure Protection Channel Uncertainty.

5.27 Dominion Virginia Power Calculation EE-0092, Revision 2, North Anna Refueling Water Storage Tank Level Uncertainty

-Wide Range.5.28 Dominion Virginia Power Calculation EE-0198, Revision 1 with ADDlA, Setpoint Accuracy for Power Range Neutron Flux High Setpoint Reactor Trip.5.29 Dominion Virginia Power Calculation EE-0722, Revision 1, NIS Intermediate Range Channel Statistical Allowance Calculation.

5.30 Dominion Virginia Power Calculation EE-0719, Revision 0, Nuclear Instrumentation Source Range Uncertainty.

5.31 Dominion Virginia Power Calculation EE-0415, Revision 2, Delta T and T Average Protection Loops, T-412, T-422 and T-432, Surry Power Station, Units 1 and 2.5.32 Dominion Virginia Power Calculation EE-0514, Revision 1, SPS Pressurizer Pressure Protection and Indication CSA.5.33 Dominion Virginia Power Calculation EE-0458, Revision 1, CSA for Surry Pressurizer Level Protection, Surry Units 1 and 2.

EE-0116 Page 131 of 134 Revision 3 5.34 Dominion Virginia Power Calculation EE-0183, Revision 3, CSA Calculation for Surry Power Station Units 1 and 2 Reactor Coolant Flow.5.35 Dominion Virginia Power Calculation EE-0432, Revision 4, CSA for Surry Power Station, Steam Generator Narrow Range Level, Units 1&2, Loops L-1474, L-1475, L-1476, L-1484, L-1485, L-1486, L-1494, L- 1495, L- 1496, L-2474, L-2475, L-2476, L-2484, L-2485, L-2486, L-2494, L-2495, L-2496.5.36 Dominion Virginia Power Calculation EE-0355, Revision 3, with ADD O0A, OOB, OOC, and 00D, Channel Uncertainty for Surry, Units 1 &2 Feedwater Flow, Steam Flow, Steam Pressure and Steam Header Pressure Protection and Control Including Channel Check Criteria for Feedwater and Steam Flow Indication.

5.37 Dominion Virginia Power Calculation EE-0412, Revision 0 with ADD OA and OB, CSA for Surry RCP Undervoltage and Underfrequency Protection.

5.38 Dominion Virginia Power Calculation EE-0457, Revision 1, CSA Calculation for Turbine First Stage Pressure, Steam Break Protection and High Steam Flow SI Actuation, Surry Power Station Units 1 and 2.5.39 Dominion Virginia Power Calculation EE-0131, Revision 4, SPS Reactor Containment Pressure:

Narrow Range Pressure Indication and Protection CSA.5.40 Dominion Virginia Power Calculation EE-0141, Revision 0, Insulation Resistance (IR) Uncertainty Effects for Environmentally Qualified (EQ) Instrumentation.

5.41 Dominion Virginia Power Calculation EE-01 12, Revision 1 with ADD OOC, Refueling Water Storage Tank Level Uncertainty.

5.42 Dominion Virginia Power Calculation EE-0724, Revision 0, CSA for Surry Intake Canal Level.5.43 ISA-RP67.04.02-2000, Methodologies for the Determination of Setpoints for Nuclear Safety Related Instrumentation.

5.44 North Anna Instrument Calibration Procedure 1-ICP-RC-P-1455, Revision 1, Pressurizer Pressure Protection Channel 1 (1-RC-P-1455)

Calibration.

5.45 North Anna Instrument Calibration Procedure 1-ICP-LO-PS-609-4, Revision 10, Reactor Trip From Turbine Trip Auto Stop Oil Pressure Switch (LO-PS-609-4)

Calibration.

5.46 North Anna Instrument Calibration Procedure ICP-NI-1-N-41, Revision 32, Power Range Channel N-41 Protection Channel I.5.47 North Anna Instrument Calibration Procedure ICP-RC-1-T-1412, Revision 26, T-1412 AT/TAVG Protection Ch. I.5.48 North Anna Instrument Calibration Procedure 1-ICP-FW-L-1474, Revision 11, Steam Generator A Narrow Range Level Protection Channel I (L-FW-1474)

Calibration.

EE-0116 Page 132 of 134 Revision 3 5.49 North Anna Instrument Calibration Procedure 1-ICP-MS-F-1474, Revision 17, Steam Generator A Steam Flow and Feed Flow Protection Channel II (F-MS-1474 and F-FW-1477)

Calibration.

5.50 North Anna Instrument Calibration Procedure 1-ICP-MS-P-1474, Revision 2, Steam Line A Steam Pressure Protection Channel II (P-MS-1474)

Calibration.

5.51 North Anna Instrument Calibration Procedure 1-ICP-NI-N-31, Revision 0, NIS Source Range Channel I (N-3 1) Calibration.

5.52 North Anna Instrument Calibration Procedure 1-ICP-QS-L-100A, Revision 9, Refueling Water Storage Tank Level Channel I (L-QS-100A)

Calibration.

5.53 North Anna Instrument Calibration Procedure 1-ICP-RC-F-1414, Revision 1, Reactor Coolant Flow Loop A Protection Channel I (1-RC-F-1414)

Calibration.

5.54 North Anna Instrument Calibration Procedure 1-ICP-RC-L-1459, Revision 2, Pressurizer Level Protection Channel 1 (1-RC-L- 1459) Calibration.

5.55 North Anna Instrument Calibration Procedure ICP-LM-1-P-100A, Revision 12, P-LM100A, Reactor Containment Pressure Protection Channel I.5.56 North Anna Instrument Calibration Procedure ICP-MS-1-P-1446A, Revision 16, P-1446A, First Stage Pressure Protection Channel III.5.57 North Anna Instrument Calibration Procedure ICP-NI-1-N-35, Revision 19, Intermediate Range Channel N-35.5.58 Surry Instrument Periodic Test Procedure 1-ILPT-CC-CS-L-100A, Revision 5, Refueling Water Storage Tank Level Loop L-100A Channel Calibration.

5.59 Surry Instrument Periodic Test Procedure 1-IPT-CC-FW-F-476, Revision 10, Feedwater Flow Loop F-1-476 Channel Calibration.

5.60 Surry Instrument Periodic Test Procedure 1-IPT-CC-FW-L-474, Revision 8, Steam Generator Level Protection Loop L-1-474 Channel Calibration.

5.61 Surry Instrument Periodic Test Procedure 1-IPT-CC-LM-P-lOOA, Revision 9, Containment Pressure Loop P-LM- 1OOA Channel Calibration.

5.62 Surry Instrument Periodic Test Procedure 1-IPT-CC-MS-F-474, Revision 11, Steam Line Flow Protection Loop F-1-474 Channel Calibration.

5.63 Surry Instrument Periodic Test Procedure 1-IPT-CC-MS-P-446, Revision 11, Turbine Load Loop P-1-446 Channel Calibration.

EE-0116 Page 133 of 134 Revision 3 5.64 Surry Instrument Periodic Test Procedure 1-IPT-CC-MS-P-464, Revision 2, Steam Header Pressure Loop P-1-464 Channel Calibration.

5.65 Surry Instrument Periodic Test Procedure 1-IPT-CC-MS-P-474, Revision 7, Steam Line Pressure Loop P-1-474 Channel Calibration.

5.66 Surry Instrument Periodic Test Procedure 1-IPT-CC-RC-F-414, Revision 9, Reactor Coolant Flow Loop F-1-414 Channel Calibration.

5.67 Surry Instrument Periodic Test Procedure 1-IPT-CC-RC-L-459, Revision 11, Pressurizer Level Protection Loop L-1-459 Channel Calibration.

5.68 Surry Instrument Periodic Test Procedure 1-IPT-CC-RC-P-455, Revision 9, Pressurizer Pressure Protection Loop P-1-455 Channel Calibration.

5.69 Surry Instrument Periodic Test Procedure 1-IPT-CC-RC-T-412, Revision 19, Delta T and TAVG Protection Set I Loop T-1-412 Channel Calibration.

5.70 North Anna Maintenance Operating Procedure 1-MOP-55.80, Revision 5, Turbine Stop Valve Closure Position Indication Instrumentation.

5.71 Engineering Transmittal ET-NAF-970142, Rev. 0, Surry Technical Specification

3.2 Limiting

Safety Settings, Protective Instrumentation Modification to Surveillance Procedures Surry units 1 and 2.5.72 Engineering Transmittal CEE-97-029, Rev. 0, Comments on NAF Engineering Transmittal ET-NAF-970142, Rev. 0 (DRAFT), Surry Power Station Units 1 & 2.5.73 Technical Report EE-0068, Revision 0 (AR), Instrument Tolerances for Westinghouse/Hagan 7100 Process Protection and Control System, Surry Power Station.5.74 Calculation SM-932, Revision 0, Surry Core Uprating Rod Withdrawal at Power.5.75 Calculation SM-0933, Revision 0, Generation of OTAT, OPAT, F(AI) Function Constants for Surry Core Uprating.5.76 NAF Technical Report NE-680, Revision 1, Analysis and Evaluations Supporting Implementation of STAT DNB and a 1.62 FAh at Surry units 1 and 2.5.77 Calculation EE-0724, Revision 0, Canal Level Probe Channel Statistical Accuracy Calculation.

Channel Numbers: 1-CW-LS- 102, 1-CW-LS- 103, 2-CW-LS-202, 2-CW-LS-203.

5.78 Engineering Transmittal CEE 98-005, Revision 0, Intake Canal Level Trip Setpoint Procedural Changes, Surry Power Station, Units 1 and 2.5.79 Calculation ME-0318, Revision.

0, Add. OA, Canal Level Probe Response Time.

EE-0116 Page 134 of 134 Revision 3 5.80 1-IPT-CC-CW-L-102, Intake Canal Level Probe 1-CW-LS-102 Time Response Test and Channel Calibration, Revision 8.5.81 Surry Instrument Periodic Test Procedure 1-PT-1.2, Revision 14, NIS Power Range Trip Channel Test.5.82 Surry Instrument Periodic Test Procedure 1-PT- 1.1, Revision 30, NIS Trip Channel Test Prior to Start-up.5.83 Technical Report NE-1460, Rev. 1, "Implementation of GOTHIC Containment Analyses and Revisions to the LOCA Alternate Source Term Analysis to Support Resolution of NRC GL 2004-02 for Surry Power Station", Dated July 2006.5.84 WCAP- 11203, Improved Thermal Design Procedure Instrument Uncertainties for North Anna Units 1&2 Core Uprating.5.85 Engineering Transmittal CEE-06-0010, Revision 0, Determination of RWST Level Allowable Values to Support Technical Report NE-1472 and Technical Specification Change Request N-05 1, North Anna Units 1 and 2, Dated 8-17-06.5.86 Technical Report NE- 1472, Rev. 0, "Implementation of GOTHIC Containment Analyses and Revisions to the LOCA Alternate Source Term Analysis to Support Resolution of NRC GL 2004-02 for North Anna Power Station", Dated 9-27-06.5.87 Technical Report NE-1381, Rev. 0, "Evaluation of Surry Power Station Reactor Coolant System Leak Rate Calculation Surry Power Station", Dated 8-15-2003.