RNP-RA/13-0117, License Amendment Request to Modify Technical Specification 3.3.1, Reactor Protection System (RPS) Instrumentation

License Amendment Request to Modify Technical Specification 3.3.1, Reactor Protection System (RPS) Instrumentation

ML14052A065
Person / Time
Site:	Robinson
Issue date:	02/10/2014
From:	William Gideon Duke Energy Progress
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RNP-RA/13-0117
Download: ML14052A065 (213)

Text

W. R. Gideon H. B. Robinson Steam DUKE Site Vice President n ENERGY EY oDuke Energy Progress 3581 West Entrance Road Hartsville, SC 29550 0: 8438571701 F: 843 857 1319 Randj Gideon@duke-ener*f.com 10 CFR 50.90 Serial: RNP-RAI13-0117 FE8 1 0 2014 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 H. B. ROBINSON STEAM ELECTRIC PLANT, UNIT NO. 2 DOCKET NO. 50-261/RENEWED LICENSE NO. DPR-23 LICENSE AMENDMENT REQUEST TO MODIFY TECHNICAL SPECIFICATION 3.3.1, REACTOR PROTECTION SYSTEM (RPS) INSTRUMENTATION

Dear Sir or Madam:

Pursuant to 10 CFR 50.90, Duke Energy Progress, Inc., hereby requests an amendment to the H. B. Robinson Steam Electric Plant, Unit No. 2 (HBRSEP) renewed facility operating license DPR-23, Appendix A, Technical Specifications.

The proposed amendment would revise the Technical Specification (TS) for the Reactor Protection System Instrumentation Turbine Trip function on Low Auto Stop Oil Pressure to a Turbine Trip function on Low Fluid Oil Pressure. In addition, the Nominal Trip Setpoint will be changed from its current value of 45 psig to 800 psig and a corresponding change in the Allowable Value from 40.87 psig to 769 psig. These changes to the TS are due to the relocation of three pressure switches from the low pressure Auto Stop Oil (ASO) system that operates at a nominal control pressure of 80 psig to the high pressure Auto Stop Trip (AST) header that operates at a nominal control pressure of 2000 psig. Relocation of the pressure switches is necessary to accommodate deletion of the ASO system as part of a Turbine Control System (TCS) upgrade while maintaining the function of transmitting the trip signal to the Reactor Protection System. The proposed amendment would also revise the TS by adding requirements to assess channel performance during testing that verifies instrument channel setting values established by the plant-specific setpoint methodology.

The proposed change incorporates Technical Specification Task Force (TSTF) Traveler TSTF-493-A, Revision 4, "Clarify Application of Setpoint Methodology for LSSS Functions," Option A for the AST function only. TSTF-493-A revises the Improved Standard TS to address NRC concerns that the TS requirements for Limiting Safety System Settings (LSSS) may not be fully in compliance with the intent of 10 CFR 50.36.

The Enclosure provides the basis for the proposed change, including a detailed description, technical and regulatory evaluations, environmental considerations, and Duke Energy Progress, Inc.'s determination that the proposed change does not involve a significant hazards consideration. The proposed marked-up and retyped TS pages are provided in Attachments 1 and 2 to the Enclosure respectively. Marked-up TS Bases are included in Attachment 3 to the Enclosure for information. Attachment 4 provides one copy of procedure EGR-NGGC-01 53, "Engineering Instrument Setpoints." f\PItL

United States Nuclear Regulatory Commission Serial: RNP-RA/13-0117 Page 2 of 2 Approval of the proposed amendment is requested by January 15, 2015. Once approved, the amendment shall be implemented prior to start-up after implementation of the modification currently scheduled for the HBRSEP Unit 2 Cycle 29 refueling outage, in the spring of 2015.

In accordance with 10 CFR 50.91(a)(1), "Notice for public comment; State consultation" the analysis about the issue of no significant hazards consideration using the standards in 10 CFR 50.92 is being provided to the Commission.

The proposed change has been reviewed by the HBRSEP Plant Nuclear Safety Committee.

This letter contains no new Regulatory Commitments.

In accordance with 10 CFR 50.91(b), a copy of this application is being provided to the State of South Carolina. If you have any questions regarding this submittal, please contact Mr. Richard Hightower, Manager - Nuclear Regulatory Affairs at (843) 857-1329.

I declare under penalty of perjury that the foregoing is true and correct.

Executed On: (-t,(lg Sincerely, William R. Gideon Site Vice President WRG/jk Enclosure cc: Ms. S. E. Jenkins, Manager, Infectious and Radioactive Waste Management Section (SC)

Mr. V. McCree, NRC Region II Mr. S. P. Lingam, NRC Project Manager, NRR NRC Resident Inspectors, HBRSEP Mr. A. Wilson, Attorney General (SC)

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/13-0117 ENCLOSURE Evaluation of Proposed Change to Technical Specification Reactor Trip on Low Electro-Hydraulic Fluid Oil Pressure 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION 3.0 TECHNICAL EVALUTION

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 4.2 Precedent 4.3 No Significant Hazards Consideration 4.4 Conclusions

6.0 REFERENCES

ATTACHMENTS:

1- Marked-Up Technical Specifications 2- Retyped Technical Specifications Page 3- Marked-Up Technical Specifications Bases Pages (For Information Only) 4- Procedure EGR-NGGC-0153, Engineering Instrument Setpoints I

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/13-0117 1.0

SUMMARY

DESCRIPTION Pursuant to 10 CFR 50.90, Duke Energy Progress, Inc., is hereby requesting an amendment to Renewed Facility Operating License No. DPR-23 for H. B. Robinson Steam Electric Plant (HBRSEP) Unit 2. The proposed change would modify the Technical Specification (TS)

Nominal Trip Setpoint and Allowable Value for the Low Auto Stop Oil (ASO) Pressure initiation of a reactor trip on turbine trip.

The proposed amendment would modify the Turbine Trip function in Table 3.3.1-1 for function 15.a, Low ASO Pressure, which has a Nominal Trip Setpoint of 45 psig and an Allowable Value of ->40.87 psig. The Low ASO Pressure would be replaced by Low Electro-Hydraulic (EH) Fluid Oil Pressure having a Nominal Trip Setpoint of 800 psig and an Allowable Value of ->769 psig.

Although not required to address the setpoint change, the proposed change also revises the Technical Specifications (TSs) by applying additional testing requirements listed in Technical Specifications Task Force (TSTF) Traveler TSTF-493-A, Revision 4, "Clarify Application of Setpoint Methodology for LSSS [limiting safety system settings] Functions," for the Low EH Fluid Oil Pressure trip only. This TS change is made by the addition of individual surveillance Note requirements to applicable instrument Functions in accordance with Option A of TSTF-493, Revision 4. Changes to the TS Bases reflect the nomenclature for the system change from Low ASO Pressure to the Low EH Fluid Oil Pressure as well as changes resulting from TSTF-493-A. Note that the HBRSEP Bases differ from the Bases in TSTF-493 therefore the markup differs as well.

Duke Energy Progress has reviewed the model safety evaluation (SE) referenced in the FederalRegister Notice of Availability published on May 11, 2010 (75 FR 26294). As described herein, Duke Energy Progress has concluded that the justifications presented in TSTF-493, Revision 4, Option A, and the model SE prepared by the NRC staff for Option A, are applicable to HBRSEP.

The background for this application is adequately addressed by the NRC Notice of Availability published in the FederalRegister on May 11, 2010 (75 FR 26294).

2.0 DETAILED DESCRIPTION The purpose of this license amendment submittal is to request a change to the Technical Specification Nominal Trip Setpoint and Allowable Value for turbine trip on low ASO pressure. Currently, the three pressure switches located on the low pressure ASO header provide the Reactor Protection System (RPS) input signals for a reactor trip on turbine trip.

Elimination of the low pressure ASO system will include the removal of the three ASO pressure switches. The function performed by these three switches will now be performed by 2

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/13-0117 three new pressure switches located on the high pressure AST header; a part of the Electro-Hydraulic Control (EHC) System. The EHC System supplies EH fluid to the turbine stop, governor, intercept and reheat valves. The EH control fluid for the AST header is provided by skid-mounted hydraulic pumps that maintain operating pressure at approximately 2000 psig. The operation of the turbine is wholly dependent on maintaining proper EHC system pressure. There are no significant pressure transients associated with the EHC operation.

The circuitry associated with the pressure switches and the reactor protection system is independent of the new turbine control system.

Following a turbine trip, drain valves connected to the control EH fluid header open, the EH control fluid is drained from the piping, and the pressure rapidly decreases. The decreased EH control fluid pressure is sensed by the new AST header pressure switches. When the decreased pressure is sensed by two out of three switches a reactor trip signal is initiated.

Relocation of the three pressure switches requires a new turbine trip Nominal Trip Setpoint and Allowable Value for low AST header pressure rather than low Auto Stop Oil pressure and consequently, a change to HBRSEP Technical Specification Table 3.3.1-1.

This submittal also incorporates TSTF-493, Option A for the Low EH Fluid Oil Pressure function, Table 3.3.1-1, item 15.

3.0 TECHNICAL EVALUTION Change to Setpoint Value in Table 3.3.1-1, Item 15 The HBRSEP RPS includes a reactor trip following a turbine trip on low Auto Stop Oil Pressure. This trip anticipates the loss of heat removal capabilities of the secondary system following a turbine trip and acts to minimize the pressure/temperature transient on the Reactor Coolant System. When the low pressure condition is sensed by two out of the three pressure switches following a turbine trip, the EH fluid header drain valves open, and the turbine control EH fluid header is rapidly depressurized resulting in the initiation of a reactor trip signal.

The reactor trip on turbine generator trip is an anticipatory trip and the accident analyses do not credit this trip for any core protection function. Unit 2 is designed to withstand a complete loss of load and not sustain core damage or challenge the Reactor Coolant System (RCS) pressure limitations. Core protection is provided by the Pressurizer Pressure

- High trip function, and RCS integrity is ensured by the pressurizer safety valves.

For the new configuration, the pressure switches utilized to generate the signal to the RPS will be multi-contact switches installed locally in the Turbine EHC fluid system. This installation is in the same general location near the turbine front standard as the present ASO switches. The switches sense the EH fluid oil pressure and provide contact "change of state" input signals to the RPS logic to initiate a reactor trip on low EH fluid oil pressure when two of three pressure switches sense pressure is below the trip setpoint. Each switch provides contact inputs to both RPS trip logic trains (the trip logic remains the same). Two 3

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/1 3-0117 of three switches below the setpoint is indicative of a turbine trip and causes a reactor trip if reactor power is above 40% (P-8). The purpose of the trip is to reduce the severity of the ensuing transient when the turbine is tripped at power. This reactor trip function is not required below 40% reactor power and is automatically blocked. The new Unit 2 pressure switches that sense the AST pressure are independent of (i.e., do not interface with or provide input to) the control function of Turbine Control System (TCS).

The pressure switches are Quality Class "D", non-safety related, non-seismic devices. The switches are the same type of switches used for the ASO System with the exception that the new switches are upgraded and do not use mercury. The new switches are designed for consistent, dependable operation at the higher EH fluid oil pressure. Operational experience has shown this style of switch to be reliable. The piping connecting the switches to the AST header is capable of withstanding the system pressure. Postulated pipe breaks in the AST header do not need to be considered in the design as no safety-related equipment would be adversely impacted. A break would result in closure of the associated turbine valves and actuation of the pressure switches.

The low pressure setpoint must provide an un-ambiguous, non-spurious indication of turbine trip status. The reactor trip on turbine trip function of the low EH fluid oil pressure is not credited in the accident analysis. The calculational setpoint uncertainties are determined for normal conditions since the switches are not credited for operation under accident conditions and therefore will not be exposed to adverse environmental conditions before or during the time they are needed to function. The purpose of the switches is to actuate a reactor trip in response to a turbine trip event, not as a direct result of an accident such as a Loss Of Coolant Accident (LOCA) or a Main Steam Line Break (MSLB). As the safety analyses do not credit the operation of the reactor trip on turbine trip function of the low EH fluid oil pressure, nor is there an associated analytical limit, the Low EH Fluid Oil Pressure setpoint is not a limiting setpoint and is not used to protect a design or license bases limiting condition. The Low EH Fluid Oil Pressure setpoint represents the turbine tripped/not tripped physical condition.

The setpoint value of 800 psig was based on the minimum required EHC fluid oil pressure, the expected calibration tolerance and frequency of the switches, and the expected time-based drift of the pressure switches. The new low EH fluid oil pressure setpoint accounts for recovery actions from a decreasing EHC system pressure occurrence prior to a turbine trip, such as valve testing or system component failure or leakage. The EHC System low pressure alarm setpoint will have sufficient margin from the system trip setpoint. The high pressure EH fluid "Low Pressure Alarm" occurs on decreasing pressure at 1400 psig and alarms the operator in the control room that the EH fluid oil pressure is decreasing. The "Main Pump Auto Start" is initiated on decreasing pressure at 1350 psig and starts the backup EH fluid oil pump to maintain pressure in the high pressure header to prevent a turbine trip. This allows for operator action to recover the EH fluid oil pressure in response to the Low Pressure Alarm and Main Pump Auto Start action. If EH fluid oil pressure is not recovered by the time the pressure drops below 800 psig, the turbine will trip (as sensed by 4

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/13-0117 independent pressure switches) and the new AST header pressure switch contacts will close and consequently send a trip signal to the RPS. This value was evaluated and confirmed to be acceptable.

NUREG-1431, Revision 4, Standard Technical Specifications Westinghouse Plants, (Ref. 1) provides the referenced Nominal Trip Setpoint for Turbine Trip on Low EH Fluid Oil Pressure as 800 psig. This value is consistent with the EHC operating system pressure range associated with this parameter for HBRSEP. The changed value is also consistent with that of the D. C. Cook Nuclear Plant Unit 2 which implemented a similar modification. Additional discussion of the similarities between the HBRSEP and D. C. Cook plant approaches to Technical Specification changes for reactor trip on low turbine oil pressure is provided in Section 4.2.

The setpoint is offset from the analytical limit (Allowable Value) such that the limit will not be exceeded due to instrument uncertainties expected to be present between calibrations. The Standard Westinghouse Technical Specification lists an Allowable Value for Turbine Trip on Low EH Fluid Oil Pressure as greater than or equal to 750 psig. HBRSEP evaluated and confirmed that the Allowable Value of >769 psig was sufficient to account for uncertainties and margin.

ISA Standard ISA-RP67.04.02-2000 - Methodologies for the Determinationof Setpoints for Nuclear Safety-Related Instrumentation,(Ref. 2), defines the methodologies for the determination of setpoints for nuclear safety-related instrumentation. Though the pressure switches are considered non-safety related, the new turbine trip setpoint on low AST header pressure has been determined in accordance with this standard. Pertinent variations, including reference accuracy, calibration error, drift and temperature were considered in determining a total device uncertainty for the pressure switches.

In order to ensure that the instrument channel is capable of performing its specified function, HBRSEP will include testing of this channel in accordance with current station procedures that govern the control of calibration requirements (including as-found and as-left tolerances), and the evaluation of out-of-tolerance instruments. Calibration accuracy is defined to the manufacturer's reference accuracy. As-found instrument tolerances found out of the specified allowable band are entered into the station's Corrective Action Program for assessment on operability and impact on the equipment reliability in accordance with the Maintenance Rule Program.

Following NRC approval of this Amendment Request and after completion of the modification, Technical Specification Table 3.3.1-1, Reactor Protection System Instrumentation, will be updated to reflect a new Turbine Trip on Low EH Fluid Oil Pressure Nominal Setpoint of 800 psig and a new Allowable Value of >769 psig.

IncorDoration of TSTF-493 ODtion A 5

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/1 3-0117 The Technical Analysis for this application is described in TSTF-493 as referenced in the NRC Notice of Availability published in the FederalRegister on May 11, 2010 (75 FR 26294). Plant-specific information related to the Technical Analysis is described below to document that the content of TSTF-493, Revision 4, Option A, is applicable to HBRSEP.

Use of the Term "Nominal Trip Setpoint" The term "Nominal Trip Setpoint" (NTSP) is HBRSEP terminology for the setpoint value calculated by means of the plant-specific setpoint methodology documented in the Final Safety Analyses Report (FSAR) or a document incorporated by reference into the FSAR.

The actual trip setpoint may be more conservative than the NTSP. The NTSP is the 1

LSSS which is required to be in the TS by 10 CFR 50.36. The NTSP is the least conservative value to which the instrument channel is adjusted to actuate.

2 The Allowable Value (AV) is derived from the NTSP. The NTSP is the limiting setting for an operable channel trip setpoint considering all credible instrument errors associated with the instrument channel. The NTSP is the least conservative value (with an as-left tolerance (ALT)) to which the channel must be reset at the conclusion of periodic testing to ensure that the analytical limit (AL) will not be exceeded during an anticipated operational occurrence or accident before the next periodic surveillance or calibration. It is impossible to set a physical instrument channel to an exact value, so a calibration tolerance is established around the NTSP. Therefore, an instrument adjustment is considered successful if the NTSP as left instrument setting is within the setting tolerance (i.e., a range of values around the NTSP).

The field setting is the NTSP with margin added. The field setting is as conservative or more conservative than the NTSP.

The determination to include surveillance Notes for specific Low EH Fluid Oil Pressure in the TS is based on this function being an automatic protective device related to variables having a significant safety function as delineated by 10 CFR 50.36(c)(1 )(ii)(A). There are two surveillance Notes added to the TSs regarding the use of TS AVs for operability determinations and for assessing channel performance. Note that TSTF-493 Notes 1 and 2 are being implemented as Notes 4 and 5 in the HBRSEP TS.

Surveillance Note 4 states: "Ifthe as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service."

1. 10 CFR 50.36(c)(1 (ii)(a) states: "Limiting safety system settings for nuclear reactors are settings for automatic protective devices related to those variables having significant safety functions."

2. The instrument setting "Allowable Value" is a limiting value of an instrument's as-found trip setting used during surveillances. The AV is more conservative than the Analytical Limit (AL) to account for applicable instrument measurement errors consistent with the plant-specific setpoint methodology. If during testing, the actual instrumentation setting is less conservative than the AV, the channel is declared inoperable and actions must be taken consistent with the TS requirements.

6

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/13-0117 Surveillance Note 5 states: "The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the Nominal Trip Setpoint (NTSP) at the completion of the surveillance; otherwise, the channel shall be declared inoperable. Setpoints more conservative than the NTSP are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures (field setting) to confirm channel performance. The methodologies used to determine the as-found and the as-left tolerances are specified in EGR-NGGC-0153, Engineering Instrument Setpoints."

Setpoint calculations establish a NTSP based on the AL of the Safety Analysis to ensure that trips or protective actions will occur prior to exceeding the process parameter value assumed by the Safety Analysis calculations. These setpoint calculations also calculate an allowed limit of expected change (i.e., the as-found tolerance) between performances of the surveillance test for assessing the value of the setpoint setting. The least conservative as-found instrument setting value that a channel can have during calibration without requiring performance of a TS remedial action is the setpoint AV. Discovering an instrument setting to be less conservative than the setting AV indicates that there may not be sufficient margin between the setting and the AL. TS channel calibrations, channel operational tests, and trip actuation operational tests (with setpoint verification) are performed to verify channels are operating within the assumptions of the setpoint methodology calculated NTSP and that channel settings have not exceeded the TS AVs. When the measured as-found setpoint is non-conservative with respect to the AV, the channel is inoperable and the actions identified in the TS must be taken.

The first surveillance Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as found tolerance but conservative with respect to the AV. Evaluation of channel performance will verify that the channel will continue to perform in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service.

Verifying that a trip setting is conservative with respect to the AV when a surveillance test is performed does not by itself verify the instrument channel will operate properly in the future.

Although the channel was operable during the previous surveillance interval, if it is discovered that channel performance is outside the performance predicted by the plant setpoint calculations for the test interval, then the design basis for the channel may not be met, and proper operation of the channel for a future demand cannot be assured.

Surveillance Note 4 formalizes the establishment of the appropriate as-found tolerance for each channel. This as-found tolerance is applied about the NTSP or about any other more conservative setpoint. The as-found tolerance ensures that channel operation is consistent with the assumptions or design inputs used in the setpoint calculations and establishes a high confidence of acceptable channel performance in the future. Because the as-found tolerance allows for both conservative and non-conservative deviation from the NTSP, changes in channel performance that are conservative with respect to the NTSP will also be detected and evaluated for possible effects on expected performance.

7

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/13-0117 To implement surveillance Note 5 the as-left tolerance for some instrumentation Function channels is established to ensure that realistic values are used that do not mask instrument performance. Setpoint calculations assume that the instrument setpoint is left at the NTSP within a specific as-left tolerance (e.g., 25 psig +/- 2 psig). A tolerance band is necessary because it is not possible to read and adjust a setting to an absolute value due to the readability and/or accuracy of the test instruments or the ability to adjust potentiometers. The as left tolerance is normally as small as possible considering the tools and the objective to meet an as low as reasonably achievable calibration setting of the instruments. The as-left tolerance is considered in the setpoint calculation. Failure to set the actual plant trip setpoint to the NTSP (or more conservative than the NTSP), and within the as-left tolerance, would invalidate the assumptions in the setpoint calculation because any subsequent instrument drift would not start from the expected as-left setpoint.

Incorporating the surveillance Note 4 of TSTF-493-A and deleting the applicability of existing Note 1 for Table 3.3.1-1, item 15a, results in a more restrictive requirement in that an evaluation of the channel performance is required for the condition where the as-found setting for a channel setpoint is outside its as-found tolerance, but conservative with respect to the AV. In addition, incorporation of TSTF-493-A, surveillance Note 5 results in a more conservative requirement in that the allowance for the trip setpoints to be set more conservative than the NTSP explicitly requires that the as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures to confirm channel performance. Note that TSTF-493 Notes 1 and 2 are being renumbered to Notes 4 and 5 in the HBRSEP TS. Notation in the calibration procedure will reference these notes.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 10 CFR Appendix A to Part 50 - General Desigqn Criteria for Nuclear Power Plants The General Design Criteria (GDC) applicable to HBRSEP at the time Unit No.2 was licensed for operation (July, 1970) were contained in Proposed Appendix A to 10 CFR 50, General Design Criteria for Nuclear Power Plants, published in the Federal Register on July 11, 1967. (Appendix A to 10 CFR 50, effective in 1971 and subsequently amended, is somewhat different from the proposed 1967 criteria.) HBRSEP was evaluated with respect to the proposed 1967 GDC and the original FSAR contained a discussion of the criteria as well as a summary of the criteria by groups.

The following provides discussion of the effects of the proposed change on the capability of HBRSEP Unit No. 2 for continued compliance with the associated 1967 GDCs.

Appendix A to 10 CFR 50 provides the general design criteria for nuclear power plants. The principal design criteria establishes the necessary design, fabrication, construction, testing, and performance requirements for structures, systems, and components important to safety; that is, structures, systems, and components that provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the public. Section III of 10 CFR 50 Appendix A delineates criteria for Protection and Reactivity Control Systems.

8

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/1 3-0117 1967 GDC-20 ProtectionSystems Redundancy and Independence - "Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure on removal from service of any component or channel of such a system will result in loss of the protection function. The redundancy provided shall include, as a minimum, two channels of protection for each protection function to be served."

Criterion 20 is applicable to this amendment request since the input into the RPS must ensure RPS actuation even if the input component fails. The normal operational state of the existing ASO pressure switch is contacts open, and the contacts close when the ASO pressure drops below the setpoint. If the pressure switch fails, the contacts would close and therefore provide input to the RPS.

The new AST header pressure switches are configured in the same manner as the existing ASO pressure switches with contacts open when AST pressure rises above the reset setpoint and contacts close when AST pressure drops below the trip setpoint. Pressure switch failure would result in contact closure and input provided to the RPS in the same manner as an AST pressure drop below the trip setpoint. Criterion 20 is met because the new AST header pressure switches are designed to fail into a safe state.

1967 GDC-23 ProtectionAqainst Multiple Disability for Protection Systems - "The effects of adverse conditions to which redundant channels or protection systems might be exposed in common, either under normal conditions or those of an accident, shall not result in loss of the protection function or shall be tolerable on some other basis."

Criterion 23 is applicable to this modification to the extent that inputs to the RPS are affected. The RPS and TCS are independent. A failure of the turbine control system does not affect the input to the reactor protection system from the AST header pressure switches.

The TCS upgrade project will remove the ASO system including the ASO pressure switches that actuate a reactor trip above 40% power (P-8) on low ASO pressure. A reactor trip will now be actuated on low AST header pressure as sensed by the three new redundant AST header pressure switches. The new AST header pressure switches will perform in the same manner as the ASO switches. These upgraded switches have a reliable operating history.

The new AST header pressure switches do not provide any input into the turbine control system. The AST header pressure switches utilize the existing auxiliary relays to communicate with the RPS. The connection to the RPS from the auxiliary relays is not being modified. Criterion 23 is met because the relocation and replacement of the pressure switches maintains system reliability, redundancy and independence from the turbine control system.

10 CFR 50.36 - Technical Specifications The Technical Specifications for HBRSEP are governed by 10 CFR 50.36. The new turbine trip setpoint on low AST header pressure ensures the safety limits are not violated, as 9

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/13-0117 defined by 10 CFR 50.36. The proper functioning of the RPS and main steam safety valves prevents violation of the reactor core safety limit (see Technical Specification Bases, Section 2.0 Safety Limits). The new turbine trip setpoint will not affect the functioning of the RPS or main steam safety valves; therefore, the safety limits will be maintained by this change.

4.2 Precedent On September 15, 2006, Indiana Michigan Power Company (I&M), the licensee for the Donald C. Cook Nuclear Plant Unit 2, proposed to amend Facility Operating License DPR-74 (ML062690500) (Ref. 3). I&M modified Technical Specification (TS) 3.3.1, Table 3.3.1-1, Function 16.a, "Low Fluid Oil Pressure," to reflect a modification to the Unit 2 turbine control system that was to be implemented during the Fall 2007 refueling outage. A change to the turbine control system replaced the control system which increased the nominal control fluid oil operating pressure from 114 psig to 1600 psig. The control fluid oil pressure provided an input to the reactor protection system via three pressure switches connected to the control fluid header. Due to the relocation of the pressure switches to a new higher operational pressure system, I&M proposed a revision to the Allowable Value for low fluid oil pressure from > 57 psig to a 750 psig. This amendment request was approved and the NRC Safety Evaluation was issued on September 21, 2007 (ML072180639), (Ref. 4). The HBRSEP amendment request is very much like the I&M amendment; however, the I&M amendment did not address TSTF-493 since it was not finalized at that time. Each license amendment request increases the Allowable Value as the result of increased control fluid oil operating pressure originating from upgrades and/or replacement of the originally installed turbine control systems. In both cases, the pressure switches providing the reactor protection system inputs do not interface with the turbine control system and can be considered independent of the TCS modifications.

4.3 No Significant Hazards Consideration Duke Energy Progress, Inc. is submitting a request for an amendment to the H. B.

Robinson Steam Electric Plant Unit 2 Technical Specification (TS) for the Reactor Protection System Instrumentation Turbine Trip function on Low Auto Stop Oil Pressure to a Turbine Trip function on Low EH Fluid Oil Pressure. In addition, the Nominal Trip Setpoint will be changed from its current value of 45 psig to 800 psig and a corresponding change in the Allowable Value from >40.87 psig to >769 psig. These changes to the TS are due to the relocation of three pressure switches from the low pressure Auto Stop Oil (ASO) System to the high pressure Auto Stop Trip (AST) header in the Electro-Hydraulic Control (EHC) System. Relocation of the pressure switches is necessary to accommodate deletion of the ASO system as part of a Turbine Control System (TCS) upgrade.

Duke Energy Progress, Inc. has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposedchange involve a significant increasein the probabilityor consequences of an accidentpreviously evaluated?

10

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/1 3-0117 Response: No The proposed change reflects a design change to the turbine control system that results in the use of an increased control oil pressure system, necessitating a change to the value at which a low EH fluid oil pressure initiates a reactor trip on turbine trip. The EH oil pressure is an input to the reactor trip instrumentation in response to a turbine trip event. The value at which the low EH fluid oil initiates a reactor trip is not an accident initiator. A change in the nominal control oil pressure does not introduce any mechanisms that would increase the probability of an accident previously analyzed. The reactor trip on turbine trip function is initiated by the same protective signal as used for the ASO System trip signal. There is no change in form or function of this signal and the probability or consequences of previously analyzed accidents are not impacted.

The proposed change also adds test requirements to a TS instrument function related to those variables that have a significant safety function to ensure that instruments will function as required to initiate protective systems or actuate mitigating systems at the point assumed in the applicable setpoint calculation. Surveillance tests are not an initiator to any accident previously evaluated. As a result, the probability of any accident previously evaluated is not significantly increased. The systems and components required by the TSs for which surveillance tests are added are still required to be operable, meet the acceptance criteria for the surveillance requirements, and be capable of performing any mitigation function. Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The EH fluid oil pressure decreases in response to a turbine trip. The value at which the low EH fluid oil initiates a reactor trip is not an accident initiator. The proposed TS change reflects the higher pressure that will be sensed after the pressure switches are relocated from the ASO System to the AST high pressure header. Failure of the new switches would not result in a different outcome than is considered in the current design basis. Further, the change does not alter assumptions made in the safety analysis but ensures that the instruments perform as assumed in the accident analysis. Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

3. Does the change involve a significant reduction in a margin of safety?

Response: No The change involves a parameter that initiates an anticipatory reactor trip following a turbine trip. The safety analyses do not credit this anticipatory trip for reactor core 11

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RAI13-0117 protection. The original pressure switch configuration and the new pressure switch configuration both generate the same reactor trip signal. The difference is that the initiation of the trip will now be adjusted to a different system of higher pressure. This system function of sensing and transmitting a reactor trip signal on turbine trip remains the same. Also, the proposed change adds test requirements that will assure that (1) technical specifications instrumentation Allowable Values will be limiting settings for assessing instrument channel operability and (2) will be conservatively determined so that evaluation of instrument performance history and the as left tolerance requirements of the calibration procedures will not have an adverse effect on equipment operability.

The testing methods and acceptance criteria for systems, structures, and components, specified in applicable codes and standards (or alternatives approved for use by the NRC) will continue to be met as described in the plant licensing basis including the updated Final Safety Analysis Report. There is no impact to safety analysis acceptance criteria as described in the plant licensing basis because no change is made to the accident analysis assumptions. Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Duke Energy Progress, Inc. therefore concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

4.4 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement.

However, the proposed amendment does not involve (i) a significant hazards consideration; (ii) a significant change in the types or significant increases in the amounts of any effluents that may be released offsite; or (iii) result in a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment needs to be prepared in connection with the issuance of the amendment.

6.0 REFERENCES

1. NUREG-1431, Revision 4, Standard Technical Specifications Westinghouse Plants, dated June 2004.

12

United States Nuclear Regulatory Commission Enclosure to Serial: RNP-RA/13-0117

2. ISA-RP67.04.02-2000, Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation.

3. September 15, 2006 Letter, AEP:NRC:6331-02, Indiana Michigan Power Company to Nuclear Regulatory Commission, "Donald C. Cook Nuclear Plant Unit 2, Docket No. 50-316, Technical Specification Change for Reactor Trip on Low Turbine Oil Pressure". (ML062690500)

4. September 21, 2007 Letter, Nuclear Regulatory Commission to Indiana Michigan Power Company, "Donald C. Cook Nuclear Plant Unit 2, Issuance of Amendment Regarding Reactor Trip on Low Turbine Oil Pressure". (ML072180639) 13

Attachment 1 Marked-Up Technical Specifications Page

RPS Instrumentation 3.3.1 Table 3.3.1-1 (page 4 of 7)

Reactor Protection System Instrumentation APPLICABLE MODES OR NOMINAL OTHER TRIP SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE SETPOINT FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE (1)

14. DELETED

15. Turbine Trip 769 800

a. Low Auto StopEH 1 (f) 3 P SR 3.3.1.10(4)(5) >4O-7 psig 45 psig Fluid Oil SR 3.3.1.15 Pressure P SR 3.3.1.15 NA NA

b. Turbine Stop 1(f) 2 Valve Closure

16. Safety Injection (SI) 1,2 2 trains Q SR 3.3.1.14 NA NA Input from Engineered Safety Feature Actuation System (ESFAS)

(continued)

(1) A channel is OPERABLE with an actual Trip Setpoint value found outside its calibration tolerance band provided the Trip Setpoint value is conservative with respect to its associated Allowable Value and the channel is re-adjusted to within the established calibration tolerance band of the Nominal Trip Setpoint. This Note is not applicable to Table 3.3.1-1, item 15a.

(f) Above the P-8 (Power Range Neutron Flux) interlock.

(2)(4) If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

(3)(5)The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the Nominal Trip Setpoint (NTSP) at the completion of the surveillance; otherwise, the channel shall be declared inoperable.

Setpoints more conservative than the NTSP are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures (field setting) to confirm channel performance. The methodologies used to determine the as-found and as-left tolerances are specified in the Engineering Instrument Setpoints procedure.

HBRSEP Unit No. 2 3.3-16 Amendment No. 234

Attachment 2 Retyped Technical Specifications Page

RPS Instrumentation 3.3.1 Table 3.3.1-1 (page 4 of 7)

Reactor Protection System Instrumentation APPLICABLE MODES OR NOMINAL OTHER TRIP SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE SETPOINT FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE (1)

14. DELETED

15. Turbine Trip

a. Low EH Fluid Oil 0(f) 3 P SR 3.3.1.10 (4)(5) a769 psig 800 psig Pressure SR 3.3.1.15

b. Turbine Stop 2 P SR 3.3.1.15 NA NA Valve Closure 1(0

16. Safety Injection (SI) 1,2 2 trains Q SR 3.3.1.14 NA NA Input from Engineered Safety Feature Actuation System (ESFAS)

(continued)

(1) A channel is OPERABLE with an actual Trip Setpoint value found outside its calibration tolerance band provided the Trip Setpoint value is conservative with respect to its associated Allowable Value and the channel is re-adjusted to within the established calibration tolerance band of the Nominal Trip Setpoint. This Note is not applicable to Table 3.3.1-1, item 15a.

(f) Above the P-8 (Power Range Neutron Flux) interlock.

(4) If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

(5) The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the Nominal Trip Setpoint (NTSP) at the completion of the surveillance; otherwise, the channel shall be declared inoperable.

Setpoints more conservative than the NTSP are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures (field setting) to confirm channel performance. The methodologies used to determine the as-found and as-left tolerances are specified in the Engineering Instrument Setpoints procedure.

HBRSEP Unit No. 2 3.3-16 Amendment No.

Attachment 3 Marked-Up Technical Specifications Bases Pages (For Information Only)

B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protection System (RPS) Instrumentation BASES Formatted: Font: (Default) Anal, 11 pt BACKGROUND The RPS initiates a unit shutdown, based on the values of selected unit parameters, to protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during Anticipated ......- Deleted: anticipated operational Operational Occurrences(AOOs) and to assist the Engineered Safety occurrences Features (ESF) Systems in mitigating accidents.

The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as specifying LCOs on other reactor system parameters and equipment performance.

The LSSS, defined in this specification as the Allowable Values, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During AOOs, which are those events expected to occur one or more times during the unit life, the acceptable limits are:

1. The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling (DNB);

2. Fuel centerline melt shall not occur; and

3. The RCS pressure SL of 2735 psig shall not be exceeded.

Operation within the SLs of Specification 2.0, "Safety Limits (SLs)," also maintains the above values and assures that offsite dose will be within the 10 CFR 50.67 limits during AOOs.

Accidents are events that are analyzed even though they are not expected to occur during the unit life. The acceptable limit during accidents is that offsite dose shall be maintained within an acceptable fraction of 10 CFR 50.67 limits. Different accident categories are allowed a

(continuecd HEIRSEP Unit No. 2 B 3.3-1 Revision No. 31

RPS Instrumentation B 3.3.1 BASES Formatted: Font: (Default) Arlal, 11 pt BACKGROUND different fraction of these limits, based on probability of (continued) occurrence. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.

The RPS instrumentation is segmented into four distinct but interconnected modules as illustrated in the UFSAR, Chapter 7 (Ref. 1),

and as identified below:

1. Field transmitters or process sensors: provide a measurable electronic signal based upon the physical characteristics of the parameter being measured;

2. Signal Process Control and Protection System, including Analog Protection System, Nuclear Instrumentation System (NIS), field contacts, and protection channel sets: provides signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection systeichannels. ~---4 Deleted: devices and control board/control room/miscellaneous indications;

3. RPS relay logic: initiates proper unit shutdown and/or ESF actuation in accordance with the defined logic, which is based on the bistable outputs from the signal process control and protection system; and

4. Reactor trip switchgear, including reactor trip breakers (RTBs) and bypass breakers: provides the means to interrupt power to the control rod drive mechanisms (CRDMs) and allows the rod cluster control assemblies (RCCAs), or "rods," to fall into the core and shut down the reactor. The bypass breakers allow testing of the RTBs at power.

Field Transmitters or Sensors To meet the design demands for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters. To account for the calibration tolerances and instrument drift, which are assumed to occur between calibrations, statistical allowances are provided in the Nominal Trip Setpoint (NTSP) and Formatted: Font: (Default) Arial, 11 pt Formatted: Font: (Default) Arial, 11 pt (continued)

I 'HBRSEP Unit No. 2 B 3.3-2 Revision No. 0

RPS Instrumentation B 3.3.1 BASES Formatted: Font: (Default) Adal, 11 pt BACKGROUND Field Transmitters or Sensors (continued)

Allowable Value, The_ OPERABILITY of each transmitter or sensor can_ Deleted: s be evaluated when its "as found" calibration data are compared against its documented acceptance criteria.

Signal Process Control and Protection System Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments. The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals withVNTSP derived Deleted: setpoints from Analytical Limits established by the safety analyses. Analytical Deleted: These solpoints Limits are defined in UFSAR, Chapter 7 (Ref. 1), Chapter 6 (Ref. 2), and Chapter 15 (Ref. 3). Ifthe measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the RPS relay logic. Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing. Some unit parameters provide input only to the RPS relay logic, while others provide input to the RPS relay logic, the main control board, the unit computer, and one or more control systems.

The instrumentation system is designed in accordance with HBRSEP design criteria, which is described in UFSAR Section 3.1 (Ref. 4), and IEEE-279-1968 (Ref. 5).

The instrumentation system is esined such that a failure or malfunction - [ Deleted: desinged j of a control system, that is assumed in the initiation of an accident or transient and concurrently prevents proper action of one or more instrument channels required to mitigate the same accident or transient, will not preclude the proper protection system action. The remaining portions of the instrumentation system are designed to ensure the protection system action occurs to mitigate the accident or transient (i.e.,

no single failure within the instrumentation system sill prevent proper protection system action when required). These requirements are described in Reference 5.

Formatted: Font: (Default) Arial, 11 pt Formatted: Font: (Default) Arial, 11 pt (continued)

I HBRSEP Unit No.2 B 3.3-3 Revision No. 0

RPS Instrumentation B 3.3.1 BASES Formatted: Font: (Default) Arial, 11 pt BACKGROUND Signal Process Control and Protection System (continued)

Two logic channels are required to ensure no single random failure of a logic channel will disable the RPS. The logic channels are designed such that testing required while the reactor is at power may be accomplished without causing trip.

Nominal Trip Setpoints and Allowable Values The Nominal Trip Setpoints are the nominal values at which the bistables are set. Any bistable is considered to be properly adjusted (in accordance with the Nominal Trip Setpoint) when the "as left" value is within the established calibration tolerance band. A channel is required to be adjusted, if the actual Nominal Trip Setpoint is found outside the "as found" calibration tolerance band, such that the actual Trip Setpoint is within the "as left" calibration tolerance band. The as-left tolerance and as-found tolerance band methodoloqy is provided in EGR-NGGC-0153, Engineering Instrument Setpoints.

The Nominal Trip Setpoints used in the bistables are based on the analytical limits stated in Reference 3. The selection of these Nominal Trip Setpoints is such that adequate protection is provided when all sensor and processing time delays accounted for in setpoint calculations and accident analyses are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those RPS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 6), the Nominal Trip Setpoints and Allowable Values specified in Table 3.3.1-1 in the accompanying LCO are conservatively adjusted with respect to the analytical limits. A detailed description of the methodology used to calculate the Nominal Trip Setpoints, including their explicit uncertainties, is provided in the company setpoint methodology procedure (Ref. 8). The actual Nominal Trip Setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a COT. , _ - Deleted: One example of such a change in measurement error is drift during the surveillance interval. As noted in Table 3.3.1-1 (Note I), a channel is considered OPERABLE with an actual Trip Setpoint value found outside its "as found" calibration tolerance band provided the TRIP Setpoint value is conservative with respect to its Formatted: Font: (Default) Anal, 11 pt Formatted: Font: (Default) Arial, 11 pt (continued)

I ýHBRSEP Unit No. 2 B 3.3-4 Revision No. Q

RPS Instrumentation B 3.3.1 BASES Formatted: Font: (Default) Artal, 11 pt BACKGROUND Trip Setpoints and Allowable Values (continued)

Notes allow the Nominal Trip Setpoints to be reduced when required by 1 Deleted: associated Allowable Value Required Actions. and the channel is re-adjusted to within the "as-left'calibration tolerance band of the Nominal Trip Selpoint NTSPs, in coniunction with the use of as-found and as-left tolerances I-

-I Deleted: Setpoints tooether with the reauirements of theAllowable Value ensure that SLs are not violated during AQOs (and that the consequences of DBAs will be 4 Deleted: in accordance with the acceptable, providing the unit is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed).

Note that in the accompanying LCO 3.3.1, the Allowable Values are the LSSS.

Each channel of the analog protection system can be tested on line to verify that the signal or setpoint accuracy is within the specified allowance requirements of calculations performed in accordance with the company setpoint methodology procedure (Ref. 8). Once a designated channel is taken out of service for testing, a simulated signal is injected into the channel for testing. The process equipment for the channel in test is then tested, verified, and calibrated. SRs for the channels are specified in the SRs section.

The Nominal Trip Setpoints and Allowable Values listed in Table 3.3.1-1 are based on the methodology described in the company setpoint methodology procedure (Ref. 8), which incorporates all of the applicable uncertainties for each channel. The magnitudes of these uncertainties are factored into the determination of each Nominal Trip Setpoint. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes.

Reactor Protection System Relay Logic This equipment is used for the decision logic processing of outputs from the signal processing equipment bistables. To meet the redundancy requirements, two trains of RPS logic, each performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide reactor trip for the unit. If both trains are taken out of service or placed in test, a reactor trip will result. Each train is packaged in Formatted: Font: (Default) Anal, 11 pt Formatted: Font: (Default) Arial, 11 pt (continued)

I HBRSEP Unit No. 2 B 3.3-5 Revision No. Q

RPS Instrumentation B 3.3.1 BASES Formatted: Font: (Default) Anal, 11 pt BACKGROUND Reactor Trip Switchqear (continued) shunt trip mechanism is sufficient by itself, thus providing a diverse trip mechanism.

The RPS relay logic matrix Functions are described in the functional diagrams included in Reference 1. In addition to the reactor trip or ESF, these diagrams also describe the various "permissive interlocks" that are associated with unit conditions. When an RPS train is removed from service for testing, the other train is relied upon to provide the automatic reactor protection requirements.

Formatted: Font: (Default) Anal, 11 pt I APPLICABLE The RPS functions to preserve the SLs during all Deleted: maintain SAFETY AOOs and mitigates the consequences of DBAs in all MODES in ANALYSES, LCO, which the RTBs are closed.

and APPLICABILITY Each of the analyzed accidents and transients can be detected by one or more RPS Functions. The accident analysis described in Reference 3 takes credit for most RPS trip Functions. RPS trip Functions that are retained yet not specifically credited in the accident analysis are jmplicitelv credited in the safety analysis and the NRC staff approved Deleted: qualitatively licensing basis for the unit. These RPS trip Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. They may also serve as backups to RPS trip Functions that were credited in the accident analysis.

The LCO requires all instrumentation performing an RPS Function, listed in Table 3.3.1-1 in the accompanying LCO, to be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.

The LCO generally requires OPERABILITY of four or three channels in each instrumentation Function, two channels of Manual Reactor Trip in each logic Function, and two trains in each Automatic Trip Logic Function.

The two-out-of-three and two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing a reactor trip.

Specific exceptions to the above general philosophy exist and are discussed below.

Formatted: Font: (Default) Arlal, 11 pt Formatted: Font: (Default) Arial, 11 pt (continued)

HBRSEP Unit No. 2 B 3.3-7 Revision No. Q

RPS Instrumentation B 3.3.1 BASES Formatted: Font: (Default) Arlal, 11 pt APPLICABLE 14. DELETED SAFETY ANALYSES, LCO, and APPLICABILIT'

15. Turbine Trip

a. Turbine Trio - Low.Fluid Oil Pressure -A Deleted: At~aq The Turbine Trip - Low Fluid Oil Pressure trip Function anticipates -_ - j Deleted: Auto-Stop I the loss of heat removal capabilities of the secondary system following a turbine trip. This trip Function acts to minimize the pressure/temperature transient on the reactor. Any turbine trip from a power level below the P-8 setpoint, approximately 40% power, will not actuate a reactor trip. Three pressure switches monitor the auto-stop oil pressure in the Turbine Trip System. A low pressure condition sensed by two-out-of-three pressure switches will actuate a reactor trip. These pressure switches do not provide any input to the control system. The unit is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure - High trip Function and RCS integrity is ensured by the pressurizer safety valves.

The LCO requires three channels of Turbine Trip - LowFludOil Deleted: Auto-Stop Pressure to be OPERABLE in MODE 1 above P-8.

Below the P-8 setpoint, a turbine trip does not actuate a reactor trip.

In MODE 3, 4, 5, or 6, there is no potential for a turbine trip, and the Turbine Trip - LowZFluid Oil Pressure trip Function does not Deleted: Auto-Stop need to be OPERABLE.

Formatted: Font: (Default) Arial, 11 pt Formatted: Font: (Default) Arlal, 11 pt (continued)

IHBRSEP Unit No. 2 B 3.3-25 Revision No. 57

RPS Instrumentation B 3.3.1 BASES Formatted: Font: (Default) Anal, 11 pt APPLICABLE b. Turbine Trip - Turbine Stop Valve Closure SAFETY ANALYSES, LCO, The Turbine Trip - Turbine Stop Valve Closure trip and APPLICABILITY Function anticipates the loss of heat removal (continued) capabilities of the secondary system following a turbine trip from a power level above the P-8 setpoint, approximately 40% power.

This action will actuate a reactor trip. The trip Function anticipates the loss of secondary heat removal capability that occurs when the stop valves close. Tripping the reactor in anticipation of loss of secondary heat removal acts to minimize the pressure and temperature transient on the reactor. This trip Function will not and is not required to operate in the presence of a single channel failure. The unit is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure

- High trip Function, and RCS integrity is ensured by the pressurizer safety valves. This trip Function is diverse to the Turbine Trip - LowZFluid Oil Pressure trip Function Eachturbine_ *- Deleted: Auto-Stop stop valve is equipped with one limit switch that inputs to the RPS.

If both limit switches indicate that the stop valves are closed, a reactor trip is initiated.

The limit switches are set to assure channel trip occurs when the associated stop valve is closed.

The LCO requires two Turbine Trip - Turbine Stop Valve Closure channels, one per valve, to be OPERABLE in MODE 1 above P-8.

Both channels must trip to cause reactor trip.

Below the P-8 setpoint, a load rejection can be accommodated by the Steam Dump System. In MODE 3, 4, 5, or 6, there is no potential for a load rejection, and the Turbine Trip - Stop Valve Closure trip Function does not need to be OPERABLE.

Formatted: Font: (Default) Anal, 11 pt Formatted: Font: (Default) Arlal, 11 pt (continued)

HBRSEP Unit No. 2 B 3.3-26 Revision No. 41

Attachment 4 Procedure EGR-NGGC-0153 Engineering Instrument Setpoints

I Information

• @ ENERGY.

ENDUKE Use NUCLEAR GENERATION GROUP BNP/HNP/RNP STANDARD PROCEDURE VOLUME 99 BOOK/PART 99 EGR-NGGC-0153 ENGINEERING INSTRUMENT SETPOINTS REVISION 12 IEGR-NGGC-1 53 1 Rev. 12 1 Page lof 184

TABLE OF CONTENTS SECTION PAGE 1.0 PURPOSE .......................................................................................................... 4

2.0 REFERENCES

........................................................................................................... 5 3.0 DEFINITIO NS ......................................................................................................... 7 4.0 RESPO NSIBILITIES .......................................................................................... 24 5.0 PREREQ UISITES ............................................................................................... 25 6.0 PRECAUTIO NS AND LIM ITATIO NS ................................................................. 25 7.0 SPECIAL TOO LS AND EQ UIPM ENT ................................................................. 25 8.0 ACCEPTANCE CRITERIA ................................................................................. 25 9.0 INSTRUCTIO NS ................................................................................................. 26 9.1 Setpoint Methodology ...................................................................................... 26 9.1.1 Scope ........................................................................................................ 27 9.1.2 Surveillance Test Acceptance Values ...................................................... 27 9.1.3 Settings of Lesser Im portance .................................................................. 28 9.1.4 Setpoint Databases ................................................................................. 28 9.1.4 Setpoint Databases (cont'd) ...................................................................... 29 9.2 Loop Error Analysis ......................................................................................... 29 9.2.1 Overview .................................................................................................... 29 9.2.2 Basic Concepts ......................................................................................... 32 9.2.3 Error Sources ............................................................................................. 34 9.2.4 Loop Analysis .......................................................................................... 35 9.2.5 Error Com ponent Types .......................................................................... 36 9.3 Process Measurem ent Error .......................................................................... 41 9.3.1 Liquid Level Measurem ent ......................................................................... 43 9.3.2 Pressure Measurem ent ............................................................................. 66 9.3.3 Flow Measurem ent .................................................................................... 69 9.3.4 Tem perature Measurem ent ...................................................................... 78 9.4 Instrum ent Uncertainties ................................................................................. 80 9.4.1 Reference Accuracy (RA) ........................................................................ 81 9.4.2 Drift (DR) .................................................................................................... 82 9.4.3 Tem perature Effect (TE) ........................................................................... 85 9.4.4 Static Pressure Effect (SPE) .................................................................... 88 9.4.5 Overpressure Effect (O P) ........................................................................ 90 9.4.6 Power Supply Effect (PSE) ...................................................................... 90 9.4.6 Power Supply Effect (PSE) (cont'd) ........................................................... 91 9.4.7 Accident Effects ......................................................................................... 91 9.4.8 Readability (RE) ......................................................................................... 97 9.4.9 Setpoints W ith A Single Side Of Interest ................................................. 98 9.4.10 Vortex Considerations for Tank Levels ...................................................... 99 9.4.10 Vortex Considerations for Tank Levels (cont'd) ........................................... 100 9.5 Other Errors ....................................................................................................... 100 9.5.1 Calibration Errors ......................................................................................... 101 9.5.2 Insulation Resistance Error (IR)................................................................... 111 9.5.3 Conduit Seal Effects (CSE) ......................................................................... 114 9.5.4 RTD Lead W ire Effects (LW ) ....................................................................... 114 9.5.5 RTD Self Heating Effect (SH) ...................................................................... 115 9.6 Error Analysis ..................................................................................................... 116 EGR-NGGC-0153 Rev. 12 1 Page 2 of 184 1

9.6.1 Sum m ary of Errors ....................................................................................... 116 9.6.2 Error Com bination Methodologies ............................................................... 117 9.7 Establishm ent of Uncertainty Allowances .......................................................... 125 9.7.1 Graded Approach ........................................................................................ 125 9.7.2 Conditions for W hich Uncertainty is Determ ined ......................................... 126 9.7.3 Loop Error Determ ination ............................................................................ 126 9.7.4 Uncertainty Allowances ............................................................................... 132 9.8 Setpoint Determ ination ....................................................................................... 142 9 .8 .1 Lim its ........................................................................................................... 14 3 9.8.2 Setpoints ...................................................................................................... 149 9.8.3 Application of Margin ................................................................................... 157 9.8.4 Reducing Overconservatism s ...................................................................... 158 9.8.4 Reducing Overconservatism s (cont'd) ......................................................... 159 9.8.5 Dead Band and Reset ................................................................................. 160 9.8.6 Tim e Response ........................................................................................... 161 9.9 Calculation Format ............................................................................................. 162 9.9.1 Overview ...................................................................................................... 162 9.9.2 Form at Details ............................................................................................. 163 9.9.3 General G uidelines ...................................................................................... 166 9.9.3 General G uidelines (cont'd) ......................................................................... 167 9.10 TSTF-493 Im plem entation .............................................................................. 167 9.10.1 TSTF-493 Applicability ................................................................................. 168 9.10.2 Determination of Tech Spec Trip Setpoints and Allowable Values ............. 168 9.10.3 Determination of Surveillance Test As-Found Acceptance Criteria ............ 169 9.10.4 Determination of Surveillance Test As-Left Acceptance Criteria ................ 169 9.10.5 Use of As-Found and As-Left Acceptance Criteria in Surveillance Tests ... 169 9.10.6 Response to Surveillance Test Out-of-Tolerance As-Found Results ....... 170 10.0 RECO RDS ......................................................................................................... 170 ATTACHMENTS 1 F o rm s ................................................................................................................... 17 1 2 Specific G ravity Determ ination for Boric Acid Solutions ....................................... 175 3 Conversion of Error Basis ..................................................................................... 179 4 Site-Specific Com m itments .................................................................................. 183 REVISIO N SUM MARY .................................................................................................. 184 I EGR-NGGC-0153 Rev. 12 1 Page 3 of 184

1.0 PURPOSE The purpose of this procedure is to implement NGG's program requirements for both methodology and scope concerning instrument uncertainty and scaling calculations for each of the NGG plants. The methodology requirements are intended to provide NGG's Engineering, and other interested organizations, with a description of the detailed rules and plant specific criteria involved in instrument loop uncertainty analysis and setpoint determination. The scoping criteria defines those instrument loops that, as a minimum, shall have documented instrument uncertainty and scaling calculations completed to ensure these vital systems are operating within established safety limits.

Section 9.10 establishes criteria to support implementation of TSTF-493 for those specific Technical Specification functions for which TSTF-493 applicability has been committed within an NGG facility's Operating License.

This document applies to NGG personnel, NGG managed contract personnel, and any plant personnel who require an understanding and / or use of the concepts involved in instrument loop uncertainty analysis and setpoint determination.

NOTE: The uncertainty combination methodology described within this procedure is based primarily on ISA RP67-04 Method 3. Selected cases may arise in which it is advantageous to utilize alternate uncertainty combination techniques based on either ISA RP67-04 Method 1 or 2. Upon concurrence from the EGR-NGGC-01 53 Sponsor, usage of an agreed-upon alternate method is permitted.

1.1 Background The need for a documented, consistent basis for calculating instrument uncertainties and setpoints is an industry issue. Both INPO and the NRC have conducted audits / inspections of various nuclear facilities to ensure the adequacy of instrument setpoints and designs to be able to achieve their functions. Individual plant commitments relative to instrument uncertainties and setpoints are discussed in documents such as the FSAR, Technical Specifications, Licensing Dockets and DBDs; however, see Attachment 4 to this procedure for site-specific commitments made to utilize a specific methodology. It is considered prudent to establish a consistent methodology for determining and documenting instrument uncertainties and setpoints.

This procedure sets forth the methodology to ensure NGG's design practices remain compatible with industry practices in this area.

R2.1, R2.30 This procedure, in its entirety, implements, in part, the Harris commitment to Regulatory Guide 1.105, "Instrument Setpoints", Revision 1, as described in the Harris FSAR, Section 1.8.

I EGR-NGGC-0153 Rev. 12 1 Page 4 of 184

2.0 REFERENCES

R2.1 2.1 [HNP - Regulatory Guide 1.105, "Instrument Setpoints", Revision 1]

2.2 ANSI/ISA-67.04.01-2000, "Setpoints for Nuclear Safety-Related Instrumentation" 2.3 ISA-RP67.04.02-2000, "Methodologies for the Determination of Setpoints for Nuclear Safety-Related Instrumentation" 2.4 INPO 84-026, "Setpoint Change Control Program", Revision 1, Good Practice TS-405, June, 1986.

2.5 Title 10, Part 50, Section 36, of the Code of Federal Regulations (10CFR50),

as of January 1, 1990.

2.6 IE Information Notice 82-11, "Potential Inaccuracies in Wide Range Pressure Instruments Used in Westinghouse Designed Plants", April 9, 1982.

2.7 IE Information Notice 84-54, "Deficiencies in Design Base Documentation and Calculations Supporting Nuclear Power Plant Design", July 5, 1984.

2.8 NRC Information Notice 89-68, "Evaluation of Instrument Setpoints During Modifications", September 25, 1989.

2.9 NRC Information Notice 91-29, "Deficiencies Identified During Electrical Distribution System Functional Inspections", April 15, 1991.

2.10 NRC Information Notice 91-75, "Static Head Corrections Mistakenly Not Included in Pressure Transmitter Calibration Procedures", November 25, 1991.

2.11 NRC Information Notice 92-12, "Effects of Cable Leakage Currents on Instrument Settings and Indications", February 10, 1992.

2.12 NRC Inspection Report of San Onofre Units 2 & 3, Report Numbers 50-361/91-01 and 50-362/91-01, dated April 12, 1991.

2.13 NRC Systems Based Instrumentation and Control Inspection at the Pilgrim Nuclear Power Station Unit 1, Report No. 50-293/91-201, dated January 6, 1992.

2.14 NRC Systems-Based Instrumentation and Control Inspection at the Haddam Neck Plant, Report No. 50-213/92-902, dated April 23, 1992.

2.15 ANSI/ISA-S51.1-1979, "Process Instrumentation Terminology".

2.16 ANSI/ASME PTC 19.1-1985, Part I, "Measurement Uncertainty", Instruments and Apparatus, Supplement to ASME Performance Test Code.

[EGR-NGGC-0153 Rev. 12 Page 5 of 184

2.17 ASME PTC 19.5, Part II, "Application of Fluid Meters", Instruments and Apparatus, Sixth Edition, 1971.

2.18 ASME MFC-3M-1985, "Measurement of Fluid Flow in Pipes Using Orifice, Nozzle, and Venturi".

2.19 Considine, Douglas M., Process Instruments and Controls Handbook, McGraw-Hill, 1957.

2.20 Liptak, Bela G. and Venczel, Kriszta, Process Measurement Instrument Engineers Handbook, Chilton Book Company, 1982.

2.21 Magison, E.C., Temperature Measurement in Industry, Instrument Society of America, 1990.

2.22 NUREG/CR-3659 - A Mathematical Model for Assessing the Uncertainties of Instrumentational Measurements for Power and Flow of PWR Reactors, February, 1985.

2.23 Fluid Meters - Their Theory and Application - 6th Edition, 1971.

2.24 Spiegel, M.R., Theory and Problems of Probability and Statistics, Appendix C, Schaums Outline Series, New York; Mcgraw Hill, 1975 2.25 ASME B&PV Code, Sect III Div 1, Appendices, 1986 Edition, Nominal Coefficients of Thermal Expansion, Material Group a, Coefficient C.

2.26 GE Information Letter, SIL No. 470, dated 9/16/88, and Supplement 1, dated 4/20/89.

2.27 ISA Technical Report TR-9, Graded Approach To Setpoint Determination, Draft Revision, dated 12/1/93.

2.28 NRC Information Notice 96-22, "Improper Equipment Settings Due to the Use of Nontemperature-Compensated Test Equipment" 2.29 EPRI Technical Report TR-103335-RI, October 1998, "Guidelines for Instrument Calibration Extension/Reduction - Revision 1: Statistical Analysis of Instrument Calibration Data".

R2.30 2.30 Shearon Harris Nuclear Power Plant Final Safety Analysis Report.

2.31 HNP document 1364-53067, "Westinghouse Setpoint Methodology for Protection Systems, Shearon Harris".

R2.32 2.32 Shearon Harris Nuclear Power Plant Technical Specifications Bases.

I EGR-NGGC-0153 Rev. 12 1 Page 6 of 184

2.33 [BNP - General Electric Instrument Trending Analysis System (GEITAS),

Version 1.0b]

2.34 [BNP - User Manual, General Electric Instrument Trending Analysis System (GEITAS), GE-NE-901-010-0293, February 1993]

2.35 (Deleted) 2.36 (Deleted) 2.37 EGR-NGGC-0017, Preparation and Control of Design Analyses and Calculations 2.38 Generic Letter 87-02, Enclosure 1, Supplemental Safety Evaluation Report No. 2, on Seismic Qualification Utility Group's Generic Implementation Procedure, Revision 2, Corrected February 14, 1992, for Implementation of GI 87-02 (USI A-46), Verification Of Seismic Adequacy Of Equipment In Older Operating Nuclear Plants 2.39 CPL-89-634, HBR - The potential for formation of air entraining vortices in the Aux. Feed Pump Suction from the Condensate Storage Tank R2.40 2.40 [RNP - LER 95-009-01, 2/1/96, "Condition Prohibited by Technical Specification Due to Inoperable Safety Injection"]

2.41 TSTF-493, Rev. 4 with Errata, April 23, 2010: Technical Specification Task Force - Improved Standard Technical Specifications Change Traveler, Clarify Application of Setpoint Methodology for LSSS Functions 2.42 NRC Requlatory Issue Summary (RIS) 2006-17, NRC Staff Position on the Requirements of 10 CFR 50.36, "Technical Specifications," Regarding Limiting Safety System Settings During Periodic Testing and Channel Calibrations of Instrument Channels 3.0 DEFINITIONS 3.1 Abnormally Distributed Uncertainty A term used by Reference 2.3 to denote uncertainties that do not have a normal distribution. For the purpose of this document, abnormally distributed uncertainties are treated as biases.

3.2 Accuracy A measure of the degree by which the actual output of a device approximates the output of an ideal device nominally performing the same function. Error, inaccuracy, or uncertainty represent the difference between the measured value and the ideal value.

EGR-NGGC-01 53 1 Rev. 12 Page 7 of 184

3.3 Allowable Setpoint A setpoint with no margin applied. (see Setpoint and Margin) 3.4 Allowable Value A limiting value that the trip setpoint may have when tested periodically, beyond which appropriate action shall be taken.

3.5 Ambient Temperature The temperature of the medium surrounding a device. For field mounted devices, this is typically the room temperature at the device. For panel mounted devices, this is typically the temperature inside the panel which can be different from the room temperature.

3.6 Analytical Limit Limit of a measured or calculated variable established by the safety analysis to ensure that a safety limit is not exceeded.

3.7 As Found The condition in which a channel, or portion of a channel, is found after a period of operations and before calibration (if necessary).

3.8 As Left The condition in which a channel, or portion of a channel, is left after calibration or final actuation device setpoint verification.

3.9 Bias The fixed or systematic error within a measurement. The bias error is the fixed difference between the true value and the actual measurement. The bias error can be of (1) known sign and known magnitude, (2) known sign but an unknown magnitude (with a maximum), or (3) unknown magnitude (with a maximum) and unknown sign. Often times the sign and magnitude vary in some relationship with another parameter.

3.10 Bistable A device that changes state when a preselected signal value is reached. For example, for BWRs electronic trip units are considered bistables.

I EGR-NGGC-0153 Rev. 12 1 Page 8 of 184

3.11 Calibration The comparison of a standard (or device of known accuracy) with equal or better accuracy with a device under test to detect, record, or eliminate by adjustment any variation in the accuracy of the device under test.

3.12 Components Discrete items from which a system is assembled. For example, wire, resistors, transmitters, converters, etc. would all be considered components.

3.13 Conformity The closeness that the output of an instrument approximates (or conforms to) a specified preprogrammed curve (e.g., logarithmic, parabolic, cubic, etc.).

NOTE: This measurement is usually determined in terms of non-conformity but expressed as conformity; e.g., the maximum deviation between an average curve and a specified curve. The average curve is determined after making two or more full range traverses in each direction. The value of conformity is referenced to the output unless otherwise stated.

3.14 Dead Band The range through which an input can be varied upon reversal of direction without initiating an observable output response. See Figure 3-1.

3.15 Dependent Uncertainty Uncertainties are dependent on each other if they possess a significant correlation, for whatever cause, known or unknown. Typically, dependencies form when effects share a common cause.

3.16 Design Bases That information that identifies the specific functions to be performed by an SSC and the specific values or ranges of values chosen for controlling parameters as reference bounds for design. These values may be (1) restraints derived from generally accepted "state of the art" practices for achieving functional goals, or (2) requirements derived from analysis (based on calculation and/or experiments) of the effects of a postulated accident for which an SSC must meet its functional goals (10CFR50.2, NGGM-PM-0007) or (3) requirements derived from analysis of operating and anticipated transient conditions in which the SSC is expected to perform its function.

IEGR-NGGC-01 53 1 Rev. 12 1 Page 9 of 184

3.17 Design Limit The limit of a measured or calculated variable established to prevent undesired conditions (e.g., equipment or structural damage, spurious trip or initiation signals, challenges to plant safety signals, etc.). It is used in setpoint calculations for which there is no true Analytical Limit.

3.18 Device An apparatus for performing, a prescribed function (i.e., an instrument). The discrete items which make up an instrument loop/channel.

3.19 Drift An undesired change in output over a period of time, which change is unrelated to the input, environment, or load.

3.20 Dynamic Response The behavior of the output of a device as a function of the input, both with respect to time.

3.21 Effect A change in output produced by some outside phenomena, such as elevated temperature, pressure, humidity, or radiation.

3.22 Error The algebraic difference between the indication and the ideal value of the measured signal. (A "positive" error denotes that the indication of the instrument is greater than the ideal (actual) value.)

3.23 Final Actuation Device A component or assembly of components that directly controls the motive power (electricity, compressed air, hydraulic fluid, etc.) for actuated equipment. Examples of final actuation devices are: bistables, relays, pressure switches, and level switches.

3.24 Foldover A device characteristic exhibited when a further change in the input produces an output signal that reverses its direction from the specified input-output relationship.

IEGR-NGGC-0153 I Rev. 12 1 Page 10 of 184

3.25 Full Scale The 100% value of the measured parameter on an instrument. Full scale is equal to the span for zero-based instruments.

3.26 Harsh Environment This term refers to the worst environmental conditions to which an instrument is exposed during transient, accident or post-accident conditions, out to the point in time when the device is no longer called upon to serve any monitoring or trip function. It may also be referred to as the accident environment, or trip environment, and is the converse of mild environment.

3.27 Hysteresis That property of an element evidenced by the dependence of the value of the output, for a given excursion of the input, upon the history of prior excursions and the direction of the current traverse.

NOTE 1: This measure is usually determined by subtracting the value of dead band from the maximum measured separation between upscale going and downscale going indications of the measured variable (during a full range traverse, unless otherwise specified) after transients have decayed. This measurement is sometimes called hysteresis error or hysterectic error. See Figure 3-1.

NOTE 2: Some reversal of output may be expected for any small reversal of input; this distinguishes hysteresis from dead band.

3.28 Independent Uncertainty Uncertainties are independent of each other if their magnitudes or algebraic signs are not significantly correlated, and they do not share a common source.

3.29 Indicated Value A predetermined value of an indicator or recorder at which a manual action will be taken. An indicated value is similar to a setpoint except that a setpoint assumes an action will be taken by a device and an indicated value assumes an action will be taken by an individual.

EGR-NGGC-0153 Rev. 12 Page 11 of 184

3.30 Instrument A single device that may be utilized alone or interconnected with other instruments for the purpose of observation, control and/or protection of a process or parameter.

3.31 Instrument Channel An arrangement of components and modules as required to generate a single protective action signal when required by a plant condition. A channel loses its identity where single protective action signals are combined. For example, if three channels are input into a comparator, at the comparator the three individual signals lose their identity. Thus, the three channels are only channels up to the comparator.

3.32 Instrument Range The region between the limits within which a quantity is measured, received, or transmitted, expressed by stating the lower and upper range values.

3.33 Insulation Resistance (IR) Effect The change in measurement signal due to an increase in leakage current between the conductors of instrument signal transmission components such as cables, connectors, splices, etc. The increased leakage is caused by the decrease of component insulation resistance due to extreme changes in environmental conditions.

3.34 Lead Wire Effect The effect on measured RTD signals due to ambient temperature changes on the RTD signal wire.

3.35 Limiting Safety System Setting (LSSS)

Settings for automatic protective devices in nuclear reactors that are related to those variables having significant safety functions. A LSSS is chosen to begin protective action before the analytical limit is reached to ensure that the consequences of a design basis event are not more severe than the safety analysis predicted. Limiting Safety System Settings are identified in Section 2.0 of the Technical Specifications.

IEGR-NGGC-0153 I Rev. 12 1 Page 12 of 1841

3.36 Linearity The closeness to which a curve approximates a straight line. Note: The measurement determines non-linearity and expresses it as linearity; e.g., a maximum deviation between an average curve and a straight line. The average curve is determined after making two or more full range traverses in each direction. The value of linearity is referenced to the output unless otherwise stated.

3.37 Loop A loop or instrument loop is the generic name given to a set of instrument devices which perform a specific function.

3.38 Loop Uncertainty The instrument loop uncertainty is the combined effect of all instrument/device uncertainties in that loop. Depending on the function of the loop, this uncertainty could be an uncertainty in indication or an actuation uncertainty.

3.39 Lower Setpoint Limit The lowest value for a setpoint which when used in conjunction with the upper setpoint limit, describes the tolerance band (no adjustment required) which allows for safe function operation and also minimizes the frequency of readjustment.

3.40 Margin In setpoint determination, an allowance added to the instrument loop uncertainty. Margin moves the setpoint farther away from the analytical limit.

NOTE: An additional expression, operating margin, should not be confused with margin. Adding or increasing operating margin has the effect of moving a setpoint closer to the analytical limit to increase the region of operation prior to reaching a setpoint.

IEGR-NGGC-0153 7 Rev. 12 1 Page 13 of 184

3.41 Measurement and Test Equipment (M&TE) Effect The effect on the uncertainty of a device or loop due to the accuracy ratings of reference measurement (test) equipment. When the accuracy rating of the reference measuring equipment is one tenth or less than that of the device under test, the accuracy rating of the reference measuring equipment may be ignored in the loop uncertainty calculation and in design of test/calibration procedures. When the accuracy rating of the measuring equipment is greater than one tenth that of the device under test, the accuracy rating of the reference measuring equipment shall be taken into account in the loop uncertainty calculation and in development of test/calibration procedures. Examples of measuring and test equipment are deadweight testers, resistor decade boxes, multimeters, current sources, etc.

3.42 Mild Environment An environment that would at no time be more severe than the environment that would occur during normal plant operation, including any anticipated operational occurrences. It may also be referred to as the normal environment.

3.43 Module Any assembly of interconnected components that constitutes an identifiable device, instrument, or piece of equipment. A module can be removed as a unit and replaced with a spare. It has definable performance characteristics that permit it to be tested as a unit. A module can be a card, a drawout circuit breaker, or other subassembly of a larger device, provided it meets the requirements of this definition. For the purpose of this document, a module is the same as a device.

3.44 Nuclear Safety-Related Instrumentation That instrumentation which is essential to:

a) Provide emergency reactor shutdown b) Provide containment isolation c) Provide reactor core cooling d) Provide for containment or reactor heat removal, or e) Prevent or mitigate a significant release of radioactive material to the environment; or otherwise essential to provide reasonable assurance that a nuclear power plant can be operated without undue risk to the health and safety of the public.

IEGR-NGGC-0153 I Rev. 12 Page 14 of 184

3.45 Operating Conditions Conditions to which a device is subjected, other than the variable measured by the device. Examples of operating conditions include: ambient pressure, ambient temperature, electromagnetic fields, gravitational force, inclination, power supply variation (voltage, frequency, harmonics), radiation, shock, and vibration. Both static and dynamic variations in these conditions should be considered.

3.46 Operating Influence The change in a performance characteristic caused by a change in a specified operating condition from a reference operating condition, all other conditions being held within the limits of reference operating conditions.

NOTE: The specified operating conditions are usually the limits of the normal operating conditions. Operating influence may be stated in either of two ways: (1) As the total change in performance characteristics from reference operating condition to another specified operating condition, or (2) As a coefficient expressing the change in a performance characteristic corresponding to unit change of the operating condition, from a reference operating condition to another specified operating condition.

3.47 Percent Full Scale Percent full scale is the ratio of a specific value compared to the full scale value, expressed as a percentage.

Specific Value

• 100% = Percent Full Scale Full Scale Value 3.48 Primary Element The system element that quantitatively converts the measured variable energy into a form suitable for measurement.

3.49 Process Effects This is the general name given to all errors which affect the basic process measurements. The process effects are not instrument related but are due to characteristics of the process signal received by a sensor. The process effects include such things as fluid density variation effects, improper flow development effects, pressure variation effects, etc.

I EGR-NGGC-0153 Rev. 12 1 Page 15 of 184

3.50 Process Measurement Instrumentation An instrument, or group of instruments, that converts a physical process parameter such as temperature, pressure, etc. to a useable, measurable signal such as current, voltage, etc.

3.51 Random A variable whose value at a particular future instant cannot be predicted exactly but can only be estimated by a probability distribution function. As used in this document, random means approximately normally distributed.

The algebraic sign of a random uncertainty is equally likely to be positive or negative with respect to some median value. Thus, random uncertainties are eligible for square-root-sum-of-the-squares combination.

3.52 Range The area between the upper and lower limits for which a device is designed to operate. A device may only be calibrated over a portion of its range (i.e its span) or calibrated over its entire range. For the latter case, the span would equal its range. Some vendors provide uncertainties in terms of span versus range, and clarification should be obtained as to whether the value is in range or span.

3.53 Reference Accuracy A number or quantity that defines the limit that errors will not exceed when the device is used under reference operating conditions. Reference accuracy typically includes the combined effects of conformity (or linearity),

hysteresis, dead band and repeatability. See Figure 3-2.

3.54 Repeatability The closeness of agreement among a number of consecutive measurements of the output for the same value of the input under the same operating conditions, approaching from the same direction, for full range traverses.

NOTE: This measurement is usually determined as non-repeatability and expressed as repeatability in percent of span. It does not include hysteresis. See Figure 3-3.

I EGR-NGGC-0153 Rev. 12 Page 16 of 184 1

3.55 Reproducibility The closeness of agreement among repeated measurements of the output for the same value of input made under the same operating conditions over a period of time, approaching from both directions.

NOTE 1: This measurement is usually determined as non-reproducibility and expressed as reproducibility in percent of span for a specified time period.

Normally, this implies a long period of time, but under certain conditions the period may be a short interval for which drift would not be included.

NOTE 2: Reproducibility typically includes hysteresis, dead band, drift, and repeatability.

NOTE 3: Between repeated measurements the input may vary over the range and operating conditions may vary within normal operating conditions.

3.56 Response Time The delay in the actuation of a trip function following the time when a measured process variable reaches the actual trip value due to the time response characteristics of the instrument loop, including the sensor. It may be expressed as the time taken by a device or loop to respond to a selected step input for testing or surveillance purposes.

3.57 Safety Limit A limit on an important process variable that is necessary to reasonably protect the integrity of physical barriers that guard against uncontrolled release of radioactivity.

3.58 Saturation A device characteristic exhibited when a further change in the input signal produces no additional change in the output.

3.59 Sensor The portion of an instrument loop that responds to changes in a plant variable or condition and converts the measured process variable into a signal, e.g., electric or pneumatic.

I EGR-NGGC-0153 Rev. 12 Page 17 of 184 1

3.60 Setpoint A predetermined value at which a device changes state to indicate that the quantity under surveillance has reached the selected value.

3.61 Signal Conditioning One or more modules that perform signal conversion, buffering, isolation, or mathematical operations on the signal as needed.

3.62 Signal Interface The physical means (cable, connectors, etc.) by which the process signal is propagated from the process measurement module through the signal conditioning module of the instrument channel to the module which initiates the actuation.

3.63 Span The algebraic difference between the upper and lower values of a calibrated range. If a device is calibrated over its entire range, the span equals its range.

3.64 Test Interval The elapsed time between the initiation (or successful completion) of tests on the same sensor, load group, safety group, safety system, or other specified system of device.

3.65 Tolerance The allowable deviation from a specified or true value.

3.66 Transient Overshoot The difference in magnitude of a process variable over time, taken from the point of initial trip actuation to the point at which the magnitude is a maximum or minimum.

3.67 Turndown Factor The upper range limit divided by the span of the device. Sometimes referred to as the turndown ratio.

Upper Rangqe Limit = Turndown Factor Span IEGR-NGGC-01 53 1 Rev. 12 Page 18 of 1841

3.68 Uncertainty The amount to which an instrument loop's output is in doubt (or the allowance made therefore) due to possible errors either random or systematic which have not been corrected for. The uncertainty is generally identified within a probability and confidence level. For the purpose of this document, uncertainties shall include the broad spectrum of terms such as error, accuracy, effect, etc. (A "positive" error denotes that the indication of the instrument is greater than the ideal value.)

3.69 Upper Setpoint Limit The highest value for a setpoint which when used in conjunction with the lower setpoint limit, describes the setpoint tolerance band which allows for safe function operation but minimizes the frequency of readjustment.

10% INPUT CHANGE 50% INPUT CHANGE 100% INPUT CHANGE (a) HYSTERESIS Mb)DEAD BAND Mc

/ (bi Ma)HYSTERESIS PLUS DEAD BAND FIGURE 3-1 HYSTERESIS AND DEAD BAND I EGR-NGGC-0153 Rev. 12 Page 19 of 184

OUTPUT HIGH OR POSITIVE PUrMIssBLEj WiT OF ERROR CHAACTErlC CURVE MAXIMUM AkAL NEGAMlVE DEATION ERROR INPUT too%

SPAN m I p 4 FIGURE 3-2 REFERENCE ACCURACY I EGR-NGGC-0153 Rev. 12 Page 20 of 184

OUTPUT Maximum Repeatabllity

• ambii.y DOWNSCALE CAIB5RAT]ON CURVES ./7 UPSCALE CALIBRATION CURVES INPI.F 0% 100%

FULL -RANGE TRAVERSE FIGURE 3-3 REPEATABILITY IEGR-NGGC-0153 1 Rev. 12 Page 21 of 184

3.70 Acronyms AE Accident Effect AL - Analytical Limit AMMS - Automated Maintenance Management System ANSI - American National Standards Institute APE - Accident Pressure Effect ARE - Accident Radiation Effect ASME - American Society of Mechanical Engineers ASP - Allowable Setpoint ATE - Accident Temperature Effect AV - Allowable Value BNP - Brunswick Nuclear Plant BWR - Boiling Water Reactor CAL - Calibration Tolerance CFR - Code of Federal Regulations CNAF - Calibration Nonconformance Action Form COL - Channel Operability Limit CSE - Conduit Seal Effect DBA - Design Basis Accident DBD - Design Basis Document DL - Design Limit DNBR - Departure from Nuclear Boiling Ratio DP - Differential Pressure DR - Drift EDBS - Equipment Data Base System EL - Elevation Difference EOP - Emergency Operating Procedure EQ - Environmental Qualification EQDP - Environmental Qualification Data Package ESFAS - Engineered Safety Features Actuation System FSAR - Final Safety Analysis Report GAFT - Group As-Found Tolerance GPM - Gallons Per Minute HELB - High Energy Line Break HL - Height of Liquid HNP - Harris Nuclear Plant HP - Hydrostatic Pressure HPCI - High Pressure Coolant Injection HR - Height of Reference Leg HV - Height of Vapor HVAC - Heating, Ventilating and Air Conditioning I&C - Instrumentation & Controls IE - Inspection and Enforcement IND - Indicator INPO - Institute of Nuclear Power Operations IR - Insulation Resistance IEGR-NGGC-0153 I Rev. 12 I Page 22 of 1841

ISA International Society of Automation (formerly Instrument Society of America)

I/ V - Current to Voltage Converter LAFT - Loop As-Found Tolerance LALT - Loop As-Left Tolerance LER - Licensee Event Report LOCA - Loss of Coolant Accident LP - Loop Calibration Procedure LSL - Lower Setpoint Limit LSSS - Limiting Safety System Setting LV - Loop Value LW - Lead Wire Effect M - Margin M&TE - Measurement & Test Equipment MFC - Measurement of Fluid Flow in Closed Conduits MFR - Maintenance Feedback Report MM - Multimeter MMM - Maintenance Management Manual MSLB - Main Steam Line Break MST - Maintenance Surveillance Test Procedure MTE - Measurement & Test Equipment Error NBS - National Bureau of Standards NGG - NuclearGeneration Group NIST - National Institute of Standards and Technology NRC - Nuclear Regulatory Commission NUREG - Nuclear Regulation OL - Operational Limit OP - Overpressure Effect P - Pressure P&ID - Piping & Instrument Diagram PB - Pressure Bistable PE - Primary Element PI - Pressure Indicator PIC Process Instrument Calibration Procedure PME Process Measurement Effect PSE Power Supply Effect PT Pressure Transmitter PTC Performance Test Code (ASME)

PWR Pressurized Water Reactor QDP Qualification Data Package RA Reference Accuracy RCS Reactor Coolant System RE Readability RNP Robinson Nuclear Plant RPS Reactor Protection System RTD - Resistance Temperature Detector SAR - Safety Analysis Report SC - Signal Conditioner SE - Seismic Effect I EGR-NGGC-0153 I Rev. 12 Page 23 of 184

SG - Specific Gravity SGL - Specific Gravity of Liquid SGR - Specific Gravity of Reference Leg SGV - Specific Gravity of Vapor (or Gas)

SH - Self Heating Effect SI - Safety Injection SL - Safety Limit SP - Setpoint SPE - Static Pressure Effect SRSS - Square-Root-Sum-of-the-Squares SSC - Structure, System, or Component STP - Standard Temperature and Pressure STSS - Surveillance Test Scheduling System SVF - Specific Volume of Fluid TDF - Turndown Factor TE - Temperature Effect TID - Total Integrated Dose TLU - Total Loop Uncertainty TMM - Technical Support Management Manual TRX - Transmitter TV - True Value URL - Upper Range Limit USL - Upper Setpoint Limit V/I - Voltage to Current Converter VQP - Vendor Qualification Package WC - Water Column 4.0 RESPONSIBILITIES 4.1 Responsible Engineers 4.1.1 Engineer instrument setpoints using this procedure when preparing new designs / design changes that effect setpoints, and when evaluating setpoint problems.

4.1.2 Review the fuel vendor's fuel reload analyses and changes to fuel vendor accident analyses via the Nuclear Fuels Section fuel reload EC.

4.1.2.1 Identify impacted instrument uncertainty and setpoint calculations.

4.1.2.2 Revise affected calculations and implement the results into the plant settings as necessary using applicable plant processes such as the EC and procedure change processes.

EGR-NGGC-0153 Rev. 12 Page 24 of 184

4.2 Setpoint Policy NGG 's Instrument Setpoint and Control Processes have been established as a systematic method for capturing, specifying, documenting, reviewing, and controlling Instrument Setpoints at our -four nuclear plants.

The Engineering Section at each site is responsible for ensuring that adequate documentation and implementation of instrument setpoints takes place commensurate with importance to safety and production.

This includes preparing, reviewing, approving, and controlling instrument uncertainty and scaling calculations for selected instruments and ensuring that these results are properly implemented through acceptable maintenance practices and procedures. Lesser levels of rigor and documentation are expected to be applied to instruments of lesser importance to safety and production.

Changes to instrumentation systems and instrument setpoints shall be accomplished through approved design change processes to ensure that such changes are appropriately reviewed, approved, and controlled and so that effected documentation and data bases are revised to maintain configuration control.

Adequate awareness shall be maintained among applicable personnel so it is generally known that changes affecting the accuracies of post accident indications can impact values used in the determination of indicator driven operator actions specified in the Emergency Operating Procedures possibly requiring revision to the procedures.

5.0 PREREQUISITES N/A 6.0 PRECAUTIONS AND LIMITATIONS N/A 7.0 SPECIAL TOOLS AND EQUIPMENT N/A 8.0 ACCEPTANCE CRITERIA N/A I EGR-NGGC-0153 I Rev. 12 Page 25 of 184

9.0 INSTRUCTIONS 9.1 Setpoint Methodology This procedure is to be utilized when preparing instrument uncertainty calculations for the NGG plants, however, the NSSS vendors use their own NRC approved methodology that may have differences from the instructions provided in this document. The NGG, GE, Westinghouse, or B&W methodologies are acceptable when properly applied, and it is acceptable to use the NSSS vendor's methodology when revising instrument uncertainty calculations originally prepared by them.

R2.32 [HNP - When performing setpoint calculations for the Reactor Trip System Instrumentation Trip Setpoints (Technical Specifications Table 2.2-1) and/or the Engineered Safety Features Actuation System Instrumentation Trip Setpoints (Technical Specifications Table 3.3-4), generate results in accordance with the format described in the Technical Specifications Bases (i.e., either 5 column or 2 column, as appropriate).]

Applicable instrument loops may be either safety related or non-safety-related and encompass loops used for protection, control, or indication functions. Since this document is intended to address all types of loops, portions of the methodology may not be applicable to every individual loop. For example, instruments that are not safety related or exposed to a harsh environment, do not need to incorporate accident environment uncertainties into their overall loop uncertainty. Conversely, instruments used for personnel safety, may need to include additional margins or conservatism not generally applied. Each user of this document must evaluate individual uncertainties for their relevance to the user's application. Specific instructions for the application of these criteria are included in the text of this procedure.

It is not the intent of this procedure to supersede any calculations performed previously by NGG or its vendors. Such calculations and analyses were performed in accordance with the methods and assumptions in effect at the time of their development and are considered to be valid. Differences in methodology between this procedure and existing calculations that need to be revised due to plant changes should be identified to the appropriate NGG I&C Supervisor for resolution.

Although this document is intended to be utilized for process instrumentation, it may be applied to other equipment as well. Specifically excluded from the scope of this methodology, however, are:

• Mechanical Safety or Relief Valves

• Self Contained Regulating Valves

• Breaker Trip Settings

• Protective Relays

• Valve Torque or Limit Switches EGR-NGGC-0153 Rev. 12 Page 26 of 184

9.1.1 Scope Application of the methodology described in this procedure is appropriate for Limiting Safety System Settings as defined in 10CFR 50.36, and for operator indications when required by the emergency response guidelines. Where Limiting Safety System Settings have been established for nuclear plant instruments by the plant Technical Specifications, the settings are to be chosen so that automatic protective action will occur to protect against the most severe abnormal situation without exceeding analytical safety limits. Instruments that are utilized to ensure that these safety limits are not exceeded will provide adequate margins to safety which are to be documented through the use of instrument uncertainty and scaling calculations. Approved documentation shall also exist to support instrument uncertainty values used in the determination of indicator driven operator actions specified in the Emergency Operating Procedures when required by the Emergency Response Guidelines.

Application of the complete methodology outside of the above defined scope may not be warranted and will require engineering experience and judgment on a case by case basis. Judgment would typically consider the following:

Instances where existing designs can be justified to prevent equipment modifications.

Situations where settings need to be made with a minimum margin to maintain reliability and it is desired to quantify the margin.

Cases where instrumentation design inadequacies are being evaluated to determine an optimum solution to a specific-problem.

9.1.2 Surveillance Test Acceptance Values Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met. (Ref. 10 CFR 50.36)

It is generally not necessary to apply allowances for instrument uncertainties to surveillance test values that are not Limiting Safety System Settings or automatic protective functions because:

1. Surveillance test acceptance criteria are typically specified close to system process parameter optimal performance limits so that degraded equipment performance is identified in a timely manner.

This leaves little or no margin of system capability remaining for conservative application of instrument uncertainties.

I EGR-NGGC-0153 Rev. 12 1 Page 27 of 184 1

9.1.2 Surveillance Test Acceptance Values (cont'd)

2. Typically the analyses or calculations on which the surveillance test values are based have conservatism built into them which are greater than normal instrument uncertainties.

3. Industry standards for the design and accuracy of industrial instrumentation were used when plant instruments were specified and constructed so the instrument uncertainties are limited.

4. Plant instruments, which are used for surveillance tests, are included in standard periodic instrument maintenance or calibration programs that check instrument performance at specified intervals.

5. Surveillance tests, not involving Limiting Safety System Settings or automatic protective functions, are not encompassed by specific 10 CFR 50.36, Reg. Guide 1.105, and ISA Std. 67.04 requirements to account for instrument uncertainties.

9.1.3 Settings of Lesser Importance Lesser levels of rigor and documentation are expected to be applied to instruments of lesser importance to safety and production. The recommended method of documenting settings of lesser importance is to load the setpoint data and any reference document number into the Equipment/Component/UTC Parameters panel of PassPort, per applicable plant procedures. Database loading can be accomplished electronically or by using paper forms, as specified by plant procedures. Section 9.1.4 describes the goals that can be achieved through use of our setpoint database.

9.1.4 Setpoint Databases The goal of our electronic setpoint database is to achieve a single point reference for instrument setpoints. A fully functional setpoint database can be used by Engineering, Maintenance, and Operations on a continuous basis so that all tasks involving setpoints are based on the same information and so all setpoint changes are consistently controlled and implemented.

All types of setpoints should eventually be captured in, and controlled by, the database. To accomplish this goal, it is necessary to systematically load and approve the setpoint information. The recommended method of loading information is to integrate the loading process into the engineering evaluation and change processes, and into the instrument calibration process so that data is routinely entered. Data base loading can be accomplished electronically or by using paper forms, as specified by plant procedures.

A routine setpoint data approval process should also exist in Engineering so that the data gets reviewed and approved as it is entered, thus avoiding creation of a backlog of unapproved setpoints. This engineering approval process, however, EGR-NGGC-0153 Rev. 12 Page 28 of 184

9.1.4 Setpoint Databases (cont'd) needs to apply a graded approach because the vast majority of setpoints already exist in approved plant procedures, and have been proven through time in service, making it unnecessary to evaluate each one from scratch. When an approved reference document such as a procedure or an EC exists, and the setpoint under review is not a Limiting Safety System Setting (10CFR50.36), no separate calculation or significant review documentation should be required when approving the setpoint data for database use. Setpoint changes and new setpoints, however, shall continue to be evaluated and approved through the EC process with the results being loaded into the database.

9.2 Loop Error Analysis 9.2.1 Overview Proper plant operation is achieved through the continuous monitoring and adjustment of process variables, either automatically or manually, via plant instrumentation and controls. The ability of the instrumentation and control (I&C) systems and equipment to properly monitor and control these variables is directly dependent upon the ability of the I&C systems to predictably and consistently measure and act on these processes. This ability is a measure of the accuracy of an I&C system.

The design of plant systems and equipment must take into account the realistic capabilities and limitations of the I&C systems available. The accuracy of an I&C system is affected by the system's ability to measure the process conditions and discern true variations in the process from a desired or set condition. This set condition, generally known as a setpoint, is the primary basis of process control.

Setpoints can be actual process control settings, points of equipment actuation (commonly referred to as interlocks or trip setpoints), points of initiation of an alarm, etc. In other words, any predetermined point that requires an action to be initiated can be considered a setpoint.

Typically, setpoints are considered to be applicable to automatic devices such that upon reaching the predetermined value, an automatic action occurs. Sometimes setpoints are considered in a broader sense, and are considered to be points at which an automatic or manually initiated action occurs. When the term "setpoint" is used to describe a manually initiated action, it is usually used in conjunction with another descriptive term such as "EOP Setpoint" or "Operator Setpoint" to differentiate it from those setpoints that initiate automatic actions. For the purposes of this document, the term "indicated value" will be used to describe those points at which a manual action is expected. The following discussion is applicable to both setpoints and indicated values, although just the term "setpoint" is used for brevity.

Whenever an issue only applies to just setpoints or just indicated values, it will be specifically noted.

I EGR-NGGC-0153 Rev. 12 1 Page 29 of 184

9.2.1 Overview (cont'd)

Proper selection of setpoints is important to the safe, reliable and efficient operation of a plant. For proper determination of setpoints, a good understanding of system dynamic responses, interrelationships of system components, and analyses of anticipated abnormal occurrences (including accidents and environmental effects) is essential. In addition, the capabilities of the instrumentation must be considered.

All instruments have limits to their accuracy, stability, and repeatability. These limits are also affected by external influences such as calibration, environment, power supply fluctuations, process conditions, etc. These external influences must be considered in the determination of a setpoint. The accuracy of an instrument is generally expressed in terms of inaccuracy, error, or uncertainty. These three terms are used interchangeably in industry to describe the limitations in the performance of an instrument.In a nuclear power facility, special care must be taken in the development and selection of plant setpoints. This is especially true for setpoints which are related to plant quality-related systems and equipment.

Setpoints which affect the safety of the plant must take into consideration all aspects of plant normal, and potentially abnormal, operations. For such setpoints, a specific detailed analysis should be performed and documented to ensure that all operational aspects are appropriately addressed.

Plant design is based on detailed system and equipment analyses which establish safety limits on important plant process variables. Safety limits are established to protect the integrity of the physical barriers that guard against the uncontrolled release of radioactivity. An example of a safety limit would be the absolute maximum pressure allowed in a piping system that carries potentially contaminated fluid. All safety limits applicable to a plant are typically documented in the plant's Licensing Basis and Safety Analysis Report (SAR).

Plant safety analyses, or accident analyses, are performed to model the interaction of plant systems, and to establish additional analytical or safety limits on specific process variables. These analytical limits are established such that, given the most severe operating or accident transient, the plant safety limits will not be exceeded.

A typical analytical limit is the maximum operating pressure in a piping system. The piping system may have a safety limit maximum pressure equal to the pipe maximum design pressure. The analytical limit maximum pressure would be set below the safety limit to ensure that the safety limit is not reached during applicable design bases accidents (DBAs).

The plant safety analyses generally take into account the specific thermodynamic, hydraulic, and mechanical interactions of systems. Response time assumptions for plant instrumentation are also modeled in the safety analyses, but the effects of instrument and measurement uncertainties are generally not explicitly quantified.

Additional analyses are therefore necessary to ensure that all aspects of system IEGR-NGGC-01 53 1 Rev. 12 1 Page 30 of 184

9.2.1 Overview (cont'd) and equipment design are taken into account when establishing the final plant process setpoints. These additional analyses are the primary subject of this document. The final plant setpoints must incorporate instrumentation uncertainties which, if not considered, could allow analytical limits, and possibly safety limits, to be exceeded.

Uncertainties which exist within an instrument device/loop are classified as either random or bias errors. Random errors are, as the name implies, the basic measurement uncertainties or variations which exist in any repeated measurement.

The error is caused by the combination of numerous small effects which are within any such measurement. An exact value of random error cannot be predicted for a specific measurement. Instead, it can only be said that it will exist within a normal distribution about a true mean value. Therefore, in order to account for the random errors, these unsystematic errors are enveloped by upper and lower limits around the measured value. These limits bound the most probable value for the instrumentation output at any specific instance.

Unlike random errors, bias errors do not exhibit the random normal distribution characteristics. Rather, they exhibit a correlated, predictable, fixed, or systematic behavior. A bias exists where there is a known offset of a measurement from the ideal value or where there is a known relationship between the measured parameter and another parameter.

To establish the total uncertainty in an instrument or measurement, the various random and/or bias error effects must be appropriately combined. This is accomplished through the application of basic statistical analysis. Those errors that are considered random are combined using statistical formulae such as Square-Root-Sum-of-the-Squares (SRSS). The bias errors, on the other hand, must be algebraically combined. Finally, the resultant random and bias errors are algebraically combined to yield a total uncertainty. Once the total uncertainty is known, the final plant setpoint can be established. It is calculated by placing it on the conservative side of the analytical limit by a value equal to, or greater than, the total uncertainty.

Consider again the example of the maximum piping system pressure analytical limit discussed earlier. The final plant setpoint would be established at a value lower that the analytical limit, to ensure that neither the analytical limit nor the safety limit would be exceeded.

The source and magnitude of instrument uncertainties are governed by a number of system, equipment, and installation parameters. Process variations in temperature, pressure, fluid density, etc., can cause significant errors in the basic measurement.

In addition, instrument support activities, such as the accuracy of the test equipment used to calibrate an instrument, and the calibration process itself, also influence instrument and measurement uncertainties.

I EGR-NGGC-0153 Rev. 12 Page 31 of 184

9.2.1 Overview (cont'd)

Many instrument errors are influenced by the environmental conditions which surround an instrument. These conditions include among others, temperature, pressure, and radiation effects. The accuracy of an instrument must be evaluated for the ambient operating conditions under which it must function. In addition, a set of base or reference ambient conditions should be established to assist in instrument design and calibration. Typically, three specific ambient operating conditions are considered: (1) calibration (reference), (2) normal, and (3) accident conditions. These are discussed in detail in Section 9.7.2.

9.2.2 Basic Concepts The typical instrument loop consists of a field mounted transmitter or sensor connected by cabling to an instrument process cabinet containing the loop power supply and other signal conditioning modules. For loops with remote mounted devices (such as an indicator), the cabinet would contain modules to drive the remotely mounted device. Figure 9-1 depicts a typical instrument loop containing both a remote mounted indicator and an actuation/setpoint device (bistable module), and Figure 9-2 shows a block diagram for the typical loop.

Each device or component in the loop can affect the loop's performance (accuracy).

These devices include the loop's power supply and interconnecting cabling. In general, the more components that exist in a loop, the greater the potential loop uncertainty since each component has a discrete uncertainty associated with it. In addition, the component uncertainties can be greatly affected by the ambient conditions under which the components function.

Field Mourned Cabinet Mounted I Control Pressure Current 1o Voltage I Pressure Transmitter Voltage tO Currant Indicator

& Bistable eltC.,

Modules elcrltricc.l Cable and Acc. [Cable and Ac.

FIGURE 9-1 TYPICAL INSTRUMENT LOOP For sensors and electronic modules such as transmitters, current converters, function generators, etc., even small variations in ambient conditions can affect their performance. On the other hand, the loop signal transmission components (cable, splices, etc.) are generally immune to small ambient variations and only affect loop performance under extreme conditions.

IEGR-NGGC-0153 1 Rev. 12 Page 32 of 184

9.2.2 Basic Concepts (cont'd)

Instrument loops can generally be divided into four major parts for loop error analysis:

Process measurement - This includes a loop's transmitter, a flow element or other primary element, and/or other sensors/transducers used to measure a process variable. It also includes the basic measurement process and any effects it may have on the performance of a loop, as well as, the interface with the process (tubing, etc.).

Signal transmission - All of the loop components required to carry the measurement signal from the process measurement device to the signal processing section including the signal cable, cable connectors, splices, penetration assemblies, etc.

Signal processing - All loop devices downstream of the process measurement section, used to condition or modify the signal from the measurement device. This would include such items as an isolator, square root extractor, function generator, etc.

Final output - This is the final destination of a loop signal. Typically the final output is an actuating device such as a bistable module, and/or an indicating device such as an analog indicator, recorder or digital indicating device.

Poten*tially M,,arsh Mild Enviranmentr Enviratnsnnt PT. TE. etc. Cables, Splices IN. v11. Indl.ators, Conneotoro. Squre FlaRoters. Recorder$.

Penetrations Power Supply, eta. *istebles, eta.

FIGURE 9-2 TYPICAL LOOP BREAKDOWN The environmental conditions to which the various parts of a loop are exposed can be different, depending on the location of actual loop components. Typically, two major classifications of environmental conditions are defined - harsh and mild.

Harsh environments cover all ambient conditions resulting from High Energy Line Breaks (HELBs), such as a loss of coolant accident (LOCA) or main steam line break (MSLB). Mild environments cover all normal operating conditions besides the harsh areas.

IEGR-NGGC-0153 1 Rev. 12 1 Page 33 of 184 1

9.2.2 Basic Concepts (cont'd)

Different ambient conditions exist under each classification, depending on the specific location of a device. The separation between harsh and mild conditions typically occurs somewhere between the field mounted sensors and the signal processing modules. Usually only the field mounted sensors and a portion of the signal transmission components will be exposed to harsh environment conditions.

However, each loop must be individually evaluated to identify which components, if any, will be exposed to a harsh environment. Only those components which are potentially exposed to a harsh environment need to be considered for other than normal environmental effects in an uncertainty analysis.

9.2.3 Error Sources Variations in instrument or loop accuracy are the result of a number of different error components. These error components can be divided into three major classifications or classes of error based on their source:

• Process Measurement Errors

• Instrument Uncertainties

• Other Errors Process measurement errors are, as the name implies, basic errors in the actual process signal being detected by the process measurement device (sensor).

These errors are wholly a function of the characteristics of the measurement process and not a function of the performance of the instruments. Process measurement errors include such things as variations in a measurement due to sensing line fluid density changes, process pressure changes, errors in a head type flow meter measurement due to improper flow profile development or density effects, or temperature variations. Process measurement errors are discussed in detail in Section 9.3.

Instrument uncertainties, or errors, are the performance limitations (inaccuracies) associated with the actual equipment used to measure and process the measurement signal. This class of errors includes the basic accuracy of an instrument, its performance versus ambient variations, and its performance over time. Instrument uncertainties are discussed in detail in Section 9.4.

The class of "other errors" is used to account for a number of error sources that are essentially independent of the actual loop and its devices, but that can introduce significant error. This class includes such items as the uncertainty associated with the instrument calibration process and with the calibration test equipment.

Additional errors are introduced into a measurement signal due to performance variations in signal transmission components exposed to a harsh environment.

Section 9.5 discusses the error sources for the "other errors" class.

I EGR-NGGC-0153 Rev. 12 Page 34 of 184

9.2.4 Loop Analysis By expanding the loop block diagram shown in Figure 9-2, a basic instrument loop error analysis diagram can be established. The diagram, presented in Figure 9-3, shows the relationship of loop instruments, sources of errors, and environmental effects for a typical loop.

The basic error analysis block diagram starts with the process errors which may in a measurement. This is a subset of the process measurement errors discussed above. The next block, the primary element block, is included to account for loops which may have a true primary element such as a flow nozzle or orifice. Any errors associated with the primary element are considered part of the process measurement errors since they are integral in the variable being measured by the loop sensor. The remaining four blocks represent the four major sections of an instrument loop as defined above.

Actual loop error analysis uses the basic loop error analysis diagram as a model for identifying and calculating error values. The loop error analysis is done in a step by step calculation which builds the total loop error, or uncertainty, using a combination of the individual error effects. The process starts from the process error effects and progresses through the loop to the final output device of concern.

POTENrTIALLY HARSH PMILD ENVIRONMENT ENVIRONMENT Efcsmesswurolaftmt TrOM LO -4 NacL~o*

mes.i*rwa*

Pacess Measurement Instrument Other Efror Incrument Uncortaintiea BffemR UVnCe~itiWB Othar Errors FIGURE 9-3 INSTRUMENT LOOP ERROR ANALYSIS DIAGRAM IEGR-NGGC-0153 Rev. 12 Page 35 of 184

9.2.4 Loop Analysis (cont'd)

In reference to Figure 9-3, the loop analysis typically progress from left to right.

This also represents the functional flow of the measurement signal through the loop. Use of this method allows the uncertainty in a measurement signal to be determined at any point within a loop. This format also allows the calculation of uncertainty values for a loop that contains multiple signal paths or multiple signal processing. For example, both a pressure measurement signal and a temperature measurement signal, used in a temperature compensated level measurement, may be combined to establish a single level error value. By calculating the individual signal errors up to the point of combination, the total uncertainty for the loop can be calculated. The errors for the individual signal paths are determined using the same basic calculation process, and are then combined with any remaining error terms in the loop to obtain a final output error. This method is discussed in detail in Section 9.6.

9.2.5 Error Component Types All measurements, whether as simple as a length measurement by ruler, or as complicated as a three element water level control loop, have errors associated with them. No measurement is without an associated uncertainty. In some measurements, the error is minor and need not be quantified. When measurement error becomes potentially large, or where even small amounts of error can create problems, a quantitative determination of the error must be made. The determination of the measurement error can be accomplished in several ways (algebraic, statistical, or the combination of the two). These different methods are discussed in more detail in Section 9.6.2. For now, suffice it to say that the most common method involves a combination of the algebraic and statistical derivation of the error, and this is what will be used for the NGG plants.

The statistical derivation is possible due to the inherent nature of the errors which exist for instruments and measurements. The statistical derivation provides realistic estimates of the errors which exist. A given measurement is composed of two types of error components, the random/precision error, and the bias/fixed error.

These two error terms form the bases of instrument error analysis. Proper application of these terms is essential to proper error analysis.

A general discussion of random and bias errors is provided below, and defines how these error types are treated in instrument error analysis. Sections 9.3 through 9.5 of this document define the individual errors which may be present in an instrument or loop.

Each of these error terms is classified as typically being either random or bias in order to aid the user of this document in appropriately applying each type of error.

However, the applicability of these classifications must be validated for each individual device/loop.

I EGR-NGGC-0153 1 Rev. 12 Page 36 of 184

9.2.5 Error Component Types (cont'd)

1. Random Error A random error is, in itself, a statistical measurement of accuracy. It is the basic variation seen in the seemingly identical, repeated measurements of a parameter. A random error is caused by the culmination of the numerous small error effects which exist in any action. The exact magnitude and sign of a random error at a specific point in time cannot be predicted. However, the error is normally distributed about the true values, and a bounding set of limits to its upper and lower value can be established.

Random errors are independent variations (not dependent on one another or on the same parameters) in a measurement and cannot be eliminated.

Bounds on the magnitude of a random error are established through statistical analysis of these variations.

By obtaining repeated measurements of a parameter, a measure of the random error magnitude can be calculated. The standard deviation, sigma (a), is used as a measurement of the random error. The standard deviation is defined as:

N Nr (Eq. 1)

Where, X = Individual measurement values M = Mean of all measurement values N = Number of measurements A group of random error measurements will exhibit a bell shaped (normal) distribution about the mean, when plotted as a function of measurement frequency (see Figure 9-4). The figure illustrates the typical distribution of measurement deviations associated with random errors. As recorded deviation from the mean increases, the occurrence of measurements with that particular deviation decreases significantly.

By using the standard deviation term, a statistically acceptable measure of random error can be established.

IEGR-NGGC-0153 1 Rev. 12 Page 37 of 184

9.2.5 Error Component Types (cont'd)

Using normal probability analysis, it can be shown that the number of measurements that will vary within one standard deviation of the mean will represent 68.27% of all the measurements. In other words, approximately 68% of the time, the recorded measurement will be within one standard deviation of the true value. Expressing this in terms of probability, there is a 68% probability that the error will be equal to or less than one standard deviation.

- Average Measurmrent Scarter Due to Ranctom Error Paramneter Measurementt Vaiue FIGURE 9-4 MEASUREMENT UNCERTAINTY Industry and the NRC have accepted a minimum level of random error probability of 95% for instrument error analysis. This 95% probability means that the error exhibited by a component or loop must be less than or equal to its established error at least 95% of the time. The 95% probability represents the deviation value from the mean which encompasses 95% of all measurement variations. Statistically, the 95% value can be shown to be

+/- 1.96 times the standard deviation. For various sample sizes, refer to EPRI TR-103335-R1, Table 18-4 (Ref. 2.29) to determine the appropriate multiple to be used with the standard deviation.

When combining random uncertainties, it is important to identify whether each uncertainty is 1, 2, or 3 sigma. The resulting overall uncertainty will only be statistically equivalent to the least probable uncertainty. Thus, if one uncertainty is three sigma and the other uncertainties are two sigma, the combined uncertainty can only be two sigma. For NGG, it will be assumed that published vendor uncertainties are two sigma unless the vendor can provide a more conclusive determination. This is based on common industry practice.

I EGR-NGGC-0153 Rev. 12 Page 38 of 184

9.2.5 Error Component Types (cont'd)

As stated above, random errors are independent variations with a normal distribution about the mean. What happens though, when two or more errors are dependent? If they are not random they are treated as biases as discussed below. If, however, their combined effect is random they may be summed together and treated as a single random error the same as other random errors. This is discussed in more detail in Section 9.6.

2. Bias Error Bias errors, also known as correlated or fixed errors, are systematic deviations in a measurement or output. A bias error does not exhibit normally distributed random behavior. The bias error exhibits a generally known behavior with respect to other parameters. A measure of total error for an instrument, or loop, can be determined by combining its bias error terms with its random error terms.

There are generally three types of bias error terms encountered in instrumentation. The first is defined as a bias with known sign and known magnitude. This type of bias is generally well defined and predictable. An example of such a bias is the reference leg heat-up effect on a filled reference leg level installation, as discussed in Section 9.3. For a known temperature change, the level signal exhibits a known (direction and magnitude) shift in output. Many biases of this nature can be calibrated out of an instrument, and thus eliminated.

A second type of bias is defined as a bias with known sign but unknown magnitude. This type of bias is less predictable due to its variable magnitude, but may be quantified by establishing a maximum (worst case) value. An example of such a bias can again be seen in a filled reference leg level installation. After an event, the reference leg may be exposed to accident temperature conditions which cause errors in the level signal. The accident temperature, though, is not a known constant change. The temperature is a variable with a calculated maximum. As a result, the actual effect on the reference leg due to the variation in temperature is not known precisely. The difference between reference leg heat-up rate and the temperature change causes the exact bias magnitude to be unknown. A maximum bias effect can be determined, though, based on the maximum temperature to bound the actual bias.

IEGR-NGGC-0153 1 Rev. 12 1 Page 39 of 184

9.2.5 Error Component Types (cont'd)

The third type of bias is defined as a bias with unknown sign and unknown magnitude. This type of bias is similar to a random error due to its unknown sign.

However, it cannot be classified as random since it will not exhibit a normal distribution. An example of this type of bias is the accident environment effect on some transmitters. When subjected to accident conditions, the transmitters begin to exhibit a shift in output. The shift may be either negative or positive for a specific transmitter, but once it's initiated, the shift will remain in the same direction (negative or positive). The magnitude of the shift will generally increase with the duration and severity of the accident conditions, but its value at a specific time cannot be determined. Only its maximum error for the stated conditions can be established. Because of the unknown sign, this type of bias error must be assumed to contribute to both the negative and positive uncertainty values.

It should be noted, that for the purpose of this document, the type of error described above will be treated as a bias. Other industry documents may call this an abnormally distributed uncertainty, or some other similar term. However, the name applied to such an error is not as important as how the error is combined with the other uncertainties. Both this document and other industry documents combine the error in the same manner. That manner is to algebraically combine the error with the positive random error and positive biases, and separately to combine the error with the negative random error and negative biases.

Bias errors are normally generated by specific effects internal to, or external to, an instrument. The magnitudes and signs of the errors are decided using known correlations between variations of a parameter and its effect on the output of a device (e.g., reference leg heat-up, IR effect). Thus, while a number of bias errors may have equal and opposite effects on instrument accuracy, each must be treated separately, and not used to offset another. Unless specific links exist between bias error, each must be assumed to occur separately.

The errors which bias a measurement in the same direction can be combined to establish the worst case error in a given direction. As discussed above, a specific bias can generally be a value anywhere from zero to its maximum value. By combining the maximum bias values in a given direction, the maximum error band over which a measurement can vary in that given direction is established. This approach usually provides extremely conservative error values which may not be desirable for all applications.

Figure 9-5 illustrates the total uncertainty of a measurement or instrument output.

The positive bias error (+B) is combined with the positive random error to define the largest positive error, while the negative bias error (-B) is combined with the negative random error to define the largest negative error. Based on the probability of the random error term, the uncertainty interval established will define the total error to the same degree of probability.

I EGR-NGGC-0153 Rev. 12 Page 40 of 184

9.2.5 Error Component Types (cont'd)

L N P .Va Erzro r'"o Largem ftaftive War 4-40 + IR)

-a Uncermouny rn~wvg -

ITha True VaLue SbhouWeR01 within ThiS Irv~uiall FIGURE 9-5 TOTAL UNCERTAINTY 9.3 Process Measurement Error Process measurement requires the establishment of relationships between variables which enable the detection of changes in these relationships. The measurement of temperature by a mercury thermometer can be used to demonstrate this point. The thermometer measures room temperature by using the known relationship between the volumetric expansion of mercury and changes in temperature. As temperature increases, the volume of a fixed mass of mercury increases by a proportional amount. By placing the mercury in a tube with known graduations, the change in volume can be identified and correlated to a change in temperature.

The establishment of usable relationships between variables for measurement purposes is generally dependent upon other known influences not affecting the relationship of concern. In other words, only one variable is assumed to change at a time, so that the measured change is due solely to the variation of the parameter of concern.

I EGR-NGGC-0153 Rev. 12 1 Page 41 of 184

9.3 Process Measurement Error (cont'd)

Using the mercury thermometer illustration again: To isolate the mercury from other influences which could be misinterpreted as a temperature influence, the mercury is enclosed in a vacuum sealed glass tube. By doing this, other parameters which can cause the mercury to vary in volume, such as pressure or humidity, are isolated. Now, the only parameter which can cause the mercury volume to change is temperature. By calibrating the change in volume for a known temperature change, an accurate temperature measurement device is obtained.

In actual process measurement however, the effects of other parameters on a given measurement relationship may not be fully isolated. This can cause errors in the measured parameter. The effects of these other influences must be either accounted for or isolated in order to obtain an accurate measurement.

The effects of these influences are known as Process Measurement Effect (PME) since they are due primarily to variations in ambient and process conditions. The process measurement errors encompass all errors within a process measurement signal prior to the loop sensing device.

In design and calibration of plant instrumentation, uniformity of all pertinent characteristics of the process fluid is assumed. However, there are many applications where uniformity is not a valid assumption. For example, changes in gas density due to pressure varying fluid density or viscosity for a head-type mass flow meter, or thermal gradients in stagnant fluids with a point temperature measurement, can cause significant measurement errors. Many of these problems can be accounted for by providing compensating measurements, proper correction factors, or special calibrations. Others though, may not be correctable and will induce additional error or uncertainty into a measurement.

IEGR-NGGC-0 53 I Rev. 12 I Page 42 of 184

9.3.1 Liquid Level Measurement One of the most common methods for liquid level measurement uses the hydrostatic head (pressure) created by a column of liquid. The measurement of the hydrostatic head usually provides a direct link to liquid level, and it is easily measured by a pressure transmitter/switch, or a differential pressure transmitter/switch. Depending on the specific method of measurement, changes in the density of the measured process liquid, or in the pressure sensing lines can cause errors in the level measurement. This variation in density can be caused by changes in temperature, pressure, and/or chemical composition.

1. Open Vessel Measurement The measurement of level in an open vessel is one of the simplest forms of utilization of the hydrostatic head principle.

The actual measurement can be accomplished by use of either a gauge pressure or differential pressure type device. Since the vessel is open, both devices use the local atmosphere as the common reference.

Figure 9-6 shows a typical open tank application. The pressure (P) sensed at the point of connection to the tank can be calculated by:

P =HL*SG (Eq. 2)

Where, HL = Height of liquid above the connection point, in inches of water SG = Specific gravity of the liquid P = Pressure, in inches of water I EGR-NGGC-0153 Rev. 12 Page 43 of 184 1

9.3.1 Liquid Level Measurement (cont'd)

HLMAX HL P Oin. WCI = HL # SG

• P =; HW.SG . $GI Error(%spn a HL4SG

• 1GI HLMn' SGI HL = Height of liquid measured in inchies HLMAX- MaxiMum h ight of liquid SG Specific gravity of licuid SG, SG *Sp-cific gravity of liquid at temperature I and timperature 2 respectlvely P= Presure sensed at the bottom of HL in irthes of water cojumn.

FIGURE 9-6 HYDROSTATIC LEVEL MEASUREMENT IEGR-NGGC-01 53 Rev. 12 1 Page 44 of 1841

9.3.1 Liquid Level Measurement (cont'd)

By using the specific gravity to calculate the pressure, the resulting pressure will be in units of inches of water column (in WC). The primary variable in the pressure equation, specific gravity, is by definition, the ratio of a fluid's density to the density of water at the standard temperature and pressure of 68 0 F and 1 atmosphere.

NOTE: Not all sources of SG use water at 68 0 F as a reference. Those must be converted to SG referenced to water at 68 0 F.

SG = density of fluid (Eq. 3) density of water @ 68°F In nuclear power plant applications, water constitutes the majority of the fluid applications for which measurements are made. For water, the ASME Steam Tables provide a convenient source of data for the determination of specific gravity. The Steam Tables provide the specific volume for water in its liquid (f) and vapor (g) states at various temperatures and pressures.

Since specific volume is the inverse of density, the specific gravity of a fluid can be calculated from the specific volume values by:

SG = specific vol. of water (.3 68°F (Eq. 4) specific vol. of fluid 0.01605 Vf or Vg Two important facts must be noted about the measurement of level using hydrostatic head:

The relationship of hydrostatic head (P) to fluid height (HL) is directly proportional. (see Equation 2)

The hydrostatic head produced by the fluid is dependent upon the temperature of the fluid since the temperature affects the fluid's density.

In the initial design and establishment of calibration parameters for a level loop, a base calibration temperature of the fluid must be assumed. In this example, the base temperature is typically the temperature of the fluid at normal operating conditions. When the actual fluid temperature varies from this assumed value, errors in level measurement occur. This is because the device sensing the hydrostatic head cannot distinguish a pressure change caused by temperature variation from a change in actual level. The error can be calculated, though, by calculating the change in specific gravity.

EGR-NGGC-0153 Rev. 12 Page 45 of 184

9.3.1 Liquid Level Measurement (cont'd)

Assume for a temperature of T1, a fluid has a specific gravity of SG1.

We will call this the base calibration temperature. The error calculated will be at a different temperature, T2. For temperature T2, the fluid has a specific gravity of SG2. P1 and P2 are the resulting hydrostatic heads at TI and T2 (assuming level remains constant).

Thus, Error (in WC)= P2 - P1 DP = (HL* SG2) - (HL* SG1)

= HL (SG2- SG1) (Eq. 5)

To express this error in terms of level measurement loop span, the error term in Equation 5 must be divided by the span of the loop. The span is typically equal to the difference between the maximum calibrated value and the minimum calibrated value. In this case, the span is equal to HLmax because minimum level is measured from the elevation of the level sensing nozzle (HL=O). To express the span in consistent units (in WC), it must be multiplied by the calibration specific gravity SGI.

Therefore, Error (% span) = HL (SG2 - SG1)

• 100% (Eq. 6)

HLmax (SG1)

Notice that the actual error incurred due to temperature change will vary as follows:

1. For T2<T1, SG2>SG1. The error is positive and becomes larger as T2 decreases.

2. For T2>T1, SG2<SG1. The error is negative and becomes larger as T2 increases.

3. The larger the actual level term HL, the larger the level error with the maximum error occurring when HL is equal to HLmax.

EGR-NGGC-0153 Rev. 12 Page 46 of 184

9.3.1 Liquid Level Measurement (cont'd)

The positive and negative error annotations refer to the error with respect to actual level. A positive error will cause a measurement to be higher than actual value, while a negative error will cause a measurement to be lower than actual value.

Temperature may not be the only parameter which varies the density of a fluid. The chemical composition of the fluid can also cause the density to vary. In PWRs, the most common chemically induced variation of water density is caused by the presence of boric acid or Sodium Hydroxide. The effects of boric acid concentration, for example, can be determined using the same formulae developed above (Equations 5 and 6). The concentration of boric acid in water has a similar affect on the density of the water to that of temperature.

If the density change is known, the measurement error can be calculated.

Processes for determining the densities of different boric acid solutions are described in Attachment 2.

While open vessels are normally at atmospheric conditions, during certain events this may not be so, thereby introducing measurement uncertainty. An example was addressed in RNP CR 99-00882, which evaluated an OE item from the DC Cook plant. During review of the Refueling Water Storage Tank vent piping capacity, it was determined that, at the maximum liquid outlet flow rate, a vacuum condition would be established in the tank because the vent flow rate into the tank would be insufficient to maintain atmospheric pressure. This effect would bias the level indication, making it lower than the actual level.

Situations like this, involving non-atmospheric conditions in a vented tank during certain events, must be considered and their effect on level measurement uncertainty properly analyzed.

2. Closed Vessel Measurement Another common level measurement application involves the detection of level in a closed vessel using the hydrostatic head measurement process.

While the basic principles are the same as discussed in Section 9.3.1.1, other factors can affect the measurement process.

Figure 9-7 illustrates a typical closed vessel level measurement installation.

In a closed vessel, the static pressure of the gaseous volume above the liquid must be taken into account. This requires the use of a differential pressure device which measures the pressure at both the bottom and top of the liquid. The lower sensing line, called the measurement or variable EGR-NGGC-0153 Rev. 12 Page 47 of 184

9.3.1 Liquid Level Measurement (cont'd) leg, measures the hydrostatic pressure of the liquid plus the static pressure of the gas. The upper sensing line, called the reference leg, measures the static pressure of the gas above the liquid. The differential pressure device measures the difference in pressure between the measurement and reference legs, such that the resultant output is a measurement of only the liquid's hydrostatic head.

As depicted in Figure 9-7, a common practice of level measurement involves the filling of the reference leg with a liquid, typically the same liquid as found within the vessel or simple ordinary water. This provides both a seal between the contents of the upper portion of a vessel and the transmitter as well as providing a more stable reference leg measurement for certain applications.

IEGR-NGGC-01 53 1 Rev. 12 Page 48 of 184

9.3.1 Liquid Level Measurement (cont'd)

A m-- HLMAX HK DP liin, WC) = H-R SGRI - IHL SGU

• [DP (jn. WC) a HRiSGR4- SGR C - HLISGL - SGL I error % snan change = - 100%

MAX 5L HL= Height of vessel Liquid measured in inches HR Height of reference leg liquid column in inches SGL = Specific gravity of vessed liquid SGR = SpeoifLc gravity of reference ieg iiQuid OP D Differential pressure representing vessel liquid level in inches of water SP = Static pressure in gas at top of vessel SGL 5GL Specific gravity of liquid at temperature I and 2 respectiveLy SGR -. SGR

• Specific gravity of reference leg liquid at temperature 3 and 4 respectiveLy NOTE: it is assumed that the gas is at negligible specific gravity conditions in this example FIGURE 9-7 WET LEG LEVEL SYSTEM IEGR-NGGC-0153 1 Rev. 12 Page 49 of 184 1

9.3.1 Liquid Level Measurement (cont'd)

The calculations of hydrostatic head, and associated errors for a level loop, using a differential pressure device, are the same as those for an open vessel, provided that the fluid in the reference leg does not contribute to the hydrostatic head. For reference legs containing a gaseous fluid (dry reference leg), the hydrostatic head in the reference leg will generally be zero. Only when the gas is under very high pressure would the density of the gas cause a significant head effect. In this discussion it is assumed that all gases are at low pressure and do not contribute any significant hydrostatic pressure. For a wet, or filled, reference leg installation, though, the level determination and potential errors in measurement are determined differently.

The basic formula for calculating the hydrostatic head for a wet reference leg system is:

DP (in WC) = (HR*SGR + SPE) - (HL*SGL + SPE)

= (HR*SGR) - (HL*SGL) (Eq. 7)

Where, DP Differential pressure created by the vessel liquid level, expressed in inches of water HR Height of the reference leg liquid column above the lower connection, in inches HL Height of liquid in the vessel above the lower connection, in inches HLmax Maximum height of liquid which can be measured, in inches SGL = Specific gravity of the liquid in the vessel SGR Specific gravity of the liquid in the reference leg SPE Static pressure effect of the gas above the liquid, in inches of water IEGR-NGGC-0153 Rev. 12 Page 50 of 1841

9.3.1 Liquid Level Measurement (cont'd)

The resulting equation contains two components of potential error, SGR and SGL. As discussed in Section 9.3.1.1, the specific gravity is affected by changes in temperature. In order to account for differences in temperatures, assumed calibration temperatures for both the vessel fluid and the reference leg fluid must be established. Variations in actual temperature induce errors into the measured level signal. The error can be calculated by comparing the changes in specific gravity in a manner similar to that shown in Section 9.3.1.1:

• Assumed base (calibration) temperature T3, with a reference leg fluid specific gravity of SGR3.

• Actual temperature T4, with a reference leg fluid specific gravity SGR4.

If only the reference leg temperature varies, the error is determined by calculating the change (or error) in DP due to the change in reference leg specific gravity, assuming HL and SGL remain constant.

Error (in WC) = DP(Actual Conditions) - DP(Base Conditions)

DP = HR (SGR4 - SGR3) (Eq. 8)

If both the vessel liquid and the reference leg liquid temperatures vary, the error is:

Error (in WC) = HR(SGR4-SGR3) - HL(SGL2-SGL1) (Eq. 9)

If only the reference leg is affected by changes in temperature, the maximum error will occur at the maximum temperature variation. Since HR does not vary, it will not affect the maximum error. Equation 8 reveals that the DP error is negative if T4>T3 (since specific gravity decreases as temperature increases).

IEGR-NGGC-0153 1 Rev. 12 Page 51 of 184

9.3.1 Liquid Level Measurement (cont'd)

To express these errors in terms of level measurement loop span, the error terms in Equations 8 and 9 must be divided by the span of the loop. As was done for Equation 6, the span is equal to the maximum level HLmax, multiplied by the selected specific gravity of the liquid level, SGLI. Thus Equation 8 becomes, Error (% span) = HR (SGR4 - SGR3)

• 100% (Eq. 10)

HLmax

• SGL1 And Equation 9 becomes, Error (% span) = HR (SGR4 - SGR3) - HL (SGL2 - SGL1)

• 100%

HLmax

• SGL1 (Eq. 11)

If both the reference leg fluid temperature and the vessel fluid temperature vary, the maximum error will occur when one temperature is at a maximum with the other at a minimum.

The above example is for an installation with the "low" side of the transmitter connected to the lower tap, and the "high" side connected to the upper tap.

A similar process could be used for a transmitter whose "low" side is connected to the upper tap and whose "high" side is connected to the lower tap.

Note in the example above, that though the DP error is negative for T4>T3, the corresponding % span level error would be positive. This is due to the inverse relationship that exists between differential pressure and the liquid level in the tank. That is, a reduction in DP is equivalent to an increase in liquid level in the tank.

The effects of temperature variation on level measurement can cause significant amounts of error to be introduced into a loop. Thus, it is essential that the effects of process and reference leg temperature changes be considered in an overall setpoint or loop error analysis.

IEGR-NGGC-01 53 1 Rev. 12 1 Page 52 of 184

9.3.1 Liquid Level Measurement (cont'd)

3. High Temperature/Pressure Vessel Level Measurement The measurement of level by use of a differential pressure device can become very complex when measuring the level in a vessel containing process liquids at high temperature or pressure, or both. The high temperature causes a portion of the process to become vapor and fill the upper portion of the vessel. The resultant changes in the density of the vapor, as well as, of the liquid, can have a significant effect on the accuracy of a level measurement. In a similar manner, high pressure can compress the gas in the upper portion of a vessel causing significant changes in gas density, thus affecting the resulting accuracy.

Figure 9-8 shows a typical closed vessel level measurement setup where the area above the liquid contains a fluid whose density can vary. For nuclear power applications the process liquid is generally water, such as in a pressurizer, a steam generator, or the reactor vessel, with the area above the liquid containing saturated steam. For this discussion two examples are presented, in example 1 we will assume the liquid in Figure 9-8 is water and the area above the liquid is steam. In example 2 we will assume the liquid is borated water, the area above the liquid is pressurized Nitrogen, and the reference line is a dry leg of Nitrogen gas.

The basic formula for calculating the differential pressure or level, where the effects of both fluid densities must be included, is:

DP (in WC) = (HR*SGR + SPE) - (HL*SGL + HV*SGV + SPE)

= HR*SGR - HL*SGL - HV*SGV (Eq. 12)

Where, HR, HV & HL = Heights of the reference leg, vapor region, and liquid, respectively, in inches SGR, SGV & SGL = Specific gravity of the reference leg liquid, vapor, and vessel water, respectively SPE = Static pressure effect within the vessel, in inches of water HLmax = Measurable level within the vessel, in inches I EGR-NGGC-0153 1 Rev. 12 Page 53 of 184

9.3.1 Liquid Level Measurement (cont'd)

For this example, the measurable level (HLmax) within the vessel is equal to the height between the upper and lower sensing connections. This is also the height of the wet leg of concern. Those portions of the sensing lines (high and low) below the lower connection points are not of concern since, they will impart equal and opposite influences which cancel each other, assuming both lines are filled with the same fluid at approximately equal temperatures. Generally, HLmax will not be equal to the reference leg height, but will be at some level below the upper tap of the reference leg.

However, for this example, HLmax = HR = HL + HV (Eq. 13)

Substituting Equation 13 into Equation 12 yields DP in terms of HR and HL only.

DP (in WC) = HR*SGR - HL*SGL - (HR - HL)SGV

= HR(SGR - SGV) + HLI(SGV - SGL) (Eq. 14)

I EGR-NGGC-0153 Rev. 12 Page 54 of 184 1

9.3.1 Liquid Level Measurement (cont'd)

REFERENCE LEG (WATER FILLEDI FULL LEVEL EX0%iO OF STIEAMRL HL MAHX fR *i* t ZERO LEVEL wiSGLI 10%1 Si -

L.0 HI INSTRUMENT EXPLANATION OF SYMBOLS:

HIL -Height of Iliq uid (See nDto 11 HV Heighi of gas or Vaoor HR Height ol referenre leg iSee note 1)

ýGL - Specific graviy of liq~id at saturation iemoerawure SGV. Soecifil gravity ol vapor 41 saturation temporap-re SGR- SpecifIc gravity of reference leg OP ,ifftareniial pressure in inches of water whete DP mHRrSGR$GVI + HL(SGV-S!Ll NOTES:

1. All heights (except HVI are referenced above csrntetline of lower level sensing nozzle FIGURE 9-8 SATURATED LIQUID / VAPOR LEVEL MEASUREMENT EGR-NGGC-0153 Rev. 12 Page *55 of 84

9.3.1 Liquid Level Measurement (cont'd)

For the more general case where HLmax does not equal the reference leg height, HLmax may be substituted for HL. Provided that the vessel and reference leg conditions (temperature/ pressure) remain the same as the base calibration conditions, the indicated level is a linear function of the measured differential pressure, and no vessel/reference leg density effect errors are created.

To assess the effects of density variations (typically caused by temperature variation) on the level measurement, Equation 14 is rewritten in the form:

DP (in WC) = (HR*SGR) - (HR*SGV) - (HL*SGL) + (HL*SGV)

(Eq. 15)

As in the previous sections, let T1 = Assumed base temperature of the liquid and vapor T2 = Actual temperature of the liquid and vapor T3 = Assumed base temperature of the reference leg T4 = Actual temperature of the reference leg Each temperature has a corresponding specific gravity value:

SGL1 & SGV1 = Specific gravity of liquid and vapor at T1 SGL2 & SGV2 = Specific gravity of liquid and vapor at T2 SGR3 = Specific gravity of ref. leg liquid at T3 SGR4 = Specific gravity of ref. leg liquid at T4 The change in differential pressure signal (ADP) at the instrument due to a change in density caused by variations in temperature from the assumed calibrated condition, can be determined by:

ADP (in WC) = DP (Actual Conditions) - DP (Base Conditions)

= HR(SGR4 - SGR3) - HR(SGV2 - SGV1) -

HL(SGL2 - SGL1) + HL(SGV2 - SGV1)

= HR(SGR4 - SGR3 - SGV2 + SGV1) -

HL(SGL2 - SGL1 - SGV2 + SGV1) (Eq. 16)

IEGR-NGGC-01 53 I Rev. 12 I Page 56 of 1841

9.3.1 Liquid Level Measurement (cont'd)

To convert the change in differential pressure, or error value, to error in percent of span, the ADP must be divided by the base span of the loop.

Error (% span) = Error (in WC)

• 100% (Eq. 17)

DP Span The span is the difference between the full scale (100%) value for level and the zero (0%) value for level. In terms of DP, DP span = (DPloo%) - (DPO%) (Eq. 18)

Where, DPO% = the differential pressure when level is 0%

DP,oo% = the differential pressure when level is 100%

Substituting Equation 14 into Equation 18, DP span = [HR(SGR3 - SGV1) - HLloo%(SGL1 -

SGV1)] - [HR(SGR3 - SGV1) -

HLo%(SGL1 - SGV1)]

= HLloo%(SGV1 - SGL1) - HLo%(SGV1 -

SGL1) (Eq.19)

From Figure 9-8, HLo is equal to 0; therefore, DP span = HLloo%(SGV1 - SGL1) (Eq. 20)

Therefore, substituting Equation 16 into Equation 17 yields the error equation, expressed in percent of span, of:

ADP = HR(SGR4-SGR3-SGV2+SGV1)-HL(SGL2-SGL1-SGV2+SGV1)

HLloo% (SGV1-SGL1)

(Eq. 21)

The above formulae for calculating the variation in level can be applied to a number of different types of level loops.

EGR-NGGC-0153 Rev. 12 Page 57 of 184

9.3.1 Liquid Level Measurement (cont'd)

These equations represent the general formulae for calculating differential pressure level measurement error due to variations in density. The equations apply for density variations in any of the fluids which can affect the measurement. By equating the effects of certain specific gravity terms to zero (e.g., SGV1 = SGV2 = 0 in a simple closed vessel), the equations can be shown to be equivalent to those for the open vessel and simple closed vessel.

While many loops only measure level, and are calibrated for specific conditions, other more complicated loops may have automatic temperature compensation circuitry. Such circuitry can adjust a level instrument's calibration parameters to account for the changes in fluid density.

Temperature compensation can be used for either process temperature variations, reference leg temperature variations, or both. Utilization of temperature compensation in a level loop will eliminate the errors in measurement caused by density variations.

The effects of both process and reference leg temperature variations must be considered in the analysis of a level loop's accuracy. Since the magnitude of the error is governed by both the level and the magnitude of temperature change, care must be taken when defining the conditions under which the accuracy must be determined. While the maximum, or worst case, error can easily be calculated for a level equal to 100%, the actual levels of concern may be considerably less than 100% and thereby have much less potential error. In a similar manner, the actual process and reference leg temperatures expected at the time a level measurement is needed may greatly decrease the potential error in comparison to worst case temperature conditions.

Consider the following examples:

Example 1 Calculate the worst case and specific error due to temperature variations in the process and reference leg of the vessel in Figure 9-8.

Assume:

• Process and reference leg fluid is water

• Normal and calibrated process temperature = 532'F

• Normal and calibrated reference leg temperature = 120OF

" Distance between level connections (HLmax & HR) = 169 in IEGR-NGGC-0153 1 Rev. 12 Page 58 of 184

9.3.1 Liquid Level Measurement (cont'd)

" Specific error conditions:

• 40% level

• 500'F process temperature

• 250°F reference leg temperature

" Process temperature minimum 4000 F

• Reference leg temperature maximum 280°F

• All conditions are saturated steam/water Using the basic level formula (Eq. 14), the level signals in inches of water at Standard Temperature and Pressure (STP) at 68 0 F are determined for normal operation using (ASME) Steam Tables (See specific gravity conversion from specific volume in Section 9.3.1.1):

DP = HR(SGR- SGV) + HL(SGV- SGL)

DP for 100% of level (DP 1oo):

HL = HLmax = 169 in DP 0ooo% = (169 in)(0.990249 - 0.032047) +

(169 in)(0.032047 - 0.755817)

= (169 in)(0.958202) - (169 in)(0.723770)

= (161.936 - 122.317) in

= 39.619 in DP for 40% of level (DP 4o%):

HL = 40% HLmax 40% level = (40%)(169 in) = 67.6 in DP4ooo = (169 in)(0.958202) - (67.6 in)(0.723770)

= 113.009 in These represent the calibrated DP values for the loop. No process error would exist in the loop as long as the process temperature remained at 532 0 F and the reference leg temperature remained at 120 0 F.

I EGR-NGGC-0153 Rev. 12 Page 59 of 184

9.3.1 Liquid Level Measurement (cont'd)

The worst case error within the loop will always occur when level is at a maximum and both the process and reference leg temperatures are at their opposite extremes. The worst case error for this loop is calculated using the general formula for differential pressure change (Eq. 16).

ADP = HR(SGR4- SGR3- SGV2 + SGV1)-

HL(SGL2 - SGL1 - SGV2 + SGV1)

HL = 100% = 169 in HR = 169 in SGR3 = Specific gravity of ref. leg water at 120°F SGR4 = Specific gravity of ref. leg water at 280°F SGL1 = Specific gravity of process water at 532°F SGL2 = Specific gravity of process water at 400°F SGV1 = Specific gravity of steam at 5320 F SGV2 = Specific gravity of steam at 400'F ADP = (169 in)(0.929449 - 0.990249 - 0.008613 +

0.032047) - (169 in)(0.860837 - 0.755817 -

0.008613 + 0.032047)

= (169 in)(-0.037366) - (169 in)(0.128454)

= -6.32 in - 21.71 in

= -28.02 in WC Therefore, the worst case error causes the measurement by the level loop to be off by 28.02 in WC in the negative direction. Differential pressure level installations that have a wet reference leg have an inverse relationship between DP and actual vessel level. As the vessel level increases, DP decreases, and as the vessel level decreases, DP increases.

Expressed in percent span, DP Span = HL

-o1%

1 (SGV1 - SGL1)

= (169 in)(0.032047 - 0.755817)

= -122.32 in.

Error = (-28.02 in)

• 100% = +22.9% of span

(-122.32 in)

I EGR-NGGC-0153 Rev. 12 1 Page 60 of 184

9.3.1 Liquid Level Measurement (cont'd)

Therefore, the negative (or decrease) error of - 28.02 in WC differential pressure represents a level error of +22.9% span. In other words, an indicator would read 123% even though the actual level is only 100%.

The error within the loop measurement at the specific level of concern and conditions would be:

ADP HR(SGR4 - SGR3 - SGV2 + SGV1) - HL(SGL2 -

SGL1 - SGV2 + SGV1)

HL = 40% = 67.6 in HR = 169 in SGR3 = Specific gravity of ref. leg water at 120OF SGR4 = Specific gravity of ref. leg water at 250°F SGL1 = Specific gravity of process water at 5320 F SGL2 = Specific gravity of process water at 400°F SGV1 = Specific gravity of steam at 5320F SGV2 = Specific gravity of steam at 400°F ADP (169 in)(0.943549 - 0.990249 - 0.023775 +

0.032047) - (67.6 in)(0.785414 - 0.755817 -

0.023775 + 0.032047)

= (169 in)( -0.038428) - (67.6 in)(0.037869)

= -6.49 in - 2.56 in

= -9.05 in WC Error = (-9.05 in)

• 100% = +7.4% of span

(-122.32 in)

Therefore, the actual error at 40% is -9.05 in WC differential pressure or

+7.4% actual level. Thus, the level loop would indicate 47.4% while actual level would be 40%.

EGR-NGGC-0153 Rev. 12 Page 61 of 184 1

9.3.1 Liquid Level Measurement (cont'd)

Example 2 Calculate the required span for an Accumulator Level Instrument which measures liquid level in a tank pressurized with Nitrogen to compensate for the effects of the pressurized cover gas.

The differential pressure transmitter is connected with a wet variable leg and a dry reference leg.

Assume that the system is designed to measure a span of 14 physical inches in height with an offset of + 8.5 inches (0% span is 8.5 inches above the transmitter and 100% span is 22.5 inches above the transmitter). For the purposes of this calculation it is assumed that the accumulators are at 104 degrees F and 660 psig.

On one side of the transmitter we have borated water at 104 degrees F and 660 psig. On the other side of the transmitter we have nitrogen at 104 degrees F and 660 psig. Since we are comparing liquid and gas, we will use weight instead of specific gravity in our calculation. The equation for DP with a dry reference leg design is:

DP = HL * (Wbw - Wn)

DP = differential pressure HL = height of vessel liquid (above the transmitter)

Wbw = weight of pressurized borated water Wn = weight of pressurized nitrogen The differential pressure scaling calculation is as follows:

The specific gravity of the borated water is 1.0001762 at 104 degrees F and 660psig. The weight of water at reference temperature and pressure is 62.3441 lbs/cu ft therefore:

Wbw = 1.0001762 x 62.3441 = 62.3551 lbs/ cu ft The density of nitrogen at 0 degrees C and 14.7 psia is:

1.2506 grams/liter = 0.0781 lbs/cu ft The general law for gases is:

do = d (1 + ct) 760/H, solving for d we get:

d = do (1/(1 + at)) H/760 EGR-NGGC-0153 1 Rev. 12 Page 62 of 184

9.3.1 Liquid Level Measurement (cont'd)

Where:

d = density at some temperature and pressure do = density at 0 deg. C and 760 millimeters of mercury (14.7 psia) a* = 0.00367 t = temperature in degrees C.

H = pressure in millimeters of mercury Substituting into d = do (1/(1 + at)) H/760, we get:

do =0.0781 lbs/cu ft t = 104 degrees F = 40 degrees C H = 660 psig = 34,892.043 millimeters of mercury d = 0.0781 lbs/cu ft (1/(1 + 0.00367 x 40)) (34,892.043/760) d = 0.0781 (0.872) (45.9106) d = 3.1266 Ibs/cu ft Therefore the weight of nitrogen at 104 degrees F and 660 psig is:

Wn = 3.1266 lbs/cu ft Recalling that DP = HL x (Wbw - Wn), at 100% of transmitter span:

HL = 14 + 8.5 = 22.5 inches = 1.875 feet DP = 1.875 ft (62.3551 - 3.1266) lbs/cu ft DP = 111.0534 lbs/sq ft = 1.7791 feet of water

= 21.3489 inches of water At 0% of transmitter span:

HL = 8.5 inches = 0.7083 feet DP = 0.7083 ft (62.3551 - 3.1266) lbs/cu ft DP = 41.9535 lbs/sq ft = 0.6721 feet of water = 8.0651 inches of water I EGR-NGGC-0153 Rev. 12 Page 63 of 184

9.3.1 Liquid Level Measurement (cont'd)

Therefore, the transmitter span, rounded to one decimal place is:

8.1 to 21.3 inches of water or 13.2 inches of water This method compensates the input pressures for the weight of the pressurized nitrogen on the low side of the transmitter.

4. Vessel Growth Large pressure vessels exposed to large temperature changes experience significant thermal expansion called vessel growth. This growth can be as much as 2 inches in BWR reactor pressure vessels and PWR pressurizers.

The amount of growth at any point along the vessel depends on the thermal expansion coefficient of the material the vessel is made of, the distance from a reference point (either the bottom of the vessel or the variable leg tap) to the point in question, and the temperature change. There are two types of vessel growth errors of concern: Errors when the condensate pot (top of reference leg) is stationary; and Errors when the condensate pot moves with the vessel upper tap (reference leg tap).

Stationary Condensate Pot When the reference leg condensate pot is stationary, vessel growth effectively moves the variable leg tap upwards resulting in a smaller distance between the variable leg tap and the condensate pot than that which existed under cold conditions. A bias in water level measurement of up to +2 inches (actual water level is lower than the sensed water level) can result, thereby reducing low level setpoint margins. To compensate for this effect, the scaling calculation for the level instrument calibrated range needs to account for the thermal expansion of that portion of the vessel between the variable leg tap and the bottom of the vessel. In other words, determine how much the lower tap will move due to thermal expansion of the vessel material between the variable leg tap and the bottom of the vessel and then compensate the transmitter calibrated range accordingly, (compensated range less than uncompensated).

EGR-NGGC-0153 Rev. 12 Page 64 of 184

9.3.1 Liquid Level Measurement (cont'd)

Moveable Condensate Pot When the reference leg condensate pot is designed to move along with the upper tap on the vessel (reference leg tap), vessel growth that causes the variable leg tap to move upwards is offset by a corresponding upward movement of the condensate pot. However, the condensate pot upward movement is greater than that of the variable leg tap because the condensate pot elevation is effected by the thermal growth of the vessel material between the upper tap and the variable leg tap in addition to the thermal growth of the material between the variable leg tap and the bottom of the vessel. A negative bias in water level measurement of some amount (actual water level is higher than the sensed water level) can result, thereby reducing high level setpoint margins. To compensate for this effect, the scaling calculation for the level instrument calibrated range needs to account for the thermal expansion of that portion of the vessel between the variable leg tap and the reference leg tap. In other words, determine how much the reference leg tap will move due to thermal expansion of the vessel material between the reference leg tap and the variable leg tap and then compensate the transmitter calibrated range accordingly, (compensated range greater than uncompensated). For some applications these errors are significant and should be compensated for in the scaling calculation. In other applications, it may not be necessary to consider this growth in the scaling if sufficient margin exists for it to be accounted for in the uncertainty analysis or, if the distance between the taps is small the effects may be negligible.

BWR specifics In September 1988, General Electric issued Service Information Letter (SIL) 470, titled reactor Water Level Mismatches. Supplement 1 to this SIL was issued April 20, 1989, that provided additional detailed information. This Section covers the design considerations for Vessel Growth in BWRs that was addressed in this SIL 470 and its supplements.

EXAMPLE: BNP Units 1 and 2, an expansion coefficient is obtained from Reference 2.25, when going from 70'F to vessel operating temperature. For consistency, a nominal value of 545°F will be selected as the operating temperature, which produces an expansion coefficient of 0.0413 in/ft or 0.00344 in/in.

I EGR-NGGC-0153 Rev. 12 1 Page 65 of 184

9.3.2 Pressure Measurement The point at which the measurement for a process variable is made must be considered when establishing a setpoint. The point of measurement for a process variable can require an actual setpoint value to be increased or decreased to satisfy the specific setpoint function. Many times, a specific process variable cannot be measured precisely at the point of concern within the process. This is a particular problem for pressure measurements. When a setpoint limit exists for this situation, the pressure effects of process flow and hydrostatic head must be evaluated.

Fluids flowing through a piping system experience a drop in pressure due to fluid friction. Many factors affect the actual pressure loss including length of piping, number of bends, diameter of piping, fluid viscosity, fluid velocity, etc. This pressure drop is generally referred to as "line loss".

The line loss at a specific point in a piping system configuration can be determined by analysis of the specific piping system, and the application of standard industry formulae. Line loss effects for a specific application should be calculated. Obtain assistance, as necessary, from other design disciplines.

Hydrostatic pressure effects can exist when the measurement point for an installation is at an elevation different than that of the point of concern. This elevation difference induces a hydrostatic head difference proportional to the height and the specific gravity of the process fluid.

The true measurement point elevation is the elevation of the loop sensing device, and not the elevation of the connection to the process. However, many times this elevation difference is accounted for in the calibration process. Hydrostatic pressure effects, therefore, can be the result of process piping elevation differences or instrument sensing line elevation differences (from process connection to sensing device), or both.

Therefore, HP = EL

• SG (Eq. 22)

Where, HP = Hydrostatic head pressure EL = Elevation difference SG = Specific gravity of fluid IEGR-NGGC-0153 R ev. 12 Page 66 of 184

9.3.2 Pressure Measurement (cont'd)

Consider the following example:

EXAMPLE Referring to Figure 9-9, a low pressure trip is to be initiated on the pump when the pump suction pressure (Point B) falls below 50 psig. The instrument used to monitor suction pressure senses the pressure at a point 35 feet upstream and 15 feet below the actual suction. The instrument itself is 5 feet above the sensing line connection on the pipe.

Process fluid = Water Process temperature = 150'F (Saturated Conditions)

The line loss effect between point A and point B could be calculated from the actual piping and fluid conditions. In this example we will assume a line loss effect of 4.0 psi.

With elevation (EL) for the example being equal to the 10 foot difference between the measurement point elevation and point B, the hydrostatic pressure effect (HP),

or head effect, is:

HP = EL

• SG

= (10 ft)(0.98183)

= (9.82 ft)(0.433 psi/ft)

= 4.25 psi The setpoint for the pressure loop at point A must be corrected for both effects:

Actual setpoint = Desired setpoint at B + Line loss effect +

Hydrostatic pressure effect

= (50 + 4.0 + 4.25) psi

= 58.25 psi This would be the required setpoint at point A to ensure that the pump tripped when actual suction pressure, at point B, was 50 psi. An additional increase of the setpoint may also be included to account for other uncertainty effects in the actual instrument loop.

I EGR-NGGC-0153 Rev. 12 Page 67 of 184

9.3.2 Pressure Measurement (cont'd)

POINT B PS)

Lat t* ,,FLO W INM ZO ft.

POINT A NOTES:

f". *PUMp IUiP, muM oCur if pWesuria la$WI below 50 psig tat point B) 121- PT is 0resstjeO transmiter

ý31 - PS is pressure switch 4bistaIle)

FIGURE 9-9 LINE PRESSURE LOSS HEAD EFFECT EXAMPLE In the example presented above, the line loss must be added to the 50 psi limit in order to obtain a conservative setpoint. For example, if the line loss and head effect were neglected, using a value of 50 psi at point A would not be conservative since the pump trip would occur when pressure at point B was 46 psi, i.e below the 50 psi limit. The head effect also has to be added, as shown above, to effectively take credit for making the desired setpoint less restrictive, since the head pressure above the point of measurement reduces the available pump suction pressure.

NOTE: The head effect/line loss errors are known fixed error terms. The error must be added, or subtracted, from the desired setpoint depending on the particular circumstances. This is discussed in more detail in Section 9.8.

I EGR-NGGC-0153 I Rev. 12 1 Page 68 of 184

9.3.2 Pressure Measurement (cont'd)

As noted above, hydrostatic pressure (head) effects may be accounted for in the calibration process, or in the determination of the overall loop uncertainty. It is important to specify for each application, where such effects are incorporated, either via the calibration process or the loop uncertainty. Otherwise, the effects may not be addressed, or may be addressed twice.

9.3.3 Flow Measurement The most common form of flow measurement is the head type flowmeter. These flowmeters operate on the principle that placing a restriction in a flowing fluid causes a pressure drop in the fluid across the restriction. By measuring the pressure drop across the restriction with a differential pressure device, flow can be derived. Flow orifices, nozzles, and venturies are all forms of head type flowmeters.

The accurate measurement of flow is affected by a number of design factors.

These factors include the assumed sizing and calibration attributes of the flow meter and piping loop, adherence to installation requirements, and potential process influence. Each of these factors must be reviewed and accounted for in the analysis of a flow loop.

1. Basic Flow Accuracy Influences In the initial selection and sizing of a flow meter, design assumptions are made as to the pressure, temperature, flow range and chemical composition of the fluid to be metered. These design assumptions become the bases of a meter's sizing, and the differential pressure profile versus flow characteristics for the meter.

The basic formula for determining the volumetric flow from a head type flowmeter is:

Q = (K)(C)(Y)(Fa)(d) 2 (hiD)° 5 (Eq.23)

Where, Q = Flow rate K = Correction constant for a specific installation C = Coefficient of discharge ratio Y = Expansion factor Fa = Thermal expansion factor d = Flow meter orifice diameter h = Differential pressure produced across the meter D = Density of the flowing fluid IEGR-NGGC-0153 1 Rev. 12 1 Page 69 of 184 1

9.3.3 Flow Measurement (cont'd)

The correction constant (K) is generally a true constant for a particular flow meter. This factor includes the effects of Beta ratio (orifice size vs. pipe size) and unit conversion values which are fixed values for an installation.

The coefficient of discharge ratio (C) is a correction factor for the pressure sensing taps on a meter. The coefficient of discharge is a function of the Reynolds number calculated for an installation and the specific pressure tap arrangement employed. For most flows at the NGG plants, the Reynolds number is between 10,000 and 1,000,000 and the ratio is a fixed value. It would only require analysis consideration if major changes in the assumed flow conditions take place (e.g., a ten-fold increase or decrease in base flow rate).

The expansion factor (Y) accounts for changes in a meter's performance when metering compressible fluids such as air, steam, and nitrogen. The value is a fixed constant of one (1.0) for non-compressible fluids. In its liquid state, water is considered to be a non-compressible fluid.

The thermal expansion factor (Fa), or area expansion factor, as it is sometimes referred to, is a correction factor which accounts for the thermal expansion of a flow meter orifice due to a change in temperature. The thermal expansion factor is generally a very small value, varying from 1.000 to 1.0187 over a 900°F temperature change. Temperature variations of 200°F have less than a 0.5% effect on the actual flow measurement. In some applications, it may be considered negligible.

The flow meter orifice size (d) is the diameter of the actual orifice within a flow meter. It is generally considered a constant except for the effects of thermal expansion as discussed above. In some applications though, wear within the orifice may occur, causing the orifice size to change. Meters in severe service conditions should be evaluated for potential wear or erosion, and suitable allowances made.

The differential pressure (h) is the difference in static pressure between the fluid upstream and downstream of the meter. This difference is a function of the square of the flow; therefore, the square root of the signal must be taken to obtain actual flow. A differential pressure device measures this parameter in a flow loop installation.

IEGR-NGGC-0153 1 Rev. 12 Page 70 of 184

9.3.3 Flow Measurement (cont'd)

The density (D) of the flowing fluid directly affects the differential pressure produced by a meter. As discussed in Section 9.3.1.1, density may vary due to changes in temperature or chemical composition. The primary cause of a variation in density is the change in temperature of the fluid. However, an evaluation should be made for any possible density changes due to all potential sources.

An important fact to remember when utilizing head flow elements such as an orifice is, that because the flow rate is proportional to the square root of the differential pressure, the rangeability of the device is rather limited. The effective operating range is about 25-100% full flow. This is a limit imposed by the differential pressure meter, not the accuracy of the orifice discharge coefficients. For example, consider the case where 10% of rated maximum flow produced 1% of rated differential pressure. If the differential pressure transmitter accuracy was +/- 0.5% of full scale differential pressure, the transmitter itself could introduce an error of +/- 25% nominal at the 10% rated flow value.

The measurement of flow with head type flow meters is a well documented, but complicated subject. The specific factors discussed above are the factors which affect a meter's accuracy once it is sized for a particular application. This methodology document will limit its discussion to those factors which affect the accuracy of a meter after installation.

Specific values for the uncertainty of the head flow device should be obtained from the vendor, design specifications, etc. Where no specific values can be located, a typical value for the basic uncertainty of such a device is +/- 1% of differential pressure. Any other process or installation effects, such as those discussed below, would be in addition to the basic accuracy of the device.

2. Density Variation Effects Variations in the density of a process fluid to be metered can be the biggest source of potential process measurement error in a flow loop. The density variation is normally caused by variations in the process fluid's temperature.

A simplified version of the flow formula will be used to determine the effects of density variation on flow measurement accuracy:

Q = k (h/D)° 5 (Eq.24)

Where, k = Combined value of all other factors and constants I EGR-NGGC-0153 Rev. 12 Page 71 of 184

9.3.3 Flow Measurement (cont'd)

Ifthe volumetric flowrate, Q, is held constant, it is seen that a decrease in density (D), due to an increase in temperature, will cause a decrease in differential pressure, (h), thus resulting in an error in the transmitter reading.

This error occurs because the differential pressure transmitter was calibrated for a particular differential pressure corresponding to that flowrate at a lower temperature. The lower "h" value causes the transmitter to indicate a lower flowrate.

Assuming Q remains constant between a base density condition, D1, for which the instrument is calibrated, and an actual process condition, D2, an equality can be written between the base flowrate, Q1, and actual process flowrate, Q2, as shown below:

Q2 = Q1 (Eq.25)

Substituting Equation 24 into Equation 25 yields k(h2/D2)° 5 = k(hl/D1)° 5 (Eq.26) or, h2/D2 = hl/D1 h2/hl = D2/D1 A fluid's density and temperature have an inverse relationship. That is, the density of a fluid decreases as temperature increases and vice versa. As can be seen in Equations 24 and 26, as the density decreases, the corresponding differential pressure must decrease to maintain the relationship. Since the density is the reciprocal of specific volume of fluid (SVF), the equation may be rewritten as, h2/hl = SVFI/SVF2 (Eq.27)

Therefore, as temperature increases, the differential pressure produced by a meter will decrease for the same flow rate. The opposite is true for a decrease in temperature. The differential pressure error (eh) produced by the change in density can be written as:

eh = h2 - hl (Eq.28)

IEGR-NGGC-0153 1 Rev. 12 1 Page 72 of 1841

9.3.3 Flow Measurement (cont'd)

Rewriting Equation 27 as, h2 = hl(SVF1/SVF2) and substituting this into Equation 28 yields, eh = hl(SVFI/SVF2 - 1) (Eq.29)

It can be observed in Equation 29 (which is the process error equation for density effect on volumetric flow), that the absolute error is maximized when "hl" is maximized. This occurs at the upper end of the calibrated differential pressure span for which the transmitter is calibrated. This is also the maximum calibrated flow. The error varies from negative values for temperatures above the base value (SVF2>SVF1), to zero for temperatures equal to the base value (SVF2=SVF1), and finally to positive values for temperatures below the base value (SVF2<SVF1).

Once the differential pressure error has been determined, the actual flow rate error can be determined. The actual flow rate error will vary for a given differential pressure error due to the square root relationship between "h" and "Q". The error of a flow loop is dependent on the specific flow of concern. While the maximum error of a loop can be calculated at 100% flow conditions, application of this error to lower flows may be overly conservative. The density error should be calculated for the specific flows of concern. The calculated "eh" can then be factored into the differential pressure error for the given flow condition and the true impact on flow evaluated.

Consider the following example:

Example The error in a flow loop due to density effects is to be determined for the following:

Assume an orifice plate is used to measure flow in a water system that is normally at 80 0F. The orifice is sized to produce a differential pressure of 100 inches of water for a flow rate of 5000 GPM at 80'F. Assume further that under accident conditions the temperature rises to 200°F at an actual flow of 2000 GPM.

IEGR-NGGC-0153 1 Rev. 12 Page 73 of 184

9.3.3 Flow Measurement (cont'd)

The first step is to determine the relationship between "Q" and "h". Given that, Q = k(h/D)°.5 the constant k for the flow/DP relationship at 80°F can be determined from the design parameters as follows by setting the density term, D=1.

0 5 5000 GPM = k (100 in WC/1) k = 5000/10 = 500 Thus, Q = 500(h)°.5 Now, using the established constant, and the accident flowrate of 2000 GPM, we can solve for hl, or the differential pressure that would be present for the normal 807F condition for which the orifice is sized.

Q1 = k(hl)° 5 Q1 = 500(hl)° 5 2000 = 500(h 1)°5 or, hl = (2000)2/(500)2 = 16 inches of water Using the thermodynamic steam tables and assuming saturation conditions, SVF1 (at 800F) = 0.016072 ft3/Ibm SVF2 (at 200°F) = 0.016637 ft3 /Ibm Substituting these into the error formulae equation 29:

eh = hl(SVF1/SVF2-1) eh = 16 (0.016072/0.016637-1)

= -0.54 in WC IEGR-NGGC-0153 1 Rev. 12 Page 74 of 184

9.3.3 Flow Measurement (cont'd)

Therefore, the rise in temperature reduces the actual differential pressure (h2) created by the orifice to, eh = h2 - hl h2 = eh + hl

- (-0.54 in) + (16 in)

= 15.46 in WC This yields an indicated flow of, Q = 500 (15.46)0.5 = 1966 GPM The error induced by the density change is the difference between the indicated flow at the higher temperature condition (Q2) and the indicated flow at the normal temperature condition (Q1),

Q2- Q1 = 1966 GPM - 2000 GPM =- 34 GPM This represents an error, expressed in percent of reading, of,

-34 GPM

• 100% = -1.7% of reading 2000 GPM or, as expressed in percent of span,

-34 GPM

• 100% = -0.68% of span 5000 GPM The density variation effect from a base, or calibration, condition to an actual condition of interest is a known predictable effect. As such, the effect is treated as a bias type error.

3. Effects of Piping Configuration The actual installation of a head type flow device can affect the measurement accuracy of a flow loop. Bends, fittings, and valves in piping systems cause turbulence in the flowing fluid. This turbulence can cause errors to be induced into the differential pressure measurement.

IEGR-NGGC-0153 Rev. 12 Page 75 of 184

9.3.3 Flow Measurement (cont'd)

ASME has published results of extensive testing of piping systems and guidance for various types of installations. The ASME recommendations provide the minimum acceptable upstream and downstream lengths of straight pipe needed for a specific flow meter installation to keep the effects of this turbulence from significantly decreasing a flow meter's accuracy. The piping arrangement showing locations of valves, bends, fittings, piping planes, etc. must be reviewed to verify that an installation meets the minimum requirements. Typically locations can be obtained from piping isometric drawings.

As established by Reference 2.17, if the minimum pipe lengths are met, the resultant flow measurement error due to piping configuration will be less than

+/-0.5% of reading. If the minimum criteria cannot be met, an additional tolerance of +/-0.5% of reading must be applied to the flow measurement error allowance.

The effects of the piping configuration on accuracy is considered to be a bias error term, since their sign is calculable.

Typically, the minimum pipe lengths for orifices are as follows:

a. On the downstream side of the device, five pipediameters of straight run pipe is sufficient.

b. On the upstream side of the device, ten pipe diameters of straight run pipe is sufficient if the disturbance is due to flanges, collars, wide open gate valves, reducers, or bends, elbows, or tees in the same plane. Fifty pipe diameters is sufficient if the disturbance is due to piping angle turns in two planes. Seventy-five pipe diameters is sufficient if the disturbance is due to pressure regulators, valves, or similar apparatus.

To determine the minimum pipe lengths for venturis, flow nozzles, etc., consult either vendor specific recommendations, reference books, or ASME guidelines. The Mechanical Engineering Group should also be contacted, as necessary.

IEGR-NGGC-0153 1 Rev. 12 1 Page 76 of 184 1

9.3.3 Flow Measurement (cont'd)

4. Thermal Expansion Factor Effect The basic flow equation discussed in Section 9.3.3.1 includes a correction factor for expansion of the flow meter orifice or primary element due to temperature change. The correction factor is known as the Area Factor, or Thermal Expansion Factor (Fa). The factor, Fa, is dependent on the material composition of the primary element. This factor provides for changes in the flow meter orifice size due to the thermal expansion or contraction of the primary element material.

While the thermal expansion of the flow element generally has little effect on the flow measurement, the effects of large temperature gradients must be evaluated.

The values of Fa for various materials is shown in Reference 2.17, Figure 11-1-3. For a 300 Series stainless steel flow meter, a 200°F temperature change results in less than a 0.5% change in Fa. Therefore, for most applications, the effects of Fa variation need not be considered for temperature variations less than 2000 F. For greater temperature variations, the effects of Fa should be evaluated. Errors induced by Fa are considered to be bias errors since their direction can be determined.

Generally, the orifice plate and the pipe are made of similar materials. Thus, the thermal expansion factor for the pipe will be very similar to that of the orifice plate, and no changes in the d/D, or Beta ratio, will occur. Significant errors may occur if this material conformity does not exist.

The following example is provided to illustrate how errors associated with Fa variation can be established.

Example Determine the percentage error in reading, caused by the Fa factor alone, for the following:

Initial flow rate 1000 GPM Process calibration temperature 100°F Process accident temperature 300OF Orifice plate material 316 SS IEGR-NGGC-0153 I Rev. 12 1 Page 77 of 184

9.3.3 Flow Measurement (cont'd)

From Reference 2.17, Figure 11-1-3, Fa initial = 1.0005 Fa accident = 1.0042 If all other parameters remain constant, the basic flow formula can be written as, Q = (Fa)(Constant)

Solving for a constant for the conditions defined above, Constant = Q1/Fa

= 1000/1.0005

= 999.5 Assuming no other effects on flow are present, the change in flow due to the change in Fa is, Q2 = (1.0042)(999.5) 1,003.7 GPM or an increase of 3.7 GPM. This corresponds to an error of,

% Error = 3.7 GPM

• 100% = 0.37% of reading 1000 GPM 9.3.4 Temperature Measurement When measuring temperature, we assume that the temperature at the sensor is the same temperature as the gas, liquid, or solid whose temperature we want to know.

In most situations, we do not think about whether that assumption is true. But for some applications it is necessary to ensure that the sensed temperature is really the process temperature. Heat flows from a hot region to a cooler one by conduction, convection, and radiation. An accurate temperature measurement ensures that the amount of heat flowing between the point being measured and the point of concern is not sufficient to cause a significant temperature difference.

I EGR-NGGC-0153 Rev. 12 Page 78 of 184

9.3.4 Temperature Measurement (cont'd)

Where the differences in temperature within a medium are significant, it is referred to as temperature stratification and can affect the accuracy of the temperature measurement.

Consider the measurement of temperature, via a thermocouple, of a stirred liquid in a tank. For practical purposes, we can consider the entire volume of liquid to be at the same temperature. If we insert a thermocouple assembly with a half-inch diameter stainless steel protecting tube into the tank, heat flows along the protecting tube towards the colder thermocouple head. If the tube is immersed only one-half inch, we can sense that the thermocouple junction is probably colder than the liquid because of the temperature stratifying along the protecting tube.

As the depth of immersion is increased, the hot junction temperature more nearly equals the liquid temperature. This is because more of the protecting tube is at the same temperature as the liquid and there is little or no heat flowing in the region of the hot junction. If no heat flows, there is no temperature difference. For this reason, it is generally considered that the depth of immersion of a well or protecting tube in a tank should be at least 10 times its diameter.

The above example shows temperature stratification due to the actual measurement. In other applications, the stratification is a result of the process being monitored. A typical pressurizer for example, may employ two different temperature detectors - one for the pressurizer liquid and one for the pressurizer steam. Both are needed to provide a representative measurement of the actual temperatures within the pressurizer.

Other examples of where temperature may be stratified are: rooms or large areas of a building, large diameter piping, tanks, piping or vessels that are heat traced or only partially insulated.

Regardless of the reason for the stratification, the potential for it to exist must be recognized and addressed in order to ensure an accurate temperature measurement. Corrections are treated as a bias, similar to head effects, to account for any temperature difference between the point of measurement and the point of concern.

I EGR-NGGC-0153 Rev. 12 1 Page 79 of 184 1

9.4 Instrument Uncertainties All instruments have limits on their ability to accurately perform their function. These limits of accuracy, generally expressed as inaccuracies or errors, vary, based on the specific design capabilities of the instrument, and the service within which it is used. By evaluating the various effects on instrument accuracy, a total uncertainty limit can be established for the instrument.

Each instrument has a basic accuracy established by its manufacturer. In addition, various types of instruments have different parameters which affect their basic accuracy. While one type of instrument may be greatly affected by a change in humidity, another may show no effect. The instrument's basic accuracy, and all of the applicable parameters which can affect its accuracy, must be taken into account in performing loop uncertainty analyses.

The information described below must typically be obtained from the vendor, either through product data sheets, test reports, technical manuals, etc. In order to maintain consistency between calculations that utilize the same types of devices, it is recommended that the vendor data be obtained from the same common sources.

Ideally, the information should come from the plant's vendor technical manuals since these are controlled. However, some information may not be within these reports and other sources may need to be utilized. Whenever possible, the vendor technical manuals should be updated to include any information obtained from supplemental sources. Whenever the vendor is contacted, the information obtained via letter, telecon, telecopy, etc. should be documented and maintained in a manner that will allow subsequent calculations to utilize the same information.

The major parameters which govern an instrument's accuracy are discussed below.

Additional parameters may be identified, by a manufacturer, as having an influence on the specific instrumentation. These parameters, and their effects, would be handled in the same manner as those described below.

Each of the major parameters which affect an instrument's accuracy has been assigned an abbreviation to aid in the identification of error terms within a specific error analysis. The abbreviations are indicated in the individual sections discussing the error, and a complete listing can be found in Section 3.70.

I EGR-NGGC-0153 Rev. 12 Page 80 of 184 1

9.4.1 Reference Accuracy (RA)

The Reference Accuracy (RA) of a device is the base performance accuracy of a device, typically established by the manufacturer. The RA should include the effects of hysteresis, repeatability and linearity for an instrument. Where these effects are not included, the individual effects of the omitted components should be included separately, or resolved with the vendor to be not applicable. For example, one instrument's manufacturer may provide separate values for accuracy and repeatability. Ifthe accuracy value does not include the repeatability value, they must be combined to determine the overall reference accuracy. The vendor may provide guidance on how they should be combined, either algebraically or SRSS. If no guidance is given, they should be combined via SRSS. Figure 3-2 provides a graphic representation of RA.

For some devices such as bistables, no reference accuracy is provided by the vendor. Instead, the vendor may only provide a value for repeatability. If the vendor states that this is the only applicable term for the device, then it can be used as the reference accuracy.

Reference accuracy is considered to be a random error component unless specifically indicated otherwise by a manufacturer, and is normally stated in terms of percent of span for the instrument.

The RA is the accuracy that an instrument can meet, and it defines the limits of acceptable performance in normal operation. The RA typically can only be met over a small band of operating conditions specified by the manufacturer.

The RA value is generally established by a manufacturer based on equipment testing. The results of the testing allow a manufacturer to statistically define the performance of an instrument, and develop an RA value with a high degree of confidence. While some disagreement exists on the degree of statistical confidence a manufacturer's RA value should have, for the purposes of this document a 95% confidence factor (or 2 a) will be assumed. Thus, a vendor should be contacted to determine whether his published reference accuracy values represent 1, 2, 3, or some other ( value. If such information cannot be provided by the vendor, the values will be assumed to be 2a. This is based on common industry practice. Refer to Section 9.2.5 for additional discussions on statistics.

IEGR-NGGC-0153 1 Rev. 12 Page 81 of 184

9.4.1 Reference Accuracy (RA) (cont'd)

Reference accuracies should be established based on vendor information applicable to the specific equipment. In some cases, the vintage of the equipment at the plants may preclude the identification of equipment specific reference accuracies. Where no specific information can be obtained, the value for the calibration tolerance may be used as the reference accuracy. Another option may be to use the following values as reasonable representations of reference accuracy.

However, the calibration tolerance or the default values should be used for the reference accuracy only after a valid effort has been made to obtain specific vendor values.

Equipment ReDresentative Ref. Accuracies Thermocouples +/-1.0% of span RTDs +/-0.5% of span Pressure transmitters (incl. d/p) +/-1.0% of span Recorders +/-2.0% of span Indicators (Analog - PWRs) +/-2.0% of span (Analog - BWRs) +/-3.0% of span (Digital) +/-0.5% of span Values are based on References 2.21, 2.22, and common industry values.

9.4.2 Drift (DR)

Drift (DR) is a natural phenomenon exhibited by instrumentation, and is caused by the changing properties of instrument components due to aging or other naturally occurring phenomena. The individual elements of an instrument all have characteristics which may vary with time. The culmination of these changes imparts a specific drift characteristic to an instrument. Drift is a measure of an instrument's stability over time, and is often referred to as stability by a vendor.

For most instruments, drift is typically considered proportional to a given period of time. As more time is allowed, the potential error due to drift increases. Some instrument manufacturers though, are able to put a bounding value on drift. This bounding allows increased time periods without incurring additional inaccuracies beyond a maximum drift value.

IEGR-NGGC-0153 1 Rev. 12 Page 82 of 184

9.4.2 Drift (DR) (cont'd)

In a nuclear power facility, drift for a loop is generally broken into two parts, sensor drift, and signal processing drift. The two are separated to allow periodic verification of loop calibration parameters. Many times, a loop's sensor is inaccessible for calibration/verification during operation while the remaining components are accessible. By maintaining separate drift components, additional flexibility is provided for maintaining accurate instrumentation systems.

Drift is usually specified in terms of a limiting value per unit of time, and is considered a random error component unless otherwise indicated by a manufacturer. The actual drift value for a loop must be determined using the anticipated time interval between calibrations for a loop. The nominal calibration frequency of instruments is identified in [BNP, HNP, RNP - the PassPort PM Requirement Panel]. With regard to surveillances, the Technical Specifications allow a grace period of the nominal frequency, by an amount of 25% of the specified interval. For example, if a surveillance's frequency is specified as each refueling (i.e. 18 months), the actual frequency could be up to 18 +/- 25% months, or 22.5 months. Therefore, the interval taken as the calibration interval must be the maximum interval allowed by a plant's program, and not just the nominal interval.

In many cases, the drift value specified by a manufacturer may be less than the actual calibration interval. If possible, the manufacturer should be contacted to determine if more recent drift data is available, or if he can provide guidance on how it should be applied to longer intervals than what is published. Otherwise, the drift value should be extrapolated out to encompass the calibration interval.

Consider the following example:

Example A manufacturer specifies a drift value of +/-0.25% span for 6 months for his device.

The range of the device is 0-500 psig and is calibrated from 0-440 psig. The nominal surveillance interval is 18 months.

The simplest and most conservative approach is to assume that the drift is linear with respect to time. This would provide a drift value of, 18 months +/- 25% = 22.5 months (22.5 months) * (500 psia)

• 0.25% = +1.07% cal. span (6 months) (440 psig)

[EGR-NGGC-0153 Rev. 12 Page 83 of 184

9.4.2 Drift (DR) (cont'd)

Note that the manufacturer specified a drift value of +/-0.25% span. Frequently, vendors specify a value in terms of span which correlates to range, not calibrated span. That was the case here. Thus the range of the instrument, 500 psig, is divided by the calibrated span the instrument is used for this application, 440 psig.

This factor is frequently referred to as the Turndown Factor (TDF) or turndown ratio.

Anytime a value is being converted from units of range of an instrument to its span, the turndown factor must be applied.

As stated above, treating the drift linearly is a rather simple and conservative approach. A more realistic assumption is that the drift is random and independent with respect to each time interval. Based on this assumption, the drift may be calculated using the SRSS method. Using the SRSS method, the drift would be calculated as follows, 18 months +/- 25% = 22.5 months or, - 4 separate 6 month intervals DR = [ (0.25)2 + (0.25)2 + (0.25)2 + (0.25)2 ]o.5 * (500)

(440)

DR = (4)0.5 * (0.25) * (500)

(440)

DR = +/- 0.57% cal. span Although either method may be used, the SRSS method is the preferred method for the NGG plants.

The drift value for a device should primarily be obtained from vendor information.

However, there may be some instances where either vendor data does not exist, or the vendor data is rather conservative and it is desirable to try to use another method. A drift value for a particular device can be inferred from an analysis of the device's calibration history. The overall methodology for calculating drift in this manner is described in both Section 6.2.7 and Appendix E of Reference 2.3.

Reference 2.29 contains detailed guidelines for analysis of instrument drift based on calibration history. [BNP - References 2.33 and 2.34 may be used to analyze historical as-found/as-left data for the purpose of determining instrument drift, either for the existing calibration interval or for interval extension.]

There are several important points which must be understood however, prior to determining drift from as-left/as-found data. First, it should be recognized that the use of as-left/as-found data may actually provide a higher drift value than provided by the manufacturer. Another potential issue is that the analysis may identify that the actual drift for a device is not random, and normally distributed. Thus, instead of being able to SRSS the drift value, it may have to be treated as a bias.

I EGR-NGGC-0153 Rev. 12 1 Page 84 of 184

9.4.2 Drift (DR) (cont'd)

Another factor to consider when assessing whether to determine device specific drift values from as-left/as-found data, is that such an analysis may be rather time consuming. To establish a proper population size often requires collecting numerous surveillance/calibration test results. Each application must also be evaluated for any factors which may cause its data to be different from other applications. As noted in References 2.3 and 2.29, the as-left/as-found data typically includes uncertainties other than drift, such as temperature effects, humidity, power supply variations, complete M&TE etc. Thus, if possible, such effects should be separated from the as-left/as-found data to provide a value that is more representative of just the drift uncertainty.

When drift values cannot be obtained from a vendor, and analysis of as-left/as-found data is not feasible, default values for drift can be used. However, these should only be used after a reasonable effort has been made to obtain a drift value via another method. Per Reference 2.22, typical values which may be assumed for drift are +/-11.0% full scale for 18 months nominal for a sensor and +/-11.0% full scale for 18 months for the total rack, or signal processing equipment.

If default values are used for safety-related applications, then once enough as-left/as-found data is available to calculate a drift value, such data should be used to either validate or replace the default values. If the default value bounds a calculated drift value, the default value can be retained.

9.4.3 Temperature Effect (TE)

Temperature effect (TE) is the term given to the change in an instrument's accuracy due to changes in ambient temperature. Generally, all instruments exhibit some form of TE. The temperature effect is normally stated by a manufacturer in terms of accuracy change per unit change in temperature within the normal operating limits of the device. The TE is caused by changes in temperature between the ambient temperature at time of calibration, and the ambient temperature in normal operation.

The temperature effect is normally stated as an additional percent of span error per unit of temperature. For an instrument transmitter, though, the TE may be stated in terms of the transmitter range. For example, a typical Rosemount Model 1153D transmitter has a TE of, TE = +/-(0.75% Upper Range Limit + 0.5% of span) per 100°F change I EGR-NGGC-01 53 Rev. 12 Page 85 of 184 1

9.4.3 Temperature Effect (TE) (cont'd)

In this case, the resulting error from the Upper Range Limit (URL), must be calculated and corrected to a percent of span limit before the true TE can be determined. The 1153D transmitter can have any of eight different URLs varying from 30 inches of water to 4000 psi. The proper URL value must be multiplied by 0.75% and divided by the actual span for the transmitter to convert the value to percent of span.

For example, if the URL was 1000 psi and the actual span was 800 psi, the resulting TE would be:

TE = +/- [(0.75) * (1000) + (0.5)]

(800)

TE = +/- 1.44% span per 100°F In addition to the TE for normal operating limits, many field mounted devices have an accident temperature effect. The accident temperature effect provides the limits of uncertainty for an instrument when operated outside its normal operating limits.

This is discussed further in Section 9.4.7.

The temperature effect is considered a random error term unless otherwise specified by a manufacturer. The TE should be calculated from the maximum range of temperatures for a given location, unless otherwise justified.

The normal temperature bands for plant areas at each of the NGG plants is presented in the following documents:

[BNP - Drawing D-3056]

[HNP - FSAR Table 9.4.0-1, FSAR Section 3.11 B, and FSAR Section 6.2.2]

[RNP - Drawing HBR2-11260]

The temperature band an instrument is normally expected to be exposed to can be determined from the entire design range of temperatures in its location (which is very conservative), or determined from the difference between its assumed calibration temperature and the ranges of temperatures identified in the above EGR-NGGC-0153 1 Rev. 12 Page 86 of 184

9.4.3 Temperature Effect (TE) (cont'd) documents. For panel mounted enclosed equipment, the normal temperature band for an instrument's location should be considered and may be increased by 10°F, unless it has been determined that minimal heat rise exists, or the heat rise is included in the vendor temperature effect value i.e. (+/-% per 100°F change in ambient). This is to account for the elevated temperatures above the ambient room temperatures inside the racks/panels.

It should be noted that the temperatures identified in the above documents are intended to bound all locations within the stated area. Thus, after further evaluation, these temperatures could potentially be reduced for a specific location.

As an example of how to use the temperature bands and the assumed calibration temperature, consider the Rosemount 11 53D transmitter discussed above, located in the Brunswick Reactor Building. Per Brunswick Drawing D-3056, the normal ambient temperature inside the Reactor Building is between 40 and 104'F. An assumed calibration temperature for a sensor, is taken to be 65-90 0 F. Therefore, the expected normal temperature change for such a transmitter is, AT= 90-40 = 50'F and, AT= 104-65= 39°F The largest expected temperature difference is 50'F and is combined with the vendor specified temperature effect per 100°F determined above to provide the specific normal temperature effect for this application.

TE = +/- 1.44% cal. span * (500 F)

(100°F)

TE = +/- 0.72% cal. span Larger temperature effect errors would be expected under accident conditions when the accident temperature effects at the time of trip are analyzed.

As with the other instrument uncertainties, the TE should be obtained from vendor specific information, combined with the ambient temperature change for a given location. However, in some instances such data may not be available. If, after a reasonable effort has been made to obtain vendor specific data, no such data can be identified, default values can be utilized.

Based on the temperature bands for each of the plants, a typical default value of TE for components located within [BNP - the Reactor Building] [HNP, RNP -

Containment] would be +/- 1.00% full scale. For instruments in other plant locations, a typical default value for TE is +/- 0.50% full scale.

EGR-NGGC-0153 Rev. 12 Page 87 of 184

9.4.4 Static Pressure Effect (SPE)

Some differential pressure transmitters exhibit an error related to the static pressure (SPE) imposed by the process. The static pressure effect can cause changes in a transmitter's calibration parameters (at both full and zero span) which affect its basic accuracy. Some manufacturers quote the SPE in terms of basic accuracy changes, while others indicate changes in both a transmitter's zero, and full span calibration parameters. Care must be taken in determining the actual SPE for a transmitter, as it often requires the review of both the manufacturers specifications, and the plant calibration procedures.

The static pressure effect is only applicable to differential pressure transmitters in high static pressure service. For process static pressures less than 200 psi, the SPE is generally not considered, since the resultant error is negligible. If, for a particular manufacturer, the SPE can be determined to be greater than 0.05% of span at less than 200 psi, the effect should be included. There are three terms that are applicable when considering SPE effects. They are:

1) Zero Correction (If not corrected during calibration)

2) Span Correction/Process Effect (If not corrected during calibration)

3) Span Correction/Uncertainty

1. Zero Correction The zero effect occurs at rated pressure with zero input differential to a transmitter. In this case the effects of the static pressure on both the high and low sides tend to cancel each other, but, the slight remaining shift in output is called static pressure effect on zero or zero effect. This effect is a bias error. While the maximum magnitude of the zero effect is predictable its direction is not. There are two ways to account for this zero effect in pressure loop calibrations.

a. Calibrate The Shift Out. The static pressure zero effect can be trimmed out after installation with the unit at operating pressure.

Equalize pressure to both process connections, and turn the zero adjustment until the ideal output at zero differential input is observed.

Another method is to determine the zero effect for a specific instrument via bench testing and then incorporating that value in the scaling calculation or calibration procedure. The uncertainty calculation may still need to include an additional allowance for variations in system operating pressures different from the assumed reference pressure.

I EGR-NGGC-0153 Rev. 12 Page 88 of 184 1

9.4.4 Static Pressure Effect (SPE) (cont'd)

b. Account For Shift In Uncertainty Calculations. If the zero effect is neither trimmed out at operating pressure nor specifically bench-measured for a unique transmitter, the manufacturers specified uncertainty effects have to be included in the transmitter uncertainty calculation. As an example, the Rosemount 1153 Series, specifies two effects, +/-0.2% URL per 1000 psi or +/-0.5% URL per 1000 psi, depending on the range code.

2. Span Correction (Process Effects)

To understand the differential pressure effects for a particular transmitter, one must review that manufacturers data sheets. But, in general when differential pressure is applied to a transmitter the movement is toward zero differential pressure or center position. With this in mind one can see the effect is to decrease output as static pressure is increased. In other words as static pressure increases, a slightly higher differential pressure is required to move the sensing element a given amount. This shift is called static pressure effect on span or span effect, which is systematic or predictable, repeatable, a bias and linear. Because the effect is systematic it can be calibrated out for any given static pressure and span. As an example, the Rosemount 1153 Series this effect is +0.75% of input/1000 psi. This shift can be used in the scaling calculation to adjust the span for the difference between calibration and operating pressures. If this is not calibrated out, this term has to be included in the uncertainty calculation. The uncertainty calculation may still need to include an allowance for variations in system operating pressures different from the assumed reference pressure.

3. Span Correction (Uncertainty Effect)

The last term to be considered for differential pressure effects is the overall uncertainty value. This number is available from the manufacturer. As an example, the Rosemount 1153 Series is +/-0.5% reading/1000 psi. This term is in the same category as the transmitters reference accuracy, drift, temp.

effects, etc., cannot be calibrated out and has to be included in the uncertainty calculation when appropriate.

When performing an uncertainty calculation for a device and differential pressure is applicable, each of the above three terms have to be considered.

The first two have to be included in the uncertainty calculation if not calibrated out. The third item has to be included in the uncertainty calculation. When any more than one term is used in a calculation, the terms must be treated as dependent terms and added algebraically before being combined with the other uncertainty terms.

I EGR-NGGC-0153 Rev. 12 Page 89 of 184 1

9.4.5 Overpressure Effect (OP)

The overpressure effect accounts for errors in a transmitter's performance after exposure to process pressures in excess of its normal design range. In general, the overpressure effect is not required to be included in loop error analysis. Most loops are designed to operate within their worst case process conditions, which include the worst case process pressure.

Overpressure can affect all types of transmitters. If the process pressure exceeds the URL of the transmitter during Normal or Accident operation of the plant, then the Overpressure Effect needs to be accounted for in the Analysis/Calculation.

Overpressure effects for differential pressure transmitters are not considered to occur from valving the transmitter into service. Plant procedures control the proper method of valving transmitters into service.

9.4.6 Power Supply Effect (PSE)

All electronic instrument loops are powered by low voltage power supplies designed to maintain the loop voltage and current for the loop devices. Power supplies vary from loop to loop with some supplied from unregulated sources while others have precision regulated supplies. Variations in the loop voltage can cause variations in an instrument's accuracy. This variation is called the power supply effect (PSE).

The instrument loops which contain transmitters are generally 4-20 mA current loops, which require a driving potential of 12 to 45 VDC. Selection of the power supply for a specific loop is based on the configuration of the loop, and the required voltages of the individual devices in the loop. Once set, the voltage is generally not changed unless loop performance is unsatisfactory.

The PSE is determined based on the variation in the power supply voltage.

Consider the following example, A Rosemount 11 53D transmitter has a PSE value of less than 0.005% of output span per volt of change. For an unregulated power supply with a voltage variation of +/- 4 VDC, the PSE becomes, PSE = +/- (0.005%) * (4)

PSE = +/- 0.02% output span For instruments with regulated power supplies, the PSE may be negligible because the regulation keeps the voltage variations small. This, coupled with the generally minor effects of the power supply per volt, may allow the PSE to be ignored.

I EGR-NGGC-0153 Rev. 12 Page 90 of 184 1

9.4.6 Power Supply Effect (PSE) (cont'd)

Since some loops may have unregulated power supplies, the PSE cannot be totally ignored for all loops. The variations in individual loop power supplies should be determined from the following sources:

[BNP, HNP- Vendor information for the applicable loop power supply.]

[RNP Calculation RNP-E-1.005 can be used to determine the voltage variations for instrument busses. Other individual electrical calculations can be used for determining the variations of all other power supplies.]

The PSE s considered a random error due to the generally random variation in actual supply voltage. Where the PSE is found to be less than +/-0.05% of span, the effect can be ignored. Since this is typically the case, if no device specific data for the PSE can be found, it can be ignored. If however, device specific information is found, it should be compared to the +/-0.05% of span to determine whether or not it should be included in the uncertainty calculation.

9.4.7 Accident Effects Instruments which can be exposed to severe ambient conditions as a result of an accident, and which are required to remain functional during or after an accident, may have additional accident related error terms which must be considered in a loop accuracy analysis. These additional terms account for the effects of extreme temperature, radiation, pressure, and seismic/vibration conditions.

Environmentally qualified (EQ) instruments make up the largest portion of the instruments exposed to severe ambient conditions. However, additional instruments may also exist, besides just the EQ instrumentation. The effects are generally applied only to the field mounted devices, but some accident related errors may also be experienced by other instruments in the loop. For example, a loop device mounted in a controlled environment which experiences a temperature rise after an accident due to changes in HVAC performance should be included in an accident error analysis.

The accident error effects are a separate set of accuracy values generally derived from the environmental qualification testing of an instrument. Based on this testing, manufacturers establish worst case performance specifications for the instruments.

These specifications are based on generic accident temperature, pressure, and radiation profiles which envelope values at multiple nuclear facilities. As a result, the profiles are worst case conditions which should meet or exceed the specific design requirements at each of the NGG plants. Typically, Engineering will evaluate test data submitted by the vendor during the procurement process to ensure that vendor test data envelops site-specific design requirements.

IEGR-NGGC-01 53 1 Rev. 12 1 Page 91 of 184

9.4.7 Accident Effects (cont'd)

The applicability of accident error effects in a specific loop analysis is based on the loop's functional requirements. Accident error effects are time dependent, occurring from the initiation of an accident/event through long term recovery. The effects are normally not instantaneous. Many instrument loops, primarily those in the Reactor Protection System (RPS) and Engineered Safety Features Actuation System (ESFAS), meet their intended function before being significantly affected by accident environmental conditions. For such loops, the accident error effects may not have to be included in the analysis. Care must be taken, though, to ensure that all functional requirements are evaluated against potential accident conditions.

Many loops perform accident mitigation functions (not requiring accident effect consideration) initially, and then perform additional post accident functions which require accident effect considerations.

For most instrument loops, the manufacturer's accident performance specification is utilized for the accident effects. When more specific Accident Effect (AE) data is available, more realistic terms can be developed. Accident error terms can be developed based on the actual qualification test results, and plant specific accident parameters. The extrapolation of accident terms should, where possible, be based on actual test data rather than being based on manufacturer's performance specifications.

However, care must be taken when reviewing, and establishing, specific accident effects based on actual test data. In general, the accuracy of test data is limited by both the number of tests performed, and the sample size (number of instruments tested). These limitations can lead to many unexplained variations in test results, and raise questions as to the validity of the test data. The use of actual EQ test data should be limited to cases where sufficient test data exists to clearly substantiate an interpolation/extrapolation.

The format in which the accident error is supplied can vary from manufacturer to manufacturer. One manufacturer may provide an uncertainty based on the consolidation of multiple accident effects (temperature, pressure, humidity, etc.).

Another manufacturer may provide an uncertainty for each accident effect. If the accident effects are consolidated into one uncertainty value, it may be necessary to segregate the accident radiation effects from the other effects. This may be necessary if the device is in a radiation harsh environment only (i.e. it is not exposed to the other effects). It may also be necessary because the total of all accident effects results in an extremely high value, and are not all applicable to a specific application.

Following an accident inside containment, all of the accident effects except radiation will be present rather quickly. The radiation effect is typically contingent upon the total integrated dose (TID) rather than the dose rate, but on occasion can be contingent upon the dose rate. For those instances where the radiation effect is contingent on the TID, it may not become a significant factor until quite sometime following the accident. Once the radiation effect does become significant, the other EGR-NGGC-0153 Rev. 12 Page 92 of 184

9.4.7 Accident Effects (cont'd) accident effects typically have been reduced to near normal conditions. Therefore, it may only be necessary to incorporate one of these effects, either the accident radiation effect or the combination of the other accident effects.

Evaluating the "timing" of the different accident effects, as discussed above, is normally done for Limiting Safety System Settings within an instrument loop. This method is employed to prevent inclusion of unnecessarily large uncertainties into the setpoint analysis. When the allowance between a setpoint and an analytical limit is increased to accommodate unnecessarily large uncertainties, the setpoint is moved closer to the normal operating range of the sensed process variable. This makes it more likely that a process transient, process noise, or spurious signal variation will cause an unwanted actuation under normal conditions and challenge plant safety systems increasing the risk of unwanted safety system actuation under normal conditions.

The increased risk of unwanted actuation under normal conditions is larger than any reduction of risk gained by accounting for uncertainties that are not expected to exist at the time of a trip.

If a manufacturer only lists one accident uncertainty and it is not necessary to segregate the individual effects, the effect will be referred to as the accident temperature effect.

1. Accident Temperature Effects (ATE)

Frequently, the ATE is the largest contributor to an instrument's inaccuracy during an accident. While a field mounted device, such as a transmitter, may be able to perform well under design temperatures of up to 200'F, an accident temperature of near 300'F can cause severe changes in performance. Typical inaccuracies of 5% to 10% are not uncommon.

The accident temperature effect (ATE) is generally obtained from the manufacturer's performance specifications. For a Rosemount Model 1153D transmitter, for example, the accident temperature effect (given as Steam Pressure/Temperature) is:

ATE = +/-(4.5% Upper Range Limit + 3.5% span)

The specification sheet details the temperature, pressure, and duration of the test accident profile on which the performance is based. The actual worst case error can be calculated by substituting the upper range limit value for a specific transmitter, converting to percent span, then adding the 3.5%

span. The temperature profile used by the vendor should be compared with the plant specific accident temperature profiles. The plant's specific profiles should be fully enveloped by the actual test profiles, or differences evaluated for acceptability, for the specification to be valid.

EGR-NGGC-0153 Rev. 12 Page 93 of 184

9.4.7 Accident Effects (cont'd)

The accident temperature profiles for each plant can be found in the documents identified below:

[BNP - Drawing D-3056 (All areas except Primary Containment and Reactor Building)

DR-227 (For Primary Containment and Reactor Building Areas)]

[HNP - Section 3.11 B of the FSAR]

[RNP - Drawing HBR2-11260]

As another example, consider a Foxboro Model N-El 1 transmitter, whose specification sheet shows three different error terms related to temperature. Each term is valid at a different temperature, causing the error term to change with time after an event. Based on the functional requirements of the specific loop, the accident temperature effect can be minimized since the error varies from +/-8% to

+/-3% over the duration of the test.

The acceptability of a particular device's environmental qualification should be documented in a [BNP - Qualification Data Package (QDP)] [HNP, RNP -

Environmental Qualification Data Package (EQDP)]. The applicable QDP/VQP/EQDP should be reviewed to ensure that all assumptions, constraints, etc. documented for the device's qualification are consistent with the device's usage and design basis. The EQ Program Manager should be notified if it is suspected that a device is required to operate in an accident environment but does not have a qualification package. If this suspicion is confirmed, then a Condition Report shall be initiated.

The components that have a qualification package are identified in PassPort Equipment Database (EDB).

The accident temperature effects are considered to be random error terms unless otherwise indicated by a manufacturer. When an accident temperature effect is included in an error analysis, the normal temperature effect (TE) would not be included in the portion of the calculation addressing accident effects. Note that an increase in the temperature may yield a Bias condition in a Reference Leg, for example, that needs to be accounted for.

I EGR-NGGC-0153 Rev. 12 Page 94 of 184

9.4.7 Accident Effects (cont'd)

2. Accident Pressure Effects (APE)

Accident pressure effects can occur for some instrumentation because of the large increase in ambient/atmospheric pressure associated with an accident.

While most instrumentation is not affected by changes in atmospheric pressure, devices which use local pressure as a reference of measurement can be greatly affected. Of primary concern are pressure transmitters which may use the containment pressure as the reference atmospheric pressure.

Loop error analysis must take into account the containment pressure over time following an accident for the transmitter. If the transmitter uses a sealed reference, the additional error will be minimized and may be ignored.

Accident pressure effects will generally not be included in an error analysis except for the reason cited above. The accident pressure effect is only to be included if specifically required by an instrument manufacturer. The effect can be treated as either a random error, or bias error, depending on the manufacturer's specifications, and the level of predictability of the error. In other words, for the example cited above, the error would be treated as a bias if it is known that the pressure increase causes the transmitter to read less than actual pressure.

The QDP/EQDPNQPs should also be reviewed and evaluated when identifying the APE, as discussed above for the ATE. The accident pressure profiles for each plant are identified in the same documents that list the accident temperature profiles, as noted above.

3. Accident Radiation Effect (ARE)

High radiation levels caused by an accident are yet another effect which can greatly influence an instrument's accuracy. Electronic instrumentation may be affected by both the rate of radiation, and the total radiation dose to which it is exposed. In normal operation, radiation effects are small and can be calibrated out during periodic calibrations. Accident radiation levels can exceed an instrument's normal life time radiation dose by a factor of 10 to 100. This high radiation exposure can increase instrument error by as much as 10%.

Accident radiation effects are also determined as part of a manufacturer's environmental qualification testing. Generally, the effect is stated as a maximum error effect for a given integrated radiation dose, typically 107 or 108 Rads. The accident radiation levels used for testing are chosen so as to envelope maximum dose levels expected at a large sampling of plants.

IEGR-NGGC-01 3 1 Rev. 12 1 Page 95 of 184

9.4.7 Accident Effects (cont'd)

Because of the irradiation process used in EQ testing, very little interpolation of error effect versus radiation is possible. When an instrument must function during or following exposure to high radiation levels, the manufacturer's performance specification values should typically be used. Comparison of manufacturer tested radiation levels to the plant specific radiation levels should be made, to ensure the dose rates and TIDs used for the tests envelope the plant profiles. These profiles are identified in the same documents as noted above that contain the accident temperature and pressure profiles.

The accident radiation effect is considered to be a random error component unless otherwise determined by a manufacturer.

4. Seismic Effects (SE)

Some instrumentation experiences a change in accuracy performance when exposed to equipment or seismic vibration. The vibration can cause minor changes in instrument calibration settings, component connections and/or sensor response. The seismic effect may have different values for seismic and post-seismic events. Care must be taken when establishing loop functional requirements so as to establish loop accuracy under the anticipated conditions. Refer to Generic Letter 87-02 Enclosure 1, for guidance concerning design basis accidents caused by or coincident with seismic events. Some of these scenarios are not within the licensing basis of our nuclear plants and therefore, consideration of both accident and seismic effects simultaneously may not be required.

The seismic effect is considered to be a random error term unless otherwise indicated by a manufacturer.

If the vendor specifications give an instrument uncertainty for seismic vibration, this uncertainty should be included in the uncertainty calculation unless the instrument is not used in an application requiring seismic qualification.

If the application does not require seismic qualification, then any seismic vibration induced uncertainty can be ignored.

If an instrument is used in an application requiring seismic qualification but no specific seismic uncertainty is specified by the vendor it is usually considered to be included in the reference accuracy term as long as the device is seismically qualified.

Assumptions concerning seismic uncertainties should be verified by contacting the instrument manufacturer if the specifications are not clearly understood. As noted earlier, it is essential that test data submitted or published by the vendor be evaluated to ensure that vendor test profiles envelop site-specific design requirements EGR-NGGC-0153 Rev. 12 Page 96 of 184

9.4.8 Readability (RE)

In instrument loops in which the final output device is an indicator or recorder, the readability of the output device must be taken into account in the analysis. The readability of an analog indicator/recorder is based on the interval between scale demarcations. The indicator's/recorder's scale demarcations, and span, are used to define the readability of the device.

It is important here to differentiate the difference between the readability of the indicator/recorder for calibration purposes and its readability during operation.

When calibrating an indicator/recorder, an input test signal will be provided by M&TE and the "output" will be directly read from the indicator/recorder. The output is typically aligned on the scale demarcations during the calibration process. If so, no additional M&TE error must be considered for reading the value. Otherwise, an additional readability error, as discussed below, must be considered for the M&TE error.

For an indicator/recorder, however, there is a separate readability that must be included for its use by an operator. An actual signal will not always line up on the scale demarcations. The operator is forced to interpret the indication as a function of how close the indicated signal is to the demarcations. Operator A may interpret the signal as closer to the higher demarcation, Operator B may interpret the signal to the lower demarcation, and Operator C may take the mean between the demarcations. Thus, an error is introduced into the total loop uncertainty based upon an individual operator's ability to interpret the indication. This is the readability uncertainty of concern.

For linear analog indicators and recorders, readability (RE) is generally defined as one half of the smallest scale increment, however 1/4 the smallest increment can be used if the increments are 1/2 inch apart or more.

RE = 1/2 smallest scale demarcation (Eq. 30)

This definition is based on limited interpolation of process values between specific scale markings. This interpolation is limited by scale pointers, potential parallax, and operator judgment.

While some indicators and recorders may allow more detailed interpolation of readings between scale markings, it cannot be ascertained that an operator will accurately perform this interpolation on a consistent basis. The plasma type indicators are a good example. While the indicators are actually comprised of approximately 200 discrete scaled segments, an operator does not count the segments to determine a reading. Most readings are obtained from a distance which makes the segments indiscernible. Therefore, unless an instrument has a specific evaluation and justification identifying why its readability can be some other value, readability will be considered to be one-half the smallest increment scale.

IEGR-NGGC-0153 I Rev. 12 Page 97 of 184

9.4.8 Readability (RE) (cont'd)

Consider the following example, A control board indicator displays a pressure signal. The indicator is scaled from 0 to 1000 psi and has minor scale marking every 20 psi. The indicator uses a pointer to show pressure, and it is located somewhere between 520 psi and 540 psi.

Whenever the pointer is between scale markings, an operator reading the indicator generally only has the ability to determine one of three possible values for the parameter, 520 psi, 530 psi or 540 psi. The ability to interpolate more precisely than 10 psi is limited. The operator can judge whether the pointer is closer to the 520 psi mark or the 540 psi mark, or is approximately halfway between the two marks. The readability of the indicator is therefore 1/2 of 20 psi, or, 10 psi.

The readability defines the highest degree of accuracy (smallest error) that a loop can have through an indicator or recorder. That is, the smallest error for an instrument, or loop, cannot be less than the final output device's readability.

Indicators or recorders with digital displays do not follow the same definition of readability as analog displays. Since no scale is used for the digital display, no interpolation is necessary by an operator. The readability of digital displays is equal to the value of the least significant digit in the display.

Readability is typically considered a random error term.

9.4.9 Setpoints With A Single Side Of Interest Setpoints which are approached from only one direction may have an adjustment applied which converts the uncertainty determined for a bidirectional approach to a smaller value which still retains the 95% confidence level determined for the bidirectional uncertainty. In these cases the critical region is a region to one side of the distribution, with an area equal to the desired level of confidence. The method to calculate these smaller uncertainty values is as follows.

For normally distributed 95% probability uncertainties, standardized area distribution tables, Reference 2.24, shows that 95% of the population will have uncertainties between +/- 1.96 sigma, with 2.5% failing below -1.96 sigma and 2.5%

falling above +1.96 sigma. If there are increasing and decreasing trip limits, the appropriate limits to use are +/- 1.96 sigma.

For normally distributed uncertainties, the same tables show that 95% of the population will have uncertainties less than +1.645 sigma (50% below the median and 45% between the median and +1.645 sigma) and that 95% of the population will have uncertainties greater than -1.645 sigma. If interest is only in the probability that a single value of the process parameter is not exceeded and the single value is approached only from one direction, the appropriate limit to use for 95% probability is +1.645 sigma or -1.645 sigma as appropriate.

EGR-NGGC-0153 Rev. 12 Page 98 of 184

9.4.9 Setpoints With A Single Side Of Interest (cont'd)

Using this technique, a positive uncertainty that has been calculated for a symmetrical case can be reduced while maintaining 95% coverage of the population when a single parameter is approached from one direction. For example, if the original symmetric value was based on 2 sigma members, the reduction factor is 1.645/2.00=0.8225; if the original symmetric value was based on 1.96 sigma values, the reduction factor is 1.645/1.96=0.839. This adjustment is applicable only to random uncertainties which are normally distributed.

9.4.10 Vortex Considerations for Tank Levels Level measurements can be effected by vortices when they form either by a mixing action such as in a blender, or by suction such as during a draining or pumping operation. When a vortex forms, the level measurement can become in error because the volume of liquid in the tank no longer conforms to the shape of the tank. If the level measurement depends on the height of liquid above a level tap located on the wall of the tank (DP or Pressure measurement) then a positive level error will exist with a magnitude dependent upon the severity of the vortex. If the level measurement depends on the distance between the sensor and the liquid surface (ultra sonic beam measurement) then a positive or negative level error could exist, or level detection could be lost, depending on the location of the sensor relative to the vortex. Other types of level measuring systems such as float switches, capacitance probes, or bubblers are similarly affected.

The main concern relating to vortices at nuclear power stations is that air would be sucked into the suction pumps (such as Safety Injection or AFW pumps) causing loss of suction during pumping operations if the switchover from tank supplied water to an alternate water source or makeup to the tank does not occur prior to formation of an air entrained vortex. Since loss of suction due to air entrained vortex formation is not acceptable, it is necessary to determine the level required that prevents vortex formation and then to use this minimum level as the analytical limit when determining low level setpoints for tanks.

IEGR-NGGC-0153 1 Rev. 12 Page 99 of 184

9.4.10 Vortex Considerations for Tank Levels (cont'd)

Based on the above, it is generally not necessary to include vortex considerations as a level instrument uncertainty but it is necessary to consider vortex formation when setting analytical limits for tank low level setpoints. See section 9.8.1.2.

When this information is required to be generated, the Mechanical discipline should be consulted and an approved input obtained for use as the low level analytical limit because other considerations besides vortexing may apply. The following general relationship is presented for information: (See attachment to letter CPL-89-634, HBR- The potential for formation of air entraining vortices in the Aux. Feed Pump Suction from the Condensate Storage Tank)

Harleman Equation: SJd = 0.625 FR°0 4 where:

S, = Critical submergence, or minimum level above the top of the intake nozzle which precludes the formation of air entraining vortices.

d = Diameter of the intake nozzle FR = Froude number = V/(gd)l/2 g = Gravitational constant V = Fluid velocity into nozzle 9.5 Other Errors In addition to the basic performance uncertainties of process measurement, external influences on the loop can affect accuracy. These influences are totally independent of loop process and instrument errors, but impart an additional level of uncertainty to a loop's measurement, and as such, must be considered in any error analysis calculation.

I EGR-NGGC-0153 Rev. 12 Page 100 of 184 1

9.5.1 Calibration Errors The cornerstone of all instrumentation performance, and accuracy, is the calibration process. The instrument and loop calibration(s) establish the baseline parameters necessary for accurate measurement and presentation of information. The calibration process consists of two important facets; 1) the calibration procedure itself, and the tolerances that are allowed in calibrating the device (or loop segment); 2) the measurement and test equipment used during calibration. Both of these directly affect the performance of an instrument and/or loop and are discussed in detail below.

1. Calibration Tolerances The calibration process is used to adjust an instrument, or loop, to ensure that it functions within an acceptable set of limits. Calibration tolerances are the defined limits, above and below a desired value, within which an instrument or loop signal may vary and-not require adjustment. Calibration tolerances are established to aid technicians in the calibration of instrument loops and devices. Adjustment to ideal values within the tolerance may or may not be attempted during calibration depending upon the standard calibration methods applied by the technicians.

For example, if a device has a reference accuracy of +/-0.25%, requiring calibration of the device to a tolerance less than its reference accuracy (say

+/-0.1%) cannot increase its accuracy. Since the output of the device may vary continuously by +/-0.25%, calibration adjustment of the device to tolerances set less than the RA would be futile in that the device cannot maintain calibration to these tight tolerances. Even if possible during the calibration process, the device cannot be assumed to maintain performance to these tight tolerances between successive calibrations. Therefore, the minimum requirement for calibration tolerance should normally be equal to the reference accuracy. In uniquely analyzed applications, AL and AF tolerances may be to set at values less than the RA based on conclusive past calibration data.

Calibration tolerances define for the instrument technician the acceptable band of operation for a device or loop. The calibration tolerance is defined for each calibration point of a loop. Usually, the calibration tolerance included within the loop uncertainty/setpoint calculation is obtained directly from the device's/loop's calibration procedure.

EGR-NGGC-0153 Rev. 12 Page 101 of 184

9.5.1 Calibration Errors (cont'd)

For the NGG plants, the calibration tolerances for a device are generally established within the calibration procedures as follows:

[BNP - MMM-002 describes how calibration tolerances should generally be established equal to a device's reference accuracy.]

[HNP - Ultimately the setpoint document specifies tolerances to a scaling document which specifies all tolerances for calibration procedures. Where there is no scaling document, the setpoint document or MMM-005 specifies a tolerance. Therefore, the list of priority is (1)

Setpoint Document, (2) Scaling Document, (3) MMM-005, (4)

MMM-04. MMM-005 also specifies device tolerances for generic device types for any devices which do not have a calculation or worksheet.]

[RNP - MMM-006 describes how calibration tolerances should be established in accordance with the type of device, and provides tolerances for specific device types.]

Calibration tolerances must be established for all instruments, devices, and loops, including setpoint bistable devices, and output indicators. The upper and lower setpoint limits, discussed later in Section 9.8.2.3, are tolerances.

The calibration tolerance does not necessarily have to be limited to a component's reference accuracy. Additional margin or tolerance is acceptable in selected instrument or loop calibrations, as long as the functional requirements can still be satisfied.

Thus, the Calibration Tolerance (CAL) can be defined as that uncertainty allowance that is applied to a loop error analysis to compensate for the reference accuracy (RA) of the instrument (or loop segment) which is being calibrated, as well as, for any additional potential calibration setting uncertainties allowed.

As described above, each plant has its own guidelines for establishing a calibration tolerance. However, each plant also has a policy that states that the measuring and test equipment error should be less than or equal to the tolerance of the device/loop being calibrated. While this policy is discussed further in Section 9.5.1.2 below, it directly affects the establishment of the calibration tolerance.

I EGR-NGGC-0153 Rev. 12 Page 102 of 184

9.5.1 Calibration Errors (cont'd)

For each calibration, the calibration tolerance is used to account for the reference accuracy of a device. Thus, the error attributable to the test equipment should be less than or equal to the calibration tolerance of the device/loop being calibrated. If the test equipment error is higher than the device/loop being calibrated, two options are generally available - either utilize more accurate test equipment, or if this is impractical, increase the calibration tolerance.

Therefore, the guidelines for calibration tolerance should be as follows:

1. The measuring and test equipment accuracy should be better than or equal to the calibration tolerance of the device/loop being measured.

2. If the calibration tolerance is greater than or equal to the reference accuracy it may be used in place of the reference accuracy.

One assumption that is inherent in replacing the reference accuracy with the calibration tolerance is that the calibration process verifies all of the attributes of reference accuracy. As previously discussed in Section 9.4.1, the reference accuracy represents the combined effects of linearity, hysteresis, and repeatability. If the calibration checks multiple points along the span of the device, it verifies the linearity. If the calibration checks these points in both an increasing and decreasing direction, it verifies the hysteresis. Ifthe calibration checks the points in both directions several (i.e.,

three or more) times, it verifies the repeatability.

All of the calibrations used for the NGG plants verify linearity, and most verify hysteresis; however, few verify repeatability. The individual calibration procedure should be reviewed to identify for each calibrated device, which specific attributes are verified during calibration.

If all of the attributes are not verified during the calibration, then the attributes that are not verified must somehow be compensated for within the uncertainty calculation. Reference 2.3 provides four separate ways of addressing this problem. Although any of the methods described in Reference 2.3 may be used, the simplest method is to include both the calibration tolerance and the reference accuracy within the uncertainty calculation. However, this may be too conservative an approach for many devices. An alternate method would be to assume that each of the three attributes affects the reference accuracy equally such that the SRSS of the three attributes would equal the reference accuracy, RA = (x2 + x2 + x2)'/ (Eq. 31)

I EGR-NGGC-0153 Rev. 12 Page 103 of 184

9.5.1 Calibration Errors (cont'd) where x represents each attribute. If the calibration procedure did not verify one attribute, then the value for x could be substituted for the reference accuracy and used with the calibration tolerance. Similarly, if the calibration procedure did not verify two attributes, then the SRSS of x and x could be substituted for the reference accuracy and used with the calibration tolerance.

Consider the following example, A transmitter has a reference accuracy of +/-0.25% and a calibration tolerance of +/-0.50%. The calibration procedure only checks 5 points of the transmitter's span in one direction.

If there is enough margin in the uncertainty calculation, both the reference accuracy and the calibration tolerance should be used. If not, the value that could be substituted for the reference accuracy could be determined as follows,

+/-0.25% = (x + x2 + X2)/2 x= +/-0.144%

Since the calibration did not verify two attributes (i.e., hysteresis and repeatability), then the substitute reference accuracy term would need to account for both of these attributes.

Substitute RA = +/-(0.1442 + 0.144 2)

Substitute RA = +/-0.20%

Thus, the uncertainty of the device would be determined by SRSS of the

+/-0.20% value for the substitute reference accuracy, the +/-0.50% for the calibration tolerance, and any other applicable device uncertainty terms. It should be noted that not all terms are random. Only random terms are included in the SRSS calculation.

2. Measurement and Test Equipment Measurement and Test Equipment is the general name given to all of the equipment required to calibrate instrumentation. The test equipment includes voltmeters, ammeters, resistance decade boxes, test gauges, test point or test resistors, deadweight testers, etc. All test equipment must be controlled and calibrated to known standards. The calibration of test equipment must be done using highly accurate precision standards which are traceable to the National Institute of Standards and Technology (NIST),

formerly the National Bureau of Standards (NBS). This standardization provides known bases for test equipment accuracy, and allows for the.

EGR-NGGC-0153 Rev. 12 Page 104 of 184

9.5.1 Calibration Errors (cont'd) determination of the test equipment effects on plant instrumentation. All test equipment used for the NGG plants is controlled by site-specific programs to ensure that traceability is maintained. Test equipment is periodically re-calibrated and verified to be within known limits. Each of the NGG plants has established a policy that requires all test equipment used in the calibration of instrumentation to be at least as accurate as the instrument being calibrated. For example, if an instrument has a reference accuracy of

+/-0.25% of span and is calibrated to +/-0.25% of span, the combined accuracies of the test equipment used in calibrating the instrument must be less than or equal to +/-0.25% of span.

The basic accuracy of test equipment is generally not documented in relation to the accuracy of the instrument or loop being calibrated. Instead, test equipment accuracy must be converted to an equivalent instrument or loop accuracy value, by factoring in the test equipment range in terms of the instrument (or loop) span.

Consider the following example, A multimeter (MM) with an accuracy of +/-0.25% of its range is to be used to calibrate a pressure transmitter. Transmitter span is 4-20 mA. The MM has a 0-20 mA and a 0-50 mA range. The accuracy of the multimeter can vary depending on the MM range used.

MM accuracy = (0.25% of MM Range)/(Transmitter Span)

Therefore, MM accuracy on the 0-20 mA range is, 0.25%

• 20 mA = 0.31% of span 16 mA The MM accuracy on the 0-50 mA range is, 0.25%

• 50 mA = 0.78% of span 16 mA As can be seen, the basic accuracy of the test equipment and the proper selection of test equipment range is important. The final test equipment accuracy, expressed in equivalent instrument or loop accuracy units, must have an overall accuracy less than or equal to the accuracy (i.e., calibration tolerance) of the device/loop being calibrated. Thus, for this example the calibration tolerance would have to be greater than or equal to 0.31% to account for the multimeter or, a more accurate multimeter used.

IEGR-NGGC-01 53 1 Rev. 12 1 Page 105 of 184

9.5.1 Calibration Errors (cont'd)

The Measurement and Test Equipment Error (MTE) is that uncertainty allowance included in the loop uncertainty calculation, to account for the uncertainty imposed into a loop component, or loop, as a result of the calibration using imperfect measurement and test equipment. The MTE term is, in essence, the uncertainties associated with measurement and test equipment used to calibrate the loop, or component. When a component is calibrated, the reference accuracy errors associated with the test equipment are imposed on the component. That is, reference accuracy errors associated with the test equipment are transferred to the loop component being calibrated. These additional errors bias the future performance of the component, after calibration. As such, the MTE error and the CAL, are conservatively treated as random, but dependent, terms. For conservatism, in the uncertainty analysis, these two terms would be algebraically combined with each other before being statistically (SRSS) combined with the other random terms.

In order to determine the MTE for a device/loop, the applicable calibration procedure should be reviewed. The calibration procedure will identify the test equipment to be used for the calibration. The test equipment may be identified specifically via manufacturer and model (i.e., Fluke 8600) or only generically as to type of test equipment (i.e., Digital Voltmeter). Typically, the MTE error is determined from the "worst case" accuracy for the types of M&TE specified, in order to provide the I&C technicians the most flexibility in performing the tests. If there is not sufficient margin in the total loop uncertainty to accommodate this flexibility, the MTE error can be calculated for specific M&TE. If this changes the calibration procedure, the plant I&C staff should be contacted and this matter discussed with them to ascertain if any other options are available.

When specific M&TE are required to meet instrument uncertainty needs, the test equipment should be evaluated to determine if it is subject to a temperature effect. This effect is the error caused by temperature on the M&TE accuracy. Some M&TE devices can be affected by the difference in temperature between the shop and the field. When this is the case the M&TE error should include an allowance for this temperature effect.

For new or revised loops, the calibration procedure may not exist prior to performing the uncertainty/setpoint calculation. In this case, the calculation should be developed using assumed test equipment that is used in similar types of existing loops. The assumed equipment must be identified to the preparers of the calibration procedure, so that such equipment, or better, may be incorporated into the calibration.

I EGR-NGGC-0153 Rev. 12 Page 106 of 184 1

9.5.1 Calibration Errors (cont'd)

The listing of measuring and test equipment available for a plant and its associated accuracy, is maintained in the following locations:

[BNP - Test Equipment Room Bar Code Computer, kept by the Site Test Equipment Room Attendants.]

[HNP - Required Test Equipment Accuracy in MST and LP, as well as guidelines for determining, are in MMM-005, Instrument Loop Calibration Procedure.]

[RNP - The RNP Test Equipment Shop can provide a listing of the test equipment available at RNP and its associated range and accuracy.]

When multiple measurement and test equipment devices are used in the calibration of a component, the MTE error imposed on the component is determined by combining, using SRSS, the individual MTE errors associated with each individual M&TE device.

Consider the following example, Assume a transmitter, with a reference accuracy (and calibration tolerance) of +/-0.50% of span, is calibrated using a deadweight tester and a multimeter, each with a reference accuracy error equal to +/-0.25%. The MTE error is:

MTE = +/- (0.252 + 0.252)0.5 = +/- 0.354%

When combining the errors for test equipment, one device that is frequently overlooked is a test resistor. This includes any such resistors that may be installed in the loop to facilitate testing/calibration, as well as any resistors provided by the technician for performing a specific calibration. Whenever any such resistor is used as part of a device's/loop's calibration, it should be evaluated for inclusion in the determination of the MTE term. (Typically, the effect due to resistors accurate to +/-0.01%, will be negligible.)

As an illustration of MTE error, consider a device used to measure an absolute value such as a primary standard, or to measure barometric pressure, at sea level, on a perfect day (29.92 in Hg = 0.000 psig). If this device has an accuracy of +/-0.5% of span, then its output can vary by as much as 0.5% from its ideal value, with the input held at this absolute value.

Therefore, the output has a bandwidth of 1.0% span, centered about the absolute value, see Figure 9-10.

I EGR-NGGC-0153 Rev. 12 1 Page 107 of 184 1

9.5.1 Calibration Errors (cont'd) autpt nfrfo+0.5% span Absolute value Error ESanwidth 1 10% 3p' Output error -0.5%

FIGURE 9-10 DEVICE ERROR BAND Now, instead of an absolute calibration device, the device is calibrated using test equipment that has a combined error of +/-0.25% of the device's span.

The MTE error can bias the device's accuracy above or below the absolute value to a new reference value. In other words, if at the instant of device calibration adjustment, the test equipment output was +0.25% span, the device's error band would be adjusted such that it was centered on a new reference value -0.25% span below the absolute value. The device's error bandwidth is still 1.0% of span but it is now centered about the new reference value rather than about the absolute value. By superimposing the additional error on Figure 9-10, the result is shown in Figure 9-11. The device output deviates from the ideal by the amount of test equipment error.

Note that comparison of Figures 9-10 and 9-11 reveals an increase in the error bandwidth when the effects of MTE are considered.

Like RA, MTE error is a random error, but due to the interdependence between MTE and CAL, it may be combined with CAL before being included in an overall error analysis.

MTE error must be considered for each instrument, or device, within a loop, which is calibrated independently. Generally, calibrations are performed device-by-device or by performing "string" calibrations of multiple devices at one time. The method of calibration selected determines how the MTE will be included in the overall loop uncertainty.

For example, if a loop contains 8 devices and each device is calibrated individually, the overall loop uncertainty must include provisions for 8 MTE errors. Each of these would be added to the calibration tolerance of the device and SRSSed with the other uncertainties. Alternatively, the calibration could be performed by a "string" calibration whereby all 8 devices would be treated as one device, with regard to the MTE. For this case, the overall MTE would only have to be applied once, thereby decreasing the total loop uncertainty.

IEGR-NGGC-0153 I Rev. 12 1 Page 108 of 184

9.5.1 Calibration Errors (cont'd)

The MTE, when applied to each component, can impose an excessively conservative penalty on plant operations. Implementing partial loop tuning of all components checked during a periodic calibration (i.e., after individual component calibration) or performing just a "string" calibration (i.e., not calibrating the devices individually) are two viable alternatives. These techniques minimize the number of times the overall MTE must be applied to the total loop uncertainty.

Combtrnd ef*e-- a? Device Rle*rmenc Acmnoa'v and M&TE an, OveralL Accuracy

-- C-tvic- RA - Nomw Reference S-A AbameVu ,. Now Rat. Value 4 Due to0 NV* .2 IL New, Ref. Vogue l 0Lm i4-MfIM

-to

-0m vice FLA

-0.50%

-rv3ice RA -i- New Reference FIGURE 5-11 DEVICE ERROR BAND BIAS I EGR-NGGC-0153 Rev. 12 Page 109 of 184 1

9.5.1 Calibration Errors (cont'd)

In summary, the general rules for calibration error are:

Calibration error, CAL, is typically equal to the RA for a device/loop, plus any additional tolerance deemed necessary to aid in the calibration of the device/loop.

Component accuracies are conservatively considered to be dependent on the test equipment used to calibrate the component.

Therefore, the applicable MTE error is normally algebraically summed with the CAL error prior to being combined with other loop errors.

• All MTE errors must be converted to units consistent with the loop error analysis.

• The MTE error should include the MTEin and MTEout as SRSS terms.

0 The MTE error should be applied to each calibrated component, or group of components, in a loop depending upon whether the calibration is performed device-by-device or via a "string" calibration.

• If all of the attributes of a component's reference accuracy are not verified during its calibration, then the reference accuracy or a portion of the reference accuracy must be included in the uncertainty calculation as a random, independent term. If all of the attributes of a component's reference accuracy are verified during calibration, and the calibration tolerance is greater than or equal to the reference accuracy, then the reference accuracy term can be ignored.

0 The MTE error should be less than or equal to the CAL error for a component, or group of components.

3. Calibration Temperature The calibration temperature refers to the ambient temperature for an instrument at the time of calibration. The calibration temperature may be used as the initial temperature for determining errors based on temperature variation such as, instrument temperature effects, etc.

As discussed in Section 9.4.3, for error calculation purposes, an assumed calibration temperature (for example,65-90F) may be used on a case-by-case basis. If a calibration temperature is not assumed, the temperature effects are determined from the spectrum of design temperatures for a given location. If calibration procedures record the ambient temperature, then the mean temperature for previous calibrations can be used as the calibration temperature for calculation purposes.

EGR-NGGC-0153 I Rev. 12 Page 110 of 184

9.5.2 Insulation Resistance Error (IR)

During accident conditions, when temperature, pressure, and humidity are well above their normal operating conditions for certain areas, electrical signal components can experience degradation in their electrical insulation. This phenomenon is known as Insulation Resistance (IR) Degradation, or IR loss. Such a reduction in IR can cause an increase in leakage currents between conductors, and terminals, of an instrument loop, resulting in potential degradation of loop performance.

In normal operation, changes in electrical insulation performance are so small that typically no effect on instrument loop performance can be seen. Even as the electrical signal component's (primarily cable, splices, and connectors) IR characteristics change with age, the periodic calibration process corrects the loop to eliminate any effects of leakage currents.

However, plant design basis accidents can impose extreme changes in ambient operating conditions on the components, primarily increases in ambient temperature and radiation. All electrical insulating materials experience some decrease in electrical insulation resistance properties with increasing temperature or radiation. The resulting decrease in electrical resistance, while not generally a concern for power applications, can cause significant changes in low level signal wiring or control loops.

The effects of IR can be determined by analyzing the changes in resistance, through the use of equivalent instrument loop circuit models. The following section provides a synopsis of the IR effects on various types of instrument loops.

1. Current Loop IR Effect The insulation resistance degradation of electrical signal components in an ungrounded instrument current loop causes an increase in the apparent signal for the loop. The loop signal current will increase as a result of reduced insulation resistance between the signal conductors of the loop. A leakage current between the conductors causes an increase in the signal current to the downstream loop devices. The magnitude of this leakage current, and that of the subsequent signal error, are directly proportional to the change in insulation resistance.

IEGR-NGGC-01 53 1 Rev. 12 1 Page 111 of 184

9.5.2 Insulation Resistance Error (IR) (cont'd)

The magnitude of the IR error for an ungrounded current loop is directly affected by the following parameters:

• Loop supply voltage - The error is directly related to the value of the loop supply voltage. The higher the voltage, the higher the error is and vice versa.

• Loop load resistance - As the loop load resistance increases, the error is reduced.

• Loop current range - The error current generated is inversely related to the loop current. The highest error occurs at the minimum value of loop current.

• Cable length - The majority of the leakage current comes from the actual length of cable exposed to the accident environment.

The shorter the cable length, the lower the IR error effect.

The IR error effect for an ungrounded current loop always causes an increase in current.

Since the IR error has a known effect on instrument performance, the IR error is considered a bias error, and as such, it must always be algebraically added to a loop's uncertainty. However, the IR error is a bias with known sign but unknown magnitude.

Many variables (environmental temperature, cable length, cable type, etc.)

determine the magnitude of IR error, and it cannot be predicted to occur for every type of event. As such, IR error should be calculated as a "worst case" value for "worst case" conditions. [HNP, RNP - Generic IR calculations exist as part of the cable EQDPs and may be used for determining the IR error for the applicable instrument loops.]

The above discussion applies for the typical case where the loop is ungrounded. If, however, the loop is grounded, the IR degradation may cause either an increase or a decrease in the apparent signal for the loop, depending upon the specific circuit configuration.

EGR-NGGC-0153 Rev. 12 Page 112 of 184

9.5.2 Insulation Resistance Error (IR) (cont'd)

2. RTD Loop IR The degradation of electrical signal components in an ungrounded RTD sensing loop causes a different type of error than in the current loop. In the RTD loop, the total resistance of the RTD for a given temperature is known.

Changes in the total resistance are assumed to be changes due only to changes in the RTD sensor as a result of temperature change. When the signal wiring also experiences a change in resistance characteristics between conductors, the loop mistakes this change for a change in sensor resistance. Changes in signal wiring IR will have the same effect as changes in sensor resistance. The signal wiring insulation provides a parallel resistance path to the RTD thus causing an apparent decrease in RTD sensor resistance as signal wiring IR decreases. Therefore as IR decreases, the loop will exhibit a negative error in measured temperature, since RTD resistance increases with temperature.

The magnitude of the IR error for an ungrounded RTD sensing loop is directly affected by the following parameters:

• Cable length - The majority of the leakage current comes from the actual length of cable exposed to the accident environment.

The shorter the cable length, the lower the IR effect error.

• RTD values - The higher the RTD ice point resistance (RO, or resistance at 32°F), the higher the error.

0 3-wire RTDs vs 4-wire RTDs - A 4-wire RTD will demonstrate more IR effect error than a comparable 3-wire RTD, due to the increased leakage paths.

• IR effect error for an RTD loop is always a negative error.

Since the IR error has a known effect on instrument performance, the IR error is considered a bias error, and must always be algebraically combined with a loop's uncertainty. As discussed above for the current loop, the IR error is a bias with a known sign and an unknown magnitude. Thus, its value should be determined for "worst case" conditions.

The above discussion applies for the typical case where the RTD sensing loop is ungrounded. If, however, the loop is grounded, the IR degradation may cause either an increase or a decrease in the apparent signal for the loop, depending upon the specific circuit configuration.

IEGR-NGGC-01 53 1 Rev. 12 Page 113 of 184

9.5.3 Conduit Seal Effects (CSE)

In certain applications of high ambient temperatures, conduit seals may provide a current leakage path similar to that discussed above for insulation resistance.

Depending on how the IR error is determined, the conduit seal error may be combined with the IR error or determined separately. Like the IR error, it will act as a bias and have the same effect on the loops as the IR error - acting as a positive bias for current loops and a negative bias for RTD loops. Loops susceptible to IR error should also be evaluated for conduit seal effect error.

9.5.4 RTD Lead Wire Effects (LW)

Resistance temperature detectors (RTD) can experience an additional error effect due to changes in the resistance of the signal wiring conductors. The effect, generally known as the lead wire effect (LW), is usually only significant on RTDs which use two (2) wires to sense RTD variation. To a lesser extent, the lead wire effect is apparent on three (3) wire RTDs, but the third lead eliminates most of the error.

In a two (2) wire RTD installation, the resistance temperature coefficient in the signal wiring can cause significant changes in total circuit resistance. This change in resistance appears as a change in sensed temperature. As the temperature of the signal wiring goes up, the wire resistance rises in the same manner as the RTD itself. The wire resistance is directly proportional to the length of the cable as well.

Therefore, two (2) wire RTDs should only be used where required accuracy is not critical, or cable lengths are limited to a few feet.

As a general rule, three or four wire RTD's are used in applications requiring accurate temperature measurement. The four wire RTD does not experience any significant lead wire effect since it measures the voltage variation caused by the RTD.

The relevant points to remember regarding lead wire effects are:

The lead wire error is a positive bias for the 2 wire RTD and may be either a positive or a negative bias for a 3 wire RTD.

The magnitude of lead wire error increases with increasing cable length. For example, for a three wire RTD whose wires are all routed and terminated the same, the effect would be determined from the RTD cable length multiplied by three.

The higher the RTD ice point resistance, the lower the lead wire error, for the same length/size of lead wire.

IEGR-NGGC-0153 1 Rev. 12 1 Page 114 of 184 1

9.5.5 RTD Self Heating Effect (SH)

The measurement of the resistance of an RTD demands that a current be passed through the resistance element. This current produces heat that raises the temperature of the element and, therefore, its resistance. The self-heating error is the amount of resistance change, converted to degrees, and is typically stated by the manufacturer.

The magnitude of the self-heating error depends on the efficiency of heat transfer from the sensing element to the protective sheath and from the sheath to the medium being measured. The self-heating error is, therefore, much larger when the detector is measuring moving air than when it is measuring moving liquid.

The standard method of determining the self-heating error is to immerse the thermometer in a stirred constant temperature bath, usually an ice bath. The resistance of the bulb is measured at two levels of current and the wattage dissipated at each level of current is calculated. The self-heating error, SH, is then:

SH = 1 * (RJ-R1 ) (Eq. 32)

S (W2 - W)

Where, S Average slope of the calibration curve, in ohms/°C at the temperature at which the test is carried out.

= Resistance at the first level of current, in ohms

= Resistance at the second level of current, in ohms W, = Wattage dissipated at the first level of current W2 = Wattage dissipated at the second level of current The error is calculated in terms of °C/watt and must be converted to units of percent span.

The above discussion characterizes what the self-heating effect is and how it is determined. However, it should be noted that the effect is typically insignificant, relative to the other uncertainties.

IEGR-NGGC-01 53 1 Rev. 12 Page 115 of 184

9.6 Error Analysis The analysis of instrument, and loop, uncertainty requires the application of probabilities and statistics to known instrument and loop errors. By defining each of the errors as either random or bias, as discussed in Section 9.2.5, one is able to apply the science of statistics to establish the cumulative effects of the errors. By using statistical analysis, truer relationships between probable errors and their resultant effects can be established. The statistical analysis of errors allows the determination of a total error effect based on both the magnitude of individual errors and the probability of their occurrence over time.

There are numerous methodologies within the science of statistics for analyzing data (errors). These methods include in depth analysis techniques (regression, partial derivatives, etc.) which are designed to predict the most probable value for a given set of numerical data. While the subject of probabilities is not the primary focus of this document, an understanding of the subject is necessary for instrument error analysis. The following sections discuss the primary methodology used in instrument error analysis. This methodology is based on accepted data analysis techniques, and has been endorsed by both the Nuclear Regulatory Commission, and the Instrumentation, Systems and Automation Society (formerly Instrument Society of America) (References 2.1 and 2.2, respectively).

9.6.1 Summary of Errors Before discussing the methodology for combining the individual error terms, it is helpful to reiterate the individual error terms, and how they are applied. Described below is a summary of the types of errors that should typically be considered for the determination of instrument loop uncertainty. Other errors may also be applicable to individual loops, however, the errors described below represent the most common error types. This summary is derived from the discussions previously presented in Sections 9.3, 9.4, and 9.5.

Process Measurement Effects - Consider for each loop, including any primary elements such as flow orifices, venturies, etc.

Reference Accuracy - Consider for each device within a loop.

Drift - Consider for each device within a loop.

Temperature Effect - Consider for each device within a loop. Does not have to be included whenever an ATE value is used.

Static Pressure Effect - Consider for Differential Pressure transmitters that operate at high (i.e. > 200 psig) pressures.

Overpressure Effect - Consider only for pressure transmitters (including d/p).

EGR-NGGC-0153 Rev. 12 Page 116 of 184

9.6.1 Summary of Errors (cont'd)

Power Supply Effect - Consider for each device within a loop.

Accident Temperature Effect - Consider for each device within a harsh environment.

Accident Pressure Effect - Consider for each device within a harsh environment.

Accident Radiation Effect - Consider for each device within a harsh or radiation harsh environment.

Seismic Effect - Consider for each device within a loop that is designated Seismic Class 1.

Readability - Consider for each indication or recording device, including local gauges and digital displays.

Calibration Tolerance - Consider for each device within the loop or loop as a whole, as appropriate..

M&TE Uncertainty - Consider for each device within a loop that is calibrated.

Include all M&TE used within the calibration.

Insulation Resistance Error - Consider for the portion of a loop within a harsh environment.

Conduit Seal Effect - Consider for the portion of a loop within a harsh environment.

RTD Lead Wire Effect - Consider for two or three wire RTDs.

RTD Self Heating Effect - Consider for RTDs.

9.6.2 Error Combination Methodologies There are two primary methods of combining instrument and/or loop uncertainties:

linear addition, and a simple statistical analysis called the Square-Root-Sum-of-the-Squares method. By combining these two methods, a third method can be defined such that random error terms are combined in the statistical manner and then algebraically summed with the bias error terms. This third method, or "combined" method, is the primary method used in industry for instrument loop error analysis.

A fourth, but rarely used, method is one where individual device errors are determined from SRSS, and then the error allowance for each device is added together to yield the loop error. The three predominant methods are described below.

IEGR-NGGC-01 53 1 Rev. 12 - Page 117 of 184

9.6.2 Error Combination Methodologies (cont'd)

1. Linear Addition Combination of all component errors by linear addition is by far the most conservative approach to loop uncertainty analysis. By algebraically summing all of the error effects of each component for the most severe abnormal situations anticipated, a bounding total loop uncertainty can be generated. This large uncertainty, though, when combined with plant limits can reduce operating bands to such an extent that it will impact process limits and restrict the operational flexibility of a plant.

It is true that an instrument loop will always function within the boundaries established using the linear addition method. However, it is generally not cost effective to take the operational penalties associated with such a conservative analysis. The linear addition method essentially treats all errors as correlated (bias) terms, and does not take advantage of the statistical nature of random error components.

2. Square Root Sum of the Squares Square-Root-Sum-of-the-Squares (SRSS) is a statistical method of combining multiple random errors for a device, or loop, in order to establish the total error attributable to all of the individual errors. The SRSS method accounts for the individual probabilities of random errors. The method is based on the knowledge that the probability of a group of random errors, each being at their maximum value, and in the same direction (i.e., + or -),

simultaneously, as is assumed in the linear addition method, is extremely small.

The SRSS method of combining random error terms is a methodology accepted by the NRC as discussed in Reference 2.1. The methodology produces a resultant error value which has the same level of probability as the individual terms being combined. A pure SRSS equation considers that all uncertainty effects are independent and random.

Since all component errors are generally considered independent, personnel doing this type of analysis need only square each uncertainty term and take the square root of the sum.

The basic SRSS combination of error terms takes the form:

Z = +/-[A2 + B2 + C2 + .. + n 2]0 5 (Eq. 33)

Where, A, B, C, n - are random and independent error terms Z - is the resultant uncertainty EGR-NGGC-0153 Rev. 12 Page 118 of 184

9.6.2 Error Combination Methodologies (cont'd)

3. Combined Analysis Method The combined method uses portions of both the linear addition, and SRSS methods for combining uncertainties. For the combined method, the individual random error terms are combined by SRSS to establish a single, resultant random error component. Linear addition is then used to combine all non-random (bias) terms to establish single positive, and negative, bias error components. The total error or uncertainty, is obtained by combining the random and bias components of error, as discussed in Section 9.2.5.

The basic formula for an uncertainty calculation takes the form of:

Z =[A2 + B2 + C2 + ... n2]05 + L + M (Eq. 34)

Where, A,B,C, & n - are random and independent uncertainty terms.

L&M are, respectively, the positive and negative bias error terms (terms which are not random and independent, but which are dependent uncertainties, non-random, correlated, etc).

Z - is resultant uncertainty. The resultant uncertainty combines the random uncertainty with the positive and negative components of the correlated terms separately to give a final total uncertainty.

The random and bias components for each device in an error calculation must remain separate and distinct throughout each intermediate calculation step, except when determining a final total error. In addition, the bias errors of opposite signs (+ or -) must remain separate, since biases can contain uncertainties which vary in magnitude over time. In other words, a bias may not exist at all moments in time, or always be at its maximum value with respect to other bias terms. Therefore, the positive and negative bias terms must be kept separate in order to establish a worst case possible error. Bias terms of opposite sign cannot be assumed to offset each other, and thereby reduce total error. However, certain bias terms such as head effects, will always be present and are of known sign and magnitude. For these cases, the bias term could be used in the determination of both the positive and negative uncertainty terms.

In calculating the total error, the total bias error for a given direction is combined with the random error in that direction. This establishes a final set of upper and lower bounds of error for a group of individual error terms. The bounds represent the limits within which the total error for a group of individual errors will remain 95% of the time. (Assuming all random error terms were of 95% probability as discussed in Section 9.2.5.1).

EGR-NGGC-0153 1 Rev. 12 Page 119 of 184

9.6.2 Error Combination Methodologies (cont'd)

Consider the following example, If we have a loop which contains the following error terms, Process measurement error = +0.5 (bias)

Transmitter accuracy = +/-0.25 (random)

IR error = -1.2 (bias)

Indicator accuracy = +/-0.5 (random)

The total loop uncertainty, TLU, is calculated as:

TLU = +/- [0.252 + 0.52]0.5 + 0.5-1.2

= +/- 0.56 + 0.5 - 1.2

= + 1.06/- 1.76 The total error is between +1.06 and -1.76 of the true value.

In determining the random portion of an uncertainty, situations may arise where two or more random terms are not totally independent of each other, but they are independent of the other random terms. This dependent relationship can be accommodated within the SRSS method by algebraically summing the dependent random terms prior to performing the SRSS determination.

An example is the dependent relationship between MTE error and CAL error, as discussed in Section 9.5.1.2. The formula would take the following form:

Z =[A2 + B2 + C2 + (D+E)2]°'5 + L+M (Eq. 35)

Where, D, E - are random, dependent uncertainty terms that are independent of terms A, B & C.

The combined analysis method can be used in the calculation of either a device uncertainty or a total loop uncertainty. The results are independent of the order of combination as long as the dependent terms, and non-random terms are accounted for properly. For example, the uncertainty of a device can be determined from its individual terms, and then combined with other device uncertainties to provide a loop uncertainty. Or, all of the specific device terms for each device in the loop can be combined in one loop uncertainty formula. Either way, the result will be the same. The specific groupings of an uncertainty formula can be varied for convenience of understanding IEGR-NGGC-01 53 1 Rev. 12 1 Page 120 of 184

9.6.3 Instrument/Device Uncertainty Equations Using the basic analysis methods discussed above, the uncertainties introduced into a loop measurement signal, by the individual instruments/devices within a loop, can be determined. The effect that a device has on a measurement signal is dependent on both the mathematical relationship between the input and output signals, and the amount of additional error the device imparts on the signal due to its own inherent error effects.

Loop devices such as amplifiers, multipliers, and square root extractors each impart a predictable level of error into a measurement. Non-linear devices, such as a square root extractor, not only increase potential error but can cause extreme variations in total error, due to mathematical manipulation of input error as part of the signal.

To aid in the development of actual loop error analysis, instrument/device uncertainty equations have been developed for the common devices. The equations define the output error, or uncertainty of a device based on its function, input error, input signal, and accuracy. These equations are intended to be used in the development of specific loop error analyses for the plants, as needed.

In the uncertainty equations contained in this section, the following codes are used:

A, B = Input signal(s) to the device a, b = Uncertainty in the input signal(s)

C = Output signal from the device c = Uncertainty in the output signal e = Inherent uncertainty of the device k1, k2 = Gain of the device inputs

1. Signal Converter The term, "signal converter" alludes to any loop transducer having an overall gain equal to unity (1.000), and an error free transfer function of:

Output = (k)[Input]

C=k*A The output uncertainty (c) for signal converters is expressed as:

c = +/- (a2 + e2)°5 (Eq. 36)

The output uncertainty equation is applicable to any component having a gain (k) equal to 1.0. All errors are expressed in terms of percent span.

Typical applications are transmitter, indicator, and isolation/buffer amplifier output uncertainties.

EGR-NGGC-0153 Rev. 12 Page 121 of 184

9.6.3 Instrument/Device Uncertainty Equations (cont'd)

2. Linear Signal Devices These are single input, fixed gain devices such as a common amplifier or ratio station. Linear signal devices have an error free transfer function of:

Output = (k)(Input)

C = k9A (From Section 9.6.3.1)

The output uncertainty (c) for linear devices is expressed as:

c = +/- [(ka)2 + e2]°'5 (Eq. 37)

This statistical uncertainty equation is applicable to any component having a fixed gain, where gain, k, is expressed as a multiple or fraction of 1.0, or unity gain. All errors are expressed as percent span. Any errors associated with the function of the device are included as part of the inherent device uncertainty (e).

3. Multiplier This type of device not only changes the amplitude of the input by a factor of the gain, but also by a factor proportional to the amplitude of a second input.

The module has individual gains for each input. The module has an error free transfer function of:

Output = (kl)(input 1)(k2)(Input 2)

C = (klA)(k2B) (Eq.38)

The output uncertainty (c) for multipliers is expressed as:

c = + [(kl k2Ab) 2 + (kl k2aB) 2 + (klk2ab)2 + e 2]°0 5 (Eq.39)

4. Divider A divider is used for applications such as a differential pressure signal which needs to be corrected for density changes in the flowing fluid, or liquid level.

The error free transfer function of a divider is:

Output = (kl)(Input 1)/(k2) (Input 2)

C = (klA)/(k2B)

The output uncertainty (c) for dividers is expressed as:

c = + kl/k2B(B 2-b 2) [(aB2)2 + (abB)2 + (ABb) 2 + (Ab)2 + e2]°5 (Eq. 40)

EGR-NGGC-0153 1 Rev. 12 Page 122 of 184

9.6.3 Instrument/Device Uncertainty Equations (cont'd)

5. Square Root Extractor A square root extractor module has a fixed gain of unity, and its output is the square root of its input. The error free transfer function of this module is:

Output = (Input)05 C = (A) 0 -5 The output uncertainty (c) for square root extractors is expressed as:

c =+/- [(a/2C) 2 + e 2]0 5 (Eq. 41)

The user of this equation should be aware that better error models are available and may be applicable for use.

6. Summing Amplifier A summing amplifier is a very high gain operational amplifier with a summing junction (resistor network) connected in front of its input. The gain factor (ki, k2, etc.) for an individual input is controlled by selecting an input resistor such that the feedback resistor value divided by the input resistor value provides the desired gain. The error free transfer function of a two input summing amplifier is:

Output = (kl)(Input 1) + (k2)(Input 2)

C = klA + k2B The output uncertainty (c) for summing amplifiers is expressed as:

c = +/- [(kla)2 + (k2b)2 + e2]°5 (Eq. 42)

The output uncertainty equation is applicable to any device required to add, subtract or compare two or more input signals. As a summer, the output signal will be equal to the algebraic sum of the input. In the case of a comparator (bistable), one signal (A) is a constant or variable (setpoint) with polarity opposite that of the process variable signal (B). The switching device is energized or de-energized when the two opposing signals approach the same amplitude.

I EGR-NGGC-0153 Rev. 12 Page 123 of 184

9.6.3 Instrument/Device Uncertainty Equations (cont'd)

7. Characterizer (Function Generator)

A characterizer module approximates a nonlinear mathematical function using multiple straight line segments. To operate on each segment of the nonlinear input, an adjustable gain (k1, k2,... kn) control is provided for each segment, and a separate gain (kO) is provided for the output amplifier.

Therefore, the error free transfer function is:

Output = kO[kl(input to segment 1) +

k2(Input to segment 2) +... +

kn(Input to segment n)]

C = kO[klA1 + k2A2 +. ... + knAn]

where, segment input (Al, A2,... An) is defined as the total input value minus the low breakpoint value of that segment.

It is important to note that when a specific function segment is in operation, only the gain for that segment of the function curve is to be used for error quantification. All other segments are not in operation, and thus the gains are zero.

The output uncertainty (c) for characterizers is expressed as:

c =[(kO kl al)2 + (kO k2 a2)2 +...+ (kO Kn an)2 + e2]°5 (Eq. 43)

For a characterizer, the errors associated with the segmented curve fit are included as part of the device error term (e).

8. Controllers Controllers by nature of their function, continuously correct a process to eliminate what they see as errors between a measurement and a setpoint.

The basic purpose of a controller is to force the measured variable to match the setpoint value, such that the setpoint minus measured value is equal to zero. Controllers will normally not impart additional significant error uncertainty into a loop unless improperly calibrated or tuned. The controller uses both internal and process measurement feedback to continually adjust its output signal, and related control elements to force the detected error to zero.

I EGR-NGGC-0153 Rev. 12 Page 124 of 184 1

9.6.3 Instrument/Device Uncertainty Equations (cont'd)

Error in the measured variable used by the controller can cause significant errors in a controller's final control point. However, the error present in the measured variable signal cannot be detected by the controller. Therefore, it becomes a proportional error in the final control point. If a measured variable contains a +1% error, the controller will decrease the variable by an amount equal to the error (-1%), and vice versa, due to negative feedback.

Once corrected, the final control point will be -1% below the actual desired point of control. The error could not be reduced unless a separate measurement loop, with no error, were available to check the actual control point.

9.7 Establishment of Uncertainty Allowances All of the potential error effects for a loop must be evaluated, and applicable ones incorporated into a loop error analysis. The analysis may cover the total loop from process to final output device, or only that portion of a loop needed to perform a specific function. The loop error analysis will establish the total uncertainty in a loop's measurement under the conditions of concern. From the total uncertainty, allowances can be established and used to delineate the required control limits.

These allowances define the boundaries of uncertainty a loop can possess under various operating conditions. Allowances are used to define the acceptable levels of performance an instrument/loop must meet to satisfy its functional criteria.

9.7.1 Graded Approach Apply a graded approach for the reconstruction of setpoints at the Nuclear Plants.

The concept behind "Graded Approaches to Setpoint Determination" is that all of the rigor and conservatism established in Ref. 2.3 is not warranted for all safety related setpoints in a Nuclear Plant. This graded approach consists of defining a classification scheme and then establishing a corresponding level of rigor for each of the different classification schemes.

All setpoints that have to be reconstructed will be reviewed on a case by case basis. While all uncertainties that effect the performance of a component shall be accounted for, a broader application of assumptions may be utilized to reduce unnecessary engineering effort for some categories of setpoints.

This determination of what a setpoint uncertainty calculation will consider should include, but not limited to the following: Safety Classification; Operational aspects; and Consequences of exceeding limits. The design engineer in conjunction with his/her supervisor will make these basis decisions before the calculations are started. Setpoints which should be eligible for less rigorous treatment are those not explicitly credited for in statistical/analytic plant design (accident) analyses, but are instead based on utility, industry and/or vendor experience, consistent with engineering judgment.

Documentation for the calculation can take the form of a formalized calculation, an EC response, or a data sheet that shows the basis for the setpoints.

EGR-NGGC-0153 1 Rev. 12 Page 125 of 184

9.7.2 Conditions for Which Uncertainty is Determined For the NGG plants, three design bases conditions of operation have been established for which instrument accuracy should be determined. The three conditions, calibration (reference), normal, and accident, define the bases and limits of the plant process, and environmental conditions, under which instrumentation must function. The three conditions are shown pictorially in Figure 9-12.

1. Calibration Conditions The calibration conditions are, essentially, the conditions under which an instrument/loop provides its highest degree of accuracy. Typically, no operational influences are imposed on the loop under these reference conditions. For calibrations, all ambient environmental parameters are considered to be within an instrument's/loop's relatively narrow range of reference operating limits. This accuracy is that of a loop immediately after calibration.

2. Normal Conditions The normal conditions define the environmental conditions under which an instrument/loop must function during normal plant operation. This condition includes anticipated operational occurrences, but does not include design bases accident conditions. The normal conditions are defined as the normal condition maximum values.

3. Accident Conditions The accident conditions define the maximum or worst case process and environmental conditions under which an instrument/loop must function.

This condition includes those uncertainties expected to exist at the time of a trip or indicator based action. The accident conditions are defined in each plant's FSAR.

9.7.3 Loop Error Determination The calculation of instrument loop error must utilize a clear, and straightforward process. The calculation should coincide with a loop's layout from process measurement to the final output device(s) of concern. The terms for each device in a loop must be clearly identified and classified for proper inclusion in the error formula. For the NGG error calculations, a set of standard abbreviations has been developed to identify the various error components of a loop. This nomenclature is provided in Section 3.0 of this document. All calculations should use these abbreviations for consistency and ease of identification of terms contained within this procedure.

IEGR-NGGC-01 3 1 Rev. 12 1 Page 126 of 184

9.7.3 Loop Error Determination (cont'd) i--" - - ..... .... ACCIDENT CON~mONS UPPER LIMIT S- -.... - NORMAL OPERATING CC RANGE OF REFERENCE NOTS N OPERATtNG CONDITION Mo z I4fWOOu Fýgkr=~ Swpii U

UPPER LtMIT QI 0 AU 2

z0u a 'S. -' tREFEPINCE OPERA1,NG CCNDmONSý f ti NOMINAL REFERENCe a z p OPERAT*NG C0NOMONS 0

cc

( LOWER UMrT tRiFERENCa OPERA7NG CDNDITtONS) 4 LIJ U

'C 2

U 2

LOWER LIMIT

- --~- -NORMAL OPERAflNG COKorrroNS

- - - -- -ACCIDENT CONDITIONS FIGURE 9-12 DIAGRAM OF INSTRUMENTATION OPERATING CONDITIONS I EGR-NGGC-0153 Rev. 12 Page 127 of 184 1

9.7.3 Loop Error Determination (cont'd)

The basic process for calculating loop errors will involve the separate calculation of individual device uncertainties, and the calculation of partial loop error values at the output of each loop device. This process is shown graphically in Figure 9-13.

mEroF1E POFJ-fT7hXaR~ Sr1C 0 [IND INO PE 23 8C INd. '5 PME

• Process Measurrnent Error wito error a, PE. P*rmary Element With error a 2 TRX - Tranmirtter with error 0 3 SC - Sigrnal Converter with error e IND - Indicator with error a The Lowr case I and o suffix designate the inp,*t end0 output errors for Nhe devices FIGURE 9-13 TYPICAL LOOP ERROR DIAGRAM A loop error analysis should always start with an evaluation for process measurement errors as discussed in Section 9.3. Even if no process measurement error exists, a statement to that affect should be noted in the calculation. The process measurement error (PME), el, would take the form of, ei = +/- PME + PMEb÷ - PMEb (Eq. 44)

Where,

+/- PME are the random components of PME, if any PMEb are the bias error portions of the process measurement, if any Bias error term abbreviations will use a lower case "b" as a suffix to designate bias.

Random error term abbreviations will not have a random suffix designator.

I EGR-NGGC-0153 Rev. 12 Page 128 of 184

9.7.3 Loop Error Determination (cont'd)

Since PME is the starting point of the loop analysis, PMEo = el In general, no additional error will exist between PME and the primary element (PE). Therefore, PEi = PMEo The PE error, e 2 , would then be calculated, e2 = +/-[RA2 + (other error effects)2]° + PEb÷ - PEb- (Eq. 45)

Where, RA is the primary element's reference accuracy PEb are the bias error portions of the primary element, if any.

The PE error, e 2 , would then be combined with the PEi error to establish the primary element output error, PEo.

PEo = +/- [PEi 2 + e 2 2]0 .5 + PMEb÷ + PEb÷ - PMEb - PEb-If no additional error is identified between the PE and the transmitter (TRX), then TRXi = PEo The TRX error, e 3 , would then be calculated from an equation such as, e3 = +/-[(MTE + CAL) 2 + DR2 + TE 2 + RA2]0 5 + TRXb÷ - TRXb (Eq. 46)

The actual error components which make up the total transmitter error will vary based on functional requirements, and reference operating conditions. The individual error components are discussed in Section 9.4. For this discussion, we will assume that no bias error exists for the transmitter, thus allowing the bias terms to be dropped from Equation 46.

I EGR-NGGC-0153 1 Rev. 12 Page 129 of 184

9.7.3 Loop Error Determination (cont'd)

The TRX error, e 3 , would then be combined with the TRXi error to establish transmitter output error, TRXo. The transmitter device equation from Section 9.6.2.3 is used to combine the errors.

TRXo = +/-[TRXi2 + e 32]°5 + PMEb÷ + PEb÷ - PMEb - PEb (Eq. 47)

The output error of one device will generally equal the input error of the next device in a string. The exception occurs when an additional error term such as IR comes into play between two devices. In this situation, the signal conditioning equipment input (SCi) is, SCi = TRXo + IRb÷ (or - IRb)

In an actual loop analysis, only one lRb component would exist (+ or -) since IR does not exhibit both a positive and negative component for the same loop.

The process of calculating individual device error terms and combining them with the partial loop error term would continue through to the device of concern.

Assuming no bias errors existed for SC and IND, INDo = +/-[INDi2 +e 52]°5 +lRb÷ +PMEb÷ + PEb÷ - PMEb- - PEb- (Eq. 48)

All loop and device error terms shall be expressed in the same basis (i.e. units) prior to combining the error terms. Typically, the simplest basis to express the errors in is percent of span. Careful evaluation of the individual error terms is required to ensure that consistent units are maintained throughout the calculations.

Examples of various expressions of error terms and conversion values for percent of span are shown in Sections 9.3 through 9.5. Attachment 3 shows techniques for converting from other bases to percent span.

If it is questionable whether a particular module or uncertainty is applicable because it may not have an appreciable amount of error associated with it, the calculation does not need to consider the term as long as acceptable justification is documented within the calculation for the term's exclusion. Due to the statistical nature of combining the errors, if a random independent uncertainty is one-fifth or less than the largest random independent uncertainty, it may be disregarded.

However it is important to document within the calculation why it can be disregarded.

When a loop contains a non-linear device, the loop errors must be calculated for specific values of span downstream of the non-linear device. For a non-linear device, such as a square root extractor, the output error is proportional to the magnitude of the true signal. This non-linearity can be seen in the example below.

EGR-NGGC-0153 1 Rev. 12 Page 130 of 184 1

9.7.3 Loop Error Determination EXAMPLE: Assume we have a flow measurement loop containing a square root extraction module. The loop is calibrated such that an output signal of 0-4000 GPM is generated for an input of 0-100 in WC.

The basic flow to differential pressure relationship is:

F = k(DP)°'5 where, k is a constant for a particular loop.

For this example k is:

k = F/(DP)°5 = 4000/(100)°5 = 400 Now if we have an error in the measurement upstream of the square root extractor, this error is seen as a change in the DP input.

Using the basic flow/DP relationship, a table can be made showing the effect of a

+2% DP span error on the flow measurement.

Factual F (% D DP (% DP+2% F reading F error F error (%

(GPM) flow) (inWC) DP span) error (GPM) (% flow reading)

(inWC) span) 0 0 0 0 2 565.7 14.1 8 800 20 4 4 6 979.8 4.5 22.5 2000 50 25 25 27 2078.5 2.0 3.9 3200 80 64 64 66 3249.6 1.2 1.6 4000 100 100 100 102 4039.8 1.0 1.0 Note that as the true flow signal increases, the effect of the constant +2% DP span error decreases due to the basic non-linear function of square root extraction.

Therefore, the error in the output of a non-linear device should be calculated for specific values of output span unless the largest error of the span is used.

I EGR-NGGC-0153 Rev. 12 Page 131 of 184 1

9.7.4 Uncertainty Allowances The uncertainties determined to exist in a loop are used to establish allowances for that loop. The allowances define the bounds within which a loop and/or its components can operate and still satisfy their design functions. Multiple allowances exist for each instrument loop. These allowances, also known as tolerances, or performance limits, are provided to aid in the calibration, and maintenance of the instrument loop.

1. Tolerances Tolerances, as discussed in Section 9.5.1.1, are allowances established on specific loop components, groups of components, or the total loop, and which are used to aid in the maintenance and calibration of the loop.

Tolerances define the limits to which an instrument loop must be calibrated to assure proper loop function. Tolerances allow for the basic inaccuracy of a device, or group of devices, and establish the acceptable level of performance of the components being calibrated. Tolerances are defined under the reference conditions only, since calibration is performed under these conditions. For an instrument loop, the various tolerances are,

• Device Tolerance - the calibration tolerance of a specific component or device within a loop. The device tolerance is equal to the reference accuracy of the device, plus any device setting tolerance.

• Loop Tolerance - the total loop calibration tolerance which defines the basic accuracy of a loop. The loop tolerance is established based on the calibration tolerances of the devices which make up the loop.

" As-Found Tolerance - the generic term given to the bounding tolerance allowed between calibrations of a defined device, loop segment, or loop.

The As-Found tolerance establishes the limit of error the defined device(s) can be found to have during surveillance testing, and still be considered to be in calibration. The As-Found tolerance accounts for the calibration tolerances, drifts, and M&TE uncertainties of the device(s) under test. Note that if only the rack instruments through the final device is being tested, the sensor uncertainties should not be included.

I EGR-NGGC-0153 Rev. 12 Page 132 of 184 1

9.7.4 Uncertainty Allowances (cont'd)

As-Left Tolerance - the generic term given to the calibration tolerance allowed for a defined device, group of devices or loop. For a single device, the As-Left tolerance is the same as the device tolerance discussed above. For a total loop, the As-Left tolerance is the same as the loop tolerance discussed above. The term is also commonly used to define the calibration tolerance allowed in a loop segment which is periodically tested. The As-Left tolerance accounts for the calibration tolerance of the loop segment. The As-Left tolerance establishes the required accuracy band within which the loop segment must be calibrated.

2. Loop Allowances An understanding of the concepts of allowances, and tolerances, in instrument loops is essential to understanding loop performance, and capabilities. The allowances, and their associated limits, establish the performance characteristics of an instrument/loop, which in turn establishes the design relationships between the loops and plant control.

a. Basic Relationships Figure 9-14 shows the basic relationship of allowances for a typical instrument or loop. In Figure 9-14, the horizontal center line marked "desired value" represents a measurement value without error. This desired value could be the output of any device, group of devices, or loop. The true output will vary about the desired value based on the accuracy of the device(s). This variance is encompassed by the As-Left tolerance for the device(s). For a general measurement process, the As-Left tolerance is typically applied both above, and below, the desired value, since the true output varies randomly about the actual value.

The As-Left tolerance is normally equal to the reference accuracy, or the combination of reference accuracies for the device(s). A device setting tolerance, which is a value used to increase a device tolerance above the reference accuracy, may also be applied as desired.

However, for the remaining discussions, no device setting tolerances will be assumed to exist.

I EGR-NGGC-0153 Rev. 12 1 Page 133 of 184 1

9.7.4 Uncertainty Allowances (cont'd)

REQUmIRD FOUND UPPER LIMIT Cal. Tofwo~nca

+ *,== == * ' ,*Cal. Tolerance LLcaU DES VALUE REQUIRE LEFT LOWER UMIt REQUIRE FOUND L.OWk uMrr FIGURE 9-14 TOLERANCE RELATIONSHIPS The As-Left tolerance provides calibration personnel with a measurable calibration band, within which the device(s) must be adjusted. In addition, the As-Left tolerance allows a set of acceptable performance limits to be set, against which actual performance can be monitored. The acceptable performance limits are actually beyond the As-Left tolerance by an amount equal to the MTE error effect.

As discussed in Section 9.5.1.2, the MTE error effect is an error due to calibration equipment inaccuracies, which is not discernable to a calibration technician. As such, it cannot be eliminated. Therefore, actual performance limits for the device(s) being calibrated are equal to the As-Left tolerance plus MTE effect. The acceptable performance limits define the true uncertainty in an output for plant reference conditions (i.e. the highest accuracy obtainable). However, the device(s) must be left within the As-Left tolerance band, as indicated by the technician's MTE. If the performance of the device(s) remains within these limits, no further calibration adjustment would be required.

Device(s) found outside of the As-Left tolerance would require recalibration to bring the errors back within the tolerance.

I EGR-NGGC-0153 Rev. 12 Page 134 of 184

9.7.4 Uncertainty Allowances (cont'd)

Because all devices experience drift, as discussed in Section 9.4.2, the additional tolerance value of As-Found has been created. The amount of drift applies only to that which can occur between successive periodic calibrations. The As-Found tolerance establishes what can be called "required limits of performance" on the device(s). These required limits define the maximum amount of error allowed during normal plant operation. Any device whose error exceeds the As-Found tolerance should be evaluated for possible corrective action. The As-Found tolerance can provide a means to verify the operability of the device(s), at any time after calibration.

The As-Found tolerance, as indicated, includes the As-Left tolerances (usually equal to the Reference Accuracy), the MTE error, and the drift (DR) of the device(s), and are combined as discussed in Section 9.5.1.1. If the equipment is tested on a frequency greater than the normally scheduled calibration intervals, the drift can only account for the time between successive surveillance tests. For many safety-related loops, the surveillance test for accessible components, such as those located in the rack, are required to be performed on a monthly basis.

It is important to note that As-Left and As-Found tolerances can be established for a single instrument, or device, a select group of devices, or a total loop. The tolerances only encompass inherent instrument inaccuracies, and do not account for inaccuracies caused by varying external influences (i.e., ambient environment effects, PME, IR, etc.).

[BNP - Only one tolerance is typically provided within the calibration procedures (MSTs, PICs, LPs), and it represents the As-Left tolerance.

A separate As-Found tolerance for each device being calibrated is usually not delineated within the procedures. Instead, the procedures specify that any device found to be outside the (As-Left) tolerance by more than twice the tolerance, shall have a Calibration Nonconformance Action Form (CNAF) prepared. The "twice the tolerance" criteria acts as an As-Found tolerance to account for drift of the devices, and if devices are found outside of this tolerance, they must be evaluated for operability via the CNAF.

I EGR-NGGC-0153 Rev. 12 Page 135 of 184 1

9.7.4 Uncertainty Allowances (cont'd)

The manner in which BNP utilizes the "twice the tolerance" criteria to act as an As-Found tolerance is a generic method of providing two tolerances. However, the method must also be used with caution.

When establishing the setpoints and allowable values discussed in Section 9.8, the As-Found tolerance may be larger than just the As-Left tolerance plus the drift. If so, this must be accounted for within the individual setpoint and allowable value determinations. Otherwise, a device could drift within the "twice the tolerance" band yet potentially be beyond its allowable value.

Consider the following example, A pressure switch at BNP has a reference accuracy (and calibration tolerance) of +/-0.50% span. The drift value for the pressure switch, as provided by the vendor is +/-0.50% span per 6 months. The MTE error for calibrating the pressure switch is +/-0.25% span. The existing allowable value is equivalent to 1.0% span, and the pressure switch is required to be calibrated every 18 months +/- 25%.

In performing a calibration of the pressure switch, the As-Found condition would have to be greater than twice the tolerance, or greater than 1.0% span (i.e., 2

• 0.50%) before a CNAF would be initiated.

However, at greater than 1.0% span, the existing allowable value would be exceeded. Thus, using the "twice the tolerance" criteria for As-Found values provides the potential for exceeding the allowable value.

If the allowable value had been established considering the reference accuracy, the drift, and the MTE, it would have been determined as follows, 2

AV = [(CAL)2 + (DR) 2 + (MTE) ]v, First, the drift would be determined for the 18 months +/- 25%. Using the SRSS method, the 18 months +/- 25% is approximately equal to 4 six month periods. Thus, drift would be determined as, DR = [(0.5)2 + (0.5)2 + (0.5)2 + (0. 5 )2]/ 2 DR = 1.0%

I EGR-NGGC-0153 Rev. 12 Page 136 of 184

9.7.4 Uncertainty Allowances (cont'd)

The allowable value would then be calculated as, AV = [(0.5)2 + (1.0)2 + (0.25)2]/

AV= 1.15%

Even though the existing allowable value was 1.0% span, it should probably be increased, via the proper procedures, to at least 1.15%

span. Otherwise, the switch may be found to exceed the allowable value more often than would normally be expected.

In order to prevent the As-Found value from being less than twice the tolerance but greater than the allowable value at BNP, the actual allowable values are shown on the calibration sheets and the technician is instructed to verify the As-Found are less than the allowable values. However, it is important that the preparer of any uncertainty calculation understand the way that BNP treats the "twice the tolerance" criteria and ensure that if a value is found up to twice its tolerance, it would still be considered operable in the field.]

[CR3 - Generally both an As-Found and an As-Left tolerance are specified within the calibration procedures. For those loops with allowable values, if the As-Found tolerance is met, then the loop is operating within its allowable value. If the As-Found tolerance is exceeded, then a condition report must be initiated to evaluate whether or not the allowable value was also exceeded. This is because, in some cases, there may be sufficient margin between the trip setpoint and the allowable value such that the As-Found tolerance can be exceeded without exceeding the allowable value. A condition report must also be initiated if the loop cannot be calibrated to within the As-Left tolerance.]

[HNP - Generally only one tolerance is specified within the calibration procedures, and it acts as the As-Left tolerance. The devices with allowable values have the allowable values denoted on the individual calibration sheets. All As-Found and As-Left values must be within the allowable values to meet the calibration requirements of the procedure.

If the As-Found values are found to be within the allowable range, then no adjustment is necessary. For Q-Class A transmitters an Allowable Drift tolerance is given in addition to the allowable range. The I EGR-NGGC-0153 1 Rev. 12 Page 137 of 184

9.7.4 Uncertainty Allowances (cont'd) transmitter allowable drift tolerance (which may be single sided) is defined by the (S) term in Technical Specification Equations 2.2-1 and 3.3-1. When the transmitter allowable drift tolerance is exceeded, then a Condition Report (CR) must be initiated to evaluate Technical Specification drift. This report provides a documented mechanism for evaluating the out of tolerance condition. For all other devices found to be out of tolerance, the device is calibrated back to within tolerance and the Unit SCO notified.

For all other devices without any criteria for assessing out of tolerance values, the device may have drifted beyond what was expected but it does not create a plant operability concern. It may create a device operability concern, and this determination is left up to the Unit SCO to make an evaluation. If calculations quantify the value a device is expected to drift, then this value should be provided to the plant. This will yield a quantifiable assessment of out of tolerance conditions to more easily identify potential problem devices and those whose out of tolerance condition is within the expected range of drift.]

[RNP - Only one tolerance is specified within most calibration procedures, and it acts as the As-Left tolerance. If the As-Found value is found to be outside the tolerance, it is calibrated back to within tolerance. The calibration records are then reviewed by responsible personnel. It is the responsibility of these reviewers to evaluate any device that had exceeded its tolerance.

Using this method, evaluating out of tolerance conditions is rather subjective. If calculations quantify the expected drift for a device, then this value should be provided to the Maintenance group. This will afford the reviewers of calibration data with an "As-Found" value that will allow a quantifiable assessment of which out of calibration values present a problem and which out of tolerance values are justified.]

b. Loop Relationships Normally, the calibration of instrument loops (or channels) is divided into three major parts due to the general inaccessibility of loop field sensors for calibration during plant operation. In order to be able to verify loop performance, the loop is divided into a section which is required to be tested and a non-testable section. The section which is IEGR-NGGC-0153 I Rev. 12 Page 138 of 184

9.7.4 Uncertainty Allowances (cont'd) required to be tested generally includes the portion of the loop downstream of the sensor, to a specific loop output. The non-testable section generally contains only the field sensor. Actual division of the loop is as defined in the applicable loop calibration procedures.

The section of the loop required to be tested, the individual loop devices, and the loop as a whole make-up the three parts for calibration. Each part has an associated set of tolerances.

Individual device tolerances define the performance requirements for each of the devices within a loop. As discussed in Section 9.7.4.2.a, each device has an As-Left tolerance and may have an actual or implied As-Found tolerance. The As-Left tolerances are assigned for a device as discussed in Section 9.5.1.1. If an As-Found tolerance was to be assigned to a device or simply used in assessing an out of tolerance condition, it would be determined as shown below:

Device Tolerance As-Found = +/- [(As-Left) 2 + (DR) 2 + (MTE) 2 ]°5 (Eq. 49)

The tolerances for the section of the loop required to be tested define the requirements for a group of devices. This group can consist of a number of loop devices and is usually defined by the group of devices tested periodically to verify acceptable loop operation. The tolerances for a group of devices is defined as:

Group Tolerance 2 205 As-Left = + [As-Left 12 + As-Left2 +. . . + As-Leftn ]

(Eq. 50)

Where, As-Left, through As-Leftn represents the As-Left tolerances of the individual devices which make-up the defined group 1 through n.

As-Found = +/-[As-Left 1 2 + DR 1 2 + MTE 1 2 + As-Left 22 +

DR2 2 + MTE 22... + As-Leftn2 + DRn2 +

MTEn2]05 (Eq. 51)

Where, As-Lefti, DRi, and MTEi are the As-Left, drift, and MTE error, respectively, for each device 1 through n.

I EGR-NGGC-01 53 Rev. 12 Page 139 of 184

9.7.4 Uncertainty Allowances (cont'd)

Figure 9-15 shows the relationship of the group tolerances to the final set of tolerances, the loop tolerances. The loop tolerances, as discussed in Section 9.7.4.1, define the performance requirements for the loop as a whole. The loop tolerances are calculated in the same manner as defined above, for a group of devices, but include all devices from sensor to final loop output device.

The As-Found tolerance for a loop, establishes an important performance limit for safety-related instrument loops. This limit, which we will call the "Channel Operability Limit", is the limit for verifying operability of a safety-related loop. A safety-related loop found outside of its channel operability limit would normally be declared inoperable, and may cause the initiation of a Licensee Event Report (LER) to the NRC.

IEGR-NGGC-0153 1 Rev. 12 1 Page 140 of 184

9.7.4 Uncertainty Allowances (cont'd)

CHANNEL OPERABITY UMrr

/ [upper)

+/-

/ LOOP SEGMENW Cal. Tol"=ea

.- +odft

+

1K~ a C

S U

'5 PI / I-U (2ii 4 CHANNELQ OPfABILTY UMIT

[lower)

FIGURE 9-15 LOOP TOLERANCE RELATIONSHIPS IEGR-NGGC-0153 I Rev. 12 Page 141 of 184

9.7.4 Uncertainty Allowances (cont'd)

c. Setpoint Relationship The application of tolerances, or allowances, in loops containing setpoints, is of particular importance for a nuclear power plant. This is particularly true of the numerous setpoint functions in quality-related applications. For loops containing setpoints, the output of the setpoint device defines the end of a complete loop or channel. This division allows each setpoint/setpoint device to be treated as a separate loop or channel.

The loop is normally divided in the same manner as discussed in Section 9.7.4.2.b, with the setpoint device included in the testable section of the loop. This division allows for the periodic testing of the loop's setpoint actuation value.

The primary function of setpoint loops is to actuate within an acceptable process variable range. This function leads to a slightly different treatment of tolerances for setpoint loops. Instead of being concerned with the accuracy of the loop measurement (i.e., the variance band around the true value), the concern focuses around when the loop will actuate with respect to a true process value limit of concern. Because of these differences, tolerances for setpoint loops will be discussed in detail in Section 9.8.

9.8 Setpoint Determination Development and maintenance of setpoints is an essential prerequisite to the safe and efficient operation of plant systems and equipment. Properly selected setpoints provide early warning of pending problems, correct abnormal situations, and protect the public, plant personnel, and equipment, without unduly compromising the operability, or efficiency, of the plant.

Keeping this in mind, the purpose of each setpoint must be satisfied by the final value established. Setpoints for alarms, for example, should have sufficient margin from a system trip point, or safety limit, to allow an operator time to take corrective action. An alarm, coincident with an equipment trip setpoint, may serve no useful function. However, when attempting to achieve this margin, alarm and plant trip points should not be set so close to normal plant operation limits that they cause nuisance alarms and spurious trips.

IEGR-NGGC-0153 I Rev. 12 1 Page 142 of 184

9.8 Setpoint Determination (cont'd)

An instrument loop using many components and functional modules can possess large uncertainties, even though the accuracy rating of the individual components may be reasonable. Therefore, for all instrument loops, and particularly for multi-component instrument loops, setpoints should be located in that portion of the instrument range which has the required accuracy. It is accepted practice that setpoints should generally not be located in the extreme upper or lower portions of the instrument range.

Figure 9-16 shows the relationships between the various parameters that make up, or define, safety-related setpoints and related allowances. Each of these parameters will be discussed in more detail in the following paragraphs.

9.8.1 Limits The Technical Specifications for each of the NGG plants are governed by 10CFR50.36, which defines two terms, safety limit (SL) and limiting safety system setting (LSSS), and their relation to instrumentation and control design bases.

These terms, as well as two other associated terms, are described below.

1. Safety Limit Plant safety limits (SL) are design limits placed on important process variables to maintain the integrity of plant barriers designed to prevent the release of radioactivity. The limits are established by various regulatory requirements, industry design standards, such as ASME, and initial plant design assumptions bases. The actual plant systems and equipment must be designed such that the plant safety limits are not exceeded during the worst case accident conditions.

Safety limits are the absolute limits. To exceed them, risks incurring uncontrolled releases of radioactivity. In order to ensure they are never reached or exceeded, each plant has conducted in-depth analyses of the accidents and transients postulated to occur for that facility. Such analyses are described in Chapter 15 of each plant's FSAR, as well as in supplemental analyses such as reload reports.

I EGR-NGGC-0153 Rev. 12 Page 143 of 184

9.8.1 Limits (cont'd)

SAFETY uMrr I

ANALYTICAL UMrr I

CHANNEL OPERABILITY LIMIT ALWOWABI.. VALuE Lurlm ntLdaA~uireo I&mrtum Larqn

--- n-LIPPER MEPOINT LIMIT U

Auujumgn~

K V

-C i I '

~P~iu~aU OPERATIONAL UMIT NORMAL OPERATION FIGURE 9-16 LOOP / SETPOINT RELATIONSHIPS The safety limits are specific values of plant process variables, such as pressure or temperature. They may also be defined by directly calculated process conditions, such as the departure from nuclear boiling ratio (DNBR).

I EGR-NGGC-0153 Rev. 12 Page 144 of 184 1

9.8.1 Limits (cont'd)

2. Analytical Limit The accident analyses conducted for each plant (fuel reload analyses and fuel vendor accident analyses), assume protective trips are initiated at certain conservative values prior to a variable reaching the safety limit. Both the assumed values that form the model for such an analyses, and the maximum value that process variables attain in such an analysis, are referred to as analytical limits (AL).

As shown in Figure 9-16, the safety limit is the uppermost limit that cannot be exceeded without risking potential radioactive releases to the public. To prevent safety limits from being reached, analytical limits are established prior to the safety limits, and are obtained from the results of the fuel vendors fuel reload analyses or accident analyses or from fuel vendor assumed values.

The region between the safety limit and the analytical limit is to provide an additional margin of safety and/or to accommodate any rapid "spikes" or transient overshoots beyond the postulated conditions.

It is important to note that there are relatively few safety limits. Typically, there are numerous analytical limits established, for several types of process conditions, to prevent exceeding a single safety limit. Thus, there may be analytical limits established for RCS temperature, pressurizer level, core power, etc. to prevent exceeding the safety limit associated with RCS pressure.

The determination of Analytical Limits (AL) is the responsibility of the Engineering Discipline which is responsible for the plant system associated with the instrument loop. Each analytical limit and its basis, shall be justified through an engineering calculation or other appropriate means. The value for the analytical limit and the bases for its determination shall be documented in the uncertainty/setpoint calculation.

An evaluation shall be made by the appropriate Engineering Discipline to determine the analytical limit. This evaluation shall take all viable actions necessary to establish the analytical limit and its bases. Such actions may include, but not be limited to - reviewing fuel vendor fuel reload analyses, fuel vendor accident analyses, plant safety analyses, reviewing existing calculations pertaining to the system/instrument loop of concern, reviewing correspondence files with the appropriate vendor, contacting the vendor and/or performing an audit of their files, obtaining and reviewing the original design specifications and/or associated data sheets, contacting other utilities to ascertain what relevant information they may have, and reviewing start-up test reports.

EGR-NGGC-0153 Rev. 12 Page 145 of 184

9.8.1 Limits (cont'd)

The Technical Specification value may be the only limiting value available. As a last resort, the Technical Specification value could be taken as the analytical limit. However, this would be a very conservative assumption and could result in new setpoints and allowable values closer to the normal operational limits.

As discussed later in Section 9.8.2.2, moving a setpoint too close to the normal operational limits is a legitimate safety concern. Thus, using the Technical Specification value as the analytical limit should be avoided, and only implemented after it has been properly evaluated as to its effects on normal operation and plant safety.

3. Limiting Safety System Setting The second term discussed in 10CFR50.36 for use within the Technical Specifications is the Limiting Safety System Setting (LSSS). The LSSS, as defined in Section 3.0 is, "Settings for automatic protective devices in nuclear reactors that are related to those variables having significant safety functions. A LSSS is chosen to begin protective action before the analytical limit is reached to ensure that the consequences of a design basis accident are not more severe than the safety analysis predicted."

The LSSS is comprised of two components - the trip setpoint and the allowable value. The trip setpoint is the predetermined value at which a device changes state to indicate that the quantity under surveillance has reached the selected value. The allowable value is the limiting value that the trip setpoint can have when tested periodically, beyond which the instrument channel must be evaluated for operability. Thus, the trip setpoint corresponds to the nominal value at which a device is set and expected to change state.

The allowable value is the maximum region associated about a setpoint that is still considered to be acceptable for the instrument to fulfill its safety function without risking exceeding the analytical limit. The safety limits and LSSSs are typically defined in the Technical Specifications and the analytical limits are typically defined in the fuel vendor fuel reload analyses, fuel vendor accident analyses, or the FSAR.

To further illustrate the relationships between the terms discussed above, the RCS Pressure for Harris will be used as an example (Note - any associated head effects have been ignored in the following example for simplicity of illustration). Technical Specifications 2.1.2 define the RCS Pressure safetY limit as 2735 psig.

EGR-NGGC-0153 I Rev. 12 Page 146 of 184

9.8.1 Limits (cont'd)

Within Table 15.0.6-1 of the Harris FSAR, the high pressurizer pressure trip setpoint is assumed to be 2445 psig for the safety analyses. This is the analytical limit. To ensure that the analytical limit is not exceeded, Technical Specifications 2.2 lists the limiting safety system setting. The limiting safety system setting is composed of the trip setpoint and the allowable value. The trip setpoint is identified as 2385 psig and the allowable value is identified as 2399 psig within Table 2.2-1 of the Harris Technical Specifications. Thus, as long as the trip setpoint for RCS Pressure, and other process variables, are maintained below their allowable values, the safety analyses have ensured that the maximum RCS Pressure achievable under accident conditions will be significantly below the safety limit.

The limits discussed above apply to instrument loops with a protective function. The limits associated with control and indication design bases are treated similarly. Since the control and indication functions are typically not included in the accident analyses, no safety limits, analytical limits, or limiting safety system settings pertain to their settings. However, there is usually a limit associated with control and indication functions and it is frequently referred to as the design limit.

The design limit for control and indication functions is comparable to the analytical limit for protection functions. It is a limit for a measured or calculated variable to prevent undesired conditions such as equipment damage, spurious trips, or challenges to plant safety signals. The design limit may be a calculated value for a particular system or application or it may be a limit specified by the vendor.

The indicated value is like a setpoint except a setpoint results in an automatic action and an indicated value results in a manual action in response to an indication. Depending on the importance of the setpoint or indicated value, corresponding allowable values may also be established similar to the Technical Specification allowable values for the protection functions.

When identifying a limit associated with a particular instrument, it is thus important to understand what that limit represents. It must be clearly understood whether the function is for protection, control, or indication purposes. Once that is confirmed, it must be further clarified as to the type of limit represented by the value and how it relates to the instrument loop's design basis. Otherwise, the design basis may be misinterpreted and/or misapplied.

EGR-NGGC-0153 Rev. 12 Page 147 of 184

9.8.1 Limits (cont'd)

4. Channel Operability Limit Although not addressed in the Technical Specifications, another limit exists for determining operability of an instrument channel. This limit, called the Channel Operability Limit (COL), is the loop As-Found tolerance (plus any associated margin) as discussed in Section 9.7.4.2.b. It would be added or subtracted from the setpoint in a manner similar to the allowable value.

Per the Technical Specifications, an instrument loop whose As-Found setpoint exceeds the allowable value in a non-conservative direction must be declared inoperable, and corrective actions taken. However, this determination does not always conclusively demonstrate that the actuation would have occurred at a non-conservative value. This is true because the allowable value only accounts for drift in the tested instruments in the loop, which typically does not include the sensor.

The channel operability limit includes the whole loop, from sensor to final actuation device. This limit includes a larger total allowance for drift, which gives rise to the possibility that unused drift in the sensor may offset the drift incurred in the testable portion of the loop. Therefore, if it is feasible to test the entire loop when an allowable value is exceeded, a reportable condition may not exist, as long as, the As-Found allowance for the loop is not exceeded. However, corrective actions must be in accordance with the Technical Specifications when the allowable value is exceeded, regardless of whether or not the channel operability limit was exceeded.

If it is not feasible to test the entire loop, it may be possible to analytically determine whether the channel operability limit would have been exceeded.

5. Operational Limits These operational limits (OL) are the minimum/maximum values within which a process should be maintained during normal operation. A margin should be maintained between the operational limit(s), and the setpoint limit(s) to allow flexibility for plant maneuvering.

IEGR-NGGC-0153 1 Rev. 12 Page 148 of 184

9.8.2 Setpoints As discussed above in Section 9.8.1.3, trip setpoints or setpoints (SP) typically refer to an automatic action in response to a process variable achieving or exceeding some predetermined value. An indicated value is similar except that the action taken is manual in response to an indication. The discussions below will refer to the term "setpoint", however, it is intended that such discussions apply to any type of setpoint or indicated value.

1. Types of Setpoints Setpoints are generally characterized as one of three types: rising, falling, and variable. The setpoint is categorized based on (1) the direction from which a process variable approaches the setpoint, and (2) whether the setpoint has a fixed value or varies as a function of another variable (i.e., time, power, level, temperature, etc.)

Rising setpoints are associated with a process that has a high limit. Action is initiated when the process variable increases to a point equal to, or greater than, the setpoint.

Falling setpoints are associated with a process that has a low limit. Action is initiated when the process variable decreases to a point equal to, or less than, the setpoint.

Variable setpoints can be of either a rising or falling type. The distinction is that in lieu of a fixed value, the setpoint will vary as a function of another parameter or a preset program. A variable setpoint will always be either a rising or a falling setpoint over its entire range. It cannot change from a rising to a falling, or vise versa. Identification of the setpoint type is an important factor when assessing the impact of setpoint inaccuracies.

Figure 9-17 graphically illustrates both a rising and falling setpoint, and the treatment of loop uncertainties. For a rising setpoint, a conservative setting would be less than the actual limit. Therefore, the loop uncertainties must be subtracted from the analytical limit. For a falling setpoint, a conservative setting would be higher than the actual limit. Therefore, the loop uncertainties must be added to the analytical limit.

IEGR-NGGC-0153 Rev. 12 1 Page 149 of 184

9.8.2 Setpoints (cont'd)

2. Calculating Setpoints Sections 9.3, 9.4, and 9.5 discussed the various components of a loop's uncertainty, and Section 9.6 described how to combine those uncertainties to determine a total loop uncertainty (TLU). The TLU is the maximum potential deviation in the positive and negative direction about the true value of a variable which the loop could consider as the true value of the variable. This can be expressed mathematically as:

LV = TV +/- TLU (Eq. 52)

Where, LV Loop Value TV True Value TLU Total Loop Uncertainty HIGH UIMrr

.4-... ALLOWABLE VALuE AISING ACTUATION EXAMPLE SETPOINT

/

NORMAL OQFGIATtNG UMrr SEMI~NrT FAL.UNG ACTUATION EXAMPLE ALLOWAGLE VALuE-4.-4a.

LOW ANALYTICAL I uMrr FIGURE 9-17 SETPOINT TYPES I EGR-NGGC-01 53 Rev. 12 Page 150 of 184

9.8.2 Setpoints (cont'd)

For calculating setpoints, we have determined the total loop uncertainty but we do not know the true value of the process. What we do know, however, is that the loop value has been analyzed not to exceed a certain value, i.e., the analytical limit (or design limit as applicable). Therefore, we can let the loop value equal the analytical limit, AL:

AL = LV (Eq. 53)

Substituting into Equation 52, AL = TV +/- TLU (Eq. 54)

For an analytical limit that is higher than the true value of a variable, the equation becomes, AL = TV + TLU (Eq. 55)

Similarly, for an analytical limit that is lower than the true value of a variable, the equation becomes, AL = TV - TLU (Eq. 56)

The true value in both these equations represents the maximum true value that the actual process variable may have, which when combined with the maximum expected deviation, will still not exceed the analytical limit. It also represents the maximum value which a setpoint can be assigned and the process be ensured to respond as it was analyzed. As described later in Section 9.8.3.1, additional margin may also be used to position the setpoint further away from the analytical limit.

Assuming that no additional margin is used and substituting the setpoint (SP) in for the true value, Equations 55 and 56 can be written as, AL = SP + TLU (Eq. 57) and AL = SP - TLU (Eq. 58)

I EGR-NGGC-0153 Rev. 12 1 Page 151 of 184

9.8.2 Setpoints (cont'd)

Rearranging the terms, the setpoint can be determined from the following, SP = AL- TLU (Eq. 59) and SP = AL + TLU (Eq. 60)

Equation 59 represents an analytical limit that is higher than the setpoint and Equation 60 represents an analytical limit that is lower than the setpoint.

Another way of viewing it is that Equation 59 applies to a process that must be prevented from rising above a certain analytical limit, and Equation 60 applies to a process that must be prevented from failing below a certain analytical limit. Thus, as discussed in Section 9.8.2.1, Equation 59 applies to a rising setpoint and Equation 60 applies to a falling setpoint. They may also be combined into one equation, SP = AL +/- TLU (Eq. 61)

It is important to understand how the positive and negative terms are used when writing the equation this way. For a rising setpoint, the maximum absolute negative TLU is subtracted (i.e, add the negative value) from the analytical limit. Similarly, for a falling setpoint, the maximum positive TLU is added to the analytical limit.

Figure 9-17 illustrates both a rising and falling setpoint and the treatment of loop uncertainties. For a rising setpoint, a conservative setting would be less than the limiting value, therefore, the loop uncertainties must be subtracted from the analysis limit. For a falling setpoint, a conservative setting would be higher than the limiting value, therefore, the loop uncertainties must be added to the analytical limit.

Another factor frequently overlooked when establishing a setpoint is the setpoint's proximity to the normal operational limits. If a setpoint is placed too close to the operational limits, it can result in spurious alarms or trips.

IEGR-NGGC-0153 1 Rev. 12 1 Page 152 of 184

9.8.2 Setpoints (cont'd)

Consider the example of the RCS Pressure for Harris discussed in Section 9.8.1.3. As stated in Section 9.8.1.3, the trip setpoint for RCS Pressure is 2385 psig, however, in actuality the Technical Specifications state the trip setpoint must be = 2385 psig. Selecting the trip setpoint as 2250 psig versus 2385 psig would provide additional conservatism that the analytical limit would not be exceeded. Additionally, it would also increase the probability of spurious plant trips. Besides the economic consequences, such trips unnecessarily cycle plant equipment which is only designed for a given number of such trips. Thus, overall plant safety may actually be degraded by moving the setpoint too far away from the analytical limit.

Another illustration of the potential safety significance of placing setpoints too close to their operational limits involves equipment availability and the potential for common mode failures. Consider two trains of an Emergency Core Cooling System (i.e., HPCI, SI, etc,) with their associated pumps. The pumps would typically have trip functions on low suction pressure. If the setpoint for the low suction pressure was established conservatively away from the limiting suction pressure for the pump, it may be set too close to the expected range of the suction pressure. This could cause an inadvertent trip of the pump. Normally, the setpoints for both trains would be set at approximately the same value. Thus, both pumps could potentially trip due to a common mode failure of establishing the setpoints too close to the normal operational values.

When calculating a setpoint, Equations 59 and 60 describe how to ensure a setpoint is far enough away from the analytical limit. A similar approach can be used to ensure that it is far enough away from the operational limits. For a rising setpoint, Equation 59 states that the maximum absolute negative TLU should be subtracted from the analytical limit. To ensure the setpoint is sufficiently away from the operational limit (OL), the maximum positive component of the TLU is added to the OL, as follows:

SP = OL + TLU (Eq. 62)

The value for OL in this equation would be the maximum value the process would be expected to achieve under its normal operational conditions.

Similarly, to ensure that the setpoint is sufficiently away from the operational limit for a falling setpoint, the maximum absolute negative component of the TLU would be subtracted from the OL, as follows:

SP = OL- TLU (Eq. 63)

EGR-NGGC-0153 1 Rev. 12 Page 153 of 184

9.8.2 Setpoints (cont'd)

For this equation, the OL represents the minimum value the process would be expected to achieve under its normal operational conditions.

3. Setpoint Tolerances An upper and lower setpoint limit or tolerance should be established for setpoints. The limits should provide a band around the setpoint which, as a minimum, accounts for the reference accuracy of the periodically tested segment of a loop. This would usually be from the output of a transmitter or detector (i.e., where the test input is injected) up to, and including, the device where calibration measurements are periodically taken during surveillance tests. This is the same as the group As-Left tolerance as discussed in Section 9.7.4.2. b.

Section 9.7.4 describes how the device, group and loop tolerances are established. For a device, the calibration tolerance is normally at least as large as the device's reference accuracy. In some applications, such as when more accurate test equipment is not available, the calibration tolerance may need to be increased beyond the device's reference accuracy.

As a calibration tolerance is widened, it increases its value. This higher value contributes to a higher value for the total loop uncertainty. The higher value for the total loop uncertainty moves the setpoint away from the analytical limit or design limit, as applicable.

Similarly, narrowing the calibration tolerance will move the setpoint closer to the analytical or design limit. Therefore, increasing a tolerance band makes calibrations easier via fewer devices found outside the band and less tuning required to stay within the band. However, increasing the tolerance band also moves a setpoint closer to its operational limits and increases the potential for spurious trips, alarms, etc. Thus, an optimum value should be determined for a device's tolerance and the associated group (i.e. setpoint) and loop tolerances, to allow the most flexibility for both the I&C group to perform their calibrations, and the operations group to operate their equipment.

I EGR-NGGC-01 53 Rev. 12 T Page 154 of 184

9.8.2 Setpoints (cont'd)

One method of potentially providing some flexibility for a device tolerance may be to include a calibration tolerance that is not symmetrical. That is, in the direction of interest (falling or rising) the calibration tolerance may be relatively narrow yet broader in the other direction. For example for a rising setpoint, the negative portion of the TLU will be used to establish the setpoint with respect to the analytical limit. Therefore, the tolerance may be tighter in the negative direction and broader in the positive direction (e.g. +10/-5 psig). In such a case, different values would need to be calculated for the positive and negative TLU terms using the respective calibration tolerances. Although acceptable, this practice is discouraged because instrument drift and reference accuracies do not typically manifest themselves asymmetrically. In addition, any device that can be reliably maintained within tolerance on the "tight" side of an asymmetrical tolerance should be expected to meet that tolerance symmetrically; and if a larger tolerance is needed, the setpoint should be revised to allow for it instead of revising the tolerance so calibration can be satisfied by "playing the tolerance."

The tolerance band provides calibration personnel with a measurable calibration band within which the device(s) must be adjusted. In addition, the tolerance band establishes a set of acceptable performance limits against which actual performance can be monitored. As long as the performance of the device(s) remains within these limits, no calibration adjustment would be required. Device(s) found outside of the calibration tolerance would require recalibration to bring the errors back within the tolerance and a review would potentially need to be made to determine if the instrument was, and had been prior to its recalibration, operable.

4. Allowable Values Technical Specifications typically list, along with an instrument's setpoints, another term called the allowable value which provides an allowance to account for the expected drift in the testable portion of the loop. Usually, the Technical Specifications will state that if a setpoint is found to be less conservative than its allowable value, the loop is to be declared inoperable until the setpoint is restored to within the allowable value. An evaluation is usually made to determine how long such a loop may have been inoperable and any plant operations that may have been affected.

The allowable value defines a limit which the setpoint should be maintained within to show that the uncertainties which are present within the loop when it is periodically tested/calibrated, are consistent with the values used within its uncertainty/setpoint calculation. In other words, it provides an acceptance criteria for the setpoint during the required periodic surveillance test, and from which operability determinations can be made.

EGR-NGGC-0153 Rev. 12 Page 155 of 184

9.8.2 Setpoints (cont'd)

The allowable value (error allowance) can be determined from the As-Found tolerance for that group or loop of instruments periodically tested as discussed in Section 9.7.4. If the allowable value is applied to surveillance testing that excludes the sensor, then the group As-Found tolerance is used. If the allowable value is applied to surveillance testing that includes the sensor, then the loop As-Found tolerance is used. In this case, the Channel Operability Limit (COL) as discussed in Section 9.8.1.4 should be used as the allowable value. The allowable value can be determined by adding or subtracting the group As-Found tolerance or loop As-Found tolerance, as appropriate, to the setpoint such that the allowable value moves closer to the analytical limit. Note that the drift term in Equation 51 would only account for the interval between successive tests (as few as 30 days for rack components and up to 30 months for sensors).

Thus for a rising setpoint, the allowable value would be determined by, AV = SP + GAFT (Eq. 64) and for a falling setpoint the allowable value would be determined by, AV = SP - GAFT (Eq. 65)

Where, AV = Allowable Value SP = Setpoint GAFT = Group As-Found Tolerance As discussed in Section 9.8.1.4, the channel operability limit is a value established to encompass the drift from the entire loop, inclusive of the sensor. Whenever the drift from the testable portion of the loop exceeds its allowable value, the drift for the entire loop may still be acceptable if the allowable value is not the same as the channel operability limit and the sensor drift is less than predicted. Although the Technical Specifications must still be followed in assessing loop operability, showing that a loop is still within its channel operability limit is one potential method of evaluating safety significance.

IEGR-NGGC-0153 Rev. 12 Page 156 of 184 1

9.8.2 Setpoints (cont'd)

The channel operability limit is calculated similar to the allowable value, except the Loop As-Found Tolerance is used in place of the Group As-Found Tolerance. For a rising setpoint it is determined by, COL = SP + LAFT (Eq. 66) and for a falling setpoint the channel operability limit is determined by, COL = SP - LAFT (Eq. 67)

Where, COL = Channel Operability Limit SP = Setpoint LAFT = Loop As-Found Tolerance 9.8.3 Application of Margin Margin (M) is a term used to describe a general allowance made for determining setpoints. Adding margin has the affect of moving a setpoint further away from the analytical limit (AL) or also known as the design limit (DL). Similarly, removing margin moves a setpoint closer to the analytical limit. Both applications are described in more detail below.

1. Additional Margin For some loops, the setpoint may be determined to be too close to the analytical limit (or design limit). Such an evaluation may be based on "engineering judgement" or it may be more quantitative. For example, the As-Found values for a given loop may be repeatedly exceeding the allowable value and the loop is continually being evaluated for operability. Regardless of the reason, whenever a setpoint is moved further away from the analytical limit (or design limit), it is referred to as "adding margin". Equation 61 shows that a setpoint is calculated by the expression:

SP = AL +/- TLU By adding margin (M), the equation becomes, SP = AL +/- TLU +/- M (Eq. 68)

I EGR-NGGC-0153 Rev. 12 Page 157 of 184

9.8.2 Setpoints (cont'd)

When margin is added it has the effect of increasing the conservatism of the setpoint. That is the action initiated by the setpoint will occur prior to where it would have occurred without the margin. Caution must be exercised, however, in that too much margin may also lead to spurious trips, nuisance alarms, etc. As discussed in Section 9.8.2.2, overall plant performance and plant safety can be degraded because of inadvertent challenges to plant equipment.

Whenever margin is added to a setpoint or determined to be present in an existing setpoint, it should be identified as such within the setpoint calculation. This will assist in any future evaluations of the loop or process system, should modifications be required of the equipment or the safety analyses.

9.8.4 Reducing Overconservatisms As discussed in Section 9.6.2, there are several ways of combining uncertainties (linear, SRSS, combinational) that employ varying levels of conservatism. Similarly, there are ways and assumptions used in determining the actual uncertainties that inject varying levels of conservatism. This document has reflected a general approach that may be used efficiently for most setpoints. It is not necessary to finetune each setpoint to very precise values. Thus, the methods described up to now may introduce certain conservatisms for the sake of convenience in performing the calculations. Some applications have a very narrow region between the normal operating range and the analytical limit (or design limit). For these cases, the conservatism must be reduced as much as practical to prevent inadvertent trips. Presented below are some suggestions which may be used on a case-by-case basis to reduce an individual conservatism.

a. Review the timing of the setpoint's actuation (or the time needed for an indication) versus the plant specific accident profiles to determine if the loop's design basis trip function occurs prior to a harsh environment forming. Also, the accident temperature effect usually occurs immediately after an accident and then dissipates. The accident radiation effect is frequently not a concern until a significant period following an accident. Thus, only one or the other of the effects may need to be included in the total loop uncertainty instead of both.

I EGR-NGGC-0153 Rev. 12 1 Page 158 of 184 1

9.8.4 Reducing Overconservatisms (cont'd)

b. Determine if the specific location of the loop (or components results in a milder environment than that assigned to the general room or building. For example, a sensor may be shielded by equipment reducing its radiation dose or a sensor may be on the floor of a large open area such that its temperature is less than the average room temperature.

c. Determine if a loop calibration can be performed versus a component-by-component calibration. If not, evaluate whether a loop check can be done following the component-by-component calibration. Either of these minimizes the number of times the M&TE uncertainty must be applied.

d. Ascertain whether more accurate M&TE is available for performing the calibrations. It may be possible to use more accurate equipment if the device is calibrated in the shop versus in the field.

e. Reduce the calibration tolerance for all devices to their minimum acceptable values (typically their reference accuracies).

f. Revise the method of calibration to verify all attributes of each device such that only the calibration tolerance must be included in the total loop uncertainty calculation.

g. Perform a loop specific insulation resistance (IR) calculation instead of relying on a worst case or assumed IR value.

h. Utilize calibration tolerances that are not symmetrical, but are smaller in the direction of interest.

Determine if the calibration frequency can be increased to approach the interval used by the vendor for his drift value or, to be even more frequent than that assumed by the vendor.

j. Investigate whether updated information from the vendor can reduce drift or other uncertainties. Also, evaluate whether or not plant As-Found/As-Left calibration data may be analyzed to determine drift, rather that using the vendor specifications.

k. Modify equipment whereby its span is closer to its range, and the turndown factor can be decreased or deleted.

EGR-NGGC-0153 Rev. 12 1 Page 159 of 184

9.8.4 Reducing Overconservatisms (cont'd)

1. For indicators and recorders, assess whether another indication (i.e, via the plant computer) may provide a more accurate indication. If possible, scale faces, chart paper, etc. may be changed to reduce the readability error. The substitution of digital displays for analog displays will usually result in a smaller indicator error.

m. Evaluate if sensors can be moved to a more moderate environment.

n. For differential pressure loops, determine if calibrating the sensor at pressure could reduce the static pressure effect.

o. Treat calibration tolerances and M&TE errors as statistically independent terms when combining the uncertainties.

p. Reduce the uncertainty values using the "single side of interest" statistical methodology factor described in section 9.4.12, if applicable.

9.8.5 Dead Band and Reset Dead band and reset are two interrelated control phenomenon which can affect an instrument loop's performance. Dead Band is the term given to the phenomenon that occurs in all instruments upon the reversal of an input signal (i.e., from rising to falling, or falling to rising). A band of non-response, or dead band, exists for a change in input, where no change in output is seen. This is demonstrated graphically in Figure 3-1. Whenever an input signal changes direction, a discrete amount of reverse signal change has to take place before the output begins to change. This characteristic is inherent in most devices.

Dead band is found in both analog and digital (setpoint) devices. In analog devices, the dead band is part of the basic accuracy of the device, and affects the device's ability to respond to a change in input signal. For digital or setpoint devices, the dead band affects the point at which a device resets after actuation. Generally dead band is an undesirable trait of a control system because of its effect on stability. Many digital applications, though, rely on dead band as an integral part of the control scheme.

IEGR-NGGC-01 53 1 Rev. 12 Page 160 of 184

9.8.5 Dead Band and Reset (cont'd)

To prevent cycling, chatter and subsequent system instability, it is usually necessary to allow a sufficiently large difference (or dead band) between the actuation and reset point of a setpoint device. Some setpoint devices have only a fixed differential between the actuation and reset point. When selecting such a device, an assessment should be made to ensure that the fixed differential is adequate for the application.

For devices which have an adjustable differential, the setting for the reset point should be based on system capabilities and required system performance. A sufficient band must be allowed between a device's setpoint and reset point to prevent cycling, and equipment wear due to normal process system variations.

In general, dead band and reset do not have to be considered in loop error analysis. The dead band and reset do, however, have to be evaluated during a final setpoint determination.

9.8.6 Time Response The speed, or time response, of both a process, and the I&C system that is monitoring a process, can be an important factor in the selection of setpoints.

Allowances in setpoint values may be necessary to compensate for specific system, or equipment, time responses which affect the operation of a setpoint. A slow time response can cause a setpoint to be actuated too late to prevent damage of equipment.

The lead time needed to correct an abnormal process condition prior to reaching unacceptable levels may need to be determined, and factored into a setpoint.

However, most "time response" type setpoint concerns are addressed by either establishing circuitry and system response time requirements that are verified by testing, or by installing "lead circuit" devices in the instrument loop. "Lead circuits" cause output signal increases based on the rate of change of the input signal thus ensuring trip points are reached sooner for fast changes to the input signal. When "time response" is of concern and these methods are used, no time considerations need to be included in the setpoint selection.

Consider the following example where a simple pressure switch is used without a "lead circuit" capability, A setpoint is needed for a pressure switch which serves to maintain a minimum pressure in a system. The pressure switch starts a pump, which requires 5 seconds before it is capable of supplying pressure. If the normal pressure is 100 psi, the system pressure can decrease by 5 psi per second and the absolute minimum pressure to be maintained is 50 psi, the switch would require a setpoint of at least 75 psi. This would ensure that the actual system pressure does not fall below the required minimum before the pump corrects the decrease.

EGR-NGGC-0153 I Rev. 12 Page 161 of 184

9.8.6 Time Response (cont'd)

In a similar manner, the time response of an instrument or instrument loop may have to be determined and factored into a setpoint. This happens primarily with processes which have very fast time constraints. Every instrument or loop has a time response, or elapsed time period between the time a process reaches a given setpoint and action is taken. For many instrument loops, this is a matter of a second or less. But for a process condition which could also significantly change within this period of time, a setpoint may have to be lowered or raised to allow for the instrument time response or a "lead circuit" may need to be present in the design.

9.9 Calculation Format 9.9.1 Overview In order to assist in the development, review and approval processes required for instrument loop error/setpoint calculations, a standard format should be used in the preparation of these calculations. The following format should be used in conjunction with the EGR-NGGC-0017 procedure to generate or revise all future instrument loop error and setpoint calculations. A general discussion of the format is provided below.

Each loop uncertainty/setpoint calculation should contain, as a minimum, the following sections:

• Calculation Cover Sheet

• List of Effective Pages

• Table of Contents

• Objective

• Functional Description

• Loop Diagram

• References

• Inputs and Assumptions

• Calculation of Uncertainties/Setpoints

• Discussion of Results

• Setpoint Relationship Form (optional)

• Attachments (as necessary)

Other sections may be added as needed, depending upon the specific application and complexity of the instrument loop. Each of the above sections is briefly described below.

IEGR-NGGC-0153 1 Rev. 12 1 Page 162 of 184

9.9.2 Format Details Calculation Cover Sheet The Calculation Cover Sheet should comply with the EGR-NGGC-001 7 calculation procedure and would typically include the calculation number, revision, title, safety classification, seismic classification, and applicable signatures and dates. The title should directly indicate whether the calculation is just an uncertainty calculation a setpoint calculation a scaling calculation, or some combination of these; and the system, process, and function (protection, control, indication) being monitored.

2. List of Effective Pages The List of Effective Pages should comply with the EGR-NGGC-001 7 procedure and would typically show all pages in the calculation, including any attachments or appendices. Page numbering should start with the List of Effective Pages, which should be page i. Any subsequent pages up to the start of the calculation (i.e., with the Objective) should use lower case Roman numerals as the page numbers (e.g. ii, v, ix, etc.). Starting with the first page of the calculation, the remaining pages should be numbered with Arabic numbers (e.g. 2, 5, 9, etc.). Any Attachments, Appendices, Figures should also be included on the List of Effective Pages. In addition to their consecutive numbers as part of the calculation, Attachments, Appendices, and Figures should also be numbered as "page __ of _" to indicate how many pages make up the complete Attachment/ Appendix/Figure. Only their consecutive page numbers as part of the calculation need be included in the List of Effective Pages.

3. Table of Contents The Table of Contents should include a listing of each section and subsection of the calculation, along with any Attachments, Appendices, and/or Figures. Each section and subsection should be numbered with Arabic numbers (e.g. 2.1, 4.4, 6.0, etc.). The Table of Contents should denote Attachments, Appendices, and Figures by their consecutive page number within the calculation and by their total number of pages. Their title/subject should also be identified within the Table of Contents.

I EGR-NGGC-0153 Rev. 12 1 Page 163 of 184

9.9.2 Format Details (cont'd)

4. Objective The Objective should describe what the calculation is intended to achieve. It should discuss what is being calculated (i.e. uncertainties, setpoints, indicated values, etc.), the reason it is being calculated, and the applicable system and instrument loop numbers.

5. Functional Description The Functional Description should briefly describe the functions of the loop(s) (i.e., protection, control, and indication), their safety significance, the plant conditions for which the calculation is valid, and the general design basis of the instrument's function.

6. Loop Diagram A Loop Diagram shall be generated to identify each component in the loop by component type, manufacturer/model number, location, and tag number.

The diagram should begin with the loop's relative location to the process, show the primary element or sensor, and progress to each applicable bistable and/or end device. Both the process units being monitored, as well as any electrical units, should be shown together with their associated range.

The diagram is intended to be a simplified "block" diagram, and does not need to include individual termination points.

7. References The References should list all documents, and their revision number, that govern, and/or supply, data used in the calculation. References should be grouped into major subsections (i.e. drawings, vendor data, calibration procedures, other procedures, etc.) and assigned a unique number within that subsection. As a minimum, the following references should be included within the calculation: P&ID, loop diagram, vendor literature (preferably from the vendor technical manual), this procedure and any applicable Tech Spec or FSAR sections.

IEGR-NGGC-0153 I Rev. 12 1 Page 164 of 184

9.9.2 Format Details (cont'd)

8. Inputs and Assumptions The Inputs and Assumptions section should list any known conditions or values from codes/standards, measured data, functional requirements, performance requirements, design conditions, or other specific requirements.

Such conditions may include the normal and accident ranges of the process condition, the normal and accident environmental conditions for each applicable location, the span of each component, the calibration frequency of each component, etc. The source of each input shall be referenced.

Also included within this section shall be any assumptions necessary to complete the calculation. Assumptions shall be kept to a minimum and specifically identified as an assumption, and not a design input. Information that can be specifically referenced to a source document should be treated as input. Each assumption must state the basis for the assumption, and use of "engineering judgment" as a basis should be minimized.

9. Calculation of Uncertainties/Setpoints The Calculation of Uncertainties/Setpoints section should define each individual uncertainty, calculate the total loop uncertainty, and as applicable, calculate the setpoint, allowable value, channel operability limit, and indicated value. Using the loop diagram as a guide, the process measurement uncertainties should be determined first and progress through all loop components to each appropriate bistable/end device. Error propagation through the loop should be calculated as discussed in Section 9.6.2.

As each device in a loop is encountered, the specific error effects for the device should be listed. Following the device information, the resultant device errors shall be calculated. Each facet of the loop that exists should be addressed, even if it is only to explain why an uncertainty value is not applicable. The Setpoint Relationship Form shown in Attachment 1 should be completed for each instrument loop (or group of loops if all information for a loop is common to other channels).

EGR-NGGC-0153 1 Rev. 12 Page 165 of 184

9.9.2 Format Details (cont'd)

10. Discussion of Results The Discussion of Results shall provide the specific results of the calculation, by instrument loop and/or function. The status of the plant to which these results apply should be described, along with any other clarifying assumptions/conditions. The relationship of the results to any existing values should be described along with any available margin. If the results necessitate, or potentially necessitate, the change of any existing documents, drawings, procedures, etc., these shall be specifically identified and discussed.

11. Setpoint Relationship Form (optional)

The Setpoint Relationship Form shown in Attachment 1 may be completed for each loop. The form is designed to quickly summarize the individual error terms and how they are combined. The form itself is not important, but rather the information it provides. If, for particular applications, other means are more appropriate to present this information, they may be used instead of this form (e.g. a separate printout of the information, a diagram, etc.).

12. Attachments Attachments should be used to document instrument scaling calculations when it is necessary to provide scaling and no separate scaling calculation exists, or to provide clarification of the information used within the calculation. Frequently, the information used within the calculation may be from a source that is not easily reproducible/recoverable. In such cases, copies of the information should be included with the calculation as an attachment. Such information may include - vendor literature, letters, memos, telecons, specifications, etc.

9.9.3 General Guidelines Some other general information should be considered in developing the calculations. These general guidelines are described below:

1. Calculations may be performed by "hand" or preferably, by applying the techniques of a computer based word processor. An alternate method would employ a computer based software program.

I EGR-NGGC-0153 Rev. 12 Page 166 of 184 1

9.9.3 General Guidelines (cont'd)

2. Calculated values should be rounded to the least significant digit. For values that end in five or higher, they should be rounded up to the next higher significant digit. For values ending in one through four, they should be rounded down to the lower significant number. When determining setpoints, calculated values may be rounded in a direction that is conservative with respect to the analytical limit.

9.10 TSTF-493 Implementation NOTE 1: Background Information: RIS 2006-17 identifies NRC concerns regarding industry compliance with 10 CFR 50.36(c)(1)(ii)(A), which states:

"Limiting safety system settings for nuclear reactors are settings for automatic protective devices related to those variables having significant safety functions. Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded. If, during operation, it is determined that the automatic safety system does not function as required, the licensee shall take appropriate action, which may include shutting down the reactor."

TSTF-493, Rev. 4 with Errata, April 23, 2010 defines the collaborative NRC/

industry response to RIS 2006-17. The intent of TSTF-493 is to maximize assurance that instruments supporting selected Technical Specification functions perform both "as required" and "as expected".

All Technical Specification instrument functions, whether or not subject to TSTF-493, must perform "as required." That criterion is satisfied by Surveillance Test as-found results being within Technical Specification Allowable Values and it is unchanged by application of TSTF-493. When Surveillance Test as-found results are within Technical Specification Allowable Values, the tested function is demonstrated to be Operable.

The impact of TSTF-493 applicability is imposition of an additional operability criterion to demonstrate that a function is also performing "as-expected,"

relative to the applicable manufacturer-identified tolerances and the manner in which those tolerances have been applied within setpoint calculations.

This is accomplished by requiring that Surveillance Test As-Found results be within a specifically limited tolerance band established around the actual device field setting. When Surveillance Test As-Found results are within the Allowable Value, but not within the specified limited as-found tolerance band, the TSTF provides that the function to be considered Operable, but Degraded. (cont'd)

I EGR-NGGC-0153 Rev. 12 1 Page 167 of 184

9.10 TSTF-493 Implementation (cont'd)

(cont'd)

In response to that condition, TSTF-493 requires 1) performance of certain immediate actions to enable determination that the function can be considered Operable and 2) follow-up processing within the Corrective Action Program for further evaluation.

Compliance with TSTF-493 is accomplished by imposition of unique design and testing requirements as follows:

• Restricting the types of uncertainty factors that may be considered in determination of Surveillance Test As-Found and As-Left Tolerances,

• Inclusion of those "restricted" As-Found and As-Left Tolerances as part of the acceptance criteria within applicable Surveillance Test procedures,

• Requiring satisfactory evaluation of any Surveillance Test Out-of-Tolerance As-Found Results prior to returning the equipment to Operable status.

• Performance of follow-up reviews by Engineering for further evaluation, documented within the Corrective Action Program.

Section 9.10 establishes the detailed guidance necessary to implement the TSTF-493 requirements.

9.10.1 TSTF-493 Applicability

1. Applicability of the requirements in 9.10 is currently limited to:

• Those specific Technical Specification functions for which compliance with TSTF-493 has been committed within a facility's Operating License, and

• Those design activities performed in support of pending Licensing Amendment Requests for which TSTF-493 compliance is required.

9.10.2 Determination of Tech Spec Trip Setpoints and Allowable Values

1. Technical Specification Trip Setpoints and Technical Specification Allowable Values are determined using the same generic methodology established in 9.8.2.2 and 9.8.2.4, respectively. No unique or additional requirements are imposed by TSTF-493 applicability.

I EGR-NGGC-0153 Rev. 12 1 Page 168 of 184

9.10.3 Determination of Surveillance Test As-Found Acceptance Criteria

1. Specific tolerances to be applied as As-Found Surveillance Test acceptance criteria shall be established as directed in 9.5.1, 9.7.4 and 9.8.2.3, subject to the following clarifications and restrictions:

a. The As-Found Tolerance should be based on As-Left Tolerance, Drift, and M&TE uncertainties. No additional margin should be applied, except as permitted per the following step.

b. In cases where unique circumstances suggest inclusion of specific uncertainty factors (not discretionary margin) in the As-Found Tolerance beyond those permitted in the preceding step, the basis for that inclusion shall be explicitly documented within the calculation.

9.10.4 Determination of Surveillance Test As-Left Acceptance Criteria

1. Specific tolerances to be applied as As-Left Surveillance Test acceptance criteria shall be established as directed in 9.5.1, 9.7.4 and 9.8.2.3, subject to the following clarifications and restrictions:

a. The As-Left tolerance should be based on Reference Accuracy. No additional margin should be applied, except as permitted per the following step.

b. In cases where unique circumstances suggest inclusion of specific uncertainty factors (not discretionary margin) in the As-Left Tolerance beyond Reference Accuracy, the basis for that inclusion shall be explicitly documented within the calculation.

9.10.5 Use of As-Found and As-Left Acceptance Criteria in Surveillance Tests

1. All Surveillance Test Procedures include acceptance criteria requiring test results to be within Technical Specification Allowable Values. These criteria are unchanged by TSTF-493 applicability.

2. For Surveillance Test Procedures subject to TSTF-493, the following additional acceptance criterion shall be applied:

a. As-Found trip settings shall be within the As-Found Tolerance band (as specifically established in 9.10.3) around the desired trip setting.

b. As-Left trip settings shall be within the As-Left Tolerance band (as specifically established in 9.10.4) around the desired trip setting.

c. In the case where a Surveillance Test Procedure does not provide separate As-Found and As-Left tolerances, the single tolerance specified must be used for both purposes and its magnitude must be less than or equal to the magnitude of the As-Left Tolerance (as established in 9.10.4). This approach effectively excludes any allowance for potential instrument drift and should only be utilized in applications that are known to be exceptionally stable. Otherwise, test results might unnecessarily cause entry into the Out-of-Tolerance evaluation and operability determination steps defined in 9.10.6.

EGR-NGGC-0153 Rev. 12 Page 169 of 184

9.10.6 Response to Surveillance Test Out-of-Tolerance As-Found Results

1. Surveillance Test Procedures shall include specific requirements for the maintenance technicians to perform the following actions when As-Found results are found to be outside the As-Found Tolerance band:

a. Prompt notification to Operations of the initial Out-of-Tolerance test result.

b. Attempt to adjust the trip setting to within the As-Left Tolerance.

c. If resetting to within the As-Left Tolerance is successful, then consider whether the adjustment activity revealed any unusual device response or whether any adverse physical or functional conditions are apparent.

Determine whether the function can be reasonably expected to perform satisfactorily throughout the next surveillance interval.

d. Report the results of steps b and c above to Operations. This action constitutes a recommendation by Maintenance for use in a determination by Operations regarding whether the function can be declared operable.

e. Initiate a Condition Report within the Corrective Action Program describing the Out-of-Tolerance Surveillance Test result for further evaluation by Engineering.

10.0 RECORDS 10.1 No records are generated specifically from the performance of this procedure. This procedure describes a methodology to perform certain types of engineering calculations. Other corporate/site specific procedures exist to provide direction regarding the records required to be generated, record format, and approval requirements.

10.2 Use of the three forms provided in Attachment 1 is optional. The completed forms are not, by themselves, records. When used, however, they may be included as part of the calculation for which they were prepared.

IEGR-NGGC-0153 1 Rev. 12 1 Page 170 of 184

ATTACHMENT 1 Sheet I of 4 Forms These forms are provided to assist in the calculation of total loop uncertainty, setpoints, allowable values, etc. The use of these forms are optional and intended to be an aid to the preparer of such calculations and provide the relevant information in a summary format. It is believed that by viewing the pertinent information in a format such as that provided, the overall relationships of the different error and limit terms can be more readily understood. If the user of this document determines that another format is more suitable for their application, then another format can be used as long as the necessary information is documented.

[HNP, RNP - The GAFT is typically used to determine the allowable value.] [BNP - The LAFT is typically used and the channel operability limit is the allowable value. Therefore, the GAFT need not be shown in the setpoint analysis results.]

Three forms are provided. Form 1-1 is for listing device uncertainties, Form 1-2 is for increasing setpoints, and Form 1-3 is for decreasing setpoints.

Form 1-1 lists potential uncertainties that may apply to a given device. Appropriate values should be inserted for each applicable device error/effect. Under "TYPE", the user should identify what type of error the value represents: random, bias, dependent, independent. If the error is dependent, the dependency should be explained in the "COMMENTS" field.

Any other clarifying information may also be included within the "COMMENTS" field.

Using Section 9.6.2.3 of the procedure, the errors/effects should be combined to determine an overall device uncertainty.

Once all of the uncertainties for the devices have been determined, they should be summarized at the top of Form 1-2 or 1-3, as appropriate. The process measurement errors, primary element errors, and any other applicable errors should be combined with the device uncertainties to determine the total loop uncertainty. The values for the other parameters should be documented on the applicable form, in the spaces provided. Some values must be obtained from the design bases of the instrument loop, and others must be calculated, as shown.

IEGR-NGGC-0153 1 Rev. 12 Page 171 of 184

ATTACHMENT 1 Sheet 2 of 4 Listing Device Uncertainties (Form 1-1)

Device Type Device Name(s)

ERROR/EFFECT VALUE TYPE COMMENTS Ref. Accuracy Cal. Tolerance (ALT)

M&TE Error Drift Temp. Effect Pwr. Supply Effect Readability Seismic Effect Acc. Temp. Effect Acc. Press. Effect Acc. Rad. Effect Insul. Resist. Effect Other Total Device TDU = + /-

Uncertainty (TDU)

(EGR-NGGC-0153-1-1-9)

Note: All errors/effects must be converted to the same basis (i.e. units) prior to entering their values onto the form.

EGR-NGGC-01 53 Rev. 12 Page 172 of 184

ATTACHMENT I Sheet 3 of 4 Increasing Setpoint (Form 1-2)

PE Bias 1 PME Bias 2 TDUsensor Bias 3 TDU1 Total Bias TDU 2 TDU3 TLU = (PE2 + PME2 + TDUsensor2 + TDU12 + TDU 22 + TDU 32)1/2 + Total Bias TLU Margin GAFT =(ALT12 + DR 1 2 + MTE 12 + 0+ ALTn2 + DRn2 + MTEn2)/

GAFT LAFT = (GAFT2 + ALTsensor2 + DRsensor2 + MTEsensor2 )11/2 LAFT Safety Analytical Limit = ( )

LAFT Allowable Value /

Channel Operability Limit =

TLU = LAFT

( ) G GAFT Allowable Value =

GAFT r

/AllOWaDle Setpoin[ = k Margin

( )

Ik Setpoint = (

Operating Ma r g in I _N r ma

________VNormal (EGR-NGGC-01 53-1-2-9)

EGR-NGGC-0153 Rev. 12 Page 173 of 184

ATTACHMENT 1 Sheet 4 of 4 Decreasing Setpoints (Form 1-3)

PE Bias 1 PME Bias 2 TDUsensor Bias 3 TDU1 Total Bias TDU 2 TDU 3 TLU = (PE2 + PME2 + TDUsensor2 + TDU12 + TDU2 2 + TDU 32) 1/ + Total Bias TLU Margin 2 2 2 2 2%1/

GAFT = (ALT1 + DR 1 + MTE 1 +0e + ALTn + DRn 2 + MTEn)

GAFT 2

LAFT = (GAFT2 + ALTsensor2 + DRsensor2 + MTEsensor )1/2 LAFT Normal Operating Margin F, Setpoint = (

Margin=

A Allowable Setpoint =

LAFT = GAFT =

( )

TLU = GAFT Allowable Value =

F LAFT Allowable Value /

Channel Operability Limit =

I Analytical Limit = (

Safety Limit (EGR-NGGC-01 53-1-3-9)

IEGR-NGGC-0153 I Rev. 12 Page 174 of 184

ATTACHMENT 2 Sheet I of 4 Specific Gravity Determination for Boric Acid Solutions The most common chemical composition affecting the density of water in Light Water Reactors is boric acid. Boric acid is typically provided in either units of "parts per million (ppm)" or "weight percent". The Method 1 discussion below provides one convenient means of correlating such values to an equivalent specific gravity, that can then be used in making the appropriate corrections for density in the process measurement determination. Alternate methods are acceptable if a documented basis is provided.

For example, Method 2 below (based on CR3 calculation 1-95-0006) develops the following equations for boric acid density in terms of ppm boron and percent weight of boric acid.

Method 1 (Simplified technique):

A solution of boric acid (B.A.) will have a certain percent by weight (%wt) of boric acid according to the relationship, 1 %wt B.A. = 1 pound B.A.

100 pounds of solution By definition, 1 ppm B.A. = 1 pound B.A.

1,000,000 pounds of solution Combining these two equations produces, 1 %wt B.A. = 1 pound B.A.

• 1,000,000 pounds of solution 1 ppm B.A. 100 pounds of soluti(on 1 pound B.A.

Simplifying the relationship produces, 1 %wt B.A. = 10,000 ppm B.A.

Since concentration is normally stated in ppm boron (B), not ppm B.A., the equation must be modified. Boric acid is H 3BO 3 with a molecular weight of 61.83. Boron's atomic weight is 10.81. Thus, the correction factor becomes, 10.81 ppm B 61.83 ppm B.A.

IEGR-NGGC-0153 1 Rev. 12 Page 175 of 184

ATTACHMENT 2 Sheet 2 of 4 Specific Gravity Determination for Boric Acid Solutions Using this correction factor, the above relationship for boric acid is revised to, 1 %wt B.A. = 10,000 ppm B.A.

• 10.81 Dom B 61.83 ppm B.A.

1 %wt B.A. = 1748 ppm B Another way to state this is, 1 ppm B = 0.000572 %wt B.A.

This is the derived conversion factor that will be used in concentration conversions.

Next, the conversion factor will be used to determine the Specific Gravity (S.G.) of a solution. The S.G. of a solution of B.A. can be defined by the equation, S.G. of solution = [(%wt H20)(S.G. of H-2 0) + [(%wt B.A.)(S.G. of B.A.)]

100 To find the S.G. of a particular boric acid solution with a known concentration (in ppm Boron) at a certain temperature, follow these steps,

1. Convert the ppm B to %wt B.A. using the derived conversion factor determined above.

2. Determine the water's S.G. (from appropriate tables) for the given temperature.

3. Substitute the values into the equation for the S.G. for a solution.

Consider the following example, EXAMPLE Find the S.G. of a 2300 ppm B solution at 100 0F.

From steam tables, the S.G. of water at 100°F is determined as 0.99544. From the CRC handbook of Chemistry and Physics, the S.G. of B.A. is determined as 1.435.

Using the conversion factor, the ppm B is converted to %wt B.A. as follows, 2300 ppm B

• 0.000572 %wt B.A. = 1.3156 %wt B.A.

ppm B EGR-NGGC-0153 Rev. 12 Page 176 of 184

ATTACHMENT 2 Sheet 3 of 4 Specific Gravity Determination for Boric Acid Solutions The %wt of water (H20) is determined by subtracting the %wt of B.A. from 100%, or

%wt H2 0 = 100 - 1.3156 = 98.6844 Substituting the values into the equation for the S.G. for a solution produces, S.G. of solution = [(98.6844)(0.99544)1 + [(1.3156)(1.435)1 100 S.G. of solution = 1.0012 It should be noted that the S.G.of boric acid is 1.435 at 151C (about 60'F). Due to the small amount of boric acid in the solution, the density change of the boric acid due to temperature is negligible. The density change of the water due to temperature is included.

Method 2 (based on CR3 calculation 1-95-0006)

For boric acid density in terms of ppm boron:

Pc 2 = [(1.973 x 10-6 x ppm B) + 1] x pi and Pc4 = [(2.2305 x 10-6 x ppm B) + 0.9991] x Pi where, 3

Pi = density of water in Ibm/ft ppm B = parts per million of boron Pc2 = density of boric acid solution for <3497 ppm B (2% weight) solutions in Ibm/ft 3 Pc4 = density of boric acid solution between3 3497 and 6994 ppm B (2 and 4% weight) solutions in Ibm/ft I EGR-NGGC-0153 Rev. 12 1 Page 177 of 184

ATTACHMENT 2 Sheet 4 of 4 Specific Gravity Determination for Boric Acid Solutions For boric acid density in terms of percent weight of boric acid:

Pc2 = [(0.00345 x %Wt) + 1] x Pi and Pc4 = [(0.0039 x %Wt) + 0.9991] x Pi where, 3

Pi = density of water in Ibm/ft

%Wt = % weight of boric acid Pc2 = density of boric acid solution for <2% weight (3497 ppm B) solutions in Ibm/ft3 Pc4 = density of boric acid solution between3 2 and 4% weight (3497 and 6994 ppm B) solutions in Ibm/ft The results from the above CR3 calculation may be used by all NGG sites in lieu of the simplified Method 1 described below.

IEGR-NGGC-0153 1 Rev. 12 Page 178 of 184

ATTACHMENT 3 Sheet I of 4 Conversion of Error Basis The error basis which provides the most flexible and useful information is "percent of span". However, different devices may have their error expressed in different bases.

The following methods are provided for the user to convert from typical bases to "percent span". Many of these methods have been described in examples throughout the design guide. However, they are summarized here for the user's convenience.

1. Upper Range Limit The upper range limit is associated with an instrument which has an adjustable range, and the upper range limit represents the maximum possible range of the instrument. To convert from upper range limit (URL) to percent span, use the following relationship, Error in % cal. span = (Error in % URL)(URL)

(Span)

For example, if the drift accuracy of a transmitter is +/-0.5% URL, the span is 0-100 psig, and the URL is 0-400 psig, determine the error in % span.

Error in % cal. span = +/- (0.5%) (400 psiaQ)

(100 psig)

Error in % cal. span = +/- 2.0%

2. MTE Ranges Measurement and test equipment (MTE) frequently has a range which is different from an instrument's range. Thus, the error for the MTE is given in terms of % of its range and must be converted to % of the instrument's span. This is done using the following relationship, Error in % cal. span = (MTE Error in % of ranqe)(MTE Range)

(Equivalent Instrument Span)

I EGR-NGGC-0153 Rev. 12 Page 179 of 184 1

ATTACHMENT 3 Sheet 2 of 4 Conversion of Error Basis For example, a pressure transmitter has a span of 0-100 psig. It produces an equivalent signal of 4-20 madc. This is dropped across a 250 ohm resistor at the test point to produce a 1-5 vdc signal. A digital multimeter has a voltage range of 0-25 vdc and an MTE error of +/-0.2% of its range. Determine the multimeter's error in

% span of the transmitter.

The transmitter has a range of 0-100 psig which also corresponds to 4-20 madc.

Instead of measuring the current, however, the multimeter measures the equivalent voltage across a 250 ohm resistor, or 1-5 vdc. The transmitter's equivalent range is then 1-5 vdc, or 4 vdc (i.e., 5 - 1 = 4 vdc). Substituting this into the above equation produces, Error in % cal. span = +/- (0.2%)(25 volts)

(4 volts)

Error in % cal. span = +/- 1.25%

[Note: This is just the error of the multimeter and does not include the error of the resistor, which would also need to be determined for the MTE error.]

3. MTE Error as a Percentage of Readinq For some MTE, its error may be expressed as a percentage of its reading. This is especially common for digital meters. To convert to an error expressed in terms of

% span of the instrument, the following relationship is used, Error in % cal. span = (Error in % reading)(Readinq)

(Equivalent Instrument Span)

For example, a piece of test equipment has an accuracy of +/-0.3% of reading for all scales. The transmitter's span is 0-100 psig, producing an equivalent signal of 4-20 madc. The test equipment measures this signal as a 1-5 vdc signal across a 250 ohm resistor. The transmitter's setpoint is 50 psig. Determine the test equipment's error in % span.

I EGR-NGGC-01 53 Rev. 12 1 Page 180 of 184

ATTACHMENT 3 Sheet 3 of 4 Conversion of Error Basis At the setpoint of the transmitter, the test equipment should read 3 vdc. This is because the 50 psig setpoint is equal to one half of the transmitter's span of 0-100 psig. At 50 psig, the transmitter will output a signal of 12 madc (halfway across the 4-20 madc span) which will be monitored by the test equipment as 3 vdc (halfway across the 1-5 vdc span). Since the test equipment begins with a reading of 1 vdc, this must be subtracted from the 3 vdc to obtain the effective reading of the test equipment, which is 2 vdc. The equivalent instrument span is 1-5 vdc, or 4 vdc (5 - 1 vdc). Substituting these values into the above equation produces, Error in % cal. span = +/- (0.3%)(2 vdc)

(4 vdc)

Error in % cal. span = +/- 0.15%

[Note: This is just the error of the test equipment identified and does not include the error of the resistor, which would also need to be determined for the MTE error.]

4. Bias of a Known Maximum Maqnitude Many times a bias of a known maximum magnitude, must be converted to % span of the instrument loop. The bias will typically be expressed in terms of units of the process. This is converted to terms of error in % span by the relationship, Error in % cal. span = (Bias)

(Span)

For example, the temperature bias in the reference leg of a level transmitter can cause a maximum error of 2 in WC. The transmitter has a span of 250 in WC.

Determine the bias error in % span.

Error in % cal. span = (2 in WC)

(250 in WC)

Error in % cal. span = 0.8%

EGR-NGGC-0153 Rev. 12 Page 181 of 184

ATTACHMENT 3 Sheet 4 of 4 Conversion of Error Basis

5. MTE Error with Rounding of Least Significant Digits Digital meters have an error associated with rounding off to the least significant digit displayed. If the meter displays four or more digits, then the error caused by rounding off to the fourth digit will not add an appreciable amount of error. For meters that display three or fewer digits, the error is equal to half the value of the least significant digit displayed by the digital meter.

For example, a digital multimeter has an error of +/- 0.2% of its range plus the error associated with rounding off to the least significant digit. If the meter is used to read 0-20 vdc to +/-0.1 vdc, the error for the round-off would be, Error (in vdc) = 1 1/2(+/-0.1 vdc) = +/-0.05 vdc Error (in % of meter's range) = 100% * (0.05vdc) = +/-0.25%

(20vdc)

Thus, the total error for the multimeter would be +/-0.2% + 0.25% or +/-0.45%. This would then be converted to error in % span of the instrument as described in Section 2 of this Attachment.

I EGR-NGGC-0153 I Rev. 12 1 Page 182 of 184

ATTACHMENT 4 Sheet I of 1 Site-Specific Commitments 1.0 Site-Specific Commitments 1.1 [BNP - No specific licensing commitments have been made.]

R2.1, R2.30, 1.2 [HNP - Committed to Regulatory Guide 1.105, "Instrument Setpoints",

R2.32 Revision 1, as identified in HNP FSAR, page 1.8-135 and to the format described in the Technical Specifications Bases (i.e., either 5 column or 2 column, as appropriate).]

R2.40 1.3 [RNP - In the response to LER 95-009-01, RNP established the following corrective action: "Engineering procedures for performing calculations will be revised and implemented by June 30, 1996, to address the effects of gas under pressure in a closed vessel measurement, and will include the SI accumulator as an example." This corrective action was accomplished by insertion of Example 2 into Section 9.3.1.3 of Revision 0 of this procedure.

IEGR-NGGC-0153 I Rev. 12 Page 183 of 184

SUMMARY

OF CHANGES PRR 615032 SECTION/STEP CHANGES Throughout The justification for the changes to this procedure is 'Due to CR3 being decommissioned CR3 is no longer part of NGG (cessation of power operations letter 3F0213-07.) All references to CR3 are being removed from this procedure. A site specific procedure has been developed for CR3.'

All Changed revision number to 12.

Cover Page Updated to reflect procedure no longer applies to CR3. Site-specific procedure EGR-0153 created due to decommissioning efforts.

Deleted "[CR3 - I&C Design Criteria for Instrument Loop Uncertainty Calculations].'

2.36 Deleted '[CR3 - Environmental Qualification Plant Profile Document (EQPPD)] '

Pg 83, 2 nd para. Deleted '[CR3 - the applicable calibration procedure]'

Pg 86, 5 th para. Deleted '[CR3 CR3 Environmental Qualification Plant Profile Document (EQPPD)]'

Pg 87, 7th para. Deleted 'CR3' Pg 91, 1 st para. Deleted '[CR3 Vendor information for the applicable loop power supply and the applicable electrical system Enhanced DBD.]'

Pg 94, 1 st para. Deleted '[CR3 CR3 Environmental Qualification Plant Profile Document (EQPPD)]'

Pg. 94 3rd para. Deleted '[CR3 - Vendor Qualification Package (VQP)]'

Pg. 102 1 st para. Deleted '[CR3 - I&C Design Criteria for Instrument Loop Uncertainty Calculations, Attachment 1, describes how As-Left and As-Found tolerances should be established.]'

Pg 107, 1 st para. Deleted '[CR3 1-95-0005, Measurement and Test Equipment Accuracy Calculation]'

Pg. 112, 4 th para. Deleted '[CR3 - The applicable VQP and IR calculation should be used to determine the IR error' Pg 171, 2 nd para. Deleted 'CR3' Pg 183 2nd para. Deleted '1.2 [CR3 - No specific licensing commitments have been made.]'

EGR-NGGC-0153 Rev. 12 Page 184 of 184