ML20112H228

Proposed Tech Specs Re Scram Discharge Sys & Calibr/ Functional Test Frequency for Analog Trip Units

ML20112H228
Person / Time
Site:	Quad Cities
Issue date:	01/03/1985
From:	COMMONWEALTH EDISON CO.
To:
Shared Package
ML20112H225	List: ML20112H219 ML20112H228
References
NUDOCS 8501170033
Download: ML20112H228 (22)

Text

. _ - . _. . - ._ - . . .

ATTACHMENT 2 Proposed changes to L DPR-30 Revised pages:

3.1/4.2-2 3.1/4.1-2a*

3.1/4.1-3 3.1/4.1-6 3.1/4.1-7 3.1/4.1-8 3.1/4.1-9 3.1/4.1-10 3.1/4.1-11 3.1/4.1-12 3.1/4.1-13 3.1/4.1-14 3.2/4.2-10 3.2/4.2-10a*

3.2/4.2-14 3.2/4.2-14a*

3.2/4.2-16 3.2/4.2-17 3.2/4.2-17a*

3.3/4.3-3 3 ..

• New Page 9551N . 8501170033 850103 P

PDR ADOCK 05000265 PDR

- - - ' w -

m--rw.an--v,.ee,-++-we,--ww,-*-gv-~4w--+-- rv,-. w - v- s e e m ee-- - . - + - s----t- e v -yw -w--s --<e-- - v-r- r ,- ee - --==r~ 1-g ww - w w w--e'-w v

9 l QUAD-CITIES l DPR-30 ,

3.1 LIMITING CONDITIONS FOR OPERATION BASES The reactor protection system automatically initiates a reactor scram to:

a. preserve the integrity of the fuel cladding.

b. preserve the integrity of the primary system, and

c. minimize the energy which must be adsorbed and prevent criticality following a loss-of-coolant accident.

This specification provides the limiting conditions for operation necessary to pre!erve the ability of the system to tolerate single failures and still perform its intended function even during periods when instrument channels may be out of service because of maintenance. When necessary, one channel may be made inoperable for brief intervals to conduct required functional tests and calibrations.

The reactor protection system is of the dual channel type (reference SAR Section 7.7.1.2). The system is

. made up of two independent trip systems, each having two subchannels of tripping devices. Each subchannel has an input from at least one instrument channel which monitors a critical parameter.

The outputs of the subchannels are combined in a one-out-of-two-logic; i.e., an input signal on either one or both of the subchannels will cause a trip system trip. The outputs of the trip systems are arranged so -

that e trip on both systems is required to produce a reactor scram.

This system meets the requirements of the IEEE 279 Standard for Nuclear Power Plant Protection Systems issued September 13, 1966. The system has a reliability greater than that of a two-out-of-three system and somewhat less than that of a one-out-of-two system (reference APED 5179).

With the exception of the average power range monitor (APRM) and intermediate range monitor (IRM) channels, each subchannel has one instrument channel.- When the minimum condition for operation on the number of operable instrument channels per untripped protection trip system is met, or if it cannot be met and the affected protection trip system is placed in a tripped condition, the effectiveness of the protection system is preserved, i.e. the system can tolerate a single failure and still perform its --

intended function of scrammming the reactor. Three APRM instrument channels are provided for each protection trip system.

APRM's #1 and #3 operate contacts in one subchannel, and APRM's #2 and #3 operate contacts in the other subchannel. APRM's #4 and #5, and #6 are arranged similarly in the other protection trip system. Each protection trip system has one more APRM than is necessary to meet the minimum number required per channel. This allows the bypassing of one APRM per protection trip system for maintenance, testing, or calibration. Additional IRM channels have also been provided to allow for bypassing of one such channel.

The bases for the scram settings for the IRM, APRM, high reactor pressure, reactor low water level, turbine control valve fast closure, and turbine stop valve closure are discussed in Specifications 2.1 and 2.2.

Pressure sensing of the drywell is provided to detect a loss-of-coolant accident and initiate the emergency core cooling equipment. The pressure-sensing instrumentation is a backup to the water-level instrumentation which is discussed in Specification 2.1. A scram is provided at the same setting as the emergency core cooling system (ECCS) initiation to minimize the energy which must be accomodated during a loss-of-coolant accident and to prevent the reactor from going critical following the accident.

3.1/4.1-2 0154H I

QUAD-CITIES DPR-30 -

The control rod drive scram system is designed so that all of the water which is discharged from the Reactor by a scram can be accommodated in the discharge piping. A part of this system is an individual instrument volume for each of the south and north CRD accumulators. These two volumes and their piping can hold in excess of 90 gallons of water and is the low point in the piping. No credit was taken for these volumes in the design of the discharge piping relative to the amount of water which must be accommodated during a scram. During normal operations, the discharge volumes are empty; however, should either volume fill with water, the water discharged to the piping from the Reactor may not be accommodated which could result in slow scram times or partial or no control rod insertion. To preclude this occurrence, level switches have been installed in both volumes which will alarm and scram the Reactor when the volume remaining in either instrument volune is approximately 40 gallons. For diversity of level sensing methods that will ensure and provide a scram, both differential pressure switches and thermal switches have been incorporated into the design and logic of the system. The setpoint for the scram signal has been chosen on the basis of providing sufficient volume remaining to accomnodate a scram even with 5 gpm leakage per drive into SDV. As indicated above, there is sufficient volume in the piping to accommodate the scram without impairment of the scram times or the amount of insertion of the control rods. This function shuts the Reactor down while sufficient volume remains to accommodate the discharged water and precludes the situation in which a scram would be required but not be able to ' perform its function properly.

3.1/4.1-2a 0154H

l l

l l

QUAD-CITIES OPR-30 -

Loss of condensate vacuum occurs when the condenser can no longer handle heat input. Loss of condenser vacuum initiates a closure of the turbine stop valves and turbine bypass valves, which eliminates the heat input to the condenser. Closure of the turbine stcp and bypass valves causes a pressure transient, neutron flux rise, and an increase in surface heat flux. i exceeded if this occurs, a reactor scram occurs on turbine stop valve closure.To prevent The turbinethe cladding stop valve safety limit !

closure scram function alone is adequate to prevent the cladding safety limit from being exceeded in the event of a turbine trip transient with bypass closure.

The condenser low-vacuum scram is a backup to the stop valve closure scram and causes a scram before the stop valves are closed, thus the resulting transient is less severe. Scram occurs at 21 inches Hg vacuum, stop valve closure occurs at 20 inches Hg vacuum, and bypass closure at 7 inches Hg vacuum.

High radiation levels in the main steamline tunnel above that due to the normal nitrogen and oxygen radioactivity are an indication of leaking fuel. A scram is initiated whenever such radiation level exceeds seven times normal background. The purpose of this scram is to reduce the source of such radiation to the extent necessary to prevent excessive turbine contamination. Discharge of excessive amounts of radioactivity to the site environs is prevented by the air ejector off-gas monitors, which cause an isolation of the main condenser off-gas ifne provided the limit specified in Specification 3.8 is exceeded.

The main steamline isolation valve closure scram is set to scram when the isolation valves are 105 closed from full open. This scram anticipates the pressure and flux transient which would occur when the valves close. By scranuiing at this setting, the resultant transient is insignificant.

A reactor mode switch is provided which actuates or bypasses the various scram functions appropriate to the particular plant operating status (reference SAR Section 7.7.1.2). Whenever the reactor mode switch is in the Refuel or Startup/ Hot Standby position, the turbine condenser low-vacuum scram and main steamline isolation valve closure scram are bypassed. This bypass has been provided for flexibility during startup and to allow repairs to be made to the turbine condenser. While this bypass is in effect, protection is provided against pressure or flux increases by the high-pressure scram and APRM 155 scram, respectively, which are effective in this mode.

If the reactor were brought to a hot standby condition for repairs to the turbine condenser, the main steamline isolation valves would be closed. No hypothesized single failure or single operator action in this mode of operation can result in an unreviewed radiological release.

, The manual scram function is active in all modes, thus providing for a manual means of rapidly inserting control rods during all modes of reactor operation.

The IRM system provides protection against excessive power levels and short reactor periods in the startup and intermediate power ranges (reference SAR Section 7.4.4.2 and 7.4.4.3). A source range monitor (SRM) system is also provided to supply additional neutron level information during startup but has no scram functions (reference SAR Section 7.4.3.2). Thus the IRM is required in the Refuel and Startup/ Hot Standby

. modes. In addition, protection is provided in this range by the APRM 155 scram as discu: sed in the bases

( for Specification 2.1. In the power range the APRM system provides required protection (reference SAR Section 7.4.5.2). Thus, the IRM system is not required in the Run mode, the APRM's cover only the

-intermediate and pcner range, the IRM's provide adequate coverage in the startup and intermediate range.

' The high-reactor pressure, high-drywell pressure, reactor low water level, and scram discharge volume high level scrans are required for the Startup/ Hot Standby and Run modes of plant operation. They are

. therefore required to be operational for these modes of reactor operation.

The turbine condenser low vacuum scram is required only during power operation and must be bypassed to start up the unit.

3.1/4.1-3 0154H i

F

_,u.--_;--_ . - - . . . _ ~ , _ - _ _ _ . _ _ _ . , _ _ . _ _ . . , _ _ _ . . _ _ _ _ _ _ _ _ . _ . _ . _ . . . , , _ _ _

QUAD-CITIES OFR-30 to an out-of-limits imut. This type of failure for analog devices is a rare occurrence end is detectable by an operator so observes that on signal does not track the other thme. For purposes of analysis, it is assumed that this rare failure will be detected within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

lhe bistable trip circuit *ich is a part of the Goup 2 devices can sustain unsafe failures sich are revealed only on test. Therefore, it is necessary to test then periodically.

A study was conducted of the instnmentation diannels included in the &oup 2 devices to calculate their

' unsafe' failure rates. The analog devices (sensors and anplifiers) are predicated to have an unsafe failure rate of less than 20 X 10-6 fail s/ hour. The bistable trip circuits are predicated to have an unsafe failum rate of less than 2 X l failures / hour. Considering the 2-hour monitoring interval for the analog devices as asstmed above and a mekly test interval for the bistable trip circuits, the design reliability goal of 0.99999 is attained wity anple margin.

The bistable devices are nonitored during plant operation to record their failure history and establish a test interval using the curve of Fipre 4.1-1. Them am ntmerous identical bistable devices used throu@out the plant instrtmentation systen. Therefom, siy11ficant data on the failure rates for the bistable devices should be acctmulated rapidly.

The frequency of calibration of the AFRM flow biasing neterk has been established at each refueling outage. lhe flow biasing network is functionally tested at least once per nonth and, in addition, cross calibration checks of flow frput to the flow-biasing neterk can be made during the functional test by direct netcr reading (IEEE 279 Standard for ibclear Ebwer Plant Protection Systens, Section 4.9, Septerber 13, 1966). There are several instruments sich must be calibrated, and it will take several days to perform the calibration of the entire network. Sile the calibration is being performed, a zero flow signal will be sent to half of the AFRM's, resulting in a half scram and rod block condition. Thus, if the calibration were performed daring operation, flux shaping muld not be possible. Based on experience

,, at other generating stations, drift of instrunent such as those in the flow biasing network is not significant; themfore, to avoid spurious scrams, a calibration frequency of each refueling outage is established.

Reactor low water level instrunents 2-263-57A, 2-263-578, 2-263-584, and 2-263-5EB have been modified to be an analog trip systen. lhe analog trip system consists of an analog sensor (transnitter) and a master / slave trip unit set @ tich ultimately drives a trip relaty. The frequency of calibration and ftrictional testing for instrunent loops of the analog trip systen, including reactor low water level, has been established in Licensing Topical Report E00-21617-A (Decerber 1978). With the oneout-of-twor-taken-twice logic, ED0-21617-A states that each trip unit be stbjected to a calibratiorVfunctional test frequency of one month. An adequate calibratforVsurveillance test interval for the transmitter is once per operating cycle.

Group 3 devices are active only during a given portion of the operational cycle. For exanple, the IRM is active daring startup and inactive during full-power operation. 1hus, the only test that is neaningful is the one performed just prior to shutdom or starttp, i.e., the tests that are performed just prior to use of the instrunent.

Calibration frequency of the instrunent channel is divided into te groups. These are as follows:

1. passive type indicating devices that can be cmpared with like units on a continuous basis, and

! 2. vacutsn tibe'or seniconductor devices and detectors that drift or lose sensitivity..

l 3.1/4.1-6 0153H l

QUAD-CITIES 0FR-30 Experience with passive type instnments in QImonwealth Edison generating stations and stbstations indicates that the specified calibrations am adequate. For those devices sich enploy anplifiers, etc.

&ift specifications call for drift to be less than 0.4%Aonth 1.e., in the period of 'a nonth a &ift of 0.4% would occur, thus providing for adequate margin.

lhe sensitivity of LM detectors decreases with exposure to neutron flux at a slow and @pmxinately constant rate. Dianges in powr distribution and electronic drift also requim cmpensation. This cmpensation is accmplished by calibrating the AM system every 7 days using heat balance data and by calibrating individual LfRM's at least every 1000 equivalent full-powr hours using TIP traverse data.

Calibration on this fmquency assures plant operation at or below thennal limits.

A caparison of Tables 4.1-1 and 4.1-2 indicates that sme instrunent channels have not been included in the latter table. lhese are mode switch in shutdown, manual scran, high water level in scram discharge voltme, main steamline isolation valve closure, turtine control valve fast closure, and turbine stop valve closure. All of the devices or sensors associated with these scram functions are sinple on-off switches, hence calibration is not applicable, i.e., the switch is either on or off. Further, these switches am nounted solidly to the device and have a very low probability of noving; e.g., the thermal switches in the scram discharge volme tank. Based on the abcue, no calibration is required for these instrment channels.

B. The WLPD shall be chedced once per de to determine if the AFRM scram requires adjustment. This nay nonnally be done by checking the LFRM readings, TIP traces, or process cmputer calculations. Only a snall nmber of contrul ruds are nmed daily, thus the peaking factors are not expected to change sipificantly and a daily check of the WLPD is adequate. .

References

1. I. M. Jacobs, " Reliability of Engineemd Safety Features as a Function of Testing Frequentf', 70 clear Safety, W1. 9, ft. 4, m. 310-312, lly - August,1968.

2. Licensing Topical Report fEDD-21617-A (Decenter 1978).

3.1/4.1-7 0153H

9 f

TABLE 3.1-1 REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION REQUIREMENTS REFUEL MODE Minimum Number' ,

of Operable or Tripped Instrument Channels per )

Trip SystemtI Trip Function Trip Level Setting Action (2) 1 Mode Switch in shutdown A 1 Manual scram A IRM 3

3 High flux Inoperative 6120/125 of full scale A APRM(3) 2 High flux (155 scram) Specification 2.1.A.2 A 2 Inoperative A 2 (per bank) High water level 6 40 gallons per bank A discharge volume (*jn) scram 2 High-reactor pressure i 1060 psig A 2 High-drywell pressure (5) i 2 psig A

.2 Reactor low water level 1 8 inches (8) A 2 Turbine ondenser low 1 21 inches Hg vacuum A vacuuntII 2

Mainsteapjjpehigh n 7 X normal full power A radiationt i background 4 Main steam 11ne jsolation i 10% valve closure A valve closurel71 3.1/4.1-8

TABLE 3.1-2 REACTOR PROTECTION SYSTEM (SCRAM) INSTRUMENTATION REQUIREMENTS STARTUP/HCT STANDBY MODE Minicum Number of Op3rable or Trippsd Instrument Channels per

• Trip SystemLI) Trip Function Trip Level Setting Action (2) 1 Mode Switch in shutdown A 1 Manual scram A IRM 3 High flux (120/125 of full scale A 3 Inoperative A APRM(3) 2 High flux (155 scram) Specification 2.1.,A.2 A

-2 Inoperative A 2 High-reactor pressure 4 1060 psig A 2 High-drywell pressure (5) f 2 psig A ,

2 Reactor low water level 1 8 inches (8) A 2 (per bank) High water level i 40 gallons per bank A dischargevolume(jpscram s

2 .

Turbing 121 inches Hg vacuum A vacuunt? J condenser low i 7 X normal full power A 2 Mainsteayljpehigh radiationt J background 4 Main steamline jsolation 6 105 valve closure A valve closurel73 3.1/4.1-9 r

l

)

QUAD-CITIES OPIL-30 1 1

l TABLE 3.1-3 REACTOR PROTECTION SYSTEM (SQWO INSTRUIENTATION REQUIRDENTS RUN MODE Minimum Number of Operable or Tripped Instrument ChanneIs per Trio Svstem(l) Trio Function Trio I.svol Settina Action (D 1 Moder Switch in shutdown A I Manuel scram A m (3) 2 High fluu (flow biased) Specification 2.1.A.I A or B 2 Inoperative A or 8 2 Downsceleill) 1 3/125 of full scale A or B 2 Hlf w ta pressure $ 1060 psig A 2 High-drywell pressure $ 2 psig A 2 Reactor low water level 1 8 inches (8) A 2 (por benid - Hi s at a level in scram $ 40 gallons per bank A discharge volues 2 Turbine condenser low 1 21 inches Hg vacuus A or C vacusse 2 Mein steenline high $ 7 X normel full power A or C redletion(ID background 4 Mein steenline isolation -< 105 valve closure A or C valve closure (6) 2 Turbine control valve fast 1 405 turbine / generator A or C closure (') -

load alsmetch (10) 2 Turbine stop valve $ 105 valve closure A or C closure (9)

2 Turbine EHC control fluid 1 900 pelg A or C low pressure N f

3.1/4.1-10 0154H

QUAD-CITIES 0FR-30 TAB.E 4.1-1 SOUN INSlRLDENTATION AND LGIC SYSTEMS FUNLTIOEL TESTS MINIMLN FlFCTIOML TEST FREQJENCIES Fm SAFETY INSlRUPENTATION, LGIC SYSTEMS, AND GhlROL CIROJITS Instrment Giannel hup (3) functional Test (7) Mininun Fmquency(4)

Mode switch in shutdom A Place mode switch in Each refueling outage shutdown Marual scram A Trip channel and alann fuery 3 months IRM Highflux C Trip channel and alann (5) Before each startup and mekly during refueling (6)

Inoperative C Trip channel and alann Before ead startup and ly during mfueling ARM Hi@ flux B Trip output mlays(5) Oice each w ek Inoperative B Trip output relays Oice each week Otwiscale B Trip output mlays Once each wek High flux 1!K C Trip output relays Before each startup and weklydurip refueling (6; Hi@ reactor pressure A Trip channel and alann (1)

Hi@ drywell pressure A Trip channr1 and alann (1)

Reactor low water level (2) B (8) (1)

A Trip channel and alann Every 3 months Hi@ water level in scrad9) discharge volune (thennal and

... dp switches)

Turbine condenser low vacutsn A Tripchannelandalann (1)

Main steanline hi@ radiation (2) B Trip channel and alan /5) 01ce each week Main steanline isolation valve A Trip channel and alann (1) closure Turbine contml valve fast A Trip channel and alann (1) closure Turtine stop valve closum A Trip channel and alann (1)

Turbine EHC contml fluid low pressure A Trip channel and alann (1) 3.1/4.1-12 0153H

QUAD CITIES

[FR-30 l

TAB.E 4.1-1 (0xit'd) fetes:

1. Initially once per month until exposure hours (M as defined on Figure 4.1-1) are 2$0 X 105; thereafter, accortfing to Figure 4.1-1 with an interval not less than 1 month nor mom than 3 months.

The ccnpilation of instruent failure rate data may include data obtained fmn other boiling water reactors for dich the see design instrunent operates in an erwironment similar to that of (had-Cities thits 1 and 2.

2. An instrunent check shall be perforned on low reactor water level once per day and on hi@ steamline radiation once per shift.

3. A description of the three groups is included in the bases of this specification.

4. Functional tests are not requimd een the systens are not required to be operable or are tripped. If

, tests are missed, they shall be perfonned prior to returning the systems to an operable status.

5. lhis instrunentation is exspted fmn the instrunent functional test definition (1.0 Definition F).

This instrwent functional test will consist of irdecting a sinulated electrical signal into the measurunent channels.

6. Frequency need not exceed weekly.

7. A functional test of the logic of each channel is performed as indicated. This cotpled with placing the node switch in shutdown each refueling outage constitutes a logic system functional test of the scram systen.

8. A functional test of the master and slave trip units is required monthly. A calibration of the trip toit is to be perforned concurnnt with the functional testing.

9. Only the electronics portion of the thernal switches will be tested using an electronic calibrator (kJring the three nonth interval test. A water colunn or equivalent will be used to test the dp switches.

3.1/4.1-13 0153H

QUAD-CITIES

[FR-30 Tall.E 4.1-2 S0Wi INSTRlENT CALIBRATION ,

1 MINNLN CALIBRATION FREQUENCIES FCR REACT (R PROTECTION INSTRlMNT CHWELS j 1

Instrtnent mannel Groto(l) CalibrationStandard(5) Mininun Frequency (2)

High flux IRM C 03tparison to AIRM after Every contplied heat balance shutdownW l l

Hi@ flux AIRM (btput signal B Heat balance 01ce every 7 des Flow bias B Standard pressure and Refueling outage voltage source LIRM B(6) Using TIP systen Every 1000 equivalent full powr hours Hi@ mactor gressure A Standard pressure source Every 3 nonths Hi@ drywll pressure A Standard pressum scurre Every 3 months Reactor low water level B Water level (7)

Turbine condenser low vacuun A Standard vacuun sourte Every 3 rnanths Main stearnline high radiation 8 te radiation Refuelingoutage Appropr(p1 sourte Turbine EHC control fluid A Pmssure source Every 3 nonths Low pressum ,

Hi@ water level in scran A Water level Refueling Outage discharge volune (dp only)

Notes:

1. A description of the three gro@s is included in the bases of this specification.

2. Calibration tests are not requimd en the systens are not required to be operable or are tripped.

l If tests are missed, they shall be perfomed prior to retuming the systens to an operable status, t

3. A curmnt source prwides an instrunent diannel aligrnent every 3 nonths.

4. Maxinun calibration frequency need not exceed once per week.

5. Response time is not part of the routine instrunent dieck and calibration but will be diecked e/ery refueling outage.

6. [bes not prwide scram function.

7. Trip units are calibrated monthly concurrently with functional testing. Transmitters are calibrated once per operating cycle.

3.1/4.1-14 0153H

QUfeCITIES

, 0FR-30 i

@timizing ead channel independently may not truly optimize the system considering the werall rules of l system operation. Homver, true systen optimization is a cmplex problem. The optinuns are broad, not sharp, and optimizing the individual dannels is generally adequate for the systen.

The fortrula given abwe minimizes the unmailability of a single channel dich nust be bypassed during testing. The minimization of the unavailabilpi is illustrated by curve 1 of Figure 4.2-2, tich assures that a sannel has a failure rate of 0.1 X 10 Aour and 0.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is requined to test it. 1he unwailability is a mininun at a test interval 1, of 3.6 X 103hours.

If tw similar channels are used in a one out-of-two configuration, the test interval for mininun availability changes as a function of the rules for testing. The sinplest case is to test each one indq=rdent of the other. In this case, there is assuned to be a finite probability that both my be bypassed at one time. his case is shown by curve 2. ibte that the unwailability is lower, as expected for a redundant systen, and the mininun occurs at the sane test interval. Thus, if the two channels are tested independently, the equation abwe yields the test interval for mininun unavailability.

A more usual case is that the testing is not done independently. If both channels are bypassed and tested at the sane time, the result is shown in curve 3. lete that the mininun occurs at about 40,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />, i much longer than for Cases 1 and 2. Also, the mininun is not nearly as low as Case 2, tich indicates that this method of testing does not take full a&antage of the redundant channel. Bypassing both 4

channels for sinultaneous testing should be avoided.

1he most likely case would be to stipulate that one channel be bypassed, tested, and restored, and then innediately following the second channel be bypassed, tested, and restored. This is shown by curve 4.

j fete that there is not true mininun. lhe curve does have a definite knee, and very little reduction in systen unwailability is achieved by testing at a shorter interval than corputed by the ecpation for a single channel.

The best test procechne of all those exanined is to perfectly stagger the tests. This is, if the test

interval is 4 months, test one of the other damels every 2 months. lhis is shown in curve 5. De difference beteen Cases 4 and 5 is negligible. There my be other argunents, however, that more strongly s@ port the perfectly staggered tests, including redictions in hunan error.

The conclusions to be drann are these

4 a. A one-out-of-n systen my be treated the sane as a single channel in terms of choosing a test interval.

4

b. More than one channel should not be bypassed for testing at any one time.

Reactor water level instruients 2-263-73A & B, WCI hic) steam flow instrurents 2-23894-D, and HPCI stean "i

line low pressure instruments 2-2352 & 2353 have been modified to be analog trip systens. lhe analog trip systen consists of an analog sensor (transmitter) and a master / slave trip unit set @ dich ultinately

&ives a trip rely. _ lhe frequency of calibration and functional testing for instrunent loops of the analog trip systen has been established in Licensing Topical Report IEDD-21617-A (Deceiber 1978). With the one.out-of-two-takerMwice logic, IE00 21617-A states that each trip unit be sihjected to a calibratfor/ functional test frequency of one month. An adequate calibratiorVsurveillante test interval for the transmitter is once per operating cycle.

The radiation monitors in the ventilation duct and on the refueling floor sich initiate building isolation and stanty gas treatment operation are arranged in two one-out-of-two logic systens. The bases given abwe for the rod blocks apply here also and were used to arrive at the functional testing frequency.

3.2/4.2 -10 0153H

4 QUAD-CITIES OFR-30 Bases on experience at Dresden thit I with instnments of similar design, a testing interval of once every 3 rronths has been found to be adequate.

The autmatic pressure relief instnmentation can be considered to be a onsut-of-twoiogic system, and the discussion above applies to it also.

The instruentation which is required for the postaccident condition will be tested and calibrated at regularly sdeduled intervals. The basis for the calibration and testing of this instnmentation is the see as was discussed abcue for the reactor protection systen and the emenjency core cooling systens.

References

1. B. Epstein and A. Shiff, "Inproving kallability and Readiness of Field Equipment Throufi Periodic Inspection", U04.-50451, Latrence Radiation Laboratory, p.10, Equation (24), JJ1y 16,1968.

6.

m 6

3.2/4.2-10a 0153H

TABLE 3.2-3 INSTRUMENTATION THAT INITI ATES ROD BLOCc Minimum Nuncer of Operable or Tripped Instrument Channels per Trip System (I) instrument Trio level Settin 2 APRM upscale (flow blas)(?) i [0.58Wo + 50] FRP (2) .

MFLPD 2 APRM upscale (Refuel and Startup/Not Standby mode) ' 12/125 full scale 4

2 APRM downscaleII) 2 3/125 full scale 1 Rod block egnitor upscale (flow bias)t?) 1 0.65WD + 42 (2) 1 Rod block monitor downstaleII) 1 3/125 full scale 3 IRM downscale(3) (8) 2 3/125 full scale 3 IRM upscale (8) f 108/125 full scale 2(5) $RM detector not in Startup positionL4J 2 2 feet below core center line 3- IRM detector not in Startup 2,2 feet below core center line positiontoJ 2(5)(6) SRM upscale 2 105 counts /sec 2(5) SRM downscale(9) 2 102 counts /see 1(perba$k) High water level in scram i 25 gallons (per bank) discharge volume ($DV) I 1 $DY high water level scram NA trip bypassed NOTE:

1. For the Startup/ Hot Standby and Run positions of the reactor mode selector switch, there shall be two operable or tripped trip systems for each function except the $RM rod blocks. IRM upscale and IRM downscale need not be operable in the Run position, APRM downscale, APRM upscale (flow biased), and RBM downscale need not'be operable in the Startup/ Mot Standby mode. The RBM upscale need not be operable at less than 305 rated thermal power. One channal may be bypassed above 305 rated thermal power provided

~that a limiting control rod pattern does not esist. For systems with more than one channel per trip system, if the first column cannot be met for one of the two trip systems, this condition may exist for uo to 7 days provided that during that time the operable system is functionally tested immediately and daily I thereaf ter; if this condition lasts longer than 7 days the system shall be tripped. If the first column cannot be met for both trip systems, the systems shall be tripped.

3.2/8:2-14

h. e

TABLE 3.2-3 (Cont'd)

Wo is the percent of drive flow required to produce a cated core flow of 98 million Ib/hr. Trip level setting is in percent of rated power (2511 MWt). .

IRM dornscale may be bypassed when it is on its lowest range.

This function is bypassed when the count rate is 2 100 cps. ,

Ona of the four SRM inputs may be bypassed.

This SRM function may be bypassed in the high IRM ranges (ranges 8, 9. and 10) when the IRM upscale rod block is operable.

Not rsquired to be operable when performing low power physics tests at atmospheric pressure during or cfter refueling at power levels not to exceed 5 MWt.

This IRM function occurs when the reactor mode switch is in the Refuel or Startup/ Hot Standby position.

This trip is bypassed when the SRM is fully inserted.

3.2/4.2-14a

l QUAD-CITIES OPR-30 TAiLE 4.2-1 f(NPut TEST AND CALIBRATION FREQDCY FOR GRE AND QNTAlfMWT GXLING SYSTEMS INSIRFENTATION, R00 BLOO(5, AND ISQ.ATIONS(7)

Instnment Functignal Instnment Giannel Testl2 i Qtlibration(2) Instnment 01eck(2)

ECG I;strwentation ,

1. Reactor low-low water level (1) Oice/3 months Once/ day

2. Drywl1 hi@ pressure (1) 01ce/3 nonths ibne 3 Reactor low pressure (1) 01ce/3 months None 4 Cbntainment spray interlock

a. 2/3 com hei@t (1)(10) (10) tbne

b. Omtainment pressure (1) 01ce/3 nonths ibne 5 Low-pressum com cooling (1) Oice/3 months ibne pmp disdiarge

6. thdervoltage 4-KV essential N fueling outage Refueling outage ibne

7. [hgraded voltage Refueling outage (8) Refueling outage 01ceAonth 4-KV essential busses

~

ibd Blocks

1. AFRM domscale (1)(3) (bce/3 months ibne

2. AFRM flow variable (1)(3) Refuelingoutage ibne 3, IRM upscale (5)(3) (5)(3) Pbne

4. IRM domscale (5)(3) (5)(3) Pbne

5. RStupscale (1)(3) Refueling outage None

6. RBM domscale (1)(3) Oice/3 months ibne

7. SRM upscale (5)(3) (5)(3) Pene

8. SRM detector not in startup (5)(3) (6) tbne position

9. IRM detector not in starttp (5) (6) tbne position

10. SRM dowiscale (5)(3) (5)(3) Pbne

11. High water level in scram 01ce/3 nonths !bt applicable ibne discharge voltme (SQf)

12. SDV high level trip Refueling outage Notapplicable None bypassed ,

Main Steamline Isolation

1. Steam tunnel hifi tmperatum Refueling outage Refueling outage ibne

2. Steamline high flow (1) 01ce/3 nonths Oice/ day

3. Steamline low pressum

4. Steamline high radiation

1) 3 (hce/3 months Refeling outage i ibne 1)(4) Dice / day 5, Reactor low low water level 1)(10) (10) 0 ce/dgy ICIC Isolation

1. Steamline hi@ flow 01ce/3 months (9) (hce/3 months (9) None

2. Turbine area hi@ tsperature Refuelingoutage Refuelingoutage Ibne 3 low reactor pressure Qice/3 months 01ce/3 months None 32/42/16 0191

l QUAD-CITIES OPR-30 TAB.E 42-1 ((bnt'd)

Instnment Func i Istrwent (hannel Test2 f 1 Calibration (2) Instrunent (heck (2)

IfCI Isolation

1. Steanline high flow (1)(9)(10) (9)(10) tbne

2. Steamline ama high te@erature Refuelingoutage Refuelingoutage fbne 3, low reactor pressure (1)(10) (10) tbne Reactor Building Ventilation System Isolation and SHITS Initiation

1. Refueling floor radiation monitors (1) Chce/3 months (hce/dgy Steam Jet Air F,)ector Off-Gas Isolation

1. Off-gas radiation monitors (1)(4) Refueling outage (hce/dgy Control Room Ventilation System Isolation

1. Reactor low water level (1) (hce/3 months Chce/ day

2. Dryell high pmssure (1) (hte/3 months ibne 3, Main steanline higi flow (1) (hce/3 months (hce/dgy

4. Ventilation e>haust duct (1) 01ce/3 nonths (hte/ day radiation inonitors Pbtes:

1. Initially once per month until exposure hours (M as defined on Figure 4.1-1) are 2.0 X 105; thereafter, according to Figure 4.1-1 with an interval not less than 1 month nor more than 3 months.

The capilation of instrunent failure rate data may include data obtained from other boiling water reactors for dich the same design instrwent operates in an enviroment similar to that of

();ad Cities thits 1 and 2.

2. Functional tests, calibrations, and instrunent checks are not required een these instrunents are not required to be operable or are tripped.

3. This instrunentation is excepted from the functional test definition. The functional test shall consist of irdetting a sim;iated electrical sipal into the neasurenent channel.

4. This instrunent channel is excepted frcm the functional test definitions and shall be calibrated using simulated electrical signals once every 3 nonths.

5. Functional tests shall be performed before each starttp with a rewired frequency not to exceed once per mek. Calibrations shall be performed during each startup or during contmiled shutdoms with a required frequency not to exceed once per week.

3 2/4.2-17 0153H

QUAIXITIES tm-30 fetes: (Cbnt)

6. The positioning mechanism shall be calibrated every refueling outage.

7. Logic systen functional tests are perfonned as specified in the applicable section for these systens. I

8. Functional tests shall include verification of operation of the deyaded voltage. 5 minute timer and 7 second irteent timer.

9. Verification of the time delay setting of 3_ t _10 seconds shall be perfonned during each refueling outage.

10. Trip units are functionally tested monthly. A calibration of the trip unit is to be perfonned concurrent with the fmetional testing. Transmitters are calibrated once per operating cycle.

3.2/4.2-17a

QUAD CITIES DPR-30 i

3. 1re artml zcd driw hasirg a4pcrt 3. 1he arrectress & tte czrtml zod system stall be in pla:e drirg Insetor ettdraal apr6e irpJt to tre %

poer ==+1m ad dw1 tre zusctor crziputer stall te wrified after loadirg coolart systs is r==== M abcne

^ tre segree.

=wW =de presure with fiel in the reacts wesel u11 ass all cxr1 trol rods Prix to the start of crztml zod are fbily Armerted ard %ecificatial dttdraal toerds criticality, the 3.3A.1 is met, rur=hility of tte zod wrth minimimr to sugerly fulfill its ftrctim stall be

a. Oztzol Itd wittdtnel saproes verified by tre fbiladrg cracks:

stall te #mblie dn s) ttat nednun zusctivity that cruld te aihd by a. The RH crNpJter m life diEJustic drmcut of sif ircreient of any are test shall te azzassfully perfaced.

acr1 trol blah wuld be azh that the zod dcap acz:idrt thsigilimit of 2D b. Pzoper sniciatial of the selectial calAgn. is rut e. error # cre cut-of-segarte cxrtrol zod shall te verified.

b. Wienewr tre reactm is in tre Starttp4tt Stancty z Rn acde below c. The zod b1cr$< flictial of tre RH 2x zutad tremal peer, tte zod stall te wrified ty dttdradru tre

erth minimiar stall te repr*>1a. A first zod as an cut.cf-esprre amo2d @erntz cr cplified ccrtrol zod ro note ths1 to tre black tactrdcal persri ney te tand as a poirt.

sistitute ftr m irrTmhl* zod erth minimiar thich fhils after 4. Prior to czztml zod dttdroel fbr wittdraal of at Jamst 12 cmtzol starttp or cirirg refuelirg, verify that zods to tte fully dthdren a Janst te scurce zange crumels tue m l position. The zod scrth minim 12er cheerwd czart zate of at 3 asst ttree say also te bpssed fbe Icw pmer carts per ancord.

shysics testirg to chntrutzute tre stutztwi nazgin -d==ts of 5. Iten a limitirg acrtml zod puttam

' %scificatia13.3A if a rtclear odsts, an instrunrt flictfani test & ~-

sigireer is preert ud verifles the the RN shall te r -ummi prior to step ey-ste rod amnsts & tre dttrkmal & tre ctsigstad, rod (s) ed test gxcomize. daily thereafter.

4. Ctrtrol irrt shall rot be dttrkan ftr 6, 1te scrsn disturge wlue wrt ard dein startto cr reflality trilass at 3sust two w1ws stall be wriflad men at lasst scurts zuge ctavels how m cheerved once per 31 chys. 1hemes vales ney be cart zute artal to e greater trun three cleasd intermittently fbe testirg trtkr czarts per setxrch and these SN's are adninistzstive crrtzol and at least arm fully irnertad. per 22 chys, each alw stall be cyclad thetigi at 3sast cre comlete cy:le &

5. Durirg r==+!m with limitirg cxrtzol full tzmel. At 1sest croe each zod pui.isu o, as determirled by tre .

Reflalirg QJtage, the sczm discturge rtclamr algirner, either: elue vet ard cknin alas d1l be derrstrated to:

a. both RN crumels stall be rpernhle, g

a. Clase ethin :D sa:xrds after zuceipt l

b. artzol zod dthdraal stall be # a sigal ftr certzol zods to b1cr$ed; a scr e , a d -

b. Curi dun tre scrum sigal is zuset.

3.3/4.3-3

.x ATTACHMENT 3 Evaluation of Significant Hazards Consideration f Description of Amendment Request This amendment request reflects changes to the scram

discharge system and revision of the calibration / functional test requirements for specific instrumentation which is being converted

into analog. trip system.

o

~

1 Subsequent to a failure of 76 of 185 control rods to fully insert at Browns Ferry Unit 3 in response to a manual scram signal, the-Commission had embarked on an indepth review of the BWR control rod drive system which identified a number of design issues

. requiring both short and long term corrective measures. On October ll 1, 1980 letters were sent to all BWR-licensees requesting j- commitments to reevaluate the present scram system and modifying it i as necessary to meet both the design and performance criteria as developed by the BWR Owners Subgroup. Accordingly, a Confirmatory Order was written June 24, 1983 for Quad Cities Unit 2 regarding a

', schedule for-implementation of the long term corrective actions.

x That: Confirmatory Order also provided model technical specification changes. Based on our final design and upon a review of the- model^

, technical specifications, Commonwealth Edison is proposing a number.

of changes to Appendix A of the Technical Specification for Quad Cities. Unit 2.in-accordance with the forementioned Confirmatory e m0rder.

As for the other changes, in order to comply with the

-; Environmental Qualification Electrical Equipment Rule, Quad Cities Unit 2-will' replace certain equipment with.a new analog trip system. The proposed changes provide for a channel calibration

-frequency'of'once per operating cycle for the transmitter. The NRC has found.this calibration frequency acceptable per NE00-21617-A and a similar. change has been approved for use at Quad Cities Unit.l.

Basis for Proposed No Significant Hazards Consideration Determination The Commission has provided guidance concerning the application of standards for determining whether.a significant hazards consideration exists'by providing specific examples in 48 FR 14870.

The SDVEmodification. installed additional equipment and ,

' instrumentation.for which we have proposed specific surveillance requirements. Accordingly,_we believe.the chan SDV' modification 11s encompassed by example (ii)ges in 48proposed FR 14870for the

.because of- the additional limitations and restrictions that ~ will be 1

added by the SDV portion of.this amendment. As for the calibration changes for the analog / trip equipment, the use of those units and the acceptable intervals for their calibration and testing has been reviewed and accepted by the NRC in their review of General Electric Topical Report NEDO-21617-A and for Quad Cities Unit 1. The calibration interval of the transmitter (channel calibration) is less stringent than the current requirements on the existing equipment but.nevertheless falls within the requirements of the Standard Technical Specifications. Accordingly, with the NRC's approval of the referenced Topical Report and its use at Quad Cities Unit 1 we feel this amendment requests falls within the example (vi) of the guidance provided by the NRC in 48 FR 14870.

Therefore, since the application for amendment involves a proposed changes are similar to examples for which no significant hazards consideration exists, Commonwealth Edison has made a proposed determination that the application involves no significant hazards consideration.

9551N 1