ML15350A393: Difference between revisions
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
||
| Line 16: | Line 16: | ||
=Text= | =Text= | ||
{{#Wiki_filter:S_ %DUKEKelvin Henderson Vice President SENERGY catawba Nuclear | {{#Wiki_filter:S_ %DUKEKelvin Henderson Vice President SENERGY catawba Nuclear Station Duke Energy CNO1VP I 4800 Concord Road York, SC 29745 o: 803,701.4251 CNS-1 5-098 f: 803.701.3221 December 14, 2015 U.S. Nuclear Regulatory Commission Document Control Desk Washington, DC 20555-0001 | ||
==Subject:== | ==Subject:== | ||
Duke Energy Carolinas, LLC Catawba Nuclear Station, Units 1 and 2 Docket Nos. 50-413 and 50-414 | |||
To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided. | To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided. | ||
If one train is taken out of service for maintenance or | If one train is taken out of service for maintenance or test purposes, the second train will provide ESE actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result.Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements. | ||
The SSPS performs the decision logic for most ESF= equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals | The SSPS performs the decision logic for most ESF= equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit.The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various transients. | ||
If a required logic | If a required logic matrix combination is completed, the system will send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition. | ||
Examples are given in the Applicable Safety Analyses, LCO,and Applicability sections of this Bases.Each SSPS train has a built in testing device that can test the | Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.Each SSPS train has a built in testing device that can test the decision logic matrix functions and the actuation devices while the unit is at power.When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed. | ||
The testing device is semiautomatic to minimize | The testing device is semiautomatic to minimize testing time.The actuation of ESE components is accomplished through master and slave relays. The SSPS energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices. The master and slave relays are routinely tested to ensure operation. | ||
The | The test of the master relays energizes the relay, which then operates the contacts and applies a low voltage to the associated slave relays. The low voltage is not sufficient to actuate the slave relays but only demonstrates signal Catawba Units 1 and 2B332-ReionN.1 B3.3.2-4 ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued) path continuity. | ||
The test of | The SLAVE RELAY TEST actuates the devices if their operation will not interfere with continued unit operation. | ||
The SLAVE RELAY TEST actuates the devices if | For the latter case, actual component operation is prevented by the SLAVE RELAY TEST circuit, and slave relay contact operation is verified by a continuity check of the circuit containing the slave relay.APPLICABLE Each of the analyzed accidents can be detected by one or SAFETY ANALYSES, more ESFAS Functions. | ||
For the | One of the ESFAS Functions is the LCO, AND primary actuation signal for that accident. | ||
One of the ESFAS Functions is | An ESFAS Function APPLICABILITY may be the primary actuation signal for more than one type of accident.An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents. | ||
An ESFAS | For example, Pressurizer Pressure--Low is a primary actuation signal for small loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) outside containment. | ||
An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents. | Functions such as manual initiation, not specifically credited in the accident safety analysis, are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. | ||
For example, Pressurizer Pressure--Low is a primary actuation signal for small loss of | These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).The LCO requires all instrumentation performing an ESFAS Function to be OPERABLE. | ||
Functions such as manual initiation, | Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. | ||
These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).The LCO requires all instrumentation performing an ESFAS Function | The LCO generally requires OPERABILITY of three or four channels in each instrumentation function and two channels in each logic and manual initiation function. | ||
Failure of any instrument renders the | The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing an ESFAS initiation. | ||
The LCO generally requires OPERABILITY of three or four channels | Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents. | ||
The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance | ESFAS protection functions are as follows: Catawba Units 1 and 2B3325ReionN.1 B 3.3.2-5 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Two logic or | |||
ESFAS protection functions are as follows:Catawba Units 1 and 2B3325ReionN.1 B 3.3.2-5 ESFAS Instrumentation B 3.3. | |||
: 1. .Safety Injection Safety Injection (SI) provides two primary functions: | : 1. .Safety Injection Safety Injection (SI) provides two primary functions: | ||
: 1. Primary side water addition to ensure maintenance | : 1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 2200°F); and 2. Boration to ensure recovery and maintenance of SDM (kerr < 1.0).These functions are necessary to mitigate the effects of high energy line breaks (HELBs) both inside and outside of containment. | ||
The SI signal is also used to initiate other Functions such as:* Phase A Isolation; | The SI signal is also used to initiate other Functions such as:* Phase A Isolation; | ||
* Containment Purge and Exhaust Isolation; | * Containment Purge and Exhaust Isolation; | ||
* Reactor Trip;* Turbine Trip;* Feedwater Isolation; | * Reactor Trip;* Turbine Trip;* Feedwater Isolation; | ||
* Start of motor driven auxiliary feedwater (AFW)pumps;* Start of control room area ventilation filtration trains;* Enabling automatic switchover of Emergency Core | * Start of motor driven auxiliary feedwater (AFW)pumps;* Start of control room area ventilation filtration trains;* Enabling automatic switchover of Emergency Core Cooling Systems (ECCS) suction to containment sump;* Start of annulus ventilation system filtration trains;* Start of auxiliary building filtered ventilation exhaust system trains;* Start of diesel generators Catawba Units 1 and 2B332-ReionN.1 B 3.3.2-6 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
* Start of nuclear service water system pumps; and* Start of component cooling water system pumps.These other functions ensure:* Isolation of nonessential systems through containment penetrations; | * Start of nuclear service water system pumps; and* Start of component cooling water system pumps.These other functions ensure:* Isolation of nonessential systems through containment penetrations; | ||
* Trip of the turbine and reactor to limit power generation; | * Trip of the turbine and reactor to limit power generation; | ||
* Isolation of main feedwater (MEW) to limit secondary | * Isolation of main feedwater (MEW) to limit secondary side mass losses;* Start of AFW to ensure secondary side cooling capability; | ||
* Filtration of the control room to ensure habitability; | * Filtration of the control room to ensure habitability; | ||
* Enabling ECCS suction from the refueling water storage tank(RWST) switchover on low RWST level to ensure continued cooling via use of the containment sump;* Starting of annulus ventilation and auxiliary building | * Enabling ECCS suction from the refueling water storage tank (RWST) switchover on low RWST level to ensure continued cooling via use of the containment sump;* Starting of annulus ventilation and auxiliary building filtered ventilation to limit offsite releases;* Starting of diesel generators for loss of offsite power considerations; and* Starting of component cooling water and nuclear service water systems for heat removal.a. Safety Iniection-Manual Initiation The LCO requires two channels to be OPERABLE. | ||
* Starting of diesel generators for loss of offsite | The operator can initiate SI at any time by using either of two switches in the control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability. | ||
Catawba Units 1 and 2B332-ReionN.1 B3.3.2-7 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | |||
Catawba Units 1 and 2B332-ReionN.1 B3.3.2-7 ESFAS Instrumentation B 3.3. | Each train consists of one push button and the interconnecting wiring to the actuation logic cabinet. This configuration does not allow testing at power.b. Safety Iniection-Automatic Actuation Loqic and Actuation Relays This LCO requires two trains to be OPERABLE. | ||
Each train consists of one push button and | Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment. | ||
Manual and automatic initiation of SI must be OPERABLE in MODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. | |||
Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay | These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and resPond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. | ||
Manual and automatic initiation of SI must be OPERABLE | Unit pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.c. Safety Iniection-Containment Pressure-Hi~qh This signal provides protection against the following accidents: | ||
In MODE 4, | |||
Automatic actuation logic and actuation relays must be OPERABLE | |||
These Functions are not required to be OPERABLE | |||
Unit pressure and temperature are very low | |||
*SLB inside containment; | *SLB inside containment; | ||
* LOCA; and*Feed line break inside containment. | * LOCA; and*Feed line break inside containment. | ||
Catawba Units 1 and 2B332-ReionN.1 B3.3.2-8 ESFAS Instrumentation B 3.3. | Catawba Units 1 and 2B332-ReionN.1 B3.3.2-8 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Containment Pressure-High provides no input to any | Containment Pressure-High provides no input to any control functions. | ||
Thus, three OPERABLE channels are sufficient | Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic: Containment Pressure-High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment. | ||
: d. Safety Iniection-Pressurizer Pressure-Low This signal provides protection against the following accidents: | : d. Safety Iniection-Pressurizer Pressure-Low This signal provides protection against the following accidents: | ||
* Inadvertent opening of a steam generator (SG) | * Inadvertent opening of a steam generator (SG) relief or safety valve;* SLB;* A spectrum of rod cluster control assembly ejection accidents (rod ejection); | ||
* Inadvertent opening of a pressurizer relief or | * Inadvertent opening of a pressurizer relief or safety valve;* LOCAs; and* SG Tube Rupture.Pressurizer pressure provides both control and protection functions: | ||
input to the Pressurizer Pressure Control System,reactor trip, and SI. Therefore, the actuation logic must | input to the Pressurizer Pressure Control System, reactor trip, and SI. Therefore, the actuation logic must be able to withstand both an input failure to control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. | ||
Thus, four OPERABLE channels | Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.Catawba Units 1 and 2B332-ReionN.1 B3.3.2-9 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
This Function must be OPERABLE in MODES 1, 2, and 3(above P-I11) to mitigate the consequences of an | This Function must be OPERABLE in MODES 1, 2, and 3 (above P-I11) to mitigate the consequences of an HELB inside containment. | ||
This signal may be manually blocked | This signal may be manually blocked by the operator below the P-1 1 setpoint. | ||
Automatic SI actuation below this pressure setpoint is then performed by | Automatic SI actuation below this pressure setpoint is then performed by the Containment Pressure-High signal.This Function is not required to be OPERABLE in MODE 3 below the P-Il setpoint. | ||
Other ESF functions are used | Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation. | ||
: 2. Deleted.3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment. | : 2. Deleted.3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment. | ||
This Function is necessary to prevent | This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.There are two separate Containment Isolation signals, Phase A and Phase B. Phase A isolation isolates all automatically isolable process lines, except component cooling water (CCW) and nuclear service water system (NSWS), at a relatively low containment pressure indicative of primary or secondary system leaks. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required)method of decay heat removal. Since CCW and NSWS are required to support ROP operation, not isolating CCW and NSWS on the low pressure Phase A signal enhances unit safety by allowing operators to use forced RCS circulation to cool the unit.Isolating CCW and NSWS on the low pressure signal may force the use of feed and bleed cooling, which could prove more difficult to control.Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-10 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LOCO, and APPLICABILITY (continued) | ||
Phase A containment isolation is actuated automatically by SI, or manually via the actuation circuitry. | |||
Since CCW and NSWS | All process lines penetrating containment, with the exception of CCW and NSWS, are isolated.CCW is not isolated at this time to permit continued operation of the RCPs with cooling water flow to the thermal barrier heat exchangers and air or oil coolers. All process lines not equipped with remote operated isolation valves are manually closed, or otherwise isolated, prior to reaching MODE 4.Manual Phase A Containment Isolation is accomplished by either of two switches in the control room. Either switch actuates its associated train.The Phase B signal isolates CCW and NSWS. This occurs at a relatively high containment pressure that is indicative of a large break LOCA or an SLB. For these events, forced circulation using the RCPs is no longer desirable. | ||
Phase A containment isolation is actuated automatically by SI, | Isolating the CCW and NSWS at the higher pressure does not pose a challenge to the containment boundary because the CCW System and NSWS are closed loops inside containment. | ||
All process lines penetrating containment, with the exception of CCW and NSWS, are isolated. | Although some system components do not meet all of the ASME Code requirements applied to the containment itself, the systems are continuously pressurized to a pressure greater than the Phase B setpoint. | ||
CCW is not isolated at this time to permit continued operation | Thus, routine operation demonstrates the integrity of the system pressure boundary for pressures exceeding the Phase B setpoint.Furthermore, because system pressure exceeds the Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment. | ||
All process lines not | Therefore, the combination of CCW System and NSWS design and Phase B isolation ensures there is not a potential path for radioactive release from containment. | ||
Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-11 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | |||
Isolating the CCW and NSWS | Phase B containment isolation is actuated by Containment Pressure-High High, or manually, via the automatic actuation logic, as previously discussed. | ||
Although some system components do | For containment pressure to reach a value high enough to actuate Containment Pressure-High High, a large break LOCA or SLB must have occurred. | ||
Thus, | RCP operation will no longer be required and CCW to the RCPs and NSWS to the RCP motor coolers are, therefore, no longer necessary. | ||
Furthermore, because system pressure exceeds the Phase | The RCPs can be operated with seal injection flow alone and without CCW flow to the thermal barrier heat exchanger. | ||
Therefore, the combination of | Manual Phase B Containment Isolation is accomplished by pushbuttons on the main control board. In addition to manually initiating a Phase B Containment Isolation, the pushbuttons also isolate the containment ventilation system.a. Containment Isolation-Phase A Isolation (1) Phase A Isolation-Manual Initiation Manual Phase A Containment Isolation is actuated by either of two switches in the control room. Each switch actuates its respective train.(2) Phase A Isolation-Automatic Actuation Lo~qic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.Manual and automatic initiation of Phase A Containment Isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a Phase A Containment Isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-12 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) system level manual initiation. | ||
Catawba Units 1 and 2 B3321 eiinN. | In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase A Containment Isolation. | ||
Phase B containment isolation is actuated by Containment Pressure-High High, or manually, via the automatic actuation logic,as previously discussed. | There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions. | ||
For containment pressure to reach | (3) Phase A Isolation-Safety Iniection Phase A Containment Isolation is also initiated by all Functions that initiate SI. The Phase A Containment Isolation requirements for these Functions are the same as the requirements for their SI function.Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements. | ||
RCP operation | : b. Containment Isolation-Phase B Isolation Phase B Containment Isolation is accomplished by manual Initiation, Automatic Actuation Logic and Actuation Relays, and by Containment Pressure channels. | ||
The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips that may damage the RCPs.(1) Phase B Isolation-Manual Initiation (2) Phase B Isolation-Automatic Actuation Loqjic and Actuation Relays Manual and automatic initiation of Phase B containment isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated on a Phase B Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-13 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) containment isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. | |||
Manual Phase B Containment Isolation is accomplished | In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase B containment isolation. | ||
Automatic actuation logic | There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions. | ||
In MODES 5 and 6, there | (3) Phase B Isolation-Containment Pressure -High-High Containment Pressure -High-High uses four channels in a two-out-of-four logic configuration. | ||
There also is adequate time for the operator | Since containment pressure is not used for control, this arrangement exceeds the minimum redundancy requirements. | ||
(3) Phase A Isolation-Safety Iniection Phase A Containment Isolation is also initiated by | Additional redundancy is warranted because this Function is energize to trip.Containment Pressure -High-High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break.In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to pressurize the containment and reach the Containment Pressure -High-High setpoints. | ||
Therefore, the requirements are not repeated | : 4. Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment. | ||
Rapid isolation of the steam lines will limit the steam break accident to the blowdown from one SG, at most. For an SLB upstream of the main steam isolation valves (MSIVs), inside or outside of containment, closure of the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSIVs terminates the accident as soon as the steam lines depressurize. | |||
: b. Containment Isolation-Phase B Isolation Phase B Containment Isolation is accomplished by | Steam Line Isolation also mitigates the effects of a feed line break and ensures a source of steam for the turbine driven AFW pump during a feed line break.Catawba Units 1 and 2.B3321ReionN.1 B 3.3.2-14 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips | : a. Steam Line Isolation-Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two system level switches in the control room and either switch can initiate action to immediately close all MSIVs. The LCO requires two channels to be OPERABLE. | ||
Automatic actuation logic and actuation relays must | Individual valves may also be closed using individual hand switches in the control room. The LCO requires four individual channels to be OPERABLE.b. Steam Line Isolation-Automatic Actuation Loqic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB or other accident. | ||
In MODES 5 and 6, there | This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed and de-activated. | ||
There also | In MODES 4, 5, and 6, there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.c. Steam Line Isolation-Containment Pressure-Higqh High This Function actuates closure of the MSIVs in the event of a LOCA or an SLB inside containment to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment. | ||
(3) Phase B Isolation-Containment Pressure | |||
-High-High Containment Pressure | |||
-High-High uses | |||
Since containment pressure is not used for control,this arrangement exceeds the minimum redundancy requirements. | |||
Additional redundancy is warranted because this Function is energize to trip.Containment Pressure | |||
-High-High must | |||
-High-High setpoints. | |||
: 4. Steam Line Isolation Isolation of the main steam lines provides protection in the event | |||
Rapid isolation of the | |||
inside or outside of containment, closure of | |||
Steam Line Isolation also mitigates the effects of a feed line | |||
: a. Steam Line Isolation-Manual Initiation Manual initiation of Steam Line Isolation can | |||
Individual | |||
This | |||
In MODES 4, 5, and 6, there | |||
Containment Pressure-High High uses four channels in a two-out-of-four logic configuration. | Containment Pressure-High High uses four channels in a two-out-of-four logic configuration. | ||
Since containment pressure is not | Since containment pressure is not used for control, this arrangement exceeds the minimum redundancy requirements. | ||
Additional redundancy | Additional redundancy is warranted because this Function is energize to trip.Containment Pressure-High High must be OPERABLE in MODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection Catawba Units 1 and 2 B3321 eiinN.1 B3.3.2-15 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) and closure of the MSIVs. The Steam Line Isolation Function remains OPERABLE in MODES 2 and 3 unless all MSIVs are closed and de-activated. | ||
In MODES 4, 5, and 6, there is not enough energy. in the primary and secondary sides to pressurize the containment to the Containment Pressure-High High setpoint.d. Steam Line Isolation-Steam Line Pressure Steam Line Pressure channels provide both protection and control functions. | |||
In MODES 4, 5, and 6,there is not enough energy. in the primary and secondary sides to pressurize the containment to the Containment Pressure-High High setpoint. | The protection functions include: Steam Line Pressure-Low and Steam Line Pressure-Negative Rate functions. | ||
The control functions include: Digital Feedwater Control System (DECS) which controls SG level.(1) Steam Line Pressure-Low Steam Line Pressure-Low provides closure of the MSIVs in the event of an SLB to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment. | |||
The protection functions include: | This Function provides closure of the MSIVs in the event of a feed line break to ensure a supply of steam for the turbine driven AFW pump.DFCS receives steam pressure inputs from three separate protection channels for each SG. The three inputs are median selected for each SG, with the resultant output being used by the automatic control algorithm. | ||
The median select feature prevents the failure of an input signal from affecting the control system. A loss of two or more input signals will place the control system in manual and alert the operator.DFCS will maintain a steady control function during the switch to manual operation; therefore, a failure of one or more input signals will not cause a control system action that would result in a condition requiring protective actions. Thus, three OPERABLE channels on each steam line, with a two-out-of-three logic on each steam line, are sufficient to satisfy protective requirements. | |||
The control functions include: | Steam Line Pressure-Low Function must be OPERABLE in MODES 1, 2, and 3 (above P-i11), with any main steam valve open, when a secondary side Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-16 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) break or stuck open valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the P-i11 setpoint. | ||
Digital Feedwater Control System (DECS) which controls SG level.(1) Steam Line Pressure-Low Steam Line Pressure-Low provides closure of | Below P-i11, an inside containment SLB will be terminated by automatic actuation via Containment Pressure-High High. Stuck valve transients and outside containment SLBs will be terminated by the Steam Line Pressure-Negative Rate-High signal for Steam Line Isolation below P-i11 when SI has been manually blocked. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSlVs are closed and de-activated. | ||
This Function provides closure of the MSIVs in | This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.(2) Steam Line Pressure-Neciative Rate-Hicjh Steam Line Pressure-Negative Rate-High provides closure of the MSlVs for an SLB when less than the P-i11 setpoint, to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment. | ||
The median select feature prevents | When the operator manually blocks the Steam Line Pressure-Low main steam isolation signal when less than the P-1 1 setpoint, the Steam Line Pressure-Negative Rate-High signal is automatically enabled. DFCS receives steam pressure inputs from three separate protection channels for each SG. The three inputs are median selected for each SG, with the resultant output being used by the automatic control algorithm. | ||
DFCS will maintain a steady control function | The median select feature prevents the failure of an input signal from affecting the control system. A loss of two or more input signals will place the control system in manual and alert the operator. | ||
Thus, three | DFCS will maintain a steady control function during the switch to manual operation; therefore, a failure of one or more input signals will not cause a control system action that would result in a condition requiring protective actions. Thus, three OPERABLE channels on each steam line, with a two-out-of-three logic on each steam line, are sufficient to satisfy protective requirements. | ||
Steam Line Pressure-Low Function must | Catawba Units 1 and 2 B3321 eiinN.i B 3.3.2-17 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Below P-i11, an inside containment SLB | Steam Line Pressure-Negative Rate-High must be OPERABLE in MODE 3 when less than the P-i11 setpoint, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). In MODES 1 and 2, and in MODE 3, when above the P-11I setpoint, this signal is automatically disabled and the Steam Line Pressure-Low signal is automatically enabled. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MSIVs are closed and de-activated. | ||
The | In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to have an SLB or other accident that would result in a release of significant enough quantities of energy to cause a cooldown of the RCS.5. Turbine Trip and Feedwater Isolation The primary functions of the Turbine Trip and Feedwater Isolation signals are to prevent damage to the turbine due to water in the steam lines, stop the excessive flow of feedwater into the SGs, and to limit the energy released into containment. | ||
These Functions are necessary to mitigate the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows. Feedwater Isolation serves to limit the energy released into containment upon a feedwater line or steam line break inside containment. | |||
(2) Steam Line Pressure-Neciative Rate-Hicjh Steam Line Pressure-Negative Rate-High | The Functions are actuated when the level in any SG exceeds the high high setpoint, and performs the following functions: | ||
When | * Trips the main turbine;* Trips the MFW pumps;* Initiates feedwater isolation; and* Shuts the MFW regulating valves and the bypass feedwater regulating valves.Turbine Trip and Feedwater Isolation signals are both actuated by SG Water Level-High High, or by an SI signal. The RTS also initiates a turbine trip signal whenever a reactor trip (P-4) is generated. | ||
A Feedwater Isolation signal is also generated by a Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-18 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) reactor trip (P-4) coincident with Ta,,gLow and on a high water level in the reactor building doghouse. | |||
The median select feature prevents the failure of | The MEW System is also taken out of operation and the AFW System is automatically started. The SI signal was discussed previously. | ||
DFCS | : a. Turbine Trip (1) Turbine Tripj-Automatic Actuation Loqic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.(2) Turbine Tripj-Steam Generator Water Level-Higqh Higqh (P-14)This signal prevents damage to the turbine due to water in the steam lines. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation. | ||
Thus, three OPERABLE channels on | Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.The setpoints are based on percent of narrow range instrument span.(3) Turbine Trip-Safety Iniection Turbine Trip is also initiated by all Functions that initiate SI. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 1, SI, is referenced for all initiating functions and requirements. | ||
Catawba Units 1 and 2 B3321 eiinN. | Item 5.a.(1) is referenced for the applicable MODES.The Turbine Trip Function must be OPERABLE in MODES 1 and 2. In lower MODES, the turbine generator is not in service and this Function is not required to be OPERABLE.b. Feedwater Isolation Catawba Units 1 and 2 B3321 eiinN.1 B3.3.2-19 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Steam Line Pressure-Negative Rate-High must | (1) Feedwater Isolation-Automatic Actuation Loqic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.(2) Feedwater Isolation-Steam Generator Water Level-Hi~qh Hicqh (P-14)This signal provides protection against excessive feedwater flow. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation. | ||
In MODES 1 and 2, and in MODE 3,when above the P-11I setpoint, this signal | Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.The setpoints are based on percent of narrow range instrument span.(3) Feedwater Isolation-Safety Iniection Feedwater Isolation is also initiated by all Functions that initiate SI. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI function. | ||
The Steam | Therefore, the requirements are not repeated in Table 3.3.2-1.Instead Function 1, SI, is referenced for all initiating functions and requirements. | ||
In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to have | Item 5.b.(1) is referenced for the applicable MODES.(4) Feedwater Isolation | ||
These Functions | -RCS Low coincident with Reactor Trip (P-4)This signal provides protection against excessive cooldown, which could subsequently introduce a positive reactivity excursion after a plant trip. There are four channels of RCS Tavg -Low (one per loop), with a two-out-of-four logic required coincident with a reactor trip signal (P-4) to initiate a feedwater isolation. | ||
The Functions are actuated when the level in any SG exceeds | The P-4 interlock is discussed in Function 8.a.Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-20 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
* Trips the main turbine;* Trips the MFW pumps;* Initiates feedwater isolation; and* Shuts the MFW regulating valves and the bypass feedwater regulating valves.Turbine Trip and Feedwater Isolation signals are both actuated | |||
A Feedwater Isolation signal is also generated by | |||
The MEW System is also | |||
: a. Turbine Trip(1) Turbine Tripj-Automatic Actuation Loqic and Actuation | |||
Thus, four OPERABLE channels are required | |||
Instead Function 1, SI, | |||
Item 5.a.(1) is referenced for | |||
(1) Feedwater Isolation-Automatic Actuation Loqic | |||
Thus, four OPERABLE channels are required | |||
Therefore, | |||
Item 5.b.(1) | |||
-RCS Low coincident | |||
The P-4 interlock is discussed in | |||
(5) Feedwater Isolation | (5) Feedwater Isolation | ||
-Doqhouse Water Level - | -Doqhouse Water Level -Hiqh This signal initiates a Feedwater Isolation. | ||
The signal terminates forward feedwater flow in the event of a postulated pipe break in the main feedwater piping in the doghouses to prevent flooding safety related equipment essential to the safe shutdown of the plant. Each doghouse contains two trains of level instrumentation. | |||
The level instrumentation | The level instrumentation consists of six level switches (three per train) in each of the two reactor building doghouses. | ||
A high-high | A high-high level detected by two-out-of-three switches, in either the inboard or outboard doghouse, will initiate a doghouse isolation. | ||
This signal initiates Feedwater Isolation for the specific doghouse where the High-High level is detected and trips both main feedwater pumps thus causing a main turbine trip.The Feedwater Isolation Function must be OPERABLE in MODES 1 and 2 and also in MODE 3 (except for the functions listed in Table 3.3.2-1). | |||
Feedwater Isolation is not required OPERABLE when all MFIVs, MFCVs, and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In lower MODES, the MFW System is not in service and this Function is not required to be OPERABLE.6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available. | |||
This signal initiates Feedwater Isolation for the specific doghouse where the High-High level is detected and trips both main feedwater pumps thus causing a main turbine trip.The Feedwater Isolation Function must be OPERABLE | The system has two motor driven pumps and a turbine driven pump, making it available during normal and accident operation. | ||
Feedwater Isolation is | The normal source of water for the AFW System is the condensate storage system (not safety related). | ||
A low suction pressure to the AFW pumps will automatically realign the pump suctions to the Nuclear Service Water System (NSWS)(safety related). | |||
The system has two motor driven pumps and a | The AFW System is aligned so that upon a pump start, flow is initiated to the respective SGs immediately. | ||
The normal source of water for the AFW System is | : a. Auxiliary Feedwater-Automatic Actuation Loq ic and Actuation Relays Automatic actuation logic and actuation relays consist of the Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-21 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCD, and APPLICABILITY (continued) same features and operate in the same manner as described for ESFAS Function 1 .b.b. Auxiliary Feedwater-Steam Generator Water Level-Low Low SG Water Level-Low Low provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. SG Water Level-Low Low provides input to the SG Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system which may then require a protection function actuation and a single failure in the other channels providing the protection function actuation. | ||
A low | Thus, four OPERABLE channels are required to satisfy the requirements with two-out-of-four logic. The setpoints are based on percent of narrow range instrument span.SG Water Level--Low Low in any operating SG will cause the motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level--Low Low in any two operating SGs will cause the turbine driven pumps to start.c. Auxiliary Feedwater--Safety Iniection An SI signal starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function. | ||
The AFW System is aligned so that upon a pump start,flow is initiated to the respective SGs immediately. | Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements. | ||
: a. Auxiliary Feedwater-Automatic Actuation Loq | : d. Auxiliary Feedwater-Loss of Offsite Power A loss of offsite power to the service buses will be accompanied by a loss of reactor coolant pumping power and the subsequent need for some method of decay heat removal. The loss of offsite power is detected by a voltage drop on each essential service bus. Loss of power to either essential service bus will start the turbine driven and motor driven AFW pumps to ensure that at least two SGs contain enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip.Catawba Units 1 and 2B332-2RvsoNo1 B 3.3.2-22 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Thus, four | Functions 6.a through 6.d must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor.These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation. | ||
Therefore, the requirements are not repeated | : e. Auxiliary Feedwater-Trip of All Main Feedwater Pumps A Trip of all MFW pumps is an indication of a loss of MEW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure. | ||
Each turbine driven MFW pump is equipped with three pressure switches on the trip oil system. A low pressure signal from two-out-of-three of these pressure switches indicates a trip of that pump. Three OPERABLE channels per pump satisfy redundancy requirements with two-out-of-three logic. A trip of all MEW pumps starts the motor driven AFW pumps to ensure that at least two SGs are available with water to act as the heat sink for the reactor. This function must be OPERABLE in MODES 1 and 2. This ensures that at least two SGs are provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident. | |||
: d. Auxiliary Feedwater-Loss of Offsite | In MODES 3, 4, and 5, the MEW pumps may be normally shut down, and thus neither pump trip is indicative of a condition requiring automatic AFW initiation. | ||
The loss of offsite power is detected by a | : f. Auxiliary Feedwater-Pump Suction Transfer on Suction Pressure-Low A low pressure signal in the AFW pump suction line protects the AFW pumps against a loss of the normal supply of water for the pumps, the condensate storage system. Three pressure switches per train are located on the AFW pump suction line from the condensate storage system. A low pressure signal sensed by two-out-of-three switches will align their train related motor driven AFW pump and the turbine driven AFW pump to the assured water supply (NSWS). The NSWS (safety grade) is then lined up to supply the AFW pumps to ensure an adequate supply of water for the AFW Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-23 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Functions 6.a through 6.d must be OPERABLE in MODES 1, 2,and 3 to ensure that the SGs remain the heat sink for the reactor.These Functions do not have to be OPERABLE in MODES 5 and | System to maintain at least two of the SGs as the heat sink for reactor decay heat and sensible heat removal.This Function must be OPERABLE in MODES 1, 2, and 3 to ensure a safety grade supply of water for the AFW System to maintain the SGs as the heat sink for the reactor. This Function does not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW automatic suction transfer does not need to be OPERABLE because RHR will already be in operation, or sufficient time is available to place RHR in operation, to remove decay heat.7. Automatic Switchover to Containment Sump At the end of the injection phase of a LOCA, the RWST will be nearly empty. Continued cooling must be provided by the ECOS to remove decay heat. The source of water for the ECCS pumps is automatically switched to the containment recirculation sump. The low head residual heat removal (RHR) pumps and containment spray pumps draw the water from the containment recirculation sump, the RHR pumps pump the water through the RHR heat exchanger, inject the water back into the RCS, and supply the cooled water to the other ECCS pumps. Switchover from the RWST to the-containment sump must occur before the RWST empties to prevent damage to the RHR pumps and a loss of core cooling capability. | ||
: e. Auxiliary Feedwater-Trip of All Main Feedwater | : a. Automatic Switchover to Containment Sump-Automatic Actuation Locqic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.b. Automatic Switchover to Containment Sump-Refuelinq Water Stora~qe Tank (RWST)Level-Low Coincident With Safety Iniection During the injection phase of a LOCA, the RWST is the source of water for all ECCS pumps. A low level in the RWST coincident with an SI signal provides protection against a loss of water for the ECCS pumps and indicates the end of the injection phase of the LOCA. The RWST is equipped with four level transmitters. | ||
Each turbine driven | These transmitters Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-24 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) provide no control functions. | ||
This function must be OPERABLE | Since an inadvertent switchover to the containment sump could have a significant safety impact, this instrumentation is placed in a bypass condition for testing. Therefore, four channels are supplied such that, during testing, the remaining three channels could perform the intended function, and no single failure could result in either a failure to accomplish the intended function, or in an inadvertent switchover to the containment sump.Automatic switchover occurs only if the RWST low level signal is coincident with SI. This prevents accidental switchover during normal operation. | ||
In MODES 3, 4, and 5, the MEW pumps may | Accidental switchover could damage ECCS pumps if they are attempting to take suction from an empty sump. The automatic switchover Function requirements for the SI Functions are the same as the requirements for their SI function. | ||
: f. Auxiliary Feedwater-Pump Suction Transfer | Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements. | ||
System to maintain at least two of the SGs as the heat | These Functions must be OPERABLE in MODES 1, 2, 3, and 4 when there is a potential for a LOCA to occur, to ensure a continued supply of water for the ECOS pumps.These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. | ||
System pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.8. Engqineered Safety Feature Actuation System Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlock Functions back up manual actions to ensure bypassable functions are in operation under the conditions assumed in the safety analyses.Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-25 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | |||
: a. Automatic Switchover to Containment Sump-Automatic Actuation Locqic and Actuation | : a. Engineered Safety Feature Actuation System Interlocks--Reactor Trip. P-4 The P-4 interlock is enabled when a reactor trip breaker (RTB) and its associated bypass breaker is open. Operators are able to reset SI 60 seconds after initiation. | ||
These transmitters Catawba Units 1 and 2 B3322 eiinN. | If a P-4 is present when SI is reset, subsequent automatic SI initiations will be blocked until the RTBs have been manually closed.This Function allows operators to take manual control of SI systems after the initial phase of injection is complete while avoiding multiple SI initiations. | ||
Since an inadvertent switchover to the containment sump could have a significant safety impact, this instrumentation is placed in a | The functions of the P-4 interlock are:* Trip the main turbine;* Isolate MFW with coincident low Tavg;* Prevent reactuation of SI after a manual reset of SI;* Transfer the steam dump from the load rejection controller to the unit trip controller; and* Prevent opening of the MFW isolation valves if they were closed on SI or SG Water Level--High High.Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS following a reactor trip. An excessive cooldown of the RCS following a reactor trip could cause an insertion of positive reactivity with a subsequent increase in generated power. To avoid such a situation, the noted Functions have been interlocked with P-4 as part of the design of the unit control and protection system.None of the noted Functions serves a mitigation function in the unit licensing basis safety analyses. | ||
Therefore, four channels are | Only the turbine trip Function is explicitly assumed since it is an immediate consequence of the reactor trip Function. | ||
Neither turbine trip, nor any of the other four Functions associated with the reactor trip signal, is required to show that the unit licensing basis safety analysis acceptance criteria are not exceeded.The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts. | |||
Therefore, this Function has no adjustable Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-26 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) trip setpoint with which to associate a Trip Setpoint and Allowable Value.This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may be critical or approaching criticality. | |||
Accidental switchover could damage ECCS pumps if they are attempting to | This Function does not have to be OPERABLE in MODE 4, 5, or 6 because the main turbine, the MFW System, and the Steam Dump System are not in operation. | ||
Therefore, | : b. Engqineered Safety Feature Actuation System Interlocks-Pressurizer Pressure. | ||
Instead,Function 1, SI, is referenced for all initiating Functions | P-11I The P-i1I interlock permits a normal unit cooldown and depressurization without actuation of SI or main steam line isolation. | ||
These Functions must be OPERABLE in MODES 1, 2, 3,and 4 when there is a potential for a LOCA to occur, | With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-i11 setpoint, the operator can manually block the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal (previously discussed). | ||
When the Steam Line Pressure-Low steam line isolation signal is manually blocked, a main steam isolation signal on Steam Line Pressure-Negative Rate-High is enabled. This provides protection for an SLB by closure of the MSIVs. With two-out-of-three pressurizer pressure channels above the P-i11 setpoint, the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal are automatically enabled. The operator can also enable these trips by use of the respective manual reset buttons. When the Steam Line Pressure-Low steam line isolation signal is enabled, the main steam isolation on Steam Line Pressure-Negative Rate--High is disabled.This Function must be OPERABLE in MODES 1, 2, and 3 to allow an orderly cooldown and depressurization of the unit without the actuation of SI or main steam isolation. | |||
This Function does not have to be OPERABLE in MODE 4, 5, or 6 because system pressure must already be below the P-i1!setpoint for the requirements of the heatup and cooldown curves to be met.c. Engqineered Safety Feature Actuation System lnterlocks-T~v-Low Low. P-i12 On increasing reactor coolant temperature, the P-12 interlock provides an arming signal to the Steam Dump System. On a Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-27 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) decreasing temperature, the P-i12 interlock removes the arming signal to the Steam Dump System to prevent an excessive cooidown of the RCS due to a malfunctioning Steam Dump System.Since Tavg is used as an indication of bulk RCS temperature, this Function meets redundancy requirements with one OPERABLE channel in each loop. These channels are used in two-out-of-four logic. This Function must be OPERABLE in MODES 1, 2, and 3 when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This Function does not have to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to have an accident.9. Containment Pressure Control System Permissives The Containment Pressure Control System (CPCS) protects the Containment Building from excessive depressurization by preventing inadvertent actuation or continuous operation of the Containment Spray and Containment Air Return Systems when containment pressure is at or less than the CPCS permissive setpoint. | |||
Catawba Units 1 and 2 B3322 eiinN. | The control scheme of CPCS is comprised of eight independent control circuits (4 per train), each having a separate and independent pressure transmitter and current alarm module.Each pressure transmitter monitors the containment pressure and provides input to its respective current alarm. The current alarms are set to inhibit or terminate containment spray and containment air return systems when containment pressure falls to or below 0.25 psid. The alarm modules switch back to the permissive state (allowing the systems to operate) when containment pressure is greater than or equal to 1.0 psid.This function must be OPERABLE in MODES 1, 2, :3, and 4 when there is sufficient energy in the primary and secondary sides to pressurize containment following a pipe break. In MODES 5 and 6, there is insufficient energy in the primary and secondary sides to significantly pressurize the containment. | ||
: a. Engineered Safety Feature Actuation | : 10. Nuclear Service Water System Suction Transfer -Low Pit Level Upon an emergency low pit level signal from either NSWS pit, interlocks isolate the NSWS from Lake Wylie, align NSWS to the standby nuclear service water pond, close particular crossover Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-28 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) valves, and start the NSWS pumps. This function is initiated on a two-out-of-three logic from either NSWS pump pit.This function must be OPERABLE in MODES 1, 2, 3, and 4 to ensure cooling water remains available to essential components during a DBA. In MODES 5 and 6, the sufficient time exists for manual operator action to realign the NSWS pump suction, if required.Unlike other shared NSWS equipment, the pit level interlocks do not require both normal and emergency power for OPERABILITY. | ||
If a P-4 | This is because unlike mechanical components such as pumps and valves, the interlocks are designed to fail safe upon a loss of power, initiating a transfer from Lake Wylie to the standby nuclear service water pond. The definition of OPERABILITY, which requires either normal or emergency power, provides sufficient power supply requirements and these interlocks can be considered OPERABLE provided they are powered from either an inverter or regulated power.The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36 (Ref.6).ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1. When the Required Channels in Table 3.3.2-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate. | ||
The functions of the P- | A channel shall be OPERABLE if the point at which the channel trips is found more conservative than the Allowable Value. In the event a channel's trip setpoint is found less conservative than the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected. | ||
Only the turbine | If plant conditions warrant, the trip setpoint may be set outside the NOMINAL TRIP SETPOINT calibration tolerance band as long as the trip setpoint is conservative with respect to the NOMINAL TRIP SETPOINT. | ||
Neither | If the trip setpoint is found outside of the NOMINAL TRIP SETPOINT calibration tolerance band and non-conservative with respect to the NOMINAL TRIP SETPOINT, the setpoint shall be re-adjusted. | ||
The RTB position switches that provide input to the P- | Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-29 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
Therefore, this Function has no adjustable Catawba Units 1 and 2 B3322 eiinN. | When the number of inoperable channels in a trip function exceed those specified in one or other related Conditions associated with a trip function, then the unit is outside the safety analysis. | ||
This Function does not have to be OPERABLE in MODE 4,5, or 6 because the main turbine, the MFW System, and | Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation. | ||
: b. Engqineered Safety Feature Actuation | A.__1 Condition A applies to all ESFAS protection functions. | ||
P- | Condition A addresses the situation where one or more channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected. | ||
With two-out-of-three pressurizer | The Completion Times are those from the referenced Conditions and Required Actions.B.1, B.2.1 and B.2.2 Condition B applies to manual initiation of:* SI;* Containment Spray;* Phase A Isolation; and* Phase B Isolation. | ||
When the | This action addresses the train orientation of the SSPS for the functions listed above. If a channel or train is inoperable, 48 hours is allowed to return it to an OPERABLE status. Note that for containment spray and Phase B isolation, failure of one or both channels in one train renders the train inoperable. | ||
This | |||
The operator can also enable | |||
This Function must be OPERABLE in MODES 1, 2, and 3 | |||
The control scheme of CPCS is comprised of | |||
: 10. Nuclear Service Water System Suction Transfer | |||
-Low Pit | |||
Unlike other shared NSWS equipment, the pit level interlocks | |||
This is because unlike mechanical components such as pumps | |||
A channel shall be OPERABLE if the point at which the channel trips | |||
If plant conditions | |||
If the | |||
Catawba Units 1 and 2 B3322 eiinN. | |||
When the number of inoperable channels in a trip function exceed | |||
Therefore, LCO 3.0.3 should be immediately entered if applicable in the | |||
A. | |||
Condition A addresses the situation where one or more channels or | |||
The Completion Times | |||
This action addresses the train orientation of the SSPS for the functions listed above. If a channel or train is inoperable, 48 hours is allowed | |||
Condition B, therefore, encompasses both situations. | Condition B, therefore, encompasses both situations. | ||
The specified Completion Time is reasonable considering that there | The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each Function, and the low probability of an event occurring during this interval. | ||
If the train cannot be restored | If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours (54 hours total time) and in MODE 5 within an additional 30 hours (84 hours total time). The allowable Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-30 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1. 0.2.1 and 0.2.2 Condition C applies to the automatic actuation logic and actuation relays for the following functions: | ||
* SI;* Phase A Isolation; | * SI;* Phase A Isolation; | ||
* Phase B Isolation; and* Automatic Switchover to Containment Sump.This action addresses the train orientation of the SSPS and the | * Phase B Isolation; and* Automatic Switchover to Containment Sump.This action addresses the train orientation of the SSPS and the master and slave relays. If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference | ||
: 13. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an | : 13. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. | ||
If the train cannot be restored | If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours (30 hours total time) and in MODE 5 within an additional 30 hours (60 hours total time). The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing, provided the other train is OPERABLE. | ||
The Required Actions are not required to be met during this time, unless the train is discovered inoperable during the testing. This allowance is based on the reliability analysis assumption of WCAP-1 0271-P-A (Ref. 7) that 4 hours is the average time required to perform train surveillance. | |||
The Required Actions are not required to be | Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-31 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1, D.2.1. and D.2.2 Condition 0 applies to:* Containment Pressure-High; | ||
This allowance is based on the reliability analysis assumption | |||
Catawba Units 1 and 2 B3323 eiinN. | |||
* Pressurizer Pressure-Low; | * Pressurizer Pressure-Low; | ||
* Steam Line Pressure-Low; | * Steam Line Pressure-Low; | ||
* Steam Line Pressure-Negative Rate-High; | * Steam Line Pressure-Negative Rate-High; | ||
* Loss of offsite power (refer to Condition D footnote); | * Loss of offsite power (refer to Condition D footnote); | ||
* SG Water level--Low Low; and* SG Water level--High High (P-14) for the Feedwater Isolation Function. | * SG Water level--Low Low; and* SG Water level--High High (P-14) for the Feedwater Isolation Function.If one channel is inoperable, 72 hours are allowed to restore the channel to OPERABLE status or to place it in the tripped condition. | ||
If one channel is inoperable, 72 hours are allowed to restore the | Generally this Condition applies to functions that operate on two-out-of-three logic.Therefore, failure of one channel places the Function in a two-out-of-two configuration. | ||
Generally | One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements. | ||
One channel must be tripped to place the Function in | The 72 hours allowed to restore the channel to OPERABLE status or to place it in the tripped condition is justified in Reference 13.Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours requires the unit be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing of other channels. | ||
The 12 hours allowed for testing is justified in Reference 13.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-32 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | |||
E.1. E.2.1, and E.2.2 Condition E applies to:* Containment Phase B Isolation Containment Pressure-High High;and* Steam Line Isolation Containment Pressure -High High.Neither of these signals has input to a control function. | |||
The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing | |||
The 12 hours allowed for testing is justified | |||
E.1. E.2.1, and E.2. | |||
-High High.Neither of these signals has input to a control function. | |||
Thus, two-out-of-. | Thus, two-out-of-. | ||
three logic is necessary to meet acceptable protective requirements. | three logic is necessary to meet acceptable protective requirements. | ||
However, a two-out-of-three design would require tripping a failed channel. This is undesirable because a single failure would then cause spurious isolation initiation. | |||
This is undesirable because a single failure would then | Therefore, these channels are designed with two-out-of-four logic so that a failed channel may be bypassed rather than tripped. Note that one channel may be bypassed and still satisfy the single failure criterion. | ||
Therefore, these channels are designed | Furthermore, with one channel bypassed, a single instrumentation channel failure will not spuriously initiate isolation. | ||
Note that one channel may be bypassed and still satisfy | To avoid the inadvertent actuation of Phase B containment isolation, the inoperable channel should not be placed in the tripped condition. | ||
Furthermore, with one channel bypassed, a | Instead it is bypassed. | ||
To avoid the inadvertent actuation of Phase B containment isolation, | Restoring the channel to OPERABLE status, or placing the inoperable channel in the bypass condition within 72 hours, is sufficient to assure that the Function remains OPERABLE and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The Completion Time is further justified based on the low probability of an event occurring during this interval. | ||
Failure to restore the inoperable channel to OPERABLE status, or place it in the bypassed condition within 72 hours, requires the unit be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows one additional channel to be bypassed for up to 12 hours for surveillance testing.Placing a second channel in the bypass condition for up to 12 hours for testing purposes is acceptable based on the results of Reference 13.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-33 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | |||
Restoring the channel to OPERABLE status, or | F.1, F.2.1, and F.2.2 Condition F applies to:* Manual Initiation of Steam Line Isolation; and* P-4 Interlock. | ||
Failure to restore the inoperable channel to OPERABLE status,or place it in the bypassed condition within 72 hours, requires the unit | For the Manual Initiation and the P-4 Interlock Functions, this action addresses the train orientation of the SSPS. If a train or channel is inoperable, 48 hours is allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of these Functions, the available redundancy, and the low probability of an event occurring during this interval. | ||
In MODE 4, these Functions are no longer | If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours and MODE 4 within the following 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.G.1 and G.2 Condition G applies to manual initiation of Steam Line Isolation. | ||
The Required Actions are modified by a Note that allows one additional channel to be bypassed for up to 12 hours for surveillance testing.Placing a second channel in the bypass condition for up to 12 hours | This action addresses the operability of the manual steam line isolation function for each individual main steam isolation valve. If a channel is inoperable, 48 hours is allowed to return it to an OPERABLE status. If the train cannot be restored to OPERABLE status, the Conditions and Required Actions of LCO 3.7.2, "Main Steam Isolation Valves," must be entered for the associated inoperable valve. The specified Completion Time is reasonable considering that there is a system level manual initiation train for this Function and the low probability of an event occurring during this interval.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-34 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
F.1, F.2.1, and F.2. | H.1, H.2.1 and H.2.2 Condition H applies to the automatic actuation logic and actuation relays for the Steam Line Isolation, Feedwater Isolation, and AFW actuation Functions. | ||
For the Manual Initiation and the P-4 Interlock Functions, this | The action addresses the train orientation of the SSPS and the master and slave relays for these functions. | ||
If the Function cannot be returned | If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference | ||
In MODE 4, the unit does not | : 13. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. | ||
This action addresses the operability of the manual steam line isolation function for each individual main steam isolation valve. If a channel | If the train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours and MODE 4 within the following 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of the protection channels and actuation functions. | ||
must | In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing provided the other train is OPERABLE. | ||
Catawba Units 1 and 2 B3323 eiinN. | This allowance is based on the reliability analysis (Ref. 7) assumption that 4 hours is the average time required to perform channel surveillance. | ||
H.1, H.2.1 and H.2. | Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-35 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 1.1 and 1.2 Condition I appiies to the automatic actuation logic and actuation relays for the Turbine Trip Function.This action addresses the train orientation of the SSPS and the master and slave relays for this Function. | ||
The action addresses the train orientation of the SSPS and the | If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the following 6 hours. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference | ||
If one train is inoperable, 24 | : 13. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. | ||
: 13. The Completion Time for restoring a train | The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. These Functions are no longer required in MODE 3. Placing the unit in MODE 3 removes all requirements for OPERABILITY of the protection channels and actuation functions. | ||
If the train cannot be returned to OPERABLE status, the | In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing provided the other train is OPERABLE. | ||
Placing the unit in MODE 4 removes all requirements | This allowance is based on the reliability analysis (Ref. 7) assumption that 4 hours is the average time required to perform channel surveillance. | ||
In | J.1 and J.2 Condition J applies to:* SG Water Level--High High (P-14) for the Turbine Trip Function;and* Tavg-LOw.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-36 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
This allowance is based on the reliability analysis(Ref. 7) assumption that 4 hours is the average time required to | If one channel is inoperable, 72 hours are allowed to restore one channel to OPERABLE status or to place it in the tripped condition. | ||
Catawba Units 1 and 2 B3323 eiinN. | If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-three logic will result in actuation. | ||
This action addresses the train orientation of the SSPS and the | The 72 hours allowed to restore the channel to OPERABLE status or place it in the tripped condition is justified in Reference | ||
If one train is inoperable, 24 hours | : 13. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours requires the unit to be placed in MODE 3 within the following 6 hours. The allowed Completion Time of 78 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing of other channels. | ||
: 13. The Completion Time for restoring a train to | The 72 hours allowed to place the inoperable channel in the tripped condition, and the 12 hours allowed for a second channel to be in the bypassed condition for testing, are justified in Reference 13.K.1 and K.2 Condition K applies to the AFW pump start on trip of all MFW pumps.This action addresses the auto start function of the AFW System on loss of all MFW pumps. The OPERABILITY of the AFW System must be assured by allowing automatic start of the AFW System pumps. If a channel is inoperable, 1 hour is allowed to return it to an OPERABLE status or to place the channel in trip. If the function cannot be returned to an OPERABLE status or placed in a trip condition, 6 hours are allowed to place the unit in MODE 3. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, the unit does not have any analyzed transients or conditions that require the explicit use of the protection function noted above.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-37 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
L.1 and L.2 Condition L applies to the Doghouse Water Level -High High.If one channel is inoperable, 6 hours are allowed to restore the channel to OPERABLE status or to place it in the tripped condition. | |||
These Functions are | |||
In this MODE, the unit does not have analyzed transients | |||
This allowance is based on the reliability analysis(Ref. 7) assumption that 4 hours is the average time required to | |||
J.1 and J. | |||
Catawba Units 1 and 2 B3323 eiinN. | |||
If one channel is inoperable, 72 hours are allowed to restore one | |||
If placed | |||
The 72 hours allowed | |||
: 13. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition | |||
In MODE 3,these Functions are no longer required OPERABLE. | |||
The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing | |||
The 72 hours allowed to place the inoperable channel | |||
In MODE 3, the unit does not have any analyzed transients | |||
L.1 and L. | |||
Therefore, failure of one channel places the Function in a two-out-of-two configuration. | Therefore, failure of one channel places the Function in a two-out-of-two configuration. | ||
One channel must be tripped to place the Function in | One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements. | ||
Alternatively, if the inoperable channel is not restored to | Alternatively, if the inoperable channel is not restored to OPERABLE status or placed in the tripped condition within 6 hours, the unit must be placed in MODE 3 within 12 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, this Function is no longer required OPERABLE.Required Action L.1 is modified by a Note that allows the inoperable channel to be bypassed for up to 2 hours for surveillance testing of other channels.M.1, M.2.1 and M.2.2 Condition M applies to the Auxiliary Feedwater Pumps Suction Transfer on Suction Pressure Low.If one channel is inoperable, 1 hour is allowed to restore the channel to OPERABLE status or to place it in the tripped condition. | ||
The failure of one channel places the Function in a two-out-of-two configuration. | |||
Required Action L.1 is modified by a Note that allows the inoperable channel to be bypassed for up to 2 hours for surveillance testing of | One channel must be tripped to place the Function in a one-out-of-three configuration that satisfies redundancy requirements. | ||
M.1, M.2.1 and M.2. | Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 1 hour requires the unit to be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-38 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
The failure | The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, this Function is no longer required OPERABLE.N.1, N.2.1 and N.2.2 Condition N applies to:* RWST Level--Low Coincident with Safety Injection. | ||
RWST Level--Low Coincident With SI provides actuation of switchover to the containment sump. Note that this Function requires the bistables to energize to perform their required action. The failure of up to two channels will not prevent the operation of this Function. | |||
Failure to restore the inoperable channel to OPERABLE status or place | However, placing a failed channel in the tripped condition could result in a premature switchover to the sump, prior to the injection of the minimum volume from the RWST. Placing the inoperable channel in bypass results in a two-out-of-three logic configuration, which satisfies the requirement to allow another failure without disabling actuation of the switchover when required. | ||
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full | Restoring the channel to OPERABLE status or placing the inoperable channel in the bypass condition within 6 hours is sufficient to ensure that the Function remains OPERABLE, and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The 6 hour Completion Time is justified in Reference | ||
: 7. If the channel cannot be returned to OPERABLE status or placed in the bypass condition within 6 hours, the unit must be brought to MODE 3 within the following 6 hours and MODE 5 within the next 30 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows placing a second channel in the bypass condition for up to 2 hours for surveillance testing. The total of 12 hours to reach MODE 3 and 2 hours for a second channel to be bypassed is acceptable based on the results of Reference 7.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-39 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1, 0.2.1 and 0.2.2 Condition 0 applies to the P-11 and P-12 interlocks. | |||
N.1, N.2.1 and N.2. | With one channel inoperable, the operator must verify that the interlock is in the required state for the existing unit condition. | ||
RWST Level--Low Coincident With SI provides actuation of switchover | This action manually accomplishes the function of the interlock. | ||
Determination must be made within 1 hour. The 1 hour Completion Time is equal to the time allowed by LCO 3.0.3 to initiate shutdown actions in the event of a complete loss of ESFAS function. | |||
Restoring the channel to OPERABLE status or placing | If the interlock is not in the required state (or placed in the required state) for the existing unit condition, the unit must be placed in MODE 3 within the next 6 hours and MODE 4 within the following 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of these interlocks. | ||
: 7. If the channel cannot be returned to | P.1 Condition P applies to the Containment Pressure Control System Start and Terminate Permissives. | ||
In MODE 5, the unit does not have any analyzed transients | With one or more channels inoperable, the affected containment spray and containment air return systems components must be declared inoperable immediately. | ||
The total of 12 hours to reach MODE 3 and 2 hours for a | The supported system LCOs provide the appropriate Required Actions and Completion Times for the equipment made inoperable by the inoperable channel. The immediate Completion Time is appropriate since the inoperable channel could prevent the supported equipment from starting when required. | ||
With one channel inoperable, the operator must verify that the interlock | Additionally, protection from an inadvertent actuation may not be provided if the terminate function is not OPERABLE.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-40 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
This action | Q.1, Q.2. Q.3.1. and Q.3.2 With one channel of NSWS Suction Transfer -Low Pit Level inoperable in one or more NSWS pits, 4 hours are allowed to place it in the tripped condition or align the NSWS to the Standby NSWS Pond. The failure of one channel places the Function in a two-out-of-two configuration. | ||
Determination must be | The failed channel must either be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements, or the NSWS realigned to fulfill the safety function.Failure to place the channel in the tripped condition or to realign the NSWS suction and discharge within 4 hours requires the unit be placed in MODE 3 within the following 6 hours and MODE 5 within the next 30 hours.The requirement to align the NSWS to the Standby NSWS Pond only applies to OPERABLE trains of the system.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, this Function is no longer required OPERABLE.R.1. R.2.1, and R.2.2 With two or more channels of NSWS Suction Transfer -Low Pit Level inoperable in one or more pits, the NSWS must be aligned to the Standby NSWS Pond within 4 hours. Failure to accomplish the realignment within 4 hours requires the unit be placed in MODE 3 within the following 6 hours and MODE 5 within the next 30 hours.The requirement to align the NSWS to the Standby NSWS Pond only applies to OPERABLE trains of the system.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, this Function is no longer required OPERABLE.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-41 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE The SRs for each ESFAS Function are identified by the SRs column REQUIREMENTS of Table 3.3.2-1.A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions. | ||
If the interlock is not in the required state (or | Note that each channel of process protection supplies both trains of the ESFAS. When testing channel I, train A and train B must be examined.Similarly, train A and train B must be examined when testing channel II, channel Ill, and channel IV (if applicable). | ||
Placing the unit in MODE 4 removes all requirements | The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies. | ||
P. | SR 3.3.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. | ||
With one or more channels inoperable, the affected containment | A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. | ||
The supported system LCOs provide | It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. | ||
The immediate Completion Time is appropriate since the inoperable channel could prevent | Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and reliability. | ||
Additionally, protection from an inadvertent actuation may not be provided if | If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.2 SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST. The SSPS is tested using the semiautomatic tester. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation. | ||
Catawba Units 1 and 2 B3324 eiinN. | Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-42 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
Q.1, Q.2. Q.3.1. and Q.3. | Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, are tested for each protection function. | ||
-Low Pit Level inoperable | |||
Failure to place the channel in the tripped condition or to realign | |||
R.1. R.2.1, and R.2. | |||
-Low Pit | |||
Catawba Units 1 and 2 B3324 eiinN. | |||
Note that each channel of process protection supplies both trains of | |||
Similarly, train A and train B must be examined when testing channel II,channel Ill, and channel IV (if applicable). | |||
The | |||
SR 3.3.2. | |||
A CHANNEL CHECK is normally | |||
It is based on the assumption | |||
A | |||
Agreement criteria are determined by the unit staff, based on | |||
If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside | |||
Catawba Units 1 and 2 B3324 eiinN. | |||
Through the semiautomatic tester, all possible logic combinations, | |||
In addition, the master relay coil is pulse tested for continuity. | In addition, the master relay coil is pulse tested for continuity. | ||
This verifies that the logic modules are OPERABLE and that there is | This verifies that the logic modules are OPERABLE and that there is an intact voltage signal path to the master relay coils. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.3 SR 3.3.2.3 is the performance of a TADOT. This test is a check of the Loss of Offsite Power Function. | ||
Each Function is tested up to, | Each Function is tested up to, and including, the master transfer relay coils.This test also includes trip devices that provide actuation signals directly to the SSPS. The SR is modified by a Note that excludes final actuation of pumps and valves to minimize plant upsets that would occur. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.4 SR 3.3.2.4 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a low voltage continuity check of the slave relay coil. Upon master relay contact operation, a low voltage is injected to the slave relay coil. This voltage is insufficient to pick up the slave relay, but large enough to demonstrate signal path continuity. | ||
The time allowed | The time allowed for the testing (4 hours) is justified in Reference | ||
: 7. The Surveillance Frequency is based on operating experience, equipment reliability, | : 7. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.5 SR 3.3.2.5 is the performance of a COT.A COT is performed on each required channel to ensure the channel will perform the intended Function. | ||
The tested portion of the loop must | The tested portion of the loop must trip within the Allowable Values specified in Table 3.3.2-1.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-43 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
The setpoint shall be left set consistent with the assumptions of | The setpoint shall be left set consistent with the assumptions of the setpoint methodology. | ||
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.6 SR 3.3.2.6 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is placed in a condition where the relay contact operation can be verified without operation of the equipment. | ||
Actuation equipment that may not | Actuation equipment that may not be operated in the design mitigation MODE is prevented from operation by the SLAVE RELAY TEST circuit. For this latter case, contact operation is verified by a continuity check of the circuit containing the slave relay. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.For slave relays or any auxiliary relays in the ESFAS circuit that are of the type Westinghouse AR or Potter & Brumfield MDR, the SLAVE RELAY TEST Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.7 SR 3.3.2.7 is the performance of a COT on the RWST level and Containment Pressure Control Start and Terminate Permissives. | ||
For this latter case, contact operation | A COT is performed on each required channel to ensure the entire channel will perform the intended Function. | ||
A COT is performed on each required channel to ensure the | Setpoints must be found conservative with respect to the Allowable Values specified in Table 3.3.2-1. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-44 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
Setpoints must be | For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions" has been implemented, this SR is modified by two Notes as identified in Table 3.3.2-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. | ||
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under | The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition. | ||
For Functions for which TSTF-493, "Clarify Application of | The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the NOMINAL TRIP SETPOINT (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. | ||
The first | This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. | ||
The purpose | If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable. | ||
For channels determined to | The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances be in the UFSAR.SR 3.3.2.8 SR 3.3.2.8 is the performance of a TADOT. This test is a check of the Manual Actuation Functions, AFW pump start on trip of all MFW pumps, AFW low suction pressure, Reactor Trip (P-4) Interlock, and Doghouse Water Level -High High Feedwater Isolation. | ||
Entry into the Corrective Action Program | Each Manual Actuation Function is tested up to, and including, the master relay coils. In some instances, the test includes actuation of the end device (i.e., pump starts, valve cycles, etc.). The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. The SR is modified by a Note that excludes verification of setpoints during the TADOT for manual initiation Functions. | ||
The | |||
the as-left and as- | |||
This will ensure that sufficient margin to the Safety Limit and/ | |||
If the as-left channel setting cannot | |||
The second Note also | |||
Each Manual Actuation Function is tested up to, and including, the master relay coils. In | |||
The SR is modified by | |||
The manual initiation Functions have no associated setpoints. | The manual initiation Functions have no associated setpoints. | ||
Catawba Units 1 and 2 B3324 eiinN. | Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-45 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
SIR 3.3.2. | SIR 3.3.2.9 SIR 3.3.2.9 is the performance of a CHANNEL CALIBRATION. | ||
CHANNEL CALIBRATION is a complete check of the instrument ioop,including the sensor. The test verifies that the channel responds | CHANNEL CALIBRATION is a complete check of the instrument ioop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology. | ||
CHANNEL CALIBRATIONS must be performed consistent with | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note stating that this test should include verification that the time constants are adjusted to the prescribed values where applicable. | ||
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under | The applicable time constants are shown in Table 3.3.2-1.For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions" has been implemented, this SR is modified by two Notes as identified in Table 3.3.2-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. | ||
The applicable time constants are shown in | The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition. | ||
The first | The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the NOMINAL TRIP SETPOINT (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. | ||
The purpose | This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. | ||
For channels determined to | If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-46 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) channel shall be declared inoperable. | ||
Entry into the Corrective Action Program | The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances be in the UFSAR.SR 3.3.2.10 This SR ensures the individual channel ESE RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis.Response Time testing acceptance criteria are included in the UFSAR (Ref. 2). Individual component response times are not modeled in the analyses. | ||
The | The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the Trip Setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position). | ||
the as-left and as- | For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate UFSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace, onsite, or offsite (e.g. vendor)test measurements, or (3) utilizing vendor engineering specifications. | ||
This will ensure that sufficient margin to the Safety Limit and/ | WCAP-13632-P-A Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. In addition, while not specifically identified in the WCAP, ITT Barton 386A and 580A-0 sensors were compared to sensors which were identified. | ||
If the as-left channel setting cannot | It was concluded that the WCAP results could be applied to these two sensor types as well. Response time verification for other sensor types must be demonstrated by test.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-47 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
The second Note also | WCAP-1 4036-P-A Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.The allocations for sensor, signal conditioning and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter. | ||
Response Time testing acceptance criteria are included in the UFSAR(Ref. 2). Individual component response times are not modeled in | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note that clarifies that the turbine driven AEW pump is tested within 24 hours after reaching 600 psig in the SGs.SR 3.3.2.11 SR 3.3.2.11 is the performance of a COT on the NSWS Suction Transfer-Low Pit Level.A COT is performed on each required channel to ensure the entire channel will perform the intended Function. | ||
The analyses model the overall or total elapsed time, from | Setpoints must be found within the Allowable Values specified in Table 3.3.2-1. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-48 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
SR 3.3.2.12 SR 3.3.2.12 is the performance of an ACTUATION LOGIC TEST on the Doghouse Water Level-High High and NSWS Suction Transfer-Emergency Low Pit Level Functions. | |||
For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the | An ACTUATION LOGIC TEST to satisfy the requirements of GL 96-01 is performed on each instrumentation to ensure all logic combinations will initiate the appropriate Function. | ||
Response time may be verified by actual response time tests in | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES | ||
Allocations for sensor response times may be obtained from:(1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace, onsite, or offsite (e.g. vendor)test measurements, or (3) utilizing vendor engineering specifications. | |||
WCAP-13632-P-A Revision 2, "Elimination of Pressure Sensor | |||
WCAP-1 4036-P-A Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" provides the basis and methodology | |||
One example where | |||
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under | |||
Setpoints must be | |||
The Surveillance Frequency is based on operating experience, equipment reliability, | |||
SR 3.3.2. | |||
An ACTUATION LOGIC TEST to satisfy the requirements of GL 96-01 | |||
The Surveillance Frequency is | |||
: 1. UFSAR, Chapter 6.2. UFSAR, Chapter 7.3. UFSAR, Chapter 15.4. IEEE-279-1971. | : 1. UFSAR, Chapter 6.2. UFSAR, Chapter 7.3. UFSAR, Chapter 15.4. IEEE-279-1971. | ||
: 5. 10 CFR 50.49.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii). | : 5. 10 CFR 50.49.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii). | ||
: 7. WCAP-1 0271-P-A, Supplement 1 and Supplement 2, Rev. 1, | : 7. WCAP-1 0271-P-A, Supplement 1 and Supplement 2, Rev. 1, May 1986 and June 1990.8. WCAP-1 3632-P-A Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" Sep., 1995.9. WCAP-1 4036-P-A Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" Oct., 1998.10. Not used.11. Not used.12. Not used.13. WCAP-14333-P-A, Revision 1, October 1998.14. Not used.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-49 LTOP System B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.12 Low Temperature Overpressure Protection (LTOP) System BASES BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (PIT) limits of 10 CFR 50, Appendix G (Ref. 1 ). The reactor vessel is the limiting RCPB component for demonstrating such protection. | ||
This specification | This specification provides the maximum allowable actuation logic setpoints for the power operated relief valves (PORVs) and LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," provides the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES.The reactor vessel material is less tough at low temperatures than at normal operating temperature. | ||
provides the maximum RCS pressure for the existing | As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased. | ||
The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. | |||
As the vessel neutron | Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3 requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the specified limits.This LCO provides RCS overpressure protection by having a minimum coolant input capability and having adequate pressure relief capacity.Limiting coolant input capability requires all but two pumps incapable of injection into the RCS, isolating the accumulators, and limiting reactor coolant pump operation at low temperatures. | ||
The potential for vessel overpressurization is most acute when the RCS | The pressure relief capacity requires two redundant RCS relief valves. One RCS relief valve is the overpressure protection device that acts to terminate an increasing pressure event.With minimum coolant input capability, the ability to provide core coolant addition is restricted. | ||
Exceeding the RCS P/T limits by a significant amount could cause | The LCO does not require the makeup control Catawba Units 1 and 2B34121RvsoN.5 B 3.4.12-1 Revision No. 5 LTOP System B 3.4.12 BASES BACKGROUND (continued) system deactivated or the safety injection (SI) actuation circuits blocked.Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve. If conditions require the use of more than one charging pump for makeup in the event of loss of inventory, then additional pumps can be made available through manual actions.The LTOP System for pressure relief consists of two PORVs with reduced lift settings or two residual heat removal (RHR) suction relief valves or one PORV and one RHR suction relief valve. Two RCS relief valves are required for redundancy. | ||
Limiting coolant input capability requires all but two pumps incapable | One RCS relief valve has adequate relieving capability to keep from overpressurization for the required coolant input capability. | ||
The pressure relief | PORV Requirements As designed for the LTOP System, each PORV is signaled to open if the RCS pressure reaches 400 psig (as left calibrated), allowable value < 425 psig (as found), when the PORVS are in the "io-press" mode of operation. | ||
The LCO does not require the makeup | If the PORVs are being used to meet the requirements of this Specification, then indicated ROS cold leg temperature is limited to >_ 70°F in accordance with the LTOP analysis. | ||
One RCS relief valve has adequate relieving capability to keep from overpressurization for the required coolant | When all Reactor Coolant Pumps are secured, this temperature is measured at the outlet of the residual heat removal heat exchanger. | ||
PORV Requirements As designed for the LTOP System, each PORV is signaled to open if | This location will provide the most conservative (lower) temperature measurement of water capable of being delivered into the Reactor Coolant System. The LTOP actuation logic monitors both RCS temperature and RCS pressure. | ||
allowable value < | The signals used to generate the pressure setpoints originate from the wide range pressure transmitters. | ||
If the PORVs are being used to meet the requirements of | The signals used to generate the temperature permissives originate from the wide range RTDs. Each signal is input to the appropriate NSSS protection system cabinet where it is converted to an internal signal and then input to a comparator to generate an actuation signal. If the indicated pressure meets or exceeds the calculated value, a PORV is signaled to open.This Specification presents the PORV setpoints for LTOP. Having the setpoints of both valves within the limits ensures that the Reference 1 limits will not be exceeded in any analyzed event.When a PORV is opened in an increasing pressure transient, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.Catawba Units 1 and 2B34122RvsoN.5 B 3.4.12-2 Revision No. 5 LTOP System B 3.4.12 BASES BACKGROUND (continued) | ||
When all Reactor Coolant | RHR Suction Relief Valve Requirements During LTOP MODES, the RHR system is operated for decay heat removal and low-pressure letdown control. Therefore, the RHR suction isolation valves (there are two suction isolation valves per line) are open in the piping from the ROS hot legs to the inlets of the RHR pumps. While these valves are open, the RHR suction relief valves are exposed to the RCS and are able to relieve pressure transients in the RCS.The RHR suction isolation valves must be open with operator power removed to make the RHR suction relief valves OPERABLE for RCS overpressure mitigation. | ||
This location will provide the | The RHR suction relief valves are spring loaded, bellows type water relief valve with pressure tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 8) for Class 2 relief valves.APPLICABLE Safety analyses (Ref. 3) demonstrate that the reactor vessel is adequately SAFETY ANALYSES protected against exceeding the Reference 1 P/T limits. In MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature exceeding 210°F, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At about 21 0 0 F and below, overpressure prevention falls to two OPERABLE RCS relief valves. Each of these means has a limited overpressure relief capability. | ||
The signals used | The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. | ||
The signals used to generate the temperature permissives originate from the wide range RTDs. Each signal is input to | Each time the P/T curves are revised, the LTOP System must be re-evaluated to ensure its functional requirements can still be met using the RCS relief valve method.Any change to the RCS must be evaluated against the Reference 3 analyses to determine the impact of the change on the LTOP acceptance limits.Transients that are capable of overpressurizing the ROS are categorized as either mass or heat input transients, examples of which follow: Mass Input Type Transients | ||
As | : a. Inadvertent safety injection of one safety injection pump and one charging pump; or b. Charging/letdown flow mismatch.Catawba Units 1 and 2B34123RvsoN.5 B 3.4.12-3 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued) | ||
RHR Suction Relief Valve Requirements During LTOP MODES, the RHR system is operated for decay | |||
Therefore, the RHR | |||
The RHR suction relief valves are spring loaded,bellows type water relief valve with pressure tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 8) for Class 2 relief valves.APPLICABLE Safety analyses (Ref. 3) demonstrate that the reactor vessel is adequately SAFETY ANALYSES protected against exceeding the Reference 1 P/T limits. In MODES 1, 2,and 3, and in MODE 4 with RCS cold leg temperature exceeding 210°F,the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At about 21 | |||
The actual temperature at which the pressure in the P/T limit curve | |||
Each | |||
: a. Inadvertent safety injection of one safety injection pump and | |||
Catawba Units 1 and 2B34123RvsoN.5 B 3.4.12- | |||
Heat Input Type Transients | Heat Input Type Transients | ||
: a. Inadvertent actuation of pressurizer heaters;b. Loss of RHR cooling; | : a. Inadvertent actuation of pressurizer heaters;b. Loss of RHR cooling; or c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators. | ||
The following are required during the LTOP MODES to ensure that | The following are required during the LTOP MODES to ensure that mass and heat input transients do not occur, which either of the LTOP overpressure protection means cannot handle: a. Rendering all but two pumps incapable of injection; | ||
: b. Deactivating the accumulator discharge isolation valves in | : b. Deactivating the accumulator discharge isolation valves in their closed positions; | ||
: c. Limiting RCP operation based on the existing temperature in | : c. Limiting RCP operation based on the existing temperature in the ROS cold legs; and d. Disallowing start of an RCP if secondary temperature is more than 50°F above primary temperature in any one loop. LCO 3.4.6, "RCS Loops--MODE 4," and LCO 3.4.7, "RCS Loops--MODE 5, Loops Filled," provide this protection'. | ||
provide this protection'. | The Reference 3 analyses demonstrate that one RCS relief valve can maintain RCS pressure below limits when any two pumps (charging and/or safety injection) are actuated. | ||
The Reference 3 analyses demonstrate that one RCS relief valve | Thus, the LCO allows two pumps OPERABLE during the LTOP MODES. The LCO also requires the accumulators be isolated when accumulator pressure is greater than or equal to the maximum ROS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3.The isolated accumulators must have their discharge valves closed and power removed.The restrictions on the number of RCPs in operation at a given temperature ensures that during a LTOP mass injection event that the pressure/temperature (PIT) limits of 10 CFR 50, Appendix G to protect the Catawba Units 1 and 2B34124RvsoN.5 B 3.4.12-4 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued) reactor vessel are not exceeded. | ||
Thus, the LCO allows two | During startup and shutdown, when the RCPs are operated, their induced flows create a pressure drop across the vessel. This pressure drop along with the difference in elevation between the beitline region and the instrumentation locations are additive to the peak pressure from the mass injection event.The amount of the pressure at the reactor vessel beltline region from the RCPs is dependent on the number of RCPs operated. | ||
During startup and shutdown, when | Adequate margin to prevent exceeding the P/T limits is assured by restricting the number of RCPs operated. | ||
Adequate | Since LTOP events are basically acknowledged as being steady-state events, these RCP operating restrictions are designed to work with the LTOP setpoint to provide protection from exceeding the steady-state Appendix G P/T limits.Fracture mechanics analyses established the temperature of LTOP Applicability at 210°F.The consequences of a small break loss of coolant accident (LOCA) in LTOP MODE 4 conform to 10 CFR 50.46 and 10 CFR 50, Appendix K (Refs. 4 and 5), requirements by having a maximum of two pumps (charging and/or safety injection) | ||
Since LTOP events are basically acknowledged as | OPERABLE and SI actuation enabled.PORV Performance The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the specified limit. The setpoints are derived by analyses that model the performance of the LTOP System, assuming the limiting LTOP transient of one charging pump and one safety injection pump injecting into the RCS. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensures the Reference 1 PIT limits will be met.The PORV setpoints will be updated when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation. | ||
OPERABLE and SI actuation enabled.PORV Performance The fracture mechanics analyses show that the vessel is protected | Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. | ||
Revised limits | The Bases for LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," discuss these examinations. | ||
The Bases for LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," | Catawba Units 1 and 2B34125RvsoN.5 B 3.4.12-5 Revision No. 5 LTOP System B 3.4.12 BAS ES APPLICABLE SAFETY ANALYSES (continued) | ||
discuss these examinations. | |||
Catawba Units 1 and 2B34125RvsoN.5 B 3.4.12- | |||
The PORVs are considered active components. | The PORVs are considered active components. | ||
Thus, the failure of | Thus, the failure of one PORV is assumed to represent the worst case, single active failure.RHR Suction Relief Valve Performance The RHR suction relief valves do not have variable pressure and temperature lift setpoints like the PORVs. Analyses show that one RHR suction relief valve with a setpoint at or between 417 psig and 509 psig will pass flow greater than that required for the limiting LTOP transient while maintaining RCS pressure less than the P/T limit curve. Assuming all relief flow requirements during the limiting LTOP event, an RHR suction relief valve will maintain RCS pressure to within the valve rated lift setpoint, plus an accumulation | ||
< 10% of the rated lift setpoint. | < 10% of the rated lift setpoint.Although each RHR suction relief valve may itself meet single failure criteria, its inclusion and location within the RHR system does not allow it to meet single failure criteria when spurious RHR suction isolation valve closure is postulated. | ||
Although each RHR suction relief valve may itself meet single | Also, as the RCS P/T limits are decreased to reflect the loss of embrittlement, the RHR suction relief valves must be analyzed to still accommodate the design basis transients for LTOP.The RHR suction relief valves are considered to be active components. | ||
Also, as the RCS P/T limits are decreased to | Thus, the failure of one valve is assumed to represent the worst case single active failure.The LTOP System satisfies Criterion 2 of 10 CFR 50.36 (Ref. 6).LCO This LCO requires that the LTOP System is OPERABLE. | ||
Thus, the failure of one valve is assumed to represent the worst | The LTOP System is OPERABLE when the minimum coolant input and pressure relief capabilities are OPERABLE. | ||
The | Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient. | ||
Violation of this LCO could lead to | To limit the coolant input capability, the LCO permits a maximum of two pumps (charging and/or safety injection) capable of injecting into the RCS and requires all accumulator discharge isolation valves closed and immobilized when accumulator pressure is greater than or equal to the maximum ROS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3. The LCO also limits ROP operation based on existing RCS cold leg temperature as required by the LTOP analysis.The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are: Catawba Units 1 and 2B34126RvsoN.5 B 3.4.12-6 Revision No. 5 LTOP System B 3.4.12 BASES LCO (continued) | ||
To limit the coolant input capability, the LCO permits a maximum of | : a. Two OPERABLE PORVs (NC-32B and NC-34A); or A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set to the specified limit and testing proves its automatic ability to open at this setpoint, and motive power is available to the valve and its control circuit. The following restrictions are placed on PORV OPERABILITY for LTOP due to commonalities between the PORV power supplies and letdown isolation: | ||
The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are:Catawba Units 1 and 2B34126RvsoN.5 B 3.4.12- | * NC-32B is not OPERABLE for LTOP if excess letdown is in service.* NC-32B is not OPERABLE for LTOP if normal letdown is in service and centrifugal charging pump B is in operation. | ||
: a. Two OPERABLE PORVs (NC-32B and NC-34A); | * NC-34A is not OPERABLE for LTOP if normal letdown is in service.b. Two OPERABLE RHR suction relief valves (ND-3 and ND-38); or An RHR suction relief valve is OPERABLE for LTOP when both of its RHR suction isolation valves are open, its setpoint is at or between 417 psig and 509 psig, and testing has proven its ability to open in this pressure range.c. One OPERABLE PORV and one OPERABLE RHR suction relief valve.Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient. | ||
APPLICABILITY This LCO is applicable in MODE 4 when any ROS cold leg temperature is< 210°F, in MODE 5, and in MODE 6 when the reactor vessel head is on.The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above 21 0°F. When the reactor vessel head is off, overpressurization cannot occur.LCO 3.4.3 provides the operational P/T limits for all MODES. LCO 3.4.10,"Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above 21 0°F.Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows Catawba Units 1 and 2B34127RvsoN.5 B 3.4.12-7 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABILITY (continued) operator action to mitigate the event.The Applicability is modified by a Note stating that accumulator isolation is only required when the accumulator pressure is more than or at the maximum RCS pressure for the existing temperature, as allowed by the P/T limit curves. This Note permits the accumulator discharge isolation valve Surveillance to be performed only under these pressure and temperature conditions. | |||
The following restrictions are placed on PORV OPERABILITY for LTOP due | ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable LTOP system. There is an increased risk associated with entering MODE 4 from MODE 5 with LTOP inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance. | ||
* NC-32B is not OPERABLE for LTOP if excess letdown is | A.1 With more than two pumps (charging and/or safety injection) capable of injecting into the RCS, ROS overpressurization is possible.To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency.of removing the RCS from this condition. | ||
* NC-34A is not OPERABLE for LTOP if normal letdown is | B._11 With RCP operation not limited in accordance with Table 3.4.12-1, RCS overpressurization is possible.To immediately initiate action to limit pump operation reflects the urgency of removing the RCS from this condition. | ||
APPLICABILITY This LCO is applicable in MODE 4 when any ROS cold leg temperature is< 210°F, in MODE 5, and in MODE 6 when the reactor vessel head is on.The pressurizer safety valves provide overpressure protection that | C.1, D.1, and D.2 An unisolated accumulator requires isolation within 1 hour. This is only required when the accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.If isolation is needed and cannot be accomplished in 1 hour, Required Action D.1 and Required Action D.2 provide two options, either of which must be performed in the next 12 hours. By increasing the ROS Catawba Units 1 and 2B34128RvsoN.5 B 3.4.12-8 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued) temperature to > 21 0°F, an accumulator pressure of 678 psig cannot exceed the LTOP limits if the accumulators are fully injected.Depressurizing the accumulators below the LTOP limit also gives this protection. | ||
requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2,and 3, and MODE 4 above 21 0°F.Low temperature overpressure prevention is most critical during | The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.E.1I In MODE 4 when any RCS cold leg temperature is < 210°F, with one RCS relief valve inoperable, the RCS relief valve must be restored to OPERABLE status within a Completion Time of 7 days. Two RCS relief valves (in any combination of the PORVs and RHR suction relief valves)are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component. | ||
ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable | The Completion Time considers the facts that only one of the RCS relief valves is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low.F. 1 The consequences of operational events that will overpressurize the RCS are more severe at lower temperature (Ref. 7). Thus, with one of the two RCS relief valves inoperable in MODE 5 or in MODE 6 with the head on Completion Time to restore two valves to OPERABLE status is 24 hours.The Completion Time represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one OPERABLE RCS relief valve to protect against overpressure events.Catawba Units 1 and 2B34129RvsoN.5 B 3.4.12-9 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued) | ||
A. | G.1 and G.2 Steps must be taken immediately to limit potential mass input into the RCS, and the RCS must be depressurized and a vent must be established within 12 hours when: a. Both required RCS relief valves are inoperable; or b. A Required Action and associated Completion Time of Condition A, 0, E, or F is not met; or c. The LTOP System is inoperable for any reason other than Condition A, C, D, E, or F.The Reference 3 analyses demonstrate that with the mass input into the RCS reduced to that of one injection pump (charging or safety injection) an RCS vent of> 4.5 square inches can maintain RCS pressure below limits. Therefore the Condition requires action to be taken immediately to reduce the input to that of one injection pump (charging or safety injection) prior to commencing RCS pressure reduction and establishing the required RCS vent. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle fracture of the reactor vessel.The capacity of a vent this size is greater than the flow of the limiting transient for the LTOP configuration, one charging pump or one safety injection pump OPERABLE, maintaining RCS pressure less than the maximum pressure on the P/T limit curve. The required vent capacity may be provided by one or more vent paths. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.The RCS vent size will be re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material su rveil lance.The ROS vent is passive and is not subject to active failure.The Completion Time considers the time required to place the plant in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements. | ||
To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency.of removing the RCS from this condition. | Catawba Units 1 and 2 B341-0Rvso o B 3.4.12-10 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued) | ||
B. | G.3 The ROS vent of > 4.5 square inches is proven OPERABLE by verifying its open condition either: a. Once every 12 hours for a valve that is not locked, (valves that are sealed or secured in the open position are considered "locked" in this context); | ||
To immediately initiate action to limit pump operation reflects the | or b. Once every 31 days for other vent path(s) (e.g., a vent valve that is locked, sealed or secured in position or a removed pressurizer safety valve or open manway also fits this category). | ||
C.1, D.1, and D. | The passive vent valve arrangement must only be open to be OPERABLE. | ||
Depressurizing the accumulators below the LTOP limit also gives | This Required Action is required to be performed if the vent is being used to satisfy the pressure relief requirements of Required Action G.2.Catawba Units 1 and 2 B341-1Rvso o B 3.4.12-11 Revision No. 5 LTOP System B 3.4.12 BASES SURVEILLANCE SR 3.4.12.1 and SR 3.4.12.2 REQU IREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, a maximum of two pumps (charging and/or safety injection) are verified capable of injecting into the RCS and the accumulator discharge isolation valves are verified closed and power removed.The pumps are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control. An alternate method of LTOP control may be employed using at least two independent means to prevent a pump start such that a single failure or single action will not result in an injection into the RCS. This may be accomplished through two valves in the discharge flow path being closed.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.12.3 Each required RHR suction relief valve shall be demonstrated OPERABLE by verifying its RHR suction isolation valves are open and by testing it in accordance with the Inservice Testing Program. This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet this LCO.The RHR suction isolation valves are verified to be opened. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The ASME Code (Ref. 9), test per Inservice Testing Program verifies OPERABILITY by proving relief valve mechanical motion and by measuring and,. if required, adjusting the lift setpoint.SR 3.4.12.4 The PORV block valve must be verified open to provide the flow path for each required PORV to perform its function when actuated. | ||
The Completion Times are based on operating experience that | The valve must be remotely verified open in the main control room. This Surveillance is performed if the PORV satisfies the LCO.The block valve is a remotely controlled, motor operated valve. The Catawba Units 1 and 2 B341-2Rvso o B 3.4.12-12 LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued) power to the valve operator is not required removed, and the manual operator is not required locked in the inactive position. | ||
The Completion Time considers the facts that only one of the RCS | Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation. | ||
G.1 and G. | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.12.5 Performance of a COT is required within 12 hours after decreasing RCS temperature to < 21 0°F and periodically on each required PORV to verify and, as necessary, adjust its lift setpoint. | ||
Catawba Units 1 and 2 B341-0Rvso | The COT will verify the setpoint is within the allowed maximum limits. PORV actuation could depressurize the RCS and is not required. | ||
G. | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The 12 hour Frequency considers the unlikelihood of a low temperature overpressure event during this time.A Note has been added indicating that this SR is required to be met 12 hours after decreasing RCS cold leg temperature to < 210°F. The COT cannot be performed until in the LTOP MODES when the PORV lift setpoint can be reduced to the LTOP setting. The test must be performed within 12 hours after entering the LTOP MODES.SR 3.4.12.6 Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B341-3Rvso o B 3.4.12-13 Revision No. 5 LTOP System B 3.4.12 BAS ES SURVEILLANCE REQUIREMENTS (continued) | ||
SR 3.4.12.7 Each required RHR suction relief valve shall be demonstrated OPERABLE by verifying its RHR suction isolation valves are open and by testing it in accordance with the Inservice Testing Program. (Refer to SR 3.4.12.3 for the RHR suction isolation valves Surveillance and for a description of the Inservice Testing Program.) | |||
The passive vent valve arrangement must only be open to | This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet this LCO.The RHR suction isolation valves are verified open, with power to the valve operator removed and locked in the removed position, to ensure that accidental closure will not occur. The "locked open in the removed position" power supply must be locally verified in its open position with the power supply to the valve locked in its inactive position. | ||
This Required Action is required to be performed if the | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES | ||
An alternate method of LTOP control may | : 1. 10 CFR 50, Appendix G.2. Generic Letter 88-1 1.3. UFSAR, Section 5.2 4. 10 CFR 50, Section 50.46.5. 10 CFR 50, Appendix K.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii). | ||
: 7. Generic Letter 90-06.8. ASME, Boiler and Pressure Vessel Code, Section III.9. ASME Code for Operation and Maintenance of Nuclear Power Plants.Catawba Units 1 and 2 B341-4Rvso o B 3.4.12-14 Revision No. 5 S_ %DUKEKelvin Henderson Vice President SENERGY catawba Nuclear Station Duke Energy CNO1VP I 4800 Concord Road York, SC 29745 o: 803,701.4251 CNS-1 5-098 f: 803.701.3221 December 14, 2015 U.S. Nuclear Regulatory Commission Document Control Desk Washington, DC 20555-0001 | |||
SR 3.4.12. | |||
The | |||
Thus, the | |||
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.12. | |||
The COT will verify the | |||
The Surveillance Frequency is based | |||
The test must be performed within 12 hours after entering the LTOP MODES.SR 3.4.12. | |||
SR 3.4.12. | |||
(Refer to | |||
This Surveillance is | |||
The Surveillance Frequency is based on operating experience, equipment reliability, | |||
: 1. 10 CFR 50, Appendix G.2. Generic Letter 88-1 1.3. UFSAR, Section 5. | |||
: 7. Generic Letter 90-06.8. ASME, Boiler and Pressure Vessel Code, Section III.9. ASME Code for Operation and Maintenance of Nuclear | |||
==Subject:== | ==Subject:== | ||
Duke Energy Carolinas, LLC Catawba Nuclear Station, Units 1 and 2 Docket Nos. 50-413 and 50-414 | |||
To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided. | To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided. | ||
If one train is taken out of service for maintenance or | If one train is taken out of service for maintenance or test purposes, the second train will provide ESE actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result.Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements. | ||
The SSPS performs the decision logic for most ESF= equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals | The SSPS performs the decision logic for most ESF= equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit.The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various transients. | ||
If a required logic | If a required logic matrix combination is completed, the system will send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition. | ||
Examples are given in the Applicable Safety Analyses, LCO,and Applicability sections of this Bases.Each SSPS train has a built in testing device that can test the | Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.Each SSPS train has a built in testing device that can test the decision logic matrix functions and the actuation devices while the unit is at power.When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed. | ||
The testing device is semiautomatic to minimize | The testing device is semiautomatic to minimize testing time.The actuation of ESE components is accomplished through master and slave relays. The SSPS energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices. The master and slave relays are routinely tested to ensure operation. | ||
The | The test of the master relays energizes the relay, which then operates the contacts and applies a low voltage to the associated slave relays. The low voltage is not sufficient to actuate the slave relays but only demonstrates signal Catawba Units 1 and 2B332-ReionN.1 B3.3.2-4 ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued) path continuity. | ||
The test of | The SLAVE RELAY TEST actuates the devices if their operation will not interfere with continued unit operation. | ||
The SLAVE RELAY TEST actuates the devices if | For the latter case, actual component operation is prevented by the SLAVE RELAY TEST circuit, and slave relay contact operation is verified by a continuity check of the circuit containing the slave relay.APPLICABLE Each of the analyzed accidents can be detected by one or SAFETY ANALYSES, more ESFAS Functions. | ||
For the | One of the ESFAS Functions is the LCO, AND primary actuation signal for that accident. | ||
One of the ESFAS Functions is | An ESFAS Function APPLICABILITY may be the primary actuation signal for more than one type of accident.An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents. | ||
An ESFAS | For example, Pressurizer Pressure--Low is a primary actuation signal for small loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) outside containment. | ||
An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents. | Functions such as manual initiation, not specifically credited in the accident safety analysis, are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. | ||
For example, Pressurizer Pressure--Low is a primary actuation signal for small loss of | These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).The LCO requires all instrumentation performing an ESFAS Function to be OPERABLE. | ||
Functions such as manual initiation, | Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. | ||
These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).The LCO requires all instrumentation performing an ESFAS Function | The LCO generally requires OPERABILITY of three or four channels in each instrumentation function and two channels in each logic and manual initiation function. | ||
Failure of any instrument renders the | The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing an ESFAS initiation. | ||
The LCO generally requires OPERABILITY of three or four channels | Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents. | ||
The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance | ESFAS protection functions are as follows: Catawba Units 1 and 2B3325ReionN.1 B 3.3.2-5 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Two logic or | |||
ESFAS protection functions are as follows:Catawba Units 1 and 2B3325ReionN.1 B 3.3.2-5 ESFAS Instrumentation B 3.3. | |||
: 1. .Safety Injection Safety Injection (SI) provides two primary functions: | : 1. .Safety Injection Safety Injection (SI) provides two primary functions: | ||
: 1. Primary side water addition to ensure maintenance | : 1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 2200°F); and 2. Boration to ensure recovery and maintenance of SDM (kerr < 1.0).These functions are necessary to mitigate the effects of high energy line breaks (HELBs) both inside and outside of containment. | ||
The SI signal is also used to initiate other Functions such as:* Phase A Isolation; | The SI signal is also used to initiate other Functions such as:* Phase A Isolation; | ||
* Containment Purge and Exhaust Isolation; | * Containment Purge and Exhaust Isolation; | ||
* Reactor Trip;* Turbine Trip;* Feedwater Isolation; | * Reactor Trip;* Turbine Trip;* Feedwater Isolation; | ||
* Start of motor driven auxiliary feedwater (AFW)pumps;* Start of control room area ventilation filtration trains;* Enabling automatic switchover of Emergency Core | * Start of motor driven auxiliary feedwater (AFW)pumps;* Start of control room area ventilation filtration trains;* Enabling automatic switchover of Emergency Core Cooling Systems (ECCS) suction to containment sump;* Start of annulus ventilation system filtration trains;* Start of auxiliary building filtered ventilation exhaust system trains;* Start of diesel generators Catawba Units 1 and 2B332-ReionN.1 B 3.3.2-6 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
* Start of nuclear service water system pumps; and* Start of component cooling water system pumps.These other functions ensure:* Isolation of nonessential systems through containment penetrations; | * Start of nuclear service water system pumps; and* Start of component cooling water system pumps.These other functions ensure:* Isolation of nonessential systems through containment penetrations; | ||
* Trip of the turbine and reactor to limit power generation; | * Trip of the turbine and reactor to limit power generation; | ||
* Isolation of main feedwater (MEW) to limit secondary | * Isolation of main feedwater (MEW) to limit secondary side mass losses;* Start of AFW to ensure secondary side cooling capability; | ||
* Filtration of the control room to ensure habitability; | * Filtration of the control room to ensure habitability; | ||
* Enabling ECCS suction from the refueling water storage tank(RWST) switchover on low RWST level to ensure continued cooling via use of the containment sump;* Starting of annulus ventilation and auxiliary building | * Enabling ECCS suction from the refueling water storage tank (RWST) switchover on low RWST level to ensure continued cooling via use of the containment sump;* Starting of annulus ventilation and auxiliary building filtered ventilation to limit offsite releases;* Starting of diesel generators for loss of offsite power considerations; and* Starting of component cooling water and nuclear service water systems for heat removal.a. Safety Iniection-Manual Initiation The LCO requires two channels to be OPERABLE. | ||
* Starting of diesel generators for loss of offsite | The operator can initiate SI at any time by using either of two switches in the control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability. | ||
Catawba Units 1 and 2B332-ReionN.1 B3.3.2-7 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | |||
Catawba Units 1 and 2B332-ReionN.1 B3.3.2-7 ESFAS Instrumentation B 3.3. | Each train consists of one push button and the interconnecting wiring to the actuation logic cabinet. This configuration does not allow testing at power.b. Safety Iniection-Automatic Actuation Loqic and Actuation Relays This LCO requires two trains to be OPERABLE. | ||
Each train consists of one push button and | Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment. | ||
Manual and automatic initiation of SI must be OPERABLE in MODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. | |||
Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay | These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and resPond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. | ||
Manual and automatic initiation of SI must be OPERABLE | Unit pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.c. Safety Iniection-Containment Pressure-Hi~qh This signal provides protection against the following accidents: | ||
In MODE 4, | |||
Automatic actuation logic and actuation relays must be OPERABLE | |||
These Functions are not required to be OPERABLE | |||
Unit pressure and temperature are very low | |||
*SLB inside containment; | *SLB inside containment; | ||
* LOCA; and*Feed line break inside containment. | * LOCA; and*Feed line break inside containment. | ||
Catawba Units 1 and 2B332-ReionN.1 B3.3.2-8 ESFAS Instrumentation B 3.3. | Catawba Units 1 and 2B332-ReionN.1 B3.3.2-8 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Containment Pressure-High provides no input to any | Containment Pressure-High provides no input to any control functions. | ||
Thus, three OPERABLE channels are sufficient | Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic: Containment Pressure-High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment. | ||
: d. Safety Iniection-Pressurizer Pressure-Low This signal provides protection against the following accidents: | : d. Safety Iniection-Pressurizer Pressure-Low This signal provides protection against the following accidents: | ||
* Inadvertent opening of a steam generator (SG) | * Inadvertent opening of a steam generator (SG) relief or safety valve;* SLB;* A spectrum of rod cluster control assembly ejection accidents (rod ejection); | ||
* Inadvertent opening of a pressurizer relief or | * Inadvertent opening of a pressurizer relief or safety valve;* LOCAs; and* SG Tube Rupture.Pressurizer pressure provides both control and protection functions: | ||
input to the Pressurizer Pressure Control System,reactor trip, and SI. Therefore, the actuation logic must | input to the Pressurizer Pressure Control System, reactor trip, and SI. Therefore, the actuation logic must be able to withstand both an input failure to control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. | ||
Thus, four OPERABLE channels | Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.Catawba Units 1 and 2B332-ReionN.1 B3.3.2-9 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
This Function must be OPERABLE in MODES 1, 2, and 3(above P-I11) to mitigate the consequences of an | This Function must be OPERABLE in MODES 1, 2, and 3 (above P-I11) to mitigate the consequences of an HELB inside containment. | ||
This signal may be manually blocked | This signal may be manually blocked by the operator below the P-1 1 setpoint. | ||
Automatic SI actuation below this pressure setpoint is then performed by | Automatic SI actuation below this pressure setpoint is then performed by the Containment Pressure-High signal.This Function is not required to be OPERABLE in MODE 3 below the P-Il setpoint. | ||
Other ESF functions are used | Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation. | ||
: 2. Deleted.3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment. | : 2. Deleted.3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment. | ||
This Function is necessary to prevent | This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.There are two separate Containment Isolation signals, Phase A and Phase B. Phase A isolation isolates all automatically isolable process lines, except component cooling water (CCW) and nuclear service water system (NSWS), at a relatively low containment pressure indicative of primary or secondary system leaks. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required)method of decay heat removal. Since CCW and NSWS are required to support ROP operation, not isolating CCW and NSWS on the low pressure Phase A signal enhances unit safety by allowing operators to use forced RCS circulation to cool the unit.Isolating CCW and NSWS on the low pressure signal may force the use of feed and bleed cooling, which could prove more difficult to control.Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-10 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LOCO, and APPLICABILITY (continued) | ||
Phase A containment isolation is actuated automatically by SI, or manually via the actuation circuitry. | |||
Since CCW and NSWS | All process lines penetrating containment, with the exception of CCW and NSWS, are isolated.CCW is not isolated at this time to permit continued operation of the RCPs with cooling water flow to the thermal barrier heat exchangers and air or oil coolers. All process lines not equipped with remote operated isolation valves are manually closed, or otherwise isolated, prior to reaching MODE 4.Manual Phase A Containment Isolation is accomplished by either of two switches in the control room. Either switch actuates its associated train.The Phase B signal isolates CCW and NSWS. This occurs at a relatively high containment pressure that is indicative of a large break LOCA or an SLB. For these events, forced circulation using the RCPs is no longer desirable. | ||
Phase A containment isolation is actuated automatically by SI, | Isolating the CCW and NSWS at the higher pressure does not pose a challenge to the containment boundary because the CCW System and NSWS are closed loops inside containment. | ||
All process lines penetrating containment, with the exception of CCW and NSWS, are isolated. | Although some system components do not meet all of the ASME Code requirements applied to the containment itself, the systems are continuously pressurized to a pressure greater than the Phase B setpoint. | ||
CCW is not isolated at this time to permit continued operation | Thus, routine operation demonstrates the integrity of the system pressure boundary for pressures exceeding the Phase B setpoint.Furthermore, because system pressure exceeds the Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment. | ||
All process lines not | Therefore, the combination of CCW System and NSWS design and Phase B isolation ensures there is not a potential path for radioactive release from containment. | ||
Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-11 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | |||
Isolating the CCW and NSWS | Phase B containment isolation is actuated by Containment Pressure-High High, or manually, via the automatic actuation logic, as previously discussed. | ||
Although some system components do | For containment pressure to reach a value high enough to actuate Containment Pressure-High High, a large break LOCA or SLB must have occurred. | ||
Thus, | RCP operation will no longer be required and CCW to the RCPs and NSWS to the RCP motor coolers are, therefore, no longer necessary. | ||
Furthermore, because system pressure exceeds the Phase | The RCPs can be operated with seal injection flow alone and without CCW flow to the thermal barrier heat exchanger. | ||
Therefore, the combination of | Manual Phase B Containment Isolation is accomplished by pushbuttons on the main control board. In addition to manually initiating a Phase B Containment Isolation, the pushbuttons also isolate the containment ventilation system.a. Containment Isolation-Phase A Isolation (1) Phase A Isolation-Manual Initiation Manual Phase A Containment Isolation is actuated by either of two switches in the control room. Each switch actuates its respective train.(2) Phase A Isolation-Automatic Actuation Lo~qic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.Manual and automatic initiation of Phase A Containment Isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a Phase A Containment Isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-12 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) system level manual initiation. | ||
Catawba Units 1 and 2 B3321 eiinN. | In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase A Containment Isolation. | ||
Phase B containment isolation is actuated by Containment Pressure-High High, or manually, via the automatic actuation logic,as previously discussed. | There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions. | ||
For containment pressure to reach | (3) Phase A Isolation-Safety Iniection Phase A Containment Isolation is also initiated by all Functions that initiate SI. The Phase A Containment Isolation requirements for these Functions are the same as the requirements for their SI function.Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements. | ||
RCP operation | : b. Containment Isolation-Phase B Isolation Phase B Containment Isolation is accomplished by manual Initiation, Automatic Actuation Logic and Actuation Relays, and by Containment Pressure channels. | ||
The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips that may damage the RCPs.(1) Phase B Isolation-Manual Initiation (2) Phase B Isolation-Automatic Actuation Loqjic and Actuation Relays Manual and automatic initiation of Phase B containment isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated on a Phase B Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-13 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) containment isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. | |||
Manual Phase B Containment Isolation is accomplished | In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase B containment isolation. | ||
Automatic actuation logic | There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions. | ||
In MODES 5 and 6, there | (3) Phase B Isolation-Containment Pressure -High-High Containment Pressure -High-High uses four channels in a two-out-of-four logic configuration. | ||
There also is adequate time for the operator | Since containment pressure is not used for control, this arrangement exceeds the minimum redundancy requirements. | ||
(3) Phase A Isolation-Safety Iniection Phase A Containment Isolation is also initiated by | Additional redundancy is warranted because this Function is energize to trip.Containment Pressure -High-High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break.In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to pressurize the containment and reach the Containment Pressure -High-High setpoints. | ||
Therefore, the requirements are not repeated | : 4. Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment. | ||
Rapid isolation of the steam lines will limit the steam break accident to the blowdown from one SG, at most. For an SLB upstream of the main steam isolation valves (MSIVs), inside or outside of containment, closure of the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSIVs terminates the accident as soon as the steam lines depressurize. | |||
: b. Containment Isolation-Phase B Isolation Phase B Containment Isolation is accomplished by | Steam Line Isolation also mitigates the effects of a feed line break and ensures a source of steam for the turbine driven AFW pump during a feed line break.Catawba Units 1 and 2.B3321ReionN.1 B 3.3.2-14 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips | : a. Steam Line Isolation-Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two system level switches in the control room and either switch can initiate action to immediately close all MSIVs. The LCO requires two channels to be OPERABLE. | ||
Automatic actuation logic and actuation relays must | Individual valves may also be closed using individual hand switches in the control room. The LCO requires four individual channels to be OPERABLE.b. Steam Line Isolation-Automatic Actuation Loqic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB or other accident. | ||
In MODES 5 and 6, there | This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed and de-activated. | ||
There also | In MODES 4, 5, and 6, there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.c. Steam Line Isolation-Containment Pressure-Higqh High This Function actuates closure of the MSIVs in the event of a LOCA or an SLB inside containment to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment. | ||
(3) Phase B Isolation-Containment Pressure | |||
-High-High Containment Pressure | |||
-High-High uses | |||
Since containment pressure is not used for control,this arrangement exceeds the minimum redundancy requirements. | |||
Additional redundancy is warranted because this Function is energize to trip.Containment Pressure | |||
-High-High must | |||
-High-High setpoints. | |||
: 4. Steam Line Isolation Isolation of the main steam lines provides protection in the event | |||
Rapid isolation of the | |||
inside or outside of containment, closure of | |||
Steam Line Isolation also mitigates the effects of a feed line | |||
: a. Steam Line Isolation-Manual Initiation Manual initiation of Steam Line Isolation can | |||
Individual | |||
This | |||
In MODES 4, 5, and 6, there | |||
Containment Pressure-High High uses four channels in a two-out-of-four logic configuration. | Containment Pressure-High High uses four channels in a two-out-of-four logic configuration. | ||
Since containment pressure is not | Since containment pressure is not used for control, this arrangement exceeds the minimum redundancy requirements. | ||
Additional redundancy | Additional redundancy is warranted because this Function is energize to trip.Containment Pressure-High High must be OPERABLE in MODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection Catawba Units 1 and 2 B3321 eiinN.1 B3.3.2-15 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) and closure of the MSIVs. The Steam Line Isolation Function remains OPERABLE in MODES 2 and 3 unless all MSIVs are closed and de-activated. | ||
In MODES 4, 5, and 6, there is not enough energy. in the primary and secondary sides to pressurize the containment to the Containment Pressure-High High setpoint.d. Steam Line Isolation-Steam Line Pressure Steam Line Pressure channels provide both protection and control functions. | |||
In MODES 4, 5, and 6,there is not enough energy. in the primary and secondary sides to pressurize the containment to the Containment Pressure-High High setpoint. | The protection functions include: Steam Line Pressure-Low and Steam Line Pressure-Negative Rate functions. | ||
The control functions include: Digital Feedwater Control System (DECS) which controls SG level.(1) Steam Line Pressure-Low Steam Line Pressure-Low provides closure of the MSIVs in the event of an SLB to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment. | |||
The protection functions include: | This Function provides closure of the MSIVs in the event of a feed line break to ensure a supply of steam for the turbine driven AFW pump.DFCS receives steam pressure inputs from three separate protection channels for each SG. The three inputs are median selected for each SG, with the resultant output being used by the automatic control algorithm. | ||
The median select feature prevents the failure of an input signal from affecting the control system. A loss of two or more input signals will place the control system in manual and alert the operator.DFCS will maintain a steady control function during the switch to manual operation; therefore, a failure of one or more input signals will not cause a control system action that would result in a condition requiring protective actions. Thus, three OPERABLE channels on each steam line, with a two-out-of-three logic on each steam line, are sufficient to satisfy protective requirements. | |||
The control functions include: | Steam Line Pressure-Low Function must be OPERABLE in MODES 1, 2, and 3 (above P-i11), with any main steam valve open, when a secondary side Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-16 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) break or stuck open valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the P-i11 setpoint. | ||
Digital Feedwater Control System (DECS) which controls SG level.(1) Steam Line Pressure-Low Steam Line Pressure-Low provides closure of | Below P-i11, an inside containment SLB will be terminated by automatic actuation via Containment Pressure-High High. Stuck valve transients and outside containment SLBs will be terminated by the Steam Line Pressure-Negative Rate-High signal for Steam Line Isolation below P-i11 when SI has been manually blocked. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSlVs are closed and de-activated. | ||
This Function provides closure of the MSIVs in | This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.(2) Steam Line Pressure-Neciative Rate-Hicjh Steam Line Pressure-Negative Rate-High provides closure of the MSlVs for an SLB when less than the P-i11 setpoint, to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment. | ||
The median select feature prevents | When the operator manually blocks the Steam Line Pressure-Low main steam isolation signal when less than the P-1 1 setpoint, the Steam Line Pressure-Negative Rate-High signal is automatically enabled. DFCS receives steam pressure inputs from three separate protection channels for each SG. The three inputs are median selected for each SG, with the resultant output being used by the automatic control algorithm. | ||
DFCS will maintain a steady control function | The median select feature prevents the failure of an input signal from affecting the control system. A loss of two or more input signals will place the control system in manual and alert the operator. | ||
Thus, three | DFCS will maintain a steady control function during the switch to manual operation; therefore, a failure of one or more input signals will not cause a control system action that would result in a condition requiring protective actions. Thus, three OPERABLE channels on each steam line, with a two-out-of-three logic on each steam line, are sufficient to satisfy protective requirements. | ||
Steam Line Pressure-Low Function must | Catawba Units 1 and 2 B3321 eiinN.i B 3.3.2-17 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Below P-i11, an inside containment SLB | Steam Line Pressure-Negative Rate-High must be OPERABLE in MODE 3 when less than the P-i11 setpoint, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). In MODES 1 and 2, and in MODE 3, when above the P-11I setpoint, this signal is automatically disabled and the Steam Line Pressure-Low signal is automatically enabled. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MSIVs are closed and de-activated. | ||
The | In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to have an SLB or other accident that would result in a release of significant enough quantities of energy to cause a cooldown of the RCS.5. Turbine Trip and Feedwater Isolation The primary functions of the Turbine Trip and Feedwater Isolation signals are to prevent damage to the turbine due to water in the steam lines, stop the excessive flow of feedwater into the SGs, and to limit the energy released into containment. | ||
These Functions are necessary to mitigate the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows. Feedwater Isolation serves to limit the energy released into containment upon a feedwater line or steam line break inside containment. | |||
(2) Steam Line Pressure-Neciative Rate-Hicjh Steam Line Pressure-Negative Rate-High | The Functions are actuated when the level in any SG exceeds the high high setpoint, and performs the following functions: | ||
When | * Trips the main turbine;* Trips the MFW pumps;* Initiates feedwater isolation; and* Shuts the MFW regulating valves and the bypass feedwater regulating valves.Turbine Trip and Feedwater Isolation signals are both actuated by SG Water Level-High High, or by an SI signal. The RTS also initiates a turbine trip signal whenever a reactor trip (P-4) is generated. | ||
A Feedwater Isolation signal is also generated by a Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-18 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) reactor trip (P-4) coincident with Ta,,gLow and on a high water level in the reactor building doghouse. | |||
The median select feature prevents the failure of | The MEW System is also taken out of operation and the AFW System is automatically started. The SI signal was discussed previously. | ||
DFCS | : a. Turbine Trip (1) Turbine Tripj-Automatic Actuation Loqic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.(2) Turbine Tripj-Steam Generator Water Level-Higqh Higqh (P-14)This signal prevents damage to the turbine due to water in the steam lines. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation. | ||
Thus, three OPERABLE channels on | Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.The setpoints are based on percent of narrow range instrument span.(3) Turbine Trip-Safety Iniection Turbine Trip is also initiated by all Functions that initiate SI. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 1, SI, is referenced for all initiating functions and requirements. | ||
Catawba Units 1 and 2 B3321 eiinN. | Item 5.a.(1) is referenced for the applicable MODES.The Turbine Trip Function must be OPERABLE in MODES 1 and 2. In lower MODES, the turbine generator is not in service and this Function is not required to be OPERABLE.b. Feedwater Isolation Catawba Units 1 and 2 B3321 eiinN.1 B3.3.2-19 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Steam Line Pressure-Negative Rate-High must | (1) Feedwater Isolation-Automatic Actuation Loqic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.(2) Feedwater Isolation-Steam Generator Water Level-Hi~qh Hicqh (P-14)This signal provides protection against excessive feedwater flow. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation. | ||
In MODES 1 and 2, and in MODE 3,when above the P-11I setpoint, this signal | Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.The setpoints are based on percent of narrow range instrument span.(3) Feedwater Isolation-Safety Iniection Feedwater Isolation is also initiated by all Functions that initiate SI. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI function. | ||
The Steam | Therefore, the requirements are not repeated in Table 3.3.2-1.Instead Function 1, SI, is referenced for all initiating functions and requirements. | ||
In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to have | Item 5.b.(1) is referenced for the applicable MODES.(4) Feedwater Isolation | ||
These Functions | -RCS Low coincident with Reactor Trip (P-4)This signal provides protection against excessive cooldown, which could subsequently introduce a positive reactivity excursion after a plant trip. There are four channels of RCS Tavg -Low (one per loop), with a two-out-of-four logic required coincident with a reactor trip signal (P-4) to initiate a feedwater isolation. | ||
The Functions are actuated when the level in any SG exceeds | The P-4 interlock is discussed in Function 8.a.Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-20 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
* Trips the main turbine;* Trips the MFW pumps;* Initiates feedwater isolation; and* Shuts the MFW regulating valves and the bypass feedwater regulating valves.Turbine Trip and Feedwater Isolation signals are both actuated | |||
A Feedwater Isolation signal is also generated by | |||
The MEW System is also | |||
: a. Turbine Trip(1) Turbine Tripj-Automatic Actuation Loqic and Actuation | |||
Thus, four OPERABLE channels are required | |||
Instead Function 1, SI, | |||
Item 5.a.(1) is referenced for | |||
(1) Feedwater Isolation-Automatic Actuation Loqic | |||
Thus, four OPERABLE channels are required | |||
Therefore, | |||
Item 5.b.(1) | |||
-RCS Low coincident | |||
The P-4 interlock is discussed in | |||
(5) Feedwater Isolation | (5) Feedwater Isolation | ||
-Doqhouse Water Level - | -Doqhouse Water Level -Hiqh This signal initiates a Feedwater Isolation. | ||
The signal terminates forward feedwater flow in the event of a postulated pipe break in the main feedwater piping in the doghouses to prevent flooding safety related equipment essential to the safe shutdown of the plant. Each doghouse contains two trains of level instrumentation. | |||
The level instrumentation | The level instrumentation consists of six level switches (three per train) in each of the two reactor building doghouses. | ||
A high-high | A high-high level detected by two-out-of-three switches, in either the inboard or outboard doghouse, will initiate a doghouse isolation. | ||
This signal initiates Feedwater Isolation for the specific doghouse where the High-High level is detected and trips both main feedwater pumps thus causing a main turbine trip.The Feedwater Isolation Function must be OPERABLE in MODES 1 and 2 and also in MODE 3 (except for the functions listed in Table 3.3.2-1). | |||
Feedwater Isolation is not required OPERABLE when all MFIVs, MFCVs, and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In lower MODES, the MFW System is not in service and this Function is not required to be OPERABLE.6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available. | |||
This signal initiates Feedwater Isolation for the specific doghouse where the High-High level is detected and trips both main feedwater pumps thus causing a main turbine trip.The Feedwater Isolation Function must be OPERABLE | The system has two motor driven pumps and a turbine driven pump, making it available during normal and accident operation. | ||
Feedwater Isolation is | The normal source of water for the AFW System is the condensate storage system (not safety related). | ||
A low suction pressure to the AFW pumps will automatically realign the pump suctions to the Nuclear Service Water System (NSWS)(safety related). | |||
The system has two motor driven pumps and a | The AFW System is aligned so that upon a pump start, flow is initiated to the respective SGs immediately. | ||
The normal source of water for the AFW System is | : a. Auxiliary Feedwater-Automatic Actuation Loq ic and Actuation Relays Automatic actuation logic and actuation relays consist of the Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-21 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCD, and APPLICABILITY (continued) same features and operate in the same manner as described for ESFAS Function 1 .b.b. Auxiliary Feedwater-Steam Generator Water Level-Low Low SG Water Level-Low Low provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. SG Water Level-Low Low provides input to the SG Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system which may then require a protection function actuation and a single failure in the other channels providing the protection function actuation. | ||
A low | Thus, four OPERABLE channels are required to satisfy the requirements with two-out-of-four logic. The setpoints are based on percent of narrow range instrument span.SG Water Level--Low Low in any operating SG will cause the motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level--Low Low in any two operating SGs will cause the turbine driven pumps to start.c. Auxiliary Feedwater--Safety Iniection An SI signal starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function. | ||
The AFW System is aligned so that upon a pump start,flow is initiated to the respective SGs immediately. | Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements. | ||
: a. Auxiliary Feedwater-Automatic Actuation Loq | : d. Auxiliary Feedwater-Loss of Offsite Power A loss of offsite power to the service buses will be accompanied by a loss of reactor coolant pumping power and the subsequent need for some method of decay heat removal. The loss of offsite power is detected by a voltage drop on each essential service bus. Loss of power to either essential service bus will start the turbine driven and motor driven AFW pumps to ensure that at least two SGs contain enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip.Catawba Units 1 and 2B332-2RvsoNo1 B 3.3.2-22 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Thus, four | Functions 6.a through 6.d must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor.These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation. | ||
Therefore, the requirements are not repeated | : e. Auxiliary Feedwater-Trip of All Main Feedwater Pumps A Trip of all MFW pumps is an indication of a loss of MEW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure. | ||
Each turbine driven MFW pump is equipped with three pressure switches on the trip oil system. A low pressure signal from two-out-of-three of these pressure switches indicates a trip of that pump. Three OPERABLE channels per pump satisfy redundancy requirements with two-out-of-three logic. A trip of all MEW pumps starts the motor driven AFW pumps to ensure that at least two SGs are available with water to act as the heat sink for the reactor. This function must be OPERABLE in MODES 1 and 2. This ensures that at least two SGs are provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident. | |||
: d. Auxiliary Feedwater-Loss of Offsite | In MODES 3, 4, and 5, the MEW pumps may be normally shut down, and thus neither pump trip is indicative of a condition requiring automatic AFW initiation. | ||
The loss of offsite power is detected by a | : f. Auxiliary Feedwater-Pump Suction Transfer on Suction Pressure-Low A low pressure signal in the AFW pump suction line protects the AFW pumps against a loss of the normal supply of water for the pumps, the condensate storage system. Three pressure switches per train are located on the AFW pump suction line from the condensate storage system. A low pressure signal sensed by two-out-of-three switches will align their train related motor driven AFW pump and the turbine driven AFW pump to the assured water supply (NSWS). The NSWS (safety grade) is then lined up to supply the AFW pumps to ensure an adequate supply of water for the AFW Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-23 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | ||
Functions 6.a through 6.d must be OPERABLE in MODES 1, 2,and 3 to ensure that the SGs remain the heat sink for the reactor.These Functions do not have to be OPERABLE in MODES 5 and | System to maintain at least two of the SGs as the heat sink for reactor decay heat and sensible heat removal.This Function must be OPERABLE in MODES 1, 2, and 3 to ensure a safety grade supply of water for the AFW System to maintain the SGs as the heat sink for the reactor. This Function does not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW automatic suction transfer does not need to be OPERABLE because RHR will already be in operation, or sufficient time is available to place RHR in operation, to remove decay heat.7. Automatic Switchover to Containment Sump At the end of the injection phase of a LOCA, the RWST will be nearly empty. Continued cooling must be provided by the ECOS to remove decay heat. The source of water for the ECCS pumps is automatically switched to the containment recirculation sump. The low head residual heat removal (RHR) pumps and containment spray pumps draw the water from the containment recirculation sump, the RHR pumps pump the water through the RHR heat exchanger, inject the water back into the RCS, and supply the cooled water to the other ECCS pumps. Switchover from the RWST to the-containment sump must occur before the RWST empties to prevent damage to the RHR pumps and a loss of core cooling capability. | ||
: e. Auxiliary Feedwater-Trip of All Main Feedwater | : a. Automatic Switchover to Containment Sump-Automatic Actuation Locqic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.b. Automatic Switchover to Containment Sump-Refuelinq Water Stora~qe Tank (RWST)Level-Low Coincident With Safety Iniection During the injection phase of a LOCA, the RWST is the source of water for all ECCS pumps. A low level in the RWST coincident with an SI signal provides protection against a loss of water for the ECCS pumps and indicates the end of the injection phase of the LOCA. The RWST is equipped with four level transmitters. | ||
Each turbine driven | These transmitters Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-24 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) provide no control functions. | ||
This function must be OPERABLE | Since an inadvertent switchover to the containment sump could have a significant safety impact, this instrumentation is placed in a bypass condition for testing. Therefore, four channels are supplied such that, during testing, the remaining three channels could perform the intended function, and no single failure could result in either a failure to accomplish the intended function, or in an inadvertent switchover to the containment sump.Automatic switchover occurs only if the RWST low level signal is coincident with SI. This prevents accidental switchover during normal operation. | ||
In MODES 3, 4, and 5, the MEW pumps may | Accidental switchover could damage ECCS pumps if they are attempting to take suction from an empty sump. The automatic switchover Function requirements for the SI Functions are the same as the requirements for their SI function. | ||
: f. Auxiliary Feedwater-Pump Suction Transfer | Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements. | ||
System to maintain at least two of the SGs as the heat | These Functions must be OPERABLE in MODES 1, 2, 3, and 4 when there is a potential for a LOCA to occur, to ensure a continued supply of water for the ECOS pumps.These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. | ||
System pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.8. Engqineered Safety Feature Actuation System Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlock Functions back up manual actions to ensure bypassable functions are in operation under the conditions assumed in the safety analyses.Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-25 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) | |||
: a. Automatic Switchover to Containment Sump-Automatic Actuation Locqic and Actuation | : a. Engineered Safety Feature Actuation System Interlocks--Reactor Trip. P-4 The P-4 interlock is enabled when a reactor trip breaker (RTB) and its associated bypass breaker is open. Operators are able to reset SI 60 seconds after initiation. | ||
These transmitters Catawba Units 1 and 2 B3322 eiinN. | If a P-4 is present when SI is reset, subsequent automatic SI initiations will be blocked until the RTBs have been manually closed.This Function allows operators to take manual control of SI systems after the initial phase of injection is complete while avoiding multiple SI initiations. | ||
Since an inadvertent switchover to the containment sump could have a significant safety impact, this instrumentation is placed in a | The functions of the P-4 interlock are:* Trip the main turbine;* Isolate MFW with coincident low Tavg;* Prevent reactuation of SI after a manual reset of SI;* Transfer the steam dump from the load rejection controller to the unit trip controller; and* Prevent opening of the MFW isolation valves if they were closed on SI or SG Water Level--High High.Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS following a reactor trip. An excessive cooldown of the RCS following a reactor trip could cause an insertion of positive reactivity with a subsequent increase in generated power. To avoid such a situation, the noted Functions have been interlocked with P-4 as part of the design of the unit control and protection system.None of the noted Functions serves a mitigation function in the unit licensing basis safety analyses. | ||
Therefore, four channels are | Only the turbine trip Function is explicitly assumed since it is an immediate consequence of the reactor trip Function. | ||
Neither turbine trip, nor any of the other four Functions associated with the reactor trip signal, is required to show that the unit licensing basis safety analysis acceptance criteria are not exceeded.The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts. | |||
Therefore, this Function has no adjustable Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-26 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) trip setpoint with which to associate a Trip Setpoint and Allowable Value.This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may be critical or approaching criticality. | |||
Accidental switchover could damage ECCS pumps if they are attempting to | This Function does not have to be OPERABLE in MODE 4, 5, or 6 because the main turbine, the MFW System, and the Steam Dump System are not in operation. | ||
Therefore, | : b. Engqineered Safety Feature Actuation System Interlocks-Pressurizer Pressure. | ||
Instead,Function 1, SI, is referenced for all initiating Functions | P-11I The P-i1I interlock permits a normal unit cooldown and depressurization without actuation of SI or main steam line isolation. | ||
These Functions must be OPERABLE in MODES 1, 2, 3,and 4 when there is a potential for a LOCA to occur, | With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-i11 setpoint, the operator can manually block the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal (previously discussed). | ||
When the Steam Line Pressure-Low steam line isolation signal is manually blocked, a main steam isolation signal on Steam Line Pressure-Negative Rate-High is enabled. This provides protection for an SLB by closure of the MSIVs. With two-out-of-three pressurizer pressure channels above the P-i11 setpoint, the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal are automatically enabled. The operator can also enable these trips by use of the respective manual reset buttons. When the Steam Line Pressure-Low steam line isolation signal is enabled, the main steam isolation on Steam Line Pressure-Negative Rate--High is disabled.This Function must be OPERABLE in MODES 1, 2, and 3 to allow an orderly cooldown and depressurization of the unit without the actuation of SI or main steam isolation. | |||
This Function does not have to be OPERABLE in MODE 4, 5, or 6 because system pressure must already be below the P-i1!setpoint for the requirements of the heatup and cooldown curves to be met.c. Engqineered Safety Feature Actuation System lnterlocks-T~v-Low Low. P-i12 On increasing reactor coolant temperature, the P-12 interlock provides an arming signal to the Steam Dump System. On a Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-27 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) decreasing temperature, the P-i12 interlock removes the arming signal to the Steam Dump System to prevent an excessive cooidown of the RCS due to a malfunctioning Steam Dump System.Since Tavg is used as an indication of bulk RCS temperature, this Function meets redundancy requirements with one OPERABLE channel in each loop. These channels are used in two-out-of-four logic. This Function must be OPERABLE in MODES 1, 2, and 3 when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This Function does not have to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to have an accident.9. Containment Pressure Control System Permissives The Containment Pressure Control System (CPCS) protects the Containment Building from excessive depressurization by preventing inadvertent actuation or continuous operation of the Containment Spray and Containment Air Return Systems when containment pressure is at or less than the CPCS permissive setpoint. | |||
Catawba Units 1 and 2 B3322 eiinN. | The control scheme of CPCS is comprised of eight independent control circuits (4 per train), each having a separate and independent pressure transmitter and current alarm module.Each pressure transmitter monitors the containment pressure and provides input to its respective current alarm. The current alarms are set to inhibit or terminate containment spray and containment air return systems when containment pressure falls to or below 0.25 psid. The alarm modules switch back to the permissive state (allowing the systems to operate) when containment pressure is greater than or equal to 1.0 psid.This function must be OPERABLE in MODES 1, 2, :3, and 4 when there is sufficient energy in the primary and secondary sides to pressurize containment following a pipe break. In MODES 5 and 6, there is insufficient energy in the primary and secondary sides to significantly pressurize the containment. | ||
: a. Engineered Safety Feature Actuation | : 10. Nuclear Service Water System Suction Transfer -Low Pit Level Upon an emergency low pit level signal from either NSWS pit, interlocks isolate the NSWS from Lake Wylie, align NSWS to the standby nuclear service water pond, close particular crossover Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-28 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) valves, and start the NSWS pumps. This function is initiated on a two-out-of-three logic from either NSWS pump pit.This function must be OPERABLE in MODES 1, 2, 3, and 4 to ensure cooling water remains available to essential components during a DBA. In MODES 5 and 6, the sufficient time exists for manual operator action to realign the NSWS pump suction, if required.Unlike other shared NSWS equipment, the pit level interlocks do not require both normal and emergency power for OPERABILITY. | ||
If a P-4 | This is because unlike mechanical components such as pumps and valves, the interlocks are designed to fail safe upon a loss of power, initiating a transfer from Lake Wylie to the standby nuclear service water pond. The definition of OPERABILITY, which requires either normal or emergency power, provides sufficient power supply requirements and these interlocks can be considered OPERABLE provided they are powered from either an inverter or regulated power.The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36 (Ref.6).ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1. When the Required Channels in Table 3.3.2-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate. | ||
The functions of the P- | A channel shall be OPERABLE if the point at which the channel trips is found more conservative than the Allowable Value. In the event a channel's trip setpoint is found less conservative than the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected. | ||
Only the turbine | If plant conditions warrant, the trip setpoint may be set outside the NOMINAL TRIP SETPOINT calibration tolerance band as long as the trip setpoint is conservative with respect to the NOMINAL TRIP SETPOINT. | ||
Neither | If the trip setpoint is found outside of the NOMINAL TRIP SETPOINT calibration tolerance band and non-conservative with respect to the NOMINAL TRIP SETPOINT, the setpoint shall be re-adjusted. | ||
The RTB position switches that provide input to the P- | Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-29 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
Therefore, this Function has no adjustable Catawba Units 1 and 2 B3322 eiinN. | When the number of inoperable channels in a trip function exceed those specified in one or other related Conditions associated with a trip function, then the unit is outside the safety analysis. | ||
This Function does not have to be OPERABLE in MODE 4,5, or 6 because the main turbine, the MFW System, and | Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation. | ||
: b. Engqineered Safety Feature Actuation | A.__1 Condition A applies to all ESFAS protection functions. | ||
P- | Condition A addresses the situation where one or more channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected. | ||
With two-out-of-three pressurizer | The Completion Times are those from the referenced Conditions and Required Actions.B.1, B.2.1 and B.2.2 Condition B applies to manual initiation of:* SI;* Containment Spray;* Phase A Isolation; and* Phase B Isolation. | ||
When the | This action addresses the train orientation of the SSPS for the functions listed above. If a channel or train is inoperable, 48 hours is allowed to return it to an OPERABLE status. Note that for containment spray and Phase B isolation, failure of one or both channels in one train renders the train inoperable. | ||
This | |||
The operator can also enable | |||
This Function must be OPERABLE in MODES 1, 2, and 3 | |||
The control scheme of CPCS is comprised of | |||
: 10. Nuclear Service Water System Suction Transfer | |||
-Low Pit | |||
Unlike other shared NSWS equipment, the pit level interlocks | |||
This is because unlike mechanical components such as pumps | |||
A channel shall be OPERABLE if the point at which the channel trips | |||
If plant conditions | |||
If the | |||
Catawba Units 1 and 2 B3322 eiinN. | |||
When the number of inoperable channels in a trip function exceed | |||
Therefore, LCO 3.0.3 should be immediately entered if applicable in the | |||
A. | |||
Condition A addresses the situation where one or more channels or | |||
The Completion Times | |||
This action addresses the train orientation of the SSPS for the functions listed above. If a channel or train is inoperable, 48 hours is allowed | |||
Condition B, therefore, encompasses both situations. | Condition B, therefore, encompasses both situations. | ||
The specified Completion Time is reasonable considering that there | The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each Function, and the low probability of an event occurring during this interval. | ||
If the train cannot be restored | If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours (54 hours total time) and in MODE 5 within an additional 30 hours (84 hours total time). The allowable Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-30 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1. 0.2.1 and 0.2.2 Condition C applies to the automatic actuation logic and actuation relays for the following functions: | ||
* SI;* Phase A Isolation; | * SI;* Phase A Isolation; | ||
* Phase B Isolation; and* Automatic Switchover to Containment Sump.This action addresses the train orientation of the SSPS and the | * Phase B Isolation; and* Automatic Switchover to Containment Sump.This action addresses the train orientation of the SSPS and the master and slave relays. If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference | ||
: 13. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an | : 13. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. | ||
If the train cannot be restored | If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours (30 hours total time) and in MODE 5 within an additional 30 hours (60 hours total time). The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing, provided the other train is OPERABLE. | ||
The Required Actions are not required to be met during this time, unless the train is discovered inoperable during the testing. This allowance is based on the reliability analysis assumption of WCAP-1 0271-P-A (Ref. 7) that 4 hours is the average time required to perform train surveillance. | |||
The Required Actions are not required to be | Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-31 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1, D.2.1. and D.2.2 Condition 0 applies to:* Containment Pressure-High; | ||
This allowance is based on the reliability analysis assumption | |||
Catawba Units 1 and 2 B3323 eiinN. | |||
* Pressurizer Pressure-Low; | * Pressurizer Pressure-Low; | ||
* Steam Line Pressure-Low; | * Steam Line Pressure-Low; | ||
* Steam Line Pressure-Negative Rate-High; | * Steam Line Pressure-Negative Rate-High; | ||
* Loss of offsite power (refer to Condition D footnote); | * Loss of offsite power (refer to Condition D footnote); | ||
* SG Water level--Low Low; and* SG Water level--High High (P-14) for the Feedwater Isolation Function. | * SG Water level--Low Low; and* SG Water level--High High (P-14) for the Feedwater Isolation Function.If one channel is inoperable, 72 hours are allowed to restore the channel to OPERABLE status or to place it in the tripped condition. | ||
If one channel is inoperable, 72 hours are allowed to restore the | Generally this Condition applies to functions that operate on two-out-of-three logic.Therefore, failure of one channel places the Function in a two-out-of-two configuration. | ||
Generally | One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements. | ||
One channel must be tripped to place the Function in | The 72 hours allowed to restore the channel to OPERABLE status or to place it in the tripped condition is justified in Reference 13.Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours requires the unit be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing of other channels. | ||
The 12 hours allowed for testing is justified in Reference 13.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-32 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | |||
E.1. E.2.1, and E.2.2 Condition E applies to:* Containment Phase B Isolation Containment Pressure-High High;and* Steam Line Isolation Containment Pressure -High High.Neither of these signals has input to a control function. | |||
The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing | |||
The 12 hours allowed for testing is justified | |||
E.1. E.2.1, and E.2. | |||
-High High.Neither of these signals has input to a control function. | |||
Thus, two-out-of-. | Thus, two-out-of-. | ||
three logic is necessary to meet acceptable protective requirements. | three logic is necessary to meet acceptable protective requirements. | ||
However, a two-out-of-three design would require tripping a failed channel. This is undesirable because a single failure would then cause spurious isolation initiation. | |||
This is undesirable because a single failure would then | Therefore, these channels are designed with two-out-of-four logic so that a failed channel may be bypassed rather than tripped. Note that one channel may be bypassed and still satisfy the single failure criterion. | ||
Therefore, these channels are designed | Furthermore, with one channel bypassed, a single instrumentation channel failure will not spuriously initiate isolation. | ||
Note that one channel may be bypassed and still satisfy | To avoid the inadvertent actuation of Phase B containment isolation, the inoperable channel should not be placed in the tripped condition. | ||
Furthermore, with one channel bypassed, a | Instead it is bypassed. | ||
To avoid the inadvertent actuation of Phase B containment isolation, | Restoring the channel to OPERABLE status, or placing the inoperable channel in the bypass condition within 72 hours, is sufficient to assure that the Function remains OPERABLE and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The Completion Time is further justified based on the low probability of an event occurring during this interval. | ||
Failure to restore the inoperable channel to OPERABLE status, or place it in the bypassed condition within 72 hours, requires the unit be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows one additional channel to be bypassed for up to 12 hours for surveillance testing.Placing a second channel in the bypass condition for up to 12 hours for testing purposes is acceptable based on the results of Reference 13.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-33 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | |||
Restoring the channel to OPERABLE status, or | F.1, F.2.1, and F.2.2 Condition F applies to:* Manual Initiation of Steam Line Isolation; and* P-4 Interlock. | ||
Failure to restore the inoperable channel to OPERABLE status,or place it in the bypassed condition within 72 hours, requires the unit | For the Manual Initiation and the P-4 Interlock Functions, this action addresses the train orientation of the SSPS. If a train or channel is inoperable, 48 hours is allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of these Functions, the available redundancy, and the low probability of an event occurring during this interval. | ||
In MODE 4, these Functions are no longer | If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours and MODE 4 within the following 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.G.1 and G.2 Condition G applies to manual initiation of Steam Line Isolation. | ||
The Required Actions are modified by a Note that allows one additional channel to be bypassed for up to 12 hours for surveillance testing.Placing a second channel in the bypass condition for up to 12 hours | This action addresses the operability of the manual steam line isolation function for each individual main steam isolation valve. If a channel is inoperable, 48 hours is allowed to return it to an OPERABLE status. If the train cannot be restored to OPERABLE status, the Conditions and Required Actions of LCO 3.7.2, "Main Steam Isolation Valves," must be entered for the associated inoperable valve. The specified Completion Time is reasonable considering that there is a system level manual initiation train for this Function and the low probability of an event occurring during this interval.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-34 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
F.1, F.2.1, and F.2. | H.1, H.2.1 and H.2.2 Condition H applies to the automatic actuation logic and actuation relays for the Steam Line Isolation, Feedwater Isolation, and AFW actuation Functions. | ||
For the Manual Initiation and the P-4 Interlock Functions, this | The action addresses the train orientation of the SSPS and the master and slave relays for these functions. | ||
If the Function cannot be returned | If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference | ||
In MODE 4, the unit does not | : 13. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. | ||
This action addresses the operability of the manual steam line isolation function for each individual main steam isolation valve. If a channel | If the train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours and MODE 4 within the following 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of the protection channels and actuation functions. | ||
must | In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing provided the other train is OPERABLE. | ||
Catawba Units 1 and 2 B3323 eiinN. | This allowance is based on the reliability analysis (Ref. 7) assumption that 4 hours is the average time required to perform channel surveillance. | ||
H.1, H.2.1 and H.2. | Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-35 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 1.1 and 1.2 Condition I appiies to the automatic actuation logic and actuation relays for the Turbine Trip Function.This action addresses the train orientation of the SSPS and the master and slave relays for this Function. | ||
The action addresses the train orientation of the SSPS and the | If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the following 6 hours. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference | ||
If one train is inoperable, 24 | : 13. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. | ||
: 13. The Completion Time for restoring a train | The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. These Functions are no longer required in MODE 3. Placing the unit in MODE 3 removes all requirements for OPERABILITY of the protection channels and actuation functions. | ||
If the train cannot be returned to OPERABLE status, the | In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing provided the other train is OPERABLE. | ||
Placing the unit in MODE 4 removes all requirements | This allowance is based on the reliability analysis (Ref. 7) assumption that 4 hours is the average time required to perform channel surveillance. | ||
In | J.1 and J.2 Condition J applies to:* SG Water Level--High High (P-14) for the Turbine Trip Function;and* Tavg-LOw.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-36 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
This allowance is based on the reliability analysis(Ref. 7) assumption that 4 hours is the average time required to | If one channel is inoperable, 72 hours are allowed to restore one channel to OPERABLE status or to place it in the tripped condition. | ||
Catawba Units 1 and 2 B3323 eiinN. | If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-three logic will result in actuation. | ||
This action addresses the train orientation of the SSPS and the | The 72 hours allowed to restore the channel to OPERABLE status or place it in the tripped condition is justified in Reference | ||
If one train is inoperable, 24 hours | : 13. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours requires the unit to be placed in MODE 3 within the following 6 hours. The allowed Completion Time of 78 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing of other channels. | ||
: 13. The Completion Time for restoring a train to | The 72 hours allowed to place the inoperable channel in the tripped condition, and the 12 hours allowed for a second channel to be in the bypassed condition for testing, are justified in Reference 13.K.1 and K.2 Condition K applies to the AFW pump start on trip of all MFW pumps.This action addresses the auto start function of the AFW System on loss of all MFW pumps. The OPERABILITY of the AFW System must be assured by allowing automatic start of the AFW System pumps. If a channel is inoperable, 1 hour is allowed to return it to an OPERABLE status or to place the channel in trip. If the function cannot be returned to an OPERABLE status or placed in a trip condition, 6 hours are allowed to place the unit in MODE 3. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, the unit does not have any analyzed transients or conditions that require the explicit use of the protection function noted above.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-37 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
L.1 and L.2 Condition L applies to the Doghouse Water Level -High High.If one channel is inoperable, 6 hours are allowed to restore the channel to OPERABLE status or to place it in the tripped condition. | |||
These Functions are | |||
In this MODE, the unit does not have analyzed transients | |||
This allowance is based on the reliability analysis(Ref. 7) assumption that 4 hours is the average time required to | |||
J.1 and J. | |||
Catawba Units 1 and 2 B3323 eiinN. | |||
If one channel is inoperable, 72 hours are allowed to restore one | |||
If placed | |||
The 72 hours allowed | |||
: 13. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition | |||
In MODE 3,these Functions are no longer required OPERABLE. | |||
The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing | |||
The 72 hours allowed to place the inoperable channel | |||
In MODE 3, the unit does not have any analyzed transients | |||
L.1 and L. | |||
Therefore, failure of one channel places the Function in a two-out-of-two configuration. | Therefore, failure of one channel places the Function in a two-out-of-two configuration. | ||
One channel must be tripped to place the Function in | One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements. | ||
Alternatively, if the inoperable channel is not restored to | Alternatively, if the inoperable channel is not restored to OPERABLE status or placed in the tripped condition within 6 hours, the unit must be placed in MODE 3 within 12 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, this Function is no longer required OPERABLE.Required Action L.1 is modified by a Note that allows the inoperable channel to be bypassed for up to 2 hours for surveillance testing of other channels.M.1, M.2.1 and M.2.2 Condition M applies to the Auxiliary Feedwater Pumps Suction Transfer on Suction Pressure Low.If one channel is inoperable, 1 hour is allowed to restore the channel to OPERABLE status or to place it in the tripped condition. | ||
The failure of one channel places the Function in a two-out-of-two configuration. | |||
Required Action L.1 is modified by a Note that allows the inoperable channel to be bypassed for up to 2 hours for surveillance testing of | One channel must be tripped to place the Function in a one-out-of-three configuration that satisfies redundancy requirements. | ||
M.1, M.2.1 and M.2. | Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 1 hour requires the unit to be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-38 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
The failure | The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, this Function is no longer required OPERABLE.N.1, N.2.1 and N.2.2 Condition N applies to:* RWST Level--Low Coincident with Safety Injection. | ||
RWST Level--Low Coincident With SI provides actuation of switchover to the containment sump. Note that this Function requires the bistables to energize to perform their required action. The failure of up to two channels will not prevent the operation of this Function. | |||
Failure to restore the inoperable channel to OPERABLE status or place | However, placing a failed channel in the tripped condition could result in a premature switchover to the sump, prior to the injection of the minimum volume from the RWST. Placing the inoperable channel in bypass results in a two-out-of-three logic configuration, which satisfies the requirement to allow another failure without disabling actuation of the switchover when required. | ||
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full | Restoring the channel to OPERABLE status or placing the inoperable channel in the bypass condition within 6 hours is sufficient to ensure that the Function remains OPERABLE, and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The 6 hour Completion Time is justified in Reference | ||
: 7. If the channel cannot be returned to OPERABLE status or placed in the bypass condition within 6 hours, the unit must be brought to MODE 3 within the following 6 hours and MODE 5 within the next 30 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows placing a second channel in the bypass condition for up to 2 hours for surveillance testing. The total of 12 hours to reach MODE 3 and 2 hours for a second channel to be bypassed is acceptable based on the results of Reference 7.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-39 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1, 0.2.1 and 0.2.2 Condition 0 applies to the P-11 and P-12 interlocks. | |||
N.1, N.2.1 and N.2. | With one channel inoperable, the operator must verify that the interlock is in the required state for the existing unit condition. | ||
RWST Level--Low Coincident With SI provides actuation of switchover | This action manually accomplishes the function of the interlock. | ||
Determination must be made within 1 hour. The 1 hour Completion Time is equal to the time allowed by LCO 3.0.3 to initiate shutdown actions in the event of a complete loss of ESFAS function. | |||
Restoring the channel to OPERABLE status or placing | If the interlock is not in the required state (or placed in the required state) for the existing unit condition, the unit must be placed in MODE 3 within the next 6 hours and MODE 4 within the following 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of these interlocks. | ||
: 7. If the channel cannot be returned to | P.1 Condition P applies to the Containment Pressure Control System Start and Terminate Permissives. | ||
In MODE 5, the unit does not have any analyzed transients | With one or more channels inoperable, the affected containment spray and containment air return systems components must be declared inoperable immediately. | ||
The total of 12 hours to reach MODE 3 and 2 hours for a | The supported system LCOs provide the appropriate Required Actions and Completion Times for the equipment made inoperable by the inoperable channel. The immediate Completion Time is appropriate since the inoperable channel could prevent the supported equipment from starting when required. | ||
With one channel inoperable, the operator must verify that the interlock | Additionally, protection from an inadvertent actuation may not be provided if the terminate function is not OPERABLE.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-40 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) | ||
This action | Q.1, Q.2. Q.3.1. and Q.3.2 With one channel of NSWS Suction Transfer -Low Pit Level inoperable in one or more NSWS pits, 4 hours are allowed to place it in the tripped condition or align the NSWS to the Standby NSWS Pond. The failure of one channel places the Function in a two-out-of-two configuration. | ||
Determination must be | The failed channel must either be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements, or the NSWS realigned to fulfill the safety function.Failure to place the channel in the tripped condition or to realign the NSWS suction and discharge within 4 hours requires the unit be placed in MODE 3 within the following 6 hours and MODE 5 within the next 30 hours.The requirement to align the NSWS to the Standby NSWS Pond only applies to OPERABLE trains of the system.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, this Function is no longer required OPERABLE.R.1. R.2.1, and R.2.2 With two or more channels of NSWS Suction Transfer -Low Pit Level inoperable in one or more pits, the NSWS must be aligned to the Standby NSWS Pond within 4 hours. Failure to accomplish the realignment within 4 hours requires the unit be placed in MODE 3 within the following 6 hours and MODE 5 within the next 30 hours.The requirement to align the NSWS to the Standby NSWS Pond only applies to OPERABLE trains of the system.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, this Function is no longer required OPERABLE.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-41 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE The SRs for each ESFAS Function are identified by the SRs column REQUIREMENTS of Table 3.3.2-1.A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions. | ||
If the interlock is not in the required state (or | Note that each channel of process protection supplies both trains of the ESFAS. When testing channel I, train A and train B must be examined.Similarly, train A and train B must be examined when testing channel II, channel Ill, and channel IV (if applicable). | ||
Placing the unit in MODE 4 removes all requirements | The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies. | ||
P. | SR 3.3.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. | ||
With one or more channels inoperable, the affected containment | A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. | ||
The supported system LCOs provide | It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. | ||
The immediate Completion Time is appropriate since the inoperable channel could prevent | Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and reliability. | ||
Additionally, protection from an inadvertent actuation may not be provided if | If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.2 SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST. The SSPS is tested using the semiautomatic tester. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation. | ||
Catawba Units 1 and 2 B3324 eiinN. | Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-42 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
Q.1, Q.2. Q.3.1. and Q.3. | Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, are tested for each protection function. | ||
-Low Pit Level inoperable | |||
Failure to place the channel in the tripped condition or to realign | |||
R.1. R.2.1, and R.2. | |||
-Low Pit | |||
Catawba Units 1 and 2 B3324 eiinN. | |||
Note that each channel of process protection supplies both trains of | |||
Similarly, train A and train B must be examined when testing channel II,channel Ill, and channel IV (if applicable). | |||
The | |||
SR 3.3.2. | |||
A CHANNEL CHECK is normally | |||
It is based on the assumption | |||
A | |||
Agreement criteria are determined by the unit staff, based on | |||
If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside | |||
Catawba Units 1 and 2 B3324 eiinN. | |||
Through the semiautomatic tester, all possible logic combinations, | |||
In addition, the master relay coil is pulse tested for continuity. | In addition, the master relay coil is pulse tested for continuity. | ||
This verifies that the logic modules are OPERABLE and that there is | This verifies that the logic modules are OPERABLE and that there is an intact voltage signal path to the master relay coils. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.3 SR 3.3.2.3 is the performance of a TADOT. This test is a check of the Loss of Offsite Power Function. | ||
Each Function is tested up to, | Each Function is tested up to, and including, the master transfer relay coils.This test also includes trip devices that provide actuation signals directly to the SSPS. The SR is modified by a Note that excludes final actuation of pumps and valves to minimize plant upsets that would occur. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.4 SR 3.3.2.4 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a low voltage continuity check of the slave relay coil. Upon master relay contact operation, a low voltage is injected to the slave relay coil. This voltage is insufficient to pick up the slave relay, but large enough to demonstrate signal path continuity. | ||
The time allowed | The time allowed for the testing (4 hours) is justified in Reference | ||
: 7. The Surveillance Frequency is based on operating experience, equipment reliability, | : 7. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.5 SR 3.3.2.5 is the performance of a COT.A COT is performed on each required channel to ensure the channel will perform the intended Function. | ||
The tested portion of the loop must | The tested portion of the loop must trip within the Allowable Values specified in Table 3.3.2-1.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-43 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
The setpoint shall be left set consistent with the assumptions of | The setpoint shall be left set consistent with the assumptions of the setpoint methodology. | ||
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.6 SR 3.3.2.6 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is placed in a condition where the relay contact operation can be verified without operation of the equipment. | ||
Actuation equipment that may not | Actuation equipment that may not be operated in the design mitigation MODE is prevented from operation by the SLAVE RELAY TEST circuit. For this latter case, contact operation is verified by a continuity check of the circuit containing the slave relay. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.For slave relays or any auxiliary relays in the ESFAS circuit that are of the type Westinghouse AR or Potter & Brumfield MDR, the SLAVE RELAY TEST Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.7 SR 3.3.2.7 is the performance of a COT on the RWST level and Containment Pressure Control Start and Terminate Permissives. | ||
For this latter case, contact operation | A COT is performed on each required channel to ensure the entire channel will perform the intended Function. | ||
A COT is performed on each required channel to ensure the | Setpoints must be found conservative with respect to the Allowable Values specified in Table 3.3.2-1. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-44 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
Setpoints must be | For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions" has been implemented, this SR is modified by two Notes as identified in Table 3.3.2-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. | ||
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under | The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition. | ||
For Functions for which TSTF-493, "Clarify Application of | The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the NOMINAL TRIP SETPOINT (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. | ||
The first | This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. | ||
The purpose | If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable. | ||
For channels determined to | The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances be in the UFSAR.SR 3.3.2.8 SR 3.3.2.8 is the performance of a TADOT. This test is a check of the Manual Actuation Functions, AFW pump start on trip of all MFW pumps, AFW low suction pressure, Reactor Trip (P-4) Interlock, and Doghouse Water Level -High High Feedwater Isolation. | ||
Entry into the Corrective Action Program | Each Manual Actuation Function is tested up to, and including, the master relay coils. In some instances, the test includes actuation of the end device (i.e., pump starts, valve cycles, etc.). The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. The SR is modified by a Note that excludes verification of setpoints during the TADOT for manual initiation Functions. | ||
The | |||
the as-left and as- | |||
This will ensure that sufficient margin to the Safety Limit and/ | |||
If the as-left channel setting cannot | |||
The second Note also | |||
Each Manual Actuation Function is tested up to, and including, the master relay coils. In | |||
The SR is modified by | |||
The manual initiation Functions have no associated setpoints. | The manual initiation Functions have no associated setpoints. | ||
Catawba Units 1 and 2 B3324 eiinN. | Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-45 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
SIR 3.3.2. | SIR 3.3.2.9 SIR 3.3.2.9 is the performance of a CHANNEL CALIBRATION. | ||
CHANNEL CALIBRATION is a complete check of the instrument ioop,including the sensor. The test verifies that the channel responds | CHANNEL CALIBRATION is a complete check of the instrument ioop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology. | ||
CHANNEL CALIBRATIONS must be performed consistent with | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note stating that this test should include verification that the time constants are adjusted to the prescribed values where applicable. | ||
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under | The applicable time constants are shown in Table 3.3.2-1.For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions" has been implemented, this SR is modified by two Notes as identified in Table 3.3.2-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. | ||
The applicable time constants are shown in | The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition. | ||
The first | The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the NOMINAL TRIP SETPOINT (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. | ||
The purpose | This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. | ||
For channels determined to | If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-46 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) channel shall be declared inoperable. | ||
Entry into the Corrective Action Program | The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances be in the UFSAR.SR 3.3.2.10 This SR ensures the individual channel ESE RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis.Response Time testing acceptance criteria are included in the UFSAR (Ref. 2). Individual component response times are not modeled in the analyses. | ||
The | The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the Trip Setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position). | ||
the as-left and as- | For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate UFSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace, onsite, or offsite (e.g. vendor)test measurements, or (3) utilizing vendor engineering specifications. | ||
This will ensure that sufficient margin to the Safety Limit and/ | WCAP-13632-P-A Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. In addition, while not specifically identified in the WCAP, ITT Barton 386A and 580A-0 sensors were compared to sensors which were identified. | ||
If the as-left channel setting cannot | It was concluded that the WCAP results could be applied to these two sensor types as well. Response time verification for other sensor types must be demonstrated by test.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-47 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
The second Note also | WCAP-1 4036-P-A Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.The allocations for sensor, signal conditioning and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter. | ||
Response Time testing acceptance criteria are included in the UFSAR(Ref. 2). Individual component response times are not modeled in | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note that clarifies that the turbine driven AEW pump is tested within 24 hours after reaching 600 psig in the SGs.SR 3.3.2.11 SR 3.3.2.11 is the performance of a COT on the NSWS Suction Transfer-Low Pit Level.A COT is performed on each required channel to ensure the entire channel will perform the intended Function. | ||
The analyses model the overall or total elapsed time, from | Setpoints must be found within the Allowable Values specified in Table 3.3.2-1. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-48 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) | ||
SR 3.3.2.12 SR 3.3.2.12 is the performance of an ACTUATION LOGIC TEST on the Doghouse Water Level-High High and NSWS Suction Transfer-Emergency Low Pit Level Functions. | |||
For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the | An ACTUATION LOGIC TEST to satisfy the requirements of GL 96-01 is performed on each instrumentation to ensure all logic combinations will initiate the appropriate Function. | ||
Response time may be verified by actual response time tests in | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES | ||
Allocations for sensor response times may be obtained from:(1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace, onsite, or offsite (e.g. vendor)test measurements, or (3) utilizing vendor engineering specifications. | |||
WCAP-13632-P-A Revision 2, "Elimination of Pressure Sensor | |||
WCAP-1 4036-P-A Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" provides the basis and methodology | |||
One example where | |||
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under | |||
Setpoints must be | |||
The Surveillance Frequency is based on operating experience, equipment reliability, | |||
SR 3.3.2. | |||
An ACTUATION LOGIC TEST to satisfy the requirements of GL 96-01 | |||
The Surveillance Frequency is | |||
: 1. UFSAR, Chapter 6.2. UFSAR, Chapter 7.3. UFSAR, Chapter 15.4. IEEE-279-1971. | : 1. UFSAR, Chapter 6.2. UFSAR, Chapter 7.3. UFSAR, Chapter 15.4. IEEE-279-1971. | ||
: 5. 10 CFR 50.49.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii). | : 5. 10 CFR 50.49.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii). | ||
: 7. WCAP-1 0271-P-A, Supplement 1 and Supplement 2, Rev. 1, | : 7. WCAP-1 0271-P-A, Supplement 1 and Supplement 2, Rev. 1, May 1986 and June 1990.8. WCAP-1 3632-P-A Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" Sep., 1995.9. WCAP-1 4036-P-A Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" Oct., 1998.10. Not used.11. Not used.12. Not used.13. WCAP-14333-P-A, Revision 1, October 1998.14. Not used.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-49 LTOP System B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.12 Low Temperature Overpressure Protection (LTOP) System BASES BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (PIT) limits of 10 CFR 50, Appendix G (Ref. 1 ). The reactor vessel is the limiting RCPB component for demonstrating such protection. | ||
This specification | This specification provides the maximum allowable actuation logic setpoints for the power operated relief valves (PORVs) and LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," provides the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES.The reactor vessel material is less tough at low temperatures than at normal operating temperature. | ||
provides the maximum RCS pressure for the existing | As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased. | ||
The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. | |||
As the vessel neutron | Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3 requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the specified limits.This LCO provides RCS overpressure protection by having a minimum coolant input capability and having adequate pressure relief capacity.Limiting coolant input capability requires all but two pumps incapable of injection into the RCS, isolating the accumulators, and limiting reactor coolant pump operation at low temperatures. | ||
The potential for vessel overpressurization is most acute when the RCS | The pressure relief capacity requires two redundant RCS relief valves. One RCS relief valve is the overpressure protection device that acts to terminate an increasing pressure event.With minimum coolant input capability, the ability to provide core coolant addition is restricted. | ||
Exceeding the RCS P/T limits by a significant amount could cause | The LCO does not require the makeup control Catawba Units 1 and 2B34121RvsoN.5 B 3.4.12-1 Revision No. 5 LTOP System B 3.4.12 BASES BACKGROUND (continued) system deactivated or the safety injection (SI) actuation circuits blocked.Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve. If conditions require the use of more than one charging pump for makeup in the event of loss of inventory, then additional pumps can be made available through manual actions.The LTOP System for pressure relief consists of two PORVs with reduced lift settings or two residual heat removal (RHR) suction relief valves or one PORV and one RHR suction relief valve. Two RCS relief valves are required for redundancy. | ||
Limiting coolant input capability requires all but two pumps incapable | One RCS relief valve has adequate relieving capability to keep from overpressurization for the required coolant input capability. | ||
The pressure relief | PORV Requirements As designed for the LTOP System, each PORV is signaled to open if the RCS pressure reaches 400 psig (as left calibrated), allowable value < 425 psig (as found), when the PORVS are in the "io-press" mode of operation. | ||
The LCO does not require the makeup | If the PORVs are being used to meet the requirements of this Specification, then indicated ROS cold leg temperature is limited to >_ 70°F in accordance with the LTOP analysis. | ||
One RCS relief valve has adequate relieving capability to keep from overpressurization for the required coolant | When all Reactor Coolant Pumps are secured, this temperature is measured at the outlet of the residual heat removal heat exchanger. | ||
PORV Requirements As designed for the LTOP System, each PORV is signaled to open if | This location will provide the most conservative (lower) temperature measurement of water capable of being delivered into the Reactor Coolant System. The LTOP actuation logic monitors both RCS temperature and RCS pressure. | ||
allowable value < | The signals used to generate the pressure setpoints originate from the wide range pressure transmitters. | ||
If the PORVs are being used to meet the requirements of | The signals used to generate the temperature permissives originate from the wide range RTDs. Each signal is input to the appropriate NSSS protection system cabinet where it is converted to an internal signal and then input to a comparator to generate an actuation signal. If the indicated pressure meets or exceeds the calculated value, a PORV is signaled to open.This Specification presents the PORV setpoints for LTOP. Having the setpoints of both valves within the limits ensures that the Reference 1 limits will not be exceeded in any analyzed event.When a PORV is opened in an increasing pressure transient, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.Catawba Units 1 and 2B34122RvsoN.5 B 3.4.12-2 Revision No. 5 LTOP System B 3.4.12 BASES BACKGROUND (continued) | ||
When all Reactor Coolant | RHR Suction Relief Valve Requirements During LTOP MODES, the RHR system is operated for decay heat removal and low-pressure letdown control. Therefore, the RHR suction isolation valves (there are two suction isolation valves per line) are open in the piping from the ROS hot legs to the inlets of the RHR pumps. While these valves are open, the RHR suction relief valves are exposed to the RCS and are able to relieve pressure transients in the RCS.The RHR suction isolation valves must be open with operator power removed to make the RHR suction relief valves OPERABLE for RCS overpressure mitigation. | ||
This location will provide the | The RHR suction relief valves are spring loaded, bellows type water relief valve with pressure tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 8) for Class 2 relief valves.APPLICABLE Safety analyses (Ref. 3) demonstrate that the reactor vessel is adequately SAFETY ANALYSES protected against exceeding the Reference 1 P/T limits. In MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature exceeding 210°F, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At about 21 0 0 F and below, overpressure prevention falls to two OPERABLE RCS relief valves. Each of these means has a limited overpressure relief capability. | ||
The signals used | The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. | ||
The signals used to generate the temperature permissives originate from the wide range RTDs. Each signal is input to | Each time the P/T curves are revised, the LTOP System must be re-evaluated to ensure its functional requirements can still be met using the RCS relief valve method.Any change to the RCS must be evaluated against the Reference 3 analyses to determine the impact of the change on the LTOP acceptance limits.Transients that are capable of overpressurizing the ROS are categorized as either mass or heat input transients, examples of which follow: Mass Input Type Transients | ||
As | : a. Inadvertent safety injection of one safety injection pump and one charging pump; or b. Charging/letdown flow mismatch.Catawba Units 1 and 2B34123RvsoN.5 B 3.4.12-3 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued) | ||
RHR Suction Relief Valve Requirements During LTOP MODES, the RHR system is operated for decay | |||
Therefore, the RHR | |||
The RHR suction relief valves are spring loaded,bellows type water relief valve with pressure tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 8) for Class 2 relief valves.APPLICABLE Safety analyses (Ref. 3) demonstrate that the reactor vessel is adequately SAFETY ANALYSES protected against exceeding the Reference 1 P/T limits. In MODES 1, 2,and 3, and in MODE 4 with RCS cold leg temperature exceeding 210°F,the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At about 21 | |||
The actual temperature at which the pressure in the P/T limit curve | |||
Each | |||
: a. Inadvertent safety injection of one safety injection pump and | |||
Catawba Units 1 and 2B34123RvsoN.5 B 3.4.12- | |||
Heat Input Type Transients | Heat Input Type Transients | ||
: a. Inadvertent actuation of pressurizer heaters;b. Loss of RHR cooling; | : a. Inadvertent actuation of pressurizer heaters;b. Loss of RHR cooling; or c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators. | ||
The following are required during the LTOP MODES to ensure that | The following are required during the LTOP MODES to ensure that mass and heat input transients do not occur, which either of the LTOP overpressure protection means cannot handle: a. Rendering all but two pumps incapable of injection; | ||
: b. Deactivating the accumulator discharge isolation valves in | : b. Deactivating the accumulator discharge isolation valves in their closed positions; | ||
: c. Limiting RCP operation based on the existing temperature in | : c. Limiting RCP operation based on the existing temperature in the ROS cold legs; and d. Disallowing start of an RCP if secondary temperature is more than 50°F above primary temperature in any one loop. LCO 3.4.6, "RCS Loops--MODE 4," and LCO 3.4.7, "RCS Loops--MODE 5, Loops Filled," provide this protection'. | ||
provide this protection'. | The Reference 3 analyses demonstrate that one RCS relief valve can maintain RCS pressure below limits when any two pumps (charging and/or safety injection) are actuated. | ||
The Reference 3 analyses demonstrate that one RCS relief valve | Thus, the LCO allows two pumps OPERABLE during the LTOP MODES. The LCO also requires the accumulators be isolated when accumulator pressure is greater than or equal to the maximum ROS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3.The isolated accumulators must have their discharge valves closed and power removed.The restrictions on the number of RCPs in operation at a given temperature ensures that during a LTOP mass injection event that the pressure/temperature (PIT) limits of 10 CFR 50, Appendix G to protect the Catawba Units 1 and 2B34124RvsoN.5 B 3.4.12-4 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued) reactor vessel are not exceeded. | ||
Thus, the LCO allows two | During startup and shutdown, when the RCPs are operated, their induced flows create a pressure drop across the vessel. This pressure drop along with the difference in elevation between the beitline region and the instrumentation locations are additive to the peak pressure from the mass injection event.The amount of the pressure at the reactor vessel beltline region from the RCPs is dependent on the number of RCPs operated. | ||
During startup and shutdown, when | Adequate margin to prevent exceeding the P/T limits is assured by restricting the number of RCPs operated. | ||
Adequate | Since LTOP events are basically acknowledged as being steady-state events, these RCP operating restrictions are designed to work with the LTOP setpoint to provide protection from exceeding the steady-state Appendix G P/T limits.Fracture mechanics analyses established the temperature of LTOP Applicability at 210°F.The consequences of a small break loss of coolant accident (LOCA) in LTOP MODE 4 conform to 10 CFR 50.46 and 10 CFR 50, Appendix K (Refs. 4 and 5), requirements by having a maximum of two pumps (charging and/or safety injection) | ||
Since LTOP events are basically acknowledged as | OPERABLE and SI actuation enabled.PORV Performance The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the specified limit. The setpoints are derived by analyses that model the performance of the LTOP System, assuming the limiting LTOP transient of one charging pump and one safety injection pump injecting into the RCS. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensures the Reference 1 PIT limits will be met.The PORV setpoints will be updated when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation. | ||
OPERABLE and SI actuation enabled.PORV Performance The fracture mechanics analyses show that the vessel is protected | Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. | ||
Revised limits | The Bases for LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," discuss these examinations. | ||
The Bases for LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," | Catawba Units 1 and 2B34125RvsoN.5 B 3.4.12-5 Revision No. 5 LTOP System B 3.4.12 BAS ES APPLICABLE SAFETY ANALYSES (continued) | ||
discuss these examinations. | |||
Catawba Units 1 and 2B34125RvsoN.5 B 3.4.12- | |||
The PORVs are considered active components. | The PORVs are considered active components. | ||
Thus, the failure of | Thus, the failure of one PORV is assumed to represent the worst case, single active failure.RHR Suction Relief Valve Performance The RHR suction relief valves do not have variable pressure and temperature lift setpoints like the PORVs. Analyses show that one RHR suction relief valve with a setpoint at or between 417 psig and 509 psig will pass flow greater than that required for the limiting LTOP transient while maintaining RCS pressure less than the P/T limit curve. Assuming all relief flow requirements during the limiting LTOP event, an RHR suction relief valve will maintain RCS pressure to within the valve rated lift setpoint, plus an accumulation | ||
< 10% of the rated lift setpoint. | < 10% of the rated lift setpoint.Although each RHR suction relief valve may itself meet single failure criteria, its inclusion and location within the RHR system does not allow it to meet single failure criteria when spurious RHR suction isolation valve closure is postulated. | ||
Although each RHR suction relief valve may itself meet single | Also, as the RCS P/T limits are decreased to reflect the loss of embrittlement, the RHR suction relief valves must be analyzed to still accommodate the design basis transients for LTOP.The RHR suction relief valves are considered to be active components. | ||
Also, as the RCS P/T limits are decreased to | Thus, the failure of one valve is assumed to represent the worst case single active failure.The LTOP System satisfies Criterion 2 of 10 CFR 50.36 (Ref. 6).LCO This LCO requires that the LTOP System is OPERABLE. | ||
Thus, the failure of one valve is assumed to represent the worst | The LTOP System is OPERABLE when the minimum coolant input and pressure relief capabilities are OPERABLE. | ||
The | Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient. | ||
Violation of this LCO could lead to | To limit the coolant input capability, the LCO permits a maximum of two pumps (charging and/or safety injection) capable of injecting into the RCS and requires all accumulator discharge isolation valves closed and immobilized when accumulator pressure is greater than or equal to the maximum ROS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3. The LCO also limits ROP operation based on existing RCS cold leg temperature as required by the LTOP analysis.The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are: Catawba Units 1 and 2B34126RvsoN.5 B 3.4.12-6 Revision No. 5 LTOP System B 3.4.12 BASES LCO (continued) | ||
To limit the coolant input capability, the LCO permits a maximum of | : a. Two OPERABLE PORVs (NC-32B and NC-34A); or A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set to the specified limit and testing proves its automatic ability to open at this setpoint, and motive power is available to the valve and its control circuit. The following restrictions are placed on PORV OPERABILITY for LTOP due to commonalities between the PORV power supplies and letdown isolation: | ||
The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are:Catawba Units 1 and 2B34126RvsoN.5 B 3.4.12- | * NC-32B is not OPERABLE for LTOP if excess letdown is in service.* NC-32B is not OPERABLE for LTOP if normal letdown is in service and centrifugal charging pump B is in operation. | ||
: a. Two OPERABLE PORVs (NC-32B and NC-34A); | * NC-34A is not OPERABLE for LTOP if normal letdown is in service.b. Two OPERABLE RHR suction relief valves (ND-3 and ND-38); or An RHR suction relief valve is OPERABLE for LTOP when both of its RHR suction isolation valves are open, its setpoint is at or between 417 psig and 509 psig, and testing has proven its ability to open in this pressure range.c. One OPERABLE PORV and one OPERABLE RHR suction relief valve.Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient. | ||
APPLICABILITY This LCO is applicable in MODE 4 when any ROS cold leg temperature is< 210°F, in MODE 5, and in MODE 6 when the reactor vessel head is on.The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above 21 0°F. When the reactor vessel head is off, overpressurization cannot occur.LCO 3.4.3 provides the operational P/T limits for all MODES. LCO 3.4.10,"Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above 21 0°F.Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows Catawba Units 1 and 2B34127RvsoN.5 B 3.4.12-7 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABILITY (continued) operator action to mitigate the event.The Applicability is modified by a Note stating that accumulator isolation is only required when the accumulator pressure is more than or at the maximum RCS pressure for the existing temperature, as allowed by the P/T limit curves. This Note permits the accumulator discharge isolation valve Surveillance to be performed only under these pressure and temperature conditions. | |||
The following restrictions are placed on PORV OPERABILITY for LTOP due | ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable LTOP system. There is an increased risk associated with entering MODE 4 from MODE 5 with LTOP inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance. | ||
* NC-32B is not OPERABLE for LTOP if excess letdown is | A.1 With more than two pumps (charging and/or safety injection) capable of injecting into the RCS, ROS overpressurization is possible.To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency.of removing the RCS from this condition. | ||
* NC-34A is not OPERABLE for LTOP if normal letdown is | B._11 With RCP operation not limited in accordance with Table 3.4.12-1, RCS overpressurization is possible.To immediately initiate action to limit pump operation reflects the urgency of removing the RCS from this condition. | ||
APPLICABILITY This LCO is applicable in MODE 4 when any ROS cold leg temperature is< 210°F, in MODE 5, and in MODE 6 when the reactor vessel head is on.The pressurizer safety valves provide overpressure protection that | C.1, D.1, and D.2 An unisolated accumulator requires isolation within 1 hour. This is only required when the accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.If isolation is needed and cannot be accomplished in 1 hour, Required Action D.1 and Required Action D.2 provide two options, either of which must be performed in the next 12 hours. By increasing the ROS Catawba Units 1 and 2B34128RvsoN.5 B 3.4.12-8 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued) temperature to > 21 0°F, an accumulator pressure of 678 psig cannot exceed the LTOP limits if the accumulators are fully injected.Depressurizing the accumulators below the LTOP limit also gives this protection. | ||
requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2,and 3, and MODE 4 above 21 0°F.Low temperature overpressure prevention is most critical during | The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.E.1I In MODE 4 when any RCS cold leg temperature is < 210°F, with one RCS relief valve inoperable, the RCS relief valve must be restored to OPERABLE status within a Completion Time of 7 days. Two RCS relief valves (in any combination of the PORVs and RHR suction relief valves)are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component. | ||
ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable | The Completion Time considers the facts that only one of the RCS relief valves is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low.F. 1 The consequences of operational events that will overpressurize the RCS are more severe at lower temperature (Ref. 7). Thus, with one of the two RCS relief valves inoperable in MODE 5 or in MODE 6 with the head on Completion Time to restore two valves to OPERABLE status is 24 hours.The Completion Time represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one OPERABLE RCS relief valve to protect against overpressure events.Catawba Units 1 and 2B34129RvsoN.5 B 3.4.12-9 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued) | ||
A. | G.1 and G.2 Steps must be taken immediately to limit potential mass input into the RCS, and the RCS must be depressurized and a vent must be established within 12 hours when: a. Both required RCS relief valves are inoperable; or b. A Required Action and associated Completion Time of Condition A, 0, E, or F is not met; or c. The LTOP System is inoperable for any reason other than Condition A, C, D, E, or F.The Reference 3 analyses demonstrate that with the mass input into the RCS reduced to that of one injection pump (charging or safety injection) an RCS vent of> 4.5 square inches can maintain RCS pressure below limits. Therefore the Condition requires action to be taken immediately to reduce the input to that of one injection pump (charging or safety injection) prior to commencing RCS pressure reduction and establishing the required RCS vent. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle fracture of the reactor vessel.The capacity of a vent this size is greater than the flow of the limiting transient for the LTOP configuration, one charging pump or one safety injection pump OPERABLE, maintaining RCS pressure less than the maximum pressure on the P/T limit curve. The required vent capacity may be provided by one or more vent paths. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.The RCS vent size will be re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material su rveil lance.The ROS vent is passive and is not subject to active failure.The Completion Time considers the time required to place the plant in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements. | ||
To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency.of removing the RCS from this condition. | Catawba Units 1 and 2 B341-0Rvso o B 3.4.12-10 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued) | ||
B. | G.3 The ROS vent of > 4.5 square inches is proven OPERABLE by verifying its open condition either: a. Once every 12 hours for a valve that is not locked, (valves that are sealed or secured in the open position are considered "locked" in this context); | ||
To immediately initiate action to limit pump operation reflects the | or b. Once every 31 days for other vent path(s) (e.g., a vent valve that is locked, sealed or secured in position or a removed pressurizer safety valve or open manway also fits this category). | ||
C.1, D.1, and D. | The passive vent valve arrangement must only be open to be OPERABLE. | ||
Depressurizing the accumulators below the LTOP limit also gives | This Required Action is required to be performed if the vent is being used to satisfy the pressure relief requirements of Required Action G.2.Catawba Units 1 and 2 B341-1Rvso o B 3.4.12-11 Revision No. 5 LTOP System B 3.4.12 BASES SURVEILLANCE SR 3.4.12.1 and SR 3.4.12.2 REQU IREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, a maximum of two pumps (charging and/or safety injection) are verified capable of injecting into the RCS and the accumulator discharge isolation valves are verified closed and power removed.The pumps are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control. An alternate method of LTOP control may be employed using at least two independent means to prevent a pump start such that a single failure or single action will not result in an injection into the RCS. This may be accomplished through two valves in the discharge flow path being closed.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.12.3 Each required RHR suction relief valve shall be demonstrated OPERABLE by verifying its RHR suction isolation valves are open and by testing it in accordance with the Inservice Testing Program. This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet this LCO.The RHR suction isolation valves are verified to be opened. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The ASME Code (Ref. 9), test per Inservice Testing Program verifies OPERABILITY by proving relief valve mechanical motion and by measuring and,. if required, adjusting the lift setpoint.SR 3.4.12.4 The PORV block valve must be verified open to provide the flow path for each required PORV to perform its function when actuated. | ||
The Completion Times are based on operating experience that | The valve must be remotely verified open in the main control room. This Surveillance is performed if the PORV satisfies the LCO.The block valve is a remotely controlled, motor operated valve. The Catawba Units 1 and 2 B341-2Rvso o B 3.4.12-12 LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued) power to the valve operator is not required removed, and the manual operator is not required locked in the inactive position. | ||
The Completion Time considers the facts that only one of the RCS | Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation. | ||
G.1 and G. | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.12.5 Performance of a COT is required within 12 hours after decreasing RCS temperature to < 21 0°F and periodically on each required PORV to verify and, as necessary, adjust its lift setpoint. | ||
Catawba Units 1 and 2 B341-0Rvso | The COT will verify the setpoint is within the allowed maximum limits. PORV actuation could depressurize the RCS and is not required. | ||
G. | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The 12 hour Frequency considers the unlikelihood of a low temperature overpressure event during this time.A Note has been added indicating that this SR is required to be met 12 hours after decreasing RCS cold leg temperature to < 210°F. The COT cannot be performed until in the LTOP MODES when the PORV lift setpoint can be reduced to the LTOP setting. The test must be performed within 12 hours after entering the LTOP MODES.SR 3.4.12.6 Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B341-3Rvso o B 3.4.12-13 Revision No. 5 LTOP System B 3.4.12 BAS ES SURVEILLANCE REQUIREMENTS (continued) | ||
SR 3.4.12.7 Each required RHR suction relief valve shall be demonstrated OPERABLE by verifying its RHR suction isolation valves are open and by testing it in accordance with the Inservice Testing Program. (Refer to SR 3.4.12.3 for the RHR suction isolation valves Surveillance and for a description of the Inservice Testing Program.) | |||
The passive vent valve arrangement must only be open to | This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet this LCO.The RHR suction isolation valves are verified open, with power to the valve operator removed and locked in the removed position, to ensure that accidental closure will not occur. The "locked open in the removed position" power supply must be locally verified in its open position with the power supply to the valve locked in its inactive position. | ||
This Required Action is required to be performed if the | The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES | ||
An alternate method of LTOP control may | : 1. 10 CFR 50, Appendix G.2. Generic Letter 88-1 1.3. UFSAR, Section 5.2 4. 10 CFR 50, Section 50.46.5. 10 CFR 50, Appendix K.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii). | ||
: 7. Generic Letter 90-06.8. ASME, Boiler and Pressure Vessel Code, Section III.9. ASME Code for Operation and Maintenance of Nuclear Power Plants.Catawba Units 1 and 2 B341-4Rvso o B 3.4.12-14 Revision No. 5}} | |||
SR 3.4.12. | |||
The | |||
Thus, the | |||
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.12. | |||
The COT will verify the | |||
The Surveillance Frequency is based | |||
The test must be performed within 12 hours after entering the LTOP MODES.SR 3.4.12. | |||
SR 3.4.12. | |||
(Refer to | |||
This Surveillance is | |||
The Surveillance Frequency is based on operating experience, equipment reliability, | |||
: 1. 10 CFR 50, Appendix G.2. Generic Letter 88-1 1.3. UFSAR, Section 5. | |||
: 7. Generic Letter 90-06.8. ASME, Boiler and Pressure Vessel Code, Section III.9. ASME Code for Operation and Maintenance of Nuclear | |||
Revision as of 18:11, 8 July 2018
| ML15350A393 | |
| Person / Time | |
|---|---|
| Site: | Catawba  |
| Issue date: | 12/14/2015 |
| From: | Henderson K Duke Energy Carolinas |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| CNS-15-098 | |
| Download: ML15350A393 (85) | |
Text
S_ %DUKEKelvin Henderson Vice President SENERGY catawba Nuclear Station Duke Energy CNO1VP I 4800 Concord Road York, SC 29745 o: 803,701.4251 CNS-1 5-098 f: 803.701.3221 December 14, 2015 U.S. Nuclear Regulatory Commission Document Control Desk Washington, DC 20555-0001
Subject:
Duke Energy Carolinas, LLC Catawba Nuclear Station, Units 1 and 2 Docket Nos. 50-413 and 50-414 Technical Specification Bases Changes Pursuant to 10OCFR 50.4, please find attached changes to the Catawba Nuclear Station Technical Specification Bases. These Bases changes were made according to the provisions of Technical Specification 5.5.14, "Technical Specifications (TS) Bases Control Program." Any questions regarding this information should be directed to Larry Rudy, Regulatory Affairs, at (803) 701-3084.I certify that I am a duly authorized officer of Duke Energy Carolinas, LLC, and that the information contained herein accurately represents changes made to the Technical Specification Bases since the previous submittal.
Kelvin Henderson Vice President, Catawba Nuclear Station Attachment A L www.duke-energy.com U.S. Nuclear Regulatory Commission December 14, 2015 Page 2 xc: L. D. Wert, Jr., Acting Regional Administrator U. S. Nuclear Regulatory Commission, Region II Marquis One Tower 245 Peachtree Center Ave., NE Suite 1200 Atlanta, GA 30303-1257 Mr. G.E. Miller NRC Project Manager (CNS)U.S. Nuclear Regulatory Commission One White Flint North, Mail Stop O-8G9A 11555 Rockville Pike Rockville, MD 20852-2746 G. A. Hutto, Senior Resident Inspector Catawba Nuclear Station ENERGY~Catawba Nuclear Station Duke Energy 4800 Concord Rd.York, SC 29745 December 14, 2015 Re: Catawba Nuclear Station Technical Specifications Bases Please replace the corresponding pages in your copy of the Catawba Technical Specifications Manual as follows: REMOVE THESE PAGES INSERT THESE PAGES LIST OF EFFECTIVE PAGES Entire Section (19 pages)Entire Section (19 pages)TAB 3.3.2 B 3.3.2-1 thru B 3.3.2-49 Revision 10 B 3.3.2-1 thru B 3.3.2-49 Revision 11 TAB 3.4.12 B 3.4.12-1 thru B 3.4.12-14 Revision 4 B 3.4.12-1 thru B 3.4.12-14 Revision 5 If you have any questions concerning the contents of this Technical Specification update, contact Kristi Byers at (803)701-3758.
Cecil Fletcher Regulatory Affairs Manager www.duke-energy.com Catawba Nuclear *Station Technical Specifications List of Effective Pages Page Number ii iii iv 1.1-1 1.1-2 1.1-3 1.1-4 1.1-5 1.1-6 1.1.7 1.2-1 1.2-2 1.2-3 1.3-1 1.3-2 1.3-3 1.3-4 1.3-5 1.3-6 1.3-7 1.3-8 1.3-9 1.3-10 1.3-11 1.3-12 1.3-13 1.4-1 1.4-2 Amendment 1771169 219/214 215/209 173/1 65 173/1 65 268/264 268/264 268/264 268/264 268/264 179/171 173/1 65 173/165 173/165 173/1 65 173/165 173/165 173/1 65 173/1 65 173/1 65 173/1 65 173/1 65 173/165 173/165 173/1 65 173/1 65 173/1 65 173/165 173/1 65 Revision Date 4/08/99 3/01/05 6/2 1/04 9/30/98*9/30/98 6/25/12 6/25/12 6/25/12 6/25/12 6/25/12 8/13/99 9/30/98 9/30/98 9/3 0/9 8 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 Catawba Units 1 and 2Pge11/25 Page 1 11/12/15 0 1.4-3 1.4-4 2.0-1 3.0-1 3.0-2 3.0-3 3.0-4 3.0-5 3,0-6 3.1.1-1 3.1.2-1 3.1.2-2 3.1.3-1 3.1.3-2 3.1.3-3 3.1.4-1 3.i1.4-2 3.1.4-3 3.1.4-4 3.1.5-1 3.1.5-2 3.1,6-1 3.1.6-2 3.1.6-3 3.1.7-1 3.1.7-2 3.1.8-1 3.1.8-2 3.2.1-1 3.2.1-2 3.2.1-3 3.2,1-4 173/165 173/1 65 210/204 235/231 235/23 1 235/231 235/231 235/231 235/231 263/ 259 173/165 263/259 173/165 275/271 173/1 65 173/1 65 i173/i 65 26 3/25 9 263/259 173/165 26 3/259 173/1 65 173/1 65 263/259 173/1 65 173/1 65 173/1 65 263/259 173/1 65 173/1 65 263/259 263/259 9/30/98 9/30/98 12/19/03 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/29/11 9/30/98 3/29/I1 9/30/98 04/14/15 9/30/98 9/30/98 9/30/98 3/29/11 3/29/11 9/30/98 3/29/11 9/30/98 9(30/98 3/29/11 9/30/98 9/30/98 9/30/98 3/29/11 9/30/98 9/30/98 3/29/11 3/29/11 Catawba Units 1 and 2Pae21//5 Page 2 11/12/15 3.2.1-5 3.2.2-1 3.2.2-2 3.2.2-3 3.2.2-4 3.2.3-1 3.2.4-1 3.2.4-2 3.2.4-3 3.2.4-4 3.3.1-1 3.3.1-2 3.3.1-3 3.3.1-4 3.3.1-5 3.3.1-6 3.3.1-7 3.3.1=8 3.3.1-9 3.3. 1-10 3.3.1-11 3.3.1-12 3.3.1-13 3.3.1-14 3.3. 1-15 3.3.1-16 3.3. 1-17 3.3.1-18 3.3. 1-19 3.3. 1-20 3.3.1-21 3.3.1-22 3.3.2-1 263/259 173/165 173/165 263/259 263/259 26 3/25 9 173/165 173/1 65 173/1 65 263/259 173/1 65 247/240 247/240 207/201 247/240 247/240 247/240!173/1 65 263/259 263/259 263/259 263/259 263/259 263/259 263/259 26 3/259 26 3/2 59 263/259 26 3/25 9 26 3/2 59 263/259 263/259 173/165 3/29/11 9/30/98 9/30/98 3/29/11 3/29/11 3/29/11 9/30/98 9/30/98 9/30/98 3/29/11 9/30/98 12/30/08 12/30/08 7/29/03 12/30/08 12/30/08 12/30/08 9/30/98 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 9/30/98 Catawba Units 1 and 2Pae31125 Page 3 11/12/15 3.3.2-2 3.3.2-3 3.3.2-4 3.3.2-5 3.3.2-6 3.3.2-7 3.3.2-8 3.3.2-9 3.3.2-10 3.3.2-11 3.3.2-12 3.3.2-13 3.3.2-14 3.3.2-15 3.3.2-16 3.3.2-17 3.3.3-1 3.3.3-2 3.3.3-3 3.3.3-4 3.3.4-1 3.3.4-2 3.3.4-3 3.3.5-1 3.3.5-2 3.3.6-1 3.3.6-2 3.3.6-3 3.3.9-1 3.3.9-2 3.3.9-3 3.3.9-4 247/240 247/240 247/240 264/260 264/26 0 249/243 249/243 249/243 263/259 263/259 263/259 269/265*263/259 263/259 264/26 0 269/265 219/214 219/214 263/259 219/214 213/207 263/259 2 72/26 8 173/1 65 263/259 196/189 263/259 196/189 207/201 207/201 263/259 263/259 12/30/08 12/30/08 12/30/08 6/13/11 6/13/11 4/2/09 4/2/09 4/2/09 3/29/11 3/29/li 3/29/11 7/25/12 3/29/11 3/29/11 6/13/11 7/25/12 3/1/05 3/1/05 3/29/11 3/1/05 4/29/04 3/29/11 2/27/14 9/30/98 3/29/11 3/20/02 3/29/111 3/20/02 7/29/03 7/29/03 3/29/11 3/29/11 Catawba Units 1 and 2Pae41/25 Page 4 11/12/15 3.4.1-1 210/204 12/19/03 03.4.1i-2 210/204 12/19/03 3.4.1-3 263/259 3/29/11 3.4.1-4 210/204 12/19/03 3.4.1-5 (deleted) 184/176 3/01/00 3.4.1-6 (deleted) 184/1 76 3/01/00 3.4.2-1 173/165 9/30/98 3.4.3-1 173/165 9/30/98 3.4.3-2 263/259 3/29/11 3.4.3-3 212/206 3/4/04 3.4.3-4 212/206 3/4/04 3.4.3 -5 212/206 3/4/04 3.4.3-6 21 2/206 3/4/04 3.4.4-1 263/259 3/29/11 3.4.5-1 207/201 7/29/03 3.4.5-2 207/201 7/29/03 3453263/259 3/29/11, 3.4.6-1 212/206 3/4/04 3.4.6-2 263/259 3/29/11i 3.4.6-3 263/259 3/29/11 3.4.7-1 212/206 3/4/04 3.4.7-2 263/259 3/29/11-'3.4.7-3 263/259 3/29/11 3.4.8-1 207/201 7/29/03 3.4.8-2 263/259 3/29/11 3.4.9-1 173/165 9/30/98 3.4.9-2 263/259 3/29/11 3.4.10-1 212/206 3/4/04 3.4.10-2 173/165 9/30/98 3.4-11-1 213/207 4/29/04 3.4.11-2 173/1 65 9/30/98*3.4.11-3 263/259 3/29/11 Catawba Units 1 and 2Pae51/25 Page 5 11/12/15 3.4.11-4 263/259 3/29/11 3.4.12-1 212/206 3/4/04 3.4.12-2 213/207 4/29/04 3.4.12-3 212/206 3/4/04 3.4.12-4 212/206 3/4/04 3.4.12-5 263/259 3/29/11 3.4.12-6 263/259 3/29/11 3.4.12-7 263/259 3/29/11 3.4.12-8 263/259 3/29/11 3.4.13-1 267/263 3/12/12 3.4.13-2 267/263 3/12/12 3.4.14-1 173/165 9/30/98 3.4.14-2 173/165 9/30/98 3.4.14-3 263/259 3/29/11 3.4.14-4 263/259 3/29/11 3.4.15-1 234/230 9/30/06 3.4.1i5-2 234/230 9/30/06 3.4.15-3 234/230 9/30/06 3.4.15-4 263/259 3/29/11 3.4.16-1 268/264 6/25/12 3.4.16-2 268/264 6/25/12 3.4.16-3(deleted) 268/264 6/25/12 3.4.1 6-4(deleted) 268/264 6/25/12 3.4.17-1 263/259 3/29/11 3.4.18-1 218/212 1/13/05 3.4.18-2 218/212 1/13/05 3.5.1-1 21 1/205 12/23/03 3.5.1-2 263/259 3/29/11 3.5.1-3 263/259 3/29/11 3.5.2-1 253/248 10/30/09 3.5.2-2 263/259 3/29/11 3.5.2-3 263/259 3/29/11 Catawba Units 1 and 2Pae61/25 Page 6 11/12/15 3.5.3-1 3.5.3-2 3.5.4-1 3.5.4-2 3.5.5-1 3.5.5-2 3.6.1-1 3.6.1-2 3.6.2-1 3.6.2-2 3.6.2-3 3.6.2-4 3.6.2-5 3.6.3-1 3.6.3-2 3.6.3-3 3.6.3-4 3.6.3-5 3.6.3-6 3.6.3-7 3.6.4-1 3.6.5-1 3.6.5-2 3.6.6-1 3.6.6-2 3.6.8-1 3.6.8-2 3.6.9-1 3.6.10-2 3.6.10-1 3.6.11-1 213/207 173/165 173/165 26 9/265 173/1 65 263/259 173/165 192/1 84 173/1 65 173/165 173/1 65 173/1 65 26 3/2 59 173/165 173/1 65 173/1 65 i173/1 65 263/259 263/259 192/1 84 263/259 173/1 65 263/259 269/265 26 9/265 213/207 26 3/2 59 253/248 263/259 173/1 65 26 3/2 59 26 3/2 59 4/29/04 9/30/98 9/30/98 7/25/12 9/30/98 3/29/11 9/30/98 7/31/01 9/30/98 9/30/98 9/30/98 9/30/98 3/29/11 9/30/98 9/30/98 9/30/98 9/30/98 3/29/11 3/29/11 7/31/01 3/29/11 9/30/98 3/29/11 7/25/12 7/25/12 4/29/04 3/29/11 10/30/09 3/29/11 9/30/98 3/29/11 3/29/11 Catawba Units 1 and 2Pae71125 Page 7 11/12/15 3.6.11-2 3.6.12-1 3.6.12-2 3.6.12-3 3.6.13-1 3.6.13-2 3.6.13-3 3.6.14-1 3.6.14-2 3.6.14-3 3.6.15-1 3.6.15-2 3.6.16-1 3.6.16-2 3.6.17-1 3.7.1-1 3.7.1=2 3.7.1-3 3.7.2-1 3.7.2-2 3.7.3-1 3.7.3-2 3.7.4-1 3.7.4-2 3.7.5-1 3.7.5-2 3.7.5-3 3.7.5-4 3.7.6-1 3.7.6-2 3.7.7-1 3.7.7-2 263/259 263/259 263/259 263/259 256/251 263/259 263/259 173/165 263/259 270/266 173/1 65 263/259 263/259 263/259 253/248 173/1 65 173/165 173/1 65 173/1 65 244/238 173/1 65 244/238 213/207 263/259 253/248 173/1 65 263/259 263/259 173/1 65 263/259 25 3/248 263/259 3/29/11 3/29/11 3/29/11 3/29/11 6/28/10 3/29/11 3/29/11 9/30/98 3/29/11 8/6/13 9/30/98 3/29/11 3/29/11 3/29/11 10/30/09 9/30/98 9/30/98 9/30/98 9/30/98 9/08/08 9/30/98 9/08/08 4/29/04 3/29/11 10/30/09 9/30/98 3/29/11 3/29/11 9/3 0/9 8 3/29/11 10/30/09 3/29/11 Catawba Units 1 and 2Pae81/25 Page 8 11/12/15 3.7.8-1 3.7.8-2 3.7.8-3 3.7.8-4 3.7.9-1 3.7.9-2 3. 7.10-1 3.7.10-2 3.7.10-3 3.7.11-1 3.7.11-2 3.7.12-1 3.7.12-2 3.7.13-1 3.7.13-2 3.7.14-1 3,7.1!5-1 3.7.16-1 3.7.16-2 3.7.16-3 3.7.17-1 3.8.1-1 3.8.1-2 3.8.1-3 3.8.1-4 3.8.1-5 3.8.1-6 3.8.1-7 3.8.1-8 3.8.1-9 3.8.1-10 3.8.1-11 271/267 271/267 271/267 271/267 263/259 263/259 250/245 260/255 263/259 198/191 26 3/2 59 253/248 263/259 198/19 1 26 3/2 59 263/259 263/259Q 233/229 233/229 233/229 263/259 253/248 173/1 65 253/248 173/1 65 263/259 263/259 263/259 263/259 263/259 263/259 263/259 08/09/13 08/09/13 08/09/13 08/09/13 3/29/11 3/29/11 7/30/09 8/9/10 3/29/11 4/23/02 3/29/11 10/30/09 3/29/11 4/23/02 3/29/11 3/29/11 3/29/11 9/27/06 9/27/06 9/27/06 3/29/11 10/30/09 9/30/98 10/30/09 9/30/98 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 Catawba Units 1 and 2Pae91/25 Page 9 11/12/15 3.8.1-12 3.8.1-13 3.8.1-14 3.8.1-15 3.8.2-1 3.8.2-2 3.8.2-3 3.8.3-1 3.8.3-2 3.8.3-3 3.8.4-1 3.8.4-2 3.8.4-3 3.8.4-4 3.8.4-5 3.8.5-1 3.8.5-2 3.8.6-1 3.8.6-2 3.8.6-3 3.8.6-4 3.8.6-5 3.8.7-1 3.8.7-2 3.8.8-1 3.8.8-2 3.8.9-1 3.8.9-2 3.8.9-3 3.8.10-1 3.8.10-2 3.9.1-1 263/259 263/259 263/259 263/259 173/1 65 207/201 173/1 65 175/167 263/259 263/259 173/1 65 263/259 263/2 59 263/259 262/258 173/1 65 207/201 253/248 253/248 253/248 263/259 223/218 173/1 65 263/259 173/1 65 26 3/2 59 173/1 65 173/1 65 26 3/25 9 207/201 263/259 26 3/2 59 3/29/11 3/29/11 3/29/11 3/29/11 9/30/98 7/29/03 9/30/98 1/15/99 3/29/11 3/29/11 9/30/98 3/29/11 3/29/11 3/29/11 12/20/10 9/30/98 7/29/03 10/30/09 10/30/09 10/30/09 3/29/11 4/27/05 9/30/98 3/29/11 9/30/98 3/29/11 9/30/98 9/30/98 3/29/11 7/29/03 3/29/11 3/29/11 Catawba Units 1 and 2 Pg 01/21 Page 10 11/12/15 0 3.9.2-1 3.9.2-2 3.9.3-1 3.9.3-2 3.9.4-1 3.9.4-2 3.9.5-1 3.9.5-2 3.9.6-1 3.9.7-1 4.0-1 4.0-2 5.1-1 5.2-1 5.2-2 5.2-3 5.4-1 5.5-1 5.5-2 5.5-3 5.5-4 5.5-5 5.5-6 5.5-7 5.5-7a 5.5-8 5.5-9 5.5-10 5.5-11 5.5-12 5.5-13 215/209 26 3/25 9 227/222 26 3/25 9 207/201 263/259 207/201 263/259 263/259 263/259 220/215 233/229 273/269 273/269 273/269 Deleted 273 /2=69 173/1 65 273/269 205/1 98 173/1 65 173/1 65 216/210 252/247 218/212 26 7/26 3 267/263 218/212 227/222 22 7/222 218/212 218/21.2 6/21/04 3/29/11 9/30/05 3/29/11 7/29/03 3/29/11 7/29/03 3/29/11 3/29/11 3/29/111 3/03/05 9/27/06 2/12/15 2/12/15 2/12/15 9/21/09 ,-/i-/15 9/30/98 2/12/15 3/12/03 9/30/98 9/30/98 8/5/04 10/30/09 1/13/05 3/12/12 3/12/12 1 /13/05 9/30/05 9/30/05 1 /13/05 1/13/05 Catawba Units 1 and 2 Pg 11/21 Page 11 11/12/15 0 5.5-14 5.5-15 5.5-16 5.6-1 5.6-2 5.6-3 5.6-4 5.6-5 5.6-6 5.7-1 5.7-2 218/212 263/259 263/259 222/217 253/248 222/217 275/271 275/271 275/271 273/269 173/1 65 1/13/05 3/29/11 3/29/11 3/31/05 10/30/09 3/31/05 4/14/15 4/14/15 4/14/15 2/12/15 9"/30/98 Catawba Units 1 and 2 Pg 21/21 Page 12 11/12/15 ii iii Bii1i -B 2.1.1-2 B 2.1.1-3 B 2.1.21-B 2.1.2-2 B 2.1.2-3 B 3.01.-B 3.0-2 B 3.0-3 B 3.0-4 B 3.0-5 B 3.0-6 B 3.0-7 B 3.0-8 B 3.0-9 B 3.0-10 B 3.0-11 B 3.0-12 B 3.0-13 B 3.0-14 B 3.0-15 B 3.0-16 B 3.0-17 B 3.0-18 B 3.0-19 B 3.1.1-1 thru B 3.1.1-6 BASES Revision 1 Revision 2 Revision 1 Revision 0 Revision 1 Revision I Revision 0 Revision 0 Revision 0 Revision 1 Revision 1 Revision 2 Revision 3 Revision 3 Revision 2 Revision 2 Revision 3 Revision 2 Revision 3 Revision 3 Revision 3 Revision 3 Revision 3 Revision 1 Revision 1 Revision 0 Revision 0 Revision 0 Re~iision 3 4/08199 3/01/05 6/21/04 9/30/98 12/19/03 12/19/03 9/30/98 9/30/98 9/30/98 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/1 9/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 5/05/11 Catawba Units 1 and 2 Pg 31/21 Page 13 11/12/15 B 3.1.2-1 thru B 3.1.2-5 B 3.1.3-1 thru B 3.1.3-6 B 3,1.4-1 thru B 3.1.4-9 B 3.1.5-1 thru B 3.1.5-4 B 3.1.6-1 thru B 3.1.6-6 B 3.1.7-1 B 3.1.7-2 B 3.1.7-3 B 3.1.7-4 B 3.1.7-5 B 3.1.7-6 B 3.1.8-1 thru B 3.1.8-6 B 3.2.1-1 thru B 3.2.1 .-Il B 3.2.2-1 thru B 3.2.2-10 B 3.2.3-1 thru B 3.2.3-4 B 3.2.4-1 thru B 3.2.4-7 B 3.3.1-1 thru B.3.3. 1-55 B 3.3.2-1 thru B 3.3.2-49 B 3.3.3-1 thru B.3.3.3-1 6 B 3.3.4-1 thru B 3.3.4-5 Revision 2 Revision 2*Revision 1 Revision 2 Revision 1*Revision 0 Revision 2 Revision 2 Revision 2 Revision 2 Revision 2 Revision 2 Revision 4 Revision 3 Revision 2 Revision 2 Revision 7 Revision 11 Revision 6 Revision 2*5/05/11 4/14/15 5/05/11 5/05/11 5/05/11 9/30/98 1/08/04 1/08/04 1/08/04 1/08/04 1/08/04 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 11/15/11 8/9/15 4/11/14 5/05/11 Catawba Units 1 and 2 Pg 41/21 Page 14 11/12/15 0 B 3.3.5-1 thru B 3.3.5-6 B 3.3.6-1 thru B 3.3.6-5 B 3.3.9-1 thru B 3.3.9-5 B 3.4.1-1 thru B 3.4.1-5 B 3.4.2-1 B 3.4.2-2 B 3.4.2-3 B 3.4.3-1 thru B 3.4.3-6 B 3.4.4-1 thru B 3.4.4-3 B 3.4.5-1 thru B 3.4.5-6 B 3.4.6-1 thru B 3.4.6-5 B 3.4.7-1 thru B 3.4.7-5 B 3.4.8-1 thru B 3.4.8-3 B 3.4.9-1 thru B 3.4.9-5 B 3.4.10-1 B 3.4.10-2 B 3.4.10-3 B 3.4.10-4 B 3.4.11-1 thru B 3.4.11-7 B 3.4.12-1 thru B 3.4.12-14 B 3.4.13-1 thru B 3.4.13-7 B 3.4.14-1 thru B 3.4.14-6 B 3.4.15-1 thru B 3.4.15-10 Catawba Units 1 and 2 Revision 2 Revision 6 Revision 3 Revision 3 Revision 0 Revision 0 Revision 0 Revision 2 Revision 2 Revision 3 Revision 4 Revision 6 Revision 3 Revision 3 Revision 1 Revision 0 Revision 1 Revision 2 Revision 4 Revision 5 Revision 7 Revision 3 Revision 6 5/05/11 08/02/12 06/02/14 5/05/11 9/30/ 98 9/30/98 9/30/ 98 5/05/11 5/05/11 5/05/11 5/05/11 2/10/1 5 5/05/11 08/02/12 3/4/04 9/30/98 3/4/04 10/30/09 5/05/11 8/19/15 3/15/12 5/05/11 5/05/11 Page 15 Page 1511/12/15 B 3.4.16-1 thru B 3.4.16-5 B 3.4.17-1 thru B 3.4.17-3 B 3.4.18-1 B 3,4.18-2 B 3.4.18-3 B 3.4.18-4 B 3.4.18-5 B 3.4.18-6 B 3.4.18-7 B 3.4.18-8 B 3.5.1-1 thru B 3.5.1-8 B 3.5.2-1 thru B 3.5.2-10 B 3.5.3-1 B 3.5.3-2 B 3.5.3-3 B 3.5.4-1 thru B. 3.5 .4-5 B 3.5.5-1 thru B 3.5.5-4 B 3.6.1-1 B 3.6.1-2 B 3.6.1-3 B 3.6.1-4 B 3.6.1-5 B 3.6.2-1 thru B 3.6.2-8 B 3.6.3-1 thru B 3.6.3-14 B 3.6.4-1 thru B 3.6.4-4 B 3.6.5-1 thru B 3.6.5-4 Revision 4 Revision 2 Revision 0 Revision 0 Revision 1 Revision 0 Revision 0 Revision 0 Revision 0 Revision 1 Revision 3 Revision 3 Revision 0 Revision 1 Revision 1 Revision 5 Revision 1 Revision 1 Revision 1 Revision 1 Revision 1 Revision 1 Revision 2 Revision 4 Revision 2 Revision 3 10/23/12 5/05/11 1113/05 1/13/05 3/18/08 1/13/05 1/13/05 1/13/05 1/13/05 3/18/08 5/05/11 5/05/11 9/30/98 4/29/04 4/29/04 4/11/14 5/05/11 7/31/01 7/31/01 7/31/01 7/31/01 7/3 1/0 1 5/05/11 5/05/11 5/05/11 07/27/13 Catawba Units 1 and 2 Pg 61/21 Page 16 11/12/15 0 B 3.6.6-1 thru B 3.6.6-7 B 3.6.8-1 thru B 3.6.8-5 B 3.6.9-1 thru B 3.6.9-5 B 3.6.10-1 thru B 3.6.10-6 B 3.6.11-1 thru B 3.6.11-6 B 3.6.12-1 thru B 3.6.12-11 B 3.6.13-1 thru B 3.6.13-9 B 3.6.14-1 thru B 3.6.14-5 B 3.6.15-1 thru B 3.6.15-4 B 3.6.16-1 thru B 3.6.16-4 B 3.6.17-i B 3.6.17-2 B 3.6.17-3 B 3.6.17-4 B 3.6.17-5 B 3.7.1-1 B 3.7.1-2 B 3.7.1-3 B 3.7.1-4 B 3.7.1-5 B 3.7.2-1 B 3.7.2-2 B 3.7.2-3 B 3.7.2-4 B 3.7.2-5 B 3.7.3-1 B 3.7.3-2 Catawba Units 1 and 2 Revision 6 Revision 3 Revision 6 Revision 2 Revision 5 Revision 5 Revision 4 Revision 2 Revision 1 Revision 3 Revision i Revision 0 Revision 0 Revision 0 Revision 1 Revision 0 Revision 0 Revision 0 Revision 1 Revision 1 Revision 0 Revision 0 Revision 2 Revision 1 Revision 3 Revision 0 Revision 0 Page 17 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 4/11/14 5/05/11 5/05/11 3/13/08 9/30/98 9/30/98 9/30/98 3/13/08 9/30/98 9/30/98 9/30/98 10/30/09 10/30/09 9/30/98 9/30/98 6/23/10 9/08/08 10/30/09 9/30/98 9/30/98 11/12/15 B 3.7.3-3 B 3,7.3-4, B 3.7.3-5 B 3.7.3-6 B 3.7.4-1 thru B 3.7.4-4 B 3.7.5-1 thru B 3.7.5-9 B 3.7.6-1 thru B 3.7.6-3 B 3.7.7-1 thru B 3.7.7-5 B 3.7,8-1 thru B 3.7.8-8 B 3.7.9-1 thru3.7.9-4 B 3.7.10-1 thru B 3.7.10-9 B 3.7.11-1 thru B 3.7,1!-4 B 3.7.12-1 thru B 3.7.12-7 B 3.7.13-1 thru B 3.7.13-5 B 3.7.14-1 thru B 3.7.14-3 B 3.7.15-1 thru B 3.7.15-4 B 3.7.16-1 B 3.7.16-2 B 3.7.16-3 B 3.7.16-4 B 3.7.17-1 thru B3 3.7.17-3 B 3.8.1-1 thru B.3.8. 1-29 B 3.8.2-1 B 3.8.2-2 Revision 0 Revision 0 Revision 1 Revision 2 Revision 2 Revision 3 Revision 4 Revision 2 Revision 5 Revision 3 Revision 10 Revision 3 Revision 6 Revision 4 Revision 2 Revision 2 Revision 2 Revision 2 Revision 2 Revision 0 Revision 2 Revision 5 Revision 0 Revision 0 9/ 30/98 9/30/98 9/08/08 10/30/09 5/05/11 5/05/11 08/02/12 5/05/11 08/09/13 5/05/11 10/24/11 10/24/11 1/09/13 5/05/11 5/05/11 5/05/11 9/27/06 9/27/06 9/27/06 9/27/06 5/05/11 07/27/13 9/30/98 9/30/98 Catawba Units 1 and 2 Pg 81/21 Page 18 11/12/15 B 3.8.2-3 B 3.8.2-4 B 3.8.2-5 B 3.8.2-6 B 3.8.3-1 thru B 3.8.3-8 B 3.8.4-1 thru B3.8.4. 10 B 3.8.5-1 B 3.8.5-2 B 3.8.5-3 B 3.8.6-1 thru B 3.8.6-7 B 3.8.7-1 thru B 3.8.7-4 B 3.8.8-1 thru B 3.8.8-4 B 3.8.9-1 thru B 3.8.9-10 B 3.8.10-1 thru B 3.8.10-4 B 3.9.1-1 thru B 3.9.1-4 B 3.9.2-1 thru B 3.9.2.4 B 3.9.3-1 thru B 3.9.3-5 B 3.9.4-1 thru B 3.9.4-4 B 3.9.5-1 thru B 3.9.5-4 B 3.9.6-1 thru B 3.9.6-3 B 3.9.7-1 thru B 3.9.7-3 Revision 0 Revision 1 Revision 2 Revision 1 Revision 4 Revision 10 Revision 0 Revision 2 Revision 1 Revision 4 Revision 3 Revision 3 Revision 2 Revision 3 Revision 3 Revision 4 Revision 4 Revision 4 Revision 3 Revision 2 Revision 1 9/30/98 5/10/05 5/10/05 5/10/05 5/05/11 5/05/11 9/30/98 7/29/03 7/29/03 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 Catawba Units 1 and 2Pae1 Page 19 11/12/15 ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND The ESFAS initiates necessary safety systems, based on the values of selected unit parameters, to protect against violating core design limits and the Reactor Coolant System (RCS) pressure boundary, and to mitigate accidents.
The ESFAS instrumentation is segmented into three distinct but interconnected modules as identified below:* Field transmitters or process sensors and instrumentation:
provide a measurable electronic signal based on the physical characteristics of the parameter being measured;* Signal processing equipment including analog protection system, field contacts, and protection channel sets: provide signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board/control room/miscellaneous indications; and* Solid State Protection System (SSPS) including input, logic, and output bays: initiates the proper unit shutdown or engineered safety feature (ESF) actuation in accordance with the defined logic and based on the bistable outputs from the signal process control and protection system.Field Transmitters or Sensors To meet the design demands for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters.
In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS).In some cases, the same channels also provide control system inputs.To account for calibration tolerances and instrument drift, which is assumed to occur between calibrations, statistical allowances are Catawba Units 1 and 2B332-ReionN.1 B 3.3.2-1 ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued) provided in the NOMINAL TRIP SETPOINT.
The OPERABILITY of each transmitter or sensor can be evaluated when its "as found" calibration data are compared against its documented acceptance criteria.Siginal Processinqi Eqiuipment Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments.
The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses.
These setpoints are defined in UFSAR, Chapter 6 (Ref. 1), Chapter 7 (Ref. 2), and Chapter 15 (Ref. 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the SSPS for decision logic processing.
Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing.
Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy.
If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic.Generally, if a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy.
The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
Again, a single failure will neither cause nor prevent the protection function actuation.
These requirements are described in IEEE-279-1 971 (Ref. 4). The actual number of channels required for each unit parameter is specified in the UFSAR.Catawba Units 1 and 2B3322ReionN.1 B 3.3.2-2 ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
Trip Setpoints and Allowable Values The NOMINAL TRIP SETPOINTS are the nominal values at which the bistables are set. Any bistable is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CALIBRATION tolerance.
The NOMINAL TRIP SETPOINTS used in the bistables are based on the analytical limits (Ref. 1, 2, and 3). The selection of these NOMINAL TRIP SETPOINTS is such that adequate protection is provided when all sensor and processing time delays, calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 5) are taken into account. The actual as-left setpoint of the bistable assures that the actual trip occurs before the Allowable Value is reached. The Allowable Value accounts for changes in random measurement errors detectable by a COT. One example of such a change in measurement error is drift during the surveillance interval.
If the point at which the loop trips does not exceed the Allowable Value, the loop is considered OPERABLE.A trip within the Allowable Value ensures that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.Each channel can be tested on line to verify that the signal processing equipment and setpoint accuracy is within the specified allowance requirements.
Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated.
SRs for the channels are specified in the SR section.The determination of the NOMINAL TRIP SETPOINTS and Allowable Values listed in Table 3.3.2-1 incorporates all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each NOMINAL TRIP SETPOINT.
All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these-uncertainty magnitudes.
Catawba Units 1 and 2B3323ReionN.1 B3.3.2-3 ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
Solid State Protection System The SSPS equipment is used for the decision logic processing of outputs from the signal processing equipment bistables.
To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided.
If one train is taken out of service for maintenance or test purposes, the second train will provide ESE actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result.Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements.
The SSPS performs the decision logic for most ESF= equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit.The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various transients.
If a required logic matrix combination is completed, the system will send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition.
Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.Each SSPS train has a built in testing device that can test the decision logic matrix functions and the actuation devices while the unit is at power.When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.
The testing device is semiautomatic to minimize testing time.The actuation of ESE components is accomplished through master and slave relays. The SSPS energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices. The master and slave relays are routinely tested to ensure operation.
The test of the master relays energizes the relay, which then operates the contacts and applies a low voltage to the associated slave relays. The low voltage is not sufficient to actuate the slave relays but only demonstrates signal Catawba Units 1 and 2B332-ReionN.1 B3.3.2-4 ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued) path continuity.
The SLAVE RELAY TEST actuates the devices if their operation will not interfere with continued unit operation.
For the latter case, actual component operation is prevented by the SLAVE RELAY TEST circuit, and slave relay contact operation is verified by a continuity check of the circuit containing the slave relay.APPLICABLE Each of the analyzed accidents can be detected by one or SAFETY ANALYSES, more ESFAS Functions.
One of the ESFAS Functions is the LCO, AND primary actuation signal for that accident.
An ESFAS Function APPLICABILITY may be the primary actuation signal for more than one type of accident.An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents.
For example, Pressurizer Pressure--Low is a primary actuation signal for small loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) outside containment.
Functions such as manual initiation, not specifically credited in the accident safety analysis, are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance.
These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).The LCO requires all instrumentation performing an ESFAS Function to be OPERABLE.
Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
The LCO generally requires OPERABILITY of three or four channels in each instrumentation function and two channels in each logic and manual initiation function.
The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing an ESFAS initiation.
Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents.
ESFAS protection functions are as follows: Catawba Units 1 and 2B3325ReionN.1 B 3.3.2-5 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
- 1. .Safety Injection Safety Injection (SI) provides two primary functions:
- 1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 2200°F); and 2. Boration to ensure recovery and maintenance of SDM (kerr < 1.0).These functions are necessary to mitigate the effects of high energy line breaks (HELBs) both inside and outside of containment.
The SI signal is also used to initiate other Functions such as:* Phase A Isolation;
- Containment Purge and Exhaust Isolation;
- Reactor Trip;* Turbine Trip;* Feedwater Isolation;
- Start of motor driven auxiliary feedwater (AFW)pumps;* Start of control room area ventilation filtration trains;* Enabling automatic switchover of Emergency Core Cooling Systems (ECCS) suction to containment sump;* Start of annulus ventilation system filtration trains;* Start of auxiliary building filtered ventilation exhaust system trains;* Start of diesel generators Catawba Units 1 and 2B332-ReionN.1 B 3.3.2-6 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
- Start of nuclear service water system pumps; and* Start of component cooling water system pumps.These other functions ensure:* Isolation of nonessential systems through containment penetrations;
- Trip of the turbine and reactor to limit power generation;
- Isolation of main feedwater (MEW) to limit secondary side mass losses;* Start of AFW to ensure secondary side cooling capability;
- Filtration of the control room to ensure habitability;
- Enabling ECCS suction from the refueling water storage tank (RWST) switchover on low RWST level to ensure continued cooling via use of the containment sump;* Starting of annulus ventilation and auxiliary building filtered ventilation to limit offsite releases;* Starting of diesel generators for loss of offsite power considerations; and* Starting of component cooling water and nuclear service water systems for heat removal.a. Safety Iniection-Manual Initiation The LCO requires two channels to be OPERABLE.
The operator can initiate SI at any time by using either of two switches in the control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.
Catawba Units 1 and 2B332-ReionN.1 B3.3.2-7 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Each train consists of one push button and the interconnecting wiring to the actuation logic cabinet. This configuration does not allow testing at power.b. Safety Iniection-Automatic Actuation Loqic and Actuation Relays This LCO requires two trains to be OPERABLE.
Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.
Manual and automatic initiation of SI must be OPERABLE in MODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.
These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and resPond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.
Unit pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.c. Safety Iniection-Containment Pressure-Hi~qh This signal provides protection against the following accidents:
- SLB inside containment;
- LOCA; and*Feed line break inside containment.
Catawba Units 1 and 2B332-ReionN.1 B3.3.2-8 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Containment Pressure-High provides no input to any control functions.
Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic: Containment Pressure-High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment.
- d. Safety Iniection-Pressurizer Pressure-Low This signal provides protection against the following accidents:
- Inadvertent opening of a steam generator (SG) relief or safety valve;* SLB;* A spectrum of rod cluster control assembly ejection accidents (rod ejection);
- Inadvertent opening of a pressurizer relief or safety valve;* LOCAs; and* SG Tube Rupture.Pressurizer pressure provides both control and protection functions:
input to the Pressurizer Pressure Control System, reactor trip, and SI. Therefore, the actuation logic must be able to withstand both an input failure to control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.Catawba Units 1 and 2B332-ReionN.1 B3.3.2-9 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
This Function must be OPERABLE in MODES 1, 2, and 3 (above P-I11) to mitigate the consequences of an HELB inside containment.
This signal may be manually blocked by the operator below the P-1 1 setpoint.
Automatic SI actuation below this pressure setpoint is then performed by the Containment Pressure-High signal.This Function is not required to be OPERABLE in MODE 3 below the P-Il setpoint.
Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.
- 2. Deleted.3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment.
This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.There are two separate Containment Isolation signals, Phase A and Phase B. Phase A isolation isolates all automatically isolable process lines, except component cooling water (CCW) and nuclear service water system (NSWS), at a relatively low containment pressure indicative of primary or secondary system leaks. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required)method of decay heat removal. Since CCW and NSWS are required to support ROP operation, not isolating CCW and NSWS on the low pressure Phase A signal enhances unit safety by allowing operators to use forced RCS circulation to cool the unit.Isolating CCW and NSWS on the low pressure signal may force the use of feed and bleed cooling, which could prove more difficult to control.Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-10 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LOCO, and APPLICABILITY (continued)
Phase A containment isolation is actuated automatically by SI, or manually via the actuation circuitry.
All process lines penetrating containment, with the exception of CCW and NSWS, are isolated.CCW is not isolated at this time to permit continued operation of the RCPs with cooling water flow to the thermal barrier heat exchangers and air or oil coolers. All process lines not equipped with remote operated isolation valves are manually closed, or otherwise isolated, prior to reaching MODE 4.Manual Phase A Containment Isolation is accomplished by either of two switches in the control room. Either switch actuates its associated train.The Phase B signal isolates CCW and NSWS. This occurs at a relatively high containment pressure that is indicative of a large break LOCA or an SLB. For these events, forced circulation using the RCPs is no longer desirable.
Isolating the CCW and NSWS at the higher pressure does not pose a challenge to the containment boundary because the CCW System and NSWS are closed loops inside containment.
Although some system components do not meet all of the ASME Code requirements applied to the containment itself, the systems are continuously pressurized to a pressure greater than the Phase B setpoint.
Thus, routine operation demonstrates the integrity of the system pressure boundary for pressures exceeding the Phase B setpoint.Furthermore, because system pressure exceeds the Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment.
Therefore, the combination of CCW System and NSWS design and Phase B isolation ensures there is not a potential path for radioactive release from containment.
Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-11 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Phase B containment isolation is actuated by Containment Pressure-High High, or manually, via the automatic actuation logic, as previously discussed.
For containment pressure to reach a value high enough to actuate Containment Pressure-High High, a large break LOCA or SLB must have occurred.
RCP operation will no longer be required and CCW to the RCPs and NSWS to the RCP motor coolers are, therefore, no longer necessary.
The RCPs can be operated with seal injection flow alone and without CCW flow to the thermal barrier heat exchanger.
Manual Phase B Containment Isolation is accomplished by pushbuttons on the main control board. In addition to manually initiating a Phase B Containment Isolation, the pushbuttons also isolate the containment ventilation system.a. Containment Isolation-Phase A Isolation (1) Phase A Isolation-Manual Initiation Manual Phase A Containment Isolation is actuated by either of two switches in the control room. Each switch actuates its respective train.(2) Phase A Isolation-Automatic Actuation Lo~qic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.Manual and automatic initiation of Phase A Containment Isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a Phase A Containment Isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-12 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) system level manual initiation.
In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase A Containment Isolation.
There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.
(3) Phase A Isolation-Safety Iniection Phase A Containment Isolation is also initiated by all Functions that initiate SI. The Phase A Containment Isolation requirements for these Functions are the same as the requirements for their SI function.Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.
- b. Containment Isolation-Phase B Isolation Phase B Containment Isolation is accomplished by manual Initiation, Automatic Actuation Logic and Actuation Relays, and by Containment Pressure channels.
The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips that may damage the RCPs.(1) Phase B Isolation-Manual Initiation (2) Phase B Isolation-Automatic Actuation Loqjic and Actuation Relays Manual and automatic initiation of Phase B containment isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated on a Phase B Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-13 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) containment isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.
In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase B containment isolation.
There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.
(3) Phase B Isolation-Containment Pressure -High-High Containment Pressure -High-High uses four channels in a two-out-of-four logic configuration.
Since containment pressure is not used for control, this arrangement exceeds the minimum redundancy requirements.
Additional redundancy is warranted because this Function is energize to trip.Containment Pressure -High-High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break.In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to pressurize the containment and reach the Containment Pressure -High-High setpoints.
- 4. Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment.
Rapid isolation of the steam lines will limit the steam break accident to the blowdown from one SG, at most. For an SLB upstream of the main steam isolation valves (MSIVs), inside or outside of containment, closure of the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSIVs terminates the accident as soon as the steam lines depressurize.
Steam Line Isolation also mitigates the effects of a feed line break and ensures a source of steam for the turbine driven AFW pump during a feed line break.Catawba Units 1 and 2.B3321ReionN.1 B 3.3.2-14 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
- a. Steam Line Isolation-Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two system level switches in the control room and either switch can initiate action to immediately close all MSIVs. The LCO requires two channels to be OPERABLE.
Individual valves may also be closed using individual hand switches in the control room. The LCO requires four individual channels to be OPERABLE.b. Steam Line Isolation-Automatic Actuation Loqic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB or other accident.
This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed and de-activated.
In MODES 4, 5, and 6, there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.c. Steam Line Isolation-Containment Pressure-Higqh High This Function actuates closure of the MSIVs in the event of a LOCA or an SLB inside containment to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment.
Containment Pressure-High High uses four channels in a two-out-of-four logic configuration.
Since containment pressure is not used for control, this arrangement exceeds the minimum redundancy requirements.
Additional redundancy is warranted because this Function is energize to trip.Containment Pressure-High High must be OPERABLE in MODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection Catawba Units 1 and 2 B3321 eiinN.1 B3.3.2-15 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) and closure of the MSIVs. The Steam Line Isolation Function remains OPERABLE in MODES 2 and 3 unless all MSIVs are closed and de-activated.
In MODES 4, 5, and 6, there is not enough energy. in the primary and secondary sides to pressurize the containment to the Containment Pressure-High High setpoint.d. Steam Line Isolation-Steam Line Pressure Steam Line Pressure channels provide both protection and control functions.
The protection functions include: Steam Line Pressure-Low and Steam Line Pressure-Negative Rate functions.
The control functions include: Digital Feedwater Control System (DECS) which controls SG level.(1) Steam Line Pressure-Low Steam Line Pressure-Low provides closure of the MSIVs in the event of an SLB to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment.
This Function provides closure of the MSIVs in the event of a feed line break to ensure a supply of steam for the turbine driven AFW pump.DFCS receives steam pressure inputs from three separate protection channels for each SG. The three inputs are median selected for each SG, with the resultant output being used by the automatic control algorithm.
The median select feature prevents the failure of an input signal from affecting the control system. A loss of two or more input signals will place the control system in manual and alert the operator.DFCS will maintain a steady control function during the switch to manual operation; therefore, a failure of one or more input signals will not cause a control system action that would result in a condition requiring protective actions. Thus, three OPERABLE channels on each steam line, with a two-out-of-three logic on each steam line, are sufficient to satisfy protective requirements.
Steam Line Pressure-Low Function must be OPERABLE in MODES 1, 2, and 3 (above P-i11), with any main steam valve open, when a secondary side Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-16 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) break or stuck open valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the P-i11 setpoint.
Below P-i11, an inside containment SLB will be terminated by automatic actuation via Containment Pressure-High High. Stuck valve transients and outside containment SLBs will be terminated by the Steam Line Pressure-Negative Rate-High signal for Steam Line Isolation below P-i11 when SI has been manually blocked. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSlVs are closed and de-activated.
This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.(2) Steam Line Pressure-Neciative Rate-Hicjh Steam Line Pressure-Negative Rate-High provides closure of the MSlVs for an SLB when less than the P-i11 setpoint, to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.
When the operator manually blocks the Steam Line Pressure-Low main steam isolation signal when less than the P-1 1 setpoint, the Steam Line Pressure-Negative Rate-High signal is automatically enabled. DFCS receives steam pressure inputs from three separate protection channels for each SG. The three inputs are median selected for each SG, with the resultant output being used by the automatic control algorithm.
The median select feature prevents the failure of an input signal from affecting the control system. A loss of two or more input signals will place the control system in manual and alert the operator.
DFCS will maintain a steady control function during the switch to manual operation; therefore, a failure of one or more input signals will not cause a control system action that would result in a condition requiring protective actions. Thus, three OPERABLE channels on each steam line, with a two-out-of-three logic on each steam line, are sufficient to satisfy protective requirements.
Catawba Units 1 and 2 B3321 eiinN.i B 3.3.2-17 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Steam Line Pressure-Negative Rate-High must be OPERABLE in MODE 3 when less than the P-i11 setpoint, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). In MODES 1 and 2, and in MODE 3, when above the P-11I setpoint, this signal is automatically disabled and the Steam Line Pressure-Low signal is automatically enabled. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MSIVs are closed and de-activated.
In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to have an SLB or other accident that would result in a release of significant enough quantities of energy to cause a cooldown of the RCS.5. Turbine Trip and Feedwater Isolation The primary functions of the Turbine Trip and Feedwater Isolation signals are to prevent damage to the turbine due to water in the steam lines, stop the excessive flow of feedwater into the SGs, and to limit the energy released into containment.
These Functions are necessary to mitigate the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows. Feedwater Isolation serves to limit the energy released into containment upon a feedwater line or steam line break inside containment.
The Functions are actuated when the level in any SG exceeds the high high setpoint, and performs the following functions:
- Trips the main turbine;* Trips the MFW pumps;* Initiates feedwater isolation; and* Shuts the MFW regulating valves and the bypass feedwater regulating valves.Turbine Trip and Feedwater Isolation signals are both actuated by SG Water Level-High High, or by an SI signal. The RTS also initiates a turbine trip signal whenever a reactor trip (P-4) is generated.
A Feedwater Isolation signal is also generated by a Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-18 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) reactor trip (P-4) coincident with Ta,,gLow and on a high water level in the reactor building doghouse.
The MEW System is also taken out of operation and the AFW System is automatically started. The SI signal was discussed previously.
- a. Turbine Trip (1) Turbine Tripj-Automatic Actuation Loqic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.(2) Turbine Tripj-Steam Generator Water Level-Higqh Higqh (P-14)This signal prevents damage to the turbine due to water in the steam lines. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation.
Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.The setpoints are based on percent of narrow range instrument span.(3) Turbine Trip-Safety Iniection Turbine Trip is also initiated by all Functions that initiate SI. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 1, SI, is referenced for all initiating functions and requirements.
Item 5.a.(1) is referenced for the applicable MODES.The Turbine Trip Function must be OPERABLE in MODES 1 and 2. In lower MODES, the turbine generator is not in service and this Function is not required to be OPERABLE.b. Feedwater Isolation Catawba Units 1 and 2 B3321 eiinN.1 B3.3.2-19 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
(1) Feedwater Isolation-Automatic Actuation Loqic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.(2) Feedwater Isolation-Steam Generator Water Level-Hi~qh Hicqh (P-14)This signal provides protection against excessive feedwater flow. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation.
Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.The setpoints are based on percent of narrow range instrument span.(3) Feedwater Isolation-Safety Iniection Feedwater Isolation is also initiated by all Functions that initiate SI. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI function.
Therefore, the requirements are not repeated in Table 3.3.2-1.Instead Function 1, SI, is referenced for all initiating functions and requirements.
Item 5.b.(1) is referenced for the applicable MODES.(4) Feedwater Isolation
-RCS Low coincident with Reactor Trip (P-4)This signal provides protection against excessive cooldown, which could subsequently introduce a positive reactivity excursion after a plant trip. There are four channels of RCS Tavg -Low (one per loop), with a two-out-of-four logic required coincident with a reactor trip signal (P-4) to initiate a feedwater isolation.
The P-4 interlock is discussed in Function 8.a.Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-20 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
(5) Feedwater Isolation
-Doqhouse Water Level -Hiqh This signal initiates a Feedwater Isolation.
The signal terminates forward feedwater flow in the event of a postulated pipe break in the main feedwater piping in the doghouses to prevent flooding safety related equipment essential to the safe shutdown of the plant. Each doghouse contains two trains of level instrumentation.
The level instrumentation consists of six level switches (three per train) in each of the two reactor building doghouses.
A high-high level detected by two-out-of-three switches, in either the inboard or outboard doghouse, will initiate a doghouse isolation.
This signal initiates Feedwater Isolation for the specific doghouse where the High-High level is detected and trips both main feedwater pumps thus causing a main turbine trip.The Feedwater Isolation Function must be OPERABLE in MODES 1 and 2 and also in MODE 3 (except for the functions listed in Table 3.3.2-1).
Feedwater Isolation is not required OPERABLE when all MFIVs, MFCVs, and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In lower MODES, the MFW System is not in service and this Function is not required to be OPERABLE.6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available.
The system has two motor driven pumps and a turbine driven pump, making it available during normal and accident operation.
The normal source of water for the AFW System is the condensate storage system (not safety related).
A low suction pressure to the AFW pumps will automatically realign the pump suctions to the Nuclear Service Water System (NSWS)(safety related).
The AFW System is aligned so that upon a pump start, flow is initiated to the respective SGs immediately.
- a. Auxiliary Feedwater-Automatic Actuation Loq ic and Actuation Relays Automatic actuation logic and actuation relays consist of the Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-21 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCD, and APPLICABILITY (continued) same features and operate in the same manner as described for ESFAS Function 1 .b.b. Auxiliary Feedwater-Steam Generator Water Level-Low Low SG Water Level-Low Low provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. SG Water Level-Low Low provides input to the SG Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system which may then require a protection function actuation and a single failure in the other channels providing the protection function actuation.
Thus, four OPERABLE channels are required to satisfy the requirements with two-out-of-four logic. The setpoints are based on percent of narrow range instrument span.SG Water Level--Low Low in any operating SG will cause the motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level--Low Low in any two operating SGs will cause the turbine driven pumps to start.c. Auxiliary Feedwater--Safety Iniection An SI signal starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function.
Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.
- d. Auxiliary Feedwater-Loss of Offsite Power A loss of offsite power to the service buses will be accompanied by a loss of reactor coolant pumping power and the subsequent need for some method of decay heat removal. The loss of offsite power is detected by a voltage drop on each essential service bus. Loss of power to either essential service bus will start the turbine driven and motor driven AFW pumps to ensure that at least two SGs contain enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip.Catawba Units 1 and 2B332-2RvsoNo1 B 3.3.2-22 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Functions 6.a through 6.d must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor.These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.
- e. Auxiliary Feedwater-Trip of All Main Feedwater Pumps A Trip of all MFW pumps is an indication of a loss of MEW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure.
Each turbine driven MFW pump is equipped with three pressure switches on the trip oil system. A low pressure signal from two-out-of-three of these pressure switches indicates a trip of that pump. Three OPERABLE channels per pump satisfy redundancy requirements with two-out-of-three logic. A trip of all MEW pumps starts the motor driven AFW pumps to ensure that at least two SGs are available with water to act as the heat sink for the reactor. This function must be OPERABLE in MODES 1 and 2. This ensures that at least two SGs are provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident.
In MODES 3, 4, and 5, the MEW pumps may be normally shut down, and thus neither pump trip is indicative of a condition requiring automatic AFW initiation.
- f. Auxiliary Feedwater-Pump Suction Transfer on Suction Pressure-Low A low pressure signal in the AFW pump suction line protects the AFW pumps against a loss of the normal supply of water for the pumps, the condensate storage system. Three pressure switches per train are located on the AFW pump suction line from the condensate storage system. A low pressure signal sensed by two-out-of-three switches will align their train related motor driven AFW pump and the turbine driven AFW pump to the assured water supply (NSWS). The NSWS (safety grade) is then lined up to supply the AFW pumps to ensure an adequate supply of water for the AFW Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-23 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
System to maintain at least two of the SGs as the heat sink for reactor decay heat and sensible heat removal.This Function must be OPERABLE in MODES 1, 2, and 3 to ensure a safety grade supply of water for the AFW System to maintain the SGs as the heat sink for the reactor. This Function does not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW automatic suction transfer does not need to be OPERABLE because RHR will already be in operation, or sufficient time is available to place RHR in operation, to remove decay heat.7. Automatic Switchover to Containment Sump At the end of the injection phase of a LOCA, the RWST will be nearly empty. Continued cooling must be provided by the ECOS to remove decay heat. The source of water for the ECCS pumps is automatically switched to the containment recirculation sump. The low head residual heat removal (RHR) pumps and containment spray pumps draw the water from the containment recirculation sump, the RHR pumps pump the water through the RHR heat exchanger, inject the water back into the RCS, and supply the cooled water to the other ECCS pumps. Switchover from the RWST to the-containment sump must occur before the RWST empties to prevent damage to the RHR pumps and a loss of core cooling capability.
- a. Automatic Switchover to Containment Sump-Automatic Actuation Locqic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.b. Automatic Switchover to Containment Sump-Refuelinq Water Stora~qe Tank (RWST)Level-Low Coincident With Safety Iniection During the injection phase of a LOCA, the RWST is the source of water for all ECCS pumps. A low level in the RWST coincident with an SI signal provides protection against a loss of water for the ECCS pumps and indicates the end of the injection phase of the LOCA. The RWST is equipped with four level transmitters.
These transmitters Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-24 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) provide no control functions.
Since an inadvertent switchover to the containment sump could have a significant safety impact, this instrumentation is placed in a bypass condition for testing. Therefore, four channels are supplied such that, during testing, the remaining three channels could perform the intended function, and no single failure could result in either a failure to accomplish the intended function, or in an inadvertent switchover to the containment sump.Automatic switchover occurs only if the RWST low level signal is coincident with SI. This prevents accidental switchover during normal operation.
Accidental switchover could damage ECCS pumps if they are attempting to take suction from an empty sump. The automatic switchover Function requirements for the SI Functions are the same as the requirements for their SI function.
Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.
These Functions must be OPERABLE in MODES 1, 2, 3, and 4 when there is a potential for a LOCA to occur, to ensure a continued supply of water for the ECOS pumps.These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.
System pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.8. Engqineered Safety Feature Actuation System Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlock Functions back up manual actions to ensure bypassable functions are in operation under the conditions assumed in the safety analyses.Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-25 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
- a. Engineered Safety Feature Actuation System Interlocks--Reactor Trip. P-4 The P-4 interlock is enabled when a reactor trip breaker (RTB) and its associated bypass breaker is open. Operators are able to reset SI 60 seconds after initiation.
If a P-4 is present when SI is reset, subsequent automatic SI initiations will be blocked until the RTBs have been manually closed.This Function allows operators to take manual control of SI systems after the initial phase of injection is complete while avoiding multiple SI initiations.
The functions of the P-4 interlock are:* Trip the main turbine;* Isolate MFW with coincident low Tavg;* Prevent reactuation of SI after a manual reset of SI;* Transfer the steam dump from the load rejection controller to the unit trip controller; and* Prevent opening of the MFW isolation valves if they were closed on SI or SG Water Level--High High.Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS following a reactor trip. An excessive cooldown of the RCS following a reactor trip could cause an insertion of positive reactivity with a subsequent increase in generated power. To avoid such a situation, the noted Functions have been interlocked with P-4 as part of the design of the unit control and protection system.None of the noted Functions serves a mitigation function in the unit licensing basis safety analyses.
Only the turbine trip Function is explicitly assumed since it is an immediate consequence of the reactor trip Function.
Neither turbine trip, nor any of the other four Functions associated with the reactor trip signal, is required to show that the unit licensing basis safety analysis acceptance criteria are not exceeded.The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts.
Therefore, this Function has no adjustable Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-26 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) trip setpoint with which to associate a Trip Setpoint and Allowable Value.This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may be critical or approaching criticality.
This Function does not have to be OPERABLE in MODE 4, 5, or 6 because the main turbine, the MFW System, and the Steam Dump System are not in operation.
- b. Engqineered Safety Feature Actuation System Interlocks-Pressurizer Pressure.
P-11I The P-i1I interlock permits a normal unit cooldown and depressurization without actuation of SI or main steam line isolation.
With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-i11 setpoint, the operator can manually block the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal (previously discussed).
When the Steam Line Pressure-Low steam line isolation signal is manually blocked, a main steam isolation signal on Steam Line Pressure-Negative Rate-High is enabled. This provides protection for an SLB by closure of the MSIVs. With two-out-of-three pressurizer pressure channels above the P-i11 setpoint, the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal are automatically enabled. The operator can also enable these trips by use of the respective manual reset buttons. When the Steam Line Pressure-Low steam line isolation signal is enabled, the main steam isolation on Steam Line Pressure-Negative Rate--High is disabled.This Function must be OPERABLE in MODES 1, 2, and 3 to allow an orderly cooldown and depressurization of the unit without the actuation of SI or main steam isolation.
This Function does not have to be OPERABLE in MODE 4, 5, or 6 because system pressure must already be below the P-i1!setpoint for the requirements of the heatup and cooldown curves to be met.c. Engqineered Safety Feature Actuation System lnterlocks-T~v-Low Low. P-i12 On increasing reactor coolant temperature, the P-12 interlock provides an arming signal to the Steam Dump System. On a Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-27 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) decreasing temperature, the P-i12 interlock removes the arming signal to the Steam Dump System to prevent an excessive cooidown of the RCS due to a malfunctioning Steam Dump System.Since Tavg is used as an indication of bulk RCS temperature, this Function meets redundancy requirements with one OPERABLE channel in each loop. These channels are used in two-out-of-four logic. This Function must be OPERABLE in MODES 1, 2, and 3 when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This Function does not have to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to have an accident.9. Containment Pressure Control System Permissives The Containment Pressure Control System (CPCS) protects the Containment Building from excessive depressurization by preventing inadvertent actuation or continuous operation of the Containment Spray and Containment Air Return Systems when containment pressure is at or less than the CPCS permissive setpoint.
The control scheme of CPCS is comprised of eight independent control circuits (4 per train), each having a separate and independent pressure transmitter and current alarm module.Each pressure transmitter monitors the containment pressure and provides input to its respective current alarm. The current alarms are set to inhibit or terminate containment spray and containment air return systems when containment pressure falls to or below 0.25 psid. The alarm modules switch back to the permissive state (allowing the systems to operate) when containment pressure is greater than or equal to 1.0 psid.This function must be OPERABLE in MODES 1, 2, :3, and 4 when there is sufficient energy in the primary and secondary sides to pressurize containment following a pipe break. In MODES 5 and 6, there is insufficient energy in the primary and secondary sides to significantly pressurize the containment.
- 10. Nuclear Service Water System Suction Transfer -Low Pit Level Upon an emergency low pit level signal from either NSWS pit, interlocks isolate the NSWS from Lake Wylie, align NSWS to the standby nuclear service water pond, close particular crossover Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-28 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) valves, and start the NSWS pumps. This function is initiated on a two-out-of-three logic from either NSWS pump pit.This function must be OPERABLE in MODES 1, 2, 3, and 4 to ensure cooling water remains available to essential components during a DBA. In MODES 5 and 6, the sufficient time exists for manual operator action to realign the NSWS pump suction, if required.Unlike other shared NSWS equipment, the pit level interlocks do not require both normal and emergency power for OPERABILITY.
This is because unlike mechanical components such as pumps and valves, the interlocks are designed to fail safe upon a loss of power, initiating a transfer from Lake Wylie to the standby nuclear service water pond. The definition of OPERABILITY, which requires either normal or emergency power, provides sufficient power supply requirements and these interlocks can be considered OPERABLE provided they are powered from either an inverter or regulated power.The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36 (Ref.6).ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1. When the Required Channels in Table 3.3.2-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.
A channel shall be OPERABLE if the point at which the channel trips is found more conservative than the Allowable Value. In the event a channel's trip setpoint is found less conservative than the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.
If plant conditions warrant, the trip setpoint may be set outside the NOMINAL TRIP SETPOINT calibration tolerance band as long as the trip setpoint is conservative with respect to the NOMINAL TRIP SETPOINT.
If the trip setpoint is found outside of the NOMINAL TRIP SETPOINT calibration tolerance band and non-conservative with respect to the NOMINAL TRIP SETPOINT, the setpoint shall be re-adjusted.
Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-29 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
When the number of inoperable channels in a trip function exceed those specified in one or other related Conditions associated with a trip function, then the unit is outside the safety analysis.
Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.
A.__1 Condition A applies to all ESFAS protection functions.
Condition A addresses the situation where one or more channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected.
The Completion Times are those from the referenced Conditions and Required Actions.B.1, B.2.1 and B.2.2 Condition B applies to manual initiation of:* SI;* Containment Spray;* Phase A Isolation; and* Phase B Isolation.
This action addresses the train orientation of the SSPS for the functions listed above. If a channel or train is inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is allowed to return it to an OPERABLE status. Note that for containment spray and Phase B isolation, failure of one or both channels in one train renders the train inoperable.
Condition B, therefore, encompasses both situations.
The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each Function, and the low probability of an event occurring during this interval.
If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (54 hours6.25e-4 days <br />0.015 hours <br />8.928571e-5 weeks <br />2.0547e-5 months <br /> total time) and in MODE 5 within an additional 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> (84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> total time). The allowable Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-30 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1. 0.2.1 and 0.2.2 Condition C applies to the automatic actuation logic and actuation relays for the following functions:
- SI;* Phase A Isolation;
- Phase B Isolation; and* Automatic Switchover to Containment Sump.This action addresses the train orientation of the SSPS and the master and slave relays. If one train is inoperable, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are allowed to restore the train to OPERABLE status. The 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed for restoring the inoperable train to OPERABLE status is justified in Reference
- 13. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> total time) and in MODE 5 within an additional 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> (60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> total time). The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing, provided the other train is OPERABLE.
The Required Actions are not required to be met during this time, unless the train is discovered inoperable during the testing. This allowance is based on the reliability analysis assumption of WCAP-1 0271-P-A (Ref. 7) that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the average time required to perform train surveillance.
Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-31 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1, D.2.1. and D.2.2 Condition 0 applies to:* Containment Pressure-High;
- Pressurizer Pressure-Low;
- Steam Line Pressure-Low;
- Steam Line Pressure-Negative Rate-High;
- Loss of offsite power (refer to Condition D footnote);
- SG Water level--Low Low; and* SG Water level--High High (P-14) for the Feedwater Isolation Function.If one channel is inoperable, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> are allowed to restore the channel to OPERABLE status or to place it in the tripped condition.
Generally this Condition applies to functions that operate on two-out-of-three logic.Therefore, failure of one channel places the Function in a two-out-of-two configuration.
One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed to restore the channel to OPERABLE status or to place it in the tripped condition is justified in Reference 13.Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels.
The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed for testing is justified in Reference 13.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-32 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
E.1. E.2.1, and E.2.2 Condition E applies to:* Containment Phase B Isolation Containment Pressure-High High;and* Steam Line Isolation Containment Pressure -High High.Neither of these signals has input to a control function.
Thus, two-out-of-.
three logic is necessary to meet acceptable protective requirements.
However, a two-out-of-three design would require tripping a failed channel. This is undesirable because a single failure would then cause spurious isolation initiation.
Therefore, these channels are designed with two-out-of-four logic so that a failed channel may be bypassed rather than tripped. Note that one channel may be bypassed and still satisfy the single failure criterion.
Furthermore, with one channel bypassed, a single instrumentation channel failure will not spuriously initiate isolation.
To avoid the inadvertent actuation of Phase B containment isolation, the inoperable channel should not be placed in the tripped condition.
Instead it is bypassed.
Restoring the channel to OPERABLE status, or placing the inoperable channel in the bypass condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, is sufficient to assure that the Function remains OPERABLE and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The Completion Time is further justified based on the low probability of an event occurring during this interval.
Failure to restore the inoperable channel to OPERABLE status, or place it in the bypassed condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows one additional channel to be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing.Placing a second channel in the bypass condition for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for testing purposes is acceptable based on the results of Reference 13.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-33 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
F.1, F.2.1, and F.2.2 Condition F applies to:* Manual Initiation of Steam Line Isolation; and* P-4 Interlock.
For the Manual Initiation and the P-4 Interlock Functions, this action addresses the train orientation of the SSPS. If a train or channel is inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of these Functions, the available redundancy, and the low probability of an event occurring during this interval.
If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.G.1 and G.2 Condition G applies to manual initiation of Steam Line Isolation.
This action addresses the operability of the manual steam line isolation function for each individual main steam isolation valve. If a channel is inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is allowed to return it to an OPERABLE status. If the train cannot be restored to OPERABLE status, the Conditions and Required Actions of LCO 3.7.2, "Main Steam Isolation Valves," must be entered for the associated inoperable valve. The specified Completion Time is reasonable considering that there is a system level manual initiation train for this Function and the low probability of an event occurring during this interval.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-34 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
H.1, H.2.1 and H.2.2 Condition H applies to the automatic actuation logic and actuation relays for the Steam Line Isolation, Feedwater Isolation, and AFW actuation Functions.
The action addresses the train orientation of the SSPS and the master and slave relays for these functions.
If one train is inoperable, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are allowed to restore the train to OPERABLE status. The 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed for restoring the inoperable train to OPERABLE status is justified in Reference
- 13. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
If the train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of the protection channels and actuation functions.
In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing provided the other train is OPERABLE.
This allowance is based on the reliability analysis (Ref. 7) assumption that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the average time required to perform channel surveillance.
Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-35 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 1.1 and 1.2 Condition I appiies to the automatic actuation logic and actuation relays for the Turbine Trip Function.This action addresses the train orientation of the SSPS and the master and slave relays for this Function.
If one train is inoperable, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are allowed to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed for restoring the inoperable train to OPERABLE status is justified in Reference
- 13. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. These Functions are no longer required in MODE 3. Placing the unit in MODE 3 removes all requirements for OPERABILITY of the protection channels and actuation functions.
In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing provided the other train is OPERABLE.
This allowance is based on the reliability analysis (Ref. 7) assumption that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the average time required to perform channel surveillance.
J.1 and J.2 Condition J applies to:* SG Water Level--High High (P-14) for the Turbine Trip Function;and* Tavg-LOw.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-36 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
If one channel is inoperable, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> are allowed to restore one channel to OPERABLE status or to place it in the tripped condition.
If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-three logic will result in actuation.
The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed to restore the channel to OPERABLE status or place it in the tripped condition is justified in Reference
- 13. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Time of 78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels.
The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed to place the inoperable channel in the tripped condition, and the 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed for a second channel to be in the bypassed condition for testing, are justified in Reference 13.K.1 and K.2 Condition K applies to the AFW pump start on trip of all MFW pumps.This action addresses the auto start function of the AFW System on loss of all MFW pumps. The OPERABILITY of the AFW System must be assured by allowing automatic start of the AFW System pumps. If a channel is inoperable, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is allowed to return it to an OPERABLE status or to place the channel in trip. If the function cannot be returned to an OPERABLE status or placed in a trip condition, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to place the unit in MODE 3. The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, the unit does not have any analyzed transients or conditions that require the explicit use of the protection function noted above.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-37 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
L.1 and L.2 Condition L applies to the Doghouse Water Level -High High.If one channel is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore the channel to OPERABLE status or to place it in the tripped condition.
Therefore, failure of one channel places the Function in a two-out-of-two configuration.
One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
Alternatively, if the inoperable channel is not restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, the unit must be placed in MODE 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, this Function is no longer required OPERABLE.Required Action L.1 is modified by a Note that allows the inoperable channel to be bypassed for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing of other channels.M.1, M.2.1 and M.2.2 Condition M applies to the Auxiliary Feedwater Pumps Suction Transfer on Suction Pressure Low.If one channel is inoperable, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is allowed to restore the channel to OPERABLE status or to place it in the tripped condition.
The failure of one channel places the Function in a two-out-of-two configuration.
One channel must be tripped to place the Function in a one-out-of-three configuration that satisfies redundancy requirements.
Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-38 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, this Function is no longer required OPERABLE.N.1, N.2.1 and N.2.2 Condition N applies to:* RWST Level--Low Coincident with Safety Injection.
RWST Level--Low Coincident With SI provides actuation of switchover to the containment sump. Note that this Function requires the bistables to energize to perform their required action. The failure of up to two channels will not prevent the operation of this Function.
However, placing a failed channel in the tripped condition could result in a premature switchover to the sump, prior to the injection of the minimum volume from the RWST. Placing the inoperable channel in bypass results in a two-out-of-three logic configuration, which satisfies the requirement to allow another failure without disabling actuation of the switchover when required.
Restoring the channel to OPERABLE status or placing the inoperable channel in the bypass condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is sufficient to ensure that the Function remains OPERABLE, and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Completion Time is justified in Reference
- 7. If the channel cannot be returned to OPERABLE status or placed in the bypass condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, the unit must be brought to MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 5 within the next 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows placing a second channel in the bypass condition for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing. The total of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to reach MODE 3 and 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for a second channel to be bypassed is acceptable based on the results of Reference 7.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-39 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1, 0.2.1 and 0.2.2 Condition 0 applies to the P-11 and P-12 interlocks.
With one channel inoperable, the operator must verify that the interlock is in the required state for the existing unit condition.
This action manually accomplishes the function of the interlock.
Determination must be made within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is equal to the time allowed by LCO 3.0.3 to initiate shutdown actions in the event of a complete loss of ESFAS function.
If the interlock is not in the required state (or placed in the required state) for the existing unit condition, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of these interlocks.
P.1 Condition P applies to the Containment Pressure Control System Start and Terminate Permissives.
With one or more channels inoperable, the affected containment spray and containment air return systems components must be declared inoperable immediately.
The supported system LCOs provide the appropriate Required Actions and Completion Times for the equipment made inoperable by the inoperable channel. The immediate Completion Time is appropriate since the inoperable channel could prevent the supported equipment from starting when required.
Additionally, protection from an inadvertent actuation may not be provided if the terminate function is not OPERABLE.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-40 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
Q.1, Q.2. Q.3.1. and Q.3.2 With one channel of NSWS Suction Transfer -Low Pit Level inoperable in one or more NSWS pits, 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> are allowed to place it in the tripped condition or align the NSWS to the Standby NSWS Pond. The failure of one channel places the Function in a two-out-of-two configuration.
The failed channel must either be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements, or the NSWS realigned to fulfill the safety function.Failure to place the channel in the tripped condition or to realign the NSWS suction and discharge within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 5 within the next 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.The requirement to align the NSWS to the Standby NSWS Pond only applies to OPERABLE trains of the system.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, this Function is no longer required OPERABLE.R.1. R.2.1, and R.2.2 With two or more channels of NSWS Suction Transfer -Low Pit Level inoperable in one or more pits, the NSWS must be aligned to the Standby NSWS Pond within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Failure to accomplish the realignment within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 5 within the next 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.The requirement to align the NSWS to the Standby NSWS Pond only applies to OPERABLE trains of the system.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, this Function is no longer required OPERABLE.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-41 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE The SRs for each ESFAS Function are identified by the SRs column REQUIREMENTS of Table 3.3.2-1.A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions.
Note that each channel of process protection supplies both trains of the ESFAS. When testing channel I, train A and train B must be examined.Similarly, train A and train B must be examined when testing channel II, channel Ill, and channel IV (if applicable).
The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
SR 3.3.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred.
A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.
It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and reliability.
If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.2 SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST. The SSPS is tested using the semiautomatic tester. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation.
Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-42 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, are tested for each protection function.
In addition, the master relay coil is pulse tested for continuity.
This verifies that the logic modules are OPERABLE and that there is an intact voltage signal path to the master relay coils. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.3 SR 3.3.2.3 is the performance of a TADOT. This test is a check of the Loss of Offsite Power Function.
Each Function is tested up to, and including, the master transfer relay coils.This test also includes trip devices that provide actuation signals directly to the SSPS. The SR is modified by a Note that excludes final actuation of pumps and valves to minimize plant upsets that would occur. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.4 SR 3.3.2.4 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a low voltage continuity check of the slave relay coil. Upon master relay contact operation, a low voltage is injected to the slave relay coil. This voltage is insufficient to pick up the slave relay, but large enough to demonstrate signal path continuity.
The time allowed for the testing (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) is justified in Reference
- 7. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.5 SR 3.3.2.5 is the performance of a COT.A COT is performed on each required channel to ensure the channel will perform the intended Function.
The tested portion of the loop must trip within the Allowable Values specified in Table 3.3.2-1.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-43 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
The setpoint shall be left set consistent with the assumptions of the setpoint methodology.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.6 SR 3.3.2.6 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is placed in a condition where the relay contact operation can be verified without operation of the equipment.
Actuation equipment that may not be operated in the design mitigation MODE is prevented from operation by the SLAVE RELAY TEST circuit. For this latter case, contact operation is verified by a continuity check of the circuit containing the slave relay. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.For slave relays or any auxiliary relays in the ESFAS circuit that are of the type Westinghouse AR or Potter & Brumfield MDR, the SLAVE RELAY TEST Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.7 SR 3.3.2.7 is the performance of a COT on the RWST level and Containment Pressure Control Start and Terminate Permissives.
A COT is performed on each required channel to ensure the entire channel will perform the intended Function.
Setpoints must be found conservative with respect to the Allowable Values specified in Table 3.3.2-1. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-44 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions" has been implemented, this SR is modified by two Notes as identified in Table 3.3.2-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology.
The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.
The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the NOMINAL TRIP SETPOINT (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint.
This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.
If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable.
The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances be in the UFSAR.SR 3.3.2.8 SR 3.3.2.8 is the performance of a TADOT. This test is a check of the Manual Actuation Functions, AFW pump start on trip of all MFW pumps, AFW low suction pressure, Reactor Trip (P-4) Interlock, and Doghouse Water Level -High High Feedwater Isolation.
Each Manual Actuation Function is tested up to, and including, the master relay coils. In some instances, the test includes actuation of the end device (i.e., pump starts, valve cycles, etc.). The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. The SR is modified by a Note that excludes verification of setpoints during the TADOT for manual initiation Functions.
The manual initiation Functions have no associated setpoints.
Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-45 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
SIR 3.3.2.9 SIR 3.3.2.9 is the performance of a CHANNEL CALIBRATION.
CHANNEL CALIBRATION is a complete check of the instrument ioop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note stating that this test should include verification that the time constants are adjusted to the prescribed values where applicable.
The applicable time constants are shown in Table 3.3.2-1.For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions" has been implemented, this SR is modified by two Notes as identified in Table 3.3.2-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology.
The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.
The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the NOMINAL TRIP SETPOINT (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint.
This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.
If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-46 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) channel shall be declared inoperable.
The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances be in the UFSAR.SR 3.3.2.10 This SR ensures the individual channel ESE RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis.Response Time testing acceptance criteria are included in the UFSAR (Ref. 2). Individual component response times are not modeled in the analyses.
The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the Trip Setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position).
For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate UFSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace, onsite, or offsite (e.g. vendor)test measurements, or (3) utilizing vendor engineering specifications.
WCAP-13632-P-A Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. In addition, while not specifically identified in the WCAP, ITT Barton 386A and 580A-0 sensors were compared to sensors which were identified.
It was concluded that the WCAP results could be applied to these two sensor types as well. Response time verification for other sensor types must be demonstrated by test.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-47 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
WCAP-1 4036-P-A Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.The allocations for sensor, signal conditioning and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note that clarifies that the turbine driven AEW pump is tested within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after reaching 600 psig in the SGs.SR 3.3.2.11 SR 3.3.2.11 is the performance of a COT on the NSWS Suction Transfer-Low Pit Level.A COT is performed on each required channel to ensure the entire channel will perform the intended Function.
Setpoints must be found within the Allowable Values specified in Table 3.3.2-1. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-48 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.2.12 SR 3.3.2.12 is the performance of an ACTUATION LOGIC TEST on the Doghouse Water Level-High High and NSWS Suction Transfer-Emergency Low Pit Level Functions.
An ACTUATION LOGIC TEST to satisfy the requirements of GL 96-01 is performed on each instrumentation to ensure all logic combinations will initiate the appropriate Function.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
- 1. UFSAR, Chapter 6.2. UFSAR, Chapter 7.3. UFSAR, Chapter 15.4. IEEE-279-1971.
- 5. 10 CFR 50.49.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
- 7. WCAP-1 0271-P-A, Supplement 1 and Supplement 2, Rev. 1, May 1986 and June 1990.8. WCAP-1 3632-P-A Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" Sep., 1995.9. WCAP-1 4036-P-A Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" Oct., 1998.10. Not used.11. Not used.12. Not used.13. WCAP-14333-P-A, Revision 1, October 1998.14. Not used.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-49 LTOP System B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.12 Low Temperature Overpressure Protection (LTOP) System BASES BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (PIT) limits of 10 CFR 50, Appendix G (Ref. 1 ). The reactor vessel is the limiting RCPB component for demonstrating such protection.
This specification provides the maximum allowable actuation logic setpoints for the power operated relief valves (PORVs) and LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," provides the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES.The reactor vessel material is less tough at low temperatures than at normal operating temperature.
As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.
The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition.
Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3 requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the specified limits.This LCO provides RCS overpressure protection by having a minimum coolant input capability and having adequate pressure relief capacity.Limiting coolant input capability requires all but two pumps incapable of injection into the RCS, isolating the accumulators, and limiting reactor coolant pump operation at low temperatures.
The pressure relief capacity requires two redundant RCS relief valves. One RCS relief valve is the overpressure protection device that acts to terminate an increasing pressure event.With minimum coolant input capability, the ability to provide core coolant addition is restricted.
The LCO does not require the makeup control Catawba Units 1 and 2B34121RvsoN.5 B 3.4.12-1 Revision No. 5 LTOP System B 3.4.12 BASES BACKGROUND (continued) system deactivated or the safety injection (SI) actuation circuits blocked.Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve. If conditions require the use of more than one charging pump for makeup in the event of loss of inventory, then additional pumps can be made available through manual actions.The LTOP System for pressure relief consists of two PORVs with reduced lift settings or two residual heat removal (RHR) suction relief valves or one PORV and one RHR suction relief valve. Two RCS relief valves are required for redundancy.
One RCS relief valve has adequate relieving capability to keep from overpressurization for the required coolant input capability.
PORV Requirements As designed for the LTOP System, each PORV is signaled to open if the RCS pressure reaches 400 psig (as left calibrated), allowable value < 425 psig (as found), when the PORVS are in the "io-press" mode of operation.
If the PORVs are being used to meet the requirements of this Specification, then indicated ROS cold leg temperature is limited to >_ 70°F in accordance with the LTOP analysis.
When all Reactor Coolant Pumps are secured, this temperature is measured at the outlet of the residual heat removal heat exchanger.
This location will provide the most conservative (lower) temperature measurement of water capable of being delivered into the Reactor Coolant System. The LTOP actuation logic monitors both RCS temperature and RCS pressure.
The signals used to generate the pressure setpoints originate from the wide range pressure transmitters.
The signals used to generate the temperature permissives originate from the wide range RTDs. Each signal is input to the appropriate NSSS protection system cabinet where it is converted to an internal signal and then input to a comparator to generate an actuation signal. If the indicated pressure meets or exceeds the calculated value, a PORV is signaled to open.This Specification presents the PORV setpoints for LTOP. Having the setpoints of both valves within the limits ensures that the Reference 1 limits will not be exceeded in any analyzed event.When a PORV is opened in an increasing pressure transient, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.Catawba Units 1 and 2B34122RvsoN.5 B 3.4.12-2 Revision No. 5 LTOP System B 3.4.12 BASES BACKGROUND (continued)
RHR Suction Relief Valve Requirements During LTOP MODES, the RHR system is operated for decay heat removal and low-pressure letdown control. Therefore, the RHR suction isolation valves (there are two suction isolation valves per line) are open in the piping from the ROS hot legs to the inlets of the RHR pumps. While these valves are open, the RHR suction relief valves are exposed to the RCS and are able to relieve pressure transients in the RCS.The RHR suction isolation valves must be open with operator power removed to make the RHR suction relief valves OPERABLE for RCS overpressure mitigation.
The RHR suction relief valves are spring loaded, bellows type water relief valve with pressure tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 8) for Class 2 relief valves.APPLICABLE Safety analyses (Ref. 3) demonstrate that the reactor vessel is adequately SAFETY ANALYSES protected against exceeding the Reference 1 P/T limits. In MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature exceeding 210°F, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At about 21 0 0 F and below, overpressure prevention falls to two OPERABLE RCS relief valves. Each of these means has a limited overpressure relief capability.
The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement.
Each time the P/T curves are revised, the LTOP System must be re-evaluated to ensure its functional requirements can still be met using the RCS relief valve method.Any change to the RCS must be evaluated against the Reference 3 analyses to determine the impact of the change on the LTOP acceptance limits.Transients that are capable of overpressurizing the ROS are categorized as either mass or heat input transients, examples of which follow: Mass Input Type Transients
- a. Inadvertent safety injection of one safety injection pump and one charging pump; or b. Charging/letdown flow mismatch.Catawba Units 1 and 2B34123RvsoN.5 B 3.4.12-3 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)
Heat Input Type Transients
- a. Inadvertent actuation of pressurizer heaters;b. Loss of RHR cooling; or c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.
The following are required during the LTOP MODES to ensure that mass and heat input transients do not occur, which either of the LTOP overpressure protection means cannot handle: a. Rendering all but two pumps incapable of injection;
- b. Deactivating the accumulator discharge isolation valves in their closed positions;
- c. Limiting RCP operation based on the existing temperature in the ROS cold legs; and d. Disallowing start of an RCP if secondary temperature is more than 50°F above primary temperature in any one loop. LCO 3.4.6, "RCS Loops--MODE 4," and LCO 3.4.7, "RCS Loops--MODE 5, Loops Filled," provide this protection'.
The Reference 3 analyses demonstrate that one RCS relief valve can maintain RCS pressure below limits when any two pumps (charging and/or safety injection) are actuated.
Thus, the LCO allows two pumps OPERABLE during the LTOP MODES. The LCO also requires the accumulators be isolated when accumulator pressure is greater than or equal to the maximum ROS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3.The isolated accumulators must have their discharge valves closed and power removed.The restrictions on the number of RCPs in operation at a given temperature ensures that during a LTOP mass injection event that the pressure/temperature (PIT) limits of 10 CFR 50, Appendix G to protect the Catawba Units 1 and 2B34124RvsoN.5 B 3.4.12-4 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued) reactor vessel are not exceeded.
During startup and shutdown, when the RCPs are operated, their induced flows create a pressure drop across the vessel. This pressure drop along with the difference in elevation between the beitline region and the instrumentation locations are additive to the peak pressure from the mass injection event.The amount of the pressure at the reactor vessel beltline region from the RCPs is dependent on the number of RCPs operated.
Adequate margin to prevent exceeding the P/T limits is assured by restricting the number of RCPs operated.
Since LTOP events are basically acknowledged as being steady-state events, these RCP operating restrictions are designed to work with the LTOP setpoint to provide protection from exceeding the steady-state Appendix G P/T limits.Fracture mechanics analyses established the temperature of LTOP Applicability at 210°F.The consequences of a small break loss of coolant accident (LOCA) in LTOP MODE 4 conform to 10 CFR 50.46 and 10 CFR 50, Appendix K (Refs. 4 and 5), requirements by having a maximum of two pumps (charging and/or safety injection)
OPERABLE and SI actuation enabled.PORV Performance The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the specified limit. The setpoints are derived by analyses that model the performance of the LTOP System, assuming the limiting LTOP transient of one charging pump and one safety injection pump injecting into the RCS. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensures the Reference 1 PIT limits will be met.The PORV setpoints will be updated when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation.
Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens.
The Bases for LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," discuss these examinations.
Catawba Units 1 and 2B34125RvsoN.5 B 3.4.12-5 Revision No. 5 LTOP System B 3.4.12 BAS ES APPLICABLE SAFETY ANALYSES (continued)
The PORVs are considered active components.
Thus, the failure of one PORV is assumed to represent the worst case, single active failure.RHR Suction Relief Valve Performance The RHR suction relief valves do not have variable pressure and temperature lift setpoints like the PORVs. Analyses show that one RHR suction relief valve with a setpoint at or between 417 psig and 509 psig will pass flow greater than that required for the limiting LTOP transient while maintaining RCS pressure less than the P/T limit curve. Assuming all relief flow requirements during the limiting LTOP event, an RHR suction relief valve will maintain RCS pressure to within the valve rated lift setpoint, plus an accumulation
< 10% of the rated lift setpoint.Although each RHR suction relief valve may itself meet single failure criteria, its inclusion and location within the RHR system does not allow it to meet single failure criteria when spurious RHR suction isolation valve closure is postulated.
Also, as the RCS P/T limits are decreased to reflect the loss of embrittlement, the RHR suction relief valves must be analyzed to still accommodate the design basis transients for LTOP.The RHR suction relief valves are considered to be active components.
Thus, the failure of one valve is assumed to represent the worst case single active failure.The LTOP System satisfies Criterion 2 of 10 CFR 50.36 (Ref. 6).LCO This LCO requires that the LTOP System is OPERABLE.
The LTOP System is OPERABLE when the minimum coolant input and pressure relief capabilities are OPERABLE.
Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient.
To limit the coolant input capability, the LCO permits a maximum of two pumps (charging and/or safety injection) capable of injecting into the RCS and requires all accumulator discharge isolation valves closed and immobilized when accumulator pressure is greater than or equal to the maximum ROS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3. The LCO also limits ROP operation based on existing RCS cold leg temperature as required by the LTOP analysis.The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are: Catawba Units 1 and 2B34126RvsoN.5 B 3.4.12-6 Revision No. 5 LTOP System B 3.4.12 BASES LCO (continued)
- a. Two OPERABLE PORVs (NC-32B and NC-34A); or A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set to the specified limit and testing proves its automatic ability to open at this setpoint, and motive power is available to the valve and its control circuit. The following restrictions are placed on PORV OPERABILITY for LTOP due to commonalities between the PORV power supplies and letdown isolation:
- NC-32B is not OPERABLE for LTOP if excess letdown is in service.* NC-32B is not OPERABLE for LTOP if normal letdown is in service and centrifugal charging pump B is in operation.
- NC-34A is not OPERABLE for LTOP if normal letdown is in service.b. Two OPERABLE RHR suction relief valves (ND-3 and ND-38); or An RHR suction relief valve is OPERABLE for LTOP when both of its RHR suction isolation valves are open, its setpoint is at or between 417 psig and 509 psig, and testing has proven its ability to open in this pressure range.c. One OPERABLE PORV and one OPERABLE RHR suction relief valve.Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.
APPLICABILITY This LCO is applicable in MODE 4 when any ROS cold leg temperature is< 210°F, in MODE 5, and in MODE 6 when the reactor vessel head is on.The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above 21 0°F. When the reactor vessel head is off, overpressurization cannot occur.LCO 3.4.3 provides the operational P/T limits for all MODES. LCO 3.4.10,"Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above 21 0°F.Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows Catawba Units 1 and 2B34127RvsoN.5 B 3.4.12-7 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABILITY (continued) operator action to mitigate the event.The Applicability is modified by a Note stating that accumulator isolation is only required when the accumulator pressure is more than or at the maximum RCS pressure for the existing temperature, as allowed by the P/T limit curves. This Note permits the accumulator discharge isolation valve Surveillance to be performed only under these pressure and temperature conditions.
ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable LTOP system. There is an increased risk associated with entering MODE 4 from MODE 5 with LTOP inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
A.1 With more than two pumps (charging and/or safety injection) capable of injecting into the RCS, ROS overpressurization is possible.To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency.of removing the RCS from this condition.
B._11 With RCP operation not limited in accordance with Table 3.4.12-1, RCS overpressurization is possible.To immediately initiate action to limit pump operation reflects the urgency of removing the RCS from this condition.
C.1, D.1, and D.2 An unisolated accumulator requires isolation within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This is only required when the accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.If isolation is needed and cannot be accomplished in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, Required Action D.1 and Required Action D.2 provide two options, either of which must be performed in the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. By increasing the ROS Catawba Units 1 and 2B34128RvsoN.5 B 3.4.12-8 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued) temperature to > 21 0°F, an accumulator pressure of 678 psig cannot exceed the LTOP limits if the accumulators are fully injected.Depressurizing the accumulators below the LTOP limit also gives this protection.
The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.E.1I In MODE 4 when any RCS cold leg temperature is < 210°F, with one RCS relief valve inoperable, the RCS relief valve must be restored to OPERABLE status within a Completion Time of 7 days. Two RCS relief valves (in any combination of the PORVs and RHR suction relief valves)are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component.
The Completion Time considers the facts that only one of the RCS relief valves is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low.F. 1 The consequences of operational events that will overpressurize the RCS are more severe at lower temperature (Ref. 7). Thus, with one of the two RCS relief valves inoperable in MODE 5 or in MODE 6 with the head on Completion Time to restore two valves to OPERABLE status is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.The Completion Time represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one OPERABLE RCS relief valve to protect against overpressure events.Catawba Units 1 and 2B34129RvsoN.5 B 3.4.12-9 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued)
G.1 and G.2 Steps must be taken immediately to limit potential mass input into the RCS, and the RCS must be depressurized and a vent must be established within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> when: a. Both required RCS relief valves are inoperable; or b. A Required Action and associated Completion Time of Condition A, 0, E, or F is not met; or c. The LTOP System is inoperable for any reason other than Condition A, C, D, E, or F.The Reference 3 analyses demonstrate that with the mass input into the RCS reduced to that of one injection pump (charging or safety injection) an RCS vent of> 4.5 square inches can maintain RCS pressure below limits. Therefore the Condition requires action to be taken immediately to reduce the input to that of one injection pump (charging or safety injection) prior to commencing RCS pressure reduction and establishing the required RCS vent. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle fracture of the reactor vessel.The capacity of a vent this size is greater than the flow of the limiting transient for the LTOP configuration, one charging pump or one safety injection pump OPERABLE, maintaining RCS pressure less than the maximum pressure on the P/T limit curve. The required vent capacity may be provided by one or more vent paths. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.The RCS vent size will be re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material su rveil lance.The ROS vent is passive and is not subject to active failure.The Completion Time considers the time required to place the plant in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.
Catawba Units 1 and 2 B341-0Rvso o B 3.4.12-10 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued)
G.3 The ROS vent of > 4.5 square inches is proven OPERABLE by verifying its open condition either: a. Once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for a valve that is not locked, (valves that are sealed or secured in the open position are considered "locked" in this context);
or b. Once every 31 days for other vent path(s) (e.g., a vent valve that is locked, sealed or secured in position or a removed pressurizer safety valve or open manway also fits this category).
The passive vent valve arrangement must only be open to be OPERABLE.
This Required Action is required to be performed if the vent is being used to satisfy the pressure relief requirements of Required Action G.2.Catawba Units 1 and 2 B341-1Rvso o B 3.4.12-11 Revision No. 5 LTOP System B 3.4.12 BASES SURVEILLANCE SR 3.4.12.1 and SR 3.4.12.2 REQU IREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, a maximum of two pumps (charging and/or safety injection) are verified capable of injecting into the RCS and the accumulator discharge isolation valves are verified closed and power removed.The pumps are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control. An alternate method of LTOP control may be employed using at least two independent means to prevent a pump start such that a single failure or single action will not result in an injection into the RCS. This may be accomplished through two valves in the discharge flow path being closed.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.12.3 Each required RHR suction relief valve shall be demonstrated OPERABLE by verifying its RHR suction isolation valves are open and by testing it in accordance with the Inservice Testing Program. This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet this LCO.The RHR suction isolation valves are verified to be opened. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The ASME Code (Ref. 9), test per Inservice Testing Program verifies OPERABILITY by proving relief valve mechanical motion and by measuring and,. if required, adjusting the lift setpoint.SR 3.4.12.4 The PORV block valve must be verified open to provide the flow path for each required PORV to perform its function when actuated.
The valve must be remotely verified open in the main control room. This Surveillance is performed if the PORV satisfies the LCO.The block valve is a remotely controlled, motor operated valve. The Catawba Units 1 and 2 B341-2Rvso o B 3.4.12-12 LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued) power to the valve operator is not required removed, and the manual operator is not required locked in the inactive position.
Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.12.5 Performance of a COT is required within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after decreasing RCS temperature to < 21 0°F and periodically on each required PORV to verify and, as necessary, adjust its lift setpoint.
The COT will verify the setpoint is within the allowed maximum limits. PORV actuation could depressurize the RCS and is not required.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency considers the unlikelihood of a low temperature overpressure event during this time.A Note has been added indicating that this SR is required to be met 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after decreasing RCS cold leg temperature to < 210°F. The COT cannot be performed until in the LTOP MODES when the PORV lift setpoint can be reduced to the LTOP setting. The test must be performed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after entering the LTOP MODES.SR 3.4.12.6 Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B341-3Rvso o B 3.4.12-13 Revision No. 5 LTOP System B 3.4.12 BAS ES SURVEILLANCE REQUIREMENTS (continued)
SR 3.4.12.7 Each required RHR suction relief valve shall be demonstrated OPERABLE by verifying its RHR suction isolation valves are open and by testing it in accordance with the Inservice Testing Program. (Refer to SR 3.4.12.3 for the RHR suction isolation valves Surveillance and for a description of the Inservice Testing Program.)
This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet this LCO.The RHR suction isolation valves are verified open, with power to the valve operator removed and locked in the removed position, to ensure that accidental closure will not occur. The "locked open in the removed position" power supply must be locally verified in its open position with the power supply to the valve locked in its inactive position.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
- 1. 10 CFR 50, Appendix G.2. Generic Letter 88-1 1.3. UFSAR, Section 5.2 4. 10 CFR 50, Section 50.46.5. 10 CFR 50, Appendix K.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
- 7. Generic Letter 90-06.8. ASME, Boiler and Pressure Vessel Code,Section III.9. ASME Code for Operation and Maintenance of Nuclear Power Plants.Catawba Units 1 and 2 B341-4Rvso o B 3.4.12-14 Revision No. 5 S_ %DUKEKelvin Henderson Vice President SENERGY catawba Nuclear Station Duke Energy CNO1VP I 4800 Concord Road York, SC 29745 o: 803,701.4251 CNS-1 5-098 f: 803.701.3221 December 14, 2015 U.S. Nuclear Regulatory Commission Document Control Desk Washington, DC 20555-0001
Subject:
Duke Energy Carolinas, LLC Catawba Nuclear Station, Units 1 and 2 Docket Nos. 50-413 and 50-414 Technical Specification Bases Changes Pursuant to 10OCFR 50.4, please find attached changes to the Catawba Nuclear Station Technical Specification Bases. These Bases changes were made according to the provisions of Technical Specification 5.5.14, "Technical Specifications (TS) Bases Control Program." Any questions regarding this information should be directed to Larry Rudy, Regulatory Affairs, at (803) 701-3084.I certify that I am a duly authorized officer of Duke Energy Carolinas, LLC, and that the information contained herein accurately represents changes made to the Technical Specification Bases since the previous submittal.
Kelvin Henderson Vice President, Catawba Nuclear Station Attachment A L www.duke-energy.com U.S. Nuclear Regulatory Commission December 14, 2015 Page 2 xc: L. D. Wert, Jr., Acting Regional Administrator U. S. Nuclear Regulatory Commission, Region II Marquis One Tower 245 Peachtree Center Ave., NE Suite 1200 Atlanta, GA 30303-1257 Mr. G.E. Miller NRC Project Manager (CNS)U.S. Nuclear Regulatory Commission One White Flint North, Mail Stop O-8G9A 11555 Rockville Pike Rockville, MD 20852-2746 G. A. Hutto, Senior Resident Inspector Catawba Nuclear Station ENERGY~Catawba Nuclear Station Duke Energy 4800 Concord Rd.York, SC 29745 December 14, 2015 Re: Catawba Nuclear Station Technical Specifications Bases Please replace the corresponding pages in your copy of the Catawba Technical Specifications Manual as follows: REMOVE THESE PAGES INSERT THESE PAGES LIST OF EFFECTIVE PAGES Entire Section (19 pages)Entire Section (19 pages)TAB 3.3.2 B 3.3.2-1 thru B 3.3.2-49 Revision 10 B 3.3.2-1 thru B 3.3.2-49 Revision 11 TAB 3.4.12 B 3.4.12-1 thru B 3.4.12-14 Revision 4 B 3.4.12-1 thru B 3.4.12-14 Revision 5 If you have any questions concerning the contents of this Technical Specification update, contact Kristi Byers at (803)701-3758.
Cecil Fletcher Regulatory Affairs Manager www.duke-energy.com Catawba Nuclear *Station Technical Specifications List of Effective Pages Page Number ii iii iv 1.1-1 1.1-2 1.1-3 1.1-4 1.1-5 1.1-6 1.1.7 1.2-1 1.2-2 1.2-3 1.3-1 1.3-2 1.3-3 1.3-4 1.3-5 1.3-6 1.3-7 1.3-8 1.3-9 1.3-10 1.3-11 1.3-12 1.3-13 1.4-1 1.4-2 Amendment 1771169 219/214 215/209 173/1 65 173/1 65 268/264 268/264 268/264 268/264 268/264 179/171 173/1 65 173/165 173/165 173/1 65 173/165 173/165 173/1 65 173/1 65 173/1 65 173/1 65 173/1 65 173/165 173/165 173/1 65 173/1 65 173/1 65 173/165 173/1 65 Revision Date 4/08/99 3/01/05 6/2 1/04 9/30/98*9/30/98 6/25/12 6/25/12 6/25/12 6/25/12 6/25/12 8/13/99 9/30/98 9/30/98 9/3 0/9 8 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 9/30/98 Catawba Units 1 and 2Pge11/25 Page 1 11/12/15 0 1.4-3 1.4-4 2.0-1 3.0-1 3.0-2 3.0-3 3.0-4 3.0-5 3,0-6 3.1.1-1 3.1.2-1 3.1.2-2 3.1.3-1 3.1.3-2 3.1.3-3 3.1.4-1 3.i1.4-2 3.1.4-3 3.1.4-4 3.1.5-1 3.1.5-2 3.1,6-1 3.1.6-2 3.1.6-3 3.1.7-1 3.1.7-2 3.1.8-1 3.1.8-2 3.2.1-1 3.2.1-2 3.2.1-3 3.2,1-4 173/165 173/1 65 210/204 235/231 235/23 1 235/231 235/231 235/231 235/231 263/ 259 173/165 263/259 173/165 275/271 173/1 65 173/1 65 i173/i 65 26 3/25 9 263/259 173/165 26 3/259 173/1 65 173/1 65 263/259 173/1 65 173/1 65 173/1 65 263/259 173/1 65 173/1 65 263/259 263/259 9/30/98 9/30/98 12/19/03 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/29/11 9/30/98 3/29/I1 9/30/98 04/14/15 9/30/98 9/30/98 9/30/98 3/29/11 3/29/11 9/30/98 3/29/11 9/30/98 9(30/98 3/29/11 9/30/98 9/30/98 9/30/98 3/29/11 9/30/98 9/30/98 3/29/11 3/29/11 Catawba Units 1 and 2Pae21//5 Page 2 11/12/15 3.2.1-5 3.2.2-1 3.2.2-2 3.2.2-3 3.2.2-4 3.2.3-1 3.2.4-1 3.2.4-2 3.2.4-3 3.2.4-4 3.3.1-1 3.3.1-2 3.3.1-3 3.3.1-4 3.3.1-5 3.3.1-6 3.3.1-7 3.3.1=8 3.3.1-9 3.3. 1-10 3.3.1-11 3.3.1-12 3.3.1-13 3.3.1-14 3.3. 1-15 3.3.1-16 3.3. 1-17 3.3.1-18 3.3. 1-19 3.3. 1-20 3.3.1-21 3.3.1-22 3.3.2-1 263/259 173/165 173/165 263/259 263/259 26 3/25 9 173/165 173/1 65 173/1 65 263/259 173/1 65 247/240 247/240 207/201 247/240 247/240 247/240!173/1 65 263/259 263/259 263/259 263/259 263/259 263/259 263/259 26 3/259 26 3/2 59 263/259 26 3/25 9 26 3/2 59 263/259 263/259 173/165 3/29/11 9/30/98 9/30/98 3/29/11 3/29/11 3/29/11 9/30/98 9/30/98 9/30/98 3/29/11 9/30/98 12/30/08 12/30/08 7/29/03 12/30/08 12/30/08 12/30/08 9/30/98 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 9/30/98 Catawba Units 1 and 2Pae31125 Page 3 11/12/15 3.3.2-2 3.3.2-3 3.3.2-4 3.3.2-5 3.3.2-6 3.3.2-7 3.3.2-8 3.3.2-9 3.3.2-10 3.3.2-11 3.3.2-12 3.3.2-13 3.3.2-14 3.3.2-15 3.3.2-16 3.3.2-17 3.3.3-1 3.3.3-2 3.3.3-3 3.3.3-4 3.3.4-1 3.3.4-2 3.3.4-3 3.3.5-1 3.3.5-2 3.3.6-1 3.3.6-2 3.3.6-3 3.3.9-1 3.3.9-2 3.3.9-3 3.3.9-4 247/240 247/240 247/240 264/260 264/26 0 249/243 249/243 249/243 263/259 263/259 263/259 269/265*263/259 263/259 264/26 0 269/265 219/214 219/214 263/259 219/214 213/207 263/259 2 72/26 8 173/1 65 263/259 196/189 263/259 196/189 207/201 207/201 263/259 263/259 12/30/08 12/30/08 12/30/08 6/13/11 6/13/11 4/2/09 4/2/09 4/2/09 3/29/11 3/29/li 3/29/11 7/25/12 3/29/11 3/29/11 6/13/11 7/25/12 3/1/05 3/1/05 3/29/11 3/1/05 4/29/04 3/29/11 2/27/14 9/30/98 3/29/11 3/20/02 3/29/111 3/20/02 7/29/03 7/29/03 3/29/11 3/29/11 Catawba Units 1 and 2Pae41/25 Page 4 11/12/15 3.4.1-1 210/204 12/19/03 03.4.1i-2 210/204 12/19/03 3.4.1-3 263/259 3/29/11 3.4.1-4 210/204 12/19/03 3.4.1-5 (deleted) 184/176 3/01/00 3.4.1-6 (deleted) 184/1 76 3/01/00 3.4.2-1 173/165 9/30/98 3.4.3-1 173/165 9/30/98 3.4.3-2 263/259 3/29/11 3.4.3-3 212/206 3/4/04 3.4.3-4 212/206 3/4/04 3.4.3 -5 212/206 3/4/04 3.4.3-6 21 2/206 3/4/04 3.4.4-1 263/259 3/29/11 3.4.5-1 207/201 7/29/03 3.4.5-2 207/201 7/29/03 3453263/259 3/29/11, 3.4.6-1 212/206 3/4/04 3.4.6-2 263/259 3/29/11i 3.4.6-3 263/259 3/29/11 3.4.7-1 212/206 3/4/04 3.4.7-2 263/259 3/29/11-'3.4.7-3 263/259 3/29/11 3.4.8-1 207/201 7/29/03 3.4.8-2 263/259 3/29/11 3.4.9-1 173/165 9/30/98 3.4.9-2 263/259 3/29/11 3.4.10-1 212/206 3/4/04 3.4.10-2 173/165 9/30/98 3.4-11-1 213/207 4/29/04 3.4.11-2 173/1 65 9/30/98*3.4.11-3 263/259 3/29/11 Catawba Units 1 and 2Pae51/25 Page 5 11/12/15 3.4.11-4 263/259 3/29/11 3.4.12-1 212/206 3/4/04 3.4.12-2 213/207 4/29/04 3.4.12-3 212/206 3/4/04 3.4.12-4 212/206 3/4/04 3.4.12-5 263/259 3/29/11 3.4.12-6 263/259 3/29/11 3.4.12-7 263/259 3/29/11 3.4.12-8 263/259 3/29/11 3.4.13-1 267/263 3/12/12 3.4.13-2 267/263 3/12/12 3.4.14-1 173/165 9/30/98 3.4.14-2 173/165 9/30/98 3.4.14-3 263/259 3/29/11 3.4.14-4 263/259 3/29/11 3.4.15-1 234/230 9/30/06 3.4.1i5-2 234/230 9/30/06 3.4.15-3 234/230 9/30/06 3.4.15-4 263/259 3/29/11 3.4.16-1 268/264 6/25/12 3.4.16-2 268/264 6/25/12 3.4.16-3(deleted) 268/264 6/25/12 3.4.1 6-4(deleted) 268/264 6/25/12 3.4.17-1 263/259 3/29/11 3.4.18-1 218/212 1/13/05 3.4.18-2 218/212 1/13/05 3.5.1-1 21 1/205 12/23/03 3.5.1-2 263/259 3/29/11 3.5.1-3 263/259 3/29/11 3.5.2-1 253/248 10/30/09 3.5.2-2 263/259 3/29/11 3.5.2-3 263/259 3/29/11 Catawba Units 1 and 2Pae61/25 Page 6 11/12/15 3.5.3-1 3.5.3-2 3.5.4-1 3.5.4-2 3.5.5-1 3.5.5-2 3.6.1-1 3.6.1-2 3.6.2-1 3.6.2-2 3.6.2-3 3.6.2-4 3.6.2-5 3.6.3-1 3.6.3-2 3.6.3-3 3.6.3-4 3.6.3-5 3.6.3-6 3.6.3-7 3.6.4-1 3.6.5-1 3.6.5-2 3.6.6-1 3.6.6-2 3.6.8-1 3.6.8-2 3.6.9-1 3.6.10-2 3.6.10-1 3.6.11-1 213/207 173/165 173/165 26 9/265 173/1 65 263/259 173/165 192/1 84 173/1 65 173/165 173/1 65 173/1 65 26 3/2 59 173/165 173/1 65 173/1 65 i173/1 65 263/259 263/259 192/1 84 263/259 173/1 65 263/259 269/265 26 9/265 213/207 26 3/2 59 253/248 263/259 173/1 65 26 3/2 59 26 3/2 59 4/29/04 9/30/98 9/30/98 7/25/12 9/30/98 3/29/11 9/30/98 7/31/01 9/30/98 9/30/98 9/30/98 9/30/98 3/29/11 9/30/98 9/30/98 9/30/98 9/30/98 3/29/11 3/29/11 7/31/01 3/29/11 9/30/98 3/29/11 7/25/12 7/25/12 4/29/04 3/29/11 10/30/09 3/29/11 9/30/98 3/29/11 3/29/11 Catawba Units 1 and 2Pae71125 Page 7 11/12/15 3.6.11-2 3.6.12-1 3.6.12-2 3.6.12-3 3.6.13-1 3.6.13-2 3.6.13-3 3.6.14-1 3.6.14-2 3.6.14-3 3.6.15-1 3.6.15-2 3.6.16-1 3.6.16-2 3.6.17-1 3.7.1-1 3.7.1=2 3.7.1-3 3.7.2-1 3.7.2-2 3.7.3-1 3.7.3-2 3.7.4-1 3.7.4-2 3.7.5-1 3.7.5-2 3.7.5-3 3.7.5-4 3.7.6-1 3.7.6-2 3.7.7-1 3.7.7-2 263/259 263/259 263/259 263/259 256/251 263/259 263/259 173/165 263/259 270/266 173/1 65 263/259 263/259 263/259 253/248 173/1 65 173/165 173/1 65 173/1 65 244/238 173/1 65 244/238 213/207 263/259 253/248 173/1 65 263/259 263/259 173/1 65 263/259 25 3/248 263/259 3/29/11 3/29/11 3/29/11 3/29/11 6/28/10 3/29/11 3/29/11 9/30/98 3/29/11 8/6/13 9/30/98 3/29/11 3/29/11 3/29/11 10/30/09 9/30/98 9/30/98 9/30/98 9/30/98 9/08/08 9/30/98 9/08/08 4/29/04 3/29/11 10/30/09 9/30/98 3/29/11 3/29/11 9/3 0/9 8 3/29/11 10/30/09 3/29/11 Catawba Units 1 and 2Pae81/25 Page 8 11/12/15 3.7.8-1 3.7.8-2 3.7.8-3 3.7.8-4 3.7.9-1 3.7.9-2 3. 7.10-1 3.7.10-2 3.7.10-3 3.7.11-1 3.7.11-2 3.7.12-1 3.7.12-2 3.7.13-1 3.7.13-2 3.7.14-1 3,7.1!5-1 3.7.16-1 3.7.16-2 3.7.16-3 3.7.17-1 3.8.1-1 3.8.1-2 3.8.1-3 3.8.1-4 3.8.1-5 3.8.1-6 3.8.1-7 3.8.1-8 3.8.1-9 3.8.1-10 3.8.1-11 271/267 271/267 271/267 271/267 263/259 263/259 250/245 260/255 263/259 198/191 26 3/2 59 253/248 263/259 198/19 1 26 3/2 59 263/259 263/259Q 233/229 233/229 233/229 263/259 253/248 173/1 65 253/248 173/1 65 263/259 263/259 263/259 263/259 263/259 263/259 263/259 08/09/13 08/09/13 08/09/13 08/09/13 3/29/11 3/29/11 7/30/09 8/9/10 3/29/11 4/23/02 3/29/11 10/30/09 3/29/11 4/23/02 3/29/11 3/29/11 3/29/11 9/27/06 9/27/06 9/27/06 3/29/11 10/30/09 9/30/98 10/30/09 9/30/98 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 3/29/11 Catawba Units 1 and 2Pae91/25 Page 9 11/12/15 3.8.1-12 3.8.1-13 3.8.1-14 3.8.1-15 3.8.2-1 3.8.2-2 3.8.2-3 3.8.3-1 3.8.3-2 3.8.3-3 3.8.4-1 3.8.4-2 3.8.4-3 3.8.4-4 3.8.4-5 3.8.5-1 3.8.5-2 3.8.6-1 3.8.6-2 3.8.6-3 3.8.6-4 3.8.6-5 3.8.7-1 3.8.7-2 3.8.8-1 3.8.8-2 3.8.9-1 3.8.9-2 3.8.9-3 3.8.10-1 3.8.10-2 3.9.1-1 263/259 263/259 263/259 263/259 173/1 65 207/201 173/1 65 175/167 263/259 263/259 173/1 65 263/259 263/2 59 263/259 262/258 173/1 65 207/201 253/248 253/248 253/248 263/259 223/218 173/1 65 263/259 173/1 65 26 3/2 59 173/1 65 173/1 65 26 3/25 9 207/201 263/259 26 3/2 59 3/29/11 3/29/11 3/29/11 3/29/11 9/30/98 7/29/03 9/30/98 1/15/99 3/29/11 3/29/11 9/30/98 3/29/11 3/29/11 3/29/11 12/20/10 9/30/98 7/29/03 10/30/09 10/30/09 10/30/09 3/29/11 4/27/05 9/30/98 3/29/11 9/30/98 3/29/11 9/30/98 9/30/98 3/29/11 7/29/03 3/29/11 3/29/11 Catawba Units 1 and 2 Pg 01/21 Page 10 11/12/15 0 3.9.2-1 3.9.2-2 3.9.3-1 3.9.3-2 3.9.4-1 3.9.4-2 3.9.5-1 3.9.5-2 3.9.6-1 3.9.7-1 4.0-1 4.0-2 5.1-1 5.2-1 5.2-2 5.2-3 5.4-1 5.5-1 5.5-2 5.5-3 5.5-4 5.5-5 5.5-6 5.5-7 5.5-7a 5.5-8 5.5-9 5.5-10 5.5-11 5.5-12 5.5-13 215/209 26 3/25 9 227/222 26 3/25 9 207/201 263/259 207/201 263/259 263/259 263/259 220/215 233/229 273/269 273/269 273/269 Deleted 273 /2=69 173/1 65 273/269 205/1 98 173/1 65 173/1 65 216/210 252/247 218/212 26 7/26 3 267/263 218/212 227/222 22 7/222 218/212 218/21.2 6/21/04 3/29/11 9/30/05 3/29/11 7/29/03 3/29/11 7/29/03 3/29/11 3/29/11 3/29/111 3/03/05 9/27/06 2/12/15 2/12/15 2/12/15 9/21/09 ,-/i-/15 9/30/98 2/12/15 3/12/03 9/30/98 9/30/98 8/5/04 10/30/09 1/13/05 3/12/12 3/12/12 1 /13/05 9/30/05 9/30/05 1 /13/05 1/13/05 Catawba Units 1 and 2 Pg 11/21 Page 11 11/12/15 0 5.5-14 5.5-15 5.5-16 5.6-1 5.6-2 5.6-3 5.6-4 5.6-5 5.6-6 5.7-1 5.7-2 218/212 263/259 263/259 222/217 253/248 222/217 275/271 275/271 275/271 273/269 173/1 65 1/13/05 3/29/11 3/29/11 3/31/05 10/30/09 3/31/05 4/14/15 4/14/15 4/14/15 2/12/15 9"/30/98 Catawba Units 1 and 2 Pg 21/21 Page 12 11/12/15 ii iii Bii1i -B 2.1.1-2 B 2.1.1-3 B 2.1.21-B 2.1.2-2 B 2.1.2-3 B 3.01.-B 3.0-2 B 3.0-3 B 3.0-4 B 3.0-5 B 3.0-6 B 3.0-7 B 3.0-8 B 3.0-9 B 3.0-10 B 3.0-11 B 3.0-12 B 3.0-13 B 3.0-14 B 3.0-15 B 3.0-16 B 3.0-17 B 3.0-18 B 3.0-19 B 3.1.1-1 thru B 3.1.1-6 BASES Revision 1 Revision 2 Revision 1 Revision 0 Revision 1 Revision I Revision 0 Revision 0 Revision 0 Revision 1 Revision 1 Revision 2 Revision 3 Revision 3 Revision 2 Revision 2 Revision 3 Revision 2 Revision 3 Revision 3 Revision 3 Revision 3 Revision 3 Revision 1 Revision 1 Revision 0 Revision 0 Revision 0 Re~iision 3 4/08199 3/01/05 6/21/04 9/30/98 12/19/03 12/19/03 9/30/98 9/30/98 9/30/98 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/1 9/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 3/19/07 5/05/11 Catawba Units 1 and 2 Pg 31/21 Page 13 11/12/15 B 3.1.2-1 thru B 3.1.2-5 B 3.1.3-1 thru B 3.1.3-6 B 3,1.4-1 thru B 3.1.4-9 B 3.1.5-1 thru B 3.1.5-4 B 3.1.6-1 thru B 3.1.6-6 B 3.1.7-1 B 3.1.7-2 B 3.1.7-3 B 3.1.7-4 B 3.1.7-5 B 3.1.7-6 B 3.1.8-1 thru B 3.1.8-6 B 3.2.1-1 thru B 3.2.1 .-Il B 3.2.2-1 thru B 3.2.2-10 B 3.2.3-1 thru B 3.2.3-4 B 3.2.4-1 thru B 3.2.4-7 B 3.3.1-1 thru B.3.3. 1-55 B 3.3.2-1 thru B 3.3.2-49 B 3.3.3-1 thru B.3.3.3-1 6 B 3.3.4-1 thru B 3.3.4-5 Revision 2 Revision 2*Revision 1 Revision 2 Revision 1*Revision 0 Revision 2 Revision 2 Revision 2 Revision 2 Revision 2 Revision 2 Revision 4 Revision 3 Revision 2 Revision 2 Revision 7 Revision 11 Revision 6 Revision 2*5/05/11 4/14/15 5/05/11 5/05/11 5/05/11 9/30/98 1/08/04 1/08/04 1/08/04 1/08/04 1/08/04 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 11/15/11 8/9/15 4/11/14 5/05/11 Catawba Units 1 and 2 Pg 41/21 Page 14 11/12/15 0 B 3.3.5-1 thru B 3.3.5-6 B 3.3.6-1 thru B 3.3.6-5 B 3.3.9-1 thru B 3.3.9-5 B 3.4.1-1 thru B 3.4.1-5 B 3.4.2-1 B 3.4.2-2 B 3.4.2-3 B 3.4.3-1 thru B 3.4.3-6 B 3.4.4-1 thru B 3.4.4-3 B 3.4.5-1 thru B 3.4.5-6 B 3.4.6-1 thru B 3.4.6-5 B 3.4.7-1 thru B 3.4.7-5 B 3.4.8-1 thru B 3.4.8-3 B 3.4.9-1 thru B 3.4.9-5 B 3.4.10-1 B 3.4.10-2 B 3.4.10-3 B 3.4.10-4 B 3.4.11-1 thru B 3.4.11-7 B 3.4.12-1 thru B 3.4.12-14 B 3.4.13-1 thru B 3.4.13-7 B 3.4.14-1 thru B 3.4.14-6 B 3.4.15-1 thru B 3.4.15-10 Catawba Units 1 and 2 Revision 2 Revision 6 Revision 3 Revision 3 Revision 0 Revision 0 Revision 0 Revision 2 Revision 2 Revision 3 Revision 4 Revision 6 Revision 3 Revision 3 Revision 1 Revision 0 Revision 1 Revision 2 Revision 4 Revision 5 Revision 7 Revision 3 Revision 6 5/05/11 08/02/12 06/02/14 5/05/11 9/30/ 98 9/30/98 9/30/ 98 5/05/11 5/05/11 5/05/11 5/05/11 2/10/1 5 5/05/11 08/02/12 3/4/04 9/30/98 3/4/04 10/30/09 5/05/11 8/19/15 3/15/12 5/05/11 5/05/11 Page 15 Page 1511/12/15 B 3.4.16-1 thru B 3.4.16-5 B 3.4.17-1 thru B 3.4.17-3 B 3.4.18-1 B 3,4.18-2 B 3.4.18-3 B 3.4.18-4 B 3.4.18-5 B 3.4.18-6 B 3.4.18-7 B 3.4.18-8 B 3.5.1-1 thru B 3.5.1-8 B 3.5.2-1 thru B 3.5.2-10 B 3.5.3-1 B 3.5.3-2 B 3.5.3-3 B 3.5.4-1 thru B. 3.5 .4-5 B 3.5.5-1 thru B 3.5.5-4 B 3.6.1-1 B 3.6.1-2 B 3.6.1-3 B 3.6.1-4 B 3.6.1-5 B 3.6.2-1 thru B 3.6.2-8 B 3.6.3-1 thru B 3.6.3-14 B 3.6.4-1 thru B 3.6.4-4 B 3.6.5-1 thru B 3.6.5-4 Revision 4 Revision 2 Revision 0 Revision 0 Revision 1 Revision 0 Revision 0 Revision 0 Revision 0 Revision 1 Revision 3 Revision 3 Revision 0 Revision 1 Revision 1 Revision 5 Revision 1 Revision 1 Revision 1 Revision 1 Revision 1 Revision 1 Revision 2 Revision 4 Revision 2 Revision 3 10/23/12 5/05/11 1113/05 1/13/05 3/18/08 1/13/05 1/13/05 1/13/05 1/13/05 3/18/08 5/05/11 5/05/11 9/30/98 4/29/04 4/29/04 4/11/14 5/05/11 7/31/01 7/31/01 7/31/01 7/31/01 7/3 1/0 1 5/05/11 5/05/11 5/05/11 07/27/13 Catawba Units 1 and 2 Pg 61/21 Page 16 11/12/15 0 B 3.6.6-1 thru B 3.6.6-7 B 3.6.8-1 thru B 3.6.8-5 B 3.6.9-1 thru B 3.6.9-5 B 3.6.10-1 thru B 3.6.10-6 B 3.6.11-1 thru B 3.6.11-6 B 3.6.12-1 thru B 3.6.12-11 B 3.6.13-1 thru B 3.6.13-9 B 3.6.14-1 thru B 3.6.14-5 B 3.6.15-1 thru B 3.6.15-4 B 3.6.16-1 thru B 3.6.16-4 B 3.6.17-i B 3.6.17-2 B 3.6.17-3 B 3.6.17-4 B 3.6.17-5 B 3.7.1-1 B 3.7.1-2 B 3.7.1-3 B 3.7.1-4 B 3.7.1-5 B 3.7.2-1 B 3.7.2-2 B 3.7.2-3 B 3.7.2-4 B 3.7.2-5 B 3.7.3-1 B 3.7.3-2 Catawba Units 1 and 2 Revision 6 Revision 3 Revision 6 Revision 2 Revision 5 Revision 5 Revision 4 Revision 2 Revision 1 Revision 3 Revision i Revision 0 Revision 0 Revision 0 Revision 1 Revision 0 Revision 0 Revision 0 Revision 1 Revision 1 Revision 0 Revision 0 Revision 2 Revision 1 Revision 3 Revision 0 Revision 0 Page 17 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 4/11/14 5/05/11 5/05/11 3/13/08 9/30/98 9/30/98 9/30/98 3/13/08 9/30/98 9/30/98 9/30/98 10/30/09 10/30/09 9/30/98 9/30/98 6/23/10 9/08/08 10/30/09 9/30/98 9/30/98 11/12/15 B 3.7.3-3 B 3,7.3-4, B 3.7.3-5 B 3.7.3-6 B 3.7.4-1 thru B 3.7.4-4 B 3.7.5-1 thru B 3.7.5-9 B 3.7.6-1 thru B 3.7.6-3 B 3.7.7-1 thru B 3.7.7-5 B 3.7,8-1 thru B 3.7.8-8 B 3.7.9-1 thru3.7.9-4 B 3.7.10-1 thru B 3.7.10-9 B 3.7.11-1 thru B 3.7,1!-4 B 3.7.12-1 thru B 3.7.12-7 B 3.7.13-1 thru B 3.7.13-5 B 3.7.14-1 thru B 3.7.14-3 B 3.7.15-1 thru B 3.7.15-4 B 3.7.16-1 B 3.7.16-2 B 3.7.16-3 B 3.7.16-4 B 3.7.17-1 thru B3 3.7.17-3 B 3.8.1-1 thru B.3.8. 1-29 B 3.8.2-1 B 3.8.2-2 Revision 0 Revision 0 Revision 1 Revision 2 Revision 2 Revision 3 Revision 4 Revision 2 Revision 5 Revision 3 Revision 10 Revision 3 Revision 6 Revision 4 Revision 2 Revision 2 Revision 2 Revision 2 Revision 2 Revision 0 Revision 2 Revision 5 Revision 0 Revision 0 9/ 30/98 9/30/98 9/08/08 10/30/09 5/05/11 5/05/11 08/02/12 5/05/11 08/09/13 5/05/11 10/24/11 10/24/11 1/09/13 5/05/11 5/05/11 5/05/11 9/27/06 9/27/06 9/27/06 9/27/06 5/05/11 07/27/13 9/30/98 9/30/98 Catawba Units 1 and 2 Pg 81/21 Page 18 11/12/15 B 3.8.2-3 B 3.8.2-4 B 3.8.2-5 B 3.8.2-6 B 3.8.3-1 thru B 3.8.3-8 B 3.8.4-1 thru B3.8.4. 10 B 3.8.5-1 B 3.8.5-2 B 3.8.5-3 B 3.8.6-1 thru B 3.8.6-7 B 3.8.7-1 thru B 3.8.7-4 B 3.8.8-1 thru B 3.8.8-4 B 3.8.9-1 thru B 3.8.9-10 B 3.8.10-1 thru B 3.8.10-4 B 3.9.1-1 thru B 3.9.1-4 B 3.9.2-1 thru B 3.9.2.4 B 3.9.3-1 thru B 3.9.3-5 B 3.9.4-1 thru B 3.9.4-4 B 3.9.5-1 thru B 3.9.5-4 B 3.9.6-1 thru B 3.9.6-3 B 3.9.7-1 thru B 3.9.7-3 Revision 0 Revision 1 Revision 2 Revision 1 Revision 4 Revision 10 Revision 0 Revision 2 Revision 1 Revision 4 Revision 3 Revision 3 Revision 2 Revision 3 Revision 3 Revision 4 Revision 4 Revision 4 Revision 3 Revision 2 Revision 1 9/30/98 5/10/05 5/10/05 5/10/05 5/05/11 5/05/11 9/30/98 7/29/03 7/29/03 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 5/05/11 Catawba Units 1 and 2Pae1 Page 19 11/12/15 ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND The ESFAS initiates necessary safety systems, based on the values of selected unit parameters, to protect against violating core design limits and the Reactor Coolant System (RCS) pressure boundary, and to mitigate accidents.
The ESFAS instrumentation is segmented into three distinct but interconnected modules as identified below:* Field transmitters or process sensors and instrumentation:
provide a measurable electronic signal based on the physical characteristics of the parameter being measured;* Signal processing equipment including analog protection system, field contacts, and protection channel sets: provide signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board/control room/miscellaneous indications; and* Solid State Protection System (SSPS) including input, logic, and output bays: initiates the proper unit shutdown or engineered safety feature (ESF) actuation in accordance with the defined logic and based on the bistable outputs from the signal process control and protection system.Field Transmitters or Sensors To meet the design demands for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters.
In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS).In some cases, the same channels also provide control system inputs.To account for calibration tolerances and instrument drift, which is assumed to occur between calibrations, statistical allowances are Catawba Units 1 and 2B332-ReionN.1 B 3.3.2-1 ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued) provided in the NOMINAL TRIP SETPOINT.
The OPERABILITY of each transmitter or sensor can be evaluated when its "as found" calibration data are compared against its documented acceptance criteria.Siginal Processinqi Eqiuipment Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments.
The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses.
These setpoints are defined in UFSAR, Chapter 6 (Ref. 1), Chapter 7 (Ref. 2), and Chapter 15 (Ref. 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the SSPS for decision logic processing.
Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing.
Some unit parameters provide input only to the SSPS, while others provide input to the SSPS, the main control board, the unit computer, and one or more control systems.Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy.
If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic.Generally, if a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy.
The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
Again, a single failure will neither cause nor prevent the protection function actuation.
These requirements are described in IEEE-279-1 971 (Ref. 4). The actual number of channels required for each unit parameter is specified in the UFSAR.Catawba Units 1 and 2B3322ReionN.1 B 3.3.2-2 ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
Trip Setpoints and Allowable Values The NOMINAL TRIP SETPOINTS are the nominal values at which the bistables are set. Any bistable is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CALIBRATION tolerance.
The NOMINAL TRIP SETPOINTS used in the bistables are based on the analytical limits (Ref. 1, 2, and 3). The selection of these NOMINAL TRIP SETPOINTS is such that adequate protection is provided when all sensor and processing time delays, calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 5) are taken into account. The actual as-left setpoint of the bistable assures that the actual trip occurs before the Allowable Value is reached. The Allowable Value accounts for changes in random measurement errors detectable by a COT. One example of such a change in measurement error is drift during the surveillance interval.
If the point at which the loop trips does not exceed the Allowable Value, the loop is considered OPERABLE.A trip within the Allowable Value ensures that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.Each channel can be tested on line to verify that the signal processing equipment and setpoint accuracy is within the specified allowance requirements.
Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated.
SRs for the channels are specified in the SR section.The determination of the NOMINAL TRIP SETPOINTS and Allowable Values listed in Table 3.3.2-1 incorporates all of the known uncertainties applicable for each channel. The magnitudes of these uncertainties are factored into the determination of each NOMINAL TRIP SETPOINT.
All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these-uncertainty magnitudes.
Catawba Units 1 and 2B3323ReionN.1 B3.3.2-3 ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)
Solid State Protection System The SSPS equipment is used for the decision logic processing of outputs from the signal processing equipment bistables.
To meet the redundancy requirements, two trains of SSPS, each performing the same functions, are provided.
If one train is taken out of service for maintenance or test purposes, the second train will provide ESE actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result.Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements.
The SSPS performs the decision logic for most ESF= equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit.The bistable outputs from the signal processing equipment are sensed by the SSPS equipment and combined into logic matrices that represent combinations indicative of various transients.
If a required logic matrix combination is completed, the system will send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition.
Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.Each SSPS train has a built in testing device that can test the decision logic matrix functions and the actuation devices while the unit is at power.When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.
The testing device is semiautomatic to minimize testing time.The actuation of ESE components is accomplished through master and slave relays. The SSPS energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices. The master and slave relays are routinely tested to ensure operation.
The test of the master relays energizes the relay, which then operates the contacts and applies a low voltage to the associated slave relays. The low voltage is not sufficient to actuate the slave relays but only demonstrates signal Catawba Units 1 and 2B332-ReionN.1 B3.3.2-4 ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued) path continuity.
The SLAVE RELAY TEST actuates the devices if their operation will not interfere with continued unit operation.
For the latter case, actual component operation is prevented by the SLAVE RELAY TEST circuit, and slave relay contact operation is verified by a continuity check of the circuit containing the slave relay.APPLICABLE Each of the analyzed accidents can be detected by one or SAFETY ANALYSES, more ESFAS Functions.
One of the ESFAS Functions is the LCO, AND primary actuation signal for that accident.
An ESFAS Function APPLICABILITY may be the primary actuation signal for more than one type of accident.An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents.
For example, Pressurizer Pressure--Low is a primary actuation signal for small loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) outside containment.
Functions such as manual initiation, not specifically credited in the accident safety analysis, are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance.
These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).The LCO requires all instrumentation performing an ESFAS Function to be OPERABLE.
Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.
The LCO generally requires OPERABILITY of three or four channels in each instrumentation function and two channels in each logic and manual initiation function.
The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing an ESFAS initiation.
Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents.
ESFAS protection functions are as follows: Catawba Units 1 and 2B3325ReionN.1 B 3.3.2-5 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
- 1. .Safety Injection Safety Injection (SI) provides two primary functions:
- 1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 2200°F); and 2. Boration to ensure recovery and maintenance of SDM (kerr < 1.0).These functions are necessary to mitigate the effects of high energy line breaks (HELBs) both inside and outside of containment.
The SI signal is also used to initiate other Functions such as:* Phase A Isolation;
- Containment Purge and Exhaust Isolation;
- Reactor Trip;* Turbine Trip;* Feedwater Isolation;
- Start of motor driven auxiliary feedwater (AFW)pumps;* Start of control room area ventilation filtration trains;* Enabling automatic switchover of Emergency Core Cooling Systems (ECCS) suction to containment sump;* Start of annulus ventilation system filtration trains;* Start of auxiliary building filtered ventilation exhaust system trains;* Start of diesel generators Catawba Units 1 and 2B332-ReionN.1 B 3.3.2-6 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
- Start of nuclear service water system pumps; and* Start of component cooling water system pumps.These other functions ensure:* Isolation of nonessential systems through containment penetrations;
- Trip of the turbine and reactor to limit power generation;
- Isolation of main feedwater (MEW) to limit secondary side mass losses;* Start of AFW to ensure secondary side cooling capability;
- Filtration of the control room to ensure habitability;
- Enabling ECCS suction from the refueling water storage tank (RWST) switchover on low RWST level to ensure continued cooling via use of the containment sump;* Starting of annulus ventilation and auxiliary building filtered ventilation to limit offsite releases;* Starting of diesel generators for loss of offsite power considerations; and* Starting of component cooling water and nuclear service water systems for heat removal.a. Safety Iniection-Manual Initiation The LCO requires two channels to be OPERABLE.
The operator can initiate SI at any time by using either of two switches in the control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.
Catawba Units 1 and 2B332-ReionN.1 B3.3.2-7 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Each train consists of one push button and the interconnecting wiring to the actuation logic cabinet. This configuration does not allow testing at power.b. Safety Iniection-Automatic Actuation Loqic and Actuation Relays This LCO requires two trains to be OPERABLE.
Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.
Manual and automatic initiation of SI must be OPERABLE in MODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.
These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and resPond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.
Unit pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.c. Safety Iniection-Containment Pressure-Hi~qh This signal provides protection against the following accidents:
- SLB inside containment;
- LOCA; and*Feed line break inside containment.
Catawba Units 1 and 2B332-ReionN.1 B3.3.2-8 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Containment Pressure-High provides no input to any control functions.
Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic: Containment Pressure-High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment.
- d. Safety Iniection-Pressurizer Pressure-Low This signal provides protection against the following accidents:
- Inadvertent opening of a steam generator (SG) relief or safety valve;* SLB;* A spectrum of rod cluster control assembly ejection accidents (rod ejection);
- Inadvertent opening of a pressurizer relief or safety valve;* LOCAs; and* SG Tube Rupture.Pressurizer pressure provides both control and protection functions:
input to the Pressurizer Pressure Control System, reactor trip, and SI. Therefore, the actuation logic must be able to withstand both an input failure to control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.Catawba Units 1 and 2B332-ReionN.1 B3.3.2-9 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
This Function must be OPERABLE in MODES 1, 2, and 3 (above P-I11) to mitigate the consequences of an HELB inside containment.
This signal may be manually blocked by the operator below the P-1 1 setpoint.
Automatic SI actuation below this pressure setpoint is then performed by the Containment Pressure-High signal.This Function is not required to be OPERABLE in MODE 3 below the P-Il setpoint.
Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.
- 2. Deleted.3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment.
This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.There are two separate Containment Isolation signals, Phase A and Phase B. Phase A isolation isolates all automatically isolable process lines, except component cooling water (CCW) and nuclear service water system (NSWS), at a relatively low containment pressure indicative of primary or secondary system leaks. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required)method of decay heat removal. Since CCW and NSWS are required to support ROP operation, not isolating CCW and NSWS on the low pressure Phase A signal enhances unit safety by allowing operators to use forced RCS circulation to cool the unit.Isolating CCW and NSWS on the low pressure signal may force the use of feed and bleed cooling, which could prove more difficult to control.Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-10 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LOCO, and APPLICABILITY (continued)
Phase A containment isolation is actuated automatically by SI, or manually via the actuation circuitry.
All process lines penetrating containment, with the exception of CCW and NSWS, are isolated.CCW is not isolated at this time to permit continued operation of the RCPs with cooling water flow to the thermal barrier heat exchangers and air or oil coolers. All process lines not equipped with remote operated isolation valves are manually closed, or otherwise isolated, prior to reaching MODE 4.Manual Phase A Containment Isolation is accomplished by either of two switches in the control room. Either switch actuates its associated train.The Phase B signal isolates CCW and NSWS. This occurs at a relatively high containment pressure that is indicative of a large break LOCA or an SLB. For these events, forced circulation using the RCPs is no longer desirable.
Isolating the CCW and NSWS at the higher pressure does not pose a challenge to the containment boundary because the CCW System and NSWS are closed loops inside containment.
Although some system components do not meet all of the ASME Code requirements applied to the containment itself, the systems are continuously pressurized to a pressure greater than the Phase B setpoint.
Thus, routine operation demonstrates the integrity of the system pressure boundary for pressures exceeding the Phase B setpoint.Furthermore, because system pressure exceeds the Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment.
Therefore, the combination of CCW System and NSWS design and Phase B isolation ensures there is not a potential path for radioactive release from containment.
Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-11 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Phase B containment isolation is actuated by Containment Pressure-High High, or manually, via the automatic actuation logic, as previously discussed.
For containment pressure to reach a value high enough to actuate Containment Pressure-High High, a large break LOCA or SLB must have occurred.
RCP operation will no longer be required and CCW to the RCPs and NSWS to the RCP motor coolers are, therefore, no longer necessary.
The RCPs can be operated with seal injection flow alone and without CCW flow to the thermal barrier heat exchanger.
Manual Phase B Containment Isolation is accomplished by pushbuttons on the main control board. In addition to manually initiating a Phase B Containment Isolation, the pushbuttons also isolate the containment ventilation system.a. Containment Isolation-Phase A Isolation (1) Phase A Isolation-Manual Initiation Manual Phase A Containment Isolation is actuated by either of two switches in the control room. Each switch actuates its respective train.(2) Phase A Isolation-Automatic Actuation Lo~qic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.Manual and automatic initiation of Phase A Containment Isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a Phase A Containment Isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-12 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) system level manual initiation.
In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase A Containment Isolation.
There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.
(3) Phase A Isolation-Safety Iniection Phase A Containment Isolation is also initiated by all Functions that initiate SI. The Phase A Containment Isolation requirements for these Functions are the same as the requirements for their SI function.Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.
- b. Containment Isolation-Phase B Isolation Phase B Containment Isolation is accomplished by manual Initiation, Automatic Actuation Logic and Actuation Relays, and by Containment Pressure channels.
The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips that may damage the RCPs.(1) Phase B Isolation-Manual Initiation (2) Phase B Isolation-Automatic Actuation Loqjic and Actuation Relays Manual and automatic initiation of Phase B containment isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA. However, because of the large number of components actuated on a Phase B Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-13 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) containment isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.
In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase B containment isolation.
There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.
(3) Phase B Isolation-Containment Pressure -High-High Containment Pressure -High-High uses four channels in a two-out-of-four logic configuration.
Since containment pressure is not used for control, this arrangement exceeds the minimum redundancy requirements.
Additional redundancy is warranted because this Function is energize to trip.Containment Pressure -High-High must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break.In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to pressurize the containment and reach the Containment Pressure -High-High setpoints.
- 4. Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment.
Rapid isolation of the steam lines will limit the steam break accident to the blowdown from one SG, at most. For an SLB upstream of the main steam isolation valves (MSIVs), inside or outside of containment, closure of the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSIVs terminates the accident as soon as the steam lines depressurize.
Steam Line Isolation also mitigates the effects of a feed line break and ensures a source of steam for the turbine driven AFW pump during a feed line break.Catawba Units 1 and 2.B3321ReionN.1 B 3.3.2-14 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
- a. Steam Line Isolation-Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two system level switches in the control room and either switch can initiate action to immediately close all MSIVs. The LCO requires two channels to be OPERABLE.
Individual valves may also be closed using individual hand switches in the control room. The LCO requires four individual channels to be OPERABLE.b. Steam Line Isolation-Automatic Actuation Loqic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB or other accident.
This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed and de-activated.
In MODES 4, 5, and 6, there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.c. Steam Line Isolation-Containment Pressure-Higqh High This Function actuates closure of the MSIVs in the event of a LOCA or an SLB inside containment to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment.
Containment Pressure-High High uses four channels in a two-out-of-four logic configuration.
Since containment pressure is not used for control, this arrangement exceeds the minimum redundancy requirements.
Additional redundancy is warranted because this Function is energize to trip.Containment Pressure-High High must be OPERABLE in MODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection Catawba Units 1 and 2 B3321 eiinN.1 B3.3.2-15 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) and closure of the MSIVs. The Steam Line Isolation Function remains OPERABLE in MODES 2 and 3 unless all MSIVs are closed and de-activated.
In MODES 4, 5, and 6, there is not enough energy. in the primary and secondary sides to pressurize the containment to the Containment Pressure-High High setpoint.d. Steam Line Isolation-Steam Line Pressure Steam Line Pressure channels provide both protection and control functions.
The protection functions include: Steam Line Pressure-Low and Steam Line Pressure-Negative Rate functions.
The control functions include: Digital Feedwater Control System (DECS) which controls SG level.(1) Steam Line Pressure-Low Steam Line Pressure-Low provides closure of the MSIVs in the event of an SLB to maintain three unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment.
This Function provides closure of the MSIVs in the event of a feed line break to ensure a supply of steam for the turbine driven AFW pump.DFCS receives steam pressure inputs from three separate protection channels for each SG. The three inputs are median selected for each SG, with the resultant output being used by the automatic control algorithm.
The median select feature prevents the failure of an input signal from affecting the control system. A loss of two or more input signals will place the control system in manual and alert the operator.DFCS will maintain a steady control function during the switch to manual operation; therefore, a failure of one or more input signals will not cause a control system action that would result in a condition requiring protective actions. Thus, three OPERABLE channels on each steam line, with a two-out-of-three logic on each steam line, are sufficient to satisfy protective requirements.
Steam Line Pressure-Low Function must be OPERABLE in MODES 1, 2, and 3 (above P-i11), with any main steam valve open, when a secondary side Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-16 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) break or stuck open valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator below the P-i11 setpoint.
Below P-i11, an inside containment SLB will be terminated by automatic actuation via Containment Pressure-High High. Stuck valve transients and outside containment SLBs will be terminated by the Steam Line Pressure-Negative Rate-High signal for Steam Line Isolation below P-i11 when SI has been manually blocked. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSlVs are closed and de-activated.
This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.(2) Steam Line Pressure-Neciative Rate-Hicjh Steam Line Pressure-Negative Rate-High provides closure of the MSlVs for an SLB when less than the P-i11 setpoint, to maintain at least one unfaulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.
When the operator manually blocks the Steam Line Pressure-Low main steam isolation signal when less than the P-1 1 setpoint, the Steam Line Pressure-Negative Rate-High signal is automatically enabled. DFCS receives steam pressure inputs from three separate protection channels for each SG. The three inputs are median selected for each SG, with the resultant output being used by the automatic control algorithm.
The median select feature prevents the failure of an input signal from affecting the control system. A loss of two or more input signals will place the control system in manual and alert the operator.
DFCS will maintain a steady control function during the switch to manual operation; therefore, a failure of one or more input signals will not cause a control system action that would result in a condition requiring protective actions. Thus, three OPERABLE channels on each steam line, with a two-out-of-three logic on each steam line, are sufficient to satisfy protective requirements.
Catawba Units 1 and 2 B3321 eiinN.i B 3.3.2-17 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Steam Line Pressure-Negative Rate-High must be OPERABLE in MODE 3 when less than the P-i11 setpoint, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). In MODES 1 and 2, and in MODE 3, when above the P-11I setpoint, this signal is automatically disabled and the Steam Line Pressure-Low signal is automatically enabled. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless all MSIVs are closed and de-activated.
In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to have an SLB or other accident that would result in a release of significant enough quantities of energy to cause a cooldown of the RCS.5. Turbine Trip and Feedwater Isolation The primary functions of the Turbine Trip and Feedwater Isolation signals are to prevent damage to the turbine due to water in the steam lines, stop the excessive flow of feedwater into the SGs, and to limit the energy released into containment.
These Functions are necessary to mitigate the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows. Feedwater Isolation serves to limit the energy released into containment upon a feedwater line or steam line break inside containment.
The Functions are actuated when the level in any SG exceeds the high high setpoint, and performs the following functions:
- Trips the main turbine;* Trips the MFW pumps;* Initiates feedwater isolation; and* Shuts the MFW regulating valves and the bypass feedwater regulating valves.Turbine Trip and Feedwater Isolation signals are both actuated by SG Water Level-High High, or by an SI signal. The RTS also initiates a turbine trip signal whenever a reactor trip (P-4) is generated.
A Feedwater Isolation signal is also generated by a Catawba Units 1 and 2 B3321 eiinN.1 B 3.3.2-18 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) reactor trip (P-4) coincident with Ta,,gLow and on a high water level in the reactor building doghouse.
The MEW System is also taken out of operation and the AFW System is automatically started. The SI signal was discussed previously.
- a. Turbine Trip (1) Turbine Tripj-Automatic Actuation Loqic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.(2) Turbine Tripj-Steam Generator Water Level-Higqh Higqh (P-14)This signal prevents damage to the turbine due to water in the steam lines. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation.
Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.The setpoints are based on percent of narrow range instrument span.(3) Turbine Trip-Safety Iniection Turbine Trip is also initiated by all Functions that initiate SI. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 1, SI, is referenced for all initiating functions and requirements.
Item 5.a.(1) is referenced for the applicable MODES.The Turbine Trip Function must be OPERABLE in MODES 1 and 2. In lower MODES, the turbine generator is not in service and this Function is not required to be OPERABLE.b. Feedwater Isolation Catawba Units 1 and 2 B3321 eiinN.1 B3.3.2-19 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
(1) Feedwater Isolation-Automatic Actuation Loqic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.(2) Feedwater Isolation-Steam Generator Water Level-Hi~qh Hicqh (P-14)This signal provides protection against excessive feedwater flow. The ESFAS SG water level instruments provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation.
Thus, four OPERABLE channels are required to satisfy the requirements with a two-out-of-four logic.The setpoints are based on percent of narrow range instrument span.(3) Feedwater Isolation-Safety Iniection Feedwater Isolation is also initiated by all Functions that initiate SI. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI function.
Therefore, the requirements are not repeated in Table 3.3.2-1.Instead Function 1, SI, is referenced for all initiating functions and requirements.
Item 5.b.(1) is referenced for the applicable MODES.(4) Feedwater Isolation
-RCS Low coincident with Reactor Trip (P-4)This signal provides protection against excessive cooldown, which could subsequently introduce a positive reactivity excursion after a plant trip. There are four channels of RCS Tavg -Low (one per loop), with a two-out-of-four logic required coincident with a reactor trip signal (P-4) to initiate a feedwater isolation.
The P-4 interlock is discussed in Function 8.a.Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-20 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
(5) Feedwater Isolation
-Doqhouse Water Level -Hiqh This signal initiates a Feedwater Isolation.
The signal terminates forward feedwater flow in the event of a postulated pipe break in the main feedwater piping in the doghouses to prevent flooding safety related equipment essential to the safe shutdown of the plant. Each doghouse contains two trains of level instrumentation.
The level instrumentation consists of six level switches (three per train) in each of the two reactor building doghouses.
A high-high level detected by two-out-of-three switches, in either the inboard or outboard doghouse, will initiate a doghouse isolation.
This signal initiates Feedwater Isolation for the specific doghouse where the High-High level is detected and trips both main feedwater pumps thus causing a main turbine trip.The Feedwater Isolation Function must be OPERABLE in MODES 1 and 2 and also in MODE 3 (except for the functions listed in Table 3.3.2-1).
Feedwater Isolation is not required OPERABLE when all MFIVs, MFCVs, and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In lower MODES, the MFW System is not in service and this Function is not required to be OPERABLE.6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available.
The system has two motor driven pumps and a turbine driven pump, making it available during normal and accident operation.
The normal source of water for the AFW System is the condensate storage system (not safety related).
A low suction pressure to the AFW pumps will automatically realign the pump suctions to the Nuclear Service Water System (NSWS)(safety related).
The AFW System is aligned so that upon a pump start, flow is initiated to the respective SGs immediately.
- a. Auxiliary Feedwater-Automatic Actuation Loq ic and Actuation Relays Automatic actuation logic and actuation relays consist of the Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-21 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCD, and APPLICABILITY (continued) same features and operate in the same manner as described for ESFAS Function 1 .b.b. Auxiliary Feedwater-Steam Generator Water Level-Low Low SG Water Level-Low Low provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. SG Water Level-Low Low provides input to the SG Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system which may then require a protection function actuation and a single failure in the other channels providing the protection function actuation.
Thus, four OPERABLE channels are required to satisfy the requirements with two-out-of-four logic. The setpoints are based on percent of narrow range instrument span.SG Water Level--Low Low in any operating SG will cause the motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level--Low Low in any two operating SGs will cause the turbine driven pumps to start.c. Auxiliary Feedwater--Safety Iniection An SI signal starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function.
Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.
- d. Auxiliary Feedwater-Loss of Offsite Power A loss of offsite power to the service buses will be accompanied by a loss of reactor coolant pumping power and the subsequent need for some method of decay heat removal. The loss of offsite power is detected by a voltage drop on each essential service bus. Loss of power to either essential service bus will start the turbine driven and motor driven AFW pumps to ensure that at least two SGs contain enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip.Catawba Units 1 and 2B332-2RvsoNo1 B 3.3.2-22 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
Functions 6.a through 6.d must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor.These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.
- e. Auxiliary Feedwater-Trip of All Main Feedwater Pumps A Trip of all MFW pumps is an indication of a loss of MEW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure.
Each turbine driven MFW pump is equipped with three pressure switches on the trip oil system. A low pressure signal from two-out-of-three of these pressure switches indicates a trip of that pump. Three OPERABLE channels per pump satisfy redundancy requirements with two-out-of-three logic. A trip of all MEW pumps starts the motor driven AFW pumps to ensure that at least two SGs are available with water to act as the heat sink for the reactor. This function must be OPERABLE in MODES 1 and 2. This ensures that at least two SGs are provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident.
In MODES 3, 4, and 5, the MEW pumps may be normally shut down, and thus neither pump trip is indicative of a condition requiring automatic AFW initiation.
- f. Auxiliary Feedwater-Pump Suction Transfer on Suction Pressure-Low A low pressure signal in the AFW pump suction line protects the AFW pumps against a loss of the normal supply of water for the pumps, the condensate storage system. Three pressure switches per train are located on the AFW pump suction line from the condensate storage system. A low pressure signal sensed by two-out-of-three switches will align their train related motor driven AFW pump and the turbine driven AFW pump to the assured water supply (NSWS). The NSWS (safety grade) is then lined up to supply the AFW pumps to ensure an adequate supply of water for the AFW Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-23 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
System to maintain at least two of the SGs as the heat sink for reactor decay heat and sensible heat removal.This Function must be OPERABLE in MODES 1, 2, and 3 to ensure a safety grade supply of water for the AFW System to maintain the SGs as the heat sink for the reactor. This Function does not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW automatic suction transfer does not need to be OPERABLE because RHR will already be in operation, or sufficient time is available to place RHR in operation, to remove decay heat.7. Automatic Switchover to Containment Sump At the end of the injection phase of a LOCA, the RWST will be nearly empty. Continued cooling must be provided by the ECOS to remove decay heat. The source of water for the ECCS pumps is automatically switched to the containment recirculation sump. The low head residual heat removal (RHR) pumps and containment spray pumps draw the water from the containment recirculation sump, the RHR pumps pump the water through the RHR heat exchanger, inject the water back into the RCS, and supply the cooled water to the other ECCS pumps. Switchover from the RWST to the-containment sump must occur before the RWST empties to prevent damage to the RHR pumps and a loss of core cooling capability.
- a. Automatic Switchover to Containment Sump-Automatic Actuation Locqic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1 .b.b. Automatic Switchover to Containment Sump-Refuelinq Water Stora~qe Tank (RWST)Level-Low Coincident With Safety Iniection During the injection phase of a LOCA, the RWST is the source of water for all ECCS pumps. A low level in the RWST coincident with an SI signal provides protection against a loss of water for the ECCS pumps and indicates the end of the injection phase of the LOCA. The RWST is equipped with four level transmitters.
These transmitters Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-24 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) provide no control functions.
Since an inadvertent switchover to the containment sump could have a significant safety impact, this instrumentation is placed in a bypass condition for testing. Therefore, four channels are supplied such that, during testing, the remaining three channels could perform the intended function, and no single failure could result in either a failure to accomplish the intended function, or in an inadvertent switchover to the containment sump.Automatic switchover occurs only if the RWST low level signal is coincident with SI. This prevents accidental switchover during normal operation.
Accidental switchover could damage ECCS pumps if they are attempting to take suction from an empty sump. The automatic switchover Function requirements for the SI Functions are the same as the requirements for their SI function.
Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.
These Functions must be OPERABLE in MODES 1, 2, 3, and 4 when there is a potential for a LOCA to occur, to ensure a continued supply of water for the ECOS pumps.These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.
System pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.8. Engqineered Safety Feature Actuation System Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlock Functions back up manual actions to ensure bypassable functions are in operation under the conditions assumed in the safety analyses.Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-25 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
- a. Engineered Safety Feature Actuation System Interlocks--Reactor Trip. P-4 The P-4 interlock is enabled when a reactor trip breaker (RTB) and its associated bypass breaker is open. Operators are able to reset SI 60 seconds after initiation.
If a P-4 is present when SI is reset, subsequent automatic SI initiations will be blocked until the RTBs have been manually closed.This Function allows operators to take manual control of SI systems after the initial phase of injection is complete while avoiding multiple SI initiations.
The functions of the P-4 interlock are:* Trip the main turbine;* Isolate MFW with coincident low Tavg;* Prevent reactuation of SI after a manual reset of SI;* Transfer the steam dump from the load rejection controller to the unit trip controller; and* Prevent opening of the MFW isolation valves if they were closed on SI or SG Water Level--High High.Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS following a reactor trip. An excessive cooldown of the RCS following a reactor trip could cause an insertion of positive reactivity with a subsequent increase in generated power. To avoid such a situation, the noted Functions have been interlocked with P-4 as part of the design of the unit control and protection system.None of the noted Functions serves a mitigation function in the unit licensing basis safety analyses.
Only the turbine trip Function is explicitly assumed since it is an immediate consequence of the reactor trip Function.
Neither turbine trip, nor any of the other four Functions associated with the reactor trip signal, is required to show that the unit licensing basis safety analysis acceptance criteria are not exceeded.The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts.
Therefore, this Function has no adjustable Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-26 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) trip setpoint with which to associate a Trip Setpoint and Allowable Value.This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may be critical or approaching criticality.
This Function does not have to be OPERABLE in MODE 4, 5, or 6 because the main turbine, the MFW System, and the Steam Dump System are not in operation.
- b. Engqineered Safety Feature Actuation System Interlocks-Pressurizer Pressure.
P-11I The P-i1I interlock permits a normal unit cooldown and depressurization without actuation of SI or main steam line isolation.
With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-i11 setpoint, the operator can manually block the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal (previously discussed).
When the Steam Line Pressure-Low steam line isolation signal is manually blocked, a main steam isolation signal on Steam Line Pressure-Negative Rate-High is enabled. This provides protection for an SLB by closure of the MSIVs. With two-out-of-three pressurizer pressure channels above the P-i11 setpoint, the Pressurizer Pressure-Low SI signal and the Steam Line Pressure-Low steam line isolation signal are automatically enabled. The operator can also enable these trips by use of the respective manual reset buttons. When the Steam Line Pressure-Low steam line isolation signal is enabled, the main steam isolation on Steam Line Pressure-Negative Rate--High is disabled.This Function must be OPERABLE in MODES 1, 2, and 3 to allow an orderly cooldown and depressurization of the unit without the actuation of SI or main steam isolation.
This Function does not have to be OPERABLE in MODE 4, 5, or 6 because system pressure must already be below the P-i1!setpoint for the requirements of the heatup and cooldown curves to be met.c. Engqineered Safety Feature Actuation System lnterlocks-T~v-Low Low. P-i12 On increasing reactor coolant temperature, the P-12 interlock provides an arming signal to the Steam Dump System. On a Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-27 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) decreasing temperature, the P-i12 interlock removes the arming signal to the Steam Dump System to prevent an excessive cooidown of the RCS due to a malfunctioning Steam Dump System.Since Tavg is used as an indication of bulk RCS temperature, this Function meets redundancy requirements with one OPERABLE channel in each loop. These channels are used in two-out-of-four logic. This Function must be OPERABLE in MODES 1, 2, and 3 when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. This Function does not have to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to have an accident.9. Containment Pressure Control System Permissives The Containment Pressure Control System (CPCS) protects the Containment Building from excessive depressurization by preventing inadvertent actuation or continuous operation of the Containment Spray and Containment Air Return Systems when containment pressure is at or less than the CPCS permissive setpoint.
The control scheme of CPCS is comprised of eight independent control circuits (4 per train), each having a separate and independent pressure transmitter and current alarm module.Each pressure transmitter monitors the containment pressure and provides input to its respective current alarm. The current alarms are set to inhibit or terminate containment spray and containment air return systems when containment pressure falls to or below 0.25 psid. The alarm modules switch back to the permissive state (allowing the systems to operate) when containment pressure is greater than or equal to 1.0 psid.This function must be OPERABLE in MODES 1, 2, :3, and 4 when there is sufficient energy in the primary and secondary sides to pressurize containment following a pipe break. In MODES 5 and 6, there is insufficient energy in the primary and secondary sides to significantly pressurize the containment.
- 10. Nuclear Service Water System Suction Transfer -Low Pit Level Upon an emergency low pit level signal from either NSWS pit, interlocks isolate the NSWS from Lake Wylie, align NSWS to the standby nuclear service water pond, close particular crossover Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-28 ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) valves, and start the NSWS pumps. This function is initiated on a two-out-of-three logic from either NSWS pump pit.This function must be OPERABLE in MODES 1, 2, 3, and 4 to ensure cooling water remains available to essential components during a DBA. In MODES 5 and 6, the sufficient time exists for manual operator action to realign the NSWS pump suction, if required.Unlike other shared NSWS equipment, the pit level interlocks do not require both normal and emergency power for OPERABILITY.
This is because unlike mechanical components such as pumps and valves, the interlocks are designed to fail safe upon a loss of power, initiating a transfer from Lake Wylie to the standby nuclear service water pond. The definition of OPERABILITY, which requires either normal or emergency power, provides sufficient power supply requirements and these interlocks can be considered OPERABLE provided they are powered from either an inverter or regulated power.The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36 (Ref.6).ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1. When the Required Channels in Table 3.3.2-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.
A channel shall be OPERABLE if the point at which the channel trips is found more conservative than the Allowable Value. In the event a channel's trip setpoint is found less conservative than the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected.
If plant conditions warrant, the trip setpoint may be set outside the NOMINAL TRIP SETPOINT calibration tolerance band as long as the trip setpoint is conservative with respect to the NOMINAL TRIP SETPOINT.
If the trip setpoint is found outside of the NOMINAL TRIP SETPOINT calibration tolerance band and non-conservative with respect to the NOMINAL TRIP SETPOINT, the setpoint shall be re-adjusted.
Catawba Units 1 and 2 B3322 eiinN.1 B 3.3.2-29 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
When the number of inoperable channels in a trip function exceed those specified in one or other related Conditions associated with a trip function, then the unit is outside the safety analysis.
Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.
A.__1 Condition A applies to all ESFAS protection functions.
Condition A addresses the situation where one or more channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected.
The Completion Times are those from the referenced Conditions and Required Actions.B.1, B.2.1 and B.2.2 Condition B applies to manual initiation of:* SI;* Containment Spray;* Phase A Isolation; and* Phase B Isolation.
This action addresses the train orientation of the SSPS for the functions listed above. If a channel or train is inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is allowed to return it to an OPERABLE status. Note that for containment spray and Phase B isolation, failure of one or both channels in one train renders the train inoperable.
Condition B, therefore, encompasses both situations.
The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each Function, and the low probability of an event occurring during this interval.
If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (54 hours6.25e-4 days <br />0.015 hours <br />8.928571e-5 weeks <br />2.0547e-5 months <br /> total time) and in MODE 5 within an additional 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> (84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> total time). The allowable Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-30 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1. 0.2.1 and 0.2.2 Condition C applies to the automatic actuation logic and actuation relays for the following functions:
- SI;* Phase A Isolation;
- Phase B Isolation; and* Automatic Switchover to Containment Sump.This action addresses the train orientation of the SSPS and the master and slave relays. If one train is inoperable, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are allowed to restore the train to OPERABLE status. The 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed for restoring the inoperable train to OPERABLE status is justified in Reference
- 13. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> total time) and in MODE 5 within an additional 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> (60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> total time). The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing, provided the other train is OPERABLE.
The Required Actions are not required to be met during this time, unless the train is discovered inoperable during the testing. This allowance is based on the reliability analysis assumption of WCAP-1 0271-P-A (Ref. 7) that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the average time required to perform train surveillance.
Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-31 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1, D.2.1. and D.2.2 Condition 0 applies to:* Containment Pressure-High;
- Pressurizer Pressure-Low;
- Steam Line Pressure-Low;
- Steam Line Pressure-Negative Rate-High;
- Loss of offsite power (refer to Condition D footnote);
- SG Water level--Low Low; and* SG Water level--High High (P-14) for the Feedwater Isolation Function.If one channel is inoperable, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> are allowed to restore the channel to OPERABLE status or to place it in the tripped condition.
Generally this Condition applies to functions that operate on two-out-of-three logic.Therefore, failure of one channel places the Function in a two-out-of-two configuration.
One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed to restore the channel to OPERABLE status or to place it in the tripped condition is justified in Reference 13.Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels.
The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed for testing is justified in Reference 13.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-32 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
E.1. E.2.1, and E.2.2 Condition E applies to:* Containment Phase B Isolation Containment Pressure-High High;and* Steam Line Isolation Containment Pressure -High High.Neither of these signals has input to a control function.
Thus, two-out-of-.
three logic is necessary to meet acceptable protective requirements.
However, a two-out-of-three design would require tripping a failed channel. This is undesirable because a single failure would then cause spurious isolation initiation.
Therefore, these channels are designed with two-out-of-four logic so that a failed channel may be bypassed rather than tripped. Note that one channel may be bypassed and still satisfy the single failure criterion.
Furthermore, with one channel bypassed, a single instrumentation channel failure will not spuriously initiate isolation.
To avoid the inadvertent actuation of Phase B containment isolation, the inoperable channel should not be placed in the tripped condition.
Instead it is bypassed.
Restoring the channel to OPERABLE status, or placing the inoperable channel in the bypass condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, is sufficient to assure that the Function remains OPERABLE and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The Completion Time is further justified based on the low probability of an event occurring during this interval.
Failure to restore the inoperable channel to OPERABLE status, or place it in the bypassed condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows one additional channel to be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing.Placing a second channel in the bypass condition for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for testing purposes is acceptable based on the results of Reference 13.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-33 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
F.1, F.2.1, and F.2.2 Condition F applies to:* Manual Initiation of Steam Line Isolation; and* P-4 Interlock.
For the Manual Initiation and the P-4 Interlock Functions, this action addresses the train orientation of the SSPS. If a train or channel is inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of these Functions, the available redundancy, and the low probability of an event occurring during this interval.
If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.G.1 and G.2 Condition G applies to manual initiation of Steam Line Isolation.
This action addresses the operability of the manual steam line isolation function for each individual main steam isolation valve. If a channel is inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is allowed to return it to an OPERABLE status. If the train cannot be restored to OPERABLE status, the Conditions and Required Actions of LCO 3.7.2, "Main Steam Isolation Valves," must be entered for the associated inoperable valve. The specified Completion Time is reasonable considering that there is a system level manual initiation train for this Function and the low probability of an event occurring during this interval.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-34 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
H.1, H.2.1 and H.2.2 Condition H applies to the automatic actuation logic and actuation relays for the Steam Line Isolation, Feedwater Isolation, and AFW actuation Functions.
The action addresses the train orientation of the SSPS and the master and slave relays for these functions.
If one train is inoperable, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are allowed to restore the train to OPERABLE status. The 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed for restoring the inoperable train to OPERABLE status is justified in Reference
- 13. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
If the train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of the protection channels and actuation functions.
In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing provided the other train is OPERABLE.
This allowance is based on the reliability analysis (Ref. 7) assumption that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the average time required to perform channel surveillance.
Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-35 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 1.1 and 1.2 Condition I appiies to the automatic actuation logic and actuation relays for the Turbine Trip Function.This action addresses the train orientation of the SSPS and the master and slave relays for this Function.
If one train is inoperable, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are allowed to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed for restoring the inoperable train to OPERABLE status is justified in Reference
- 13. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. These Functions are no longer required in MODE 3. Placing the unit in MODE 3 removes all requirements for OPERABILITY of the protection channels and actuation functions.
In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing provided the other train is OPERABLE.
This allowance is based on the reliability analysis (Ref. 7) assumption that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the average time required to perform channel surveillance.
J.1 and J.2 Condition J applies to:* SG Water Level--High High (P-14) for the Turbine Trip Function;and* Tavg-LOw.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-36 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
If one channel is inoperable, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> are allowed to restore one channel to OPERABLE status or to place it in the tripped condition.
If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-three logic will result in actuation.
The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed to restore the channel to OPERABLE status or place it in the tripped condition is justified in Reference
- 13. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Time of 78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels.
The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed to place the inoperable channel in the tripped condition, and the 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed for a second channel to be in the bypassed condition for testing, are justified in Reference 13.K.1 and K.2 Condition K applies to the AFW pump start on trip of all MFW pumps.This action addresses the auto start function of the AFW System on loss of all MFW pumps. The OPERABILITY of the AFW System must be assured by allowing automatic start of the AFW System pumps. If a channel is inoperable, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is allowed to return it to an OPERABLE status or to place the channel in trip. If the function cannot be returned to an OPERABLE status or placed in a trip condition, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to place the unit in MODE 3. The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, the unit does not have any analyzed transients or conditions that require the explicit use of the protection function noted above.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-37 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
L.1 and L.2 Condition L applies to the Doghouse Water Level -High High.If one channel is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore the channel to OPERABLE status or to place it in the tripped condition.
Therefore, failure of one channel places the Function in a two-out-of-two configuration.
One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.
Alternatively, if the inoperable channel is not restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, the unit must be placed in MODE 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, this Function is no longer required OPERABLE.Required Action L.1 is modified by a Note that allows the inoperable channel to be bypassed for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing of other channels.M.1, M.2.1 and M.2.2 Condition M applies to the Auxiliary Feedwater Pumps Suction Transfer on Suction Pressure Low.If one channel is inoperable, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is allowed to restore the channel to OPERABLE status or to place it in the tripped condition.
The failure of one channel places the Function in a two-out-of-two configuration.
One channel must be tripped to place the Function in a one-out-of-three configuration that satisfies redundancy requirements.
Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-38 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, this Function is no longer required OPERABLE.N.1, N.2.1 and N.2.2 Condition N applies to:* RWST Level--Low Coincident with Safety Injection.
RWST Level--Low Coincident With SI provides actuation of switchover to the containment sump. Note that this Function requires the bistables to energize to perform their required action. The failure of up to two channels will not prevent the operation of this Function.
However, placing a failed channel in the tripped condition could result in a premature switchover to the sump, prior to the injection of the minimum volume from the RWST. Placing the inoperable channel in bypass results in a two-out-of-three logic configuration, which satisfies the requirement to allow another failure without disabling actuation of the switchover when required.
Restoring the channel to OPERABLE status or placing the inoperable channel in the bypass condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is sufficient to ensure that the Function remains OPERABLE, and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Completion Time is justified in Reference
- 7. If the channel cannot be returned to OPERABLE status or placed in the bypass condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, the unit must be brought to MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 5 within the next 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows placing a second channel in the bypass condition for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing. The total of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to reach MODE 3 and 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for a second channel to be bypassed is acceptable based on the results of Reference 7.Catawba Units 1 and 2 B3323 eiinN.1 B 3.3.2-39 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued) 0.1, 0.2.1 and 0.2.2 Condition 0 applies to the P-11 and P-12 interlocks.
With one channel inoperable, the operator must verify that the interlock is in the required state for the existing unit condition.
This action manually accomplishes the function of the interlock.
Determination must be made within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is equal to the time allowed by LCO 3.0.3 to initiate shutdown actions in the event of a complete loss of ESFAS function.
If the interlock is not in the required state (or placed in the required state) for the existing unit condition, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of these interlocks.
P.1 Condition P applies to the Containment Pressure Control System Start and Terminate Permissives.
With one or more channels inoperable, the affected containment spray and containment air return systems components must be declared inoperable immediately.
The supported system LCOs provide the appropriate Required Actions and Completion Times for the equipment made inoperable by the inoperable channel. The immediate Completion Time is appropriate since the inoperable channel could prevent the supported equipment from starting when required.
Additionally, protection from an inadvertent actuation may not be provided if the terminate function is not OPERABLE.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-40 ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)
Q.1, Q.2. Q.3.1. and Q.3.2 With one channel of NSWS Suction Transfer -Low Pit Level inoperable in one or more NSWS pits, 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> are allowed to place it in the tripped condition or align the NSWS to the Standby NSWS Pond. The failure of one channel places the Function in a two-out-of-two configuration.
The failed channel must either be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements, or the NSWS realigned to fulfill the safety function.Failure to place the channel in the tripped condition or to realign the NSWS suction and discharge within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 5 within the next 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.The requirement to align the NSWS to the Standby NSWS Pond only applies to OPERABLE trains of the system.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, this Function is no longer required OPERABLE.R.1. R.2.1, and R.2.2 With two or more channels of NSWS Suction Transfer -Low Pit Level inoperable in one or more pits, the NSWS must be aligned to the Standby NSWS Pond within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Failure to accomplish the realignment within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 5 within the next 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.The requirement to align the NSWS to the Standby NSWS Pond only applies to OPERABLE trains of the system.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, this Function is no longer required OPERABLE.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-41 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE The SRs for each ESFAS Function are identified by the SRs column REQUIREMENTS of Table 3.3.2-1.A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions.
Note that each channel of process protection supplies both trains of the ESFAS. When testing channel I, train A and train B must be examined.Similarly, train A and train B must be examined when testing channel II, channel Ill, and channel IV (if applicable).
The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.
SR 3.3.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred.
A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels.
It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and reliability.
If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.2 SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST. The SSPS is tested using the semiautomatic tester. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation.
Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-42 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
Through the semiautomatic tester, all possible logic combinations, with and without applicable permissives, are tested for each protection function.
In addition, the master relay coil is pulse tested for continuity.
This verifies that the logic modules are OPERABLE and that there is an intact voltage signal path to the master relay coils. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.3 SR 3.3.2.3 is the performance of a TADOT. This test is a check of the Loss of Offsite Power Function.
Each Function is tested up to, and including, the master transfer relay coils.This test also includes trip devices that provide actuation signals directly to the SSPS. The SR is modified by a Note that excludes final actuation of pumps and valves to minimize plant upsets that would occur. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.4 SR 3.3.2.4 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a low voltage continuity check of the slave relay coil. Upon master relay contact operation, a low voltage is injected to the slave relay coil. This voltage is insufficient to pick up the slave relay, but large enough to demonstrate signal path continuity.
The time allowed for the testing (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) is justified in Reference
- 7. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.5 SR 3.3.2.5 is the performance of a COT.A COT is performed on each required channel to ensure the channel will perform the intended Function.
The tested portion of the loop must trip within the Allowable Values specified in Table 3.3.2-1.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-43 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
The setpoint shall be left set consistent with the assumptions of the setpoint methodology.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.6 SR 3.3.2.6 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is placed in a condition where the relay contact operation can be verified without operation of the equipment.
Actuation equipment that may not be operated in the design mitigation MODE is prevented from operation by the SLAVE RELAY TEST circuit. For this latter case, contact operation is verified by a continuity check of the circuit containing the slave relay. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.For slave relays or any auxiliary relays in the ESFAS circuit that are of the type Westinghouse AR or Potter & Brumfield MDR, the SLAVE RELAY TEST Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.3.2.7 SR 3.3.2.7 is the performance of a COT on the RWST level and Containment Pressure Control Start and Terminate Permissives.
A COT is performed on each required channel to ensure the entire channel will perform the intended Function.
Setpoints must be found conservative with respect to the Allowable Values specified in Table 3.3.2-1. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-44 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions" has been implemented, this SR is modified by two Notes as identified in Table 3.3.2-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology.
The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.
The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the NOMINAL TRIP SETPOINT (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint.
This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.
If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable.
The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances be in the UFSAR.SR 3.3.2.8 SR 3.3.2.8 is the performance of a TADOT. This test is a check of the Manual Actuation Functions, AFW pump start on trip of all MFW pumps, AFW low suction pressure, Reactor Trip (P-4) Interlock, and Doghouse Water Level -High High Feedwater Isolation.
Each Manual Actuation Function is tested up to, and including, the master relay coils. In some instances, the test includes actuation of the end device (i.e., pump starts, valve cycles, etc.). The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. The SR is modified by a Note that excludes verification of setpoints during the TADOT for manual initiation Functions.
The manual initiation Functions have no associated setpoints.
Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-45 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
SIR 3.3.2.9 SIR 3.3.2.9 is the performance of a CHANNEL CALIBRATION.
CHANNEL CALIBRATION is a complete check of the instrument ioop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note stating that this test should include verification that the time constants are adjusted to the prescribed values where applicable.
The applicable time constants are shown in Table 3.3.2-1.For Functions for which TSTF-493, "Clarify Application of Setpoint Methodology for LSSS Functions" has been implemented, this SR is modified by two Notes as identified in Table 3.3.2-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology.
The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.
The second Note requires that the as-left setting for the channel be returned to within the as-left tolerance of the NOMINAL TRIP SETPOINT (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures (field setting), the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint.
This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.
If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-46 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued) channel shall be declared inoperable.
The second Note also requires that the methodologies for calculating the as-left and the as-found tolerances be in the UFSAR.SR 3.3.2.10 This SR ensures the individual channel ESE RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis.Response Time testing acceptance criteria are included in the UFSAR (Ref. 2). Individual component response times are not modeled in the analyses.
The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the Trip Setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position).
For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate UFSAR response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be obtained from: (1) historical records based on acceptable response time tests (hydraulic, noise, or power interrupt tests), (2) inplace, onsite, or offsite (e.g. vendor)test measurements, or (3) utilizing vendor engineering specifications.
WCAP-13632-P-A Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the WCAP. In addition, while not specifically identified in the WCAP, ITT Barton 386A and 580A-0 sensors were compared to sensors which were identified.
It was concluded that the WCAP results could be applied to these two sensor types as well. Response time verification for other sensor types must be demonstrated by test.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-47 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
WCAP-1 4036-P-A Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" provides the basis and methodology for using allocated signal processing and actuation logic response times in the overall verification of the protection system channel response time.The allocations for sensor, signal conditioning and actuation logic response times must be verified prior to placing the component in operational service and re-verified following maintenance that may adversely affect response time. In general, electrical repair work does not impact response time provided the parts used for repair are of the same type and value. Specific components identified in the WCAP may be replaced without verification testing. One example where response time could be affected is replacing the sensing assembly of a transmitter.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.This SR is modified by a Note that clarifies that the turbine driven AEW pump is tested within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after reaching 600 psig in the SGs.SR 3.3.2.11 SR 3.3.2.11 is the performance of a COT on the NSWS Suction Transfer-Low Pit Level.A COT is performed on each required channel to ensure the entire channel will perform the intended Function.
Setpoints must be found within the Allowable Values specified in Table 3.3.2-1. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-48 ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.3.2.12 SR 3.3.2.12 is the performance of an ACTUATION LOGIC TEST on the Doghouse Water Level-High High and NSWS Suction Transfer-Emergency Low Pit Level Functions.
An ACTUATION LOGIC TEST to satisfy the requirements of GL 96-01 is performed on each instrumentation to ensure all logic combinations will initiate the appropriate Function.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
- 1. UFSAR, Chapter 6.2. UFSAR, Chapter 7.3. UFSAR, Chapter 15.4. IEEE-279-1971.
- 5. 10 CFR 50.49.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
- 7. WCAP-1 0271-P-A, Supplement 1 and Supplement 2, Rev. 1, May 1986 and June 1990.8. WCAP-1 3632-P-A Revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" Sep., 1995.9. WCAP-1 4036-P-A Revision 1, "Elimination of Periodic Protection Channel Response Time Tests" Oct., 1998.10. Not used.11. Not used.12. Not used.13. WCAP-14333-P-A, Revision 1, October 1998.14. Not used.Catawba Units 1 and 2 B3324 eiinN.1 B 3.3.2-49 LTOP System B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)B 3.4.12 Low Temperature Overpressure Protection (LTOP) System BASES BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (PIT) limits of 10 CFR 50, Appendix G (Ref. 1 ). The reactor vessel is the limiting RCPB component for demonstrating such protection.
This specification provides the maximum allowable actuation logic setpoints for the power operated relief valves (PORVs) and LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," provides the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES.The reactor vessel material is less tough at low temperatures than at normal operating temperature.
As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.
The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition.
Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3 requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the specified limits.This LCO provides RCS overpressure protection by having a minimum coolant input capability and having adequate pressure relief capacity.Limiting coolant input capability requires all but two pumps incapable of injection into the RCS, isolating the accumulators, and limiting reactor coolant pump operation at low temperatures.
The pressure relief capacity requires two redundant RCS relief valves. One RCS relief valve is the overpressure protection device that acts to terminate an increasing pressure event.With minimum coolant input capability, the ability to provide core coolant addition is restricted.
The LCO does not require the makeup control Catawba Units 1 and 2B34121RvsoN.5 B 3.4.12-1 Revision No. 5 LTOP System B 3.4.12 BASES BACKGROUND (continued) system deactivated or the safety injection (SI) actuation circuits blocked.Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve. If conditions require the use of more than one charging pump for makeup in the event of loss of inventory, then additional pumps can be made available through manual actions.The LTOP System for pressure relief consists of two PORVs with reduced lift settings or two residual heat removal (RHR) suction relief valves or one PORV and one RHR suction relief valve. Two RCS relief valves are required for redundancy.
One RCS relief valve has adequate relieving capability to keep from overpressurization for the required coolant input capability.
PORV Requirements As designed for the LTOP System, each PORV is signaled to open if the RCS pressure reaches 400 psig (as left calibrated), allowable value < 425 psig (as found), when the PORVS are in the "io-press" mode of operation.
If the PORVs are being used to meet the requirements of this Specification, then indicated ROS cold leg temperature is limited to >_ 70°F in accordance with the LTOP analysis.
When all Reactor Coolant Pumps are secured, this temperature is measured at the outlet of the residual heat removal heat exchanger.
This location will provide the most conservative (lower) temperature measurement of water capable of being delivered into the Reactor Coolant System. The LTOP actuation logic monitors both RCS temperature and RCS pressure.
The signals used to generate the pressure setpoints originate from the wide range pressure transmitters.
The signals used to generate the temperature permissives originate from the wide range RTDs. Each signal is input to the appropriate NSSS protection system cabinet where it is converted to an internal signal and then input to a comparator to generate an actuation signal. If the indicated pressure meets or exceeds the calculated value, a PORV is signaled to open.This Specification presents the PORV setpoints for LTOP. Having the setpoints of both valves within the limits ensures that the Reference 1 limits will not be exceeded in any analyzed event.When a PORV is opened in an increasing pressure transient, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.Catawba Units 1 and 2B34122RvsoN.5 B 3.4.12-2 Revision No. 5 LTOP System B 3.4.12 BASES BACKGROUND (continued)
RHR Suction Relief Valve Requirements During LTOP MODES, the RHR system is operated for decay heat removal and low-pressure letdown control. Therefore, the RHR suction isolation valves (there are two suction isolation valves per line) are open in the piping from the ROS hot legs to the inlets of the RHR pumps. While these valves are open, the RHR suction relief valves are exposed to the RCS and are able to relieve pressure transients in the RCS.The RHR suction isolation valves must be open with operator power removed to make the RHR suction relief valves OPERABLE for RCS overpressure mitigation.
The RHR suction relief valves are spring loaded, bellows type water relief valve with pressure tolerances and accumulation limits established by Section III of the American Society of Mechanical Engineers (ASME) Code (Ref. 8) for Class 2 relief valves.APPLICABLE Safety analyses (Ref. 3) demonstrate that the reactor vessel is adequately SAFETY ANALYSES protected against exceeding the Reference 1 P/T limits. In MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature exceeding 210°F, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At about 21 0 0 F and below, overpressure prevention falls to two OPERABLE RCS relief valves. Each of these means has a limited overpressure relief capability.
The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement.
Each time the P/T curves are revised, the LTOP System must be re-evaluated to ensure its functional requirements can still be met using the RCS relief valve method.Any change to the RCS must be evaluated against the Reference 3 analyses to determine the impact of the change on the LTOP acceptance limits.Transients that are capable of overpressurizing the ROS are categorized as either mass or heat input transients, examples of which follow: Mass Input Type Transients
- a. Inadvertent safety injection of one safety injection pump and one charging pump; or b. Charging/letdown flow mismatch.Catawba Units 1 and 2B34123RvsoN.5 B 3.4.12-3 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)
Heat Input Type Transients
- a. Inadvertent actuation of pressurizer heaters;b. Loss of RHR cooling; or c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.
The following are required during the LTOP MODES to ensure that mass and heat input transients do not occur, which either of the LTOP overpressure protection means cannot handle: a. Rendering all but two pumps incapable of injection;
- b. Deactivating the accumulator discharge isolation valves in their closed positions;
- c. Limiting RCP operation based on the existing temperature in the ROS cold legs; and d. Disallowing start of an RCP if secondary temperature is more than 50°F above primary temperature in any one loop. LCO 3.4.6, "RCS Loops--MODE 4," and LCO 3.4.7, "RCS Loops--MODE 5, Loops Filled," provide this protection'.
The Reference 3 analyses demonstrate that one RCS relief valve can maintain RCS pressure below limits when any two pumps (charging and/or safety injection) are actuated.
Thus, the LCO allows two pumps OPERABLE during the LTOP MODES. The LCO also requires the accumulators be isolated when accumulator pressure is greater than or equal to the maximum ROS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3.The isolated accumulators must have their discharge valves closed and power removed.The restrictions on the number of RCPs in operation at a given temperature ensures that during a LTOP mass injection event that the pressure/temperature (PIT) limits of 10 CFR 50, Appendix G to protect the Catawba Units 1 and 2B34124RvsoN.5 B 3.4.12-4 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued) reactor vessel are not exceeded.
During startup and shutdown, when the RCPs are operated, their induced flows create a pressure drop across the vessel. This pressure drop along with the difference in elevation between the beitline region and the instrumentation locations are additive to the peak pressure from the mass injection event.The amount of the pressure at the reactor vessel beltline region from the RCPs is dependent on the number of RCPs operated.
Adequate margin to prevent exceeding the P/T limits is assured by restricting the number of RCPs operated.
Since LTOP events are basically acknowledged as being steady-state events, these RCP operating restrictions are designed to work with the LTOP setpoint to provide protection from exceeding the steady-state Appendix G P/T limits.Fracture mechanics analyses established the temperature of LTOP Applicability at 210°F.The consequences of a small break loss of coolant accident (LOCA) in LTOP MODE 4 conform to 10 CFR 50.46 and 10 CFR 50, Appendix K (Refs. 4 and 5), requirements by having a maximum of two pumps (charging and/or safety injection)
OPERABLE and SI actuation enabled.PORV Performance The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the specified limit. The setpoints are derived by analyses that model the performance of the LTOP System, assuming the limiting LTOP transient of one charging pump and one safety injection pump injecting into the RCS. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensures the Reference 1 PIT limits will be met.The PORV setpoints will be updated when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation.
Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens.
The Bases for LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," discuss these examinations.
Catawba Units 1 and 2B34125RvsoN.5 B 3.4.12-5 Revision No. 5 LTOP System B 3.4.12 BAS ES APPLICABLE SAFETY ANALYSES (continued)
The PORVs are considered active components.
Thus, the failure of one PORV is assumed to represent the worst case, single active failure.RHR Suction Relief Valve Performance The RHR suction relief valves do not have variable pressure and temperature lift setpoints like the PORVs. Analyses show that one RHR suction relief valve with a setpoint at or between 417 psig and 509 psig will pass flow greater than that required for the limiting LTOP transient while maintaining RCS pressure less than the P/T limit curve. Assuming all relief flow requirements during the limiting LTOP event, an RHR suction relief valve will maintain RCS pressure to within the valve rated lift setpoint, plus an accumulation
< 10% of the rated lift setpoint.Although each RHR suction relief valve may itself meet single failure criteria, its inclusion and location within the RHR system does not allow it to meet single failure criteria when spurious RHR suction isolation valve closure is postulated.
Also, as the RCS P/T limits are decreased to reflect the loss of embrittlement, the RHR suction relief valves must be analyzed to still accommodate the design basis transients for LTOP.The RHR suction relief valves are considered to be active components.
Thus, the failure of one valve is assumed to represent the worst case single active failure.The LTOP System satisfies Criterion 2 of 10 CFR 50.36 (Ref. 6).LCO This LCO requires that the LTOP System is OPERABLE.
The LTOP System is OPERABLE when the minimum coolant input and pressure relief capabilities are OPERABLE.
Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient.
To limit the coolant input capability, the LCO permits a maximum of two pumps (charging and/or safety injection) capable of injecting into the RCS and requires all accumulator discharge isolation valves closed and immobilized when accumulator pressure is greater than or equal to the maximum ROS pressure for the existing RCS cold leg temperature allowed in LCO 3.4.3. The LCO also limits ROP operation based on existing RCS cold leg temperature as required by the LTOP analysis.The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are: Catawba Units 1 and 2B34126RvsoN.5 B 3.4.12-6 Revision No. 5 LTOP System B 3.4.12 BASES LCO (continued)
- a. Two OPERABLE PORVs (NC-32B and NC-34A); or A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set to the specified limit and testing proves its automatic ability to open at this setpoint, and motive power is available to the valve and its control circuit. The following restrictions are placed on PORV OPERABILITY for LTOP due to commonalities between the PORV power supplies and letdown isolation:
- NC-32B is not OPERABLE for LTOP if excess letdown is in service.* NC-32B is not OPERABLE for LTOP if normal letdown is in service and centrifugal charging pump B is in operation.
- NC-34A is not OPERABLE for LTOP if normal letdown is in service.b. Two OPERABLE RHR suction relief valves (ND-3 and ND-38); or An RHR suction relief valve is OPERABLE for LTOP when both of its RHR suction isolation valves are open, its setpoint is at or between 417 psig and 509 psig, and testing has proven its ability to open in this pressure range.c. One OPERABLE PORV and one OPERABLE RHR suction relief valve.Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.
APPLICABILITY This LCO is applicable in MODE 4 when any ROS cold leg temperature is< 210°F, in MODE 5, and in MODE 6 when the reactor vessel head is on.The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above 21 0°F. When the reactor vessel head is off, overpressurization cannot occur.LCO 3.4.3 provides the operational P/T limits for all MODES. LCO 3.4.10,"Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above 21 0°F.Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows Catawba Units 1 and 2B34127RvsoN.5 B 3.4.12-7 Revision No. 5 LTOP System B 3.4.12 BASES APPLICABILITY (continued) operator action to mitigate the event.The Applicability is modified by a Note stating that accumulator isolation is only required when the accumulator pressure is more than or at the maximum RCS pressure for the existing temperature, as allowed by the P/T limit curves. This Note permits the accumulator discharge isolation valve Surveillance to be performed only under these pressure and temperature conditions.
ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable LTOP system. There is an increased risk associated with entering MODE 4 from MODE 5 with LTOP inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
A.1 With more than two pumps (charging and/or safety injection) capable of injecting into the RCS, ROS overpressurization is possible.To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency.of removing the RCS from this condition.
B._11 With RCP operation not limited in accordance with Table 3.4.12-1, RCS overpressurization is possible.To immediately initiate action to limit pump operation reflects the urgency of removing the RCS from this condition.
C.1, D.1, and D.2 An unisolated accumulator requires isolation within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This is only required when the accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.If isolation is needed and cannot be accomplished in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, Required Action D.1 and Required Action D.2 provide two options, either of which must be performed in the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. By increasing the ROS Catawba Units 1 and 2B34128RvsoN.5 B 3.4.12-8 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued) temperature to > 21 0°F, an accumulator pressure of 678 psig cannot exceed the LTOP limits if the accumulators are fully injected.Depressurizing the accumulators below the LTOP limit also gives this protection.
The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.E.1I In MODE 4 when any RCS cold leg temperature is < 210°F, with one RCS relief valve inoperable, the RCS relief valve must be restored to OPERABLE status within a Completion Time of 7 days. Two RCS relief valves (in any combination of the PORVs and RHR suction relief valves)are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component.
The Completion Time considers the facts that only one of the RCS relief valves is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low.F. 1 The consequences of operational events that will overpressurize the RCS are more severe at lower temperature (Ref. 7). Thus, with one of the two RCS relief valves inoperable in MODE 5 or in MODE 6 with the head on Completion Time to restore two valves to OPERABLE status is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.The Completion Time represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one OPERABLE RCS relief valve to protect against overpressure events.Catawba Units 1 and 2B34129RvsoN.5 B 3.4.12-9 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued)
G.1 and G.2 Steps must be taken immediately to limit potential mass input into the RCS, and the RCS must be depressurized and a vent must be established within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> when: a. Both required RCS relief valves are inoperable; or b. A Required Action and associated Completion Time of Condition A, 0, E, or F is not met; or c. The LTOP System is inoperable for any reason other than Condition A, C, D, E, or F.The Reference 3 analyses demonstrate that with the mass input into the RCS reduced to that of one injection pump (charging or safety injection) an RCS vent of> 4.5 square inches can maintain RCS pressure below limits. Therefore the Condition requires action to be taken immediately to reduce the input to that of one injection pump (charging or safety injection) prior to commencing RCS pressure reduction and establishing the required RCS vent. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle fracture of the reactor vessel.The capacity of a vent this size is greater than the flow of the limiting transient for the LTOP configuration, one charging pump or one safety injection pump OPERABLE, maintaining RCS pressure less than the maximum pressure on the P/T limit curve. The required vent capacity may be provided by one or more vent paths. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.The RCS vent size will be re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material su rveil lance.The ROS vent is passive and is not subject to active failure.The Completion Time considers the time required to place the plant in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.
Catawba Units 1 and 2 B341-0Rvso o B 3.4.12-10 Revision No. 5 LTOP System B 3.4.12 BASES ACTIONS (continued)
G.3 The ROS vent of > 4.5 square inches is proven OPERABLE by verifying its open condition either: a. Once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for a valve that is not locked, (valves that are sealed or secured in the open position are considered "locked" in this context);
or b. Once every 31 days for other vent path(s) (e.g., a vent valve that is locked, sealed or secured in position or a removed pressurizer safety valve or open manway also fits this category).
The passive vent valve arrangement must only be open to be OPERABLE.
This Required Action is required to be performed if the vent is being used to satisfy the pressure relief requirements of Required Action G.2.Catawba Units 1 and 2 B341-1Rvso o B 3.4.12-11 Revision No. 5 LTOP System B 3.4.12 BASES SURVEILLANCE SR 3.4.12.1 and SR 3.4.12.2 REQU IREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, a maximum of two pumps (charging and/or safety injection) are verified capable of injecting into the RCS and the accumulator discharge isolation valves are verified closed and power removed.The pumps are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control. An alternate method of LTOP control may be employed using at least two independent means to prevent a pump start such that a single failure or single action will not result in an injection into the RCS. This may be accomplished through two valves in the discharge flow path being closed.The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.12.3 Each required RHR suction relief valve shall be demonstrated OPERABLE by verifying its RHR suction isolation valves are open and by testing it in accordance with the Inservice Testing Program. This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet this LCO.The RHR suction isolation valves are verified to be opened. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The ASME Code (Ref. 9), test per Inservice Testing Program verifies OPERABILITY by proving relief valve mechanical motion and by measuring and,. if required, adjusting the lift setpoint.SR 3.4.12.4 The PORV block valve must be verified open to provide the flow path for each required PORV to perform its function when actuated.
The valve must be remotely verified open in the main control room. This Surveillance is performed if the PORV satisfies the LCO.The block valve is a remotely controlled, motor operated valve. The Catawba Units 1 and 2 B341-2Rvso o B 3.4.12-12 LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued) power to the valve operator is not required removed, and the manual operator is not required locked in the inactive position.
Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.SR 3.4.12.5 Performance of a COT is required within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after decreasing RCS temperature to < 21 0°F and periodically on each required PORV to verify and, as necessary, adjust its lift setpoint.
The COT will verify the setpoint is within the allowed maximum limits. PORV actuation could depressurize the RCS and is not required.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency considers the unlikelihood of a low temperature overpressure event during this time.A Note has been added indicating that this SR is required to be met 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after decreasing RCS cold leg temperature to < 210°F. The COT cannot be performed until in the LTOP MODES when the PORV lift setpoint can be reduced to the LTOP setting. The test must be performed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after entering the LTOP MODES.SR 3.4.12.6 Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.Catawba Units 1 and 2 B341-3Rvso o B 3.4.12-13 Revision No. 5 LTOP System B 3.4.12 BAS ES SURVEILLANCE REQUIREMENTS (continued)
SR 3.4.12.7 Each required RHR suction relief valve shall be demonstrated OPERABLE by verifying its RHR suction isolation valves are open and by testing it in accordance with the Inservice Testing Program. (Refer to SR 3.4.12.3 for the RHR suction isolation valves Surveillance and for a description of the Inservice Testing Program.)
This Surveillance is only required to be performed if the RHR suction relief valve is being used to meet this LCO.The RHR suction isolation valves are verified open, with power to the valve operator removed and locked in the removed position, to ensure that accidental closure will not occur. The "locked open in the removed position" power supply must be locally verified in its open position with the power supply to the valve locked in its inactive position.
The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.REFERENCES
- 1. 10 CFR 50, Appendix G.2. Generic Letter 88-1 1.3. UFSAR, Section 5.2 4. 10 CFR 50, Section 50.46.5. 10 CFR 50, Appendix K.6. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).
- 7. Generic Letter 90-06.8. ASME, Boiler and Pressure Vessel Code,Section III.9. ASME Code for Operation and Maintenance of Nuclear Power Plants.Catawba Units 1 and 2 B341-4Rvso o B 3.4.12-14 Revision No. 5