CP-201201129, License Amendment Request (LAR) 12-005, Revision to Technical Specification 3.3.1, Reactor Trip System (RTS) Instrumentation and 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation

License Amendment Request (LAR)12-005, Revision to Technical Specification 3.3.1, Reactor Trip System (RTS) Instrumentation and 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation

ML12285A091
Person / Time
Site:	Comanche Peak
Issue date:	10/02/2012
From:	Flores R Luminant Power, Luminant Generation Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
CP-201201129, TXX-12139, LAR 12-005
Download: ML12285A091 (79)

Text

Rafael Flores Luminant Power Senior Vice President P.O. Box 1002

& Chief Nuclear Officer 6322 North FM 56 rafael.flores@luminant.com Glen Rose, TX 76043 Lum inant T 254 897 5590 C 817 559 0403 F 254 897 6652 CP-201201129 Ref:

10 CFR 50.90 TXX-12139 October 2, 2012 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

SUBJECT:

COMANCHE PEAK NUCLEAR POWER PLANT (CPNPP) DOCKET NOS. 50-445 AND 50-446, LICENSE AMENDMENT REQUEST (LAR)12-005, REVISION TO TECHNICAL SPECIFICATIONS 3.3.1, "REACTOR TRIP SYSTEM (RTS) INSTRUMENTATION" AND 3.3.2, "ENGINEERED SAFETY FEATURE ACTUATION SYSTEM (ESFAS)

INSTRUMENTATION."

Dear Sir or Madam:

Pursuant to 10CFR50.90, Luminant Generation Company LLC (Luminant Power) hereby requests an amendment to the CPNPP Unit 1 Operating License (NPF-87) and CPNPP Unit 2 Operating License (NPF-89) by incorporating the attached change into the CPNPP Unit 1 and 2 Technical Specifications (TS).

This change request applies to both Units.

The proposed change will revise TS 3.3.1 entitled "Reactor Trip System (RTS) Instrumentation" and TS 3.3.2 entitled "Engineered Safety Feature Actuation System (ESFAS) Instrumentation" to relocate the requirements for one RTS instrument Function and two ESFAS instrument Functions to the Technical Requirements Manual, a licensee document controlled under 10CFR50.59. The RTS instrument Function proposed for relocation is the reactor trip on Pressurizer Water Level - High (RTS Function number 9).

The two ESFAS instrument Functions proposed for relocation are the Auxiliary Feedwater System start on "Trip of all Main Feedwater Pumps" (ESFAS Function number 6.g) and the ESFAS Interlock "Reactor Trip, P-4" (ESFAS Function number 8.a). The proposed change will relocate the TS requirements in their entirety and not result in deletion or alteration of any RTS or ESFAS requirements. The proposed relocation of the TS requirements for these RTS and ESFAS instrument Functions is based on the application of the TS Criteria of 10 CFR 50.36(c)(2)(ii). provides a detailed description of the proposed changes, a technical analysis of the proposed changes, Luminant Power's determination that the proposed changes do not involve a significant hazard consideration, a regulatory analysis of the proposed changes and an environmental evaluation. Attachment 2 provides the affected Technical Specification (TS) pages marked-up to reflect the proposed changes. Attachment 3 provides proposed changes to the Technical Specification Bases for information only. These changes will be processed per Comanche Peak Nuclear Power Plant (CPNPP) site procedures. Attachment 4 provides retyped Technical Specification pages which incorporate the requested changes. Attachment 5 provides retyped Technical Specification Bases pages which incorporate the proposed changes for information only.

Luminant Power requests approval of the proposed License Amendment September 30, 2013, to be implemented within 120 days of the issuance of the license amendment. The approval date was administratively selected to allow for NRC review but the plant does not require this amendment to allow continued safe full power operations.

A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

• Comanche Peak - Diablo Canyon

• Palo Verde - San Onofre " South Texas Project

• Wolf Creek

U. S. Nuclear Regulatory Commission TXX-12139 Page 2 of 2 10/02/2012 In accordance with 10CFR50.91(b), Luminant Power is providing the State of Texas with a copy of this.

proposed amendment.

This communication contains the following new or revised commitments which will be completed or incorporated into the CPNPP licensing basis as noted:

Number Commitment Due Date/Event 4475895 The TS requirements for the relocated RTS Function Upon "Pressurizer Water Level - High"(RTS Function number 9) and Implementation ESFAS Functions for Auxiliary Feedwater System start on of associated "Trip of all Main Feedwater Pumps" (ESFAS Function number license 6.g) and the ESFAS Interlock "Reactor Trip, P-4" (ESFAS amendment.

Function number 8.a) will be incorporated into the Technical Requirements Manual, a licensee document controlled under 10CFR50.59.

The Commitment number is used by Luminant Power for the internal tracking of CPNPP commitments.

Should you have any questions, please contact Mr. Robert A. Slough at (254) 897-5727.

I state under penalty of perjury that the foregoing is true and correct.

Executed on October 2, 2012.

Sincerely, Luminant Generation Company, LLC Rafael Flores By: 42*2 Fred W. Madden Director, Oversight and Regulatory Affairs Attachments\\ý.. 1. Description and Assessment

2. Proposed Technical Specifications Changes (markup)

3. Proposed Technical Specifications Bases Changes (markup for information only)

4. Retyped Technical Specification Pages

5. Retyped Technical Specification Bases Pages (for information only) c -

E. E. Collins, Region IV W. C. Walker, Region IV B. K. Singal, NRR Resident Inspectors, CPNPP Alice Hamilton Rogers, P.E.

Inspection Unit Manager Texas Department of State Health Services Mail Code 1986 P. 0. Box 149347 Austin TX 78714-9347

ATTACHMENT 1 to TXX-12139 DESCRIPTION AND ASSESSMENT to TXX-12139 Page 2 of 40 10/02/2012 LICENSEE'S EVALUATION

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration 5.2 Applicable Regulatory Requirements/ Criteria

6.0 ENVIRONMENTAL CONSIDERATION

7.0 PRECEDENTS

8.0 REFERENCES

to TXX-1 2139 Page 3 of 40 10/02/2012

1.0 DESCRIPTION

By this letter, Luminant Generation Company LLC (Luminant Power) requests an amendment to the Comanche Peak Nuclear Power Plant (CPNPP) Unit 1 Operating License (NPF-87) and CPNPP Unit 2 Operating License (NPF-89) by incorporating the attached change into the CPNPP Unit 1 and 2 Technical Specifications. Proposed change License Amendment Request (LAR)12-005 is a request to revise Technical Specification (TS) 3.3.1, "Reactor Trip System (RTS)

Instrumentation" and 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)

Instrumentation" for CPNPP Units I and 2.

No changes to the CPNPP Final Safety Analysis Report are anticipated at this time as a result of this License Amendment Request.

2.0 PROPOSED CHANGE

The proposed change would revise TS 3.3.1, "Reactor Trip System (RTS) Instrumentation" to relocate the requirements for the reactor trip on Pressurizer Water Level - High (RTS Function Number 9 on TS Table 3.3.1-1) from the TS and TS 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation" to relocate the requirements for the Auxiliary Feedwater (AFW) System start on "Trip of all Main Feedwater Pumps" (ESFAS Function Number 6.g on TS Table 3.3.2-1) and the ESFAS Interlock "Reactor Trip, P-4" (ESFAS Function Number 8.a on TS Table 3.3.2-1) from the TS. The affected RTS and ESFAS requirements would be relocated in their entirety to the Technical Requirements Manual, a licensee document controlled under 10CFR50.59.

The proposed changes to the Technical Specification Bases are provided in Attachments 3 and 5 and are provided for information only. These changes will be processed in accordance with Technical Specification 5.5.14, "Technical Specification (TS) Bases Control Program."

The proposed relocation of the TS requirements for these two ESFAS instrument Functions is based on the application of the TS Criteria of 10 CFR 50.36(c)(2)(ii).

The proposed change would relocate the affected RTS and ESFAS instrument Functions discussed above in their entirety, including all the associated TS requirements such as the Mode of Applicability, the Actions Conditions (Actions and Completion Times), the Surveillance Requirements and the reactor trip on Pressurizer Water Level - High setpoint. Note that the ESFAS Functions proposed for relocation do not have setpoints associated with them.

The proposed change will not eliminate or alter any RTS or ESFAS requirements or change the RTS or ESFAS Instrumentation design as described in the CPNPP UFSAR. As such the existing defense in depth and diversity provided by the ESFAS Instrumentation is maintained. All the applicable requirements for the relocated RTS and ESFAS instrument Functions will be retained in the Technical Requirements Manual, a licensee document controlled by the 10CFR50.59 process. The details of the proposed changes to TS 3.3.1 and TS 3.3.2 are documented in the TS markup included in Attachment 2 of this License Amendment Request.

In summary, 10 CFR 50.36, "Technical Specifications" provides the criteria for determining the content of the TS. The application of the 10 CFR 50.36(c)(2)(ii) TS criteria to TS 3.3.1, "Reactor Trip System (RTS) Instrumentation" and TS 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation" resulted in one RTS instrument Function and two ESFAS instrument Functions not meeting any of the criteria for inclusion in the TS. Thus, the proposed change to TXX-12139 Page 4 of 40 10/02/2012 would relocate the requirements for the affected Functions from TS 3.3.2 in their entirety to the Technical Requirements Manual, a licensee document controlled by the 10CFR50.59 process. The result of the proposed change would make the content of the CPNPP Unit 1 and Unit 2 TS 3.3.1 and TS 3.3.2 more consistent with the requirements of 10 CFR 50.36.

3.0 BACKGROUND

The RTS Instrumentation is described in the CPNPP FSAR Section 7.2, "Reactor and Trip System," (Reference 1). The FSAR describes the RTS Instrumentation as follows:

"The Reactor Trip System (RTS) automatically keeps the reactor operating within a safe region by shutting down the reactor whenever the limits of the region are approached.

The safe operating region is defined by several considerations such as mechanical/hydraulic limitations on equipment, and heat transfer phenomena.

Therefore the RTS keeps surveillance on process variables which are directly related to equipment mechanical limitations, such as pressure, pressurizer water level (to prevent water discharge through safety valves, and uncovering heaters) and also on variables which directly affect the heat transfer capability of the reactor (e.g., flow and reactor coolant temperatures). Still other parameters utilized in the RTS are calculated from various process variables. In any event, whenever a direct process or calculated variable exceeds a setpoint the reactor will be shutdown in order to protect against either gross damage to fuel cladding or loss of system integrity which could lead to release of radioactive fission products into the Containment."

The ESFAS Instrumentation is described in the CPNPP FSAR Section 7.3, "Engineered Safety Features System," (Reference 1). The FSAR describes the ESFAS Instrumentation as follows:

"In addition to the requirements for a reactor trip for anticipated abnormal transients, the facility is provided with adequate instrumentation and controls to sense accident situations and initiate the operation of necessary engineered safety features. The occurrence of a limiting fault, such as a loss of coolant accident or a steam line break, requires a reactor trip plus actuation of one or more of the engineered safety features in order to prevent or mitigate damage to the core and Reactor Coolant System components, and ensure containment integrity.

In order to accomplish these design objectives, timely initiating signals are to be supplied by the sensors, transmitters and logic components making up the various instrumentation channels of the Engineered Safety Features Actuation System (ESFAS)."

The specific RTS and ESFAS instrument Functions proposed for relocation from the TS are the:

0 Reactor trip on Pressurizer Water Level -- High (RTS Function Number 9 on TS Table 3.3.1-1)

Auxiliary Feed Water (AFW) pump start on "Trip of all Main Feedwater Pumps" (ESFAS Function Number 6.g on TS Table 3.3.2-1), and ESFAS Interlock "Reactor Trip, P-4" (ESFAS Function Number 8.a on TS Table 3.3.2-1).

to TXX-12139 Page 5 of 40 10/02/2012 These RTS and ESFAS Functions are described below.

3.1 TS 3.3.1, Function 9, Reactor Trip on Pressurizer Water Level - High The Bases for TS 3.3.1, Function 9, provides the following description:

"The Pressurizer Water Level-High trip Function provides a backup signal for the Pressurizer Pressure-High trip and also provides protection against water relief through the pressurizer safety valves. These valves are designed to pass steam in order to achieve their design energy removal rate. A reactor trip is actuated prior to the pressurizer becoming water solid. The LCO requires three channels of Pressurizer Water Level-High to be OPERABLE. The pressurizer level channels are used as input to the Pressurizer Level Control System. A fourth channel is not required to address control/protection interaction concerns.

The level channels do not actuate the safety valves, and the high pressure reactor trip is set below the safety valve setting."

The CPNPP FSAR Section 7.2.1.1, "System Description," (Reference 1) describes the Pressurizer Water Level-High trip as follows:

"This trip is provided as a back-up to the high pressurizer pressure trip and serves to prevent water relief through the pressurizer safety valves. This trip is blocked below P-7 to permit startup."

As mentioned above, the reactor trip on Pressurizer Pressure-High is set below the safety valve setting. The TS Bases for the Pressurizer Pressure-High reactor trip states the following:

"The Pressurizer Pressure-High Allowable Value is selected to be below the pressurizer safety valve actuation pressure and above the power operated relief valve (PORV) setting. This setting minimizes challenges to safety valves while avoiding unnecessary reactor trip for those pressure increases that can be controlled by the PORVs."

Therefore, the Pressurizer Pressure-High reactor trip also functions to prevent water relief through the pressurizer safety valves.

In addition to the reactor trip Functions discussed above, the CPNPP TS contain LCO 3.4.9, "Pressurizer," LCO 3.4.10, "Pressurizer safety Valves," and LCO 3.4.11, "Pressurizer Power Operated Relief Valves." These additional pressurizer TS provide requirements to maintain a bubble in the Pressurizer, and the operability requirements for the Pressurizer safety and power operated relief valves. The requirements of these TS provide additional assurance that the Pressurizer level is monitored and controlled to prevent excessive Pressurizer water level.

to TXX-12139 Page 6 of 40 10/02/2012 3.2 TS 3.3.2, Function 6.g, "Trip of all Main Feedwater Pumps" AFW pump Start TS 3.3.2, Function 6, "Auxiliary Feedwater," contains the requirements for the AFW System actuation instrumentation. The AFW System is described in CPNPP FSAR Section 10.4.9, "Auxiliary Feedwater System," (Reference 1). However, the Bases for TS 3.3.2, Function 6, provides a more concise system description as follows:

"The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available. The system has two motor driven pumps and a turbine driven pump, making it available during normal unit operation, during a loss of AC power, a loss of MFW, and during a Feedwater System pipe break. The normal source of water for the AFW System is the condensate storage tank (CST). Upon low level in the CST, the pump suctions can be manually realigned to the safety-related Station Service Water (SSW) System. The AFW System is aligned so that upon a pump start, flow is initiated to the respective SGs immediately."

TS 3.3.2 Function number 6, "Auxiliary Feedwater," contains five instrumentation functions associated with the start of the AFW System. The following describes each ESFAS instrument function associated with the start of the AFW:

Function 6.a, "Automatic Actuation Logic and Actuation Relays."

TS 3.3.2 requires two trains to be Operable. Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the associated equipment. Automatic initiation of AFW must be Operable in Modes 1, 2, and 3 to support the operation of the following ESFAS instrument Functions.

Function 6.b, not used.

Function 6.c, "SG Water Level Low-Low."

The TS 3.3.2 Function 6.c Bases describes the Steam Generator (SG) Water Level Low-Low AFW start Function as follows:

"SG Water Level-Low Low provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. SG Water Level-Low Low provides input to the SG Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system which may then require a protection function actuation and a single failure in the other channels providing the protection function actuation. Thus, four OPERABLE channels are required to satisfy the requirements with two-out-of-four logic. Two-out-of-four low-low level signals in any SG starts the motor-driven AFW pumps; in two or more SGs starts the turbine-driven AFW pump."

to TXX-12139 Page 7 of 40 10/02/2012 Function 6.d, "Safety Injection" A Safety Injection (SI) signal starts the motor-driven AFW pumps. The ESFAS instrumentation that generate an SI signal are specified in TS 3.3.2 under Function Number 1, "Safety Injection." The following is a list of the ESFAS SI instrument Functions:

1.a, "Manual Initiation,"

1.b, "Automatic Actuation Logic and Actuation Relays,"

1.c, "Containment Pressure -- High 1"

.d, "Pressurizer Pressure - Low,"

1.e, "Steam Line Pressure Low As discussed above, the instrument functions listed above generate an SI signal, and therefore, via the SI signal, also start the motor-driven AFW pumps. A detailed description of each ESFAS SI instrument Function listed above can be found in the Bases for TS 3.3.2 Function Number 1.

Function 6.e, "Loss of Offsite Power" The TS 3.3.2 Function 6.e Bases describes the Loss of Offsite Power AFW start Function as follows:

"A loss of power to the reactor coolant pumps will result in a reactor trip and the subsequent need for some method of decay heat removal.

During a loss of offsite power, to both safety related busses feeding the motor driven AFW pumps, the loss of power to the bus feeding the turbine driven AFW pump valve control motor will start the turbine driven AFW pump to ensure that at least one SG contains enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip. In addition, once the diesel generators are started and up to speed, the motor driven AFW pumps will be sequentially loaded onto the diesel generator busses."

ESFAS Functions 6.a through 6.e discussed above, must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor.

Function 6.f, not used Function 6.g, "Trip of all Main Feedwater Pumps" The proposed change would relocate the requirements for this AFW start instrumentation in their entirety to the Technical Requirements Manual, a license document controlled by the 50.59 process. The AFW start on "Trip of all Main Feedwater Pumps" is described in the TS 3.3.2 Bases as follows:

"The A Trip of all MFW pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure.

Each turbine driven MFW pump is equipped with two pressure switches on the oil line for the speed control system. A Train "A" and a Train "B" to TXX-12139 Page 8 of 40 10/02/2012 sensor is on each MFW pump. The Train "A(B)" trip signals from both MFW pumps are required to actuate the Train "A(B)" motor-driven auxiliary feedwater pump. A trip of all MFW pumps starts the motor driven AFW pumps to ensure that at least one SG is available with water to act as the heat sink for the reactor."

Function 6.g must be OPERABLE in MODES 1 and 2. This ensures that at least one SG is provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident.

3.3 TS 3.3.2, Function 8.a, "Reactor Trip, P-4" ESFAS Interlock The remaining ESFAS instrument Function proposed for relocation from TS 3.3.2 is the the ESFAS Interlock "Reactor Trip, P-4" (ESFAS Function number 8.a). ESFAS Function 8.a is described in the TS 3.3.2 Bases as follows:

"P-4 interlock is enabled when a reactor trip breaker (RTB) and its associated bypass breaker is open. The P-4 permissive also prevents re-actuation of safety injection after a manual reset of safety injection following at least a 60 second delay time. This Function allows operators to take manual control of SI systems after the initial phase of injection is complete. Once SI is blocked, automatic actuation of SI cannot occur until the RTBs have been manually closed. Those functions that use the P-4 interlock are listed below; however, the LCO only requires the main turbine trip function to be operable. The remaining functions use a signal associated with the P-4 interlock, but are not credited in the accident analyses.

0 Trips the main turbine; Isolates MFW with coincident low Tavg; Prevent automatic reactuation of SI after a manual reset of SI; Allows arming of the steam dump valves and transfers the steam dump from the load rejection Tavg controller to the plant trip controller; and Prevents opening of the MFW isolation valves if they were closed on SI or SG Water Level-High High.

Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS following a reactor trip. An excessive cooldown of the RCS following a reactor trip could cause an insertion of positive reactivity with a subsequent increase in core power. To avoid such a situation, the noted Functions have been interlocked with P-4 as part of the design of the unit control and protection system.

None of the noted Functions serves a mitigation function in the unit licensing basis safety analyses. Only the turbine trip Function is explicitly assumed since it is an immediate consequence of the reactor trip Function. Neither turbine trip, nor any of the other four Functions associated with the reactor trip signal, is required to show that the unit licensing basis safety analysis acceptance criteria are met.

The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts. Therefore, this Function has no

Attachment i to TXX-12139 Page 9 of 40 10/02/2012 adjustable trip setpoint with which to associate a Trip Setpoint and Allowable Value. This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may be critical or approaching criticality."

3.4 10 CFR 50.36(c)(2)(ii) TS Criteria The NRC provided guidance for the contents of TS in its "Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors" ("The Policy Statement"), (Reference 2) in which the Commission indicated that compliance with "The Policy Statement" satisfies Section 182a of the Act. These criteria were subsequently incorporated into the regulations by an amendment to 10 CFR 50.36, 60 FR 36953 (July 19, 1995). In particular, the NRC indicated that certain items could be relocated from the TS to licensee-controlled documents, consistent with the standard enunciated in Portland General Electric Co. (Trojan Nuclear Plant), ALAB-531, 9 NRC 263, 273 (1979). In that case, the Atomic Safety and Licensing Appeal Board indicated that:

"technical specifications are to be reserved for those matters as to which the imposition of rigid conditions or limitations upon reactor operation is deemed necessary to obviate the possibility of an abnormal situation or event giving rise to an immediate threat to the public health and safety."

Thus, 10 CFR 50.36(c)(2)(ii) provides the criteria to be used for determining if a TS Limiting Condition of Operation (LCO) for a specific item should be included in the TS.

The criteria is applied to screen structures, systems, components, installed instrumentation, or process variables such that if one or more of the criteria is met, a TS LCO must be established for the item. The following is from 10 CFR 50.36(c)(2)(ii):

"(ii) A technical specification limiting condition for operation of a nuclear reactor must be established for each item meeting one or more of the following criteria:

(A) Criterion 1. Installed instrumentation that is used to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary.

(B) Criterion 2. A process variable, design feature, or operating restriction that is an initial condition of a design basis accident or transient analysis that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

(C) Criterion 3. A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

(D) Criterion 4. A structure, system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety."

"The Policy Statement" issued by the NRC contains additional insight regarding the purpose and intent of each criterion. The following explanations for the criterion were excerpted from "The Policy Statement:"

to TXX-12139 Page 10 of 40 10/02/2012 Criterion 1:

"This criterion is intended to ensure that Technical Specifications control those instruments specifically installed to detect excessive reactor coolant system leakage. This criterion should not, however, be interpreted to include instrumentation to detect precursors to reactor coolant pressure boundary leakage or instrumentation to identify the source of actual leakage (e.g., loose parts monitor, seismic instrumentation, valve position indicators)."

Criterion 2:

"As used in Criterion 2, process variables are only those parameters for which specific values or ranges of values have been chosen as.reference bounds in the Design Basis Accident or Transient analyses and which are monitored and controlled during power operation such that process values-remain within the analysis bounds. Process variables captured by Criterion 2 are not, however, limited to only those directly monitored and controlled from the control room. These could also include other features or characteristics that are specifically assumed in Design Basis Accident and Transient analyses even if they cannot be directly observed in the control room (e.g., moderator temperature coefficient and hot channel factors).

The purpose of this criterion is to capture those process variables that have initial values assumed in the Design Basis Accident and Transient analyses, and which are monitored and controlled during power operation."

Criterion 3:

"It is the intent of this criterion to capture into Technical Specifications only those structures, systems, and components that are part of the primary success path of a safety sequence analysis. Also captured by this criterion are those support and actuation systems that are necessary for items in the primary success path to successfully function. The primary success path for a particular mode of operation does not include backup and diverse equipment (e.g., rod withdrawal block which is a backup to the average power range monitor.high flux trip in the startup mode, safety valves which are backup to low. temperature overpressure relief valves during cold shutdown).

Criterion 4:

"It is the intent of this criterion that those requirements that PSA or operating experience exposes as significant to public health and safety, consistent with the Commission's Safety Goal and Severe Accident Policies, be retained or included in Technical Specifications.

The Commission expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA or risk survey and any available literature on risk insights and PSAs. This material should be employed to strengthen the technical bases for those requirements that remain in Technical Specifications, when applicable, and to verify that none of the requirements to be relocated contain constraints of prime importance in limiting the likelihood or severity of the accident sequences that are commonly found to dominate risk."

Attachment I to TXX-1 2139 Page 11 of 40 10/02/2012 The Reactor Trip on Pressurizer Water Level - High (RTS Function Number 9), the AFW pump start on "Trip of all Main Feedwater Pumps" (ESFAS Function Number 6.g), and the ESFAS Interlock "Reactor Trip, P-4" (ESFAS Function Number 8.a) proposed for relocation from the TS are actuation instrumentation. The instrumentation proposed for relocation are not "used to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary" as addressed by Criterion 1. Nor are these Instrument Functions a "process variable, design feature, or operating restriction" that is "monitored and controlled during power operation" as addressed in Criterion 2 and explained in the NRC Policy Statement.

Furthermore, the CPNPP Bases for TS 3.3.1 and TS 3.3.2 identify the instrument functions included in those TS as satisfying Criterion 3 of 10 CFR 50.36(2)(c)(ii). The identification of the RTS and ESFAS instrumentation as satisfying Criterion 3 is consistent with the TS Bases included in NUREG-1431 (Reference 3) which also identifies the RTS and ESFAS instrumentation as satisfying Criterion 3.

Therefore, the applicable 10 CFR 50.36 criterion for the RTS and ESFAS instrumentation is Criterion 3 and Criterion 4.

Thus, the Technical Analysis section of this License Amendment Request will focus on evaluating the ESFAS Functions proposed for relocation against 10 CFR 50.36(c)(2)(ii) Criterion 3 and Criterion 4..

3.5 Operating Experience (OE)

Part of 10 CFR 50.36(c)(2)(ii) Criterion 4 is applicable to structures, systems, or components that OE that has shown to be significant to public health and safety. In order to gather industry OE involving the Reactor trip on Pressurizer Water level High, AFW pump start on Trip of all Main Feedwater Pumps, and the ESFAS Interlock Reactor Trip, P-4, input was solicited from other utilities and searches were performed in the Scientech licensing databases. The results of these efforts were further screened to eliminate documents which simply mentioned the subject instrument Functions without providing any insight as to their significance to public health and safety per Criterion 4. The resulting documents (listed below) provide descriptions of the safety significance of the subject instrument Functions.

As discussed previously, the changes proposed in this License amendment are based on the application of the TS Criteria in 10 CFR 50.36(c)(2)(ii). When reviewing the OE documents listed below, it is informative to keep in mind one of the principle reasons for developing the 10 CFR 50.36(c)(2)(ii) Criteria as discussed by the NRC in the background section of "The Policy Statement" and quoted below.

"Technical Specifications cannot be changed by licensees without prior NRC approval. However, since 1969, there has been a trend towards including in Technical Specifications not only those requirements derived from the analyses and evaluation included in the safety analysis report but also essentially all other Commission requirements governing the operation of nuclear power reactors.

This extensive use of Technical Specifications is due in part to a lack of well-defined criteria (in either the body of the rule or in some other regulatory document) for what should be included in Technical Specifications. This has contributed to the volume of Technical Specifications and to the several-fold increase, since 1969, in the number of license amendment applications to effect changes to the Technical Specifications. It has diverted both staff and licensee

Attachment i to TXX-1 2139 Page 12 of 40 10102/2012 attention from the more important requirements in these documents to the extent that it has resulted in an adverse but unquantifiable impact on safety."

The following documents provide insight to the safety significance of the RTS and ESFAS Functions proposed for relocation.

1.

Wolf Creek - "Docket No. 50-482: Licensee Event Report 2010-002-00, Turbine Trip Function of Reactor Trip, P-4 Interlock Defeated During Entry Into and in Mode 3." Dated March 29, 2010. (Reference 4)

The event is described as:

"On January 26, 2010, a review of a revision to procedure SYS AC-120, "Main Turbine Generator Startup," identified that Step 5.6 allows leads to be lifted that defeat Reactor Trip, P-4 interlock for the turbine trip function when the plant is in Mode 3. Further review identified that Step 5.6 of procedure SYS AC-120 was performed on November 17, 2009 at approximately 1600 hours0.0185 days <br />0.444 hours <br />0.00265 weeks <br />6.088e-4 months <br /> CST. Wolf Creek Nuclear Operating Corporation (WCNOC) defeated the turbine trip on reactor trip function in Mode 4 and the plant transitioned to Mode 3 on November 18, 2009, at 0014 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> with the function defeated. The leads were relanded on November 20, 2009, at 1559.

Technical Specification (TS) 3.3.2, Table 3.3.2-1 specifies the applicable Mode for Function 8.a. (Reactor Trip, P-4) as Modes 1, 2, 3. Defeating the turbine trip on reactor trip function of the Reactor Trip, P-4 interlock using procedure SYS AC-120 results in both channels being defeated. The Mode change was not in conformance with Limiting Condition for Operation (LCO) 3.0.4 which precludes entry into a Mode or other specified condition in the Applicability statement when an LCO is not met and there is no Condition/Required Action for two channels or trains inoperable. Additionally, it was identified that the turbine trip on reactor trip function had been defeated on two occasions while in Mode 3.

LCO 3.0.3 specifies that when an associated Action is not provided, action shall be initiated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to place the plant in Mode 4 in 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. Action had not previously been taken as required by TSs."

The safety significance of the event was described as:

"As described in USAR Section 7.2.1.1.1, the reactor trip system initiates a turbine trip signal whenever reactor trip is initiated to prevent the reactivity insertion that would otherwise result from excessive reactor system cooldown. This eliminates unnecessary ESFAS actuations.

The turbine trip on reactor trip function provided by the P-4 interlock serves to limit the potential for an excessive cooldown of the reactor coolant system.

Following the reactor trip signal, the turbine is tripped off the line by promptly stopping steam flow to the turbine. Should the turbine fail to trip after a reactor trip, continuous steam flow from the steam generators removes additional energy from the reactor coolant system. This results in a reduction of primary coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the continuous cooldown results in an insertion of positive reactivity. If the most reactive rod control cluster assembly is assumed to TXX-12139 Page 13 of 40 10/02/2012 stuck in its fully withdrawn position after a reactor trip, there is possibility that the core will become critical and return to power.

However, the core would be ultimately shut down by the boric acid solution delivered by the emergency core cooling system when a safety injection signal associated with ESFAS is actuated upon receipt of a low pressurizer pressure signal. In view of the redundant core protection, the safety significance of a loss of turbine trip on reactor trip function provided by the P-4 interlock is low."

In addition, the NRC subsequently approved the removal of the TS requirements for the Turbine Trip on Reactor Trip P-4 Interlock Function in Mode 3. The relocation of these requirements from the TS are discussed in Section 7.1 of the Precedents section of this LAR under:

NRC Letter, "Wolf Creek Generating Station -Issuance of Amendment Re: Revise Table 3.3.2-1 of Technical Specification 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation" (TAC No.

ME3762)." Dated March 30, 2011.

2.

Wolf Creek - "Docket No. 50-482: Licensee Event Report 2009-009-01, Defeating Feedwater Isolation on Low Tavg Coincident with P-4 Function Results in Missed Mode Change." Dated March 22, 2010. (Reference 5)

The event is described as:

"On August 22, 2009, at 0540 hours0.00625 days <br />0.15 hours <br />8.928571e-4 weeks <br />2.0547e-4 months <br /> Central Daylight Time (CDT), with the plant in Mode 3, Control Room staff defeated the feedwater isolation on low Tavg coincident with P-4 Function using procedure SYS SB-122, "Enabling/Disabling P-4/Lo Tavg FWIS." This procedure was performed for restoring main feedwater flow through the main feedwater isolation valves (MFIVs) to supply water to the steam generators. On August 23, 2009, at 0125 hours0.00145 days <br />0.0347 hours <br />2.066799e-4 weeks <br />4.75625e-5 months <br /> the jumpers installed for defeating the feedwater isolation on low Tavg coincident with P-4 function were removed and procedure SYS SB-122 completed at 0140 hours0.00162 days <br />0.0389 hours <br />2.314815e-4 weeks <br />5.327e-5 months <br />.

The Nuclear Regulatory Commission (NRC) Resident questioned the defeating of the feedwater isolation on low Tavg coincident with P-4 function while in Mode

3. Technical Specification (TS) 3.3.2, Table 3.3.2-1 specifies the applicable Mode for Function 8.a. (Reactor Trip, P-4) as Modes 1, 2, 3. Defeating the feedwater isolation on low Tavg coincident with P-4 function using procedure SYS SB-122 results in both channels being defeated. There is no TS Condition for two inoperable trains. Limiting Condition for Operation (LCO) 3.0.3 specifies that when an associated Action is not provided, action shall be initiated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to place the plant in Mode 4 in 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. Action was not taken as required by the TSs."

In describing the safety significance of the event, the licensee stated:

"Feedwater isolation via this function is not modeled in any USAR Chapter 15 analyses, nor is it credited in the sensitivity studies presented in WCAP-9230, "Report on the Consequences of a Postulated Main Feedline Rupture,"

(referenced in USAR Section 15.2.8 for the feedwater system pipe break accident).

to TXX-12139 Page 14 of 40 10/02/2012 In order to satisfy the licensing basis accident analyses, feedwater isolation capability must be provided whenever the main feedwater system is in service and automatic valve closure must be provided after initiation signals from safety injection and steam generator water level high-high. These events are analyzed with the plant at hot zero power, full power or part power conditions.

Feedwater isolation would be actuated by a safety injection signal for the large and small break LOCA and steamline break accidents. For the analysis of the Excessive Feedwater Flow event in USAR Section 15.1.2, continuous addition of excessive feedwater is prevented by the steam generator high-high level trip, which initiates feedwater isolation and trips the turbine and main feedwater pumps. Therefore, blocking the feedwater isolation signal on low Tavg coincident with P-4 will have no impact on any accidents previously evaluated in the USAR since the signal to be blocked has not been credited."

3.

NRC Letter, "Wolf Creek Generating Station - Issuance of Amendment Re:

Revision To Technical Specification 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation" (Emergency Circumstances) (TAC No.

ME3465)." Dated March 5, 2010 (Reference 6)

The licensee proposed revisions to TS 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," Condition J, Required Action J.1, and associated Note for the start of the motor-driven auxiliary feedwater pumps on the trip of all main feedwater (MFW) pumps. The licensee determined that the design and normal operation of the MFW pumps could result in a condition that does not conform to TS Table 3.3.2-1, Function 6.g and the proposed TS changes are needed to address this condition. The license amendment was issued under emergency circumstances as provided in the provisions of paragraph 50.91(a)(5) of Title 10 of the Code of Federal Regulations due to the time critical nature of the amendment. In particular, the plant was not able to resume operation up to the plant's licensed power level without NRC approval of this amendment.

In the safety analysis section of the Safety Evaluation for this amendment the NRC stated:

"The auto-start of AFW on loss of MFW is an anticipatory safety function needed to mitigate the operational impact of loss-of-feedwater events.

The AFW start from the loss of MFW pumps is not a requirement in the licensee's design basis event analyses. The design basis events that impose AFW safety function requirements are loss of normal feedwater, main feed line or main steam line break, LOOP, and small break loss-of-coolant accident. These design basis events assume auto-start of the AFW system in the event of a LOOP, a safety-injection (SI) signal, or low-low SG water level. Therefore, even though the auto-start of MDAFW pumps upon an MFW pump trip is an ESFAS function in TS Table 3.3.2-1, Function 6.g, the function is an anticipatory start signal and no credit is taken in any of the licensee's safety analysis described in its USAR."

In the precedent Section of this Safety Evaluation the NRC cited two additional plant amendments addressing non-compliance with the same ESFAS Function (AFW Start on Trip of all Main Feedwater Pumps):

to TXX-12139 Page 15 of 40 10/02/2012 "On March 4, 2009, the NRC staff issued Amendment No. 75 (ADAMS Accession No. ML090480566) to Facility Operating License No. NPF-90 for Watts Bar Nuclear Plant, Unit 1 (Watts Bar). The amendment resolved Watts Bar's noncompliance with the TSs for the ESFAS function associated with AFW automatic start upon trip on all MFW pumps.

On August 29,2008, the NRC staff issued Amendment No. 312 (ADAMS Accession No. ML082401385) the Facility Operating License No. DPR-77 and Amendment No. 319 to Facility Operating License No. DPR-79 for Sequoyah Nuclear Plant, Units 1 and 2 (SON). The amendments resolved SON's NRC-identified noncompliance with the TSs for the ESFAS function associated with AFW automatic start upon trip on all MFW pumps.

In regard to the ESFAS AFW Start on Trip of all Main Feedwater Pumps Function, the Safety Evaluation for the Watts Bar amendment cited above stated:

"Modifying the requirement for auto-start of the AFW pumps to be required only when one or more TDMFW pumps are in service limits the potential for an overcooling transient due to inadvertent AFW actuation.

Inadvertent AFW actuation during startup or shutdown would start all three AFW pumps including the TDAFW pump. The steam demand to drive the TDAFW pump at low power could lead to reactivity transients due to overcooling."

The Safety Evaluation for the Watts Bar amendment cited above concluded:

"Therefore, the NRC staff concludes that the loss of both anticipatory trip channels does not place the plant in an unanalyzed condition since the primary success path for accident mitigation is provided by SG low-low level signals. The NRC staff also concludes that the plant should not be required to enter LCO 3.0.3. Based on a review of the above, the NRC staff finds this change acceptable."

The Safety Evaluation for the Sequoyah Unit 1 and 2 amendments cited above described the AFW start on trip of all main feedwater pumps as follows:

"The auto-start of AFW on loss of main feedwater is an anticipatory safety function needed to mitigate the operational impact of loss of feedwater events. The AFW start: on loss of MFW is not required to address design basis events. In addition to the start of the AFW system on MFW pump trip, the system is designed to start automatically in the event of a loss of offsite electrical power (LOOP), a safety injection (SI) signal, or low-low SG water level. The design basis events that impose AFW safety function requirements are loss of normal feedwater, main feed line or main steam line break, LOOP, and small break loss of coolant accident. These design basis events assume auto-start of the AFW system on a blackout signal, low-low SG level, or a SI signal. These ESFAS signals are Class 1E which means all requirements for reliable power supplies, separation, redundancy, testability, and seismic and environmental qualifications as specified in 10 CFR 50.55a(h)(2),

to TXX-12139 Page 16 of 40 10/02/2012 "Protection Systems" are met, and are unaffected by the proposed change."

When discussing the proposed change, the Safety Evaluation for the Sequoyah Unit 1 and 2 amendments cited above also addressed the potential for over cooling transients:

"Also, modifying the requirement for auto-start of the AFW pumps to be only required when the MFW pumps are in service limits the potential for inadvertent AFW actuations dluring normal plant startups and shutdowns that could lead to reactivity control issues due to over cooling transients. The proposed change is consistent with NRC-approved TS changes at other Westinghouse-designed nuclear plants."

The Technical Evaluation of the Safety Evaluation for the Sequoyah Unit 1 and 2 amendments cited above concluded with:

"Lastly, the AFW auto-start function provides an anticipatory trip to reduce the effect of a feedwater transient, and is not credited in any transient analyses. Additional protection for loss of normal feedwater for all modes of operation is provided by the safety-related signals discussed above, and these are not affected by the proposed change."

4.

Watts Bar Nuclear Plant (WBN) Unit 1 - Licensee Event Report (LER) 390/2006-008 - "Auxiliary Feedwater Auto-Start Function Upon loss Of Main Feedwater Pumps," Dated December 19, 2006. (Reference 7)

The event is described as:

"On October 27, 2006, NRC issued Inspection Report 390, 391/2006004 which identified a non-cited violation of Technical Specification (TS) 3.0.4 for entering Modes 1 and 2 with the automatic auxiliary feedwater (AFW) (EIIS Code BA) start signal for a loss of normal feedwater (EIIS Code SJ) (TS 3.3.2.6.e) inoperable. Since initial startup in 1996, WBN has concluded this function was operable when a turbine-driven main feedwater pump (TDMFW) (EJIS Code SJ/P) trip bus (EIIS Code BU) was energized even though the pump was not running and supplying feedwater to the steam generators."

In the Safety Consequences Section of the LER the licensee described the AFW Start on Trip of all main feedwater pumps as follows:

"LCO 3.3.2.6.e is an anticipatory function which provides early actuation of the AFW system but it is not a safety-related function. Steam generator low-low level or a safety injection (SI) (EIIS Code BQ) signal are the safety related signals credited for actuating the AFW system during an accident. The TDMFW pump oil pressure switches, which indicate a trip of their respective pump, are non-quality related and there is no redundancy for this function (i.e., only one switch per pump)."

Attachment i to TXX-12139 Page 17 of 40 10/0212012

5.

NRC Letter, "Amendment No. 126 To Facility Operating License No. NPF-30 Callaway Plant, Unit 1 (TAC No. M99420)." Dated April 23, 1998. (Reference 8)

The licensee proposed a TS Bases change which would allow the Feedwater Isolation function on low Tavg of the P-4 interlock to be bypassed during startup and shutdown operations. The basis for the proposed change was that the function was not credited in the safety analysis (i.e., the function does not meet 10 CFR 50.36(c)(2)(ii) criterion 3). In the Safety Evaluation for this proposed change the NRC stated:

"2.4 Feedwater Isolation on P-4/Low Tavg The Bases for Functional Unit 11.b, Reactor Trip P-4, in Table 3.3-3 would be revised to add a note allowing the feedwater isolation function on P-4 (reactor trip and bypass breakers open) coincident with low Tavg (Tavg

< 564°F) to be blocked. The reason for the change is to decrease unnecessary cycling of the MFIVs and AFW system which adversely impacts startup and shutdown evolutions. This feedwater isolation function provides backup protection for excessive cooldown events and is not credited in any FSAR analyses. The licensee has proposed to install a bypass switch to block this signal during startup and shutdown evolutions with Tavg < 564°F just prior to opening the reactor trip breakers. The feedwater isolation function would be restored by manually defeating the bypass prior to entering MODE 2. This change is acceptable."

6.

Turkey Point Unit 3, Docket No. 50-250, LER No. 2004-005-00, "Heat-Damaged Cables in Containment Cause Potential Inoperability of 2 of 3 Pressurizer Water Level Monitoring Channels," February 1, 2005. (Reference 9)

The event is described as:

"The Turkey Point Unit 3 Cycle 21 refueling outage began on September 26, 2004. On October 16,2004, abnormal indications were noted on the PT-3-445 pressurizer [EIIS: AB, PZRJ pressure indications in the control room. Troubleshooting, including cable [EBS: CBL] characterization utilizing the CHAR 200 system, revealed that the cable for pressurizer pressure transmitter [EIIS: AB, PT] PT-3-445 control loop installed in conduit [EIIS: CND] 3C226-2 was damaged inside the reactor containment building [EUS: NH]. The cable was subsequently removed from the conduit and significant damage to the cable jacket and insulation [EHS: ISLI was observed over approximately a four-foot length of cable. The cable damage occurred where the cable passed directly over Reactor Coolant System (RCS) [EIIS: AB] 3B hot leg piping."

In the Background Section of the LER the licensee stated the following regarding reactor trip on Pressurizer water level high:

"Three pressurizer level channels in a two-out-of-three logic for high pressurizer level are used for Reactor [EBS: RCT] trip [EIIS: JC]. This function is not relied upon as a primary trip function in the plant safety

Attachment I to TXX-12139 Page 18 of 40 10/02/2012 analysis. It may perform as a backup trip for any significant heatup transient, which results in a large specific volume change for RCS primary coolant. The degradation of cables associated with pressurizer level transmitters LT-3-460 and LT-3-461 does not affect their reactor trip function."

Summary Conclusion of OE As discussed in "The Policy Statement" regarding the relocation of TS requirements, the NRC stated:

"The Commission recognizes that the four criteria carry a theme of focusing on the technical requirements for features of controlling importance to safety. Since many of the requirements are of immediate concern to the health and safety of the public, this Policy Statement adopts, for the purpose of relocating requirements from Technical Specifications to licensee-controlled documents, the subjective statement of the purpose of Technical Specifications expressed by the Atomic Safety and Licensing Appeal Board in Portland General Electric Company (Trojan Nuclear Plant), ALAB-531, 9 NRC 263 (1979). There, the Appeal Board interpreted Technical Specifications as being reserved for those conditions or limitations upon reactor operation necessary to obviate the possibility of an abnormal situation or event giving rise to an immediate threat to the public health and safety."

The OE reviewed above does not indicate that the instrument Functions proposed for relocation are "necessary to obviate the possibility of an abnormal situation or event giving rise to an immediate threat to the public health and safety." Nor does the OE reviewed above indicate that the instrument Functions proposed for relocation are significant to the public health and safety per Criterion 4.

The significance of the OE discussed above may indicate an excessive use of regulatory resources (both industry and NRC) for instrument functions that are backup or anticipatory signals and, in the case of CPNPP, not credited in the safety analyses. The level of regulatory resources being applied to these requirements would seem counter to intent of "The Policy Statement" regarding the excess of TS requirements as discussed below:

"It has diverted both staff and licensee attention from the more important requirements in these documents to the extent that it has resulted in an adverse but unquantifiable impact on safety."

The application of the 10 CFR 50.36(c)(2)(ii) Criteria to TS requirements such as these would reduce the use of regulatory resources for requirements that do not meet the criteria for inclusion in the TS. Also, consistent with the standard enunciated in Portland General Electric Co. (Trojan Nuclear Plant), ALAB-531, 9 NRC 263, 273 (1979) as discussed in "The Policy Statement," TS requirements which do not meet the criteria of 10 CFR 50.36(c)(2)(ii), could be relocated from the TS so that the NRC and licensee attention are not diverted from the more important TS requirements.

Upon implementation of the Improved Standard Technical Specifications, licensees have relocated as much as 40% of their TS requirements to documents controlled by 10 CFR 50.59 or other applicable controls. As a majority of plants have converted to the to TXX-12139 Page 19 of 40 10/02/2012 Improved Standard Technical Specifications, a significant amount of OE exists which supports the removal of these "lower tier" requirements from the TS. As such, sufficient industry OE exists to indicate that the controls provided in 10 CFR 50.59 are sufficient to address future changes to the relocated requirements. As stated in "The Policy Statement;"

"Implementation of the Policy Statement through implementation of the improved STS is expected to produce an improvement in the safety of nuclear power plants through the use of more operator-oriented Technical Specifications, improved Technical Specification Bases, reduced action statement induced plant transients, and more efficient use of NRC and industry resources."

Therefore, as intended by the "The Policy Statement," application of the criteria of 10 CFR 50.36(c)(2)(ii) and the appropriate use of the controls that exist under 10 CFR 50.59 provide for more efficient use of NRC and industry resources.

4.0 TECHNICAL ANALYSIS

This license amendment request was not submitted as a risk-informed application pursuant to Regulatory Guide 1.174 (Reference 10), but uses PRA information as one element to determine the instrumentation that may be relocated from the TS. In order to apply the applicable criteria of 10 CFR 50.36(c)(2)(ii), the CPNPP design basis accidents, as described in the CPNPP UFSAR, are considered as well as the insights provided by the CPNPP PRA.

Subsection 4.1 contains a description of the safety analyses review performed to determine the RTS and ESFAS instrument Functions that are not part of the primary success path and which do not function or actuate to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier in accordance with Criterion 3 of 10 CFR 50.36(c)(2)(ii).

Subsection 4.2 contains a description of the PRA review performed to determine the RTS and ESFAS instrument Functions that have not been shown by PRA to be significant to public health and safety in accordance with Criterion 4 of 10 CFR 50.36(c)(2)(ii). The operating experience portion of Criterion 4 is addressed in Subsection 3.5 above.

Subsection 4.3 contains the conclusion with a summary of the safety analyses and PRA review results (i.e., those instrument Functions which do not meet Criterion 3 or 4). This subsection includes tables showing all the RTS and ESFAS instrumentation and the results of the safety analyses and PRA reviews.

4.1 Criterion 3 - Safety Analyses Review CPNPP has instrumentation and controls to monitor and maintain system process parameter variables (e.g., temperature, pressure, flow, level) within prescribed operating ranges during normal operation. The process instrumentation also provides inputs to the RTS and the ESFAS voting logic when predefined limits (i.e., trip setpoints) are exceeded.

The RTS provides automatic protection signals to ensure fuel and cooling system design/safety limits are not exceeded during normal operation and anticipated operational occurrences (AOOs, Condition II events), Condition III events, or Condition IV events. The ESFAS provides automatic protection signals to actuate components and systems that protect against the uncontrolled release of radioactive to TXX-1 2139 Page 20 of 40 10/02/2012 materials to the environment, and in some cases to ensure fuel and cooling system design/safety limits are not exceeded during AOOs (Condition II events), Condition III events, or Condition IV events.

The calculation packages supporting the CPNPP FSAR Chapter 15 Safety Analyses Condition II, III, and IV events and FSAR Chapter 6 (for Containment Mass and Energy Releases) (Reference 1) were reviewed to identify the primary RTS and ESFAS TS Functions (i.e., actuation signals) explicitly credited in these calculations to generate a reactor trip or ESFAS signal.

An additional effort of expert elicitation was undertaken to identify implicit primary TS Functions: those that are not explicitly mentioned in the CPNPP safety analyses but that might have been used implicitly. While finding such situations may appear difficult, in practice the number of RTS and ESFAS Functions that do not meet criterion 3 is small, and for those, expert elicitation can be used very effectively to provide a reasonable assurance that the functions not listed as primary actually do not meet that criterion.

The following RTS and ESFAS TS Functions: Reactor Trip Breakers and Reactor Trip Breaker Mechanisms, Automatic Trip Logic, and Actuation Logic and Actuation Relays were not evaluated. These Functions are associated with all the actuating signals of the RTS and ESFAS and therefore are considered to meet 10 CFR 50.36 (c) (2) (ii) Criterion 3.

Regarding the containment isolation functions, the safety analysis for large break LOCA with the ASTRUM methodology assumes containment venting is isolated for LOCA.

Containment isolation ensures meeting the containment backpressure assumptions of the large break LOCA ASTRUM analysis. It also ensures that the leakage rate used in the calculated accidental offsite radiological dose is below 10 CFR 100 limits. Therefore, the containment isolation functions meet 10CFR50.36 (c) (2) (ii) Criterion 3.

The RTS and ESFAS interlocks are used to define the range of applicability of other RTS and ESFAS TS Functions. They were addressed by examining the TS Bases sections 3.3.1 and 3.3.2 for each interlock and assessing its role. Whenever an interlock is required for the proper operation of the primary RTS and ESFAS TS Functions (i.e., actuation signals) that meet of 10CFR50.36(c)(2)(ii) Criterion 3, then those interlocks are deemed required to remain in the TS as well.

Summary of Safety Analyses Review The primary RTS TS Functions and Interlocks credited/modeled in the safety analyses for generating an automatic reactor trip (i.e., that meet 10 CFR 50.36 (c)(2)(ii) Criterion 3) are identified below:

Power Range High Neutron Flux - High, Power Range High Neutron Flux - Low, Power Range Neutron Flux Rate High Positive Rate, Intermediate Range High Neutron Flux, Source Range High Neutron Flux, Overtemperature N-16, Overpower N-16, Pressurizer Pressure - Low, Pressurizer Pressure - High, Reactor Coolant Flow - Low to TXX-12139 Page 21 of 40 10/02/2012 Undervoltage RCPs, Underfrequency RCPs, Steam Generator Water Level - Low Low, Turbine Trip - low fluid oil pressure, Turbine Trip - turbine stop valve closure, Safety Injection input from ESFAS, and P-6, P-7, P-8, P-9, P-10 and P-13 Interlocks The RTS TS Functions not credited/modeled in the safety analyses for generating an automatic reactor trip (i.e., that do not meet 10 CFR 50.36 (c)(2)(ii) Criterion 3) are:

Manual Reactor Trip Pressurizer Water Level - High The primary ESFAS TS Functions and Interlocks credited/modeled in the safety analyses for generating an ESFAS signal (i.e., that meet 10 CFR 50.36 (c)(2)(ii) Criterion 3) are identified below:

SI, Containment Pressure-High 1, SI, Pressurizer Pressure-Low, SI, Steam Line Pressure Low, Containment Spray, Containment Pressure High-3, Containment Isolation, Phase A on SI Containment Isolation, Phase B on Containment Pressure - High 3 Steam Line Isolation, Containment Pressure-High 2, Steam Line Isolation, Steam Line Pressure Lo, Steam Line Isolation, Steam Line Pressure Negative Rate-High, Turbine Trip & Feedwater Isolation, SG Water Level High High (P-14),

Auxiliary Feedwater, SG Water Level Low-Low Automatic Switchover to Containment Sump, Refueling Water Storage Tank (RWST)

Level Low Low, and P-11 Interlock The ESFAS Functions and Interlocks not credited/modeled in the safety analyses for generating an ESFAS signal (i.e., that do not meet 10 CFR 50.36 (c)(2)(ii) Criterion 3) are identified below.

Turbine Trip and Feedwater Isolation, SI Auxiliary Feedwater, SI, Auxiliary Feedwater, Loss of Offsite Power, Auxiliary Feedwater, Trip of all MFW Pumps, and P-4 Reactor Trip Interlock.

Manual Initiation Functions Although the safety analyses reviewed do not credit manual initiation of Reactor Trip or any ESFAS Instrument Function, the manual actuation Functions are not proposed to be relocated.

The RTS and ESFAS manual initiation Functions include the following:

Reactor Trip SI, Containment Spray, Containment Isolation Phase A, to TXX-12139 Page 22 of 40 10/02/2012 Containment Isolation Phase B, and Steam Line Isolation.

The manual initiation Functions are retained in the TS to assure diversity and defense in depth for the associated automatic instrumentation which does meet Criterion 3.

P-4 Interlock The P-4 functions are:

Trips the main turbine on reactor trip, Isolates MFW with coincident low Tavg, Prevent automatic re-actuation of SI after a manual reset of SI, Allows arming of the steam dump valves and transfers the steam dump from the load rejection Tavg controller to the plant trip controller, and Prevents opening of the MFW isolation valves if they were closed on SI or SG Water Level-High High.

Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS following a reactor trip. None of the noted Functions serves a primary mitigation function in the licensing basis safety analysis. Only the turbine trip Function is explicitly assumed in the safety analyses since it is an immediate consequence of the reactor trip Function.

Nevertheless, neither turbine trip, nor any of the other four Functions associated with the reactor trip signal, is required to show that the unit licensing basis safety analysis acceptance criteria are met. Therefore, the P-4 interlock is a backup function that is not part of the primary success path and does not function or actuate to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier (i.e., it does not meet 10 CFR 50.36 (c)(2)(ii) Criterion 3).

4.2 Criterion 4 - Probabilistic Risk Assessment (PRA)

In determining the PRA significance of the RTS and ESFAS Instrument Functions with respect to Criterion 4, the following considerations must be evaluated:

The importance of the RTS and ESFAS instrumentation functions with regard to plant risk, as determined by a plant-specific PRA model, and The importance of the RTS and ESFAS instrumentation functions to risk-informed applications that have been implemented at the plant.

Therefore, the PRA review performed to identify the RTS and ESFAS TS instrument Functions that may be relocated from the TS focused on the CPNPP PRA model and the risk-informed applications that have been implemented at CPNPP.

PRA Model It has previously been shown in PRA models that reactor trip and engineered safety features actuation signals are not risk drivers, that is, the actuation signals are not significant contributors to plant risk. This is due to the redundancy and diversity built into the reactor protection system and the ability of the operators to manually actuate the safety features if the actuation signals fail. For example:

to TXX-1 2139 Page 23 of 40 10/02/2012 Reactor trip can be initiated by diverse sets of parameters that are monitored by analog channels arranged in two-out-of-three or two-out-of-four logic for all transient events, Operators can also manually trip the reactor for all events, ESFAS signals, such as safety injection and auxiliary feedwater actuation, can be initiated by parameters that are monitored by analog channels arranged in two-out-of-three or two out-of-four logic, and Operators can also manually initiate the safety features for most of the events.

Consistent with this, the CPNPP PRA model has not shown the RTS and ESFAS systems to be a key driver of plant risk and the plant has an acceptable risk level which to some extent is due to the redundancy and diversity of the RTS and ESFAS systems. To maintain this level of safety performance from the RTS and ESFAS systems, the basic assumptions supporting the PRA model with regard to available RTS and ESFAS actuation signals need to be maintained.

The TS instrument Functions not associated with the signals credited explicitly or implicitly in the CPNPP PRA model would be candidates for relocation.

Similar to the safety analyses review, the RTS and ESFAS interlocks are considered to be required for the proper operation of the associated primary RTS and ESFAS TS Functions.

Therefore, when an interlock is required for the proper operation of a primary RTS or ESFAS TS Function that is required to remain in the TS, the associated interlock is required to remain in the TS as well.

Also similar to the safety analyses evaluation, the Reactor Trip Breakers and Reactor Trip Breaker Mechanisms, Automatic Trip Logic, and Actuation Logic and Actuation Relays are associated with all the actuating signals of the RTS and ESFAS and are required for the proper operation of the associated RTS and ESFAS TS Functions. Therefore, these RTS and ESFAS TS Functions are required to remain in the TS.

Risk-Informed Applications Several risk-informed applications have been completed by the Pressurized Water Reactor (PWR) Owners Group that resulted in changes to TS Completion Times, Bypass Test Times, and Surveillance Test Frequencies of the RTS and ESFAS TS. These applications include the following:

WCAP-10271 with Supplements 1 and 2 (References 11, 12, and 13),

WCAP-14333 (Reference 14), and WCAP-15376 (Reference 15).

Most of the changes from WCAP-10271, Supplements 1 and 2, were incorporated in the CPNPP original Unit 1 TSs issued in February 1990. Amendment 13, issued January 13, 1993, incorporated the remainder of the WCAP-10271 changes plus Supplement 3 for the RWST level instruments. Supplement 3 was plant-specific to CPNPP. WCAP-14333 and WCAP-15376 were incorporated in Amendment 114, issued January 31, 2005.

The changes in these WCAPs credited the diversity and redundancy of the RTS and ESFAS system design. This includes the diverse sets of parameters and backup operator to TXX-12139 Page 24 of 40 10/02/2012 actions to initiate a reactor trip, backup operator actions to initiate safety features, and the use of two-out-of three and two-out-of-four logic.

The TS functions not associated with the signals credited explicitly or implicitly in these WCAP analyses would be candidates for relocation.

CPNPP PRA Model Technical Adequacy The CPNPP PRA model has been revised substantially since its origination and the various model revisions subjected to careful evaluation and review to assure the scope and quality of the model are adequate for planned risk-informed applications. The reviews included two focused Peer Reviews, a full scope Peer Review, and a self assessment to Regulatory Guide 1.200, Rev 1 (Reference 16). These various reviews and assessments are part of the PRA model development and provide important input to the recent model upgrade. The model upgrade addressed Level 1 and Large Early Release Frequency analysis of Internal Events, including Internal Flood, for At-Power operation.

This upgrade was initially embodied in the CPNPP model of record (MOR) Revision 4, which was completed in early 2011. The model was then subject to a PWROG full scope Peer Review in March 2011. This Peer Review was performed against the requirements of the American Society of Mechanical Engineers/American Nuclear Society PRA standard and any Clarifications and Qualifications provided in the Nuclear Regulatory Commission's endorsement of the Standard contained in Revision 2 to Regulatory Guide 1.200 (Reference 17). The Revision 4 model was further revised, in part, to incorporate the model changes in response to the Peer Review Findings & Observations and issued as Revision 4A, which is the current MOR.

The PRA model development and review process discussed above provides a high degree of assurance of the technical adequacy of the CPNPP PRA model to support most risk informed applications at CPNPP. The outcome of the Peer Review showed that the CPNPP PRA MOR Revision 4 meets ASME Capability Category II or better for nearly all of the Supporting Requirements. After Findings and Observations were fully addressed through post-Peer Review model work and documentation, as reflected in CPNPP MOR 4A, all Supporting Requirements judged to have significance with respect to Initiative 8a (Reference 18) now meet Capability Category II or better.

Summary of PRA Results The primary RTS TS Functions and Interlocks credited/modeled in the PRA model for generating an automatic reactor trip or that are credited in one of the risk informed applications discussed above (i.e., that meet 10 CFR 50.36 (c)(2)(ii) Criterion 4) are identified below:

Manual Reactor Trip Power Range Neutron Flux Rate High Positive Rate, 0

Intermediate Range High Neutron Flux, 0

Source Range High Neutron Flux, Overtemperature N-16, Pressurizer Pressure - Low, 0

Pressurizer Pressure - High, 0

Reactor Coolant Flow - Low Undervoltage RCPs,

Attachment I to TXX-12139 Page 25 of 40 10/02/2012 Underfrequency RCPs, Steam Generator Water Level - Low Low, Safety Injection input from ESFAS, and 0

P-6, P-7, P-8, P-9, P-10 and P-13 Interlocks The RTS TS Functions not credited/modeled in the PRA model for providing the primary protective signal for generating an automatic reactor trip and that are not credited in one of the risk informed applications discussed above (i.e., that do not meet 10 CFR 50.36 (c)(2)(ii) Criterion 4) are:

Power Range Neutron Flux - High, Power Range Neutron Flux - Low, Overpower N-16, Pressurizer Water Level - High, Turbine Trip - Low Fluid Oil Pressure, and Turbine Trip - Turbine Stop Valve Closure.

The primary ESFAS TS Functions and Interlocks credited/modeled in the PRA model for generating an automatic actuation signal or that are credited in one of the risk informed applications discussed above (i.e., that meet 10 CFR 50.36 (c)(2)(ii) Criterion 4) are identified below:

SI, Manual Initiation, SI, Containment Pressure-High 1, SI, Pressurizer Pressure-Low, SI, Steam Line Pressure Low, Containment Spray, Containment Pressure High-3, Containment Isolation, Phase A on SI Containment Isolation, Phase B on Containment Pressure - High 3 Steam Line Isolation, Containment Pressure-High 2, Steam Line Isolation, Steam Line Pressure Lo, Steam Line Isolation, Steam Line Pressure Negative Rate-High, Turbine Trip & Feedwater Isolation, SG Water Level High High (P-14),

Turbine Trip & Feedwater Isolation, SI Auxiliary Feedwater, SG Water Level Low-Low Auxiliary Feedwater, SI Automatic Switchover to Containment Sump, Refueling Water Storage Tank (RWST) Level Low Low, and P-11 Interlock P-4 Interlock (see description below)

P-4 Interlock Feedwater isolation on P-4 with low Tavg is the only P-4 function credited in the PRA model. A PRA assessment was completed to determine the quantitative benefit of crediting feedwater isolation on P-4 with low Tavg. It was determined that this P-4 Function provides a very small benefit which does not satisfy Criterion 4 of 10 CFR 50.36(c)(2)(ii). Therefore, feedwater isolation on P-4 with low Tavg can be relocated from the TS. As explained in the safety analyses section above, the P-4 interlock includes to TXX-12139 Page 26 of 40 10/02/2012 several other functions, none of which are credited in the safety analysis, CPNPP PRA model, or the analyses supporting WCAP-10271 with Supplements 1 and 2, WCAP-14333, and WCAP-15376. Therefore, the P-4 interlock does not perform a required safety function and its removal from the PRA model shows it is not significant to public health and safety (i.e., does not meet Criterion 4). Therefore, the P-4 interlock is a candidate for relocation out of the TS.

The primary ESFAS TS Functions and Interlocks not credited/modeled in the PRA model for generating an automatic actuation signal or that have been shown by quantitative assessment to not be significant to public health and safety (i.e., P-4 Feedwater isolation with low Tavg) and that are not credited in one of the risk informed applications discussed above (i.e., that do not meet 10 CFR 50.36 (c)(2)(ii) Criterion 4) are identified below.

Steam Line Isolation, Steam Line Pressure Negative Rate - High 0

Auxiliary Feedwater, Trip of all Main Feed water Pumps, and 0

P-4 Interlock In addition to the ESFAS Instrument Functions cited above, the following manual initiation Functions were also not credited in the PRA:

Containment Spray, Containment Isolation Phase A, Containment Isolation Phase B, and Steam Line Isolation.

However, these manual initiation Functions are retained in the TS to assure diversity and defense in depth for the associated automatic actuation instrumentation which meets Criterion 3 or 4.

4.3 Summary of RTS and ESFAS Functions Proposed for Relocation from the TS Comparing the results of the safety analysis review with the PRA review, the following RTS and ESFAS instrument Functions do not meet Criterion 3 or 4 and are proposed for relocation from the TS:

RTS - Pressurizer Water Level - High, ESFAS - Trip of all Main Feed Water Pumps - AFW Start, and ESFAS - P-4 Interlock Function Pressurizer Water Level-High Reactor Trip As discussed in the Bases for TS 3.3.1 and the CPNPP FSAR Section 7.2.1.1, the Pressurizer Water Level-High trip Function provides a backup signal for the Pressurizer Pressure-High trip and also provides protection against water relief through the pressurizer safety valves.

The Pressurizer Water Level-High trip Function is not credited in any design basis accident analysis described in CPNPP FSAR Chapter 15 Safety Analyses Condition II, III, and IV events and FSAR Chapter 6 (for Containment Mass and Energy Releases) as part of the primary success path which functions or actuates to mitigate a design basis to TXX-12139 Page 27 of 40 10/02/2012 accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier as defined by Criterion 3 of 10CFR50.36 (c)(2)(ii).

Therefore, the Pressurizer Water Level-High trip Function does not meet Criterion 3 for retention in the TS.

Although providing protection against water relief through the pressurizer safety valves is important, the actuation of the Pressurizer Water Level-High trip to prevent water relief through the pressurizer safety valves is not part of the primary success path of a safety sequence analysis which is how the applicability of Criterion 3 is explained in the Policy Statement. In addition, other CPNPP TS requirements (e.g., reactor trip on Pressurizer Pressure High, Pressurizer, and Pressurizer Power Operated Relief Valves) will continue to assure that the pressurizer water level is monitored and maintained within acceptable limits.

Furthermore, the Pressurizer Water Level-High trip would still be required operable in the same manner as before in the Technical Requirements Manual, a licensee document controlled by the 10CFR 50.59 process. Therefore, Pressurizer Water Level-High trip would continue to function to prevent water relief through the pressurizer safety valves in the same manner as before.

The Pressurizer Water Level-High trip Function is not modeled or credited in CPNPP PRA model and does not support the analyses associated with the risk informed applications implemented by CPNPP (i.e., WCAP-10271 with Supplements 1 and 2, WCAP-14333, and WCAP-15376). As such, this reactor trip has not been shown to be significant to the public health and safety by PRA. In addition, no operating experience was found to indicate this reactor trip is significant to the public health and safety.

Therefore, the Pressurizer Water Level-High trip Function does not meet Criterion 4 for retention in the TS.

Trip of all Main Feed Water Pumps - AFW Pump Start The AFW pump start on Trip of all Main Feed Water Pumps is not credited in any design basis accident analysis described in CPNPP FSAR Chapter 15 Safety Analyses Condition II, III, and IV events and FSAR Chapter 6 (for Containment Mass and Energy Releases) as part of the primary success path which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier as defined by Criterion 3 of 10CFR50.36(c)(2)(ii).

Therefore, the AFW pump start on Trip of all Main Feed Water Pumps Function does not meet Criterion 3 for retention in the TS.

The AFW pump start on Trip of all Main Feed Water Pumps is not modeled or credited in CPNPP PRA model and does not support the analyses associated with the risk informed applications implemented by CPNPP (i.e., WCAP-10271 with Supplements 1 and 2, WCAP-14333, and WCAP-15376). As such, this ESFAS instrument Function has not been shown to be significant to the public health and safety by PRA. In addition, no operating experience was found to indicate this ESFAS instrument Function is significant to the public health and safety. Therefore, the AFW pump start on Trip of all Main Feed Water Pumps does not meet Criterion 4 for retention in the TS.

As discussed in the Background section above, the ESFAS instrumentation provided for AFW pump starts is numerous and diverse. The AFW pump start Functions remaining to TXX-12139 Page 28 of 40 10/02/2012 in the TS include the following:

SG Water Level Low-Low SI, which includes the following:

o Manual Initiation, o

Containment Pressure --High 1 o

Pressurizer Pressure - Low, and o

Steam Line Pressure Low, and Loss of Offsite Power As such, the remaining TS requirements for the start of the AFW system will continue to assure adequate diversity and defense in depth for this ESFAS function.

In addition, the AFW pump start on Trip of all Main Feed Water Pumps would still be required operable in the same manner as before in the Technical Requirements Manual, a licensee document controlled by the 10CFR 50.59 process. Therefore, AFW pump start on Trip of all Main Feed Water Pumps would continue to provide the AFW pump start function in the same manner as before.

P-4 Interlock The P-4 Interlock is not credited in any design basis accident analysis described in CPNPP FSAR Chapter 15 Safety Analyses Condition II, III, and IV events and FSAR Chapter 6 (for Containment Mass and Energy Releases) as part of the primary success path which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier as defined by Criterion 3 of 10CFR50.36(c)(2)(ii). Therefore, the P-4 Interlock Function does not meet Criterion 3 for retention in the TS.

The P-4 interlock consists of several functions described in the Background section above.

Only the Feedwater isolation with low Tavg Function is credited in the PRA model.

Although Feedwater isolation on P-4 with low Tavg is credited in the PRA model, a PRA assessment has determined that this Function of the P-4 Interlock provides a very small benefit which does not satisfy Criterion 4 of 10 CFR 50.36(c)(2)(ii). The P-4 interlock includes several other functions, none of which are credited in the CPNPP PRA model, or the analyses supporting WCAP-10271 with Supplements 1 and 2, WCAP-14333, and WCAP-15376. Therefore, the P-4 interlock does not perform a safety function that PRA has shown to be significant to the public health and safety. In addition, no operating experience was found to indicate the P-4 interlock is significant to the public health and safety. Therefore, the P-4 Interlock does not meet Criterion 4 for retention in the TS.

Attachment I to TXX-12139 Page 29 of 40 10/02/2012 Conclusion In conclusion, the proposed relocation of the Pressurizer Water Level - High, Trip of all Main Feed water Pumps - AFW Start, and the P-4 Interlock Function is acceptable based on the following:

The instrument Functions proposed for relocation from the TS are not part of the primary success path which function or actuate to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier (i.e., they do not meet Criterion 3 of 10CFR50.36(c) (2)(ii) for retention in the TS),

The instrument Functions proposed for relocation from the TS have not been shown by operating experience or PRA to be significant to public health and safety (i.e., they do not meet Criterion 4 of 10CFR50.36(c)(2)(ii) for retention in the TS), and The requirements for the affected instrument Functions would be relocated in their entirety from the TS to the Technical Requirements Manual, a licensee document controlled under 10CFR50.59. As such, the affected instrument Functions would still be required operable in the same manner as before and would continue to provide the same safety functions as before. Sufficient regulatory controls exist under 10 CFR50.59 to address any future changes to these requirements. Thus, any future changes to the relocated ESFAS functions will continue to assure the safe operation of the plant.

Based on the above conclusions, implementation of the proposed change would not adversely affect the safe operation of the plant and would make the CPNPP TS more consistent with the requirements of 10CFR50.36(c)(2)(ii).

to TXX-12139 Page 30 of 40 10/02/2012 Table 1: Summary of Reactor Trip Signals Credited in Comanche Peak Accident Analyses, PRA Model, WCAP-10271/14333/15376 Implementation RT Function Safety Analysis PRA Model WCAP-10271/14333/15376

1. Manual reactor trip x3 X

X 2.a. Power range neutron flux - high X

2.b. Power range neutron flux - low X

x2

3. Power range neutron flux rate - high positive rate X

X X

4. Intermediate range neutron flux X

x2

5. Source range neutron flux X

x2

6. Overtemperature N-16 X

X X

7. Overpower N-16 X

8. a. Pressurizer pressure - low X

X X

8.b. Pressurizer pressure -high X

X X

9. Pressurizer water level - high3

10. Reactor coolant flow - low X

X X

11. Not used

12. Undervoltage RCPs X

X X

13. Underfrequency RCPs X

X X

14. Steam generator water level - low low X

X X

15. Not used 16.a. Turbine trip - low fluid oil pressure X1 16.b. Turbine trip - turbine stop valve closure X1

17. Safety injection input from the ESFAS X

X X

Permissives/Interlocks P-6, Intermediate Range Neutron Flux X

X X

P-7, Low Power Reactor Trips Block X

X X

P-8, Power Range Neutron Flux X

X X

P-9, Power Range Neutron Flux X

X X

P-10, Power Range Neutron Flux X

X X

P-13, Turbine First Stage Pressure X

X X

to TXX-12139 Page 31 of 40 10102/2012 Table 1 Notes:

1.

The Safety Analysis credits reactor trip on turbine trip with the turbine trip initiated by SG water level high for events that result in an increase in feedwater flow.

Although there are two sources of reactor trip on turbine trip, low fluid oil pressure and turbine stop valve closure, it was determined that both are necessary.

2.

Credited in low power and shutdown PRA models.

3.

Reactor trip on pressurizer water level - high and manual reactor trip are only included in the Safety Analysis as backup signals.

to TXX-12139 Page 32 of 40 10/02/2012 Table 2: Summary of ESFAS Signals Credited in Comanche Peak Accident Analyses, PRA Model, WCAP-10271/14333/15376 Implementation ESFAS Function Safety Analysis PRA Model WCAP-10271/14333/15376

1. Safety Injection L.a Manual initiation X_

X X

1.b Automatic actuation logic and actuation relays X

X X

L.c Containment pressure - high 1 X

x2 L.d Pressurizer pressure - low X

X X

L.e Steam line pressure - low X

X X

2. Containment Spray 2.a Manual initiation X_

2.b Automatic actuation logic and actuation relays X

X X

2.c Containment pressure - high 3 X

X X

3.a Containment Isolation, Phase A Isolation 3.a(1) Manual initiation X1 3.a(2) Automatic actuation logic and actuation relays X

X X

3.a(3) Safety injection X

X X

3.b Containment Isolation, Phase B Isolation 3.b(l) Manual initiation X1 3.b(2) Automatic actuation logic and actuation relays X

X X

3.b(3) Containment pressure - high 3 X

__X X

4. Steam Line Isolation 4.a Manual initiation X_

4.b Automatic actuation logic and actuation relays X

X X

4.c Containment pressure - high 2 X

X 4.d(1) Steam line pressure - low X

X X

4.d(2) Steam line pressure - negative rate - high See Note 3

5. Turbine Trip and Feedwater Isolation 5.a Automatic actuation logic and actuation relays X

X X

5.b SG water level - high (P-14)

X X

5.c Safety injection X

X

6. Auxiliary Feedwater

Attachment I to TXX-12139 Page 33 of 40 10/02/2012 6.a Automatic actuation logic and actuation relays (SSPS)

X X

X 6.b Not used 6.c SG water level - low low X

X X

6.d Safety injection X

X 6.e Loss ofoffsite power X

6.f Not used 6.g Trip of all main feedwater pumps

7. Automatic Switchover to Containment Sump 7.a Automatic actuation logic and actuation relays X

X 7.b Refueling water storage tank level - low low X

X Permissives/Interlocks P-4, Reactor Trip See Note 4 P-11, Pressuizer Pressure X

X X

Table 2 Notes:

1.

Manual initiations will not be relocated out of the TS to ensure a degree of defense-in-depth is maintained.

2.

SI on containment pressure - high 1 is a backup to SI on pressurizer pressure - low for large and medium LOCA. Although a backup signal, it is included in the CPNPP PRA model.

3.

Steamline isolation on steam line pressure high negative rate is implicitly required since it eliminates the need to consider a Mode 3 steamline break limiting.

4.

Included in the PRA model, but shown to provide only a very small benefit, therefore, it does not meet Criterion 4 of 10 CFR 50.36(c)(2)(ii).

to TXX-12139 Page 34 of 40 10/02/2012

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration The proposed amendment would revise Technical Specification (TS) 3.3.1, "Reactor Trip System (RTS)" and TS 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)

Instrumentation" to relocate the requirements for one RTS instrument Function and two ESFAS instrument Functions to the Technical Requirements Manual, a licensee document controlled under the 10CFR50.59 process. The RTS instrument Function proposed for relocation from the TS is the Pressurizer Water Level-High reactor trip (RTS TS Function Number 9). The two ESFAS instrument Functions proposed for relocation from the TS are the Auxiliary Feedwater (AFW) System start on "Trip of all Main Feedwater Pumps" (ESFAS TS Function Number 6.g) and the ESFAS Interlock "Reactor Trip, P-4" (ESFAS TS Function Number 8.a). The proposed relocation of the TS requirements for these RTS and ESFAS instrument Functions is based on the application of the TS Criteria of 10 CFR 50.36(c)(2)(ii).

10 CFR 50.36(c)(2)(ii) provides the criteria to be used for determining if a TS Limiting Condition of Operation (LCO) for a specific item should be included in the TS. The criteria is applied to screen structures, systems, components, installed instrumentation, or process variables to determine if a TS LCO is required. The RTS and ESFAS instrument Functions proposed for relocation from the TS do not meet the criteria of 10 CFR 50.36(c)(2)(ii) for inclusion in the TS. Specifically, the RTS and ESFAS instrument Functions proposed for relocation are not part of the primary success path which functions or actuates to mitigate a design basis accident or transient, nor are the instrument functions a system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety.

The proposed amendment would relocate the RTS and ESFAS Functions discussed above in their entirety, including the associated TS requirements such as the Mode of Applicability, the Actions Conditions, and Surveillance Requirements. The proposed amendment will not delete or alter any RTS or ESFAS instrumentation requirements or change the RTS or ESFAS Instrumentation design. As such, the existing defense in depth and diversity provided by the ESFAS Instrumentation will be maintained.

Luminant Power has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10CFR50.92, "Issuance of amendment," as discussed below:

1.

Do the proposed changes rivolve a significant increase in the probability or consequences of an accident previously evaluated?

Response

No The proposed change to the TS does not affect the initiators of any analyzed accident. In addition, operation in accordance with the proposed TS change will continue to ensure that the previously evaluated accidents will be mitigated as analyzed. Thus, the proposed change does not adversely affect the design function or operation of any structures, systems, and components important to safety.

Therefore, the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

to TXX-12139 Page 35 of 40 10/02/2012

2.

Do the proposed changes create the possibility of a new or different kind of accident from any accident previously evaluated?

Response

No The proposed change does not involve a physical alteration of the plant (no new or different type of equipment will be installed). The proposed change does not create any new failure modes for existing equipment or any new limiting single failures. Additionally the proposed change does not involve a change in the methods governing normal plant operation and all safety functions will continue to perform as previously assumed in accident analyses. Thus, the proposed change does not adversely affect the design function or operation of any structures, systems, and components important to safety.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

3.

Do the proposed changes involve a significant reduction in a margin of safety?

Response

No The proposed change will not adversely affect the operation of plant equipment or the function of equipment assumed in the accident analyses. The proposed changes to the RTS and ESFAS TS requirements do not change the RTS or ESFAS design and capability to perform the required safety functions consistent with the assumptions of the applicable safety analyses. In addition, operation in accordance with the proposed TS change will continue to ensure that the previously evaluated accidents will be mitigated as analyzed.

Therefore, the proposed change does not involve a reduction in a margin of safety.

Based on the above evaluations, Luminant Power concludes that the proposed amendment(s) present no significant hazards under the standards set forth in 10CFR50.92(c) and, accordingly, a finding of no significant hazards consideration is justified.

5.2 Applicable Regulatory Requirements/Criteria 10 CFR 50.36(c)(2)(ii) provides the criteria to be used for determining if a TS Limiting Condition of Operation (LCO) for a specific item should be included in the TS. The criteria is applied to screen structures, systems, components, installed instrumentation, or process variables such that if one or more of the criteria is met, a TS LCO must be established for the item. The application of the TS criteria to the ESFAS instrumentation is the basis for the proposed license amendment.

A review of 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants" and the Regulatory Guides, was conducted to assess the potential. impact associated with the proposed changes. The General Design Criteria (GDC) and the Regulatory Guides (RG) were evaluated as follows:

GDC 2 requires that structures, systems, and components important to safety be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, to TXX-12139 Page 36 of 40 10/02/2012 tsunami, and seiches without the loss of the capability to perform their safety functions.

GDC 4 requires that structures, systems, and components important to safety be designed to accommodate the effects of, and to be compatible with, the environmental conditions associated with the normal operation, maintenance, testing, and postulated accidents, including loss-of-coolant accidents. These structures, systems, and components shall be appropriately protected against dynamic effects, including the effects of missiles, pipe whipping, discharging fluids that may result from equipment failures, and from events and conditions outside the nuclear power unit. However, dynamic effects associated with postulated pipe ruptures in nuclear power units may be excluded from the design basis when analyses reviewed and approved by the Commission demonstrate that the probability of fluid system piping rupture is extremely low under conditions consistent with the design basis for the piping.

GDC-13 requires that instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems.

GDC-20 requires that the protection system(s) shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety.

GDC-21 requires that the protection system(s) shall be designed for high functional reliability and testability.

GDC-22 through GDC-25 and GDC-29 require various design attributes for the protection system(s), including independence, safe failure modes, separation from control systems, requirements for reactivity control malfunctions, and protection against anticipated operational occurrences.

Regulatory Guide 1.22 discusses an acceptable method of satisfying GDC-20 and GDC-21 regarding the periodic testing of protection system actuation functions. These periodic tests should duplicate, as closely as practicable, the performance that is required of the actuation devices in the event of an accident.

10 CFR 50.55a(h) requires that the protection systems meet IEEE 279-1971. Section 4.2 of IEEE 279-1971 discusses the general functional requirement for protection systems to assure they satisfy the single failure criterion.

In summary, the RTS and ESFAS instrument Functions proposed for relocation from the TS do not meet any of the 10 CFR 50.36(c)(2)(ii) criteria for inclusion in the TS. As such, TS 3.3.1, Reactor Trip System (RTS)" and TS 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)

Instrumentation" remain in compliance with 10CFR 50.36. In addition, the proposed relocation of these instrument functions from the TS does not change the RTS and ESFAS instrumentation design or function. Therefore, the RTS and ESFAS Instrumentation remain in compliance with the applicable regulatory requirements and guidance documents cited above.

In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner,

Attachment I to TXX-12139 Page 37 of 40 10/02/2012 (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

6.0 ENVIRONMENTAL CONSIDERATION

Luminant Power has determined that the proposed amendment would change requirements with respect to the installation or use of a facility component located within the restricted area, as defined in 10CFR20, or would change an inspection or surveillance requirement. Luminant Power has evaluated the proposed changes and has determined that the changes do not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amount of effluent that may be released offsite, or (iii) a significant increase in the individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10CFR51.22 (c)(9). Therefore, pursuant to 10CFR51.22 (b), an environmental assessment of the proposed change is not required.

7.0 PRECEDENTS The following precedents establish a basis for relocating requirements from the TS that do not meet the criteria of 10 CFR 50.36(c)(2}(ii}.

7.1 NRC Letter, Wolf Creek Generating Station -Issuance of Amendment Re: Revise Table 3.3.2-1 of Technical Specification 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation" (TAC No. ME3762) Dated March 30, 2011.

The licensee proposed to revise TS 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," Table 3.3.2-1, Function 8.a (Reactor Trip, P-4) by adding footnote (m) to identify the enabled functions and the applicable modes for the Reactor Trip, P-4 interlock function. The proposed footnote (m) to Function 8.a in TS Table 3.3.2-1 includes removing out of the TSs the following functions (referred as the "Subject functions"): (1) the P-4 function of transfer of the steam dump system to the plant trip controller in MODES 1, 2, and 3, (2) the P-4 turbine trip function in MODE 3, and (3) the P-4 feedwater isolation function in MODE 3. The technical analysis in the NRC Safety Evaluation included a review of the design bases accidents in the UFSAR and based on the design basis accident review, the NRC reviewed the "subject functions" against the 10 CFR 50.36(c)(2}(ii} criteria and concluded,

"...that that the existing LCO and related surveillance requirement associated with the "subject functions" do not satisfy any of the criteria in 10 CFR 50.36(c}(2)(ii). Therefore, the proposed removal of the "subject functions" out of the TSs does not violate the 10 CFR 50.36(c}(2}(ii} requirements and is acceptable.

7.2 NRC Letter, Final Safety Evaluation For Pressurized Water Reactor Owners Group (PWROG) Topical Report (TR) Wcap-15981-Np, "Post Accident Monitoring Instrumentation Re-Definition For Westinghouse NSSS (Nuclear Steam Supply System)

Plants" (TAC NO. MC4524) Dated February 28, 2008 In WCAP-15981-NP, the Post Accident Monitoring variables included in TS 3.3.3, "Post Accident Monitoring (PAM) Instrumentation" were evaluated against Criterion 3 and 4 of 10 CFR 50.36(c)(2)(ii) based on how each variable is used in accident management at to TXX-12139 Page 38 of 40 10/02/2012 Westinghouse NSSS plants. Based on the results of that analysis, eight PAM variables were approved by the NRC for relocation from the TS.

7.3 NRC Letter, Catawba Nuclear Station, Units 1 And 2 Re: Issuance of Amendments (TAC NOS. MB3747 AND MB3748) Dated September 10, 2003.

The licensee proposed the relocation of Technical. Specification (TS) 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation" Function 5.f, Turbine Trip on Trip of all Main Feedwater Pumps. The primary basis provided by the licensee for the relocation of this ESFAS Function was the failure to meet the 10 CFR 50.36(c)(2)(ii) criteria. In the NRC Safety Evaluation for the License Amendment the NRC concurred that the ESFAS function did not meet the 10 CFR 50.36(c)(2)(ii) criteria for retention in the TS and approved relocation of the ESFAS Function. The NRC Safety Evaluation stated the following:

"The licensee states that the function of tripping the main turbine upon loss of both main feedwater pumps is anticipatory in nature only, and is not credited in any accident analysis. The loss of normal feedwater flow transient is discussed in Section 15.2.7 of the Catawba UFSAR. The accident analysis for this transient showed that the loss of feedwater, whether it is caused by main feedwater pump failures or other initiating events, is mitigated by the steam generator low-low level reactor trip function. If a loss of both main feedwater pumps were to occur, the accident analysis showed that a reactor trip occurs on low-low steam generator level, which in turn, causes a turbine trip to occur via the P4 ESFAS Interlock (TS Table 3.3.2-1, Function 8a). Additionally, this relocation of Function 5.f from TS Table 3.3.2-1 is consistent with the STS, which does not contain this ESFAS function.

"On the basis of these considerations, the licensee concluded that this function does not meet the 10 CFR 50.36 criteria for inclusion in plant TS since it: 1) is not used to detect reactor coolant boundary leakage, 2) is not credited in any accident analyses, 3) does not function to mitigate an accident, and 4) is not risk significant. The licensee proposes to relocate this function from TS 3.3.2-1 into the licensee's SLC Manual that is subject to the administrative controls and review processes required by 10 CFR 50.59.

On the basis of the above-stated justifications, the criteria in 10 CFR 50.36, and the guidance in the STS, the staff concludes that the relocation of Function 5.f from TS 3.3.2 to the SLC Manual is acceptable."

7.4 NRC Letter, Amendment No. 45 to Facility Operating License NPF-86: Feedwater Isolation - Low RCS Tavg Coincident With a Reactor Trip License Amendment Request 95-08 (TAC M93713) Dated November 29, 1995.

The Amendment revises the TS by relocating an ESFAS Instrumentation Function to a licensee document controlled by 10CFR50.59. In the Safety Evaluation the NRC stated the following:

"The staff has concluded that the instrumentation utilized to cause feedwater isolation on low RCS Tavg coincident with reactor trip does not serve a primary protective function so as to warrant inclusion in the TS in accordance with the criteria of 10 CFR 50.36. The to TXX-12139 Page 39 of 40 10/02/2012 instrumentation does not serve to ensure that the plant is operated within the bounds of initial conditions assumed in design basis accident and transient analyses or that the plant will be operated to preclude transients or accidents. Likewise, the feedwater isolation on low RCS Tavg coincident with reactor trip instrumentation does not serve as part of the primary success path of a safety sequence analysis used to demonstrate that the consequences of these events are within the appropriate acceptance criteria.

Accordingly, the staff has determined that the requirements for the feedwater isolation on low RCS T coincident with reactor trip monitoring instrumentation do not meet the criteria in 10 CFR 50.36."

"In conclusion, these specific instrumentation requirements related to feedwater isolation on low RCS Tavg coincident with reactor trip, are not required to be in the TS tinder 10CFR 50.36 or Section 182a of the Act, and are not required to obviate the possibility of an abnormal situation or event giving rise to an immediate threat to the public health and safety. Further, they do not fall within any of the four criteria which were set forth in the Commission's Final Policy Statement and incorporated into 10 CFR 50.36. In addition, the staff finds that sufficient regulatory controls exist under 10 CFR 50.59, or such other specific regulatory control as may be applicable in the particular instance, to address future changes to these requirements. Accordingly, the staff has concluded that these requirements may be relocated from the TS to North Atlantic's Technical Requirements Manual."

8.0 REFERENCES

8.1 Comanche Peak Nuclear Power Plant Final Safety Analysis Report (FSAR), Amendment 104, August 1, 2011.

8.2 Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors," 58 FR 39132, July 22, 1993.

8.3 NUREG-1431, "Standard Technical Specifications Westinghouse Plants" Revision 4.0, April 2012.

8.4 Wolf Creek - "Docket No. 50-482: Licensee Event Report 2010-002-00, Turbine Trip Function of Reactor Trip, P-4 Interlock Defeated During Entry Into and in Mode 3."

Dated March 29, 2010.

8.5 Wolf Creek - "Docket No. 50-482: Licensee Event Report 2009-009-01, Defeating Feedwater Isolation on Low Tavg Coincident with P-4 Function Results in Missed Mode Change." Dated March 22, 2010.

8.6 NRC Letter, "Wolf Creek Generating Station - Issuance of Amendment Re: Revision To Technical Specification 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)

Instrumentation" (Emergency Circumstances) (TAC No. ME3465)." Dated March 5, 2010 8.7 Watts Bar Nuclear Plant (WBN) Unit I - Licensee Event Report (LER) 390/2006-008 -

"Auxiliary Feedwater Auto-Start Function Upon loss Of Main Feedwater Pumps," Dated December 19, 2006.

to TXX-12139 Page 40 of 40 10/02/2012 8.8 NRC Letter, "Amendment No. 126 To Facility Operating License No. NPF-30 Callaway Plant, Unit 1 (TAC No. M99420)."

8.9 Turkey Point Unit 3, Docket No. 50-250, LER No. 2004-005-00, "Heat-Damaged Cables in Containment Cause Potential Inoperability of 2 of 3 Pressurizer Water Level Monitoring Channels," February 1, 2005.

8.10 Regulatory Guide 1.174, "An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant Specific Changes To The Licensing Basis," Rev. 2, May 2011.

8.11 WCAP-10271-P-A, "Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection instrumentation System", May 1986.

8.12 WCAP-10271, Supplement 1-P-A, "Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection instrumentation System, Supplement 1", May 1986.

8.13 WCAP-10271-P-A, Supplement 2, Revision 1, "Evaluation of Surveillance Frequencies and Out of Service Times for the Engineered Safety Features Actuation System", May 1989.

8.14 WCAP-14333-P-A, Rev. 1, "Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times", October 1998.

8.15 WCAP-15376-P-A, Rev. 1, "Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times", March 2003.

8.16 Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Rev. 1, January 2007.

8.17 Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Rev. 2, March 2009.

8.18 PWROG Program, PA-LSC-0331, "RITSTF Initiative 8a - Relocate LCOs that do not Satisfy Criterion 4 of 10 CFR 50.36(c)(2)(ii)".

ATTACHMENT 2 to TXX-12139 PROPOSED TECHNICAL SPECIFICATION CHANGES (MARKUP)

Pages 3.3-17 3.3-25 3.3-28 3.3-33 3.3-34

RTS Instrumentation 3.3.1 Not Used.

Table 3.3.1-1 (page 3 of 6)

Reactor Trip System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE(a)

9.

Pressurizer Water Level -

Vg 3

M SR 3.3.1.1

< 93.9% of High SR 3.3.1.7 instrument a

-__SR 3.3.1.10 M

SR 3.3.1.1

_88.6% of indicated SR 3.3.1.7 loon flow (Unit 1)

10. Reactor Coolant Flow -

Low 1(g) 3 per loop SR 3.3.1.10 SR 3.3.1.16

_ 88.8% of indicated loop flow (Unit 2)

11. Not Used

12. Undervoltage RCPs

13. Underfrequency RCPs 1 (g) 1 (g) 1,2 1 per bus 1 per bus 4 per SG M

SR 3.3.1.9 SR 3.3.1.10 SR 3.3.1.16 M

SR 3.3.1.9 SR 3.3.1.10 SR 3.3.1.16 E

SR 3.3.1.1 SR 3.3.1.7 SR 3.3.1.10 SR 3.3.1.16

> 4753 V

Ž 57.06 Hz

14. Steam Generator (SG)

Water Level Low-Low (1)

> 37.5% of narrow range instrument span (Unit 1) (q)(r)

_ 34.9% of narrow range instrument span (Unit 2 )(q)(r)

15. Not Used.

(a)

(g)

(I)

(q)

(r)

The Allowable Value defines the limiting safety system setting except for Trip Functions 2a, 2b, 6, 7, and 14 (the Nominal Trip Setpoint defines the limiting safety system setting for these Trip Functions). See the Bases for the Nominal Trip Setpoints.

Above the P-7 (Low Power Reactor Trips Block) interlock.

The applicable MODES for these channels in Table 3.3.2-1 are more restrictive.

If the as-found channel setpoint is conservative with respect to the Allowable Value but outside its predefined as-found acceptance criteria band, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

The instrument channel setpoint shall be reset to a value that is within the as-left tolerance of the Nominal Trip Setpoint, or a value that is more conservative than the Trip Setpoint; otherwise, the channel shall be declared inoperable. The Nominal Trip Setpoint, the methodology used to determine the as-found tolerance and the methodology used to determine the as-left tolerance shall be specified in the Technical Specification Bases.

COMANCHE PEAK - UNITS 1 AND 2 3.3-17 Amendment No. 445G-, 156

ESFAS Instrumentation 3.3.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME I. One channel inoperable.

---

NOTE One channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing.

1.1 Place channel in trip.

72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Not Used.

OR 1.2 Be in MODE 3.

78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> J. One Main Feedwater Pump Ip channel inoperable.

J.1 Place channel in trip.

OR J.2 Be in MODE 3.

6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours i

i i

K. One channel inoperable.

NOTE------------

One channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing.

K.1 Place channel in bypass.

OR K.2.1 Be in MODE 3.

AND K.2.2 Be in MODE 5.

72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> 78 hours 108 hours0.00125 days <br />0.03 hours <br />1.785714e-4 weeks <br />4.1094e-5 months <br /> COMANCHE PEAK-UNITS 1 AND 2 3.3-25 Amendment No. 449-, 156

ESFAS Instrumentation 3.3.2 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.3.2.9

---

NOTE ------------------

This Surveillance shall include verification that the time constants are adjusted to the prescribed values.

Perform CHANNEL CALIBRATION.

In accordance with the Surveillance Frequency Control Program.

SR 3.3.2.10

---

NOTE ------------------

Not required to be performed for the turbine driven AFW pump until 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after SG pressure is _: 532 psig.

Verify ESF RESPONSE TIMES are within limits.

In accordance with the Surveillance Frequency Control Program.

SR 3.3.2.11

---

NOTE ------------------------------------

Verification of setpoint not required.

Perform TADOT.

In accordance with the Surveillance Frequency Control Program.

COMANCHE PEAK-UNITS 1 AND 2 3.3-28 Amendment No. 460-, 156

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 5 of 6)

Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE(a)

6.

Auxiliary Feedwater

a.

Automatic Actuation Logic and Actuation Relays (Solid State Protection System) 1,2,3 2 trains G

SR 3.3.2.2 SR 3.3.2.4 SR 3.3.2.6 NA

b. Not Used.

c.

SG Water Level Low-Low 1,2,3 4 per SG D

SR 3.3.2.1 SR 3.3.2.5 SR 3.3.2.9 SR 3.3.2.10

>37.5% of narrow range span (Unit 1) (q)(r)

>34.9% of narrow range span (Unit 2) (q)(r)

d.

Safety Injection

e. Loss of Offsite Power Refer to Function 1 (Safety Injection) for all initiation functions and requirements.

1,2,3 1 per train F

SR 3.3.2.7 Qeo'q )

0 NA

f.

Not Used.

g. Trip of all Main 1,2

( F Pumps

h.

Not Used.

Not Used.

SR 3.3.2.10 J

SR 3.3.2.8 NA 2 per AFW pump (a)

(q)

(r)

The Allowable Value defines the limiting safety system except for functions 5b and 6c (the Nominal Trip Setpoint defines the limiting safety system setting for these Trip Functions). See the Bases for the Nominal Trip Setpoints.

If the as-found channel setpoint is conservative with respect to the Allowable Value but outside its predefined as-found acceptance criteria band, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

The instrument channel setpoint shall be reset to a value that is within the as-left tolerance of the Nominal Trip Setpoint, or a value that is more conservative than the Trip Setpoint; otherwise, the channel shall be declared inoperable. The Nominal Trip Setpoint, the methodology used to determine the as-found tolerance and the methodology used to determine the as-left tolerance shall be specified in the Technical Specification Bases.

COMANCHE PEAK - UNITS 1 AND 2 3.3-33 Amendment No. 464-, 156

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 6 of 6)

Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE(a)

7. Automatic Switchover to Containment Sump

a. Automatic Actuation Logic and Actuation Relays

b.

Refueling Water Storage Tank (RWST) Level - Low Low 1,2,3,4 1,2,3,4 2 trains C

SR 3.3.2.2 SR 3.3.2.4 SR 3.3.2.6 K

SR 3.3.2.1 SR 3.3.2.5 SR 3.3.2.9 SR 3.3.2.10 NA 4

> 31.9%

instrument span Coincident with Safety Injection Refer to Function 1 (Safety Injection) for all initiation functions and requirements.

8.

ESFAS Interlocks F

SR 3.3.2.11 NA

a.

Reactor Trip, P-4

b. Pressurizer Pressure, P-11 1,2, 3 1 per train, 2 trains 1,2,3 3.

L SR 3.3.2.5 SR 3.3.2.9

< 1975.2 psig (Unit 1)

< 1976.4 psig (Unit 2)

(a) The Allowable Value defines the limiting safety system except for functions 5b and 6c (the Nominal Trip Setpoint defines the limiting safety system setting for these Trip Functions). See the Bases for the Nominal Trip Setpoints.

COMANCHE PEAK-UNITS 1 AND 2 3.3-34 Amendment No. 4-50-, 156

ATTACHMENT 3 to TXX-12139 PROPOSED TECHNICAL SPECIFICATIONS BASES CHANGES (Markup For Information Only)

Pages B 3.3-17 B 3.3-37 B 3.3-56 B 3.3-83 B 3.3-84 B 3.3-86 B 3.3-87 B 3.3-93 B 3.3-96 B 3.3-97 B 3.3-101 B 3.3-103 B 3.3-107

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) setting minimizes challenges to safety valves while avoiding unnecessary reactor trip for those pressure increases that can be controlled by the PORVs.

In MODE 1 or 2, the Pressurizer Pressure-High trip must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the relief and safety valves. In MODE 3, 4, 5, or 6, the Pressurizer Pressure-High trip Function does not havew to be OPERABLE because transients that could cause an overpressure condition will be slow to occur. Therefore, the operator will have sufficient time to Not sed.evaluate unit conditions and take corrective actions.

Additionally, low temperature overpressure protection systems provide overpressure protection when in MODE 4 or ebelow.

9.

Pressurizer Water Level-High The Pressurizer Water Level-High trip Function provides a backup signal for the Pressurizer Pressure-High trip and also provides protection against water relief through the pressurizer safety valves.

These valves are designed to pass steam in order to achieve their design energy removal rate. A reactor trip is actuated prior to the pressurizer becoming water solid. The LCO requires three channels of Pressurizer Water Level-High to be OPERABLE. The pressurizer level channels are used as input to the Pressurizer Level Control System. A fourth channel is not required to address control/

protection interaction concerns. The level channels do not actuate the safety valves, and the high pressure reactor trip is set below the safety valve setting.

Therefore, with the slow rate of charging available, pressure overshoot due to level channel failure cannot cause the safety valve to lift before reactor high pressure trip.

In MODE 1, when there is a potential for overfilling the pressurizer, the Pressurizer Water Level-High trip must be OPERABLE. This trip FUnction is automatically enabled on increasing power by the P-7 interlock. On decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, transients that could raise the pressurizer water level will be slow and the operator will have sufficient time to evaluate unit conditions and take corrective'y ctions.

(continued)

COMANCHE PEAK-UNITS 1 AND 2 B 3.3-17 Revision67

RTS Instrumentation B 3.3.1 BASES ACTIONS K.1, K.2.1 and K.2.2 (continued) reactivity (i.e., temperature or boron concentration fluctuations associated with RCS inventory or chemistry management or temperature control) are permitted provided the ADM limits specified in the COLR are met and the initial and critical boron concentration assumptions in FSAR Section 15 are satisfied.

L. 1 Not Used.

M.1 and M.2 Condition M applies to the following reactor trip Functions:

° Pressurizer Pressure-Low; C.,Pressurizer WaterLel-ih WteLevel-High; Reactor Coolant Flow-Low; Undervoltage RCPs; and Underfrequency RCPs.

With one channel inoperable, the inoperable channel must be placed in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. For the Pressurizer Pressure-Low, ressurizer Water Level-High) Undervotage RCPs, and Underfrequency RCPs trip Functions, placing the channel in the tripped condition when above the P-7 setpoint results in a partial trip condition requiring only one additional channel to initiate a reactor trip. For the Reactor Coolant Flow -

Low trip Function, placing the channel in the tripped condition when above the P-8 setpoint results in a partial trip condition requiring only one additional channel in the same loop to initiate a reactor trip. Two tripped channels in two RCS loops are required to initiate a reactor trip when below the P-8 setpoint and above the P-7 setpoint. These Functions do not have to be OPERABLE below the P-7 setpoint because there are no loss of flow trips below the P-7 setpoint. There is insufficient heat production to generate DNB conditions below the P-7 setpoint. The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed to place the channel in the tripped condition is justified in Reference 11. An additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is allowed to reduce THERMAL POWER to below P-7 if the inoperable channel cannot be restored to OPERABLE status or placed in trip within the specified Completion Time.

(continued)

COMANCHE PEAK-UNITS 1 AND 2 B 3.3-37 Revision67

RTS Instrumentation B 3.3.1 Not Ued.

Table B 3.3.1-1 (Page 1 of 2)

Reactor Trip System Setpoints FUNCTION 1.

2.

2.

3.

Manual Rector Trip

a. Power Range Neutron Flux, High

b. Power Range Neutron Flux, Low Power Range Neutron Flux Rate, High Positive Rate NOMINAL TRIP SETPOINT N/A 109% RTP 25% RTP 5% RTP with a time constant

> 2 seconds 25% RTP

4. Intermediate Range Neutron Flux, High

5. Source Range Neutron Flux, High

6. Overtemperature N-16

7. Overpower N-16

8. a. Pressurizer Pressure, Low

8. b. Pressurizer Pressure, High

9. Pressurizer Water Level - High

10. Reactor Coolant Flow - Low

11. Not Used.

12. Undervoltage RCPs

13. Underfrequency RCPs

14. Steam Generator Water Level - Low-Low

15. Not Used.

16. Turbine Trip

a. Low Fluid Oil Pressure

b. Turbine Stop Valve Closure 105 cps See Note 1, Table 3.3.1-1 112% RTP 1880 psig 2385 psig 92% span 90% of nominal flow 4830 volts 57.2 Hz 38% NR (Unit 1) 35.4% NR (Unit 2) 59 psig 1% open COMANCHE PEAK - UNITS 1 AND 2 B 3.3-56 Revision67

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) decay heat removal. D)uring a loss of offsite power, to both safety related busses feeding the motor driven AFW pumps, the loss of power to the bus feeding the turbine driven AFW pump valve control motor will start the turbine driven AFW pump to ensure that at least one SG contains enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip. In addition, once the diesel generators are started and up to speed, the motor driven AFW pumps will be sequentially loaded onto the diesel generator busses.

Functions 6.a through 6.e must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. SG Water Level-Low Low in any operating SG will cause the motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level-Low Low in any two operating SGs will cause the turbine driven pumps to start. These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.

f.

Not Used

g.

Auxiliary Feedwater - Trip of All Main Feedwater Pumps A Trip of all MFW pumps is an indication of a loss of MFW o Uand the subsequent need for some method of decay heat and NUdsensible heat removal to bring the reactor back to no load temperature and pressure. Each turbine driven MFW pump is equipped with two pressure switches on the oil line for the speed control system. A Train "A" and a Train "B" sensor is on each MFW pump. The Train "A(B)" trip signals from both MFW pumps are required to actuate the Train "A(B)" motor-driven auxiliary feedwater pump. A trip of all MFW pumps starts the motor driven AFW pumps to ensure that at least one SG is available with water to act as the heat sink for the reactor.

(continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-83 Revision67

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

FFunction 6.g must be OPERABLE in MODES 1 and 2. This ensures that at least one SG is provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident. In MODES 3, 4, and 5, the MFW pumps may be normally shut down, and thus pump trip is not indicative of a condition requiring automatic AFW initiation.

h.

Not Used.

7.

Automatic Switchover to Containment Sump At the end of the injection phase of a LOCA, the RWST will be nearly empty. Continued cooling must be provided by the ECCS to remove decay heat. The source of water for the RHR pumps is semi-automatically switched to the containment recirculation sumps. After switching the low head residual heat removal (RHR) pumps draw the water from the containment recirculation sump, the RHR pumps pump the water through the RHR heat exchanger, inject the water back into the RCS, and supply the cooled water to the suction of the other ECCS pumps. Switchover from the RWST to the containment sump must occur before the RWST Empty setpoint. Switchover of the containment spray pumps from the RWST to the containment sump is performed manually after completion of ECCS switchover, but before the Empty setpoint is reached. For similar reasons, switchover must not occur before there is sufficient water in the containment sump to support ESF pump suction. Furthermore, early switchover must not occur to ensure that sufficient borated water is injected from the RWST. Raising the nominal RWST level at which Operations starts switchover (33%) would require prior NRC approval. This ensures the reactor remains shut down in the recirculation mode.

a.

Automatic Switchover to Containment Sump - Automatic Actuation Logic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

(continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-84 Revision67

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.

8.

Engineered Safety Feature Actuation System Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlock Functions back up manual actions to ensure by passable functions are in operation under the conditions assumed in the safety analyses.

a.

Engineered Safety Feature Actuation System Interlocks -

~Reactor Trip, P-4 The P-4 interlock is enabled when a reactor trip breaker (RTB) and its associated bypass breaker is open. The P-4 permissive also prevents re-actuation of safety injection after a manual reset of safety injection following at least a 60 second delay time. This Function allows operators to take manual control of SI systems after the initial phase of injection is complete. Once SI is blocked, automatic actuation of SI cannot occur until the RTBs have been manually closed.

Those functions that use the P-4 interlock are listed below; however, the LCO only requires the main turbine trip function to be operable. The remaining functions use a signal associated with the P-4 interlock, but are not credited in the accident analyses.

Trips the main turbine; Isolates MFW with coincident low Tavg; Prevent automatic reactuation of SI after a manual reset of SI; Allows arming of the steam dump valves and transfers the steam dump from the load rejection Tavg controller to the plant trip controller; and (otne (continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-86 Revision67

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Prevents opening of the MFW isolatior were closed on SI or SG Water Level-n valves if they High High.

BASES Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS following a reactor trip. An excessive cooldown of the RCS following a reactor trip could cause an insertion of positive reactivity with a subsequent increase in core power. To avoid such a situation, the noted Functions have been interlocked with P-4 as part of the design of the unit control and protection system.

None of the noted Functions serves a mitigation function in the unit licensing basis safety analyses. Only the turbine trip Function is explicitly assumed since it is an immediate consequence of the reactor trip Function. Neither turbine trip, nor any of the other four Functions associated with the reactor trip signal, is required to show that the unit licensing basis safety analysis acceptance criteria are met.

The RTB position switches that provide input to the P-4 interlock only function to energize or de-energize or open or close contacts. Therefore, this Function has no adjustable trip setpoint with which to associate a Trip Setpoint and Allowable Value.

This Function must be OPERABLE in MODES 1,2, and 3 when the reactor may be critical or approaching criticality,

b.

Engineered Safety Feature Actuation System Interlocks -

Pressurizer Pressure, P-1 The P-1 I interlock permits a normal unit cooldown and depressurization without actuation of SI or main steam line isolation. With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-1 1 setpoint, the operator can manually block the Pressurizer Pressure-Low and Steam Line Pressure-Low SI signals and the Steam Line Pressure-Low steam line isolation signal (previously discussed). When the Steam Line Pressure-Low steam line isolation signal is manually blocked, a main steam isolation signal on Steam Line Pressure - Negative Rate-High is automatically enabled. This provides protection for an SLB by closure of the MSIVs. With two-out-of-three pressurizer (continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-87 Revision67

ESFAS Instrumentation B 3.3.2 BASES ACTIONS E.1, E.2.1, and E.2.2 (continued) condition (assuming the inoperable channel has failed high). The completion Time is further justified based on the low probability of an event occurring during this interval. Failure to restore the inoperable channel to OPERABLE status, or place it in the bypassed condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.

The Required Actions are modified by a Note that allows placing one channel in bypass for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> while performing routine surveillance testing. The channel to be tested can be tested in bypass with the inoperable channel also in bypass. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> time limit is justified in Reference 12.

F.1, F.2.1, and F.2.2 Condition F applies to:

Manual Initiation of Steam Line Isolation; Loss of Offsite 1/4.

For the Manual Initiation and the P-4 Interlock Function this action addresses the train orientation of the SSPS. For the Loss of Offsite Power Function, this action recognizes the lack of manual trip provision for a failed channel. If a train or channel is inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of these Functions, the available redundancy, and the low probability of an event occurring during this interval. If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.

(continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-93 Revision67

ESFAS Instrumentation B 3.3.2 BASES ACTIONS H.1 and H.2 (continued)

The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing provided the other train is OPERABLE. This allowance is based on the reliability analysis (Ref. 6) assumption that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the average time required to perform channel surveillance.

1.1 and 1.2 Condition I applies to:

SG Water Level-High High (P-14)

If one channel is inoperable, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> are allowed to restore one channel to OPERABLE status or to place it in the tripped condition. If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-two or one-out-of-three logic will result in actuation. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is justified in Reference 12. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE: 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, these Functions are no longer required OPERABLE.

The Required Actions are modified by a Note that allows placing one channel in bypass for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> while performing surveillance testing.

The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed to place the inoperable channel in the tripped condition, and the 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed for a second channel to be in the bypassed condition for testing, are justified in Reference 12.

E Not Used.

ýýD

-I J.1 and J.2 J.1 and J.2 Condition J applies to the AFW pump start on trip of all MFW pumps.

This action addresses the train orientation of the SSPS for the auto start function of the AFW System on loss of all MFW pumps. The OPERABILITY of the AFW System must be assured by allowing automatic start of the AFW System pumps. If a channel is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to place it in the tripped condition.

If the channel cannot be tripped in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, 6 additional hours are allowed to place the unit in MODE 3. The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and _

/

(continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-96 Revision67

ESFAS Instrumentation B 3.3.2 BASES ACTIONS J.1 and J.2 (continued) without challenging unit systems. In MODE 3, the unit does not have any analyzed transients or conditions that require the explicit use of the protection function noted a~bove.

K.1, K.2.1 and K.2.2 Condition K applies to:

RWST Level-Low Low Coincident with Safety Injection.

RWST Level-Low Low Coincident With SI provides semi-automatic actuation of switchover to the containment recirculation sumps. Note that this Function requires the bistables to energize to perform their required action.

The failure of up to two channels will not prevent the operation of this Function. However, placing a failed channel in the tripped condition could result in a premature switchover to the sump, prior to the injection of the minimum volume from the RWST. Placing the inoperable channel in bypass results in a two-out-of-three logic configuration, which satisfies the requirement to allow another failure without disabling actuation of the switchover when required. Restoring the channel to OPERABLE status or placing the inoperable channel in the bypass condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is sufficient to ensure that the Function remains OPERABLE, and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). T'he 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 78 hour9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> Completion Times are justified in References 8 and 12. If the channel cannot be returned to OPERABLE status or placed in the bypass condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the unit must be brought to MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 5 within the next 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.

The Required Actions are modified by a Note that allows placing one channel in bypass for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> while performing routine surveillance testing. The channel to be tested can be tested in bypass with the inoperable channel also in bypass. The total of 78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> to reach MODE 3 and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for a second channel to be bypassed is acceptable based on the results of References 8 and 12.

L.1, L.2.1 and L.2.2 Condition L applies to the P-1 1 interlock.

(continued)

COMANCHE PEAK-UNITS 1 AND 2 B 3.3-97 Revision67

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.6 (continued)

REQUIREMENTS check of the circuit containing contacts operated by the slave relay.. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

For ESFAS slave relays and auxiliary relays which are Westinghouse type AR relays, the slave relay reliability assessment presented in Reference 10 is relay specific and applies only to Westinghouse type AR relays with AC coils. Note that, for normally energized applications, the relays may require periodic replacement in accordance with the guidance given in Reference 10.

SR 3.3.2.7 SR 3.3.2.7 is the performance of a TADOT. This test is a check of the Loss of Offsite Power Function.

The SR is modified by a Note that excludes verification of setpoints for relays. Relay setpoints require elaborate bench calibration and are verified during CHANNEL CALIBRATION. The SR is modified by a second note that excludes the actuation of final devices from the surveillance testing. The start of the auxiliary feedwater pumps during this SR is unnecessary as these pumps are adequately tested by the SRs for LCO 3.7.5. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.8 SR 3.3.2.8 is the performance of a TADOT. This test is a check of the Manual Actuation Functionsn AV pump start on trip of all MFW pumpsj The Safety Injection TADOT shall independently verify the OPERABILITY of the handswitch undervoltage and shunt trip contacts for both the Reactor.

Trip Breakers and Reactor Trip Bypass Breakers as well as the contacts for safety injection actuation. As a minimum, each Manual Actuation Function is tested up to, but not including, the master relay coils. This test overlaps with the master relay coil testing performed in accordance with SR 3.3.2.4. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The SR is modified by a Note that excludes verification of setpoints during the TADOT for manual initiation Functions. The manual initiation Functions have no associated setpoints.

SR 3.3.2.9 SR 3.3.2.9 is the performance of a CHANNEL CALIBRATION.

(continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-101 Revision67

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.10 (continued)

REQUIREMENTS Response Time testing, required channels, and acceptance criteria are included in the Technical Requirements Manual (Ref. 7). For each Functional Unit to which this SR applies, at least one ESF function has a required response time but not necessarily all associated ESF functions. No credit was taken in the safety analyses for those channels with response time listed as N.A. When the response time for a function in the TRM is NA, no specific testing need be performed to comply with this SR. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the Trip Setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position).

For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/

lag, etc.), the response time testing may be performed with the transfer functions set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.

Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be used for selected components provided that the components and methodology for verification have been previously NRC approved.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Response time verification in lieu of actual testing may be performed on ESFAS components in accordance with reference 11.

This SR is modified by a Note that clarifies that the turbine driven AFW pump is tested within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after reaching 532 psig in the SGs.

SR 3.3.2.11 SR 3.3.2.11 is the performance of a TADOT as described in SR 3.3.2.8, except that it is performed for the P-4 Reactor Trip Interlock. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

I The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Function tested has no associated setpoint.

(continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-103 Revision67

ESFAS Instrumentation B 3.3.2 No Ued.~

Table B 3.3.2-1 (Page 3 of 3)

ESFAS Trip Setpoints FUNCTION NOMINAL TRIP SETPOINT

6. Auxiliary Feedwater (continued)

g. Trip of All Main Feedwater Pumps NA

h.

Not Used.

7. Automatic Switchover to Containment Sump

a. Automatic Actuation Logic and Actuation Relays NA

b. Refueling Water Storage Tank (RWST) Level -Low-Low 33.0%

Coincident with Safety Injection

8. ESFAS Interlocks

ýal*eactor ýTrip, P-4 NA

b. Pressurizer Pressure, P-11 1960 psig COMANCHE PEAK - UNITS 1 AND 2 B 3.3-107 Revision67

ATTACHMENT 4 to TXX-12139 RETYPED TECHNICAL SPECIFICATION PAGES Pages 3.3-17 3.3-25 3.3-28 3.3-33 3.3-34

RTS Instrumentation 3.3.1 Table 3.3.1-1 (page 3 of 6)

Reactor Trip System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE(a)

9.

Not Used

10. Reactor Coolant Flow -

l(g) 3 per loop M

SR 3.3.1.1

>88.6% of indicated Low SR 3.3.1.7 loop flow (Unit 1)

SR 3.3.1.10

>88.8% of indicated SR 3.3.1.16 loop flow (Unit 2)

11. Not Used

12. Undervoltage l(g)

I per bus M

SR 3.3.1.9

> 4753 V RCPs SR 3.3.1.10 SR 3.3.1.16

13. Underfrequency 1(g) 1 per bus M

SR 3.3.1.9

> 57.06 Hz RCPs SR 3.3.1.10 SR 3.3.1.16

14. Steam Generator (SG) 1,2 4 per SG E

SR 3.3.1.1 2! 37.5% of narrow Water Level Low-Low (I)

SR 3.3.1.7 range instrument SR 3.3.1.10 span SR 3.3.1.16 (Unit 1) (q)(r)

-> 34.9% of narrow range instrument span (Unit 2 )(q)(r)

15. Not Used.

(a)

(g)

(I)

(q)

(r)

The Allowable Value defines the limiting safety system setting except for Trip Functions 2a, 2b, 6, 7, and 14 (the Nominal Trip Setpoint defines the limiting safety system setting for these Trip Functions). See the Bases for the Nominal Trip Setpoints.

Above the P-7 (Low Power Reactor Trips Block) interlock.

The applicable MODES for these channels in Table 3.3.2-1 are more restrictive.

If the as-found channel setpoint is conservative with respect to the Allowable Value but outside its predefined as-found acceptance criteria band, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

The instrument channel setpoint shall be reset to a value that is within the as-left tolerance of the Nominal Trip Setpoint, or a value that is more conservative than the Trip Setpoint; otherwise, the channel shall be declared inoperable. The Nominal Trip Setpoint, the methodology used to determine the as-found tolerance and the methodology used to determine the as-left tolerance shall be specified in the Technical Specification Bases.

COMANCHE PEAK - UNITS 1 AND 2 3.3-17 Amendment No. 460-, 46&,

ESFAS Instrumentation 3.3.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME I. One channel inoperable.

---

NOTE One channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing.

1.1 Place channel in trip.

72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR 1.2 Be in MODE 3.

78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> J. Not Used.

K. One channel inoperable.

---

NOTE One channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing.

K.1 Place channel in bypass.

72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR K.2.1 Be in MODE 3.

78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> AND K.2.2 Be in MODE 5.

108 hours0.00125 days <br />0.03 hours <br />1.785714e-4 weeks <br />4.1094e-5 months <br /> COMANCHE PEAK - UNITS 1 AND 2 3.3-25 Amendment No. 4&&, 4W

ESFAS Instrumentation 3.3.2 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.3.2.9

---

NOTE This Surveillance shall include verification that the time constants are adjusted to the prescribed values.

Perform CHANNEL CALIBRATION.

In accordance with the Surveillance Frequency Control Program.

SR 3.3.2.10

---

NOTE Not required to be performed for the turbine driven AFW pump until 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after SG pressure is - 532 psig.

Verify ESF RESPONSE TIMES are within limits.

In accordance with the Surveillance Frequency Control Program.

SR 3.3.2.11 Not Used.

COMANCHE PEAK-UNITS 1 AND 2 3.3-28 Amendment No. 464-, 4W

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 5 of 6)

Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE(a)

6.

Auxiliary Feedwater

a. Automatic Actuation 1, 2, 3 2 trains G

SR 3.3.2.2 NA Logic and Actuation SR 3.3.2.4 Relays (Solid State SR 3.3.2.6 Protection System)

b.

Not Used.

c.

SG Water Level 1,2, 3 4 per SG D

SR 3.3.2.1

_>37.5% of narrow Low-Low SR 3.3.2.5 range span SR 3.3.2.9 (Unit 1) (q)(r)

SR 3.3.2.10

Ž>34.9% of narrow range span (Unit 2) (q)(r)

d.

Safety Injection Refer to Function 1 (Safety Injection) for all initiation functions and requirements.

e. Loss of Offsite 1, 2, 3 1 per train F

SR 3.3.2.7 NA Power SR 3.3.2.9 SR 3.3.2.10

f.

Not Used.

g.

Not Used.

h.

Not Used.

(a)

(q)

(r)

The Allowable Value defines the limiting safety system except for functions 5b and 6c (the Nominal Trip Setpoint defines the limiting safety system setting for these Trip Functions). See the Bases for the Nominal Trip Setpoints.

If the as-found channel setpoint is conservative with respect to the Allowable Value but outside its predefined as-found acceptance criteria band, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

The instrument channel setpoint shall be reset to a value that is within the as-left tolerance of the Nominal Trip Setpoint, or a value that is more conservative than the Trip Setpoint; otherwise, the channel shall be declared inoperable. The Nominal Trip Setpoint, the methodology used to determine the as-found tolerance and the methodology used to determine the as-left tolerance shall be specified in the Technical Specification Bases.

COMANCHE PEAK - UNITS 1 AND 2 3.3-33 Amendment No. 44ý5, 44&,

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 6 of 6)

Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE(a)

7.

Automatic Switchover to Containment Sump

a. Automatic Actuation 1, 2, 3, 4 2 trains C

SR 3.3.2.2 NA Logic and Actuation SR 3.3.2.4 Relays SR 3.3.2.6

b.

Refueling Water 1,2,3,4 4

K SR 3.3.2.1

>31.9%

Storage Tank SR 3.3.2.5 instrument span (RWST) Level - Low SR 3.3.2.9 Low SR 3.3.2.10 Coincident with Refer to Function 1 (Safety Injection) for all initiation functions and requirements.

Safety Injection

8.

ESFAS Interlocks

a.

Not Used.

b. Pressurizer 1,2, 3 3

L SR 3.3.2.5

< 1975.2 psig Pressure, P-11 SR 3.3.2.9 (Unit 1)

< 1976.4 psig (Unit 2)

(a)

The Allowable Value defines the limiting safety system except for functions 5b and 6c (the Nominal Trip Setpoint defines the limiting safety system setting for these Trip Functions). See the Bases for the Nominal Trip Setpoints.

COMANCHE PEAK - UNITS 1 AND 2 3.3-34 Amendment No. 4&0-, 4Wa-,

ATTACHMENT 5 to TXX-12139 RETYPED TECHNICAL SPECIFICATION BASES PAGES (For Information Only)

Pages B 3.3-17 B 3.3-36 B 3.3-55 B 3.3-82 B 3.3-84 B 3.3-90 B 3.3-93 B 3.3-98 B 3.3-100 B 3.3-104

RTS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) setting minimizes challenges to safety valves while avoiding unnecessary reactor trip for those pressure increases that can be controlled by the PORVs.

In MODE 1 or 2, the Pressurizer Pressure-High trip must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the relief and safety valves. In MODE 3, 4, 5, or 6, the Pressurizer Pressure-High trip Function does not have to be OPERABLE because transients that could cause an overpressure condition will be slow to occur. Therefore, the operator will have sufficient time to evaluate unit conditions and take corrective actions.

Additionally, low temperature overpressure protection systems provide overpressure protection when in MODE 4 or below.

9.

Not Used.

10.

Reactor Coolant Flow-Low The Reactor Coolant Flow-Low trip Function ensures that protection is provided against violating the DNBR limit due to low flow in one or more RCS loops, while avoiding reactor trips due to normal variations in loop flow. Above the P-7 setpoint, the reactor trip on low flow in two or more RCS loops is automatically enabled. Above the P-8 setpoint, a loss of flow in any RCS loop will actuate a reactor trip because of the higher power level and the reduced margin to the design limit DNBR. Each RCS loop has three flow detectors to monitor flow. The flow signals are not used for any control system input.

Following plant heatup from a refueling outage, the RCS flow transmitters are adjusted (normalized) with the reactor coolant pumps in service to indicate 100% flow (nominal). During the subsequent plant startup, the RCS flow is measured in accordance with SR 3.4.1.4 to confirm that the actual flow is greater than the value assumed in the accident analysis. At this time, it is also verified that the RCS flow instruments continue to indicate 100% flow (within established tolerances). If not, the flow transmitters are readjusted (normalized) to indicate 100% flow (nominal). The value for the RCS low flow setpoint, expressed as a percentage of indicated flow, is periodically verified to be within required tolerances in accordance with SR 3.3.1.7 and SR 3.3.1.10. This process ensures that the (continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-17 Revision

RTS Instrumentation B 3.3.1 BASES ACTIONS K.1, K.2.1 and K.2.2 (continued)

OPERABLE status. If the channel cannot be returned to an OPERABLE status, action must be initiated within the same 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> to fully insert all rods. 1 additional hour is allowed to fully insert all rods and place the Rod Control System in a condition incapable of rod withdrawal (e.g., by de-energizing all CRDMs, by opening the RTBs, or de-energizing the motor generator (MG) sets). Once these ACTIONS are completed, the core is in a more stable condition. The allowance of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> to restore the channel to OPERABLE status, and the additional hour to place the Rod Control System in a condition incapable of rod withdrawal, are reasonable considering the other source range channel remains OPERABLE to perform the safety function and given the low probability of an event occurring during this interval. Normal plant control operations that individually add limited positive reactivity (i.e., temperature or boron concentration fluctuations associated with RCS inventory or chemistry management or temperature control) are permitted provided the ADM limits specified in the COLR are met and the initial and critical boron concentration assumptions in FSAR Section 15 are satisfied.

L.1 Not Used.

M.1 and M.2 Condition M applies to the following reactor trip Functions:

Pressurizer Pressure-Low; Reactor Coolant Flow-Low; Undervoltage RCPs; and 0

Underfrequency RCPs.

With one channel inoperable, the inoperable channel must be placed in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. For the Pressurizer Pressure-Low, Undervotage RCPs, and Underfrequency RCPs trip Functions, placing the channel in the tripped condition when above the P-7 setpoint results in a partial trip condition requiring only one additional channel to initiate a reactor trip. For the Reactor Coolant Flow - Low trip Function, placing the channel in the tripped condition when above the P-8 setpoint results in a partial trip condition requiring only one additional channel in the same loop to initiate a (continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-36 Revision

RTS Instrumentation B 3.3.1 Table B 3.3.1-1 (Page 1 of 2)

Reactor Trip System Setpoints FUNCTION

1. Manual Rector Trip

2. a. Power Range Neutron Flux, High

2. b. Power Range Neutron Flux, Low

3. Power Range Neutron Flux Rate, High Positive Rate

4. Intermediate Range Neutron Flux, High

5. Source Range Neutron Flux, High

6. Overtemperature N-16

7. Overpower N-16

8. a. Pressurizer Pressure, Low

8. b. Pressurizer Pressure, High

9. Not Used

10. Reactor Coolant Flow - Low

11. Not Used.

12. Undervoltage RCPs

13. Underfrequency RCPs

14. Steam Generator Water Level - Low-Low

15. Not Used.

16. Turbine Trip

a. Low Fluid Oil Pressure

b. Turbine Stop Valve Closure NOMINAL TRIP SETPOINT N/A 109% RTP 25% RTP 5% RTP with a time constant

> 2 seconds 25% RTP 105 cps See Note 1, Table 3.3.1-1 112% RTP 1880 psig 2385 psig 90% of nominal flow 4830 volts 57.2 Hz 38% NR (Unit 1) 35.4% NR (Unit 2) 59 psig 1% open COMANCHE PEAK - UNITS 1 AND 2 B 3.3-55 Revision

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) decay heat removal. During a loss of offsite power, to both safety related busses feeding the motor driven AFW pumps, the loss of power to the bus feeding the turbine driven AFW pump valve control motor will start the turbine driven AFW pump to ensure that at least one SG contains enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip. In addition, once the diesel generators are started and up to speed, the motor driven AFW pumps will be sequentially loaded onto the diesel generator busses.

Functions 6.a through 6.e must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. SG Water Level-Low Low in any operating SG will cause the motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level-Low Low in any two operating SGs will cause the turbine driven pumps to start. These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.

f.

Not Used

g.

Not Used.

h.

Not Used.

7.

Automatic Switchover to Containment Sump At the end of the injection phase of a LOCA, the RWST will be nearly empty. Continued cooling must be provided by the ECCS to remove decay heat. The source of water for the RHR pumps is semi-automatically switched to the containment recirculation sumps. After switching the low head residual heat removal (RHR) pumps draw the water from the containment recirculation sump, the RHR pumps pump the water through the RHR heat exchanger, inject the water back into the RCS, and supply the cooled water to the suction of the other ECCS pumps. Switchover from the RWST to the containment (continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-82 Revision

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Semi-Automatic switchover begins only if the RWST low low level signal is coincident with SI. This prevents accidental switchover during normal operation. Accidental switchover could result in backflow to an empty sump. The semi-automatic switchover Function requirements for the SI Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.

This Function must be OPERABLE in MODES 1, 2, 3, and 4 when there is a potential for a LOCA to occur, to ensure a continued supply of water for the ECCS pumps. This Function is not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. System pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.

8.

Engineered Safety Feature Actuation System Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlock Functions back up manual actions to ensure by passable functions are in operation under the conditions assumed in the safety analyses.

a.

Not Used.

b.

Engineered Safety Feature Actuation System Interlocks -

Pressurizer Pressure, P-11 The P-11 interlock permits a normal unit cooldown and depressurization without actuation of SI or main steam line isolation. With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-1 1 setpoint, the operator can manually block the Pressurizer Pressure-(continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-84 Revision

ESFAS Instrumentation B 3.3.2 BASES ACTIONS E.1, E.2.1, and E.2.2 (continued) tripped condition. Instead it is bypassed. Restoring the channel to OPERABLE status, or placing the inoperable channel in the bypass condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, is sufficient to assure that the Function remains OPERABLE and minimizes the time that the Function may be in a partial trip condition (assuming the inoperable channel has failed high). The completion Time is further justified based on the low probability of an event occurring during this interval. Failure to restore the inoperable channel to OPERABLE status, or place it in the bypassed condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.

The Required Actions are modified by a Note that allows placing one channel in bypass for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> while performing routine surveillance testing. The channel to be tested can be tested in bypass with the inoperable channel also in bypass. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> time limit is justified in Reference 12.

F.1, F.2.1, and F.2.2 Condition F applies to:

Manual Initiation of Steam Line Isolation; and Loss of Offsite Power.

For the Manual Initiation, this action addresses the train orientation of the SSPS. For the Loss of Offsite Power Function, this action recognizes the lack of manual trip provision for a failed channel. If a train or channel is inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of these Functions, the available redundancy, and the low probability of an event occurring during this interval. If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit doesnot have any analyzed transients or conditions that require the explicit use of the protection functions noted above.

(continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-90 Revision

ESFAS Instrumentation B 3.3.2 BASES ACTIONS H.1 and H.2 (continued)

The Required Actions are modified by a Note that allows one train to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing provided the other train is OPERABLE. This allowance is based on the reliability analysis (Ref. 6) assumption that 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is the average time required to perform channel surveillance.

1.1 and 1.2 Condition I applies to:

0 SG Water Level-High High (P-14)

If one channel is inoperable, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> are allowed to restore one channel to OPERABLE status or to place it in the tripped condition. If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-two or one-out-of-three logic will result in actuation. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is justified in Reference 12. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, these Functions are no longer required OPERABLE.

The Required Actions are modified by a Note that allows placing one channel in bypass for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> while performing surveillance testing.

The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed to place the inoperable channel in the tripped condition, and the 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed for a second channel to be in the bypassed condition for testing, are justified in Reference 12.

J.1 and J.2 Not Used.

K.1, K.2.1 and K.2.2 Condition K applies to:

RWST Level-Low Low Coincident with Safety Injection.

RWST Level-Low Low Coincident With SI provides semi-automatic actuation of switchover to the containment recirculation sumps. Note that this Function requires the bistables to energize to perform their required action.

(continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-93 Revision

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.7 SR 3.3.2.7 is the performance of a TADOT. This test is a check of the Loss of Offsite Power Function.

The SR is modified by a Note that excludes verification of setpoints for relays. Relay setpoints require elaborate bench calibration and are verified during CHANNEL CALIBRATION. The SR is modified by a second note that excludes the actuation of final devices from the surveillance testing. The start of the auxiliary feedwater pumps during this SR is unnecessary as these pumps are adequately tested by the SRs for LCO 3.7.5. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.8 SR 3.3.2.8 is the performance of a TADOT. This test is a check of the Manual Actuation Functions. The Safety Injection TADOT shall independently verify the OPERABILITY of the handswitch undervoltage and shunt trip contacts for both the Reactor Trip Breakers and Reactor Trip Bypass Breakers as well as the contacts for safety injection actuation. As a minimum, each Manual Actuation Function is tested up to, but not including, the master relay coils. This test overlaps with the master relay coil testing performed in accordance with SR 3.3.2.4. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The SR is modified by a Note that excludes verification of setpoints during the TADOT for manual initiation Functions. The manual initiation Functions have no associated setpoints.

SR 3.3.2.9 SR 3.3.2.9 is the performance of a CHANNEL CALIBRATION.

A CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology.

(continued)

COMANCHE PEAK - UNITS 1 AND 2 B 3.3-98 Revision

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.10 (continued)

REQUIREMENTS credit was taken in the safety analyses for those channels with response time listed as N.A. When the response time for a function in the TRM is NA, no specific testing need be performed to comply with this SR. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the Trip Setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position).

For channels that include dynamic transfer functions (e.g., lag, lead/lag, rate/

lag, etc.), the response time testing may be performed with the transfer functions set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.

Response time may be verified by actual response time tests in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel. Allocations for sensor response times may be used for selected components provided that the components and methodology for verification have been previously NRC approved.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Response time verification in lieu of actual testing may be performed on ESFAS components in accordance with reference 11.

This SR is modified by a Note that clarifies that the turbine driven AFW pump is tested within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after reaching 532 psig in the SGs.

SR 3.3.2.11 Not Used.

(continued)

. COMANCHE PEAK - UNITS 1 AND 2 B 3.3-100 Revision

ESFAS Instrumentation B 3.3.2 Table B 3.3.2-1 (Page 3 of 3)

ESFAS Trip Setpoints FUNCTION

6. Auxiliary Feedwater (continued)

g. Not Used.

h. Not Used.

7. Automatic Switchover to Containment Sump

a. Automatic Actuation Logic and Actuation Relays

b. Refueling Water Storage Tank (RWST) Level -Low-Low Coincident with Safety Injection

8. ESFAS Interlocks

a. Not Used.

b. Pressurizer Pressure, P-i 1 NOMINAL TRIP SETPOINT NA 33.0%

1960 psig COMANCHE PEAK - UNITS 1 AND 2 B 3.3-104 Revision