Text

Technical Specification Bases for License Amendment Nos. 158 and 149, Pages B.3.3.2-1 to B3.4.13-13 (185 Pages)
	ML022140370
Person / Time
Site:	Prairie Island
Issue date:	07/26/2002
From:	; NRC/NRR/DLPM
To:	;
References
	TAC BM0696, TAC MB0695
	Download: ML022140370 (185)
	v • d • e

ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND AEC GDC Criterion 15, "Engineered Safety Features Protection Systems" (Ref. 1), requires that protection systems shall be provided for sensing accident situations and initiating the operation of necessary engineered safety features to mitigate accidents.

Accidents are events that are analyzed even though they are not expected to occur during the unit life. One acceptable limit during accidents is that offsite dose shall be maintained within an acceptable fraction of 10 CFR 100 limits. Different accident categories are allowed a different fraction of these limits, based on probability of occurrence. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.

The ESFAS instrumentation is segmented into interconnected portions as described in the USAR (Ref. 2), and as identified below:

1.

Field transmitters or process sensors and instrumentation:

provide a measurable electronic signal based on the physical characteristics of the parameter being measured;

2.

Signal processing equipment including Reactor Protection Analog System, arranged in protection channel sets: provide signal conditioning, bistable setpoint comparison, bistable electrical signal output to engineered safety features (ESF) relay logic, and control board/control room/miscellaneous indications; and

3.

ESF relay logic system including channelized input and logic:

initiates the proper ESF actuation in accordance with the defined logic and based on the bistable outputs from the analog protection system.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-1 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND (continued)

The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for ESFAS action to prevent exceeding acceptable limits such that the consequences of Design Basis Accidents (DBAs) will be acceptable. The Allowable Value is considered a limiting value such that a channel is OPERABLE if the setpoint is found not to exceed the Allowable Value during the CHANNEL OPERATIONAL TEST (COT). Note that, although a channel is "OPERABLE" under these circumstances, the ESFAS setpoint must be left adjusted to within the established calibration tolerance band of the ESFAS setpoint in accordance with the uncertainty assumptions stated in the referenced setpoint methodology, (as-left criteria) and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.

Field Transmitters or Sensors To meet the design demands for redundancy and reliability, for the ESFAS Functions, generally two or three field transmitters or sensors are used to measure unit parameters. In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS). To account for calibration tolerances and instrument drift, which are assumed to occur between calibrations, statistical allowances are provided in the Allowable Values. The OPERABILITY of each transmitter or sensor is determined by either "as-found" calibration data evaluated during the CHANNEL CALIBRATION or by qualitative assessment of field transmitter or sensor, as related to channel behavior observed during performance of the CHANNEL CHECK.

Reactor Protection Analog System Generally, for ESFAS Functions, two or three channels of instrumentation are used for the signal processing of unit parameters measured by the field instruments. The instrument channels provide Prairie Island Units 1 and 2 B 3.3.2-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND Reactor Protection Analog System (continued) signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints that are based on safety analyses (Ref. 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable actuates logic input relays. Channel separation is described in Reference 2.

Generally, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function will still operate with a two-out-of-two logic. If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function will still operate with a one-out-of-two logic.

Therefore, a single failure will neither cause nor prevent the protection function actuation. The actual number of channels required for each unit parameter is specified in Reference 2.

Allowable Values and ESFAS Setpoints The trip setpoints used in the bistables are based on the analytical limits from Reference 3. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49, the Allowable Values specified in Table 3.3.2-1 in the accompanying LCO are conservative with respect to the analytical limits. A detailed description of the methodology used to calculate the Allowable Value and ESFAS setpoints, including their explicit uncertainties, is provided in the plant specific setpoint methodology study (Ref. 4) which incorporates all the known uncertainties applicable to each channel. The magnitudes of these uncertainties are factored into the Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-3 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND Allowable Values and ESFAS Setpoints (continued) determination of each ESFAS setpoint and corresponding Allowable Value. The nominal ESFAS setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for measurement errors detectable by a COT. One example of such a change in measurement error is drift during the surveillance interval. If the measured setpoint does not exceed the Allowable Value, the ESFAS Function is considered OPERABLE.

The ESFAS setpoints are the values at which the bistables are set and is the expected value to be achieved during calibration. The ESFAS setpoint value ensures the safety analysis limits are met for the surveillance interval selected when a channel is adjusted based on stated channel uncertainties. Any bistable is considered to be properly adjusted when the "as-left" setpoint value is within the band for CHANNEL CALIBRATION uncertainty allowance (i.e.

calibration tolerance uncertainties).

Setpoints adjusted consistent with the requirements of the Allowable Value ensure that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.

Each channel can be tested on line to verify that the signal processing equipment and setpoint accuracy is within the specified allowance requirements of Reference 4. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated. SRs for the channels are specified in the SR section.

ESF Relay Logic System The relay logic equipment uses outputs from the analog bistables.

To meet the redundancy requirements, two trains of relay logic, each Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-4 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND ESF Relay Logic System (continued) performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide ESF actuation for the unit. Each train is packaged in its own set of cabinets for physical and electrical separation to satisfy separation and independence requirements.

The ESF relay logic system performs the decision logic for most ESF equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit.

The relay logic consists of input, master and slave relays. The bistable outputs are combined via the input relays into logic matrices that represent combinations indicative of various transients. If a required logic matrix combination is completed, the appropriate master and slave relays are energized. The master and slave relays cause actuation of those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition. Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.

Each relay logic train has built in test features that allow testing the decision logic matrix and some master and slave relay functions while the unit is at power. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.

APPLICABLE Each of the analyzed accidents can be detected by one or more SAFETY ESFAS Functions. One of the ESFAS Functions is the primary

ANALYSES, actuation signal for that accident. An ESFAS Function may be the LCO, and primary actuation signal for more than one type of accident.

APPLICABILITY An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents. For example, Pressurizer Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-5 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY (continued)

Low Pressure is a primary actuation signal for loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) inside containment. Functions such as manual initiation, not specifically credited in the safety analysis, are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).

The LCO requires all instrumentation performing an ESFAS Function to be OPERABLE. A channel is OPERABLE with a trip setpoint outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to within the calibration tolerance band. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.

The LCO generally requires OPERABILITY of two or three channels in each instrumentation function and two channels in each logic and manual initiation function. The two-out-of-three configuration allows one channel to be tripped during maintenance or testing without causing an ESFAS initiation. Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.

The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents. ESFAS protection functions are as follows:

1.

Safety Injection Safety Injection (SI) provides two primary functions:

Prairie Island Units 1 and 2 B 3.3.2-6 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

1.

Safety Injection (continued)

1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 2200'F); and

2.

Boration to ensure recovery and maintenance of SDM.

These functions are necessary to mitigate the effects of a LOCA or SLB, both inside and outside of containment. The SI signal is also used to initiate other functions such as:

Containment Isolation;

"* Containment Ventilation Isolation; Reactor Trip; Feedwater Isolation;

"* Auxiliary Feedwater (AFW); and

"* Control room ventilation isolation.

These other functions ensure:

Isolation of nonessential systems through containment penetrations;

"* Trip of the reactor to limit power generation;

"* Isolation of main feedwater to limit secondary side mass contribution to containment pressurization; Start of AFW to ensure secondary side cooling capability; Prairie Island Units 1 and 2 B 3.3.2-7 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE

1.

Safety Injection (continued)

SAFETY

ANALYSES,

° Isolation of the control room to ensure habitability.

LCO, and APPLICABILITY

a.

Safety Injection-Manual Initiation The LCO requires two channels to be OPERABLE. The operator can initiate SI at any time by using either of two switches in the control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.

The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.

Each channel consists of one switch and the interconnecting wiring to the actuation logic cabinet. Each switch actuates both trains. This configuration does not allow testing at power. The Applicability of the SI Manual Initiation Function is discussed with the Automatic Actuation Relay Logic Function below.

b.

Safety Injection-Automatic Actuation Relay Logic This LCO requires two trains to be OPERABLE. The SI actuation logic consists of all circuitry housed within the ESF relay logic cabinets for the SI actuation subsystem, including the initiating relay contacts responsible for actuating the ESF equipment.

Manual and automatic initiation of SI must be OPERABLE in MODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems.

Prairie Island Unit I - Amendment No. 158 Units I and 2 B 3.3.2-8 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

b.

Safety Injection-Automatic Actuation Relay Logic (continued)

Manual Initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual actuation switches.

Automatic actuation relay logic must be OPERABLE in MODE 4 to support system level manual initiation.

These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. Unit pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.

c.

Safety Injection-High Containment Pressure This signal provides protection against the following accidents:

"* SLB inside containment; and

"* LOCA.

Three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic. The transmitters and electronics are located outside of Prairie Island Units 1 and 2 B 3.3.2-9 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

c.

Safety Injection-High Containment Pressure (continued) containment with the sensing line located inside containment. Thus, the high pressure Function will not experience any adverse environmental conditions and the Allowable Value reflects only steady state instrument uncertainties.

High Containment Pressure must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. In MODES 4, 5, and 6, plant conditions are such that the probability of an event requiring Emergency Core Cooling System (ECCS) injection is extremely low. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA.

d.

Safety Injection-Pressurizer Low Pressure This signal provides protection against the following accidents:

Inadvertent opening of a steam generator (SG) relief or safety valve; SLB; Rupture of a control rod drive mechanism housing (rod ejection);

Inadvertent opening of a pressurizer relief or safety valve; Prairie Island Units 1 and 2 B 3.3.2-10 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE

d.

Safety Injection-Pressurizer Low Pressure SAFETY (continued)

ANALYSES, LCO, and LOCAs; and APPLICABILITY 0

SG Tube Rupture.

Pressurizer pressure provides both control and protection functions: input to the pressurizer pressure control system, reactor trip, and SI. However, two independent Power Operated Relief Valve (PORV) open signals must be present before a PORV can open. Therefore, a single pressure channel failing high will not fail a PORV open and trigger a depressurization event, which may then require SI actuation. Thus, three OPERABLE channels are sufficient to satisfy the protective requirements with a two-out-of-three logic.

The transmitters are located inside containment, with the taps in the vapor space region of the pressurizer, and thus possibly experiencing adverse environmental conditions (LOCA, SLB inside containment, rod ejection). Therefore, the Allowable Value reflects the inclusion of both steady state and adverse environmental instrument uncertainties.

This Function must be OPERABLE in MODES 1, 2, and 3 with pressurizer pressure Ž_ 2000 psig to mitigate the consequences of a LOCA. This signal may be manually blocked by the operator when pressurizer pressure is

< 2000 psig. Automatic SI actuation below this pressure setpoint is then performed by the High Containment Pressure signal.

This Function is not required to be OPERABLE in MODE 3 when pressurizer pressure is < 2000 psig. Other ESF Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-11 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

d.

Safety Injection-Pressurizer Low Pressure (continued) functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.

e.

Safety Injection-Steam Line Low Pressure Steam Line Low Pressure provides protection against the following accidents:

SLB; Feed line break; and 0

Inadvertent opening of an SG safety valve.

Steam line pressure transmitters provide input to control functions, but the control function cannot initiate events that the Function acts to mitigate. Thus, three OPERABLE channels on each steam line are sufficient to satisfy the protective requirements with a two-out-of-three logic on each steam line.

With the transmitters typically located in the vicinity of the main steam lines, it is possible for them to experience adverse environmental conditions during a secondary side break. Therefore, the Allowable Value reflects both steady state and adverse environmental instrument uncertainties.

This Function is anticipatory in nature and has a typical lead/lag ratio of 12/2.

Prairie Island Units I and 2 B 3.3.2-12 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

e.

Safety Injection-Steam Line Low Pressure (continued)

Steam Line Low Pressure must be OPERABLE in MODES 1, 2, and 3 with pressurizer pressure Ž_ 2000 psig, when a secondary side break or stuck open safety valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator when pressurizer pressure is < 2000 psig. When pressurizer pressure is < 2000 psig, feed line break is not a concern.

This Function is not required to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to cause an accident.

2.

Containment Spray Containment Spray (CS) provides three primary functions:

1.

Lowers containment pressure and temperature after a LOCA or SLB in containment;

2.

Reduces the amount of radioactive iodine in the containment atmosphere; and

3.

Adjusts the pH of the water in the containment sump after a large break LOCA.

These functions are necessary to:

"* Ensure the pressure boundary integrity of the containment structure;

"* Limit the release of radioactive iodine to the environment in the event of a failure of the containment structure; and Prairie Island Units 1 and 2 B 3.3.2-13 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

2.

Containment Spray (continued)

Minimize corrosion of the components and systems inside containment following a LOCA.

The CS actuation signal starts the CS pumps and aligns the discharge of the pumps to the CS nozzle headers in the upper levels of containment. Water is initially drawn from the RWST by the CS pumps and mixed with a sodium hydroxide solution from the spray additive tank. Containment spray is actuated manually or by High High Containment Pressure.

a.

Containment Spray-Manual Initiation The LCO requires two channels to be OPERABLE. The operator can initiate CS at any time from the control room by simultaneously turning two CS actuation switches.

Because an inadvertent actuation of CS could have such serious consequences, two switches must be turned simultaneously to initiate both trains of CS. The inoperability of either switch may fail both trains of manual initiation.

Each channel consists of one switch and the interconnecting wiring to the actuation logic cabinets. The Applicability of the CS Manual Initiation Function is discussed with the Automatic Actuation Relay Logic Function below. Note that manual initiation of CS also actuates containment ventilation isolation.

b.

Containment Spray-Automatic Actuation Relay Logic The CS actuation logic consists of all circuitry housed within the ESF relay logic cabinets for the CS actuation subsystem, in the same manner as described for ESFAS Function 1.b.

Prairie Island Units 1 and 2 B 3.3.2-14 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

b.

Containment Spray-Automatic Actuation Relay Logic (continued)

Manual and automatic initiation of CS must be OPERABLE in MODES 1, 2, and 3 when there is a potential for an accident to occur, and sufficient energy in the primary or secondary systems to pose a threat to containment integrity due to overpressure conditions. Manual initiation is also required in MODE 4, even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA by the use of the manual actuation switches.

Automatic actuation relay logic must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary and secondary systems to result in containment overpressure. In MODES 5 and 6, there is also adequate time for the operators to evaluate unit conditions and respond, to mitigate the consequences of abnormal conditions by manually starting individual components.

c.

Containment Spray-High High Containment Pressure This signal provides protection against a LOCA or an SLB inside containment. The transmitters and electronics are located outside of containment with the sensing lines located inside containment. Thus, they will not experience any adverse environmental conditions and the Allowable Value reflects only steady state instrument uncertainties.

This is one of the only Functions that requires the bistable output to energize to perform its required action. It is not desirable to have a loss of power actuate CS, since the consequences of an inadvertent actuation of CS could be serious.

Prairie Island Units 1 and 2 B 3.3.2-15 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

c.

Containment Spray-High High Containment Pressure (continued)

High High Containment Pressure uses three sets of two channels, each set combined in a one-out-of-two configuration, with these outputs combined so that three sets tripped initiates CS. This arrangement exceeds the minimum redundancy requirements. High High Containment Pressure must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to overpressurize containment.

3.

Containment Isolation Containment Isolation (CI) provides isolation of the containment atmosphere, and process systems that penetrate containment, from the environment. This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a LOCA.

The CI signal isolates all automatically isolable process lines except instrument air and main steam lines, which require a steam line isolation signal.

a.

Containment Isolation-Manual Initiation Manual CI is actuated by either of two switches in the control room. Either switch actuates both trains. Note that manual initiation of CI also actuates Containment Ventilation Isolation.

Prairie Island Units 1 and 2 B 3.3.2-16 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

a.

Containment Isolation-Manual Initiation (continued)

The LCO requires two channels to be OPERABLE. Each channel consists of one switch and the interconnecting wiring to the actuation logic cabinets. The Applicability of the CI Manual Initiation Function is discussed with the Automatic Actuation Relay Logic Function below.

b.

Containment Isolation - Automatic Actuation Relay Logic The CI actuation logic consists of all circuitry housed within the ESF relay logic cabinets for the CI actuation subsystem in the same manner as described for ESFAS Function 1.b.

Manual and automatic initiation of CI must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. Manual initiation is also required in MODE 4 even though automatic actuation is not required.

In this MODE, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a CI, actuation is simplified by the use of the manual actuation switches.

Automatic actuation relay logic must be OPERABLE in MODE 4 to support system manual initiation. In MODES 5 and 6, there is insufficient energy in the primary or secondary systems, in the event of a line break, to pressurize the containment to require CI. There is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.

Prairie Island Units 1 and 2 B 3.3.2-17 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY (continued)

c.

Containment Isolation - Safety Injection Containment Isolation is initiated by all Functions that initiate SI via the SI signal. The CI requirements for these Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.

4.

Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment. Rapid isolation of the steam lines will limit the steam break accident to the blowdown from one SG, at most. For an SLB upstream of the main steam isolation valves (MSIVs), inside or outside of containment, closure of the non-return check valves or the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSIVs terminates the accident.

a.

Steam Line Isolation - Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two switches in the control room, one for each MSIV. The LCO requires one channel per loop to be OPERABLE.

b.

Steam Line Isolation - Automatic Actuation Relay Logic The steam line isolation actuation logic consists of all circuitry housed within the ESF relay logic cabinets for the steam line isolation subsystem in the same manner as described for ESFAS Function 1.b.

Prairie Island Units 1 and 2 B 3.3.2-18 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

4.

Steam Line Isolation (continued)

Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB. This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless both MSIVs are closed. In MODES 4, 5, and 6, there is insufficient energy in the RCS and SGs to experience an SLB releasing significant quantities of energy.

c.

Steam Line Isolation - High High Containment Pressure This Function actuates closure of the MSIVs in the event of a LOCA or an SLB inside containment to maintain at least one unfaulted SG as a heat sink for the reactor. Three OPERABLE channels are sufficient to satisfy protective requirements with two-out-of-three logic. The transmitters and electronics are located outside containment with the sensing line located inside containment. Thus, they will not experience any adverse environmental conditions, and the Allowable Value reflects only steady state instrument uncertainties.

High High Containment Pressure must be OPERABLE in MODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection and closure of the MSIVs. The Steam Line Isolation Function remains OPERABLE in MODES 2 and 3 unless both MSIVs are closed. In MODES 4, 5, and 6, there Prairie Island Units 1 and 2 B 3.3.2-19 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE

c.

Steam Line Isolation-High High Containment Pressure SAFETY (continued)

ANALYSES, LCO, and is not enough energy in the primary and secondary sides to APPLICABILITY over pressurize containment.

d.

Steam Line Isolation-High Steam Flow Coincident With Safety Injection and Coincident With Low Low T,,,

This Function provides closure of the MSIVs during an SLB or inadvertent opening of an SG safety valve to maintain at least one unfaulted SG as a heat sink for the reactor.

Two steam line flow channels per steam line are required OPERABLE for this Function. These are combined in a one-out-of-two logic to indicate high steam flow in one steam line. The steam flow transmitters provide control inputs, but the control function cannot cause the events that the function must protect against. Therefore, two channels are sufficient to satisfy redundancy requirements. The one-out-of-two configuration allows online testing because trip of one high steam flow channel is not sufficient to cause initiation.

The High Steam Flow Allowable Value is a AP corresponding to < 9.18E5 lb/hr at 1005 psig.

The main steam line isolates if the High Steam Flow signal occurs coincident with an SI signal and Low Low RCS average temperature. The Main Steam Line Isolation Function requirements for the SI Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-20 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

d.

Steam Line Isolation-High Steam Flow Coincident With Safety Injection and Coincident With Low Low Tavg (continued)

Two channels of Tavg per loop are required to be OPERABLE. The Tavg channels are combined in a logic such that two channels tripped cause a trip for the parameter. The accidents that this Function protects against cause reduction of Tavg in the entire primary system.

Therefore, the provision of two OPERABLE channels per loop in a two-out-of-four configuration ensures no single random failure disables the Low Low Tavg Function. The Tavg channels provide control inputs, but the control function cannot initiate events that the Function acts to mitigate. Therefore, additional channels are not required to address control protection interaction issues.

With the Tavg resistance temperature detectors (RTDs) located inside the containment, it is possible for them to experience adverse environmental conditions during an SLB event. Therefore, the Allowable Value reflects both steady state and adverse environmental instrumental uncertainties.

This Function must be OPERABLE in MODES 1 and 2, and in MODE 3, when Tavg is above 520'F, when a secondary side break or stuck open valve could result in rapid depressurization of the steam lines. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless both MSIVs are closed. This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.

Prairie Island Units 1 and 2 B 3.3.2-21 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY (continued)

e.

Steam Line Isolation-High High Steam Flow Coincident With Safety Injection This Function provides closure of the MSIVs during a SLB to maintain at least one unfaulted SG as a heat sink for the reactor.

Two steam line flow channels per steam line are required to be OPERABLE for this Function. These are combined in a one-out-of-two logic to indicate high steam flow in one steam line. The steam flow transmitters provide control inputs, but the control function cannot cause the events that the Function must protect against. Therefore, two channels are sufficient to satisfy redundancy requirements.

The Allowable Value for High High Steam Flow is a AP corresponding to _* 4.5E6 lb/hr at 735 psig.

With the transmitters located inside containment, it is possible for them to experience adverse environmental conditions during an SLB event. Therefore, the Allowable Value reflects both steady state and adverse environmental instrument uncertainties.

The main steam lines isolate if the High High Steam Flow signal occurs coincident with an SI signal. The Main Steam Line Isolation Function requirements for the SI Functions are the same as the requirements for their SI function.

Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.

Prairie Island Units 1 and 2 B 3.3.2-22 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

e.

Steam Line Isolation-High High Steam Flow Coincident With Safety Injection (continued)

This Function must be OPERABLE in MODES 1, 2, and 3 when a secondary side break could result in rapid depressurization of the steam lines unless both MSIVs are closed. This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.

j.

Feedwater Isolation The primary function of the Feedwater Isolation signal is to limit containment pressurization during an SLB. This Function also mitigates the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows.

The Function performs the following:

Trips the main turbine; Trips the main feedwater (MFW) pumps; and Shuts the MFW regulating valves (MFRVs) and the MFRV bypass valves.

Prairie Island Units 1 and 2 B 3.3.2-23 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

5.

Feedwater Isolation (continued)

This Function is actuated by High High SG Water Level, or by an SI signal. In the event of SI, the unit is taken off line. The MFW System is also taken out of operation and the AFW System is automatically started. The SI signal was discussed previously.

a.

Feedwater Isolation-Automatic Actuation Relay Logic The feedwater isolation actuation logic consists of all circuitry housed within the ESF relay logic cabinets for the feedwater isolation subsystem, in the same manner as described for ESFAS Function 1.b.

This Function must be OPERABLE in MODES 1, 2, and 3, except when all MFRVs and associated bypass valves are closed and de-activated or isolated by a closed manual valve, when a secondary side break could result in significant containment pressurization. This Function is not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to cause an accident.

b.

Feedwater Isolation-High High Steam Generator Water Level This signal provides protection against excessive feedwater flow. The SG water level instruments provide input to the Feedwater Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation. Median signal selection Prairie Island Units 1 and 2 B 3.3.2-24 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY

b.

Feedwater Isolation-High High Steam Generator Water Level (continued) is used in the Feedwater Control System. Thus, three OPERABLE channels are sufficient to satisfy the requirements with a two-out-of-three logic. The transmitters (d/p cells) are located inside containment.

However, the events that this Function protects against cannot cause a severe environment in containment.

Therefore, the Allowable Value reflects only steady state instrument uncertainties.

This Function must be OPERABLE in MODES I and 2, except when all MFRVs and associated bypass valves are closed and de-activated or isolated by a closed manual valve. In MODES 3, 4, 5, and 6, the MFW System and the turbine generator are normally not in service and this Function is not required to be OPERABLE.

c.

Feedwater Isolation-Safety Injection Feedwater Isolation is also initiated by all Functions that initiate SI via the SI signal. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI Function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 1, SI, is referenced for all initiating functions and requirements.

Prairie Island Units 1 and 2 B 3.3.2-25 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY (continued)

6.

Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available. The system has a motor driven pump and a turbine driven pump, making it available during normal unit operation, during a loss of AC power, a loss of MFW, and during a Feedwater System pipe break. The normal source of water for the AFW System is the condensate storage tank (CST) (not safety related). Upon low level in the CST, the operators can manually realign the pump suctions to the Cooling Water (CL) System (safety related). The AFW System is aligned so that upon a pump start, flow is initiated to the SGs immediately.

a.

Auxiliary Feedwater-Automatic Actuation Relay Logic The auxiliary feedwater actuation logic consists of all circuitry housed within the reactor protection relay logic cabinets for the auxiliary feedwater actuation subsystem.

b.

Auxiliary Feedwater-Low Low Steam Generator Water Level Low Low SG Water Level provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. The SG water level instruments provide input to the Feedwater Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system, which may then require a protection function actuation, and a single failure in the other channels Prairie Island Units 1 and 2 B 3.3.2-26 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE

b.

Auxiliary Feedwater-Low Low Steam Generator Water SAFETY Level

ANALYSES, LCO, and providing the protection function actuation. Median APPLICABILITY signal selection is used in the Feedwater Control System.

(continued)

Thus, three OPERABLE channels per SG are sufficient to satisfy the requirements with a two-out-of-three logic.

With the transmitters (d/p cells) located inside containment and thus possibly experiencing adverse environmental conditions (feed line break), the Allowable Value reflects the inclusion of both steady state and adverse environmental instrument uncertainties.

c.

Auxiliary Feedwater-Safety Injection An SI signal starts the motor driven and turbine driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI Function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.

Functions 6.a through 6.c must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. Low Low SG Water Level in any operating SG will cause the AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-27 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY

ANALYSES, LCO, and APPLICABILITY (continued)

d.

Auxiliary Feedwater-Undervoltage on 4kV Buses l l and 12 (21 and 22)

A loss of power on the buses that provide power to the MFW pumps provides indication of a pending loss of MFW flow. The undervoltage Function senses the voltage upstream of each MFW pump breaker. A loss of power for both MFW pumps will start the turbine driven AFW pump to ensure that at least one SG contains enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip.

e.

Auxiliary Feedwater-Trip of Both Main Feedwater Pumps A trip of both MFW pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure. Motor driven MFW pumps are equipped with a breaker position sensing device.

An open supply breaker indicates that the MFW pump is not running. Two-OPERABLE channels per AFW pump provide a start signal to each AFW pump in two-out-of-two taken once logic. A trip of both MFW pumps starts the motor driven and turbine driven AFW pumps to ensure that at least one SG is available with water to act as the heat sink for the reactor.

Functions 6.d and 6.e must be OPERABLE in MODES 1 and 2.

This ensures that at least one SG is provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident. In MODES 3, 4, and 5, the MFW pumps may be normally shut down, and thus neither the pump Prairie Island Units 1 and 2 B 3.3.2-28 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES LCO, and APPLICABILITY ACTIONS

6.

Auxiliary Feedwater (continued) trip or bus undervoltage are indicative of a condition requiring automatic AFW initiation. Also, in MODE 2 the AFW system may be used for SG level control. The MFW trip is bypassed by placing the AFW pump CS in shutdown auto when AFW is aligned for this purpose. Low low SG level provides protection during this operation.

The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1.

In the event a channel's setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected. When the Required Channels in Table 3.3.2-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.

When the number of inoperable channels in a trip function exceed those specified in one or other related Conditions associated with a trip function, then the unit may be outside the safety analysis.

Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.

A.1 Condition A applies to all ESFAS protection functions.

Prairie Island Units 1 and 2 B 3.3.2-29 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES ACTIONS A.1 (continued)

Condition A addresses the situation where one or more channels or trains for one or more Functions are inoperable at the same time.

The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.

B. 1, B.2.1, and B.2.2 Condition B applies to manual initiation of:

SI; Containment Spray (CS); and

"* Containment Isolation (CI).

This action addresses the train orientation of the ESF relay logic for the functions listed above. If a channel or train is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to return it to an OPERABLE status. The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE for each Function (except for CS), and the low probability of an event occurring during this interval. If the channel cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months total time) and in MODE 5 within an additional 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months (84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months total time). The allowable Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-30 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)

C. 1, C.2.1, and C.2.2 Condition C applies to the automatic actuation relay logic for the following functions:

"* SI;

"* CS; and

"* CI.

This action addresses the train orientation of the ESF relay logic. If one train is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the train to OPERABLE status. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months total time) and in MODE 5 within an additional 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months (42 hours4.861111e-4 days 0.0117 hours 6.944444e-5 weeks 1.5981e-5 months total time). The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

The Required Actions are modified by a Note that allows one train to be bypassed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing, provided the other train is OPERABLE. This allowance is based on the reliability analysis assumption of WCAP-10271-P-A (Ref. 5) that 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is the average time required to perform relay logic train surveillance.

Prairie Island Units 1 and 2 B 3.3.2-31 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES ACTIONS D. 1, D.2.1, and D.2.2 (continued)

Condition D applies to:

High Containment Pressure; Pressurizer Low Pressure; Steam Line Low Pressure; Steam Line Isolation High High Containment Pressure; High Steam Flow Coincident With Safety Injection Coincident With Low Low Tag; High High Steam Flow Coincident With Safety Injection; and Low Low SG Water Level.

If one channel is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the channel to OPERABLE status or to place it in the tripped condition.

Generally this Condition applies to functions that operate on two-out-of-three logic. Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-three configuration that satisfies redundancy requirements.

Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-32 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES ACTIONS D. 1, D.2.1, and D.2.2 (continued)

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status or to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for testing, are justified in Reference 5.

E.I.1, E.1.2, E.2.1, and E.2.2 Condition E applies to CS High High Containment Pressure which is a one-out-of-two channels, three-out-of-three sets logic. Condition E addresses the situation where containment pressure channels are inoperable. With channel(s) tripped, one or more of the three sets may be actuated.

Restoring the channel to OPERABLE status, or placing the other inoperable channel in the trip condition and verifying one channel in each pair remains OPERABLE within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , is sufficient to assure that the Function remains OPERABLE. The Completion Time is further justified based on the low probability of an event occurring during this interval. Failure to restore the inoperable channel(s) to OPERABLE status, or place it in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-33 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES ACTIONS E.1.1, E.1.2, E.2.1, and E.2.2 (continued)

Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, this Function is a no longer required OPERABLE.

The Required Actions are modified by a Note that allows one channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing.

Placing a channel in the bypass condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for testing purposes is acceptable based on the results of Reference 5.

F. 1, F.2.1, and F.2.2 Condition F applies to Manual Initiation of Steam Line Isolation. If a train or channel is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months are allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of this Function and the low probability of an event occurring during this interval. If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-34 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES ACTIONS (continued)

G.1, G.2.1, and G.2.2 Condition G applies to the automatic actuation relay logic for the Steam Line Isolation and Feedwater Isolation Functions. The action addresses the train orientation of the ESF relay logic for these functions. If one train is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the train to OPERABLE status. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. If the train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of the actuation function. In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the Functions noted above.

The Required Actions are modified by a Note that allows one train to be bypassed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing provided the other train is OPERABLE. This allowance is based on the reliability analysis (Ref. 5) assumption that 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is the average time required to perform relay logic train surveillance.

H. I and H.2 Condition H applies to High High SG Water Level.

If one channel is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore one channel to OPERABLE status or to place it in the tripped condition.

If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-two logic will result in actuation.

Prairie Island Units 1 and 2 B 3.3.2-35 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES ACTIONS H.1 and H.2 (continued)

The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is justified in Reference 5. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, this Function is no longer required OPERABLE.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for a second channel to be in the bypassed condition for testing, are justified in Reference 5.

1.1 and 1.2 Condition I applies to Undervoltage on Buses 11 and 12 (21 and 22).

If one or both channel(s) on one bus is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the channel(s) to OPERABLE status or to place it in the tripped condition. If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-two channels on the other bus will result in actuation. The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is justified in Reference 5. Failure to restore the inoperable channel(s) to OPERABLE status or place it in the tripped Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-36 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES ACTIONS 1.1 and 1.2 (continued) condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, this Function is no longer required OPERABLE.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for a second channel to be in the bypassed condition for testing, are justified in Reference 5.

J.1 and K.1 Conditions J and K apply to the AFW automatic actuation relay logic function and to the AFW pump start on trip of both MFW pumps function.

The OPERABILITY of the AFW System must be assured by allowing automatic start of the AFW System pumps. If a logic train or channel is inoperable, the applicable Condition(s) and Required Action(s) of LCO 3.7.5, "Auxiliary Feedwater (AFW) System," are entered for the associated AFW Train or pump.

Required Action J. 1 is modified by a note that allows placing a train in the bypass condition for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing provided the other train is OPERABLE. This is necessary to allow testing reactor trip system logic which is in the same cabinet with AFW logic. This is acceptable since the other AFW system train is OPERABLE and the probability for an event requiring AFW during this time is low.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-37 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES (continued)

SURVEILLANCE The SRs for each ESFAS Function are identified by the SRs REQUIREMENTS column of Table 3.3.2-1.

A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions.

Note that each channel of reactor protection analog system supplies both trains of the ESFAS. When testing Channel I, Train A and Train B must be examined. Similarly, Train A and Train B must be examined when testing Channel II, Channel III, and Channel IV (if applicable). The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.

SR 3.3.2.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-38 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.1 (continued)

REQUIREMENTS indication and reliability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.2.2 SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST.

The ESF relay logic is tested every 31 days on a STAGGERED TEST BASIS. The train being tested is placed in the test condition, thus preventing inadvertent actuation. All possible logic combinations are tested for each ESFAS function. The test includes actuation of master and slave relays whose contact outputs remain within the relay logic. The test condition inhibits actuation of the master and slave relays whose contact outputs provide direct ESF equipment actuation. Where the relays are not actuated, the test circuitry provides a continuity check of the relay coil. This verifies that the logic is OPERABLE and that there is a signal path to the output relay coils.

Functions which do not test the master and slave relays with the logic specify separate master and slave relay tests in Table 3.3.2-1.

The Frequency of every 31 days on a STAGGERED TEST BASIS is adequate. It is based on industry operating experience, considering instrument reliability and operating history data.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-39 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES (continued)

SURVEILLANCE SR 3.3.2.3 REQUIREMENJS (continued)

SR 3.3.2.3 is the performance of a COT.

A COT is performed on each required channel to ensure the entire channel will perform the intended Function. Setpoints must be found within the Allowable Values specified in Table 3.3.2-1. A successful test of the required contact(s) of a channel (logic input) relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The difference between the current "as-found" values and the previous test "as-left" values must be consistent with the drift allowance used in the setpoint methodology. The setpoint shall be left set consistent with the assumptions of the current unit specific setpoint methodology.

The "as-found" and "as-left" values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis (Ref. 5) when applicable.

The Frequency of 92 days is justified in Reference 5.

SR 3.3.2.4 SR 3.3.2.4 is the performance of a TADOT. This SR is a check of the following ESFAS Instrumentation Functions:

Prairie Island Unit I - Amendment No. 158 Units 1 and 2 B 3.3.2-40 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.4 (continued)

REQUIREMENTS

1. CS Manual Initiation;

2.

Cl Manual Initiation;

3.

Manual isolation of the steam lines;

4.

AFW pump start on Undervoltage on Buses 11 and 12 (21 and 22); and

5.

AFW pump start on trip of both MFW pumps.

This SR is performed every 24 months. A successful test of the required contact(s) of a channel (logic input) relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non Technical Specifications tests at least once per refueling interval with applicable extensions. The Frequency is adequate, based on industry operating experience and is consistent with the typical refueling cycle. The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Functions, except the undervoltage start of the AFW pumps, have no associated setpoints. For the undervoltage start of the AFW pumps, setpoint verification is covered by other SRs.

SR 3.3.2.5 This SR is the performance of a TADOT to check the Safety Injection Manual Initiation Function. It is performed every 24 months on a STAGGERED TEST BASIS. The Frequency is adequate, based on industry operating experience and is consistent with a typical refueling cycle.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.2-41 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS SR 3.3.2.5 (continued)

The SR is modified by a Note that excludes verification of setpoints during the TADOT. The manual initiation Function has no associated setpoints.

SR 3.3.2.6 SR 3.3.2.6 is the performance of a CHANNEL CALIBRATION.

A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology. The difference between the current "as-found" values and the previous test "as-left" values must be consistent with the drift allowance used in the setpoint methodology.

The Frequency of 24 months is based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint methodology.

This SR is modified by a Note stating that this test should include verification that the time constants are adjusted to the prescribed values where applicable.

Prairie Island Units 1 and 2 B 3.3.2-42 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)

REFERENCES SR 3.3.2.7 SR 3.3.2.7 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation. This test is performed every 24 months.

SR 3.3.2.8 SR 3.3.2.8 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is placed in a condition where the relay contact operation can be verified without operation of the equipment. This test is performed every 24 months.

1. AEC "General Design Criteria for Nuclear Power Plant Construction Permits," Criterion 15, issued for comment July 10, 1967, as referenced in USAR Section 1.2.

2. USAR, Section 7.

3. USAR, Section 14.

4.

"Engineering Manual Section 3.3.4.1, Engineering Design Standard for Instrument Setpoint/Uncertainty Calculations".

5. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.

Prairie Island Units 1 and 2 B 3.3.2-43 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Event Monitoring (EM) Instrumentation BASES BACKGROUND The primary purpose of the EM instrumentation is to display unit variables that provide information required by the control room operators during accident situations.

The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected unit parameters to monitor and to assess unit status and behavior following an accident.

The availability of accident monitoring instrumentation is important so that responses to corrective actions can be observed and the need for, and magnitude of, further actions can be determined. These essential instruments are identified by the USAR (Ref. 1) addressing the recommendations of Regulatory Guide 1.97 (Ref. 2) as required by Supplement 1 to NUREG-0737.

The instrument channels required to be OPERABLE by this LCO include two classes of parameters identified during unit specific implementation of Regulatory Guide 1.97 as Type A and Category I variables.

Type A variables are included in this LCO because they provide the primary information required for the control room operator to take specific manually controlled actions for which no automatic control is provided, and that are required for safety systems to accomplish their safety functions for DBAs.

Category I variables are the key variables deemed risk significant because they are needed to:

Determine whether other systems important to safety are performing their intended functions; Prairie Island Unit 1 -Amendment No. 158 Units 1 and 2 B 3.3.3-1 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES BACKGROUND (continued)

Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release; and Provide information regarding the release of radioactive materials to allow for early indication of the need to initiate action necessary to protect the public, and to estimate the magnitude of any impending threat.

These key variables are identified by the unit specific Regulatory Guide 1.97 analyses (Ref. 1). These analyses identify the unit specific Type A and Category I variables and provide justification for deviating from Reference 2.

The specific instrument Functions listed in Table 3.3.3-1 are discussed in the LCO section.

APPLICABLE SAFETY ANALYSES The EM instrumentation ensures the operability of Regulatory Guide 1.97 Type A and Category I variables so that the control room operating staff can:

Perform the diagnosis specified in the emergency operating procedures (these variables are restricted to preplanned actions for the primary success path of DBAs), e.g., loss of coolant accident (LOCA);

Take the specified, pre-planned, manually controlled actions, for which no automatic control is provided, and that are required for safety systems to accomplish their safety function; Determine whether systems important to safety are performing their intended functions; Determine the likelihood of a gross breach of the barriers to radioactivity release; Prairie Island Units 1 and 2 B 3.3.3-2 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES APPLICABLE Determine if a gross breach of a barrier has occurred; and SAFETY ANALYSES 0

Initiate action necessary to protect the public and to estimate (continued) the magnitude of any impending threat.

EM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Category I, non-Type A, instrumentation is included in TS because it is intended to assist operators in minimizing the consequences of accidents. Therefore, Category I, non-Type A, variables are important for reducing public risk and satisfy Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO The EM instrumentation LCO provides OPERABILITY requirements for Regulatory Guide 1.97 Type A instrument variables, which provide information required by the control room operators to perform certain manual actions specified in the Emergency Operating Procedures. These manual actions ensure that a system can accomplish its safety function, and are credited in the safety analyses. Additionally, this LCO addresses Regulatory Guide 1.97 instruments that have been designated Category I, non-Type A.

The OPERABILITY of the EM instrumentation ensures there is sufficient information available on selected unit parameters to monitor and assess unit status following an accident. This capability is consistent with Reference 1.

LCO 3.3.3 requires two OPERABLE channels for most Functions.

Two OPERABLE channels ensure no single failure prevents operators from getting the information necessary for them to determine the safety status of the unit, and to bring the unit to and maintain it in a safe condition following an accident.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-3 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES LCO Furthermore, OPERABILITY of two channels allows a CHANNEL (continued)

CHECK during the post accident phase to confirm the validity of displayed information.

An exception to the two channel requirement is Containment Isolation Valve (CIV) Position. In this case, the important information is the status of the containment penetrations. The LCO requires one position indicator for each active CIV. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve and prior knowledge of a passive valve, or via system boundary status. If a normally active CIV is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE.

Table 3.3.3-1 lists all Type A and Category I variables identified by the unit specific Regulatory Guide 1.97 analyses, as amended by the NRC's SER, as identified in Reference 3.

Type A and Category I variables are required to meet Regulatory Guide 1.97 Category I (Ref. 2) design and qualification requirements for seismic and environmental qualification, single failure criterion, utilization of emergency standby power, immediately accessible display, continuous readout, and recording of display.

Listed below are discussions of the specified instrument Functions listed in Table 3.3.3-1.

1, 2. Power Range and Source Range Neutron Flux (Logarithmic Scale)

Power Range and Source Range Neutron Flux (Logarithmic Scale) indication is provided to verify reactor shutdown. The two ranges are necessary to cover the full range of flux that may occur post accident.

Neutron flux is used for accident diagnosis, verification of subcriticality, and diagnosis of positive reactivity insertion.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-4 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES LCO 3, 4. Reactor Coolant System (RCS) Hot and Cold Leg (continued)

Temperatures RCS Hot and Cold Leg Temperatures are Category I variables provided for verification of core cooling and long term surveillance.

In addition, RCS cold leg temperature is used in conjunction with RCS hot leg temperature to verify the unit conditions necessary to establish natural circulation in the RCS. RCS hot and cold leg temperature is also used for unit stabilization and cooldown control.

The channels provide indication over a range of 50'F to 700 F.

5.

Reactor Coolant System (RCS) Pressure (Wide Range)

RCS wide range pressure is a Category I variable provided for verification of core cooling and RCS integrity long term surveillance.

RCS pressure is used to verify when there should be SI flow to RCS from at least one train, when the RCS pressure is below the pump shutoff head.

In addition to these verifications, RCS pressure is used for determining RCS subcooling margin. RCS subcooling margin will allow termination of SI, if still in progress, or reinitiation of SI if it has been stopped. RCS pressure can also be used:

to determine whether to terminate actuated SI or to reinitiate stopped SI; Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-5 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES LCO

5.

Reactor Coolant System Pressure (RCS) (Wide Range)

(continued)

to determine when to reset SI and shut off RHR;

to determine when to manually restart Emergency Core Cooling System (ECCS) Pumps; as reactor coolant pump (RCP) trip criteria; and

to make a determination on the nature of the accident in progress and where to go next in the procedure.

RCS subcooling margin is also used for unit stabilization and cooldown control.

RCS pressure is also related to three decisions about depressurization. They are:

"* to determine whether to proceed with primary system depressurization;

"* to verify termination of depressurization; and

"* to determine whether to close accumulator isolation valves during a controlled cooldown/depressurization.

RCS pressure is a Category I, Type A variable because the operator uses this indication to monitor the cooldown of the RCS following a steam generator tube rupture (SGTR) or small break LOCA. Operator actions to maintain a controlled cooldown, such as adjusting steam generator (SG) pressure or level, would use this indication. Furthermore, RCS pressure is one factor that may be used in decisions to terminate RCP operation.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-6 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES LCO (continued)

6.

Reactor Vessel Water Level Reactor Vessel Water Level is provided for verification and long term surveillance of core cooling. It is also used for accident diagnosis and to determine reactor coolant inventory adequacy.

The Reactor Vessel Water Level Monitoring System provides a direct measurement of the collapsed liquid level above the bottom of the vessel. The collapsed level represents the amount of liquid mass that is in the reactor vessel.

Measurement of the collapsed water level is selected because it is a direct indication of the water inventory.

7.

Containment Sump Water Level (Wide Range)

Containment Sump Water Level is provided for verification and long term surveillance of RCS integrity.

Containment Sump Water Level is used for accident diagnosis and to determine when to begin the recirculation procedure.

8.

Containment Pressure (Wide Range)

Containment Pressure (Wide Range) is provided for verification of RCS and containment OPERABILITY.

9.

Penetration Flow Path Automatic Containment Isolation Valve (CIV) Position CIV Position is provided for verification of Containment OPERABILITY and containment isolation.

When used to verify containment isolation, the important information is the isolation status of the containment Prairie Island Units 1 and 2 B 3.3.3-7 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES LCO

9.

Penetration Flow Path Automatic Containment Isolation Valve (CIV) Position (continued) penetrations. The LCO requires one channel of valve position indication in the control room to be OPERABLE for each active CIV in a containment penetration flow path, i.e., two total channels of CIV position indication for a penetration flow path with two active valves. The position indication in the control room requirement is satisfied by the individual valve position indication lights (red or green) or the Containment Isolation panel 44104 (44515) white status lights. For containment penetrations with only one active CIV having control room indication, Note (b) requires a single channel of valve position indication to be OPERABLE. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve, as applicable, and prior knowledge of a passive valve, or via system boundary status. If a normally active CIV is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE. Note (a) to the Required Channels states that the Function is not required for isolation valves whose associated penetration is isolated by at least one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured. Each penetration is treated separately and each penetration flow path is considered a separate Function.

Therefore, separate Condition entry is allowed for each penetration flow path.

10.

Containment Area Radiation (High Range)

Containment Area Radiation is provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-8 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES LCO

10.

Containment Area Radiation (High Range) (continued) invoke site emergency plans. Containment radiation level is used to determine if a LOCA with core damage has occurred.

11.

Hydrogen Monitors Hydrogen Monitors are provided to detect high hydrogen concentration conditions that represent a potential for containment breach from a hydrogen explosion. This variable is also important in verifying the adequacy of mitigating actions.

12.

Pressurizer Level Pressurizer Level is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped.

Knowledge of pressurizer water level is also used to verify the unit conditions necessary to establish natural circulation in the RCS and to verify that the unit is maintained in a safe shutdown condition.

13.

Steam Generator Water Level (Wide Range)

SG Water Level is provided to monitor operation of decay heat removal via the SGs. The Category I indication of SG level is the wide range level instrumentation. The wide range level covers a span of 0% to 100% between the lower tubesheet and the separator.

SG Water Level (Wide Range) is used to:

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-9 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES LCO

13.

Steam Generator Water Level (Wide Range) (continued)

"* verify that the intact SGs are an adequate heat sink for the reactor; determine the nature of the accident in progress (e.g.,

verify an SGTR); and

"* verify unit conditions for termination of SI.

Operator action is based on the control room indication of SG level. Wide range level is a Type A variable because the operator must manually raise and control SG level to ensure decay heat removal.

14.

Condensate Storage Tank (CST) Level CST Level is provided to ensure water supply for auxiliary feedwater (AFW). The CSTs provide f-, nonsafety grade water supply for the AFW System. The CSTs consist of three 150,000 gallon tanks connected to both units by a common outlet header. Inventory is monitored by a 0% to 100% level indication. CST Level is displayed on a control room indicator and unit computer. In addition, a control room annunciator alarms on low level.

CST Level is considered a Type D variable.

The DBAs that require AFW are the steam line break (SLB) and LOCA.

Reference Technical Specification Bases 3.7.6, "Condensate Storage Tanks" for additional information.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-10 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES LCO (continued)

15.

Core Exit Temperature Core Exit Temperature is provided for verification and long term surveillance of core cooling.

An evaluation was made of the minimum number of valid core exit thermocouples (CET) necessary for measuring core cooling. The evaluation determined the reduced complement of CETs necessary to detect initial core recovery and trend the ensuing core heatup. Adequate core cooling monitoring is ensured with four valid CETs per quadrant (Ref. 3). Core Exit Temperature is used to determine RCS subcooling margin.

RCS subcooling margin will allow termination of safety injection (SI), if still in progress, or reinitiation of SI if it has been stopped. RCS subcooling margin is also used for unit stabilization and cooldown control.

In accordance with Reference 3, due to the size of the reactor core, four thermocouples OPERABLE in the center region of the core and at least one thermocouple in each quadrant of the outside core region are needed to provide radial temperature gradient monitoring. The center core region is defined by the following CEhs and their locations.

Prairie Island Units 1 and 2 B 3.3.3-11 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES LCO

15.

Core Exit Temperature (continued)

CET Number 9

10 12 13 14 16 18 19 22 23 28 29 30 32 33 34 CET Location D-5 D-7 E-4 E-6 E-10 F-7 G-4 G-6 H-5 H-9 1-4 1-8 1-10 J-6 J-8 J-9 These required thermocouples ensure a single failure will not disable the ability to determine the radial temperature gradient.

16.

Refueling Water Storage Tank (RWST) Level The RWST Level is a Category I, Type A variable provided for verifying a water source to the ECCS and Containment Spray, determining the time for initiation of recirculation following a LOCA, and event diagnosis.

Prairie Island Units 1 and 2 B 3.3.3-12 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES ACTIONS A. I (continued) into account the remaining OPERABLE channel, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring EM instrumentation during this interval.

A Note has been added stating that Condition A is not applicable to the CETs. The CETs are controlled under Conditions B, F, and G.

B.1 Condition B applies when there is one or more required CET channel(s) inoperable and with at least 4 CETs OPERABLE in the center region of the core, and at least one CET OPERABLE in each quadrant of the outside core region. Required Action B. I requires restoring the required CET channel(s) to OPERABLE status within 30 days. The 30 day Completion Time is acceptable based on operating experience and takes into account the remaining OPERABLE CETs, and the low probability of an event requiring EM Instrumentation during this interval.

C.1 Condition C applies when the Required Action and associated Completion Time for Condition A or B are not met. This Required Action specifies initiation of actions in Specification 5.6.8, a written report to be submitted to the NRC immediately. This report discusses the results of the root cause evaluation of the inoperability and identifies proposed restorative actions. This action is appropriate in lieu of a shutdown requirement since alternative actions are identified before loss of functional capability, and given the likelihood of unit conditions that would require information provided by this instrumentation.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-14 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES ACTIONS D. 1 (continued)

Condition D applies when one or more Functions have two inoperable required channels (i.e., two channels inoperable in the same Function). Required Action D. 1 requires restoring one channel in the Function(s) to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring EM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the EM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the EM Function will be in a degraded condition should an accident occur. Condition D is modified by a Note that excludes hydrogen monitor channels and CET channel(s).

E.l Condition E applies when two hydrogen monitor channels are inoperable. Required Action E. 1 requires restoring one hydrogen monitor channel to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable based on the backup capability of the Post Accident Sampling System to monitor the hydrogen concentration for evaluation of core damage and to provide information for operator decisions. Also, it is unlikely that a LOCA (which would cause core damage) would occur during this time.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-15 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES ACTIONS F. I (continued)

Condition F applies when three or more required CET channels are inoperable in one or more quadrants and less than four CET channels are OPERABLE in the center region of the core. Required Action F.1 requires restoring the required inoperable channels to OPERABLE status within 7 days. The 7 day Completion Time is acceptable based on operating experience and taking into account the remaining CETs and the low probability of an event occurring that would require the CETs to assess the reactor core.

G.1 Condition G applies when three or more required CET channels are inoperable in one or more quadrants and less than one CET channel OPERABLE in each quadrant of the outside core region. Required Action G. 1 requires restoring the required inoperable channels to OPERABLE status within 7 days. The 7 day Completion Time is acceptable based on operating experience taking into account the remaining CETs and the low probability of an event occurring that would require the CETs to assess the reactor core.

H.1 Condition H applies when the Required Action and associated Completion Time of Condition D, E, F, or G are not met. Required Action H. 1 requires entering the appropriate Condition referenced in Table 3.3.3-1 for the channel immediately. The applicable Condition referenced in the Table is Function dependent. Each time an inoperable channel has not met any Required Action of Condition D, E, F, or G and the associated Completion Time has expired, Condition H is entered for that channel and provides for transfer to the appropriate subsequent Condition.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-16 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES ACTIONS I.1 (continued)

If the Required Action and associated Completion Time of Condition H is not met and Table 3.3.3-1 directs entry into Condition I, the unit must be brought to a MODE where the requirements of this LCO do not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed Completion Time is reasonable, based on operating experience, to reach the required unit condition from full power conditions in an orderly manner and without challenging unit systems.

J. 1 Alternate means (e.g., CETs) of monitoring Reactor Vessel Water Level and Containment Area Radiation have been developed and tested. These alternate means may be temporarily installed if the normal EM channel cannot be restored to OPERABLE status within the allotted time. If these alternate means are used, the Required Action is not to shut down the unit but rather to follow the directions of Specification 5.6.8, in the Administrative Controls section of the TS. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed EM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal EM channels.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-17 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES (continued)

SURVEILLANCE A Note has been added to the SR Table to clarify that REQUIREMENTS SR 3.3.3.1 and SR 3.3.3.3 apply to each EM instrumentation Function in Table 3.3.3-1 except Function 11. SR 3.3.3.1 and 3.3.3.2 apply to Function 11.

SR 3.3.3.1 Performance of the CHANNEL CHECK once every 31 days ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation should be compared to similar unit instruments located throughout the unit.

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE.

As specified in the SR, a CHANNEL CHECK is only required for those channels that are normally energized.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-18 Unit 2 - Amendment No. 149

EM Instrumentation B 3.3.3 BASES SURVEILLANCE SR 3.3.3.1 (continued)

REQUIREMENTS The Frequency of 31 days is based on operating experience that demonstrates that channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.3.2 A CHANNEL CALIBRATION is performed every 92 days.

CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to the measured parameter with the necessary range and accuracy. The Frequency is based on operating experience at PI.

SR 3.3.3.3 A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to the measured parameter with the necessary range and accuracy. This SR is modified by a Note that excludes neutron detectors.

The Frequency is based on operating experience and consistency with the typical PI refueling cycle.

REFERENCES

1. USAR Section 7.10.

2.

Regulatory Guide 1.97, Revision 2.

3. NRC approved LAR 121 dated November 9, 1995.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.3-19 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage Instrumentation B 3.3.4 B 3.3 INSTRUMENTATION B 3.3.4 4 kV Safeguards Bus Voltage Instrumentation BASES BACKGROUND The Diesel Generators (DGs) provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation. Redundant offsite power sources ensure an available source of offsite power to the Engineered Safety Features when one offsite path becomes unavailable. Undervoltage protection, via load sequencers, will provide voltage and load restoration, including DG start if an undervoltage (UV) or degraded voltage (DV) condition occurs at the 4 kV safeguards buses. There are two trains of load sequencers and UV and DV signals, one train for each 4 kV safeguards bus. These features are described in the USAR (Ref. 1).

Eight voltage relays provide input to the load sequencer for each 4 kV safeguards bus for detecting a sustained DV, approximately 95% of 4160V, or a UV, approximately 75% of 4160V, condition.

Four relays are paired in the load sequencer logic in a two-out-of two channel logic whose output is combined into a one-out-of-two times logic for each function, DV and UV. Time delays are applied within the UV and DV functions to prevent actuation during normal transients. A DG start time delay is also provided in the DV function to allow the condition to be corrected by external actions within a time period that will not cause damage to operating equipment.

The load sequencer provides a DG start signal from the UV function if neither offsite path is available. The DV function provides a DG start signal and transfers the bus from the grid to the DG. Load rejection and load restoration sequencing is actuated by an SI signal input, or when the bus is being automatically transferred. The load sequencer is considered to be a support system to the associated DG.

An inoperable load sequencer would not allow the associated DG to Prairie Island Units 1 and 2 B 3.3.4-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage Instrumentation B 3.3.4 BASES BACKGROUND automatically start, connect to the bus, and provide load reception.

(continued)

However, when a load sequencer is inoperable, the associated DG can still be manually started and loaded.

Allowable Values and Trip Setpoints The trip setpoints used in the relays are based on the plant specific voltage analysis discussed in the USAR (Ref. 1).

The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for protective action to ensure that the consequences of Design Basis Accidents (DBA's), in coincidence with offsite power unavailability or instability, will be acceptable.

The Allowable Value is considered a limiting value such that a channel is OPERABLE if the measured setpoint is found not to exceed the Allowable Value during the CHANNEL OPERATIONAL TEST (COT). Note that, although a channel is OPERABLE under these circumstances, the setpoint must be left adjusted to within the established calibration tolerance band of the trip setpoint in accordance with the uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria).

Setpoints adjusted consistent with the requirements of the Allowable Values provide a conservative margin with regard to instrument uncertainties to ensure that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the accident and that the equipment functions as designed.

Allowable Values are specified as applicable for each Function in SR 3.3.4.3. Trip setpoints are also specified in the unit specific setpoint calculations. The specified trip setpoints are selected to Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.4-2 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage Instrumentation B 3.3.4 BASES BACKGROUND Allowable Values and Trip Setpoints (continued) ensure that the setpoint measured by the surveillance procedure does not exceed the Allowable Value if the relay is performing as required. If the measured setpoint does not exceed the Allowable Value, the relay is considered OPERABLE. Operation with a measured setpoint less conservative than the specified trip setpoint, but within the Allowable Value, is acceptable provided that operation and testing is consistent with the assumptions of the unit specific setpoint calculation. Each Allowable Value specified is conservative with respect to the values assumed in the analyses described in Reference 1 in order to account for instrument uncertainties appropriate to the trip function. These uncertainties are defined in Reference 2.

APPLICABLE The 4 kV safeguards bus voltage instrumentation is required for the SAFE'TY Engineered Safety Features (ESF) Systems to function in any ANALYSES accident with a loss of offsite power. Its design basis is that of the ESF Actuation System (ESFAS).

Accident analyses credit the loading of the DG based on the loss of offsite power during a small break loss of coolant accident (LOCA).

The actual DG start has historically been associated with the ESFAS actuation. The DG loading has been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power. The analyses assume a non-mechanistic DG loading, which does not explicitly account for each individual component of loss of power detection and subsequent actions.

The required 4 kV safeguards bus voltage instrumentation, in conjunction with the ESF systems powered from the DGs, provide Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.4-3 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage Instrumentation B 3.3.4 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO APPLICABILITY unit protection in the event of any of the analyzed accidents discussed in Reference 3, in which a loss of offsite power is assumed.

The delay times assumed in the safety analysis for the ESF equipment include the 10 second DG start delay, and the appropriate sequencing delay, if applicable.

The 4 kV safeguards bus voltage instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The LCO for 4 kV safeguards bus voltage instrumentation requires that four channels per bus of both the UV and DV Functions, and one automatic load sequencer per bus, shall be OPERABLE in MODES 1, 2, 3, and 4. In MODES 5 and 6, the four channels and the associated load sequencer must be OPERABLE whenever the associated DG is required to be OPERABLE to ensure that the automatic start of the DG is available when needed. A UV or DV channel is OPERABLE when it is capable of actuating the load sequencer. Loss of the 4 kV Safeguards Bus Voltage Instrumentation Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents.

A channel is OPERABLE with a trip setpoint outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to within the calibration tolerance band.

The 4 kV Safeguards Bus Voltage Instrumentation Functions are required in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODE 5 or 6 is required whenever the required DG must be OPERABLE so that it can perform its function on an UV or degraded power to the safeguards bus.

Prairie Island Units 1 and 2 B 3.3.4-4 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage Instrumentation B 3.3.4 BASES (continued)

ACTIONS In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the channel is found inoperable, then the function that channel provides must be declared inoperable and the LCO Condition entered for the particular protection function affected.

Because the required channels are specified on a per bus basis, the Condition may be entered separately for each bus as appropriate.

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in the LCO. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 Condition A applies to the 4 kV safeguards bus voltage Function with one UV or one DV or both (one UV and one DV ) channel(s) per bus inoperable.

If one channel is inoperable, Required Action A. 1 requires that channel to be placed in bypass within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . With a channel in bypass, the remaining 4 kV safeguards bus voltage instrumentation channels provide UV or DV Function, two-out-of-two logic, initiation.

The specified Completion Time and time allowed for bypassing one channel are reasonable considering the Function will operate on every bus and the low probability of an event occurring during these intervals.

Condition A has been modified by a Note indicating that this Condition is only applicable to Functions a and b.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.4-5 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage InstrumentatiOn B 3.3.4 BASES ACTIONS B. I and B.2 (continued)

Condition B applies when one or more Functions with two channels per bus inoperable.

Required Action B. I requires placing one channel in bypass and the other inoperable channel in trip. Required Action B.2 requires the verification that all channels associated with the redundant load sequencer are OPERABLE. The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time should allow ample time to repair most failures and takes into account the low probability of an event requiring a DG start occurring during this interval.

Condition B has been modified by a Note indicating that this Condition is only applicable to Functions a and b.

C.1 Condition C applies in MODE 1, 2, 3, or 4 when Required Action and associated Completion Time of Condition A or B are not met, when Functions a or b or both with three channels per bus inoperable, or when one required load sequencer is inoperable.

Required Action C. I requires the performance of SR 3.3.4.2 for the OPERABLE automatic load sequencer. The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time provides a reasonable time for performance of the SR.

Performance of this SR on a more frequent basis, once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter, ensures that the OPERABLE load sequencer remains OPERABLE while in this Condition. If the redundant train load sequencer fails to pass the SR it is inoperable and Condition D must then be entered.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.4-6 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage Instrumentation B 3.3.4 BASES ACTIONS (continued)

C.2 and C.3 To ensure a highly reliable power source remains with an inoperable load sequencer, the offsite paths for the associated 4 kV safeguards bus must be capable of accepting the block loading that could result from an SI signal and availability must be verified on a more frequent basis. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is consistent with the Completion Time for an inoperable 4 kV safeguards bus, as required in LCO 3.8.9, "Distribution Systems - Operating." The verification of the operability of the offsite paths for associated 4 kV safeguards on a more frequent basis, once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter, ensures that the OPERABLE paths remain OPERABLE while in this Condition.

An inoperable load sequencer results in associated DG unavailability for automatic start, connection to the bus and load reception. In Condition C, the remaining OPERABLE DG and offsite paths are adequate to supply electrical power to the onsite Safeguards AC Distribution System.

Offsite power block loading capability is established by administrative control of selected distribution system loads to reduce potential starting current.

C.4 Required Action C.4 is intended to provide assurance that a loss of offsite power, during the period that a load sequencer is inoperable and the associated DG is inoperable for automatic start, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related trains.

Redundant required feature failures consist of inoperable features associated with a train, redundant to the train that has an inoperable DG.

Prairie Island Units 1 and 2 B 3.3.4-7 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage Instrumentation B 3.3.4 BASES ACTIONS C.4 (continued)

The Completion Time for Required Action C.4 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a.

An inoperable DG exists; and

b.

A required feature on the other train (Train A or Train B) is inoperable.

If at any time during the existence of this Condition (one DG inoperable) a required feature subsequently becomes inoperable, this Completion Time would begin to be tracked.

Discovering one required DG inoperable coincident with one or more inoperable required support or supported features, or both, that are associated with the OPERABLE DG, results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.

In this Condition, the remaining OPERABLE DG and paths are adequate to supply electrical power to the onsite Safeguards Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.4-8 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage Instrumentation B 3.3.4 BASES ACTIONS C.4 (continued) however, function has not been lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

C.5 Required Action C.5 requires that the automatic load sequencer be restored to OPERABLE status. The 7 day Completion Time allows a reasonable time to repair the inoperable load sequencer. The Completion Time is consistent with the Completion Time to restore an inoperable DG, as required in LCO 3.8.1, "AC Sources - Operating."

D._I Condition D applies when the Required Action and associated Completion Time of Condition C are not met. The unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

E._I Required Action E. I requires that LCO 3.8.2 "AC Sources Shutdown" Condition(s) and Required Action(s) for the DG made inoperable from inoperable 4 kV safeguards bus voltage Prairie Island Units 1 and 2 B 3.3.4-9 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage Instrumentation B 3.3.4 BASES ACTIONS SURVEILLANCE REQUIREMENTS E.1 (continued) instrumentation be entered immediately when Required Action and Completion Time of Condition A or B are not met, or Functions a and b or both with three channels per bus inoperable, or when one required automatic load sequencer is inoperable in MODE 5 or 6.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.

SR 3.3.4.1 SR 3.3.4.1 is the performance of a COT every 31 days.

A COT is performed on each required undervoltage and degraded voltage relay channel to ensure they will perform the intended function. For these tests, the relay trip setpoints are verified and adjusted as necessary. The Frequency is based on the known reliability of the relays and load sequencers and the multichannel redundancy available, and has been shown to be acceptable through operating experience.

SR 3.3.4.2 SR 3.3.4.2 is the performance of an ACTUATION LOGIC TEST on each required load sequencer every 31 days.

The test verifies that the logic functions provided by the load sequencer for voltage and load restoration are OPERABLE. The Frequency is based on the known reliability of the load sequencers and has been shown to be acceptable through operating experience.

Prairie Island Units 1 and 2 B 3.3.4-10 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage Instrumentation B 3.3.4 BASES SURVEILLANCE SR 3.3.4.3 REQUIREMENTS (continued)

SR 3.3.4.3 is the performance of a CHANNEL CALIBRATION on the undervoltage and degraded voltage channels.

The setpoints, as well as the response to a UV and a DV test, shall include a single point verification that an actuation occurs within the required time delay, as shown in Reference 1.

The first degraded voltage time delay of 8 + 0.5 seconds has been shown by testing and analysis to be long enough to allow for normal transients (i.e., motor starting and fault clearing). It is also longer than the time required to start the safety injection pump at minimum voltage. Following this delay, an alarm in the control room alerts the operator to the degraded condition. The subsequent occurrence of a safety injection actuation signal would immediately separate the affected bus or buses from the offsite power system. The degraded voltage DG start time delay range of 7.5 to 63 seconds is a limited duration such that the permanently connected Class 1E loads will not be damaged. Following this delay, if the operator has failed to restore adequate voltages, the affected bus or buses would be automatically separated from the offsite power system. The second time delay is specified here as an allowable range to be longer than the first time delay and shorter than the time which could cause damage to the permanently connected Class 1 E loads.

A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the voltage relay channel. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.4-11 Unit 2 - Amendment No. 149

4Kv Safeguards Bus Voltage Instrumentation B 3.3.4 BASES SURVEILLANCE REQUIREMENTS REFERENCES SR 3.3.4.3 (continued)

The Frequency of 24 months is based on operating experience and consistency with the typical PI refueling cycle and is justified by the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

1. USAR, Section 8.4.

2. "Engineering Manual Section 3.3.4.1, Engineering Design Standard for Instrument Setpoint/Uncertainty Calculations".

3. USAR, Section 14.

Prairie Island Units 1 and 2 B 3.3.4-12 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Containment Ventilation Isolation Instrumentation B 3.3.5 B 3.3 INSTRUMENTATION B 3.3.5 Containment Ventilation Isolation Instrumentation BASES BACKGROUND Containment ventilation isolation (CVI) instrumentation closes the containment isolation valves in the Containment Purge (high flow) and Inservice (low flow) Purge System. This action isolates the containment atmosphere from the environment to minimize releases of radioactivity in the event of an accident. The Containment Inservice (low flow) Purge System may be in use during reactor operation and with the reactor shutdown. The Containment Purge (high flow) System may be in use with the reactor shutdown.

Containment ventilation isolation initiates on a safety injection (SI) signal, by manual actuation of containment isolation, or by manual actuation of containment spray. The Bases for LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)

Instrumentation," discuss these modes of initiation.

Three radiation monitoring channels are also provided as input to CVI. One channel measures gaseous radiation in containment exhaust air. This channel provides an input to one train of CVI actuation relay logic. The other two channels measure either gaseous or particulate containment exhaust air radiation. These two channels provide inputs to the other train of CVI actuation relay logic where either channel will actuate the train. These three detectors will respond to most events that release radiation to containment. Since the monitors constitute a sampling system, various components such as sample line valves and sample pumps are required to support monitor OPERABILITY.

Prairie Island Units 1 and 2 B 3.3.5-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Containment Ventilation Isolation Instrumentation B 3.3.5 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES LCO Each of the purge systems has inner and outer containment isolation valves in its supply and exhaust ducts. A high radiation signal from any one of the three channels initiates one train of CVI logic, which closes one supply and one exhaust containment isolation valve in the Containment Purge (high flow) System and Inservice (low flow)

Purge System. These systems are described in the Bases for LCO 3.6.3, "Containment Isolation Valves."

The safety analyses assume that the containment remains intact with penetrations unnecessary for core cooling isolated early in the event. The isolation of the purge valves has not been analyzed mechanistically in the dose calculations, although its rapid isolation is assumed. The containment exhaust air radiation monitors act as backup to the SI signal to ensure closing of the purge and exhaust valves. They are also the primary means for automatically isolating containment in the event of a fuel handling accident during shutdown. Containment isolation in turn ensures meeting the containment leakage rate assumptions of the safety analyses, and ensures that the calculated accidental offsite radiological doses are below 10 CFR 100 (Ref. 1) limits.

The CVI instrumentation satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

The LCO requirements ensure that the instrumentation necessary to initiate CVI, listed in Table 3.3.5-1, is OPERABLE.

1.

Manual Initiation The LCO requires two channels OPERABLE. The operator can initiate CVI at any time by using either of two switches in Prairie Island Units 1 and 2 B 3.3.5-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Containment Ventilation Isolation Instrumentation B 3.3.5 BASES LCO

1.

Manual Initiation (continued) the control room. This action will cause actuation of one train of Containment Purge and Inservice Purge System containment isolation valves in the same manner as any of the automatic actuation signals.

The LCO for Manual Initiation ensures the proper amount of redundancy is maintained in the manual actuation circuitry to ensure the operator has manual initiation capability.

Each channel consists of one switch and the interconnecting wiring to the valves.

2.

Automatic Actuation Relay Logic The LCO requires two trains of CVI Relay Logic OPERABLE to ensure that no single random failure can prevent automatic actuation.

The CVI Automatic Actuation Relay Logic consists of the same features and operate in the same manner as described for ESFAS Function 1.b, SI, and ESFAS Function 3.b, Containment Isolation. The applicable MODES and specified conditions for the CVI portion of these Functions are different and less restrictive than those for their containment isolation and SI roles. If one or more of the SI or containment isolation Functions becomes inoperable in such a manner that only the CVI Function is affected, the Conditions applicable to their SI and containment isolation Functions need not be entered. The less restrictive Actions specified for inoperability of the CVI Functions specify sufficient compensatory measures for this case.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.5-3 Unit 2 - Amendment No. 149

Containment Ventilation Isolation Instrumentation B 3.3.5 BASES LCO (continued)

APPLICABILITY

3.

High Radiation in Exhaust Air The LCO specifies two required channels of radiation monitors, one per train, to ensure that the radiation monitoring instrumentation necessary to initiate CVI remains OPERABLE.

For sampling systems, channel OPERABILITY involves more than OPERABILITY of the channel electronics.

OPERABILITY may also require correct valve lineups, and sample pump operation as well as detector OPERABILITY, if these supporting features are necessary for trip to occur under the conditions assumed by the safety analyses.

4.

Manual Containment Isolation Refer to LCO 3.3.2, Function 3.a., for initiating Functions and requirements.

5.

Safety Injection Refer to LCO 3.3.2, Function 1, for initiating Functions and requirements.

6.

Manual Containment Spray Refer to LCO 3.3.2, Function 2, for initiating Functions and requirements.

All Functions in Table 3.3.5-1 are required to be OPERABLE in MODES 1, 2, 3, and 4 when the Containment Inservice (low flow)

Purge System is not isolated. In addition, the Manual Initiation, Prairie Island Units 1 and 2 B 3.3.5-4 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

Containment Ventilation Isolation Instrumentation B 3.3.5 BASES APPLICABILITY (continued)

ACTIONS Automatic Actuation Relay Logic, and High Radiation in Exhaust Air Functions are required OPERABLE during movement of irradiated fuel assemblies within containment, when the Containment Purge (high flow) and Inservice (low flow) Purge Systems are not isolated. Under these conditions, the potential exists for an accident that could release fission product radioactivity into containment. Therefore, the CVI instrumentation must be OPERABLE in these MODES.

While in MODES 5 and 6 without irradiated fuel handling in progress, the CVI instrumentation need not be OPERABLE since the potential for radioactive releases is minimized and operator action is sufficient to ensure post accident offsite doses are maintained within the limits of Reference 1.

The most common cause of channel inoperability is outright failure or drift of the process module sufficient to exceed the tolerance allowed by unit specific calibration procedures. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a COT, when the process instrumentation is set up for adjustment to bring it within specification. If the trip setpoint is less conservative than the Allowable Value, the channel must be declared inoperable immediately and the appropriate Condition entered.

A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.5-1. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

Prairie Island Units I and 2 B 3.3.5-5 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

Containment Ventilation Isolation Instrumentation B 3.3.5 BASES ACTIONS A. I (continued)

Condition A applies to the failure of one CVI radiation monitor channel.

The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed to restore the affected channel is justified by the low likelihood of events occurring during this interval, and recognition that the remaining channels will respond to events.

B.1 Condition B applies to all CVI Functions and addresses the train orientation for these Functions.

If a train is inoperable, two required radiation monitoring channels are inoperable, or the Required Action and associated Completion Time of Condition A are not met, operation may continue as long as the Required Action for the applicable Conditions of LCO 3.6.3 is met for each valve made inoperable by failure of isolation instrumentation.

A Note is added stating that Condition B is only applicable in MODE 1, 2, 3, or 4 when the Containment Inservice Purge System is not isolated.

C.1 and C.2 Condition C applies to all CVI Functions and addresses the train orientation for these Functions. If a train is inoperable, two required radiation monitoring channels are inoperable, or the Required Action and associated Completion Time of Condition A are not met, operation may continue as long as the Required Action to place and maintain containment purge (high flow) and inservice (low flow) purge and exhaust isolation valves in their closed position is met Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.5-6 Unit 2 - Amendment No. 149

Containment Ventilation Isolation Instrumentation B 3.3.5 BASES ACTIONS C.l and C.2 (continued) or the applicable Conditions of LCO 3.9.4, "Containment Penetrations," are met for each valve made inoperable by failure of isolation instrumentation. The Completion Time for these Required Actions is Immediately.

A Note states that Condition C is only applicable during movement of irradiated fuel assemblies within containment when the Containment Purge and Inservice Purge Systems are not isolated.

SURVEILLANCE A Note has been added to the SR Table to clarify that Table 3.3.5-1 REQUIRENENTS determines which SRs apply to which CVI Functions.

SR 3.3.5.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.5-7 Unit 2 - Amendment No. 149

Containment Ventilation Isolation Instrumentation B 3.3.5 BASES SURVEILLANCE REQUIREMENTS SR 3.3.5.1 (continued)

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.5.2 SR 3.3.5.2 is the performance of an ACTUATION LOGIC TEST.

This test is performed every 31 days on a STAGGERED TEST BASES. The test includes actuation of the master and slave relays whose contact outputs remain within the logic. The test condition inhibits actuation of the masters whose contact outputs provide direct equipment actuation. The Surveillance interval is acceptable based on instrument reliability and industry operating experience.

SR 3.3.5.3 A COT is performed every 31 days on each required channel to ensure the entire channel will perform the intended Function. The setpoint shall be left consistent with the current unit specific procedure tolerance.

SR 3.3.5.4 SR 3.3.5.4 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation mode is either allowed to function or is placed in a condition where the relay contact operation can be verified without operation of the equipment. This test is performed every 24 months.

Prairie Island Units 1 and 2 B 3.3.5-8 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Containment Ventilation Isolation Instrumentation B 3.3.5 BASES (continued)

SURVEILLANCE SR 3.3.5.5 REQUIREMENTS (continued)

SR 3.3.5.5 is the performance of a TADOT. This test is a check of the Manual Initiation Function and is performed every 24 months.

The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Functions tested have no setpoints associated with them.

The Frequency is based on the known reliability of the Function and the redundancy available, and has been shown to be acceptable through operating experience.

SR 3.3.5.6 A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

The Frequency is consistent with the typical industry refueling cycle.

REFERENCES

1.

10 CFR 100.11.

Prairie Island Units 1 and 2 B 3.3.5-9 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

CRSVS Actuation Instrumentation B 3.3.6 B 3.3 INSTRUMENTATION B 3.3.6 Control Room Special Ventilation System (CRSVS) Actuation Instrumentation BASES BACKGROUND The CRSVS provides an enclosed control room environment from which the unit can be operated following an uncontrolled release of radioactivity. During normal operation, the Control Room Ventilation System provides control room ventilation. Upon receipt of an actuation signal, automatic control dampers of the associated train isolate the control room and direct a portion of recirculated air through redundant PAC filters before entry to the air handling units.

This system is described in the Bases for LCO 3.7.10, "Control Room Special Ventilation System."

The actuation instrumentation consists of radiation monitors in the control room area. A high radiation signal from these detectors will initiate the associated train of the CRSVS. The CRSVS is also actuated by a safety injection (SI) signal. The SI Function is discussed in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation."

APPLICABLE SAFETY ANALYSES The control room must be kept habitable for the operators stationed there during accident recovery and post accident operations.

The CRSVS acts to terminate the supply of unfiltered outside air to the control room and initiate filtration. These actions are necessary to ensure the control room is kept habitable for the operators stationed there during accident recovery and post accident operations by minimizing the radiation exposure of control room personnel.

In MODES 1, 2, 3, and 4, the radiation monitor actuation of the CRSVS is a backup for the SI signal actuation. This ensures Prairie Island Units 1 and 2 B 3.3.6-1 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

CRSVS Actuation Instrumentation B 3.3.6 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO initiation of the CRSVS during a loss of coolant accident or steam generator tube rupture.

The radiation monitor actuation of the CRSVS during movement of irradiated fuel assemblies is the primary means to ensure control room habitability in the event of a fuel handling accident.

The CRSVS actuation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The LCO requirements ensure that instrumentation necessary to initiate the CRSVS is OPERABLE.

1. Manual Initiation The LCO requires two channels OPERABLE. The operator can initiate the CRSVS at any time by using either of two switches in the control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.

The LCO for Manual Initiation ensures the proper amount of redundancy is maintained in the manual actuation circuitry to ensure the operator has manual initiation capability.

Each channel consists of one switch and the interconnecting wiring to the actuation logic cabinet.

2. Control Room Radiation The LCO specifies two required Control Room Atmosphere Radiation Monitors, R23 and R24, to ensure that the radiation monitoring instrumentation necessary to initiate the CRSVS remains OPERABLE.

Prairie Island Units 1 and 2 B 3.3.6-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

CRSVS Actuation Instrumentation B 3.3.6 BASES LCO

2. Control Room Radiation (continued)

A high radiation signal from one control room radiation monitor channel (R23 or R24) initiates the following:

a. The Cleanup Fan on the associated train starts;

b. Exhaust Dampers on the associated train are isolated; and

c. Outside Air Dampers for both trains are isolated.

Table 3.3.6-1 specifies the allowable value for the Control Room Atmosphere Radiation Monitors as five times background which is approximately 10 times less than the Derived Air Concentration for Xe-133 from Appendix B of 10CFR20. No Analytical Limit is assumed in the accident analysis for this function. This allowable value was developed outside the PI setpoint methodology.

3.

Safety Injection Refer to LCO 3.3.2, Function 1, for all initiating Functions and requirements.

APPLICABILrIY CRSVS Function 1 in Table 3.3.6-1 must be OPERABLE in MODES 1, 2, 3, 4, and during movement of irradiated fuel assemblies.

The Applicability for CRSVS actuation on ESFAS Safety Injection Functions are specified in LCO 3.3.2. Refer to the Bases for LCO 3.3.2 for discussion of the Safety Injection Function Applicability.

ACTIONS A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each Function. The Conditions of this Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.6-3 Unit 2 - Amendment No. 149

CRSVS Actuation Instrumentation B 3.3.6 BASES ACTIONS Specification may be entered independently for each Function listed (continued) in Table 3.3.6-1 in the accompanying LCO. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A._ I If one or more Functions has one channel inoperable, place one CRSVS train in operation with the opposite train outside air damper closed within 7 days. With one manual switch inoperable either train of CRSVS may be placed in operation. If one radiation monitoring channel is inoperable, the associated CRSVS train must be placed in operation and the outside air dampers associated with the opposite CRSVS train must be closed. The 7 day Completion Time is the same as is allowed if one train of the mechanical portion of the system is inoperable. The basis for this Completion Time is the same as provided in LCO 3.7.10. This accomplishes the actuation instrumentation Function and places the unit in a conservative mode of operation.

B.1 and B.2 Condition B applies when one or more Functions with two channels inoperable. The first Required Action is to immediately enter the applicable Conditions and Required Actions of LCO 3.7.10 for two CRSVS trains made inoperable by the inoperable actuation instrumentation. This ensures appropriate limits are placed upon train inoperability as discussed in the Bases for LCO 3.7.10.

Alternatively, both trains may be placed in operation with the outside air dampers closed. This ensures the CRSVS function is performed even in the presence of a single failure.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.6-4 Unit 2 - Amendment No. 149

CRSVS Actuation Instrumentation B 3.3.6 BASES ACTIONS (continued)

C.1 and C.2 Condition C applies when the Required Action and associated Completion Time for Condition A or B have not been met and the unit is in MODE 1, 2, 3, or 4. The unit must be brought to a MODE in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

D.l Condition D applies when the Required Action and associated Completion Time for Condition A or B have not been met when irradiated fuel assemblies are being moved. Movement of irradiated fuel assemblies must be suspended immediately to reduce the risk of accidents that would require CRSVS actuation.

SURVEILLANCE REQUIREMENTS A Note has been added to the SR Table to clarify that Table 3.3.6-1 determines which SRs apply to which CRSVS Actuation Functions.

SR 3.3.6.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. A Prairie Island Units 1 and 2 B 3.3.6-5 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

CRSVS Actuation Instrumentation B 3.3.6 BASES SURVEILLANCE SR 3.3.6.1 (continued)

REQUIREMENS CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

The Frequency is based on operating experience that demonstrates channel failure is rare.

SR 3.3.6.2 A COT is performed once every 92 days on each required channel to ensure the entire channel, including the actuation devices, will perform the intended function. This test verifies the capability of the instrumentation to provide the CRSVS actuation. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay.

This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The setpoints are left consistent with the unit specific calibration procedure tolerance. The Frequency is based on the known reliability of the monitoring equipment and has been shown to be acceptable through operating experience.

SR 3.3.6.3 SR 3.3.6.3 is the performance of a TADOT. This test is a check of the Manual Actuation Functions and is performed every 24 months.

Each Manual Actuation Function is tested up to, and including, the master relay coils. In some instances, the test includes actuation of the end device (i.e., pump starts, valve cycles, etc.).

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.6-6 Unit 2 - Amendment No. 149

CRSVS Actuation Instrumentation B 3.3.6 BASES SURVEILLANCE REQUIREMENTS SR 3.3.6.3 (continued)

The Frequency is based on the known reliability of the Function and the redundancy available, and has been shown to be acceptable through operating experience. The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Functions tested have no setpoints associated with them.

SR 3.3.6.4 A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

The Frequency is consistent with the typical industry refueling cycle.

REFERENCES None.

Prairie Island Units 1 and 2 B 3.3.6-7 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

SFPSVS Actuation Instrumentation B 3.3.7 B 3.3 INSTRUMENTATION B 3.3.7 Spent Fuel Pool Special Ventilation System (SFPSVS) Actuation Instrumentation BASES BACKGROUND APPLICABLE SAFETY ANALYSES The SFPSVS ensures that radioactive materials in the fuel pool enclosure atmosphere following a fuel handling accident are filtered and adsorbed prior to exhausting to the environment. The system is described in the Bases for LCO 3.7.13, "Spent Fuel Pool Special Ventilation System (SFPSVS)." The system initiates filtered ventilation of the fuel pool enclosure automatically following receipt of a high radiation signal.

High radiation, monitored by either of two monitors (R-25 and R 31), provides SFPSVS initiation. Each SFPSVS train is initiated by high radiation detected by a channel dedicated to that train. There are a total of two channels, one for each train. High radiation detected by either monitor initiates fuel pool enclosure isolation and starts the SFPSVS. These actions function to prevent exfiltration of contaminated air by initiating filtered ventilation, which imposes a negative pressure on the fuel pool enclosure.

The SFPSVS ensures that radioactive materials in the fuel pool enclosure atmosphere following a fuel handling accident are filtered and adsorbed prior to being exhausted to the environment.

This action reduces the radioactive content in the fuel pool enclosure exhaust following a fuel handling accident so that offsite doses remain within the limits specified in 10 CFR 100 (Ref. 1).

The SFPSVS actuation instrumentation satisfies Criterion 3 of 1 OCFR50.36(c)(2)(ii).

Prairie Island Units 1 and 2 B 3.3.7-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

SFPSVS Actuation Instrumentation B 3.3.7 BASES (continued)

LCO The LCO requirements ensure that instrumentation necessary to initiate the SFPSVS is OPERABLE.

1. Fuel Pool Enclosure Radiation The LCO specifies two required Radiation Monitor channels (R-25 and R-31) to ensure that the radiation monitoring instrumentation necessary to initiate the SFPSVS remains OPERABLE.

The allowable value for these radiation monitors is provided by the Prairie Island Offsite Dose Calculation Manual (ODCM).

APPLICABILITY The manual SFPSVS initiation must be OPERABLE in MODES 1, 2, 3, and 4 and when moving irradiated fuel assemblies in the fuel pool enclosure, to ensure the SFPSVS operates to remove fission products associated with leakage after a fuel handling accident.

High radiation initiation of the SFPSVS must be OPERABLE in any MODE during movement of irradiated fuel assemblies in the fuel pool enclosure to ensure automatic initiation of the SFPSVS when the potential for a fuel handling accident exists.

While in MODES 5 and 6 without fuel handling in progress, the SFPSVS instrumentation need not be OPERABLE since a fuel handling accident cannot occur.

Prairie Island Units 1 and 2 B 3.3.7-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

SFPSVS Actuation Instrumentation B 3.3.7 BASES (continued)

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4, would require the unit to be shutdown unnecessarily.

A.l Condition A applies to the failure of a single radiation monitor channel. If one channel is inoperable, a period of 7 days is allowed to place one train of SFPSVS in operation. This accomplishes the actuation instrumentation function and places the unit in a conservative mode of operation. The 7 day Completion Time is the same as is allowed if one train of the mechanical portion of the system is inoperable. The basis for this time is the same as that provided in LCO 3.7.13. Since the SFPSVS does not have a manual switch, the system may be initiated by injecting a simulated high radiation signal into the radiation monitor circuitry using a rack installed test device.

B.1.1, B.1.2, and B.2 Condition B applies to the failure of two SFPSVS radiation monitors. The Required Action is to place one SFPSVS train in operation immediately. This accomplishes the actuation instrumentation function that may have been lost and places the unit in a conservative mode of operation. The applicable Conditions and Required Actions of LCO 3.7.13 must also be entered for the SFPSVS train made inoperable by the inoperable actuation instrumentation. This ensures appropriate limits are placed on train inoperability as discussed in the Bases for LCO 3.7.13.

Prairie Island Units 1 and 2 B 3.3.7-3 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

SFPSVS Actuation Instrumentation B 3.3.7 BASES ACTIONS B. 1.1, B. 1.2, and B.2 (continued)

Alternatively, both trains may be placed in operation. This ensures the SFPSVS Function is performed even in the presence of a single failure.

C.1 Condition C applies when the Required Action and associated Completion Time for Condition A or B have not been met and irradiated fuel assemblies are being moved in the fuel pool enclosure. Movement of irradiated fuel assemblies in the fuel pool enclosure must be suspended immediately to eliminate tue potential for events that could require SFPSVS actuation.

SURVEILLANCE SR 3.3.7.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

The Frequency is based on operating experience that demonstrates channel failure is rare.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.3.7-4 Unit 2 - Amendment No. 149

SFPSVS Actuation Instrumentation B 3.3.7 BASES SURVEILLANCE REQUIRE)ENTS (continued)

REFERENCES SR 3.3.7.2 A COT is performed once every 92 days on each required channel to ensure the entire channel, including the actuation devices, will perform the intended function. This test verifies the capability of the instrumentation to provide the SFPSVS actuation. The setpoints shall be left consistent with the unit specific calibration procedure tolerance. The Frequency of 92 days is based on the known reliability of the monitoring equipment and has been shown to be acceptable through operating experience.

SR 3.3.7.3 A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. The Frequency is consistent with the typical industry refueling cycle.

1.

0 CFR 100.11.

Prairie Island Units 1 and 2 B 3.3.7-5 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Pressure, Temperature, and Flow - DNB Limits B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.1 RCS Pressure, Temperature, and Flow - Departure from Nucleate Boiling (DNB) Limits BASES BACKGROUND These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within limits assumed in the safety analyses. The safety analyses (Ref. 1) of normal operating conditions and anticipated operational occurrences assume initial conditions within the normal steady state envelope. The limits placed on RCS pressure, temperature, and flow rate ensure that the minimum departure from nucleate boiling ratio (DNBR) will be met for each of the transients analyzed.

The RCS pressure limit is consistent with operation within the nominal operational envelope. Pressurizer pressure indications are averaged to come up with a value for comparison to the limit. A lower pressure will cause the reactor core to approach DNB limits.

The RCS coolant average temperature limit is consistent with full power operation within the nominal operational envelope.

Indications of temperature are averaged to determine a value for comparison to the limit. A higher average temperature will cause the core to approach DNB limits.

The RCS flow rate normally remains constant during an operational fuel cycle with both pumps running. The minimum RCS flow limit specified in the COLR corresponds to that assumed for DNB analyses. Flow rate indications are averaged to come up with a value for comparison to the limit. A lower RCS flow will cause the core to approach DNB limits.

Operation for significant periods of time outside these DNB limits increases the likelihood of a fuel cladding failure in a DNB limited event.

Prairie Island Units 1 and 2 B 3.4.1-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Pressure, Temperature, and Flow - DNB Limits B 3.4.1 BASES (continued)

APPLICABLE SAFETY ANALYSES The requirements of this LCO represent the initial conditions for DNB limited transients analyzed in the plant safety analyses (Ref. 1).

The safety analyses have shown that transients initiated from the limits of this LCO will result in meeting the DNBR criteria.

Changes to the unit that could impact these parameters must be assessed for their impact on the DNBR criteria. The transients analyzed include loss of coolant flow events and dropped or stuck rod events. A key assumption for the analysis of these events is that the core power distribution is within the limits of LCO 3.1.6, "Control Bank Insertion Limits"; LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)"; and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)."

The pressurizer pressure limit and RCS average temperature limit specified in the COLR are based on transient analyses assumptions, with allowance for steady state fluctuation, deadband and measurement errors. The measured RCS flow rate is decreased 2.3%

when being compared to the limits specified in the COLR.

The RCS DNB parameters satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).

This LCO specifies limits on the monitored process variables pressurizer pressure, RCS average temperature, and RCS total flow rate - to ensure the core operates within the limits assumed in the safety analyses. These variables are contained in the COLR to provide operating and analysis flexibility from cycle to cycle.

Operating within these limits will result in meeting the DNBR criterion in the event of a DNB limited transient.

The numerical values for pressure, temperature, and flow rate specified in the COLR are given for the measurement location and have been adjusted for instrument error.

Prairie Island Units 1 and 2 B 3.4.1-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 LCO

RCS Pressure, Temperature, and Flow - DNB Limits B 3.4.1 BASES (continued)

APPLICABILITY In MODE 1, the limits on pressurizer pressure, RCS coolant average temperature, and RCS flow rate must be maintained during steady state operation in order to ensure DNBR criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient. In all other MODES, the power level is low enough that DNB is not a concern.

A Note has been added to indicate the limit on pressurizer pressure is not applicable during short term operational transients such as a THERMAL POWER ramp > 5% RTP per minute or a THERMAL POWER step > 10% RTP. These conditions represent short term perturbations where actions to control pressure variations might be counterproductive. Since increasing power transients are initiated from power levels < 100% RTP, an increased DNBR margin exists to offset the temporary pressure variations. Decreasing power transients are in the direction which provides increased DNBR margin.

Another set of limits on DNB related parameters is provided in SL 2.1.1, "Reactor Core SLs." Those limits are less restrictive than the limits of this LCO, but violation of a Safety Limit (SL) merits a stricter, more severe Required Action.

ACTIONS A. I RCS pressure and RCS average temperature are controllable and measurable parameters. With one or both of these parameters not within LCO limits, action must be taken to restore parameter(s).

RCS total flow rate is not a controllable parameter and is not expected to vary during steady state operation. If the indicated RCS total flow rate is below the LCO limit, power must be reduced, as required by Required Action B. 1, to restore DNB margin and eliminate the potential for violation of the accident analysis bounds.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.1-3 Unit 2 - Amendment No. 149

RCS Pressure, Temperature, and Flow - DNB Limits B 3.4.1 BASES ACTIONS A.lI (continued)

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for restoration of the parameters provides sufficient time to adjust plant parameters, to determine the cause for the off normal condition, and to restore the readings within limits, and is based on plant operating experience.

B.l If Required Action A. 1 is not met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . In MODE 2, the reduced power condition eliminates the potential for violation of the accident analysis bounds. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable to reach the required plant conditions in an orderly manner.

SURVEILLANCE REQUIREMENTS SR 3.4.1.1 Since Required Action A. 1 allows a Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to restore parameters that are not within limits, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Surveillance Frequency for pressurizer pressure is sufficient to ensure the pressure can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.

Prairie Island Units 1 and 2 B 3.4.1-4 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Pressure, Temperature, and Flow - DNB Limits B 3.4.1 BASES SURVEILLANCE REQU(oniENTS (continued)

SR 3.4.1.2 Since Required Action A. 1 allows a Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to restore parameters that are not within limits, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Surveillance Frequency for RCS average temperature is sufficient to ensure the temperature can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.

SR 3.4.1.3 Measurement of RCS total flow rate once every 24 months allows the installed RCS flow instrumentation to be calibrated and verifies the actual RCS flow rate is greater than or equal to the minimum required RCS flow rate as established by the COLR.

The Frequency of 24 months reflects the importance of verifying flow after a refueling outage when the core has been altered, which may have caused an alteration of flow resistance.

This SR is modified by Note that allows entry into MODE 1, without having performed the SR, and placement of the unit in the best condition for performing the SR. The Note states that the SR is required to be performed within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after reaching 90% RTP.

This exception is appropriate since power ascension must be allowed for the flow measurement to be performed at a power level representative of rated power operations and some time is allowed to perform the test.

REFERENCES

1.

USAR, Section 14.

Prairie Island Units 1 and 2 B 3.4.1-5 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Minimum Temperature For Criticality B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.2 RCS Minimum Temperature for Criticality BASES BACKGROUND This LCO is based upon meeting several major considerations before the reactor can be made critical and while the reactor is critical.

The first consideration is isothermal temperature coefficient (ITC),

LCO 3.1.3, "Isothermal Temperature Coefficient (ITC)." In the transient and accident analyses, the ITC is assumed to be in a range from slightly positive to negative and the operating temperature is assumed to be within the nominal operating envelope while the reactor is critical. The LCO on minimum temperature for criticality helps ensure the plant is operated consistent with these assumptions.

The second consideration is the protective instrumentation. Because certain protective instrumentation (e.g., excore neutron detectors) can be affected by moderator temperature, a temperature value within the nominal operating envelope is chosen to ensure proper indication and response while the reactor is critical.

The third consideration is the pressurizer operating characteristics.

The transient and accident analyses assume that the pressurizer is within its normal startup and operating range (i.e., saturated conditions and steam bubble present). It is also assumed that the RCS temperature is within its normal expected range for startup and power operation. Since the density of the RCS water, and hence the response of the pressurizer to transients, depends upon the initial temperature of the moderator, a minimum value for moderator temperature within the nominal operating envelope is chosen for critically.

The fourth consideration is that the reactor vessel is above its minimum nil ductility reference temperature when the reactor is critical.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.2-1 Unit 2 - Amendment No. 149

RCS Minimum Temperature For Criticality B 3.4.2 BASES (continued)

APPLICABLE SAFETY ANALYSES LCO Although the RCS minimum temperature for criticality is not itself an initial condition assumed in Design Basis Accidents (DBAs), the closely aligned temperature for hot zero power (HZP) is a process variable that is an initial condition of DBAs, such as the rod cluster control assembly (RCCA) withdrawal, RCCA ejection, and main steam line break accidents performed at zero power that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier.

All low power safety analyses assume initial RCS loop temperatures are within the nominal operating envelope around the HZP temperature of 547°F (Ref. 1). The minimum temperature for criticality limitation provides a small band, 7°F, for critical operation below HZP. This band allows critical operation below HZP during plant startup and does not adversely affect any safety analyses since the ITC is not significantly affected by the small temperature difference between HZP and the minimum temperature for criticality.

The RCS minimum temperature for criticality satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

Compliance with the LCO ensures that the reactor will not be made or maintained critical (kff 2-1.0) at a temperature less than a small band below the HZP temperature, which is assumed in the safety analysis. Failure to meet the requirements of this LCO may produce initial conditions inconsistent with the initial conditions assumed in the safety analysis.

Prairie Island Units 1 and 2 B 3.4.2-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Minimum Temperature For Criticality B 3.4.2 BASES (continued)

APPLICABILITY In MODE 1 and MODE 2 with kff _>

1.0, LCO 3.4.2 is applicable since the reactor can only be critical (keff Ž- 1.0) in these MODES.

The special test exception of LCO 3.1.8, "PHYSICS TESTS Exceptions - MODE 2," permits PHYSICS TESTS to be performed at *< 5% RTP with RCS loop average temperatures slightly lower than normally allowed so that fundamental nuclear characteristics of the core can be verified. In order for nuclear characteristics to be accurately measured, it may be necessary to operate outside the normal restrictions of this LCO. For example, to measure the ITC at beginning of cycle, it is necessary to allow RCS loop average temperatures to fall below Tno load,which may cause RCS loop average temperatures to fall below the temperature limit of this LCO.

ACTIONS A. 1 If the parameters that are outside the limit cannot be restored, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to MODE 2 with keff< 1.0 within 30 minutes. Rapid reactor shutdown can be readily and practically achieved within a 30 minute period. The allowed time is reasonable, based on operating experience, to reach MODE 2 with keff< 1.0 in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.2.1 REQUIREMENTS RCS loop average temperature is required to be verified at or above 540'F every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The SR to verify RCS loop average temperatures every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months takes into account indications and alarms that are continuously available to the operator in the control Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.2-3 Unit 2 - Amendment No. 149

RCS Minimum Temperature For Criticality B 3.4.2 BASES SURVEILLANCE REQUIREMENT'S REFERENCES SR 3.4.2.1 (continued) room and are consistent with other routine Surveillances which are typically performed once per shift. In addition, operators are trained to be sensitive to RCS temperature during approach to criticality and will ensure that the minimum temperature for criticality is met as criticality is approached.

1.

USAR, Section 14.

Prairie Island Units 1 and 2 B 3.4.2-4 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS P/T Limits B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.3 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.

The PTLR contains P/T limit curves for heatup, cooldown, inservice leak and hydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolant temperature, based on Reference 1.

Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.

The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the pressurizer, which has different design characteristics and operating functions.

10 CFR 50, Appendix G, requires the establishment of P/T limits for specific material fracture toughness requirements of the RCPB materials and requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code,Section III, Appendix G.

Prairie Island Units 1 and 2 B 3.4.3-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS P/T Limits B 3.4.3 BASES BACKGROUND The neutron embrittlement effect on the material toughness is (continued) reflected by increasing the nil ductility reference temperature (RTNDT) as exposure to neutron fluence increases.

The actual shift in the RTNDT of the vessel material has been established by periodically removing and evaluating irradiated reactor vessel material specimens, in accordance with ASTM E 185, July 1982, and Appendix H of 10 CFR 50. The operating P/T limit curves have been adjusted based on the evaluation findings and the recommendations of the program prescribed in Reference 2.

The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.

The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.

The criticality limit curve includes the Reference 2 requirement that it be >_ 400 F above the heatup curve or the cooldown curve, and not less than the minimum permissible temperature for ISLH testing.

However, the criticality curve is not operationally limiting; a more restrictive limit exists in LCO 3.4.2, "RCS Minimum Temperature for Criticality."

The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must Prairie Island Unit I -Amendment No. 158 Units 1 and 2 B 3.4.3-2 Unit 2 - Amendment No. 149

RCS P/T Limits B 3.4.3 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES LCO be performed to determine the effect on the structural integrity of the RCPB components. The ASME Code,Section XI, Appendix E, provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.

The P/T limits are not derived from Design Basis Accident (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, an unanalyzed condition.

Reference 1 establishes the methodology for determining the P/T limits. Although the P/T limits are not derived from any DBA, the P/T limits are acceptance limits since they preclude operation in an unanalyzed condition.

RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).

The two elements of this LCO are:

a.

The limit curves for heatup, cooldown, and ISLH testing; and

b.

Limits on the rate of change of temperature.

The LCO limits apply to all components of the RCS, except the pressurizer. These limits define allowable operating regions and permit a large number of operating cycles while providing a wide margin to nonductile failure.

The limits for the rate of change of temperature control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and ISLH testing P/T limit curves.

Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.

Prairie Island Units 1 and 2 B 3.4.3-3 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

RCS P/T Limits B 3.4.3 BASES LCO (continued)

APPLICABILITY Violating the LCO limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCPB components. The consequences depend on several factors, as follow:

a.

The severity of the departure from the allowable operating P/T regime or the severity of the rate of change of temperature;

b.

The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and

c.

The existences, sizes, and orientations of flaws in the vessel material.

The RCS P/T limits LCO provides a definition of acceptable operation for prevention of nonductile failure in accordance with 10 CFR 50, Appendix G. Although the P/T limits were developed to provide guidance for operation during heatup or cooldown (MODES 3, 4, and 5) or ISLH testing, their Applicability is at all times in keeping with the concern for nonductile failure. The limits do not apply to the pressurizer.

During MODES 1 and 2, other Technical Specifications provide limits for operation that can be more restrictive than or can supplement these P/T limits. LCO 3.4.1, "RCS Pressure, Temperature, and Flow - Departure from Nucleate Boiling (DNB)

Limits"; LCO 3.4.2, "RCS Minimum Temperature for Criticality";

and Safety Limit 2.1, "Safety Limits," also provide operational restrictions for pressure and temperature. Furthermore, MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed for normal maneuvering profiles, such as power ascension or descent.

Prairie Island Units 1 and 2 B 3.4.3-4 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

RCS P/T Limits B 3.4.3 BASES (continued)

ACTIONS A.1 and A.2 Operation outside the P/T limits during MODE 1, 2, 3, or 4 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.

The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.

Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used, including an engineering evaluation to determine effects of the out of-limit condition on the structural integrity of the RCS, a comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.

ASME Code,Section XI, Appendix E, may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable to accomplish the evaluation. The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed before continuing to operate.

Condition A is modified by a Note requiring that Required Action A.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action A. 1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.3-5 Unit 2 - Amendment No. 149

RCS P/T Limits B 3.4.3 BASES ACTIONS B.l and B.2 (continued)

If a Required Action and associated Completion Time of Condition A are not met, the plant must be placed in a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. In reduced pressure conditions, which requires reduced temperature, the possibility of propagation of undetected flaws is decreased.

If the required restoration activity cannot be accomplished within 30 minutes, Required Action B. 1 and Required Action B.2 must be implemented to reduce pressure and temperature.

If the required evaluation for continued operation cannot be accomplished within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or the results are indeterminate or unfavorable, action must proceed to reduce pressure and temperature as specified in Required Action B. 1 and Required Action B.2. A favorable evaluation must be completed and documented before returning to operating pressure and temperature conditions.

Pressure and temperature are reduced by bringing the plant to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 with RCS pressure

< 500 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 Actions must be initiated immediately to correct operation outside of the P/T limits at times other than when in MODE 1, 2, 3, or 4, so that Prairie Island Unit 1 -Amendment No. 158 Units 1 and 2 B 3.4.3-6 Unit 2 - Amendment No. 149

RCS P/T Limits B 3.4.3 BASES ACTIONS C. 1 and C.2 (continued) the RCPB is returned to a condition that has been verified by stress analysis.

The immediate Completion Time reflects the urgency of initiating action to restore the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.

Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify that the RCPB integrity remains acceptable and must be completed prior to entry into MODE 4. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, or inspection of the components.

ASME Code,Section XI, Appendix E, may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.

Condition C is modified by a Note requiring that Required Action C.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C. 1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.

SURVEILLANCE SR 3.4.3.1 REQUIREMENTS Verification that operation is within the PTLR limits is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. This Frequency is considered reasonable in view of the control room indication available to Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.3-7 Unit 2 - Amendment No. 149

RCS P/T Limits B 3.4.3 BASES SURVEILLANCE REQUIREMýIENTS REFERENCES SR 3.4.3.1 (continued) monitor RCS status. Also, since temperature rate of change limits are specified in hourly increments, 30 minutes permits assessment and correction for minor deviations within a reasonable time.

Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied.

This SR is modified by a Note that only requires this SR to be performed during system heatup, cooldown, and ISLH testing. No SR is given for criticality operations because LCO 3.4.2 contains a more restrictive requirement.

1.

WCAP-14040-NP-A, January 1996.

2.

USAR, Section 4.7.

Prairie Island Units 1 and 2 B 3.4.3-8 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODES 1 and 2 B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.4 RCS Loops-MODES 1 and 2 BASES BACKGROUND APPLICABLE SAFETY ANALYSES The primary function of the RCS is removal of the heat generated in the fuel due to the fission process, and transfer of this heat, via the steam generators (SGs), to the secondary plant.

The secondary functions of the RCS include:

a.

Moderating the neutron energy level to the thermal state, to increase the probability of fission;

b.

Improving the neutron economy by acting as a reflector;

c.

Carrying the soluble neutron poison, boric acid; and

d.

Providing a second barrier against fission product release to the environment.

The reactor coolant is circulated through two loops connected in parallel to the reactor vessel, each containing a SG, a reactor coolant pump (RCP), and appropriate flow and temperature instrumentation for both control and protection. The reactor vessel contains the clad fuel. The SGs provide the heat sink to the isolated secondary coolant. The RCPs circulate the coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage. This forced circulation of the reactor coolant ensures mixing of the coolant for proper boration and chemistry control.

Safety analyses contain various assumptions for the design bases accident initial conditions including RCS pressure, RCS temperature, reactor power level, core parameters, and safety system setpoints. The important aspect for this LCO is the reactor coolant Prairie Island Units 1 and 2 B 3.4.4-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODES 1 and 2 B 3.4.4 BASES APPLICABLE SAFETY ANALYSES (continued) forced flow rate, which is represented by the number of RCS loops in service.

Both transient and steady state analyses include the effect of flow on the departure from nucleate boiling ratio (DNBR). The transient and accident analyses for the plant have been performed assuming both RCS loops are in operation. The majority of the plant safety analyses are based on initial conditions at high core power or zero power. The accident analyses that are most important to RCP operation are the two pump coastdown, single pump locked rotor, misaligned rod, and rod withdrawal events (Ref. 1).

The plant is designed to operate with both RCS loops in operation to maintain DNBR within limits during all normal operations and anticipated transients. By ensuring heat transfer in the nucleate boiling region, adequate heat transfer is provided between the fuel cladding and the reactor coolant.

RCS Loops - MODES I and 2 satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO APPLICABILITY The purpose of this LCO is to require an adequate forced flow rate for core heat removal. Flow is represented by the number of RCPs in operation for removal of heat by the SGs. To meet safety analysis acceptance criteria for DNB, two pumps are required at power.

An OPERABLE RCS loop consists of an OPERABLE RCP in operation providing forced flow for heat transport and an OPERABLE SG in accordance with the Steam Generator Tube Surveillance Program.

In MODES I and 2, the reactor is critical and thus has the potential to produce maximum THERMAL POWER. Thus, to ensure that the Prairie Island Units 1 and 2 B 3.4.4-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODES 1 and 2 B 3.4.4 BASES APPLICABILITY (continued) assumptions of the accident analyses remain valid, both RCS loops are required to be OPERABLE and in operation in these MODES to prevent DNB and core damage.

The decay heat production rate is much lower than the full power heat rate. As such, the forced circulation flow and heat sink requirements are reduced for lower, noncritical MODES as indicated by the LCOs for MODES 3, 4, and 5.

Operation in other MODES is covered by:

LCO 3.4.5, "RCS Loops-MODE 3";

LCO 3.4.6, "RCS Loops-MODE 4";

LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";

LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).

ACTIONS A.1 If the requirements of the LCO are not met, the Required Action is to reduce power and bring the plant to MODE 3. This lowers power level and thus reduces the core heat removal needs and minimizes the possibility of violating DNB limits.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging safety systems.

Prairie Island Units 1 and 2 B 3.4.4-3 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODES I and 2 B 3.4.4 BASES (continued)

SURVEILLANCE REQUIREMEN~TS REFERENCES SR 3.4.4.1 This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that each RCS loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal while maintaining the margin to DNB. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS loop performance.

1.

USAR, Section 14.

Prairie Island Units 1 and 2 B 3.4.4-4 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 3 B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.5 RCS Loops - MODE 3 BASES BACKGROUND In MODE 3, the primary function of the RCS is removal of decay heat and transfer of this heat, via the steam generator (SG), to the secondary plant. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.

The reactor coolant is circulated through two RCS loops, connected in parallel to the reactor vessel, each containing a SG, a reactor coolant pump (RCP), and appropriate flow, pressure, level, and temperature instrumentation for control, protection, and indication.

The reactor vessel contains the clad fuel. The SGs provide the heat sink. The RCPs circulate the water through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage.

In MODE 3, RCPs are normally used to provide forced circulation for heat removal during heatup and cooldown. The MODE 3 decay heat removal requirements are low enough that a single RCS loop with one RCP running is sufficient to remove core decay heat in response to transients or operational events. However, two RCS loops are required to be OPERABLE to ensure redundant capability for decay heat removal.

The MODE 3 decay heat removal requirements are low enough that natural circulation is sufficient to remove core decay heat when the potential for operational events is minimized (Ref. 1).

APPLICABLE SAFETY ANALYSES Whenever the reactor trip breakers (RTBs) are in the closed position and the control rod drive mechanisms (CRDMs) are energized, an inadvertent rod withdrawal from subcritical, resulting Prairie Island Units 1 and 2 B 3.4.5-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 3 B 3.4.5 BASES APPLICABLE ANALYSES SAFETY (continued) in a power excursion, is possible. Such a transient could be caused by a malfunction of the rod control system. Therefore, in MODE 3 with the Rod Control System capable of rod withdrawal, accidental control rod withdrawal from subcritical is postulated and requires two RCS loops to be OPERABLE and in operation to ensure that the accident analyses input assumptions are met.

Failure to provide decay heat removal by forced circulation, when control rods may be withdrawn, may result in challenges to a fission product barrier. The RCS loops are part of the primary success path that functions or actuates to prevent or mitigate a Design Basis Accident or transient that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier.

RCS Loops - MODE 3 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The purpose of this LCO is to require that both RCS loops be OPERABLE. In MODE 3 with the Rod Control System capable of rod withdrawal, both RCS loops must be in operation. Two RCS loops are required to be in operation in MODE 3 with the Rod Control System capable of rod withdrawal due to the postulation of a power excursion because of an inadvertent control rod withdrawal.

The required number of RCS loops in operation ensures that the transient analysis acceptance criteria will be met.

When the Rod Control System is not capable of rod withdrawal, only one RCS loop in operation is necessary to ensure removal of decay heat from the core and homogenous boron concentration throughout the RCS. An additional RCS loop is required to be OPERABLE to ensure redundant capability for decay heat removal.

Prairie Island Units 1 and 2 B 3.4.5-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 LCO

RCS Loops - MODE 3 B 3.4.5 BASES LCO The Note permits both RCPs to be de-energized for (continued)

< 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to perform preplanned work activities.

One purpose of the Note is to allow performance of tests that are designed to validate various accident analyses values. One of these tests is validation of the pump coastdown curve used as input to a number of accident analyses including a loss of flow accident. This test was performed during the initial startup testing program, and would normally only be performed once. If, however, changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values of the coastdown curve must be revalidated by conducting the test again. Another test performed during the startup testing program was the validation of rod drop times, both with and without flow.

The MODE 3 decay heat removal requirements are low enough that natural circulation is sufficient to remove core decay heat when the potential for operational events is minimized (Ref. 1).

Any future no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits stopping the pumps in order to perform this test and validate the assumed analysis values.

Another purpose of the Note is to allow stopping of both RCP's for a sufficient time to perform station electrical lineup changes without transition to MODE 4. During these evolutions both RCP's may be inoperable. Transition to MODE 4 would put the plant through unnecessary cooldown and heatup transients. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months time period specified is adequate to perform the necessary load shedding, switching and load restoration activities and restart an RCP without requiring transition to MODE 4.

Utilization of the Note is permitted provided the following conditions are met:

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.5-3 Unit 2 - Amendment No. 149

RCS Loops - MODE 3 B 3.4.5 BASES LCO (continued)

APPLICABILITY

a.

No operations are permitted that would dilute the RCS boron concentration with coolant with boron concentration less than required to meet SDM of LCO 3.1.1, thereby maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited to preclude the need for a boration, due to the time required to achieve a uniform distribution when in natural circulation (Ref. 1); and

b.

Core outlet temperature is maintained at least 10F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

An OPERABLE RCS loop consists of one OPERABLE RCP and one OPERABLE SG which is capable of removing decay heat as specified in SR 3.4.5.2. An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.

In MODE 3, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. The most stringent condition of the LCO, that is, two RCS loops OPERABLE and two RCS loops in operation, applies to MODE 3 with the Rod Control System capable of rod withdrawal.

The least stringent condition, that is, two RCS loops OPERABLE and one RCS loop in operation, applies to Mode 3 with the Rod Control System not capable of rod withdrawal.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops-MODES 1 and 2";

LCO 3.4.6, "RCS Loops-MODE 4";

LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";

LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";

Prairie Island Units 1 and 2 B 3.4.5-4 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 3 B 3.4.5 BASES APPLICABILITY LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant (continued)

Circulation-High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level"(MODE 6).

ACTIONS A.l If one RCS loop is inoperable, redundancy for forced circulation heat removal is lost. The Required Action is restoration of the RCS loop to OPERABLE status within the Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This time allowance is a justified period to be without the redundant, nonoperating loop because a single loop in operation has a heat transfer capability greater than that needed to remove the decay heat produced in the reactor core and because of the low probability of a failure in the remaining loop occurring during this period.

If power is lost to both RCPs, the unit can be stabilized in natural circulation for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months while the RCS loops are restored to OPERABLE status. Natural circulation operation of the RCS, in combination with Required Actions D. 1 and D.2, will provide sufficient decay heat removal and RCS mixing in MODE 3 to assure continued core cooling.

B.1 If restoration is not possible within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the unit must be brought to MODE 4. In MODE 4, the unit may be placed on the Residual Heat Removal System. The additional Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is compatible with required operations to achieve cooldown and depressurization from the existing plant conditions in an orderly manner and without challenging plant systems.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.5-5 Unit 2 - Amendment No. 149

RCS Loops - MODE 3 B 3.4.5 BASES ACTIONS (continued)

C.1 and C.2 If one RCS loop is not in operation, and the Rod Control System is capable of rod withdrawal, the Required Action is either to restore the RCS loop to operation or place the Rod Control System in a condition incapable of rod withdrawal (e.g., to de-energize all CRDMs by opening the RTBs or de-energizing the motor generator (MG) sets). When the Rod Control System is capable of rod withdrawal, it is postulated that a power excursion could occur in the event of an inadvertent control rod withdrawal. This mandates having the heat transfer capacity of two RCS loops in operation. If only one loop is in operation, the Rod Control System must be rendered incapable of rod withdrawal. The Completion Times of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to restore the required RCS loop to operation or defeat the Rod Control System is adequate to perform these operations in an orderly manner without exposing the unit to risk for an undue time period.

D. 1, D.2, and D.3 If both RCS loops are inoperable or a required RCS loop is not in operation, except during conditions permitted by the Note in the LCO section, the Rod Control System must be placed in a condition incapable of rod withdrawal (e.g., all CRDM's de-energized by opening the RTBs or de-energizing the MG sets). All operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended, and action to restore one of the RCS loops to OPERABLE status and operation must be initiated. Suspending the introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed Prairie Island Units 1 and 2 B 3.4.5-6 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 3 B 3.4.5 BASES ACTIONS D.1, D.2, and D.3 (continued) coolant could be introduced to the core; however, coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Time reflects the importance of maintaining operation for heat removal. The action to restore must be continued until one loop is restored to OPERABLE status and operation.

SURVEILLANCE REQUIREMENTS SR 3.4.5.1 This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that the required loops are in operation. Verification may include flow rate, temperature, or pump status monitoring, which helps ensure that forced flow is providing heat removal. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS loop performance.

SR 3.4.5.2 SR 3.4.5.2 requires verification that the SG has the capability to remove decay heat. The ability to remove decay heat requires the ability to pressurize and control pressure in the RCS, sufficient secondary side water level in the SG relied on for decay heat removal, and an available supply of feedwater (Ref. 2). The ability of the SG to provide an adequate heat sink for decay heat removal further ensures that the SG tubes remain covered.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of the other indications available in the control room to alert the operator to a loss of the SG to remove decay heat.

Prairie Island Units 1 and 2 B 3.4.5-7 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 3 B 3.4.5 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.5.3 Verification that each required RCP is OPERABLE ensures that an additional RCP can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power availability to each required RCP. Alternatively, verification that a pump is in operation also verifies proper breaker alignment and power availability.

This SR is modified by a Note that states the SR is not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a pump is not in operation.

REFERENCES

1.

License Amendment Request Dated November 19, 1999.

(Approved by License Amendment 152/143, July 14, 2000.)

2.

NRC Information Notice 95-35, "Degraded Ability of Steam Generators to Remove Decay Heat by Natural Circulation."

Prairie Island Units 1 and 2 B 3.4.5-8 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 4 B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.6 RCS Loops - MODE 4 BASES BACKGROUND APPLICABLE SAFETY ANALYSES In MODE 4, the primary function of the reactor coolant is the removal of decay heat and the transfer of this heat to either the steam generator (SG) secondary side coolant or the component cooling water via the residual heat removal (RIR) heat exchangers. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.

The reactor coolant is circulated through two RCS loops connected in parallel to the reactor vessel, each containing a SG, a reactor coolant pump (RCP), and appropriate flow, pressure, level, and temperature instrumentation for control, protection, and indication.

The RCPs or RHR pumps circulate the coolant through the reactor vessel and SGs or the RHR heat exchangers at a sufficient rate to ensure proper heat transfer and boric acid mixing.

In MODE 4, either RCPs or RHR pumps can be used to provide forced circulation. The intent of this LCO is to provide forced flow from at least one RCS loop or one RHR loop for decay heat removal and transport. The flow provided by one RCS loop or RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that two paths be available to provide redundancy for decay heat removal.

In MODE 4, RCS circulation increases the time available for mitigation of an accidental boron dilution event. The RCS and RHR loops provide this circulation.

RCS Loops - MODE 4 satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

Prairie Island Units 1 and 2 B 3.4.6-1 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 4 B 3.4.6 BASES (continued)

LCO The purpose of this LCO is to require that at least two loops be OPERABLE in MODE 4 and that one of these loops be in operation.

The LCO allows the two loops that are required to be OPERABLE to consist of any combination of RCS loops and RHR loops. Any one loop in operation provides enough flow to remove the decay heat from the core with forced circulation. An additional loop is required to be OPERABLE to provide redundancy for heat removal.

Note 1 permits all RCPs or RHR pumps to be de-energized for <

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. The purpose of the Note is to permit tests that are designed to validate various accident analyses values. One of the LCO tests performed during the startup testing program was validation of rod drop times during cold conditions, both with and without flow. If changes are made to the RCS that would cause a change in flow characteristics of the RCS, the input values must be revalidated by conducting the test again. Use of this Note also permits any future no flow test to be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time.

The Note permits stopping the pumps in order to perform this test and validate the assumed analysis values. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months time period is adequate to perform the test, and operating experience has shown that boron stratification is not a problem during this short period with no forced flow.

Utilization of Note 1 is permitted provided the following conditions are met along with any other conditions imposed by startup test procedures:

a.

No operations are permitted that would dilute the RCS boron concentration with coolant with boron concentration less than required to meet SDM of LCO 3.1.1, therefore maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure SDM in maintained is prohibited to preclude the need for a boration, due to the time required to achieve a uniform distribution when in natural circulation (Ref. 1); and Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.6-2 Unit 2 - Amendment No. 149

RCS Loops - MODE 4 B 3.4.6 BASES LCO

b.

Core outlet temperature is maintained at least 10°F below (continued) saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

Note 2 requires a steam or gas bubble in the pressurizer or that the secondary side water temperature of each SG be *< 50'F above each of the RCS cold leg temperatures before the start of an RCP with any RCS cold leg temperature *5 the OPPS enable temperature specified in the PTLR. A steam or gas bubble ensures that the pressurizer will accommodate the swell resulting from an RCP start. Either of these restraints prevents a low temperature overpressure event due to a thermal transient when an RCP is started.

An OPERABLE RCS loop comprises an OPERABLE RCP and an OPERABLE SG which is capable of removing decay heat as specified in SR 3.4.6.2.

Similarly for the RHR System, an OPERABLE RHR loop comprises an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger. RCPs and RHR pumps are OPERABLE if they are capable of being powered and are able to provide forced flow if required.

APPLICABILITY In MODE 4, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops - MODES 1 and 2";

LCO 3.4.5, "RCS Loops - MODE 3";

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled";

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled";

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level" (MODE 6); and Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.6-3 Unit 2 - Amendment No. 149

RCS Loops - MODE 4 B 3.4.6 BASES APPLICABILITY LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant (continued)

Circulation - Low Water Level" (MODE 6).

ACTIONS A. 1 If one required loop is inoperable, redundancy for heat removal is lost. Action must be initiated to restore a second RCS or RHR loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal. Entry to a reduced MODE (MODE 5 or 6) requires RHR availability for long term decay heat removal. Remaining in MODE 4, with RCS loop operation, is conservative.

If restoration is not accomplished and an RHR Loop is OPERABLE, the unit must be brought to MODE 5 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Bringing the unit to MODE 5 is a conservative action with regard to decay heat removal. With only one RHR loop OPERABLE, redundancy for decay heat removal is lost and, in the event of a loss of the remaining RHR loop, it would be safer to initiate that loss from MODE 5 rather than MODE 4. The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable time, based on operating experience, to reach MODE 5 from MODE 4 in an orderly manner and without challenging plant systems.

The Required Action is modified by a Note which indicates that the unit must be placed in MODE 5 only if a RHR loop is OPERABLE.

With no RHR loop OPERABLE, the unit is in a condition with only limited cooldown capabilities. Therefore, the actions are to be concentrated on the restoration of a RHR loop, rather than a cooldown of extended duration.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.6-4 Unit 2 - Amendment No. 149

RCS Loops - MODE 4 B 3.4.6 BASES ACTIONS (continued)

SURVEILLANCE REQUIREMENTS B.1 and B.2 If both loops are inoperable or a required loop not in operation, except during conditions permitted by Note 1 in the LCO section, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RCS or RHR loop to OPERABLE status and operation must be initiated. The margin to criticality must not be reduced in this type of operation. Suspending the introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core; however, coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Times reflect the importance of maintaining operation for decay heat removal. The action to restore must be continued until one loop is restored to OPERABLE status and operation.

SR 3.4.6.1 This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that the required RCS or RHR loop is in operation. Verification may include flow rate, temperature, or pump status monitoring, which helps ensure that forced flow is providing heat removal. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS and RHR loop performance.

Prairie Island Units 1 and 2 B 3.4.6-5 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 4 B 3.4.6 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.6.2 SR 3.4.6.2 requires verification that the required SG has the capability to remove decay heat. The ability to remove decay heat requires the ability to pressurize and control pressure in the RCS, sufficient secondary side water level in the SG relied on for decay heat removal, and an available supply of feedwater (Ref. 2). The ability of the SG to provide an adequate heat sink for decay heat removal further ensures that the SG tubes remain covered. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of the other indications available in the control room to alert the operator to a loss of capability of the SG to remove decay heat.

SR 3.4.6.3 Verification that each required pump is OPERABLE ensures that an additional RCS or RHR pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation.

Verification is performed by verifying proper breaker alignment and power available to each required pump. Alternatively, verification that a pump is in operation also verifies proper breaker alignment and power availability. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

This SR is modified by a Note that states the SR is not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a pump is not in operation.

Prairie Island Units 1 and 2 B 3.4.6-6 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 4 B 3.4.6 BASES (continued)

REFERENCES

1. License Amendment Request Dated November 19, 1999.

(Approved by License Amendment 152/143, July 14, 2000.)

2.

NRC Information Notice 95-35, "Degraded Ability of Steam Generator to Remove Decay Heat by Natural Circulation."

Prairie Island Units 1 and 2 B 3.4.6-7 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 5, Loops Filled B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.7 RCS Loops - MODE 5, Loops Filled BASES BACKGROUND In MODE 5 with the RCS loops filled, the primary function of the reactor coolant is the removal of decay heat and transfer of this heat either to the steam generator (SG) secondary side coolant via natural circulation (Ref. 1) or the component cooling water via the residual heat removal (RHR) heat exchangers. While the principal means for decay heat removal is via the RHR System, the SGs via natural circulation are specified as a backup means for redundancy. Even though the SGs cannot produce steam in this MODE, they are capable of being a heat sink due to their large contained volume of secondary water. As long as the SG secondary side water is at a lower temperature than the reactor coolant, heat transfer will occur.

The rate of heat transfer is directly proportional to the temperature difference. The RCS must be intact to support natural circulation.

The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.

In MODE 5 with RCS loops filled, the reactor coolant is circulated by means of two RHR loops connected to the RCS, each loop containing an RHR heat exchanger, an RHR pump, and appropriate flow and temperature instrumentation for control and indication.

One RHR pump circulates the water through the RCS at a sufficient rate to prevent boric acid stratification.

The number of loops in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one RHR loop for decay heat removal and transport. The flow provided by one RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that a second path be available to provide redundancy for heat removal.

The LCO provides for redundant paths of decay heat removal capability. The first path can be an RHR loop that must be OPERABLE and in operation. The second path can be another Prairie Island Units 1 and 2 B 3.4.7-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES BACKGROUND OPERABLE RHR loop or maintaining a SG capable of removing (continued) decay heat to provide an alternate method for decay heat removal via natural circulation.

APPLICABLE In MODE 5, RCS circulation increases the time available for SAFETY mitigation of an accidental boron dilution event. The RHR ANALYSES loops provide this circulation.

RCS Loops - MODE 5 (Loops Filled) satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO The purpose of this LCO is to require that at least one RHR loop be OPERABLE and in operation with an additional RHR loop OPERABLE or a SG capable of removing decay heat via natural circulation. One RHR loop provides sufficient forced circulation to perform the safety functions of the reactor coolant under these conditions. An additional RHR loop is required to be OPERABLE to provide redundancy. However, if the standby RHR loop is not OPERABLE, an acceptable alternate method is a SG. Should the operating RHR loop fail, the SG could be used to remove decay heat via natural circulation.

Note 1 permits all RHR pumps to be de-energized -* 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. The purpose of the Note is to permit tests designed to validate various accident analyses values. One of the tests performed during the startup testing program was validation of rod drop times during cold conditions, both with and without flow. If changes are made to the RCS that would cause a change in flow characteristics of the RCS, the input values must be revalidated by conducting the test again. Any future no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits stopping the pumps in order to perform this test and validate the assumed analysis values. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months time period is adequate to perform the test, and operating Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.7-2 Unit 2 - Amendment No. 149

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES LCO experience has shown that boron stratification is not likely during (continued) this short period with no forced flow.

Utilization of Note 1 is permitted provided the following conditions are met, along with any other conditions imposed by startup test procedures:

a.

No operations are permitted that would dilute the RCS boron concentration with coolant with boron concentration less than required to meet SDM of LCO 3.1.1, therefore maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited to preclude the need for a boration, due to the time required to achieve a uniform distribution when in natural circulation (Ref. 2); and

b.

Core outlet temperature is maintained at least 10°F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

Note 2 allows one RHR loop to be inoperable for a period of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , provided that the other RHR loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when such testing is safe and possible.

Note 3 requires a steam or gas bubble in the pressurizer or that the secondary side water temperature of each SG be :< 50'F above each of the RCS cold leg temperatures before the start of a reactor coolant pump (RCP) with an RCS cold leg temperature _ the OPPS enable temperature specified in the PTLR. A steam or gas bubble ensures that the pressurizer will accommodate the swell resulting from an RCP start. Either of these restraints prevents a low temperature overpressure event due to a thermal transient when an RCP is started.

Prairie Island Unit 1 - Amendment No. 158 Units I and 2 B 3.4.7-3 Unit 2 - Amendment No. 149

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES LCO (continued)

APPLIC/,BIL1TY Note 4 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting removal of RHR loops from operation when at least one RCS loop is in operation. This Note provides for the transition to MODE 4 where an RCS loop is permitted to be in operation and replaces the RCS circulation function provided by the RHR loops.

RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. A SG is capable of removing decay heat via natural circulation when: 1) there is the ability to pressurize and control pressure in the RCS; 2) there is sufficient secondary side water level in the SG relied on for decay heat removal; and 3) there is an available supply of feedwater (Ref.

1). An OPERABLE SG can perform as a heat sink via natural circulation when it has the capability to remove decay heat as specified in SR 3.4.7.2.

In MODE 5 with RCS loops filled, this LCO requires forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. One loop of RHR provides sufficient circulation for these purposes. However, one additional RHR loop is required to be OPERABLE, or a SG is capable of removing decay heat.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops-MODES 1 and 2";

LCO 3.4.5, "RCS Loops-MODE 3";

LCO 3.4.6, "RCS Loops-MODE 4";

LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled";

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).

Prairie Island Units 1 and 2 B 3.4.7-4 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES (continued)

ACTIONS A. 1, A.2, B. I and B.2 If one RHR loop is OPERABLE and the SGs are not capable of removing decay heat, redundancy, for heat removal is lost. Action must be initiated immediately to restore a second RHR loop to OPERABLE status or to restore the required SG capability to remove decay heat. Either Required Action will restore redundant heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

C. 1 and C.2 If a required RHR loop is not in operation, except during conditions permitted by Note 1, or if no loop is OPERABLE, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RHR loop to OPERABLE status and operation must be initiated. Suspending the introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core; however, coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Times reflect the importance of maintaining operation for heat removal.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.7-5 Unit 2 - Amendment No. 149

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES (continued)

SURVEILLANCE REQUIREMENTS SR 3.4.7.1 This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that the required loop is in operation. Verification may include flow rate, temperature, or pump status monitoring, which helps ensure that forced flow is providing heat removal. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient considering other indications and alarms available to the operator in the control room to monitor RHR loop performance.

SR 3.4.7.2 SR 3.4.7.2 requires verification that the required SG has the capability to remove decay heat via natural circulation. This provides an alternate decay heat removal method in the event that the second RHR loop is not OPERABLE. The ability to remove decay heat requires the ability to pressurize and control pressure in the RCS, sufficient secondary side water level in the SG relied on for decay heat removal, and an available supply of feedwater (Ref. 1).

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of other indications available in the control room to alert the operator to a loss of capability of the SG to remove decay heat.

SR 3.4.7.3 Verification that each required RHR pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation.

Verification is performed by verifying proper breaker alignment and power available to each required RHR pump. Alternatively, verification that a pump is in operation also verifies proper breaker alignment and power availability. If at least one SG is capable of decay heat removal, this Surveillance is not needed. The Frequency Prairie Island Units 1 and 2 B 3.4.7-6 Unit 1 -Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 5, Loops Filled B 3.4.7 BASES SURVEILLANCE REQUIREMENTS SR 3.4.7.3 (continued) of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

This SR is modified by a Note that states the SR is not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a pump is not in operation.

REFERENCES

1. NRC Information Notice 95-35, "Degraded Ability of Steam Generators to Remove Decay Heat by Natural Circulation".

2.

License Amendment Request Dated November 19, 1999.

(Approved by License Amendment 152/143, July 14, 2000.)

Prairie Island Units 1 and 2 B 3.4.7-7 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.8 RCS Loops - MODE 5, Loops Not Filled BASES BACKGROUND In MODE 5 with the RCS loops not filled, the primary function of the reactor coolant is the removal of decay heat and the transfer of this heat to the component cooling water via the residual heat removal (RHR) heat exchangers. The steam generators (SGs) are not available as a heat sink when the loops are not filled. The secondary function of the reactor coolant is to act as a carrier for the soluble neutron poison, boric acid.

In MODE 5 with loops not filled, only RHR pumps can be used for coolant circulation. The number of pumps in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one RHR pump for decay heat removal and transport and to require that two paths be available to provide redundancy for heat removal. The flow provided by one RHR loop is adequate for heat removal and for boron mixing.

APPLICABLE In MODE 5, RCS circulation increases the time available for SAFETY mitigation of an accidental boron dilution event. The RHR loops ANALYSES provide this circulation.

RCS Loops - MODE 5 (Loops Not Filled) satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO The purpose of this LCO is to require that at least two RHR loops be OPERABLE and one of these loops be in operation to transfer heat from the reactor coolant at a controlled rate. Heat cannot be removed via the RHR System unless forced flow is used. A minimum of one operating RHR pump meets the LCO requirement for one loop in operation. An additional RHR loop is required to be OPERABLE to provide redundancy.

Prairie Island Units 1 and 2 B 3.4.8-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES LCO (continued)

Note 1 permits all RHR pumps to be de-energized -< 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. The circumstances for stopping both RHR pumps are to be limited to situations when the outage time is short and core outlet temperature is maintained > 10°F below saturation temperature. The Note prohibits boron dilution with coolant at boron concentrations less than required to assure SDM is maintained or draining operations when RHR forced flow is stopped.

Note 2 allows one RHR loop to be inoperable for a period of

< 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , provided that the other loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when these tests are safe and possible.

An OPERABLE RHR loop is comprised of an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger. RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required.

APPLICABILITY In MODE 5 with loops not filled, this LCO requires core heat removal and coolant circulation by the RHR System.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops-MODES 1 and 2";

LCO 3.4.5, "RCS Loops-MODE 3";

LCO 3.4.6, "~RCS Loops-MODE 4";

LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled";

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).

Prairie Island Units 1 and 2 B 3.4.8-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES (continued)

ACTIONS A. 1 If one required RHR loop is inoperable, redundancy for RHR is lost.

Action must be initiated to restore a second loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

B. l and B.2 If no required loop is OPERABLE or the required loop is not in operation, except during conditions permitted by Note 1, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action must be initiated immediately to restore an RHR loop to OPERABLE status and operation. The margin to criticality must not be reduced in this type of operation.

Suspending the introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core; however, coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Time reflects the importance of maintaining operation for heat removal.

The action to restore must continue until one loop is restored to OPERABLE status and operation.

The Note in Required Action B.2 allows the use of one safety injection pump to provide heat removal in the event of a loss of RHR system cooling during reduced RCS inventory conditions.

Prairie Island Unit I - Amendment No. 158 Units 1 and 2 B 3.4.8-3 Unit 2 - Amendment No. 149

RCS Loops - MODE 5, Loops Not Filled B 3.4.8 BASES (continued)

SURVEILLANCE REQUIREMENTS REFERENCES SR 3.4.8.1 This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that the required loop is in operation. Verification may include flow rate, temperature, or pump status monitoring, which helps ensure that forced flow is providing heat removal. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient considering other indications and alarms available to the operator in the control room to monitor RHR loop performance.

SR 3.4.8.2 Verification that each required pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to each required pump. Alternatively, verification that a pump is in operation also verifies proper breaker alignment and power availability. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

This SR is modified by a Note that states the SR is not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a pump is not in operation.

None.

Prairie Island Units 1 and 2 B 3.4.8-4 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.9 Pressurizer BASES BACKGROUND The pressurizer provides a point in the RCS where liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primary system pressure during steady state operation, and limiting the pressure changes caused by reactor coolant thermal expansion and contraction during normal load transients.

The pressure control components addressed by this LCO include the pressurizer water level, the required heaters, and their emergency power supplies. Pressurizer safety valves and pressurizer power operated relief valves are addressed by LCO 3.4.10, "Pressurizer Safety Valves," and LCO 3.4.11, "Pressurizer Power Operated Relief Valves (PORVs)," respectively.

The intent of the LCO is to ensure that a steam bubble exists in the pressurizer prior to power operation to minimize the consequences of potential overpressure transients. The presence of a steam bubble is consistent with a.-alytical assumptions. Relatively small amounts of noncondensible gases are typically present in the RCS and can inhibit the condensation heat transfer between the pressurizer spray and the steam, and diminish the spray effectiveness for pressure control. These small amounts of noncondensible gases can be ignored if the steam bubble is present.

Electrical immersion heaters, located in the lower section of the pressurizer vessel, keep the water in the pressurizer at saturation temperature and maintain a constant operating pressure. A minimum required available capacity of pressurizer heaters ensures that the RCS pressure can be maintained. The capability to maintain and control system pressure is important for maintaining subcooled conditions in the RCS and ensuring the capability to remove core decay heat by either forced or natural circulation of reactor coolant.

Prairie Island Units 1 and 2 B 3.4.9-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer B 3.4.9 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES Unless adequate heater capacity is available, the hot, high pressure condition cannot be maintained indefinitely and still provide the required subcooling margin in the primary system. Inability to control the system pressure and maintain subcooling under conditions of natural circulation flow in the primary system could lead to a loss of single phase natural circulation and decreased capability to remove core decay heat. One group of pressurizer heaters is adequate to maintain natural circulation conditions during a loss of offsite power. Two groups are required to be available to ensure redundant capability.

In MODES 1, 2, and 3, the LCO requirement for a steam bubble is reflected implicitly in the accident analyses. Safety analyses performed for lower MODES are not limiting with respect to pressurizer parameters. All analyses performed from a critical reactor condition assume the existence of a steam bubble and saturated conditions in the pressurizer. In making this assumption,the analyses neglect the small fraction of noncondensible gases normally present.

Safety analyses presented in the USAR (Ref. 1) do not take credit for pressurizer heater operation; however, an implicit initial condition assumption of the safety analyses is that the RCS is operating at normal pressure.

The maximum pressurizer water level limit, which ensures that a steam bubble exists in the pressurizer, satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Although the heaters are not specifically used in accident analysis, the need to maintain subcooling in the long term during loss of offsite power, as indicated in NUREG-0737, is the reason for providing an LCO.

Prairie Island Units 1 and 2 B 3.4.9-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer B 3.4.9 BASES LCO (continued)

APPLICABILITY The LCO requirement for the pressurizer to be OPERABLE with

!< 90% level ensures that a steam bubble exists. Limiting the LCO maximum operating water level preserves the steam space for pressure control. The level limit is specified to agree with the high pressurizer level trip allowable value. The LCO has been established to ensure the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure transients. Requiring the presence of a steam bubble is also consistent with analytical assumptions.

The LCO requires two groups of OPERABLE pressurizer heaters, each with a capacity > 100 kW, capable of being powered from an emergency power supply. These are Groups A and B. One group of pressurizer heaters with a capacity Ž_ 100 kW is adequate to maintain natural circulation conditions during a loss of offsite power (Ref. 2).

Two groups are required to be OPERABLE to ensure redundant capability.

The need for pressure control is most pertinent when core heat can cause the greatest effect on RCS temperature, resulting in the greatest effect on pressurizer level and RCS pressure control. Thus, applicability has been designated for MODES I and 2. The applicability is also provided for MODE 3. The purpose is to prevent solid water RCS operation during heatup and cooldown to avoid rapid pressure rises caused by normal operational perturbation, such as reactor coolant pump startup.

In MODES 1, 2, and 3, there is need to maintain the availability of pressurizer heaters, capable of being powered from an emergency power supply. In the event of a loss of offsite power, the initial conditions of these MODES give the greatest demand for maintaining the RCS in a hot pressurized condition with loop subcooling for an extended period. For MODE 4, 5, or 6, it is not necessary to control pressure (by heaters) to ensure loop subcooling Prairie Island Units 1 and 2 B 3.4.9-3 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer B 3.4.9 BASES APPLICABILITY for heat transfer when the Residual Heat Removal (RHR)

(continued)

System is in service, and therefore, the LCO is not applicable.

ACTIONS A. 1, A.2, A.3, and A.4 Pressurizer water level control malfunctions or other plant evolutions may result in a pressurizer water level above the nominal upper limit, even with the plant at steady state conditions. Normally the plant will trip in this event since the upper limit of this LCO is the same as the Allowable Value for Pressurizer High Water Level Reactor Trip.

If the pressurizer water level is not within the limit, action must be taken to bring the unit to a MODE in which the LCO does not apply.

To achieve this status, within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months the unit must be brought to MODE 3, with all rods fully inserted and incapable of withdrawal.

Additionally, the unit must be brought to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

This takes the unit out of the applicable MODES.

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

B.l If one group of pressurizer heaters is inoperable, restoration is required within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is reasonable considering the anticipation that a demand caused by loss of offsite power would be unlikely in this period. Pressure control may be maintained during this time using normal station powered heaters.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.9-4 Unit 2 - Amendment No. 149

Pressurizer B 3.4.9 BASES ACTIONS (continued)

SURVEILLANCE REQUIREMENTS C.1 and C.2 If one group of pressurizer heaters is inoperable and cannot be restored in the allowed Completion Time of Required Action B. 1, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SR 3.4.9.1 This SR requires that during steady state operation, pressurizer level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The Surveillance is performed by observing the indicated level. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months has been shown by operating practice to be sufficient to regularly assess level for any deviation. Alarms are also available for early detection of abnormal level indications.

SR 3.4.9.2 The SR is satisfied when the power supplies are demonstrated to be capable of producing the minimum power and the associated pressurizer heaters are verified to be at their design rating. This may be done by testing the power supply output and by performing an electrical check on heater element continuity and resistance. The Frequency of 24 months is considered adequate to detect heater degradation and has been shown by operating experience to be acceptable.

Prairie Island Units 1 and 2 B 3.4.9-5 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer B 3.4.9 BASES SURVEILLANCE REQUIRMENTS REFERENCES SR 3.4.9.3 (continued)

This SR is not applicable for the Group A heaters since this group is permanently powered by a Class lE power supply.

This Surveillance demonstrates that the Group B heaters can be manually transferred from the normal to the emergency power supply and energized. The Frequency of 24 months is based on a typical fuel cycle and is consistent with similar verifications of emergency power supplies.

1. USAR, Section 14.

2.

USAR, Section 4.

Prairie Island Units 1 and 2 B 3.4.9-6 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer Safety Valves B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.10 Pressurizer Safety Valves BASES BACKGROUND The pressurizer safety valves provide, in conjunction with the Reactor Protection System, overpressure protection for the RCS.

The pressurizer safety valves are totally enclosed pop type, spring loaded, self actuated valves with backpressure compensation. The safety valves are designed to prevent the system pressure from exceeding the system Safety Limit (SL), 2735 psig, which is 110%

of the design pressure.

Because the safety valves are totally enclosed and self actuating, they are considered independent components. The required relief capacity for each valve, 325,000 lb/hr, is based on postulated overpressure transient conditions resulting from a complete loss of steam flow to the turbine. This event results in the maximum surge rate into the pressurizer, which specifies the minimum relief capacity for the safety valves. The discharge flow from the pressurizer safety valves is directed to the pressurizer relief tank. This discharge flow is indicated by an increase in temperature downstream of the pressurizer safety valves or increase in the pressurizer relief tank temperature or level.

Overpressure protection is required in MODES 1, 2, 3, 4, and 5; however, in MODE 4, with one or more RCS cold leg temperatures

< the OPPS enable temperature specified in the PTLR, and MODE 5 and MODE 6 with the reactor vessel head on, overpressure protection is provided by operating procedures and by meeting the requirements of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) > Safety Injection (SI) Pump Disable Temperature", and LCO 3.4.13, "Low Temperature Overpressure Protection (LTOP) *< Safety Injection (SI) Pump Disable Temperature."

Prairie Island Units 1 and 2 B 3.4.10-1 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer Safety Valves B 3.4.10 BASES BACKGROUND (continued)

The as left upper and lower pressure limits are based on the +/- 1%

tolerance requirement (Ref. 1) for lifting pressures above 1000 psig.

The lift setting is for the ambient conditions associated with MODES 1, 2, and 3. This requires either that the valves be set hot or that a correlation between hot and cold settings be established.

The pressurizer safety valves are part of the primary success path and mitigate the effects of postulated accidents. OPERABILITY of the safety valves ensures that the RCS pressure will be limited to 110% of design pressure. The consequences of exceeding the American Society of Mechanical Engineers (ASME) pressure limit (Ref. 1) could include damage to RCS components, increased leakage, or a requirement to perform additional stress analyses prior to resumption of reactor operation.

APPLICABLE SAFETY ANALYSES All accident and safety analyses in the USAR (Ref. 2) that require safety valve actuation assume operation of both pressurizer safety valves to limit increases in RCS pressure. The overpressure protection analysis (Ref. 3) is also based on operation of both safety valves. Transients that could result in overpressurization if not properly terminated include:

a.

Uncontrolled rod withdrawal from power;

b.

Loss of reactor coolant flow;

c.

Loss of external electrical load;

d.

Loss of normal feedwater;

e.

Loss of all AC power to station auxiliaries; and

f.

Locked rotor.

Prairie Island Units 1 and 2 B 3.4.10-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer Safety Valves B 3.4.10 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO APPLICABILITY Detailed analyses of the above transients are contained in Reference 2. Compliance with this LCO is consistent with the design bases and accident analyses assumptions.

Pressurizer safety valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The two pressurizer safety valves are set to open at the RCS design pressure (2485 psig), within a +/- 3% tolerance, to avoid exceeding the maximum design pressure SL, to maintain accident analyses assumptions, and to comply with ASME requirements. The upper and lower pressure tolerance limits following testing are based on the +/- 1% tolerance requirements (Ref. 1) for lifting pressures above 1000 psig.

The limit protected by this Specification is the reactor coolant pressure boundary (RCPB) SL of 110% of design pressure.

Inoperability of one or more valves could result in exceeding the SL if a transient were to occur. The consequences of exceeding the ASME pressure limit could include damage to one or more RCS components, increased leakage, or additional stress analyses being required prior to re.-umption of reactor operation.

In MODES 1, 2, and 3, and portions of MODE 4 above the OPPS enable temperature, OPERABILITY of both valves is required because the combined capacity is required to keep reactor coolant pressure below 110% of its design value during certain accidents.

MODE 3 and portions of MODE 4 are conservatively included, although the listed accidents may not require the safety valves for protection.

The LCO is not applicable in MODE 4 when any RCS cold leg temperatures are _* the OPPS enable temperature specified in the Prairie Island Units 1 and 2 B 3.4.10-3 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer Safety Valves B 3.4.10 BASES APPLICABILITY PTLR or in MODE 5 because LTOP is provided. Overpressure (continued) protection is not required in MODE 6 with reactor vessel head detensioned.

The note allows entry into MODES 3 and 4 with the lift settings outside the LCO limits. This permits testing and examination of the safety valves at high pressure and temperature near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design condition. Only one valve at a time will be removed from service for testing. The 36 hour4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months exception is based on 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months outage time for each of the two valves. The 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months period is derived from operating experience that hot testing can be performed in this timeframe.

ACTIONS A. 1 With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining RCS overpressure protection.

An inoperable safety valve coincident with an RCS overpressure event could challenge the integrity of the pressure boundary.

B. I and B.2 If the Required Action of A. 1 cannot be met within the required Completion Time or if both pressurizer safety valves are inoperable, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 with any RCS cold leg temperatures :5 the OPPS enable temperature specified in the PTLR within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner Prairie Island Unit 1 -Amendment No. 158 Units 1 and 2 B 3.4.10-4 Unit 2 - Amendment No. 149

Pressurizer Safety Valves B 3.4.10 BASES ACTIONS SURVEILLANCE REQUIREMENTS REFERENCES B. 1 and B.2 (continued) and without challenging plant systems. With any RCS cold leg temperatures at or below the OPPS enable temperature specified in the PTLR, overpressure protection is provided by the LTOP function. The change from MODE 1, 2, or 3 to MODE 4 reduces the RCS energy (core power and pressure), lowers the potential for large pressurizer insurges, and thereby removes the need for overpressure protection by both pressurizer safety valves.

SR 3.4.10.1 SRs are specified in the Inservice Testing Program. Pressurizer safety valves are to be tested in accordance with the requirements of Section XI of the ASME Code, which provides the activities and Frequencies necessary to satisfy the SRs. No additional requirements are specified.

The pressurizer safety valve setpoint is +/- 3% for OPERABILITY; however, the valves are reset to +/- 1% during the Surveillance to allow for drift.

1.

ASME, Boiler and Pressure Vessel Code,Section III, with the 1968 Winter Addendum.

2.

USAR, Section 14.

3.

WCAP-7769, Rev. 1, June 1972.

Prairie Island Units 1 and 2 B 3.4.10-5 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer PORVs B 3.4.11 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)

BASES BACKGROUND The pressurizer is equipped with two types of devices for pressure relief: pressurizer safety valves and PORVs. The PORVs are air operated valves that are controlled to open at a specific set pressure when the pressurizer pressure increases and close when the pressurizer pressure decreases. The PORVs may also be manually operated from the control room.

Block valves, which are normally open, are located between the pressurizer and the PORVs. The block valves are used to isolate the PORVs in case of excessive leakage or a stuck open PORV. Block valve closure is accomplished manually using controls in the control room. A stuck open PORV is, in effect, a small break loss of coolant accident (LOCA). As such, block valve closure terminates the RCS depressurization and coolant inventory loss.

The PORVs and their associated block valves may be used by plant operators to depressurize the RCS to recover from certain transients if normal pressurizer spray is not available. Additionally, the series arrangement of the PORVs and their block valves permits performance of surveillances on the valves during power operation.

The PORVs may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total loss of feedwater.

The PORVs, their block valves, and their controls are powered from the vital buses that normally receive power from offsite power sources, but are also capable of being powered from emergency power sources in the event of a loss of offsite power. The PORVs and their associated block valves are powered from two separate safety trains.

Prairie Island Unit 1 - Amendment No. 158 Units I and 2 B 3.4.11-1 Unit 2 - Amendment No. 149

Pressurizer PORVs B 3.4.11 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES The two PORVs each have a relief capacity of 179,000 lb/hr at 2335 psig. The functional design of the PORVs is based on maintaining pressure below the Pressurizer High Pressure Reactor Trip setpoint following a step reduction of 47.5% of full load with steam dump. In addition, the PORVs minimize challenges to the pressurizer safety valves and also may be used for low temperature overpressure protection (LTOP). See LCO 3.4.12 and LCO 3.4.13 for LTOP requirements.

Plant operators employ the PORVs to depressurize the RCS in response to certain plant transients if normal pressurizer spray is not available. For the Steam Generator Tube Rupture (SGTR) event, the safety analysis assumes that manual operator actions are required to mitigate the event. A loss of offsite power is assumed to accompany the event, and thus, normal pressurizer spray is unavailable to reduce RCS pressure. The PORVs are assumed to be used for RCS depressurization, which is one of the steps performed to equalize the primary and secondary pressures in order to terminate the primary to secondary break flow and the radioactive releases from the affected steam generator.

The PORVs are also modeled in safety analyses for events that result in increasing RCS pressure for which departure from nucleate boiling ratio (DNBR) criteria are critical (Ref. 1). By assuming PORV actuation, the primary pressure remains below the high pressurizer pressure trip setpoint; thus, the DNBR calculation is more conservative. As such, this actuation is not required to mitigate these events, and PORV automatic operation is, therefore, not an assumed safety function.

Pressurizer PORVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

Prairie Island Units 1 and 2 B 3.4.11-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer PORVs B 3.4.11 BASES (continued)

LCO The LCO requires the PORVs and their associated block valves to be OPERABLE for manual operation to mitigate the effects associated with an SGTR.

By maintaining two PORVs and their associated block valves OPERABLE, the single failure criterion is satisfied. An OPERABLE block valve may be either open and energized with the capability of being closed, or closed and energized with the capability to be opened, since the required safety function is accomplished by manual operation. Although typically open to allow PORV operation, the block valves may be OPERABLE when closed to isolate the flow path of an inoperable PORV that is capable of being manually cycled (e.g., as in the case of excessive PORV leakage). Similarly, isolation of an OPERABLE PORV does not render that PORV or block valve inoperable provided the relief function remains available with manual action.

An OPERABLE PORV is required to be capable of manually opening and closing and not experiencing excessive seat leakage.

Excessive seat leakage, although not associated with a specific acceptance criteria, exists when conditions dictate closure of the block valve to limit leakage.

Satisfying the LCO helps minimize challenges to fission product barriers.

APPLICABILITY In MODES 1, 2, and 3, the PORVs are required to be OPERABLE for manual actuation to mitigate a SGTR. The PORV and its block valve are also required to be OPERABLE in MODES 1, 2, and 3 to maintain the integrity of the reactor coolant pressure boundary. This requires the ability to manually control the block valve to isolate a PORV with excessive seat leakage or a stuck-open PORV.

Pressure increases are less prominent in MODE 3 because the core input energy is reduced, but the RCS pressure is high. Therefore, the LCO is applicable in MODES 1, 2, and 3 when RCS pressure is high and there is potential for a SGTR. The LCO is not applicable in Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.11-3 Unit 2 - Amendment No. 149

Pressurizer PORVs B 3.4.11 BASES APPLICABILITY (continued)

ACTIONS MODES 4 and 5, and MODE 6 with the reactor vessel head in place, when both pressure and core energy are decreased and a SGTR can not occur. LCO 3.4.12 and LCO 3.4.13 address the PORV requirements in these MODES.

Note 1 has been added to clarify that each pressurizer PORV and each block valve are treated as separate entities, each with separate Completion Times (i.e., the Completion Time is on a component basis) for Conditions A, B and C. The exception for LCO 3.0.4, Note 2, permits entry into MODES 1, 2, and 3 to perform cycling of the PORVs or block valves to verify their OPERABLE status, in the event that testing was not satisfactorily performed in lower MODES.

A.1 PORVs may be inoperable and capable of being manually cycled (e.g., excessive seat leakage). In this condition, either the PORVs must be restored or the flow path isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The associated block valve is required to be closed, but power must be maintained to the associated block valve, since removal of power would render the block valve inoperable. This permits operation of the plant until the next refueling outage (MODE 6) so that maintenance can be performed on the PORVs to eliminate the problem condition.

Quick access to the PORV for pressure control can be made when power remains on the closed block valve. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on plant operating experience that has shown that minor problems can be corrected or closure accomplished in this time period.

B.1, B.2 and B.3 If one PORV is inoperable for reasons other than Condition A, and not capable of being manually cycled, it must be either restored, or Prairie Island Units 1 and 2 B 3.4.11-4 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

Pressurizer PORVs B 3.4.11 BASES ACTIONS B.1, B.2 and B.3 (continued) isolated by closing the associated block valve and removing the power to the associated block valve. The Completion Times of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months are reasonable, based on the small potential for challenges to the PORVs during this time period, and provide the operator adequate time to correct the situation. If the inoperable valve cannot be restored to OPERABLE status, it must be isolated within the specified time. Because there is at least one PORV that remains OPERABLE, an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is provided to restore the inoperable PORV to OPERABLE status. If the PORV cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition D.

C.1 and C.2 If one block valve is inoperable, then it is necessary to either restore the block valve to OPERABLE status within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or place the associated PORV in manual control. The prime importance for the capability to close the block valve is to isolate a stuck open PORV. Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the Required Action is to place the PORV in manual control to preclude its automatic opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve is inoperable. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation. Because at least one PORV remains OPERABLE, the operator is permitted a Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore the inoperable block valve to OPERABLE status. The time allowed to restore the block valve is based upon the Completion Time for restoring an inoperable PORV in Condition B, since the PORVs may not be capable of mitigating an event if the inoperable block valve is not full open. If the block valve is restored within the Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the PORV may be restored to automatic operation. If it cannot be Prairie Island Unit I - Amendment No. 158 Units 1 and 2 B 3.4.11-5 Unit 2 - Amendment No. 149

Pressurizer PORVs B 3.4.11 BASES ACTIONS C. 1 and C.2 (continued) restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition D.

The Required Actions C. 1 and C.2 are modified by a Note stating that the Required Actions do not apply if the sole reason for the block valve being declared inoperable is as a result of power being removed to comply with other Required Actions. In this event, the Required Actions for inoperable PORV(s) (which require the block valve power to be removed once it is closed) are adequate to address the condition. While it may be desirable to also place the PORV(s) in manual control, this may not be possible for all causes of Condition B or E entry with PORV(s) inoperable and not capable of being manually cycled (e.g., as a result of failed control power fuse(s) or control switch malfunction(s)).

D. I and D.2 If the Required Action of Condition A, B, or C is not met, then the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, automatic PORV OPERABILITY may be required. See LCO 3.4.12 and LCO 3.4.13.

Prairie Island Unit 1 - Amendment No. 158 Units I and 2 B 3.4.11-6 Unit 2 - Amendment No. 149

Pressurizer PORVs B 3.4.11 BASES ACTIONS E.1, E.2, E.3 and E.4 (continued)

If both PORVs are inoperable for reasons other than Condition A and not capable of being manually cycled, it is necessary to either restore at least one valve within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or isolate the flow path by closing and removing the power to the associated block valves. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the small potential for challenges to the system during this time and provides the operator time to correct the situation. If no PORVs are restored within the Completion Time, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, automatic PORV OPERABILITY may be required. See LCO 3.4.12 and LCO 3.4.13.

F. 1 If both block valves are inoperable, it is necessary to restore at least one block valve within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The Completion Time is reasonable, based on the small potential for challenges to the system during this time and provides the operator time to correct the situation.

The Required Action F. 1 is modified by a Note stating that the Required Action does not apply if the sole reason for the block valve being declared inoperable is as a result of power being removed to comply with other Required Actions. In this event, the Required Actions for inoperable PORV(s) (which require the block valve power to be removed once it is closed) are adequate to address the condition. While it may be desirable to also place the PORV(s) in manual control, this may not be possible for all causes of Condition B or E entry with PORV(s) inoperable and not capable of being manually cycled (e.g., as a result of failed control power fuse(s) or control switch malfunction(s)).

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.11-7 Unit 2 - Amendment No. 149

Pressurizer PORVs B 3.4.11 BASES ACTIONS G.1 and G.2 (continued)

If the Required Actions of Condition F are not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, automatic PORV OPERABILITY may be required. See LCO 3.4.12 Pnd LCO 3.4.13.

SURVEILLANCE SR 3.4.11.1 REQUIREMENTS Block valve cycling verifies that the valve(s) can be opened and closed if needed. The basis for the Frequency of 92 days is the ASME Code,Section XI.

This SR is modified by two Notes. Note 1 modifies this SR by stating that it is not required to be performed with the block valve closed in accordance with the Required Action of Condition B or E.

Opening the block valve in this condition increases the risk of an unisolable leak from the RCS since the PORV is already inoperable.

Note 2 modifies this SR to allow entry into and operation in MODE 3 prior to performing the SR. This allows the test to be performed in MODE 3 under operating temperature and pressure conditions, prior to entering MODE 1 or 2.

SR 3.4.11.2 SR 3.4.11.2 requires a complete cycle of each PORV. Operating a PORV through one complete cycle ensures that the PORV can be Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.11-8 Unit 2 - Amendment No. 149

Pressurizer PORVs B 3.4.11 BASES SURVEILLANCE REQUIREMENiS REFERENCES SR 3.4.11.2 (continued) manually actuated for mitigation of an SGTR. The Frequency of 24 months is based on a typical refueling cycle and industry accepted practice.

The Note modifies this SR to allow entry into and operation in MODE 3 prior to performing the SR. This allows the test to be performed in MODE 3 under operating temperature and pressure conditions prior to entering MODE 1 or 2.

1.

USAR, Section 14.

Prairie Island Units 1 and 2 B 3.4.11-9 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT > SI Pump Disable Temperature B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12 Low Temperature Overpressure Protection (LTOP) - Reactor Coolant System Cold Leg Temperature (RCSCLT) > Safety Injection (SI) Pump Disable Temperature BASES BACKGROUND The LTOP function limits RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10 CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting RCPB component for demonstrating such protection. The Over Pressure Protection System (OPPS) and the pressurizer power operated relief valves (PORVs) provide the LTOP function (Ref. 2).

The PTLR provides the maximum allowable OPPS actuation setpoints for the PORVs and the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES. The LTOP MODES are the MODES as defined in the Applicability statement of LCO 3.4.12 and LCO 3.4.13.

The pressurizer safety valves and PORVs at their normal setpoints do not provide overpressure protection for certain low temperature operational transients. Inadvertent pressurization of the RCS at temperatures below the OPPS enable temperature specified in the PTLR could result in exceeding the ASME Appendix G (Ref. 3) brittle fracture P/T limits. Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel.

LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the PTLR limits.

This LCO provides RCS overpressure protection by restricting coolant input capability and ensuring adequate pressure relief capacity. In MODE 4, when any RCS cold leg temperature is < the OPPS enable temperature specified in the PTLR, and above the safety injection (SI) pump disable temperature, limiting coolant input capability requires one (SI) pump incapable of injection into the RCS and isolating the emergency core cooling system (ECCS)

Prairie Island Units 1 and 2 B 3.4.12-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT > SI Pump Disable Temperature B 3.4.12 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES accumulators. In MODE 4, when any RCS cold leg temperature is

< the OPPS enable temperature specified in the PTLR, and above SI pump disable temperature, one PORV is the overpressure protection device that acts to terminate an increasing pressure event.

Limiting coolant input capability reduces the ability to provide core coolant addition. The LCO does not require the makeup control system deactivated or the SI actuation circuits blocked. Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the charging system can provide adequate flow. If conditions require the use of more than one SI pump for makeup in the event of loss of inventory, then pumps can be made available through manual actions.

In MODE 4, above the SI pump disable temperature, pressure relief consists of two PORVs with reduced lift settings provided by OPPS.

Two PORVs are required for redundancy. One PORV has adequate relieving capability to prevent overpressurization for the required coolant input capability.

As designed for the LTOP function, each PORV is signaled to open by OPPS if the RCS pressure approaches the lift setpoint provided when OPPS is enabled. The OPPS monitors both RCS temperature and RCS pressure and indicates when a condition not acceptable in the PTLR limits is approached. The wide range RCS temperature setpoints indicate conditions requiring enabling OPPS.

The PTLR presents the OPPS setpoints for LTOP.

Safety analyses (Ref. 2) demonstrate that the reactor vessel is adequately protected against exceeding the Reference 1 P/T limits.

In MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature exceeding the OPPS enable temperature specified in the PTLR, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At about the OPPS enable Prairie Island Units 1 and 2 B 3.4.12-2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT > SI Pump Disable Temperature B 3.4.12 BASES APPLICABLE temperature specified in the PTLR and below, overpressure SAFETY prevention falls to two OPERABLE PORVs or to a depressurized ANALYSES RCS and a sufficiently sized RCS vent. Each of these means has a (continued) limited overpressure relief capability. LCO 3.4.13, "LTOP _* SI Pump Disable Temperature," provides the requirements for overpressure prevention at the lower temperatures.

The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the PTLR curves are revised, LTOP must be re-evaluated to ensure its functional requirements can still be met using the PORV method.

The PTLR contains the acceptance limits that define the LTOP requirements. Any change to the RCS must be evaluated against the Reference 2 analyses to determine the impact of the change on the LTOP acceptance limits.

Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients. The bounding mass input transient is inadvertent safety injection with injection from one SI pump and three charging pumps, and letdown isolated.

The bounding heat input transient is reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.

The following limitations are required during the Applicability of this Specification to ensure that mass and heat input transients in excess of analysis assumptions do not occur:

a.

Rendering one SI pump incapable of injection;

b.

Deactivating the ECCS accumulator discharge isolation valves in their closed positions; and Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.12-3 Unit 2-Amendment No. 149

LTOP - RCSCLT > SI Pump Disable Temperature B 3.4.12 BASES APPLICABLE

c.

Disallowing start of an RCP if secondary temperature is SAFETY above primary temperature in any one loop. LCO 3.4.6, ANALYSES "RCS Loops -MODE 4," provides this protection.

(continued)

The Reference 2 analyses demonstrate that one PORV can maintain RCS pressure below limits when only one SI pump and all charging pumps are actuated. Thus, the LCO allows only one SI pump OPERABLE during the Applicability of this Specification.

Since one PORV cannot handle the pressure transient resulting from ECCS accumulator injection, when RCS temperature is low, the LCO also requires ECCS accumulator isolation when ECCS accumulator pressure is greater than or equal to the maximum RCS pressure for the existing RCS cold leg temperature allowed in the PTLR.

The isolated ECCS accumulators must have their discharge valves closed and the valve power supply breakers fixed in their open positions.

Fracture mechanics analyses established the temperature of LTOP Applicability at the OPPS enable temperature specified in the PTLR.

The consequences of a small break loss of coolant accident (LOCA) in LTOP MODE 4, when any RCS cold leg temperature is < the OPPS enable temperature specified in the PTLR, and above the SI Pump disable temperature conform to 10 CFR 50.46 and 10 CFR 50, Appendix K, requirements by having a maximum of one SI pump OPERABLE and SI actuation enabled.

The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the limit shown in the PTLR. The OPPS setpoints are derived by analyses that model the performance of the system, assuming the limiting LTOP transient of one SI pump and all charging pumps injecting into the RCS. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.12-4 Unit 2-Amendment No. 149

LTOP - RCSCLT > SI Pump Disable Temperature B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO valve stroke times. The OPPS setpoints at or below the derived limit ensures the Reference 1 P/T limits will be met.

The OPPS setpoints in the PTLR will be updated when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," discuss these examinations.

The LTOP function satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

This LCO requires that LTOP be provided, by limiting coolant input capability and by OPERABLE pressure relief capability. Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient.

To limit the coolart input capability, the LCO requires that a maximum of one SI pump be capable of injecting into the RCS, and all ECCS accumulator discharge isolation valves be closed and de energized (when ECCS accumulator pressure is greater than or equal to the maximum RCS pressure for the existing RCS cold leg temperature allowed in the PTLR).

The LCO is modified by two Notes. Note 1 allows operation of both SI pumps for _* 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for conducting SI system testing providing there is a steam or gas bubble in the pressurizer and at least one isolation valve between the SI pump and the RCS is shut. The purpose of this Note is to permit the conduct of the integrated SI test and other SI system tests and operations that may be performed in MODE 4. In this case, pressurizer level is maintained at less than 50% and a positive means of isolation is provided between the SI pumps and the RCS to prevent fluid injection to the RCS. This Prairie Island Units 1 and 2 B 3.4.12-5 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT > SI Pump Disable Temperature B 3.4.12 BASES LCO (continued) isolation is accomplished by either a closed manual valve or motor operated valve with the power removed. This combination of conditions under strict administrative control assure that overpressurization cannot occur. Note 2 states that ECCS accumulator isolation is only required when the ECCS accumulator pressure is more than or at the maximum RCS pressure for the existing RCS cold leg temperature allowed by the P/T limit curves provided in the PTLR (less allowance for instrument uncertainty).

This Note permits the ECCS accumulator discharge isolation valve Surveillance to be performed only under these pressure and temperature conditions.

To provide low temperature overpressure mitigation through pressure relief, the LCO requires an OPERABLE OPPS with two pressurizer PORVs. A PORV is OPERABLE for LTOP when its block valve is open, its low pressure lift setpoint has been selected (OPPS enabled), and the backup air supply is charged.

APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is *< the OPPS enable temperature specified in the PTLR and > the SI Pump disable temperature specified in the PTLR. The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above the OPPS enable temperature specified in the PTLR.

LCO 3.4.3 provides the operational P/T limits for all MODES.

LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above the OPPS enable temperature specified in the PTLR. LCO 3.4.13 provides the LTOP requirements in MODE 4

SI pump disable temperature and in MODES 5 and 6.

Prairie Island Units I and 2 B 3.4.12-6 Unit I - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT > SI Pump Disable Temperature B 3.4.12 BASES APPLICABILITY Low temperature overpressure prevention is most critical during (continued) shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows operator action to mitigate the event.

ACTIONS A. I With two SI pumps capable of injecting into the RCS, RCS overpressurization is possible.

To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency of removing the RCS from this condition.

B. 1, C. 1, and C.2 An unisolated ECCS accumulator requires isolation within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

This is only required when the ECCS accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.

If isolation is needed and cannot be accomplished in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , Required Action C. 1 and Required Action C.2 provide two options, either of which must be performed in the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . By increasing the RCS temperature to > the OPPS enable temperature specified in the PTLR, an accumulator pressure of 800 psig cannot exceed the LTOP analysis limits if the ECCS accumulators are fully injected. Depressurizing the ECCS accumulators below the LTOP limit from the PTLR also gives this protection.

The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.12-7 Unit 2 - Amendment No. 149

LTOP - RCSCLT > SI Pump Disable Temperature B 3.4.12 BASES ACTIONS D. I (continued)

In MODE 4 when any RCS cold leg temperature is -< the OPPS enable temperature specified in the PTLR, with one required PORV inoperable, the PORV must be restored to OPERABLE status within a Completion Time of 7 days. Two PORVs are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component.

The Completion Time considers the facts that only one of the PORVs is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low.

E.1 MODE 5 must be entered, the RCS must be depressurized and a vent must be established within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when:

a.

Both PORVs are inoperable; or

b.

A Required Action and associated Completion Time of Condition A, C, or D is not met; or

c.

The OPPS is inoperable.

The vent must be sized Ž! 3 square inches to ensure that the flow capacity is greater than that required for the worst case mass input transient reasonable during the applicable MODES. The vent opening is based on the cross sectional flow area of a PORV. A PORV maintained in the open position satisfies the vent requirement. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.12-8 Unit 2 - Amendment No. 149

LTOP - RCSCLT > SI Pump Disable Temperature B 3.4.12 BASES ACTIONS E. 1 (continued)

The Completion Time considers the time required to place the plant in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.

SURVEILLANCE REQUIREMENTS SR 3.4.12.1 and SR 3.4.12.2 To minimize the potential for a low temperature overpressure event by limiting the mass input capability, one SI pump is verified incapable of injecting into the RCS and the ECCS accumulator discharge isolation valves are verified closed and de-energized.

The SI pump is rendered incapable of injecting into the RCS by employing at least two independent means to prevent a pump start such that a single failure or single action will not result in an injection into the RCS. This may be accomplished through the pump control switch being placed in pullout and with a blocking device installed over the control switch that would prevent an unplanned pump start.

The ECCS accumulator motor operated isolation valves can be verified closed and de-energized by use of control board indication.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient, considering other indications and alarms available to the operator in the control room, to verify the required status of the equipment.

Prairie Island Units 1 and 2 B 3.4.12-9 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT > SI Pump Disable Temperature B 3.4.12 BASES SURVEILLANCE SR 3.4.12.3 REQUIREMENTS (continued)

The PORV block valve must be verified open every 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to provide the flow path for each required PORV to perform its function when actuated. The valve can be remotely verified open in the main control room.

The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required to be removed, and the manual operator is not required to be locked in the inactive position.

Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Frequency is considered adequate in view of other administrative controls available to the operator in the control room, such as valve position indication, that verify that the PORV block valve remains open.

SR 3.4.12.4 Performance of a COT is required every 31 days on OPPS to verify and, as necessary, adjust the PORV lift setpoints. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay.

This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specification tests at least once per refueling interval with applicable extensions. The COT will verify the setpoints are within the PTLR allowed maximum limits in the PTLR.

PORV actuation during this testing could depressurize the RCS and is not required.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.12-10 Unit 2 - Amendment No. 149

LTOP - RCSCLT > SI Pump Disable Temperature B 3.4.12 BASES SURVEILLANCE REQUIREMENTS SR 3.4.12.4 (continued)

A Note has been added indicating that this SR is required to be performed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after decreasing RCS cold leg temperature to

_< the OPPS enable temperature specified in the PTLR. The COT may not have been performed before entry into the LTOP MODES.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months initial time considers the unlikehood of a low temperature overpressure event during this time.

SR 3.4.12.5 Performance of a CHANNEL CALIBRATION on OPPS is required every 24 months to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input.

REFERENCES

1.

10 CFR 50, Appendix G.

2.

USAR, Section 4.4.

3.

ASME, Boiler and Pressure Vessel Code,Section XI, Appendix G, with ASME Code Case N-514.

Prairie Island Units I and 2 B 3.4.12-11 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.13 Low Temperature Overpressure Protection (LTOP) Reactor Coolant System Cold Leg Temperature (RCSCLT) < Safety Injection (SI) Pump Disable Temperature BASES BACKGROUND The LTOP function limits RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10 CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting RCPB component for demonstrating such protection. The Over Pressure Protection System (OPPS) provides the actuation setpoints for the pressurizer power operated relief valves (PORVs) for the LTOP function (Ref. 2). The PTLR provides the maximum allowable OPPS actuation setpoints and the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES. The LTOP MODES are the MODES as defined in the Applicability statement of LCO 3.4.12 and LCO 3.4.13.

The pressurizer safety valves and PORVs at their normal setpoints do not provide overpressure protection for certain low temperature operational transients. Inadvertent pressurization of the RCS at temperatures below the OPPS enable temperature specified in the PTLR could result in exceeding the ASME Appendix G (Ref. 3) brittle fracture P/T limits. Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel.

LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the PTLR limits.

This LCO provides RCS overpressure protection by restricting coolant input capability and ensuring adequate pressure relief capacity. In MODE 4, at or below the safety injection (SI) pump disable temperature, limiting coolant input capability requires both SI pumps incapable of injection into the RCS and isolating the emergency core cooling system (ECCS) accumulators. The pressure Prairie Island Units 1 and 2 B 3.4.13-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES BACKGROUND relief capacity requires either two redundant PORVs or a (continued) depressurized RCS and an RCS vent of sufficient size. One PORV or the open RCS vent is the overpressure protection device that acts to terminate an increasing pressure event.

Limiting coolant input capability reduces the ability to provide core coolant addition. The LCO does not require the makeup control system deactivated or the safety injection SI actuation circuits blocked. Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the charging system can provide adequate flow. If conditions require the use of an SI pump for makeup in the event of loss of inventory, the pump can be made available through manual actions.

The LTOP pressure relief consists of two PORVs with reduced lift settings provided by OPPS or a depressurized RCS and an RCS vent of sufficient size. Two PORVs are required for redundancy. One PORV has adequate relieving capability to prevent overpressurization for the required coolant input capability.

OPPS and PORV Requirements As designed for the LTOP function, each PORV is signaled to open by OPPS if the RCS pressure approaches the lift setpoint provided when OPPS is enabled. The OPPS monitors both RCS temperature and RCS pressure and indicates when a condition not acceptable in the PTLR limits is approached. The wide range RCS temperature setpoints indicate conditions requiring enabling OPPS. The PTLR presents the OPPS setpoints for LTOP.

RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at containment ambient pressure Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.13-2 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES BACKGROUND RCS Vent Requirements (continued) in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass or heat input transient, and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.

APPLICABLE SAFETY ANALYSES Safety analyses (Ref. 2) demonstrate that the reactor vessel is adequately protected against exceeding the Reference 1 P/T limits.

In MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature exceeding the OPPS enable temperature specified in the PTLR, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits. At about the OPPS enable temperature specified in the PTLR and below, overpressure prevention falls to two OPERABLE PORVs or to a depressurized RCS and a sufficiently sized RCS vent. Each of these means has a limited overpressure relief capability. LCO 3.4.12, "LTOP > SI Pump Disable Temperature," provides the requirements for overpressure prevention at temperatures above the SIP disable temperature.

The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the PTLR curves are revised, LTOP must be re-evaluated to ensure its functional requirements can still be met using the PORV method or the depressurized and vented RCS condition.

The PTLR contains the acceptance limits that define the LTOP requirements. Any change to the RCS must be evaluated against the Reference 2 analyses to determine the impact of the change on the LTOP acceptance limits.

Prairie Island Units 1 and 2 B 3.4.13-3 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES APPLICABLE SAFETY ANALYSES (continued)

Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients. The bounding mass input transient is inadvertent safety injection with injection from one SI pump and three charging pumps, and letdown isolated.

The bounding heat input transient is reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.

The following limitations are required during the Applicability of this specification to ensure that mass and heat input transients in excess of analysis assumptions do not occur:

a.

Rendering both SI pumps incapable of injection;

b.

Deactivating the ECCS accumulator discharge isolation valves in their closed positions; and

c.

Disallowing start of an RCP if secondary temperature is more than 50'F above primary temperature in any one loop.

LCO 3.4.6, "RCS Loops - MODE 4," provides this protection.

The Reference 2 analyses demonstrate that either one PORV or the depressurized RCS and RCS vent can maintain RCS pressure below limits when all charging pumps are actuated. Neither one PORV nor the RCS vent can handle the pressure transient resulting from inadvertent SI pump or ECCS accumulator injection when the RCS is below the SI Pump disable temperature. Thus, the LCO requires both SI pumps to be disabled below the temperature specified in the PTLR.

The LCO also requires ECCS accumulator isolation when ECCS accumulator pressure is greater than or equal to the maximum RCS pressure for the existing RCS cold leg temperature allowed in the PTLR. The isolated ECCS accumulators must have their discharge valves closed and the valve power supply breakers fixed in their open positions.

Prairie Island Units 1 and 2 B 3.4.13-4 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES APPLICABLE SAFETY ANALYSES (continued)

Fracture mechanics analyses established the temperature of LTOP Applicability at the OPPS enable temperature specified in the PTLR.

The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the limit shown in the PTLR. The OPPS setpoints are derived by analyses that model the performance of the system, assuming the limiting LTOP transient of all charging pumps injecting into the RCS. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times.

The OPPS setpoints at or below the derived limit ensures the Reference 1 P/T limits will be met.

The OPPS setpoints in the PTLR will be updated when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation. Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," discuss these examinations.

With the RCS depressurized, analyses show a vent size equivalent to the cross sectional flow area of a PORV is capable of mitigating the allowed LTOP overpressure transient. The capacity of a vent this size is greater than the flow of the limiting transient for the LTOP configuration, both SI pumps disabled and all charging pumps OPERABLE when the RCS is below the SI Pump disable temperature, maintaining RCS pressure less than the maximum pressure on the P/T limit curve.

The RCS vent is passive and is not subject to active failure.

The LTOP function satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

Prairie Island Units 1 and 2 B 3.4.13-5 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES (continued)

LCO This LCO requires that LTOP be provided, by limiting coolant input capability and by OPERABLE pressure relief capability. Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient.

To limit the coolant input capability, the LCO requires both SI pumps be incapable of injecting into the RCS, and all ECCS accumulator discharge isolation valves be closed and deenergized (when ECCS accumulator pressure is greater than or equal to the maximum RCS pressure for the existing RCS cold leg temperature allowed in the PTLR).

The LCO is modified by three Notes. Note 1 allows operation of both SI pumps for < 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for conducting SI system testing providing there is a steam or gas bubble in the pressurizer and at least one isolation valve between the SI pump and the RCS is shut.

The purpose of this note is to permit the conduct of the integrated SI test and other SI system tests and operations that may be performed in MODES 4, 5 or 6. In this case, pressurizer level is maintained at less than 50% and a positive means of isolation is provided between the SI pumps and the RCS to prevent fluid injection to the RCS.

This isolation is accomplished by either a closed manual valve or motor operated valve with the power removed. This combination of conditions under strict administrative control assure that overpressurization cannot occur.

Note 2 allows operation of an SI pump during reduced inventory conditions as required to maintain adequate core cooling and RCS inventory. The purpose of this note is to allow use of an SI pump in the event of a loss of other injection capability (e.g., loss of Residual Heat Removal System cooling while in reduced inventory conditions). The operation of an SI pump under such conditions would be controlled by an approved emergency operating procedure.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.13-6 Unit 2-Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES LCO (continued)

Note 3 states that ECCS accumulator isolation is only required when ECCS accumulator pressure is more than or at the maximum RCS pressure for the existing RCS cold leg temperature allowed by the P/T limit curves provided in the PTLR (less allowance for instrument uncertainty). This Note permits the ECCS accumulator discharge isolation valve Surveillance to be performed only under these pressure and temperature conditions.

The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are:

a.

An OPERABLE OPPS with two PORVs; or A PORV is OPERABLE for LTOP when its block valve is open, its low pressure lift setpoint has been selected (OPPS enabled), and the backup air supply is charged.

b.

A depressurized RCS and an RCS vent.

An RCS vent is OPERABLE when open with an area of

> 3.0 square inches. Because the RCS vent opening specification is based on the flow capacity of a PORV, a PORV maintained in the open position may be utilized to meet the RCS vent requirement.

Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.

APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is < the SI Pump disable temperature specified in the PTLR, in MODE 5, and in MODE 6 when the reactor vessel head is on and the SG primary system manways and pressurizer manway are closed and secured. The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above the OPPS enable temperature specified in the PTLR. When the reactor vessel head is off, overpressurization cannot occur.

Prairie Island Units 1 and 2 B 3.4.13-7 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES APPLICABILITY (continued)

LCO 3.4.3 provides the operational P/T limits for all MODES.

LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above the OPPS enable temperature specified in the PTLR. LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) < Safety Injection Pump (SI) Pump Disable Temperature," provides the requirements for MODE 4 below the OPPS enable temperature and above the SI Pump disable temperature.

Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows operator action to mitigate the event.

ACTIONS A.l With one or more SI pumps capable of injecting into the RCS, RCS overpressurization is possible.

To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency of removing the RCS from this condition.

B.1, C.1, and C.2 An unisolated ECCS accumulator requires isolation within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

This is only required when the ECCS accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.

If isolation is needed and cannot be accomplished in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , Required Action C. 1 and Required Action C.2 provide two options, either of which must be performed in the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . By Prairie Island Units 1 and 2 B 3.4.13-8 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES ACTIONS B.1, C. 1, and C.2 (continued) increasing the RCS temperature to > the OPPS enable temperature specified in the PTLR, an ECCS accumulator pressure of 800 psig cannot exceed the LTOP analysis limits if the ECCS accumulators are fully injected. Depressurizing the ECCS accumulators below the LTOP limit from the PTLR also gives this protection.

The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.

D.1 The consequences of operational events that will overpressurize the RCS are more severe at lower temperature. Thus, with one PORV inoperable in MODE 4 when any RCS cold leg temperature is < the SI Pump disable temperature specified in the PTLR, MODE 5 or in MODE 6 with the head on, the Completion Time to restore two valves to OPERABLE status is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . A Note clarifies that Condition D is only applicable when the OPPS and PORVs are being used to satisfy the pressure relief requirements of LCO 3.4.13.a.

The Completion Time represents a reasonable time to investigate and repair several types of relief valve failures without exposure to a lengthy period with only one OPERABLE PORV to protect against overpressure events.

E.1 The RCS must be depressurized and a vent must be established within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months when:

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.13-9 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES ACTIONS E. I (continued)

a.

Both required PORVs are inoperable; or

b.

A Required Action and associated Completion Time of Condition A, C, or D is not met; or

c.

The OPPS is inoperable.

The vent must be sized > 3 square inches to ensure that the flow capacity is greater than that required for the worst case mass input transient reasonable during the applicable MODES. The vent opening is based on the cross sectional flow area of a PORV. A PORV maintained in the open position satisfies the vent requirement. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel.

The Completion Time considers the time required to place the plant in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of admiristrative control requirements.

SURVEILLANCE SR 3.4.13.1 and SR 3.4.13.2 REQUIREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, both SI pumps are verified incapable of injecting into the RCS and the ECCS accumulator discharge isolation valves are verified closed and deenergized.

The SI pumps are rendered incapable of injecting into the RCS by employing at least two independent means to prevent a pump start such that a single failure or single action will not result in an injection into the RCS. This may be accomplished through the Prairie Island Unit 1 -Amendment No. 158 Units 1 and 2 B 3.4.13-10 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES SURVEILLANCE REQUIREvMENTS SR 3.4.13.1 and SR 3.4.13.2 (continued) pump control switch being placed in pullout with a blocking device installed over the control switch that would prevent an unplanned pump start.

The ECCS accumulator motor operated isolation valves can be verified closed and deenergized by use of control board indication.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient, considering other indications and alarms available to the operator in the control room, to verify the required status of the equipment.

SR 3.4.13.3 The RCS vent of> 3 square inches is proven OPERABLE by verifying its open condition either:

a.

Once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for a valve that is not locked.

b.

Once every 31 days for other vent path(s) (e.g., a vent valve that is locked, sealed, or secured in position). A removed pressurizer safety valve or open manway also fits this category.

The passive vent path arrangement must only be open when required to be OPERABLE. This Surveillance is required if the vent is being used to satisfy the pressure relief requirements of LCO 3.4.13b.

Prairie Island Units 1 and 2 B 3.4.13-11 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES SURVEILLANCE SR 3.4.13.4 REQUIREMENTS (continued)

The PORV block valve must be verified open every 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to provide the flow path for each required PORV to perform its function when actuated. The valve may be remotely verified open in the main control room. This Surveillance is performed if the PORV satisfies the LCO.

The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required to be removed, and the manual operator is not required to be locked in the inactive position.

Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Frequency is considered adequate in view of other administrative controls available to the operator in the control room, such as valve position indication, that verify that the PORV block valve remains open.

SR 3.4.13.5 Performance of a COT is required every 31 days on OPPS to verify and, as necessary, adjust the PORV lift setpoints. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay.

This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The COT will verify the setpoints are within the PTLR allowed maximum limits in the PTLR.

PORV actuation during this testing could depressurize the RCS and is not required.

Prairie Island Unit 1 - Amendment No. 158 Units 1 and 2 B 3.4.13-12 Unit 2 - Amendment No. 149

LTOP - RCSCLT < SI Pump Disable Temperature B 3.4.13 BASES SURVEILLANCE REQUIREMENTS SR 3.4.13.5 (continued)

A Note has been added indicating that this SR is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after decreasing RCS cold leg temperature to < the OPPS enable temperature specified in the PTLR. The COT may not have been performed before entry into the LTOP MODES.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months initial time considers the unlikehood of a low temperature overpressure event during this time.

SR 3.4.13.6 Performance of a CHANNEL CALIBRATION on OPPS is required every 24 months to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input.

REFERENCES

1.

10 CFR 50, Appendix G.

2.

USAR, Section 4.4.

3.

ASME, Boiler and Pressure Vessel Code,Section XI, Appendix G, with ASME Code Case N-514.

Prairie Island Units 1 and 2 B 3.4.13-13 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

v t e Letter Sequence Other
TAC:BM0696, (Open) TAC:MB0695, Ventilation System Envelope Allowed Outage Time (Approved, Closed)
Initiation Acceptance... Administration Questions Answers Results Approval... Other: ML022140359, ML022140370, ML022210043
MONTHYEAR2002-03-06 [Table View]

ML022140370

Text

Navigation menu

Search