Text

Technical Specification Bases
	ML051090380
Person / Time
Site:	Indian Point
Issue date:	03/31/2005
From:	; Entergy Nuclear Northeast
To:	; Office of Nuclear Reactor Regulation
References
	Download: ML051090380 (82)
	v • d • e

31-MAR-05 Page: 91 DISTRIBUTION CONTROL LIST s ument Name: ITS/BASES/TRM CCNAME NAME DEPT LOCATION 1 OPS PROCEDURE GROUP SUPV. OPS PROCEDURE GROUP IP2 3 PLANT MANAGER'S OFFICE UNIT 3(UNIT 3/IPEC ONLY) IP2 5 CONTROL ROOM & MASTER OPS(3PT-D001/6(U3/IPEC) IP3(ONLY) 11 RES DEPARTMENT MANAGER RES (UNIT 3/IPEC ONLY) 45-4-A 19 STEWART ANN LICENSING GSB-2D 20 CHEMISTRY SUPERVISOR CHEMISTRY DEPARTMENT 45-4-A 21 TSC(IP3) EEC BUILDING IP2 22 SHIFT MGR.(LUB-001-GEN) OPS (UNIT 3/IPEC ONLY) IP3 23 LIS LICENSING & INFO SERV OFFSITE 25 SIMULATOR TRAIN(UNIT 3/IPEC ONLY) 48-2-A 28 RESIDENT INSPECTOR US NRC 88' ELEVATION IP2 32 EOF E-PLAN (ALL EP'S) EOF 47 CHAPMAN N BECHTEL OFFSITE 50 TADEMY L. SHARON WESTINGHOUSE ELECTRIC OFFSITE 55 GSB TECHNICAL LIBRARY A MCCALLION/IPEC & IP3 GSB-3B 61 SIMULATOR TRAIN(UNIT 3/IPEC ONLY) 48-2-A 69 CONROY PAT LICENSING/ROOM 205 GSB-2D 99 BARANSKI J (ALL) ST. EMERG. MGMT. OFFICE OFFSITE 106 SIMULATOR INSTRUCT AREA *TRG/3PT-D001-D006 ONLY) #48 164 CONTROL ROOM & MASTER OPS(3PT-D001/6(U3/IPEC) IP3(ONLY) 207 TROY M PROCUREMENT ENG. 1A 273 FAISON CHARLENE NUCLEAR LICENSING WPO-12 319 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 354 L.GRANT(LRQ-OPS/TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 357 L.GRANT(ITS/INFO ONLY) TRAINING - ILO CLASSES 48-2-A 424 GRANT LEAH (9 COPIES) (UNIT 3/IPEC ONLY) #48 474 OUELLETTE P ENG., PLAN & MGMT INC OFFSITE 483 SCHMITT RICHIE MAINTENANCE ENG/SUPV 45-1-A 484 HANSLER ROBERT REACTOR ENGINEERING 72'UNIT 2 489 CLOUGHNESSY PAT PLANT SUPPORT TEAM GSB-3B 491 ORLANDO TOM (MANAGER) PROGRAMS/COMPONENTS ENG 45-3-G 492 FSS UNIT 3 OPERATIONS K-IP-1210 493 OPERATIONS FIN TEAM 33 TURBIN DECK 45-1-A 494 AEOF/A.GROSJEAN(ALL EP'S) E-PLAN (EOP'S ONLY) WPO-12D 495 JOINT NEWS CENTER EMER*PLN (ALL EP'S) EOF 496 L.GRANT(LRQ-OPS/TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 497 L.GRANT(LRQ-OPS/TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 500 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 501 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 512 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 513 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 518 DOCUMENT CONTROL DESK NRC (ALL EP'S) OFFSITE 527 529 MILIANO PATRICK FIELDS DEBBIE NRC/SR. PROJECT MANAGER OUTAGE PLANNING OFFSITE IP3/OSB 0l In/ f// 91os

INDIAN POINT 3 TECHNICAL SPECIFICATION BASES INSTRUCTIONS FOR UPDATE: 15-04/11/05 REMOVE INSERT a) List of Effective Sections; a) List of Effective Sections; 4 pages (Rev. 14) 4 pages (Rev. 15) b) Section 3.3.2, Rev. 3 b) Section 3.3.2, Rev. 4 45 pages 45 pages c) Section 3.3.6, Rev. 0 c) Section 3.3.6, Rev. 1 10 pages 8 pages d) Section 3.3.7, Rev. 0 d) Section 3.3.7, Rev. 1 6 pages 6 pages e) Section 3.7.1 1; Rev. 3 e) Section 3.7.11; Rev. 4 9 pages 7 pages f) Section 3.7.12, Rev. 0 f) Section 3.7.12, Rev. 1 4 pages 4 pages g) Section 3.7.14, Rev. 0 g) Section 3.7.14, Rev. 1 3 pages 3 pages h) Section 3.9.6, Rev. 1 h) Section 3.9.6, Rev. 2 3 pages 3 pages

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE SECTIONS BASES NUMBER EFFECTIVE BASES I NUMBER I FFECTIVE SECTION REV OF PAGES DATE SECTION REV OFPAGES DATE TbI of Cnt 1 4 05118/2001 l-____ '.B3.6 CONTAINMENT 9 -

.'- :-;* 8 2.0 SAFETYLIMITS,;~z. -Xsr;,*\Z; B 3.6.1 0 5 03/19/2001 B 2.1.1 0 5 03/19/2001 B 3.6.2 0 9 03/19/2001 B 2.1.2 0 4 03/19/2001 B 3.6.3 0 17 03/19/2001

-- B 3-.0 LCO AND SR APPLICABILITY .--- B 3.6.4 0 3 03/19/2001 B3.0 i I 15 109/30/2002 B 3.6.5 1 5 06/20/2003

-B 3.1 REACTIVITY-CONTROL..; .--;- B 3.6.6 1 13 12/04/2002 B 3.1.1 0 6 03/19/2001 B 3.6.7 0 6 03/19/2001 B 3.1.2 0 7 03/19/2001 B 3.6.8 0 6 03119/2001 B 3.1.3 1 7 10/27/2004 B 3.6.9 0 8 03/19/2001 B 3.1.4 0 13 03/19/2001 B 3.6.10 0 12 03/19/2001 B 3.1.5 0 5 03/1912001 - B 3.7 PLANT-SYSTEMS:.

B 3.1.6 0 6 03/1912001 B 3.7.1 1 6 12/04/2002 B 3.1.7 0 8 03/19/2001 B 3.7.2 0 10 03/19/2001 B 3.1.8 0 7 03/19/2001 B 3.7.3 1 7 05/18/2001

. rB 3.2 POWER DISTRIBUTION LIMITS B 3.7.4 0 5 03/19/2001 B 3.2.1 0 7 03/19/2001 B 3.7.5 1 9 02/25/2005 B 3.2.2 0 7 03/19/2001 B 3.7.6 1 4 12/04/2002 B 3.2.3 0 7 03/19/2001 B 3.7.7 1 4 12/17/2004 B 3.2.4 0 7 03/19/2001 B 3.7.8 0 7 03/19/2001

. , B 3.3 INSTRUMENTATION. B 3.7.9 1 9 09130/2002 B 3.3.1 1 59 09/30/2002 B 3.7.10 0 3 03/19/2001 B 3.3.2 4 45 04/1112005 I B 3.7.11 4 7 04/1112005 B 3.3.3 2 19 09/30/2002 B 3.7.12 1 4 0411112005 B 3.3.4 0 7 03/19/2001 B 3.7.13 2 7 06/20/2003 B 3.3.5 1 6 10/27/2004 B 3.7.14 1 3 0411112005 B 3.3.6 1 8 04/1112005 B 3.7.15 0 5 03/19/2001 B 3.3.7 1 6 04/1112005 B 3.7.16 0 6 03/19/2001 B 3.3.8 1 4 03/1712003 B 3.7.17 0 4 03/19/2001 B 3.4 REACTOR COOLANT.SYSTEM -B 3.8 :ELECTRICAL- POWER-s- <2..-_

B 3.4.1 0 6 03/19/2001 B 3.8.1 1 32 01/22/2002 B 3.4.2 0 3 03/19/2001 B 3.8.2 0 7 03/19/2001 B 3.4.3 1 9 10/27/2004 B 3.8.3 0 13 03/19/2001 B 3.4.4 0 4 03/19/2001 B 3.8.4 1 11 01/22/2002 B 3.4.5 0 6 03/19/2001 B 3.8.5 0 4 03/19/2001 B 3.4.6 0 6 03/19/2001 B 3.8.6 0 8 03/19/2001 B 3.4.7 0 7 03/19/2001 B 3.8.7 1 8 06/20/2003 B 3.4.8 0 4 03/19/2001 B 3.8.8 1 4 06/20/2003 B 3.4.9 2 5 06/20/2003 B 3.8.9 2 14 06/20/2003 B 3.4.10 0 5 03/19/2001 B 3.8.10 0 4 03/19/2001 B 3.4.11 0 8 03/19/2001 I-.B 3.9 REFUELING OPERATIONS B 3.4.12 1 20 10/27/2004 B 3.9.1 0 4 l 03/19/2001 B 3.4.13 2 6 11/19/2001 B 3.9.2 0 4 03/19/2001 B 3.4.14 0 10 03/19/2001 B 3.9.3 1 8 l 03/17/2003 B 3.4.15 2 7 11/19/2001 B 3.9.4 0 4 03/19/2001 B 3.4.16 0 7 03/19/2001 B 3.9.5 0 4 03/19/2001

-.-- B3.5ECCS' ;:-- B 3.9.6 2 3 04111/2005 B 3.5.1 1 10 10/27/2004 B 3.5.2 0 13 03/19/2001 B 3.5.3 0 4 03/19/2001 B 3.5.4 0 9 03119/2001 INDIAN POINT 3 Page 1 of 4 Revision 15

BASES TECHNICAL SPECIFICATION TECHNICAL SPECIFICATION BASES REVISION HISTORY REVISION HISTORY FOR BASES AFFECTED EFFECTIVE SECTIONS REV DATE DESCRIPTION Initial issue of Bases derived from NUREG-1431, in ALL 0 03/19/01 conjunction with Technical Specification Amendment 205 for conversion of 'Current Technical Specifications' to

'Improved Technical Specifications'.

a :.BASES UPDATE PACKAGE 01-031901 -.

Changes regarding containment sump flow monitor per B 3.4.13 1 03/19/01 NSE 01-3-018 LWD Rev 0.

B 3.4.15 Change issued concurrent with Rev 0.

'_ - BASES UPDATE PACKAGE 02-051801 Table of Contents 1 05/18/01 Title of Section B 3.7.3 revised per Tech Spec Amend 207 B 3.7.3 1I 05/18/01 Implementation of Tech Spec Amend 207

.:- -. i.-:j<-BA

-;S SES EUPDATEPPA CKAGE 03111901-Correction to statement regarding applicability of Function B 3.3.2 1 11/19/01 5, to be consistent with the Technical Specification.

Changes to reflect reclassification of certain SG narrow B 3.3.3 1 11/19/01 range level instruments as QA Category M per NSE 97 439, Rev 1.

Changes to reflect installation of a new control room alarm B 3.4.13 2 11/19/01 for 'VC Sump Pump Running'. Changes per NSE 01 B 3.4.15 018, Rev 1 and DCP 01-3-023 LWD.

Clarification of allowable flowrate for CRVS in 'incident B 3.7.11 1 11/19/01 mode with outside air makeup.'

-_______ ->.X.-v~ -;.BASES UPDATEPACKAGE 04:012202z.-

B 3.3.2 2 01/22/02 Clarify starting logic of 32 ABFP per EVL-01-3-078 MULTI, Rev 0.

B 3.8.1 1 01/22/02 Provide additional guidance for SR 3.8.1.1 and Condition Statements A.1 and B.1 per EVL-01-3-078 MULTI, Rev 0.

B 3.8.4 1 01/22/02 Revision of battery design description per plant modification and to reflect Tech Spec Amendment 209.

B 3.8.9 1 01/22/02 Provide additional information regarding MCC in Table B 3.8.9-1 per EVL-01-3-078 MULTI, Rev 0.

.. e A . .., O BASES UPDATEPACKAGE 05 093002`s -*t - ';

B 3.0 1 09/30/02 Changes to reflect Tech Spec Amendment 212 regarding delay period for a missed surveillance. Changes adopt TSTF 358, Rev 6.

B 3.3.1 1 09/30/02 Changes regarding description of turbine runback feature per EVAL-99-3-063 NIS.

B 3.3.3 2 09/30/02 Changes to reflect Tech Spec Amendment 211 regarding CETs and other PAM instruments.

B 3.7.9 1 09/30/02 Changes regarding SWN 1 and -2 valves per EVAL-00-3-095 SWS, Rev 0.

INDIAN POINT 3 Page 2 of 4 Revision 15

TECHNICAL SPECIFICATION BASES REVISION HISTORY AFFECTED EFFECTIVE I SECTIONS REV I DATE DESCRIPTION

,:::: ;;1-.4BASES:UPDATE PACKAGE 06-120402-

____,,,,,,- :--- ' ; . J B 3.3.2 3 12/04/02 Changes to reflect Tech Spec Amendment 213 regarding B 3.6.6 1 1.4% power uprate.

B 3.7.1 1 B 3.7.6 1 B.7.6 BASES UPDATE PACKAGE-07-031703 ' -,

B 3.3.8 1 03/17/2003 Changes to reflect Tech Spec Amendment 215 regarding B 3.7.13 1 implementation of Alternate Source Term analysis B 3.9.3 1 methodology to the Fuel Handling Accident.

, .,,. , i-:< -BASES UPDATE-PACKAGE 08-032803 --;- '.-

B 3.4.9 1 03/28/2003 Changes to reflect Tech Spec Amendment 216 regarding

_relaxation of pressurizer level limits in MODE 3.

,____.-._ BASES- UPDATE'PACKAGE-09-062003 ---' '-- '-

B 3.4.9 2 06/20/2003 Changes to reflect commitment for a dedicated operator per Tech Spec Amendment 216.

B 3.6.5 1 06/20/2003 Implements Corrective Action 11 from CR-IP3-2002-02095; 4 FCUs should be in operation to assure representative measurement of containment air temperature.

B 3.7.11 2 06/20/2003 Correction to Background description regarding system

.response to Firestat detector actuation per ACT 02-62887.

B 3.7.13 2 06/20/2003 Revision to Background description of FSB air tempering units to reflect design change per DCP 95-3-142.

B 3.8.7 1 06/20/2003 Changes to reflect replacement of Inverter 34 per DCP-B 3.8.8 1 06/20/2003 01-022.

B 3.8.9 2 06/20/2003

- . *,- .~;.

- ,;-< BASES UPDATE PACKAGE 10-1 02704 N- -:- - .;-

B 3.1.3 1 10/27/2004 Clarification of the surveillance requirements forTS 3.1.3 per 50.59 screen.

B 3.3.5 1 10/27/2004 Clarify the requirements for performing a Trip Actuating Device Operational Test (TADOT) on the 480V degraded rid and undervoltage relays per 50.59 screen.

B 3.4.3 1 10/27/2004 Extension of the RCS pressure/temperature limits and corresponding OPS limits from 16.17 to 20 EFPY (TS B 3.4.12 1 Amendment 220).

B 3.5.1 1 10/27/2004 Changes to reflect Tech Spec Amendment 222 regarding extension of completion time for Accumulators.

_______,,, _ BASES UPDATE'PACKAGE.1-121004 .-- ' , ^fl;.t',.,,

B 3.7.7 1 12/17/2004 Addition of valves CT-1 300 and CT-1 302 to Surveillance SR 3.7.7.2 to verify that all city water header supply isolation valves are open. Reflects Tech Spec Amendment 218.

.c;,:.-- - ;:s s : -BASES UPDATE -PACKAGEl 2-012405 - :' -; :A- '- ;'-

B 3.7.11 3 01/24/2005 Temporary allowance for use of KI/SCBA for unfiltered inleakage above limit.

INDIAN POINT 3 Page 3 of 4 Revision 15

TECHNICAL SPECIFICATION BASES REVISION HISTORY AFFECTED EFFECTIVE l SECTIONS REV DATE DESCRIPTION

.:.-BASESUPDATE PACKAGE13-022505k

. : .* ';',.' ....... 4 t B 3.7.5 1 02/25/2005 Clarification on Surveillance Requirement 3.7.5.3 as it relates to plant condition/frequency of performance of Auxiliary Feedwater Pump full flow testing.

._ -.BASES UPDATE PACKAGE 14-030705.~:-'- . .

B 3.9.6 1 03/07/2005 Changes to reflect that the decay time prior to fuel movement is a minimum of 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months per Tech Spec Amendment 215.

'.BASESUPDATE PACKAGE 15-041105 ,,:,

B 3.3.2 4 04/1112005 Changes to reflect AST as per Tech Spec Amendment 224.

B 3.3.6 1 NOTE: In addition to the AST changes to B. 3.7.11, the B. 3.3.7 1 temporary allowance for use of KI/SCBA for unfiltered inleakage above limit is being removed. Tracer Gas B 3.7.11 4 testing is complete.

B 3.7.12 1 B 3.7.14 1 B 3.9.6 2 INDIAN POINT 3 Page 4 of 4 Revision 15

ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2' Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND The ESFAS initiates-necessary safety systems, based on the values of selected unit parameters', to'protect against violating core design

'limits and the Reactor Coolant System (RCS) pressure boundary, and to mitigate'accidents. '

The ESFAS instrumentation is segmented into three distinct but interconnected modules as identified below:

' Field transmitters or process sensors and instrumentation:

provide a measurable electronic signal based on the physical characteristics of the parameter being'measured:

' Signal processing equipment including analog protection system, field contacts, and protection channel sets: provide signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board/control room/miscellaneous indications;' and

. ESFAS automaticinitiation relay logic: initiates the proper engineered safety feature (ESF) actuation in accordance with the defined logic'and based on the bistable outputs from the signal process control and protection system.

Field Transmitters or Sensors To.meet'the design demands"for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters. Inmany cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Protection System (RPS). Insome cases, the same channels also provide control system inputs. To account for calibration tolerances and instrument drift, which are assumed to occur between calibrations, statistical (continued)

INDIAN POINT 3 B 3.3.2 - 1 Revision 4

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND allowances are provided in the trip setpoint and Allowable Values.

(continued) The OPERABILITY of each transmitter or sensor can be evaluated when its "as found" calibration data are compared against its documented acceptance criteria.

Signal Processing Equipment Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments. The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. These setpoints are defined in FSAR, Chapter 6 (Ref. 1). Chapter 7 (Ref. 2). and Chapter 14 (Ref.

3). Ifthe measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the ESFAS relay logic for decision evaluation. Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing. Some unit parameters provide input only to the ESFAS relay logic, while others provide input to the ESFAS relay logic, the main control board, the unit computer, and one or more control systems.

Generally, if a parameter is used for input to the protection circuits only, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function isstill OPERABLE with a one-out-of- two logic.

Generally, if a parameter is used for input to the ESFAS relay logic and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy. The (continued)

INDIAN POINT 3 B 3.3.2 - 2 Revision 4

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND circuit is designed to withstand both an input failure to the control (continued) control system, which lmayther require the protection function actuation, and a single failure in the other channels providing the protection function'actuation.' Again.,a single failure will neither

-cause nor prevent the'protection function actuation.

These requirements'are'described in IEEE-279-1968 (Ref. 4). The actual number of channels required for each unit parameter is specified in Reference 2 and discussed later in these Technical Specification Bases.

Trip Setpoints and Allowable Values The following describes'the relationship between the safety limit.

analytical limit. allowable value and channel component calibration acceptance criteria:

a. A Safety Limit (SL) is a limit on the combination of THERMAL POWER. RCS highest loop average temperature, and RCS pressure needed to protect the integrity of physical barriers that guard against the uncontrolled release'of radioactivity (i.e., fuel.

fuel cladding, RCS pressure boundary and containment). The safety limits are identified inTechnical Specification 2.0.

Safety Limits (SLs).

b. An Analytical Limit (AL) isthe'trip actuation point used as an input to the accident analyses presented in FSAR. Chapter 14 (Ref. 3). An'alytical limits are developed from event analyses models which consider parameters such as process delays, rod insertion times,'reactivity changes, instrument response times, etc. Ananalytical-limit for a trip'actuation point is established'at a'point that will ensure that a Safety Limit (SL)

- is not exceeded.

c. An Allowable Value (AV) isthe limiting actuation point for the entire channel of a trip function that will ensure, within the required level of confidence, that sufficient allocation exists

- - (continued)

INDIAN POINT 3 B 3.3.2-3 R ion 4 Revision

it ESFAS Instrumentation B 3.3.2 BASES BACKGROUND between this actual trip function actuation point and the analytical (continued) limit. The Allowable Value ismore conservative than the Analytical Limit to account for instrument uncertainties that either are not present or are not measured during periodic testing. Channel uncertainties that either are not present or are not measured during periodic testing may include design basis accident temperature and radiation effects (Ref. 6) or process dependent effects. The channel allowable value for each ESFAS function is controlled by Technical Specifications and is listed in Table 3.3.2-1. Engineered Safety Feature Actuation System Instrumentation.

d. Calibration acceptance criteria (i.e., setpoints) are established by plant administrative programs for the components of a channel (i.e., required sensor, alarm, interlock, display, and trip function). The calibration acceptance criteria are established to ensure, within the required level of confidence, that the Allowable Value for the entire channel will not be exceeded during the calibration interval.

A description of the methodology used to calculate the channel allowable values and calibration acceptance criteria is provided in References 6 and 8.

Setpoints in accordance with the Allowable Value ensure that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.

Each channel required to be OPERABLE can be tested on line, as necessary, to verify that the signal processing equipment and setpoint accuracy is within the specified allowance requirements of Reference

2. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal.

The process equipment for the channel in test is then tested.

verified, and calibrated. SRs for the channels are specified in the SR section.

(continued)

INDIAN POINT 3 B 3.3.2 - 4 Revision 4

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND The Allowable Values'listed in Table 3.3.2-1 and the trip (continued)' setpoints calculated to'ensure that Allowable Values are not exceeded during the calibration interval are based on the methodology described in calculations'performed in accordance'with Reference 6. All field sensors and signal 'processing equipment'for these channels are assumed to operate within the allowances of these uncertainty magnitudes.

ESFAS Relay Loqic Protection 'System' The relay logic equipment is used for the decision logic processing of outputs from the signal'processing equipment bistables. To meet the redundancy requirements, two trains of relay logic, each performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide ESF actuation for the unit. Each train is packaged in a cabinet for physical'and electrical separation to satisfy separation and independence requirements.

The relay logic performs the decision logic for'most ESF equipment actuation; generates'the electrical'output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room.

The bistable outputs from the signal'processing'equipment are sensed by the relay logic equipment and combined into logic that represent combinations indicative of various transients. If a required logic combination is completed. the system will send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and'restore the unit to a safe condition. Examples are given in the APPLICABLE SAFETY ANALYSES. LCO and APPLICABILITY, LCO and APPLICABILITY. LCO, and Applicability sections-of this Bases.

Each relay logic train has a built intesting capability that can test the decision logic matrix functions and the actuation devices while the unit is at power. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.

(continued)

INDIAN POINT 3 B 3.3.2 ..-5 Revision 4-

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND The actuation of ESF components is accomplished through master and (continued) slave relays. The relay logic energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices.

The master and slave relays are routinely tested to ensure operation.

APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY Each of the analyzed accidents can be detected by one or more ESFAS Functions. One of the ESFAS Functions is the primary actuation signal for that accident. An ESFAS Function may be the primary actuation signal for more than one type of accident. An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents. For example. Pressurizer Pressure-Low is a primary actuation signal for small loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) outside containment. Functions such as manual initiation, not specifically credited inthe accident safety analysis, are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).

The LCO requires all instrumentation performing an ESFAS Function identified in Table 3.3.2-1 to be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.

The LCO generally requires OPERABILITY of four or three channels in each instrumentation function and two channels in each logic and manual initiation function. The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance (continued)

INDIAN POINT 3 B 3.3.2 - 6 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY. (continued) or testing without causing an ESFAS initiation. Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.

The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents. ESFAS protection functions are as follows:

1. Safety Iniection Safety Injection (SI) provides two primary functions:

1. Primary side water addition to ensure maintenance or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad temperature to < 2200 0F): and

2. Boration to ensure recovery and maintenance of SWM (kff < 1.0).

These functions areinecessary to mitigate the effects of high energy line breaks (HELBs) both inside and outside of containment. The SI signal is also used to initiate other Functions such as:

. Phase A Isolation;

. Containment Isolation:

. Reactor Trip:

. Turbine Trip;

. Feedwater-Isolation;

. Start of auxiliary feedwater (AFW) pumps; and

. Control room ventilation actuation to the CRVS Mode 3 (10%

incident mode).

(continued)

INDIAN POINT 3 B 3.3.2 - 7 R i 4 Revision

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)

These other functions ensure:

Isolation of nonessential systems through containment penetrations;

Trip of the turbine and reactor to limit power generation;

Isolation of main feedwater (MFW) to limit secondary side mass losses;

Start of AFW to ensure secondary side cooling capability; and

Isolation of the control room to ensure habitability.

a. Safety Injection-Manual Initiation The LCO requires one channel per train to be OPERABLE. The operator can initiate both trains of SI at any time by using either of two push buttons in the control room. This action will cause actuation of all components inthe same manner as any of the automatic actuation signals.

The LCO for the Manual Initiation Function ensures the proper amount of redundancy ismaintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.

Each channel consists of one push button and the interconnecting wiring to the actuation logic cabinet.

Each push button actuates both trains. This configuration does not allow testing at power.

(continued)

INDIAN POINT 3 B 3.3.2 - 8 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and-APPLICABILITY (continued)

b.- 'Safetv'Iniection-Automatic Actuation Logic and Actuation Relays This LCO requires two trains to be OPERABLE. Actuation logic consists of all'circuitry within the actuation subsystems, including the initiating relay contacts responsible for actuating the ESF equipment.

Manual and automatic initiation of SI must be OPERABLE in MODES 1, 2.'and 3. Inthese MODES, there is sufficient

'energy'in the primary and secondary systems to warrant automatic initiation of ESF systems. Manual Initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually--actukte required components in the event of a DBA,

'but because of the'large number of components actuated on a SI, actuation is simplified by the use of the manual actuation push buttons.

These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident.

Unit pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.

c. Safety Injection-Containment Pressure-High This signal provides protection against the following accidents:L

SLB'inside-containment; and

LOCA.

(continued)

INDIAN POINT 3 B 3.3.2'- 9 Revisio'n'4

II ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES. LCO and APPLICABILITY (continued)

Containment Pressure-High provides no input to any control functions. Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic. The transmitters (d/p cells) and electronics are located outside of containment with the sensing line (high pressure side of the transmitter) located inside containment.

Thus, the high pressure Function will not experience any adverse environmental conditions and the trip setpoint reflects only steady state instrument uncertainties.

Containment Pressure-High must be OPERABLE in MODES 1. 2.

and 3 when there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 4. 5, and 6. there is insufficient energy in the primary or secondary systems to pressurize the containment.

d. Safety Injection-Pressurizer Pressure-Low This signal provides protection against the following accidents:

Inadvertent opening of a steam generator (SG) relief or safety valve;

SLB;

Inadvertent opening of a pressurizer relief or safety valve;

LOCAs; and

SG Tube Rupture.

(continued)

INDIAN POINT 3 B 3.3.2 - 10 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)

Three channels of pressurizer pressure provide input into the ESFAS actuation logic. These channels initiate the ESFAS automatically when two of the three channels exceed the low pressure'setpoint. These protection channels also provide control functions; however, the two-out-of-three logic is considered -adequate to provide the required protection. -

The transmitters are located inside containment, with the taps in the vapor'space *region of the pressurizer, and thus possibly experiencing adverse environmental conditions (LOCAN SLB inside containment, rod ejection). Therefore, the'Allowable'Value'reflects the inclusion of both steady state and adverse environmental instrument uncertainties.

This Function must be OPERABLE in MODES 1, 2, and 3 (above the Pressurizer Pressure-Interlock (Function 7) to mitigate the consequences of an HELB inside containment. This signal may be manually blocked by the operator below the Pressurizer Pressure Interlock (Function 7) setpoint.

- Automatic SI actuation below this pressure setpoint is performed by the Containment Pressure-High signal.

This Function is not required to be OPERABLE in MODE 3

- below the Pressurizer Pressure Interlock (Function 8) setpoint. -Other ESF functions are used to detect accident conditions and actuate the ESF systems inthis MODE. In MODES 4. 5, and 6. this Function is not needed for accident detection and mitigation.

e. Safety Iniection- High Differential Pressure Between Steam Lines Steam Line Pressure-High Differential Pressure Between Steam Lines'provides protection against the following accidents:

(continued)

INDIAN POINT 3 B 3.3.2 -'-11 Revision-4'

1.

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)

SLB; and

Inadvertent opening of an ADV or an SG safety valve.

High Differential Pressure Between Steam Lines provides no input to any control functions. Thus, three OPERABLE channels on each steam line are sufficient to satisfy the requirements, with a two-out-of-three logic on each steam line.

With the transmitters located inside the auxiliary feed pump room, it is possible for them to experience adverse environmental conditions during a HELB event.

Therefore, the surveillance acceptance criterion reflects both steady state and adverse environmental instrument uncertainties.

Steam line high differential pressure must be OPERABLE in MODES 1, 2. and 3 when a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). This Function is not required to be OPERABLE in MODE 4, 5. or 6 because there is not sufficient X energy in the secondary side of the unit to cause an accident.

The surveillance acceptance criterion used for this function is #142 psid.

f, g. Safety Injection-High Steam Flow in Two Steam Lines Coincident With ,-Low or Coincident With Steam Line Pressure-Low These Functions (1.f and 1.g) provide protection against the following accidents:

SLB; and

the inadvertent opening of a SG safety valve.

(continued)

INDIAN POINT 3 B 3.3.2 - 12 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)

Two steam line flow-channels per steam line are required OPERABLE for:these Functions. The steam line flow channels are combined in a one-out-of-two logic to indicate high steam flow intone steam line. The steam flow transmitters provide control'inputs, but the control function cannot cause the events that the Function must protect against.

Therefore, two channels are sufficient to satisfy redundancy requirements. The one-out-of-two configuration allows online testing because trip of one high steam flow channel is not sufficient to cause initiation. High steam flow intwo steam lines is acceptable in the case of a single steam line fault due to the fact that the remaining intact steam lines will pick up the full turbine load. The increased steam flow inthe remaining intact lines will actuate the required second high steam flow trip.

Additional protection is provided by Function 1.e., High Differential Pressure Between Steam Lines.

One channel of Tag per loop and one channel of low steam line pressure per steam line are required OPERABLE. For each parameter.'the channels for all loops or steam lines are combined in a logic such that two channels tripped will cause a trip'for-the parameter. The Function trips on one-out-of-two-high steam flow in any two-out-of-four steam lines if there is one-out-of-one low Tavg trip in any two-out-of-four RCS loops, or ifthere is a one-out-of-one low pressure trip in any two-out-of-four steam lines. Since the accidents that this event protects against cause both low'steam line pressure and low Tavg, provision of one channel per loop or steam line ensures no single random failure can disable both of these Functions. The steam line pressure channels provide no control inputs. The Tavg channels provide control inputs, but the control function cannot initiate events that the Function acts to mitigate.

(continued)

INDIAN POINT 3 B 3.3.2 - 13 R i 4

. R60sion

.__. __ - -___ U-ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)

The Allowable Value for high steam flow is a linear function that varies with power level. The function is a turbine first stage pressure corresponding to approximately 54% of full steam flow between 0% and 20% load to approximately 120% of full steam flow at 100% load. The nominal trip setpoint is similarly calculated.

With the transmitters located inside the containment (RCS temperature and steam line flow) or inside the auxiliary feedwater building (steam pressure), it is possible for them to experience adverse steady state environmental conditions during an SLB event. Therefore, the Allowable Value reflects both steady state and adverse environmental instrument uncertainties.

This Function must be OPERABLE in MODES 1. 2, and 3 when any MSIV is open because a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). SLB may be addressed by Containment Pressure High (inside containment) or by High Steam Flow in Two Steam Lines coincident with Steam Line Pressure-Low, for Steam Line Isolation, followed by High Differential Pressure Between Two Steam Lines, for SI. This Function is not required to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to cause an accident.

2. Containment Spray Containment Spray provides three primary functions:

1. Lowers containment pressure and temperature after an HELB in containment; (continued)

INDIAN POINT 3 B 3.3.2 - 14 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES. LCO and APPLICABILITY (continued)

2. Reduces the amount of radioactive iodine in the containment atmosphere, and

3. Adjusts the pH of the water in the containment and recirculation sump after a large break LOCA.

These functions are necessary to:

. Ensure the pressure boundary integrity of the containment structure:

. Limit the'release-of radioactive iodine to the environment; and

. Minimize corrosion of the components and systems inside containment following a LOCA.

The containment spray actuation signal starts the containment spray pumps.` Water is drawn from the RWST by the containment spray pumps and mixed with a sodium hydroxide solution from the spray additive tank.' When the RWST reaches a specified minimum level,'the spray pumps are secured. RHR or recirculation pumps will be used if continued containment spray is required.

Containment spray is actuated automatically by Containment Pressure-High High.

a. Cinment Spray-Manual Initiation Manual initiation of containment spray (CS) requires that two pushbuttons in the control room be depressed simultaneously which will actuate both trains of CS. Two pushbuttons must be depressed simultaneously to minimize the potential for an inadvertent actuation of CS which could have serious consequences. Each CS pushbutton closes one of the two contacts required to start CS train A and one of the two contacts required to start CS train B; depressing both pushbuttons closes both of the contacts (continued)

INDIAN POINT 3 B 3.3.2 --.15 IRevision 4

1.l ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued) required to start CS train A and both of the contacts required to start CS train B. Two channels (contacts) are required to be Operable for CS train A and two channels (contacts) are required to be Operable for CS train B.

Failure of one manual pushbutton will result in one inoperable channel in both trains.

Note that Manual Initiation of containment spray also actuates Phase B containment isolation and containment ventilation isolation.

b. Containment Spray-Automatic Actuation Logic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

Manual and automatic initiation of containment spray must be OPERABLE in MODES 1,2, and 3 when there is a potential for an accident to occur, and sufficient energy in the primary or secondary systems to pose a threat to containment integrity due to overpressure conditions.

Manual initiation isalso required inMODE 4. even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components inthe event of a DBA. However, because of the number of components actuated on a containment spray, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. InMODES 5 and 6, there is insufficient energy in the primary and secondary systems to result in containment overpressure. In MODES 5 and 6. there is also adequate time for the operators to evaluate unit conditions (continued)

INDIAN POINT 3 B 3.3.2 - 16 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued) and respond,'to mitigate the consequences of abnormal conditions by'manually starting individual components.

c. Containment Spray-Containment Pressure Hi-Hi This signal provides protection against a LOCA or an SLB inside containment. The transmitters (d/p cells) are located outside of containment with the sensing line (high pressure'side-of the transmitter) located inside containment.: The transmitters and electronics are located outside of'containment. Thus.- they will not experience any adverse'environmental conditions and the Allowable Value reflects only steady state instrument uncertainties.

This Function requires'the bistable output to energize to perform its required action. It is not desirable to have a loss of power actuate containment spray, because the consequences of an inadvertent actuation'of containment spray could be serious.

Therefore, the IP3 design consists of 2 sets of 3 channels (i.e., 6 pressure instruments) and 2 channels from each set of 3 are required to energize to actuate Containment Spray. This configuration provides sufficient redundancy to prevent a single failure from causing or preventing Containment Spray initiation even when testing with one inoperable channel already in trip.

The Required Actions for an inoperable channel associated with this Function decreases'the probability of an inadvertent actuation by allowing no more than one channel per set to be placed in trip.

Containment pressure is not used for control; therefore, this arrangement exceeds the minimum redundancy requirements.

o.. .t.u.

(continued)

INDIAN POINT 3 B 3.3.2 -17 R i Revision'4

II ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES. LCO and APPLICABILITY (continued)

Containment Pressure- High High must be OPERABLE in MODES 1. 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break. InMODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to pressurize the containment and reach the Containment Pressure High High setpoint.

3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and selected process systems that penetrate containment. This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.

There are two separate Containment Isolation signals, Phase A and Phase B. Phase A isolation isolates all automatically isolable process lines exiting containment, except component cooling water (CCW) and RCP seal return, at a relatively low containment pressure indicative of primary or secondary system leaks. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required) method of decay heat removal. Since CCW or RCP seal injection and return are required to support RCP operation, not isolating CCW and RCP seal return on the low pressure Phase A signal enhances unit safety by allowing operators to use forced RCS circulation to cool the unit.

Isolating these functions on the low pressure signal may force the use of feed and bleed cooling, which could prove more difficult to control.

Phase A containment isolation is actuated automatically by SI, or manually via the actuation logic. All process lines exiting containment, with the exception of CCW and RCP seal return, are isolated. CCW and RCP seal return are not isolated at this time to permit continued operation of the RCPs with cooling water (continued)

INDIAN POINT 3 B 3.3.2 - 18 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES. LCO and APPLICABILITY (continued) flow to the thermal barrier heat exchangers and oil coolers.

All proces slines not equipped with remote operated isolation valves are manually'closed, or otherwise isolated, prior to MODE 4 except those manual isolation valves needed to support plant operations.

Manual Phase A Containment Isolation is accomplished by either of two pushbuttons in the control room. Either push button actuates both trains.' Note that manual actuation of Phase A Containm-ent'Isolation also actuates Containment Ventilation Isolation.

The Phase B signal isolates CCW and RCP seal return. This occurs at a relatively high containment pressure that is indicative of a large break LOCA or an SLB. For these events.

forced circulation using the RCPs is no longer desirable.

Isolating the CCW at the higher pressure does not pose a challenge to the containment boundary because the CCW System is a closed loop inside containment. Although some CCW system components may not meet all of the ASME Code requirements applied,to the containment itself, the system is continuously pressurized to'a'pressure greater than the Phase B setpoint.

Thus, routine operation demonstrates the integrity of the system pressure boundary for 'pressures exceeding the Phase B setpoint.

Furthermore, because'system pressure exceeds the Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment. Therefore, the combination of CCW System design and Phase B isolation ensures the CCW System is not a potential path for radioactive release from containment.

Phase B containment isolation is actuated by Containment Pressure-High High. or manually, via the actuation logic, as previously discussed. For containment pressure to reach a value high enough to actuate Containment Pressure-High High, a large break LOCA or SLB must have occurred and containment spray must (continued)

INDIAN POINT 3 B 3.3.2 - 19 Revision ..4

A.

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES. LCO and APPLICABILITY (continued) have been actuated. RCP operation will no longer be required and CCW and seal return to the RCPs are, therefore, no longer necessary. The RCPs can be operated with seal injection flow alone and without CCW flow to the thermal barrier heat exchanger.

Manual Phase B Containment Isolation is accomplished by either of two pushbuttons in the control room. Either pushbutton actuates both trains. Manual Phase B Containment Isolation is also initiated by Containment Spray manual pushbuttons. CS pushbuttons are depressed simultaneously, Phase B Containment Isolation and Containment Spray will be actuated in both trains.

a. Containment Isolation-Phase A Isolation (1) Phase A Isolation-Manual Initiation Manual Phase A Containment Isolation is actuated by either of two pushbuttons in the control room.

Either pushbutton actuates both trains. Note that manual initiation of Phase A Containment Isolation also actuates Containment Ventilation Isolation.

(2) Phase A Isolation-Automatic Actuation Logic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

Manual and automatic initiation of Phase A Containment Isolation must be OPERABLE in MODES 1,

2. and 3, when there is a potential for an accident to occur. Manual initiation isalso required in MODE 4 even though automatic actuation is not required.

(continued)

INDIAN POINT 3 B 3.3.2 - 20 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES. LCO and APPLICABILITY (continued)

In this MODE, adequate time is available to manually actuate required components in the event of a DBA.

-but because of the large number of components

'actuated on a Phase A Containment Isolation.

actuation issimplified by the use of the manual actuation push buttons. Automatic actuation logic

-' and actuation relays must be OPERABLE inMODE 4 to support system level manual initiation. InMODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to' require Phase A Containment Isolation. There also is adequate time for the operator to evaluate

'unit conditions and manually actuate individual isolation valves in response to abnormal or accident

.:conditions.,

(3) Phase A Isolation-Safety Injection Phase A Containment Isolation is also initiated by all Functions that initiate SI. The Phase A Containment Isolation requirements for these

' Functions are the same as the requirements for their

-SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.

b. :Containment Isolation-Phase B Isolation Phase B Containment Isolation is accomplished by Manual Initiation', Automatic Actuation Logic and Actuation Relays.

and by Containment Pressure channels (the same channels

.'that actuate Containment Spray, Function 2). The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips that may damage the RCPs.

(continued)

INDIAN POINT 3 B 3.3.2 -;21 R-Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)

(1) Phase B Isolation-Manual Initiation Manual Phase B Containment Isolation is accomplished by either of two pushbuttons in the control room.

Either pushbutton actuates both trains.

(2) Phase B Isolation-Automatic Actuation LoQic and Actuation Relays Manual and automatic initiation of Phase B containment isolation must be OPERABLE in MODES 1,

2. and 3. when there is a potential for an accident to occur. Manual initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a OBA. However, because of the number of components actuated on a Phase B containment isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6. there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase B containment isolation. There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.

(3) Phase B Isolation-Containment Pressure Hi-Hi The basis for containment pressure MODE applicability is as discussed for ESFAS Function 2.c above.

(continued)

INDIAN POINT 3 B 3.3.2 - 22 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)'

4. Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside'or outside containment. Rapid isolation of the steam lines will limit.the steam break accident to the

-blowdown from one SG,' even if Main'Steam Check Valve fails. For an SLB upstream of the main steam isolation valves (MSIVs),

inside or outside of'containment. closure of the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of'the MSIVs.'closure of the MSIVs terminates the accident.

a. Steam-Line Isolation-Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. Each main steam isolation valve' (MSIV) will close if either of two solenoid valves 'inparallel (channel A and channel B) are opened.

The pair of solenoid valves associated with each MSIV are operated by a single switch and there is a separate switch for each MSIV.` Each of these switches actuates two channels. Except for the switch in the control room which is'common to both channels, there are two separate and redundant circuits (channel A and channel B) capable of closing'each MSIV.' Therefore. the LCO requires 2 channels per MSIV and each MSIV is considered a separate Function.

b. Steam Line Isolation-Automatic Actuation Logic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

-Manual and automatic initiation of steam line isolation must be OPERABLE inMODES 1. 2. and 3 when there is sufficient energy in the RCS and SGs to have an SLB or other accident. This could (continued)

INDIAN POINT 3 B 3.3.2 -~23 Revision 4

Ili ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued) result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed. In MODES 4, 5. and 6, there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.

c. Steam Line Isolation-Containment Pressure (Hi-Hi)

This Function actuates closure of the MSIVs in the event of a LOCA or an SLB inside containment to limit the mass and energy release to containment. The transmitters (d/p cells) are located outside containment. Containment Pressure-High-High provides no input to any control functions. The transmitters and electronics are located outside of containment. Thus, they will not experience any adverse environmental conditions, and the Allowable Value reflects only steady state instrument uncertainties.

The IP3 design consists of 2 sets of 3 channels and 2 channels from each set of 3 are required to energize to actuate steam line isolation on high pressure in the containment. This is the same logic that initiates Containment Spray. Therefore, this logic is designed to provide sufficient redundancy to prevent a single failure from causing or preventing Containment Spray initiation even when testing with one inoperable channel already in trip. The Required Action for an inoperable channel associated with this Function is modified by a Note that permits no more than one channel per set to be placed in trip to decrease the probability of an inadvertent actuation.

Containment Pressure-High-High must be OPERABLE in MODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following (continued)

INDIAN POINT 3 B 3.3.2 - 24 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued):

a pipe break. This would cause a significant increase in the-containment pressure, thus allowing detection and closure of the MSIVs.' The Steam Line Isolation Function remains OPERABLE in MODES 2 and 3 unless all MSIVs are closed. ;.In MODES 4. 5, and 6, there is not enough energy in'the primary and secondary sides to pressurize the containment to the Containment Pressure-High-High setpoint.

d, e. Steam Line Isolation_-High Steam Flow inTwo Steam Lines Coincident with TrlsLow or Coincident With Steam Line Pressure-Low These Functions (4.d and 4.e) provide closure of the MSIVs during an SLB or inadvertent opening of a safety valve to limit RCS cooldown and the mass and energy release to containment.

These Functions were discussed previously as Functions 1.e.

and 1.f.'

These'Functions must be OPERABLE in MODES 1 and 2. and in MODE 3, when a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines unless all MSIVs are closed. These Functions are not required to be OPERABLE in MODES 4. 5. and 6 because there is insufficient energy in the secondary side of the unit to have an'accident.

5. Feedwater Isolation The function'of the Feedwater Isolation signal isto stop the excessive flow of feedwater into the SGs. The Function is necessary to mitigate the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive'cooldown of the primary system. The SG high water level is due to excessive feedwater flows.

(continued)

INDIAN POINT 3 B 3.3.2 - 25 R Revision 4

- . _ ~ _ - 1L_

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)

This Function is actuated by SG Water Level-High High or by an SI signal. The RPS also initiates a turbine trip signal whenever a reactor trip is generated. In the event of SI, the unit is taken off line and the turbine generator must be tripped. The MFW System is also taken out of operation and the AFW System is automatically started. The SI signal was discussed previously.

a. Feedwater Isolation-Safety Injection Feedwater Isolation is also initiated by all Functions that initiate SI. Therefore, there are two trains of this Function. one initiated by SI train A and one initiated by SI train B.

b. Feedwater Isolation - Steam Generator Water Level- High High This signal provides protection against excessive feedwater flow. Signals from two-out-of-three channels from any one SG will isolate feedwater flow by closing two MBFPDVs and MBFRVs. The LCO requires three OPERABLE channels per steam generator.

The transmitters (d/p cells) are located inside containment. However, the events that this Function protects against cannot cause a severe environment in containment. Therefore, the Allowable Value reflects only steady state instrument uncertainties.

Feedwater Isolation Functions must be OPERABLE in MODES 1 and 2 except when all MBFPDVs or MBFRVs and associated low flow bypass valves are closed or isolated by a closed manual valve when the MFW System is in operation. In MODES

3. 4. 5, and 6, the MFW System is not in service and this Function is not required to be OPERABLE.

(continued)

INDIAN POINT 3 B 3.3.2 - 26 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)

6. Auxiliary Feedwater The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available. The system has two motor driven pumps and a turbine driven pump, making it available during normal unit operation, during a loss of AC power and during a loss of MFW. The normal source of water for the AFW System-is the condensate storage tank (CST). Additionally, City Water (CW) may be aligned to AFW to provide a backup water supply. The AFW System is aligned so that upon a motor driven pump start, flow is initiated to the respective SGs immediately.

a. Auxiliary Feedwater-Automatic Actuation Logic and Actuation Relays Automatic actuation logic and actuation relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.

b. Auxiliary Feedwater-Steam Generator Water Level-Low Low SG Water Level-Low Low provides protection against a loss of heat sink due to a loss of MFW and the resulting loss of SG water level.

Signals from two-out-of-three channels from any one SG will start the motor driven AFW pumps. Signals from two-out-of-three channels from any two SGs will start the steam driven AFW pump'.'.The'LCO requires three OPERABLE channels per steam generator.

(continued)

INDIAN POINT 3 B 3.3.2 - 27 RRevision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)

With the transmitters (d/p cells) located inside containment and thus possibly experiencing adverse environmental conditions, the Allowable Value reflects the inclusion of both steady state and adverse environmental instrument uncertainties.

c. Auxiliary Feedwater-Safety Injection An SI actuation starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.

d. Auxiliary Feedwater-Loss of Offsite Power A turbine trip in conjunction with a loss of offsite power to the safeguards buses will be accompanied by a loss of reactor coolant pumping power and the subsequent need for some method of decay heat removal. The loss of offsite power (Non SI blackout signal) is detected by a voltage drop on 480 V bus 3A and/or 6A. After the OG breaker closes and the bus has voltage, either safeguards bus will start the turbine driven AFW pump 32 together with operator action to ensure that at least one SG contains enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip with loss of offsite power.

The LCO requires two OPERABLE channels, one OPERABLE channel for bus 3A and one OPERABLE channel for bus 6A.

Either channel will start the turbine driven AFW pump.

Therefore, a single failure of one channel of non-Safety Injection blackout sequence will not result in a loss of Function.

(continued)

INDIAN POINT 3 B.3.3.2 - 28 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES. LCO and APPLICABILITY (continued)

-Functions 6.a through 6.d must be OPERABLE in MODES 1. 2.

and 3 to ensu're'that the SGs remain the heat sink for the reactor.' SG Water Level- Low Low in any operating SG will cause the motor driven AFW pump to start. The system is aligned so that upon a start of the pump, water immediately begins'to flow to the SGs. SG Water Level -Low Low in any two operating SGs will cause the turbine driven pump to start. These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to-require the SGs as a heat sink. In MODE 4.

AFW actuation'ddes not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation!to'remove decay heat or sufficient time is available to manually place either system in operation.

The Allowable Value for this Function is based on anticipated 480 V bus voltage transient conditions to prevent spurious trips and needless disconnection of safety buses from preferred power (Offsite Power). The analytical limit for event analysis purposes is 0 Volts AC (i.e.

complete loss of offsite power). The Allowable Value is

'therefore is conservative relative to the actual operability limit.

e. Auxiliary Feedwater-Trip of'Main Feedwater Pumps A'Trip of-either MBFW pump is an indication of a potential loss of MFW and the potential need for some method of decay heat and sensible heat'removal to bring the reactor back to no load temperature and pressure. Each turbine driven MBFW pump is equipped with a pressure switch on the control oil line for the speed control system. A low pressure signal

'from this'pressure'switch indicates a trip of that pump.

The'single'channel associated with each operating MBFP will start both'motor'driven AFW pumps. However, there is no single failure tolerance for this Function unless both MBFPs are operating.

(continued)

INDIAN POINT 3 B 3.3.2 - 29 Revisio6; 4'

- L ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO and APPLICABILITY (continued)

This is acceptable because this is a backup method for starting AFW and other Functions, in particular SG Water Level- Low Low, provide the primary protection against a loss of heat sink. The LCO requires one Operable channel for each operating MBFP. A trip of either MBFW pump starts both motor driven AFW pumps to ensure that at least one SG is available with water to act as the heat sink for the reactor.

Function 6.e must be OPERABLE in MODES 1 and 2. This ensures that at least one SG is provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of loss of normal feedwater. In MODES 3, 4, and 5. the MBFW pumps are shut down, and thus MBFW pump trip does not require automatic AFW initiation.

7. ESFAS Interlock-Pressurizer Pressure The Pressurizer Pressure interlock permits a normal unit cooldown and depressurization without actuation of SI. With two-out-of-three pressurizer pressure channels (discussed previously) less than the setpoint, the operator can manually block the Pressurizer Pressure-Low SI signal. With two-out-of-three pressurizer pressure channels above the setpoint. the Pressurizer Pressure-Low SI signal is automatically enabled.

The operator can also enable these trips by use of the respective manual blocking switches.

This Function must be OPERABLE in MODES 1. 2, and 3 to allow an orderly cooldown and depressurization of the unit without the actuation of SI. The interlock Functions back up manual actions to ensure bypassable functions are in operation under the conditions assumed in the safety analyses. This Function does not have to be OPERABLE in MODE 4. 5, or 6 because system pressure must already be below the setpoint for the requirements of the heatup and cooldown curves to be met.

(continued)

INDIAN POINT 3 B 3.3.2 - 30 Revision 4

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES. LCO and APPLICABILITY (continued)

The surveillance acceptance criterion for this function is <1884 psig.

The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36.

ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1.

In the'event a channel's trip setpoint is found nonconservative with respect'to'the'Allowable Value, or the transmitter, instrument Loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and'the LCO-Condition(s) entered for the protection Function(s) affected. When the Required Channels in Table 3.3.2-1 are specified (e.g., on a per-steam line, per loop, per SG. etc.. basis).

then thetCondition may be entered separately for each steam line, loop, SG. etc.. as appropriate.

When the number of inoperable channels in a trip function exceed those specified in one or:other related Conditions associated with a trip function, then the unit is outside the safety analysis. Therefore, LCO 3.0.3 should be immediately entered'if applicable in the current MODE of operation.

AN1 Condition A applies to all ESFAS protection functions.

Condition A addresses the situation where oneor'more channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.

(continued)

. 1.

INDIAN POINT 3 B 3.3.2 -'31 Revision 4

ESFAS Instrumentation B 3.3.2 BASES ACTIONS B.1. B.2.1 and B.2.2 (continued)

Condition B applies to manual initiation of:

SI;

Containment Spray;

Phase A Isolation; and

Phase B Isolation.

This action addresses the train orientation of the relay logic for the functions listed above. If a channel or train is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to return it to an OPERABLE status. Note that for containment spray and Phase B isolation, failure of one or both channels in one train renders the train inoperable. Condition B.

therefore, encompasses both situations.

The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each Function, and the low probability of an event occurring during this interval. If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (54 hours6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months total time) and in MODE 5 within an additional 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months (84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months total time). The allowable Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1. C.2.1 and C.2.2 Condition C applies to the automatic actuation logic and actuation relays for the following functions:

SI; (continued)

INDIAN POINT 3 B 3.3.2 - 32 Revision 4

ESFAS Instrumentation B 3.3.2 BASES ACTIONS C.1. C.2.1 and C.2.2 '(continued)

. Containment Spray;-

- Phase'A Isolation; and

. Phase B Isolation.

This action'addresses the train orientation of the relay logic and the master and slave relays. Ifone train is'inoperable. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the train to OPERABLE status. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low'probability of an event occurring during this interval. If the'train 'cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit'in at-least MODE 3 within an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months total.time) and in MODE 5 within an additional 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months (42 hours4.861111e-4 days 0.0117 hours 6.944444e-5 weeks 1.5981e-5 months total'time). The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions In an orderly manner and without challenging unit 'systems.

The Required Actions-are modified by' Note that allows one train to be bypassed .for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing, provided the other train Is OPERABLE.

D.1. D.2.1 and D.2.2 Condition D applies to:

. Containment Pressure-High;

' Pressurizer Pressure-Low'

.High Differential Pressure Between Steam Lines:

High Steam Flow in Two Steam Lines Coincident With Tavg-Low or Coincident With Steam Line Pressure-Low; and (continued)

INDIAN P.OINT 3 B 3.3.2 - 33 e si.on-4 '

Revi

- - -- i ESFAS Instrumentation B 3.3.2 BASES ACTIONS D.1. 0.2.1 and D.2.2 (continued)

SG Water level-Low Low.

If one channel is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the channel to OPERABLE status or to place it in the tripped condition.

Generally this Condition applies to functions that operate on two-out-of-three logic. Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.

Required Actions associated with High Steam Flow in Two Steam Lines Coincident With Tavg-Low or Coincident With Steam Line Pressure-Low are entered by treating Steam Flow, Tavg, and Steam Line Pressure as three separate Functions. The protective action is initiated on one-out-of-two high flow in any two-out-of-four steam lines if there is one-out-of-one low Tavg trip in any two-out-of-four RCS loops, or if there is a one-out-of-one low pressure trip in any two-out-of-four steam lines. This logic is acceptable because a single steam line fault will cause the remaining intact steam lines to pick up the full turbine load with the protective action initiated by the conditions in the non faulted steam lines. Therefore, a maximum of one channel of each of the three Functions may be placed in trip without creating a condition where a single failure will either cause or prevent the protective action.

Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

In MODE 4. these Functions are no longer required OPERABLE.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing of other channels.

(continued)

INDIAN POINT 3 B 3.3.2 - 34 Revision 4

ESFAS Instrumentation B 3.3.2 BASES ACTIONS D.1. D.2.1 and D.2.2 (continued)

The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months s-allowed'to restore the channel to OPERABLE status or to place the inoperable chajhnel in the tripped condition, is justified in Reference 7. -

E.1. E.2.1 and E.2.2 Condition' E applies to:

Steam Line Isolation Containment Pressure-(High High);

Containment Spray Containment Pressure-(High, High); and

Containment Phase B Isolation Containment Pressure-(High, High).

The IP3 design for the Containment Pressure (High High) ESFAS Function consists of 2 sets of 3 channels. This design requires that 2 channels from each set of 3 are energized to actuate the Containment Spray or Steam Line Isolation Functions. This configuration provides sufficient redundancy to prevent a single failure from causing or preventing containment spray initiation or steamline isolation even when testing with one inoperable channel per set already in trip.

Note that Condition'E applies only when no'more than one channel in one or both'sets is inoperable. Otherwise, entry into LCO 3.0.3 is required. This is required because two'inoperable channels from the same set that fail low could result in a loss of containment spray initiation or'steamline isolation when a Containment Pressure (High High) ESFAS initiation' is required. Additionally, this ensures that no more than one6channel per set can be placed in trip which is required to decrease the piobability'6f an inadvertent actuation of containment'spray or steamline isolation 'if 'additional channels fail high."

'An inoperable channel is plaiced in trip within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to limit the amount of time that a: single'failure of a different channel on the same set could result intthe failure of containment spray or steamline isolation to actuate.

(continued)

INDIAN POINT 3 B 3.3.2 35 Revision 4

- it-ESFAS Instrumentation B 3.3.2 BASES ACTIONS E.1. E.2.1 and E.2.2 (continued)

With no more than one channel from each set in trip, a single failure will not cause or prevent containment spray initiation or steamline isolation. Failure to place an inoperable channel in trip within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4. these Functions are no longer required OPERABLE.

The Required Actions are modified by a Note that allows one additional channel to be bypassed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing.

F.1. F.2.1 and F.2.2 Condition F applies to:

Manual Initiation of Steam Line Isolation: and

Loss of Offsite Power (Non Safety Injection).

For the manual MSIV isolation Function, each MSIV will close if either of the two channels required per MSIV is tripped. If one channel is inoperable, the ability to tolerate a single failure is lost but manual isolation capability is maintained. Therefore, an inoperable channel cannot be placed in trip without causing an actuation and the inoperable channel must be restored to Operable to restore single failure protection. Additionally, since a single switch actuates both channels for each MSIV, the failure of a manual switch may result in the failure of both channels and a loss of Function. The specified Completion Time, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to restore an inoperable channel. is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each MSIV, and the low probability of an event occurring during this interval. Each MSIV is considered a separate Function.

(continued)

INDIAN POINT 3 B 3.3.2 - 36 Revision 4

ESFAS Instrumentation B 3.3.2 BASES ACTIONS F.1. F.2.1 and F.2.2 (continued)

For the Loss of Offsite-Power (Non-Safety Injection) Function, either channel (bus 3A or bus'6A) will start the turbine driven AFW pump. If one channel is inoperable, the AFW starting Function for the turbine driven'AFW pump on loss of offsite power is maintained by the channel associated with the other bus. Two inoperable channels result in a loss of this'Function; therefore, entry into 'LCO 3.0.3 is required.

For the Loss of Offsite Power (Non-Safety Injection) Function, an inoperable channel cannot be placed in trip without causing an actuation: therefore, an'inoperable channel must be restored to Operable. The specified Completion Time, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to restore an inoperable channel, is reasonable considering that this is a Non-Safety Injection start of the AFW, the availability of manual starting capability, and thellow probability of.an event occurring during this interval. Additionally, other Functions,Ain particular SG Water Level-Low Low, provide the primary protection against a loss of heat sink.

If either of these Functions cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following'6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. -InMODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.

G.1. G.2.1 and G.2.2 Condition 'G applies to the automatic actuation logic and actuation relays for the Steam Line Isolation and AFW actuation Functions.

'The action addresses the train orientation of the relay logic and the actuation relays for these functions.' If one train is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the train to OPERABLE status. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low (continued)

INDIAN.POINT 3 B 3.3.2 Revision 4

ESFAS Instrumentation B 3.3.2 BASES ACTIONS G.1. G.2.1 and G.2.2 (continued) probability of an event occurring during this interval. Ifthe train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months unless the plant can be placed outside of the Applicable MODE or Conditions by other means (e.g., shutting all MSIVs). The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of the protection channels and actuation functions. In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.

The Required Actions are modified by a Note that allows one train to be bypassed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing provided the other train is OPERABLE.

H.1 and H.2 Condition H applies to the automatic actuation logic and actuation relays for the Feedwater Isolation Function.

This action addresses the train orientation of the relay logic and the actuation relays for this Function. Ifone train is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months unless the plant can be placed outside of the Applicable MODE or Conditions by other means (e.g., shutting all MBFPDVs or MBFRVs and associated bypass valves). The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions inan orderly manner and without challenging unit systems. These Functions are no (continued)

INDIAN POINT 3 B 3.3.2 - 38 Revision 4

ESFAS Instrumentation B 3.3.2 BASES ACTIONS H.1 and H.2 (continued) longer required in MODE 3. Placing the unit in MODE 3 removes all requirements for OPERABILITY of the pr6tection'channels and actuation functions.- In this MODE, the'unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.

The Required Actions are modified by a Note that allows one train to be bypassed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing provided the other train is OPERABLE.

1.1. I.2 and J.1 !

Condition I applies to the AFW pump start on trip of either Main Boiler Feedwater pump..".

The OPERABILITY of the AFW System must be assured by allowing automatic start of the AFW System pumps. The single channel associated with each operating MBFP will start both motor driven AFW pumps.

However, there is no single failure tolerance for this Function unless both MBFPs are operating. Therefore, when a channel is inoperable, Required Action I.1. verifies that one channel'associated with an operating MBFP is OPERABLE to ensure that there is no loss of function. Otherwise, entry into LCO 3.0.3 is required. If both MBFPs are operating. Required Action I.2 allows 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to restore redundancy by requiring one channel associated with each operating MBFP to be OPERABLE. Continued operation without redundant channels for 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is acceptable'because this is a backup method for starting AFW and other Functions, in particular SG Water Level -Low' Low, provide the primary protection against a loss of heat sink.

If the function cannot be returned to an OPERABLE status, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed by Required Action J.1 to place the unit in MODE 3.

(continued)

INDIAN POINT 3 B 3.3.2!- 39R Revi sion'4

IL ESFAS Instrumentation B 3.3.2 BASES ACTIONS I.1. I.2 and J.1 (continued)

The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3. the unit does not have any analyzed transients or conditions that require the explicit use of the protection function noted above.

K.1. K.2.1 and K.2.2 Condition K applies to the Pressurizer Pressure interlock.

With one or more channels inoperable, the operator must verify that the interlock is in the required state for the existing unit condition. This action manually accomplishes the function of the interlock. Determination must be made within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is equal to the time allowed by LCO 3.0.3 to initiate shutdown actions in the event of a complete loss of ESFAS function.

If the interlock is not in the required state (or placed in the required state) for the existing unit condition, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of this interlock.

SURVEILLANCE REQUIREMENTS The SRs for each ESFAS Function are identified by the SRs column of Table 3.3.2-1.

A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions.

Note that each channel of process protection supplies both trains of the ESFAS. When testing an individual channel, the SR is not met until both train A and train B logic are tested.

(continued)

INDIAN POINT 3 B 3.3.2 - 40 Revision 4

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)

The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in the setpoint methodology described in Reference 6.

SR 3.3.2.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.,:

Agreement criteria are' determined by the unit staff, based on a combination of the channel'instrument uncertainties, including indication and reliability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. '

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.2.2 SR 3.3.2.2 isthe performance of an ACTUATION LOGIC TEST. The relay logic is tested every 311days on a STAGGERED TEST BASIS. The train being tested is'placed in the bypass condition,;thus preventing inadvertent actuation. -;Al1Apossible logic combinations are tested for each protection function6required in Table 3.3.2-1. Inaddition, the master relay is tested.

(continued)

INDIAN POINT 3 B 3.3.2 - 41 Revision 4

- ls ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS SR 3.3.2.2 (continued)

This verifies that the logic modules are OPERABLE and that there is a voltage signal path to the master relay coils. The Frequency of every 31 days on a STAGGERED TEST BASIS is adequate. It is based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.2.3 SR 3.3.2.3 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a low voltage continuity check of the slave relay coil.

Upon master relay contact operation, a low voltage is supplied to the slave relay coil. This voltage is insufficient to pick up the slave relay, but large enough to demonstrate signal path continuity. This test is performed every 31 days on a STAGGERED TEST BASIS. The time allowed for the testing (8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) and the surveillance interval are justified in Reference 7.

SR 3.3.2.4 SR 3.3.2.4 is the performance of a COT.

A COT is performed on each required channel to ensure the entire channel (with the exception of the transmitter sensing device) will perform the intended Function. Setpoints must be found within the calibration acceptance criteria.

The "as found" and Was left" values must also be recorded and reviewed. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology. The setpoint shall be left set consistent with the assumptions of the current unit specific setpoint methodology (Ref. 6).

The Frequency of 92 days is justified in Reference 7.

(continued)

INDIAN POINT 3 B 3.3.2 - 42 Revision 4

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.5 SR 3.3.2.5 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is tve one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is placed in a condition where'the circuit operation can be verified without operation of the equipment. Actuation equipment that may not be operated in the design mitigation MODE is prevented from operation.

Alternately, contact operation may be verified by a continuity check of the circuit containing the slave relay. This test is performed every 24 months. The Frequency is adequate, based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.2.6 SR 3.3.2.6 is-the performance of a TADOT. This test is a check of the Manual Actuation Functions and AFW pump start on trip of either MBFW pump or loss of offsite power (non SI). It is performed every 24 months. Each Manual Actuation Function is tested up to, and including, the master relay coils. Insome instances, the test includes actuation ofthe end device (i.e., pump starts, valve cycles, etc.). The Frequency is adequate, based on industry operating experience and is consistent with the typical refueling cycle. The SR is modified by a Note that excludes verification'of setpoints during the TADOT for manual initiation Functions. The manual initiation Functions have no associated setpoints.

(continued)

INDIAN POINT 3 B 3.3.2 - 43 Revision 4

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.7 SR 3.3.2.7 is the performance of a CHANNEL CALIBRATION.

A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology (Ref. 6). The difference between the current 'as found' values and the previous test *as left" values must be consistent with the drift allowance used in the setpoint methodology.

The Frequency of 24 months is based on the assumption of an 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint methodology.

This SR is modified by a Note stating that this test should include verification that the time constants are adjusted to the prescribed values where applicable.

REFERENCES 1. FSAR, Chapter 6.

2. FSAR, Chapter 7.

3. FSAR, Chapter 14.

4. IEEE-279-1968.

5. 10 CFR 50.49.

6. Engineering Standards Manual IES-3 and IES-3B, Instrument Loop Accuracy and Setpoint Calculation Methodology (IP3).

(continued)

V.--.

INDIAN POINT 3 B 3.3.2 - 44 Revision 4

ESFAS Instrumentation B 3.3.2 BASES REFERENCES 7. WCAP-10271-P-A. Supplement 2, Rev. 1, June 1990.

(continued)

8. Consolidated Edison Company of New York, Inc. Indian Point Nuclear Generating Station Unit No. 3 Plant Manual Volume VI:

Precautions, Limitations, and Setpoints, March 1975.

9. Safety Evaluation Report (SER) for IP3 Amendment 224.

I

-1 INDIAN POINT 3 B 3.3.2 - 45 Revision 4

Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 B 3.3 INSTRUMENTATION B 3.3.6 Containment Purge System and Pressure Relief Line Isolation Instrumentation BASES BACKGROUND Containment purge system and pressure relief line isolation instrumentation closes-the containment isolation valves in the Pressure'Relief Line and the Containment Purge System. This action isolates the containment atmosphere from the environment to minimize relea'ses'of radioactivity in the event'of'an accident. The Containment Pressure Relief Line may be in use during reactor

operation and the Containment Purge System maybe in use with the reactor shutdown. -

The Containment Purge System consists of the 36-inch containment purge supply and exhaust penetrations. The containment purge supply and exhaust penetrations'bach include two butterfly valves for isolation.

The containment purge exhaust penetration includes two butterfly valves for isolation and can be aligned to discharge to the atmosphere through the plant vent either directly or through the Containment Purge Filter System (i.e.. a filter bank with roughing, HEPA and' charcoal filters).

The Containment Purge System is isolated when in Modes 1. 2, 3 and 4 in accordance with requirements established in LCO 3.6.3. Containment Isolation Valves. In Modes 5 and 6. the Containment Purge System may be used for containment ventilation. When open, the Containment Purge System isolation valves are'automatically closed when high radiation levels are detected by the Containment Air'Particulate Monitor (R-11) or Containment Radioactive Gas Monitor (R-12).

The Containment Purge System isolation capability is not credited for ensuring that 10CFR 50.67 limits are not exceeded during a fuel handling event (Ref.. 2).

The Containment Pressure Relief Line (i.e., Containment Vent) consists

-of a single 10-inch containment vent line that is used to handle

-normal pressure changes in-the'Containment when inModes 1. 2. 3 and 4.: The Containment Pressure'Relief Line is'equipped with three quick-closing butterfly type isolation valves, one inside and two outside (continued)

INDIAN POINT 3 B 3.3.6'- 1 Revis'ion 1

_ _ _ it-Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASES BACKGROUND the containment which isolate automatically as part of Safety (continued) Injection ESFAS signal (LCO 3.3.2, Function 1) and Containment Spray ESFAS signal (LCO 3.3.2, Function 2). Automatic isolation of the Containment Pressure Relief Line is also initiated when high radiation levels are detected by the Containment Air Particulate Monitor (R-11) or Containment Radioactive Gas Monitor (R-12).

Both the Containment Purge supply and exhaust isolation valves (FCV-1170. FCV-1171, FCV-1172, and FCV-1173) and the containment pressure relief isolation valves (PCV-1190. PCV-1191, and PCV-1192) close when high radiation levels are detected by the Containment Air Particulate Monitor (R-11) or Containment Radioactive Gas Monitor (R-12). The Safety Injection ESFAS signal (LCO 3.3.2. Function 1) and Containment Spray ESFAS signal (LCO 3.3.2. Function 2) also cause closure of the Containment Purge isolation valves and the containment pressure relief isolation valves. Although not required to satisfy Technical Specification requirements, containment purge and containment pressure relief are also isolated when high radiation levels are detected in the plant vent.

APPLICABLE SAFETY ANALYSES In MODE 1. 2, 3 or 4. Containment Purge System automatic isolation capability is not required because the Containment Purge System is isolated in accordance with the requirements of LCO 3.6.3. Containment Isolation Valves.

During CORE ALTERATIONS or movement of irradiated fuel in the containment, Containment Purge System automatic isolation capability is required because it provides for automatic containment isolation in response to a fuel handling accident. Although Containment Purge System isolation capability is not required to meet 10 CFR Part 50.67 limits during a fuel handling accident, this function provides a backup to the filtering function assumed in the analysis and is required to provide containment isolation following the event.

In MODE 1, 2. 3 or 4, Containment Pressure Relief Line automatic isolation capability is required as part of the containment isolation function initiated by the Engineered Safety Feature Actuation System (ESFAS) Instrumentation required by LCO 3.3.2. Containment Pressure Relief Line automatic isolation when high radiation levels are detected by the Containment Air Particulate Monitor (R-11) or Containment Radioactive Gas Monitor (R-12) provides a backup to the closure initiated by the ESFAS system.

(continued)

INDIAN POINT 3 B 3.3.6 - 2 Revi sion 1

-Containment Purge7System'arid Pressure Relief Line Isolation Instrumentation B 3.3.6 BASES APPLICABLE SAFETY ANALYSES (continued)

The containment purge system and pressure relief line isolation

'instrumentation satisfies Criterion 3 of 10 CFR 50.36.

LCO' The'LCO requirements ensure that the instrumentation listed in Table 3.3.6-1, is!OPERABLE. This instrumentation is required to initiate automatic-isolation of the Containment Purge System and the Containment'Pressur'e Relief Line.

1. Automatic Actuation Logic and Actuation Relays The LCO requires two trains of Automatic Actuation Logic and Actuation RelaysOPERABLE to ensure that no single random failure can prevent'automatic actuation.

Automatic Actuation Logic and Actuation Relays are required to be OPERABLE to support the Operability of all of the required functions that isolate the containment purge system and pressure relief line (i.e., gaseous and particulate radiation monitors (R-11-and R-12) and ESFAS SI and containment spray initiation signals). :The term Automatic Actuation Logic and Actuation Relays applies to those portions of the-circuit that are: 1) common to more than one channel in one train of a single function (i.e.. the automatic actuation logic); or. 2) the initiating relay contacts in one train responsible for actuating the equipment and which are common to more than one channel of a single function and more than one function (i.e., the actuation relays). There are two trains of automatic actuation logic and actuation relays for the containment purge system and pressure relief line. "

If one or more'of the SI or Containment Spray Functions becomes inoperable'in'such a manner that only the Containment Purge Isolation Function is affected, the Conditions applicable to their SI and Containment Spray Functions need not be entered.

The less restrictive Actions specified for inoperability of the Containment Purge System and Pressure Relief Line Isolation Functions specify sufficient compensatory measures for this case.

(continued)

INDIAN POINT 3 B 3.3.6 '-3' Revision 1

____ _ - - H-Containment Purge System and Pressure-Relief Line Isolation Instrumentation B 3.3.6 BASES LCO (continued)

2. Containment Radiation Monitors The LCO specifies two required channels of radiation monitors to ensure that the radiation monitoring instrumentation necessary to initiate Containment Purge System Isolation remains OPERABLE.

The requirement for two channels is satisfied by the Containment Air Particulate Monitor (R-11) and the Containment Radioactive Gas Monitor (R-12). Allowable values and setpoints for these Functions are specified in the IP3 Offsite Dose Calculation Manual (Ref. 3).

Channel OPERABILITY involves more than OPERABILITY of the channel electronics. OPERABILITY may also require correct valve lineups, sample pump operation, and filter motor operation, as well as detector OPERABILITY, if these supporting features are necessary for trip to occur under the conditions assumed by the safety analyses.

3. ESFAS Function 1. Safety Iniection. and ESFAS Function 2.

Containment Spray Monitors Refer to LCO 3.3.2. Functions 1 and 2, for all initiating Functions and requirements.

APPLICABILITY In MODE 1, 2. 3 or 4, Containment PurQe System automatic isolation capability is not required because the Containment Purge System is isolated in accordance with the requirements of LCO 3.6.3, Containment Isolation Valves.

During CORE ALTERATIONS or movement of irradiated fuel in the containment, Containment Purge System automatic isolation Function 1, Automatic Actuation Logic and Actuation Relays, and Function 2, Containment Radiation, are required to be OPERABLE to ensure Containment Purge System isolation in response to a fuel handling accident.

(continued)

INDIAN POINT 3 B 3.3.6 - 4 Revision 1

Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASES APPLICABI LITY (continued)

InMODE 1,2, 3 or 4. Containment Pressure Relief Line automatic isolation Function l. Automatic Actuation Logic and Actuation Relays, and Function 3. ESFAS Safety Injection and ESFAS Containment Spray, are required as part of the containment isolation function initiated by the Engineered Safety Feature Actuation System (ESFAS)

Instrumentation required by LCO 3.3.2 Containment Pressure Relief Line automatic isolation Function 2, Containment Radiation, is required as a backup to the closure initiated by the ESFAS system.

While in MODES 5 and 6 without fuel handling in progress, the containment purge system and pressure relief line isolation instrumentation'need not be OPERABLE since the potential for radioactive releases is minimized and operator action is sufficient to ensure post accident offsite doses are maintained within the limits of 10 CFR 50.67.

ACTIONS The most common cause 'of channel inoperability is outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by unit specific calibration procedures. Typically, the drift is found to be small and results'in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a COT, when the process instrumentation is set up for adjustment to bring it within specification. Ifthe Trip Setpoint is less conservative than the tolerance specified by the calibration'procedure, the channel must be declared inoperable immediately and the appropriate Condition entered.

A Note has been added to the ACTIONS tioclarify the application of Completion Time rules.: The Conditions of this Specification may be entered independently for each Function listed inTable 3.3.6-1. The Completion Time(s) of the'inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.'

Ad Condition A applies to the failure of either the R-11 or the R-12 radiation monitor channel. Since the two containment radiation monitors measure different parameters, failure of a single channel may result in delay of the radiation monitoring Function for certain (continued)

INDIAN POINT 3 B 3.3.6 - 5 Revision 1

.~~ ~-- M-Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASES ACTIONS (continued) A.1 (continued) events. However. 7 days is allowed to restore the affected channel because the containment radiation monitoring function is not the primary method of ensuring that 10 CFR limits are not exceeded.

B.1 Condition B applies to all Containment Pressure Relief Line Isolation Functions and addresses the train orientation of these Functions. It also addresses the failure of both radiation monitoring channels, or the inability to restore a single failed channel to OPERABLE status in the time allowed for Required Action A.1.

If a train is inoperable, multiple channels are inoperable, or the Required Action and associated Completion Time of Condition A are not met, operation may continue as long as the Required Action for the applicable Conditions of LCO 3.6.3 is met for each valve made inoperable by failure of isolation instrumentation. A Note is added stating that Condition B is only applicable in MODE 1, 2, 3. or 4.

C.1 and C.2 Condition C applies to all Containment Purge System Isolation Functions and addresses the train orientation of these Functions. It also addresses the failure of both radiation monitoring channels, or the inability to restore a single failed channel to OPERABLE status in the time allowed for Required Action A.1. If a train is inoperable, multiple channels are inoperable, or the Required Action and associated Completion Time of Condition A are not met, operation may continue as long as the Required Action to place and maintain Containment Purge System isolation valves in their closed position is met or the applicable Conditions of LCO 3.9.3. Containment Penetrations," are met for each valve made inoperable by failure of isolation instrumentation. The Completion Time for these Required Actions is Immediately.

A Note states that Condition C is applicable during CORE ALTERATIONS and during movement of irradiated fuel assemblies within containment.

(continued)

INDIAN POINT 3 B 3.3.6 - 6 Revision I

Containment Purge System iaid'Pressure Relief Line Isolation Instrumentation B 3.3.6 BASES SURVEILLANCE REQUIREMENTS A Note has been added to the SR Table to clarify that Table 3.3.6-1 determines which SRs apply to which Containment Purge System and Pressure Relief Line Isolation Functions.

SR 3.3.6.1 Performance of the'CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that a gross failure of 'instrumentation has not occurred, and a CHANNEL CHECK will detect gross channel'failure; thus,'it is key to verifying the instrumentation continues to operate -properly between each CHANNEL CALIBRATION. A CHANNEL CHECK for a single channel instrument is satisfied by verification that the sensor or the signal processing equipment has not'drifted outside its limits.

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. Ifa channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency is based'on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal.

but more frequent, checks of channels during normal operational use of the displays associated with the LCO required-channels.

SR 3.3.6.2 SR 3.3.6.2 is the performance of an ACTUATION LOGIC TEST. This test is performed every 31 days on a STAGGERED TEST BASIS. The Surveillance interval is acceptable based on instrument reliability and industry operating experience.

SR 3.3.6.3 A COT isperformed every 92 days on each radiation monitoring channel to ensure the entire'channel'will perform the intended Function.This test verifies the capability of the instrumentation to provide the containment purge system and pressure relief line isolation. The setpoint shall be left consistent with the current unit specific calibration procedure tolerance.

(continued)

INDIAN POINT 3 B 3.3.6 - 7 Rio Revision 1

_1.

Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.6.4 SR 3.3.6.4 is the performance of a TADOT. This test is a check every 24 months that includes actuation of the end device (i.e.. valve cycles. etc.).

The test also includes trip devices that provide actuation signals directly to the actuation instrumentation, bypassing the analog process control equipment. The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Functions tested have no setpoints associated with them.

The Frequency is based on the known reliability of the Function and the redundancy available, and has been shown to be acceptable through operating experience.

SR 3.3.6.5 A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. Allowable values and setpoints for these Functions are specified in the IP3 Offsite Dose Calculation Manual (Ref. 3).

The Frequency is based on operating experience and is consistent with the typical industry refueling cycle.

REFERENCES 1. FSAR Chapter 14.

2. Safety Evaluation Report (SER) for IP3 Amendment 224.

I

3. IP3 Offsite Dose Calculation Manual.

INDIAN POINT 3 B 3.3.6 - 8 Revision 1

CRVS Actuation Instrumentation B 3.3.7 B 3.3 INSTRUMENTATION B 3.3.7 Control Room Ventilation System (CRVS) Actuation Instrumentation BASES BACKGROUND .The CRVS provides a pressurized control room environment from which

'the unit can be operated following an uncontrolled release of radioactivity. During CRVS Mode 2 (normal operation), the CRVS provides control room ventilation by introducing a supply of outside air via Damper A. Upon receipt of an actuation signal, the CRVS initiates filtered ventilation and pressurization of the control room CRVS Mode 3'(10% In'cident'Mode) by closing of Damper A and opening of Damper B. This system is'described inthe Bases for LCO 3.7.11 (Ventilation), 'Control Room Ventilation System."

The control room operator can place the'CRVS in the CRVS Mode 3 (10%

incident mode) described in the Bases for LCO 3.7.11. by manual mode I selector'switch ini the control room. The CRVS is also actuated by a safety injection (SI) signal. The SI Function is discussed in LCO 3.3.2. "Engineered Safety Feature Actuation System (ESFAS)

Instrumentation."

On a Safety Injection signal or high radiation in the Control Room (Radiation Monitor R-1), the CRVS will actuate to the incident mode with outside air makeup CRVS Mode 3 (i.e., 10% incident mode). This I will cause one of the two'filters booster fans to start, the locker room exhaust fan to stop, and CRVS dampers to open or close as necessary to filter incoming outside. In the event that the first booster fan fails to start, the second booster fan will start after a predetermined time delay.'

If for any reason It Is required or desired to operate with 100%

recirculated air (e.g..`toxic gas condition is identified), the CRVS can be placed.in the incident mode with no outside air makeup CRVS Mode 4 (1.'e.,-100% recirculation mode) by remote manually operated switches. The Firestat detector will also initiate CRVS Mode 4 and trips both 31 and 32 CCR A/C units; (continued)

INDIAN POINT 3 B 3.3.7 - I Revisio.n'l

I I-CRVS Actuation Instrumentation B 3.3.7 BASES APPLICABLE SAFETY ANALYSES The control room must be kept habitable for the operators stationed there during accident recovery and post accident operations.

The CRVS acts to initiate filtration, and pressurize the control room.

These actions are necessary to ensure the control room is kept habitable for the operators stationed there during accident recovery and post accident operations by minimizing the radiation exposure of control room personnel.

In MODES 1, 2. 3, and 4. SI signal actuation ensures initiation of the CRVS during a loss of coolant accident or steam generator tube rupture.

Radiation monitor R-1 is not required for the Operability of the Control Room Ventilation System because control room isolation is initiated by the safety injection signal in MODES 1, 2, 3 and 4 and control room isolation is not credited for maintaining radiation exposure within General Design Criteria 19 limits following a fuel handling accident or gas-decay-tank rupture (Ref. 2).

The CRVS does not actuate automatically in response to toxic gases.

Separate chlorine, ammonia and oxygen probes are provided to detect the presence of these gases in the outside air intake. Additionally, monitors in the Control Room will detect low oxygen levels and high levels of chlorine and ammonia. The CRVS may be placed in the incident mode with no outside air makeup (i.e., CRVS Mode 4 100%

recirculation mode) to respond to these conditions. Instrumentation for toxic gas monitoring is governed by the IP3 Technical Requirements Manual CTRM) (Ref. 1).

Note that the original CRVS design was not required to meet single failure criteria and, although upgraded from the original design, CRVS does not satisfy all requirements in IEEE-279 for single failure tolerance.

The CRVS actuation instrumentation satisfies Criterion 3 of 10 CFR 50.36.

(continued)

INDIAN POINT 3 B 3.3.7 - 2 Revision 1

CRVS Actuation Instrumentation B 3.3.7 BASES LCO The LCO requirements ensure that instrumentation necessary to actuate the CRVS to the'CRVS Mode 3 (1O incident mode) is OPERABLE.

1. Manual Initiation The LCO requires two channels OPERABLE because the CRVS mode selector switch has two channels (i.e.,- one channel for each' train).' The operator can initiate the CRVS at any time by using the CRVS mode selector switch in the control room. This action will cause actuation of all components in the same manner as the automatic actuation signal.

Each channel includes the common CRVS mode selector switch and the interconnecting wiring to the actuation logic cabinet.

2. Automatic Actuation Logic and Actuation Relays The LCO requires two trains of Actuation Logic and Relays OPERABLE'to ensure that no single random failure can prevent automatic actuation resulting from an SI signal.

Automatic Actuation;Logic and Actuation relays are required to

be OPERABLE to support the Operability of the function that starts CRVS (i.e., and ESFAS SI initiation signals). The term automatic actuation logic and actuation relays applies to those portions of the circuit that are: 1)-comoon to more than one channel in one train of a single function (i.e., the automatic actuation logic): or. 2) the initiating relay contacts in one train responsible for actuating the equipment and which are common to more than one channel of a single function and more than one function (i.e.,-the actuation relays). There are two trains of automaticactuation logic and actuation relays for the containment'purge system and pressure relief line.

If the SI functions becomes inoperable in such a manner that only the CRVS function is affected,' the Conditions applicable to their SI function need not be entered. The less restrictive Actions specified for inoperability of the'CRVS Functions specify sufficient compensatory measures for this case.

-3. Safety Iniectio-Refer to LCO 3.3.2. Function 1, for all initiating Functions and requirements.

continued)

INDIAN POINT 3 B 3.3.7 - 3 Revision-l

~~II-CRVS Actuation Instrumentation B 3.3.7 BASES APPLICABILITY The CRVS Functions must be OPERABLE in MODES 1, 2, 3 and 4 to ensure a habitable environment for the control room operators.

ACTIONS A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each Function. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.7-1 in the accompanying LCO. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 Condition A applies to the manual channels and the actuation logic train Function of the CRVS.

If one channel or train is inoperable in one or more Functions, 7 days are permitted to restore it to OPERABLE status. The 7 day Completion Time is the same as is allowed if one train of the mechanical portion of the system is inoperable. The basis for this Completion Time is the same as provided in LCO 3.7.11. If the channel/train cannot be restored to OPERABLE status. CRVS must be placed in the CRVS Mode 3 (i.e., the 10% incident mode). This starts both trains of CRVS because a single switch controls both trains. This accomplishes the actuation instrumentation Function and places the unit in a conservative mode of operation.

B.1 Condition B applies to the failure of two CRVS actuation trains, or two manual channels. The Required Action is to place CRVS in the CRVS Mode 3 (10% incident mode) within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This starts both trains of CRVS because a single switch controls both trains. This accomplishes the actuation instrumentation Function that may have been lost and places the unit in a conservative mode of operation. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time for placing the CRVS in the CRVS Mode 3 (10%

incident mode) is consistent with the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time in ITS 3.7.11. The Completion Time is acceptable because of the low probability of a DBA occurring during this time period. This ensures appropriate limits are placed upon train inoperability as discussed in the Bases for LCO 3.7.11.

(continued)

INDIAN POINT 3 B 3.3.7 - 4 Revision 1

CRVS Actuation Instrumentation B 3.3.7 BASES ACTIONS C.1 and C.2 (continued)

Condition C applies when the Required Action and associated Completion Time for Condition A or B have not been met. The unit must be brought to a MODE inwhich the LCO requirements are not applicable. To achieve this status, the unit must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE REQUIREMENTS A Note has been added to the SR Table to clarify that Table 3.3.7-1 determines which SRs apply to which CRVS Actuation Functions.

SR 3.3.7.1 An actuation logic test is performed at a frequency of 31 days on a Staggered Test Basis.

This test verifies the capability of the instrumentation to provide the CRVS actuation. The Frequency is based on the known reliability of the system and has been shown to be acceptable through operating experience.

SR 3.3.7.2 SR 3.3.7.2 is the performance of a TADOT. This test is a check of the Manual Actuation Functions and is performed every 24 months. Each Manual Actuation Function is tested up to, and including, the end device (i.e., fan starts, damper cycles, etc.).

The Frequency is based on the known reliability of the Function and has been shown to be acceptable through operating experience. The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Functions tested have no setpoints associated with them.

(continued)

INDIAN POINT 3 B 3.3.7 :-5 7 Revision 1

-- l i-CRVS Actuation Instrumentation B 3.3.7 BASES REFERENCES 1. IP3 Technical Requirements Manual.

2. Safety Evaluation Report (SER) for IP3 Amendment 224.

INDIAN POINT 3 B 3.3.7 - 6 Revision 1

CRVS B 3.7.11 B 3.7 PLANT SYSTEMS B 3.7.11 Control Room Ventilation System (CRVS)

BASES -- - :

BACKGROUND The CRVS provides a protected environment from which operators can control the unit following an uncontrolled release of radioactivity, chemicals, or toxic gas.

The Control Room Ventilation System consists of the following equipment: a single filter unit'consisting of two roughing filters, two high efficiency particulate air (HEPA) filters: two activated charcoal adsorbers' for removal of gaseous activity (principally iodines);:two 100lcapacity filter booster fans; and, a single duct system including dampers,'controls and associated accessories to provide for three' different air flow-configurations. The air-conditioning units associated with the CRVS are governed by LCO 3.7.12, 'Control Room Air Conditioning System (CRACS)."

The CRVS is'divided into.two trains with'each train consisting of a filter booster fan:with its associated inlet damper, an air

conditioning unit fan powered from the'same'safeguards power train with its associated inlet damper, and the following components which are common to both trains: the control room filter unit, Damper A (filter unit bypass for outside air makeup to the Control Room),

Damper B (filter unit'inlet for outside air makeup to the Control Room), and the toilet and locker room exhaust fan. The two filter booster fans (F 31',and F;32) are powered from safeguards power trains 5A-(EDG 33) and 6A (EDG 32).-respectively. The automatic dampers that are common to both-trains are positioned in the fail-safe position (open or closed) by either of the redundant actuation channels.

The CRVS is an emergency system, parts of which'operate during normal unit operations.

The three different CRVS air flow configurations are as follows:

a) CRVS Mode 2:Normal operation - Ventilation is provided to the CCR via outside air drawn through Damper A driven by the operation of the CRACS fan(s) and the toilet/locker room exhaust fan; - ,

(continued)

INDIAN POINT 3 B 3.7.11' Revision 4

CRVS B 3.7.11 BASES BACKGROUND b) CRVS Mode 3 Incident mode with outside air makeup (known as the (continued) 10% incident mode) - Ventilation and pressurization are provided for the CCR via altered outside air drawn through Damper B.

driven by the operation of the CRACS fan(s) and its associated filter booster fan; c) CRVS Mode 4 Incident mode with no outside air makeup (i.e. 100%

recirculation mode) - In this mode there is no ventilation provided to the CCR. Both A and B Dampers are closed and the only associated CRVS components operating are the CRACS fan(s).

CRVS Mode 3 (10% Incident Mode) is the required method of operation during any radiological event because it provides outside air for pressurization of the Control Room. It has been demonstrated via industry experience with tracer gas testing that increased pressurization helps attenuate unfiltered inleakage.

On a Safety Injection signal or high radiation in the Control Room (Radiation Monitor R-1), the CRVS will actuate to the CRVS Mode 3 incident mode with outside air makeup (known as the 10% incident mode). This will cause one of the two filters booster fans to start, the locker room exhaust fan to stop, and CRVS dampers to open or close as necessary to filter all incoming outside air. In the event that the first booster fan fails to start, the second booster fan will start after a predetermined time delay.

A single train will create a slight positive pressure in the control room. The CRVS operation in maintaining the control room habitable is discussed in the FSAR, Section 9.9 (Ref. 1).

The control room is continuously monitored by radiation and toxic gas detectors.

The CRVS does not actuate automatically in response to toxic gases.

Separate chlorine. ammonia and oxygen probes are provided to detect the presence of these gases in the outside air intake. Additionally, monitors in the Control Room will detect low oxygen levels and high levels of chlorine and ammonia. The CRVS may be placed in the CRVS Mode 4 incident mode with no outside air makeup (i.e. 100%

recirculation mode) to respond to these conditions. Instrumentation for toxic gas monitoring is governed by the IP3 Technical Requirements Manual (TRM) (Ref. 4). Generally, the manually initiated actions of the toxic gas isolation state are more restrictive, and will override the actions of the emergency radiation state.

(continued)

INDIAN POINT 3 B 3.7.11 - 2 Revision 4

CRVS B 3.7.11 BASES -

BACKGROUND Iffor any reason it is required or desired to operate with 100%

(continued) recirculated air (e.g., toxic gas condition is identified), the CRVS can be placed in the CRVS Mode 4 incident mode with no outside air I makeup (i.e.. 100% recirculation mode) by remote manually operated switches. The Firestat detectors will shutdown both air conditioning units associated with the CRVS. resulting in shutting the outside air dampers. However, if any filter booster fan was running at that time, it will be tripped. I The CRVS is designed in accordance with Seismic Category I requirements.

The CRVS is designed to-maintain the control room environment for 30 days of continuous occupancy after'a Design Basis Accident (OBA) without exceeding a 5 rem TEDE dose.

APPLICABLE SAFETY ANALYSES The CRVS active components are arranged 'inredundant, safety related ventilation trains. The location of components and ducting within the control building envelope provides protection from natural phenomena Il events. The CRVS provides'airborne 'radiological protection for the control room operators, as demonstrated by the control room accident dose analyses for the most limiting design basis accident (i.e., DBA LOCA) fission product release (Ref. 3).

Radiation monitor R-1 is not required for the Operability of the Control Room Ventilation System because control room isolation is initiated by the safety injection signal inMODES 1.2, 3. 4, and control room isolation isnot credited for maintaining radiation exposure within General Design Criteria 19 limits following a fuel handling accident or gas-decay-tank rupture.

The worst case active failure of a component of the CRVS, assuming a loss of offsite power, does not impair the ability of the system to perform its design function. However, the original CRVS design was not required to meet single failure criteria and, although upgraded from the original design, CRVS does not satisfy all requirements in IEEE-279 for single failure tolerance.

(continued)

INDIAN POINT 3 B 3.7.11 - 3 Revision 4

_I CRVS B 3.7.11 BASES APPLICABLE SAFETY ANALYSES (continued)

Each of the automatic dampers that are common to both trains is positioned in the CRVS Mode 3 (10% incident mode) fail-safe position I (open or closed) by either of the redundant actuation channels.

The CRVS satisfies Criterion 3 of 10 CFR 50.36.

LCO Two CRVS trains are required to be OPERABLE to ensure that at least one is available. Total system failure could result in exceeding a dose of 5 rem TEDE to the control room operator in the event of a I large radioactive release.

The CRVS is considered OPERABLE when the individual components necessary to limit operator exposure are OPERABLE in both trains. A CRVS train is OPERABLE when the associated:

a. Filter booster fan and an air-conditioning unit fan powered from the same safeguards power train are OPERABLE:

b. HEPA filters and charcoal absorbers are not excessively restricting flow, and are capable of performing their filtration functions; and

c. Valves, and dampers are OPERABLE or in the incident mode, and air circulation can be maintained.

I In addition, the control room boundary must be maintained, including the integrity of the walls, floors, ceilings, ductwork, and CCR access doors.

Instrumentation for toxic gas monitoring is governed by the IP3 Technical Requirements Manual (TRM) (Ref. 4) and is not included in the LCO.

(continued)

INDIAN POINT 3 B 3.7.11 - 4 Revision 4

CRVS B 3.7.11 BASES APPLICABILITY In MODES 1, 2, 3. 4 CRVS must be OPERABLE to limit operator exposure during and following a DBA.

The CRVS is not required in MODE 5 or 6. or during movement of irradiated fuel assemblies and core alterations because analysis indicates that isolation of the control room is not required for maintaining radiation exp'sure within acceptable limits following a fuel handling accident-or gas decay tank rupture.

Administrative controls address the role of the CRVS in maintaining control room habitability following an event at Indian Point Unit 2.

ACTIONS A.1 When one CRVS train is inoperable, action must be taken to restore OPERABLE status'within 7 days. In this Condition, the remaining OPERABLE CRVS train is adequate to perform the control room protection function. However, the overall reliability is reduced because a failure in the OPERABLE CRVS train could result in loss of CRVS function.' The 7 day Completion Timeis based'on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.

B.1 When neither CRVS train'is Operable, action must be taken to restore at least'one train to OPERABLE status within'72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Timeis acceptable because of the low probability of a DBA occurring during 'this time period.

C.1 and C.2 If Required Actions A.1 or B.1Iare not met within the required Completion Time, the unit must be placed in a MODE that minimizes accident risk.To achieve this status, the unit must be placed in at least'MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed-Completion Times"are reasonable, based on operating experience, to reachtthe r'equired unit conditions from full power

'conditions in an orderly manner and without challenging unit systems.

(continued)

INDIAN POINT 3 B 3.7.11 - 5 R Revision 4

II CRVS B 3.7.11 BASES SURVEILLANCE REQUIREMENTS SR 3.7.11.1 Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing each train once every month provides an adequate check of this system. Note that a CRVS train includes both the filter booster fan and an air-conditioning unit fan powered from the same safeguards power train. The 31 day Frequency is based on the reliability of the equipment and the two train redundancy availability.

SR 3.7.11.2 This SR verifies that the required CRVS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The CRVS filter tests are in accordance with the sections of Regulatory Guide 1.52 (Ref. 3) identified in the VFTP. The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and the physical properties of the activated charcoal. Specific test Frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.11.3 This SR verifies that each CRVS train starts and operates on an actual or simulated actuation signal. The Frequency of 24 months is based on operating experience which has demonstrated this Frequency provides a high degree of assurance that the booster fans will operate and dampers actuate to the correct position when required.

SR 3.7.11.4 This SR verifies the integrity of the control room enclosure, and the assumed inleakage rates of the potentially contaminated air. The control room positive pressure, with respect to potentially contaminated adjacent areas, is periodically tested to verify proper functioning of the CRVS. During operation in the CRVS Mode 3 (i.e.

10% incident mode), the CRVS is designed to maintain the control room at a slight positive pressure with respect to adjacent areas in order to attenuate unfiltered inleakage. The acceptance criteria of > 1500 cfm filtered make-up air is the value used in the Control Room dose assessment.

(continued)

INDIAN POINT 3 B 3.7.11 - 6 Revision 4

CRVS B 3.7.11 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.11.4 The SR Frequency of 24 months on a staggered test basis is acceptable because operating experience has demonstrated that the control room boundary is not normally disturbed. Staggered testing is acceptable because the SR is primarily a verification of Control Room integrity because fan operation is tested elsewhere.

REFERENCES 1. FSAR, Section 9.9.

2. FSAR, Chapter 14.

3. Safety Evaluation Report (SER) for IP3 Amendment 224.

I

4. IP3 Technical Requirements Manual.

INDIAN POINT 3 B 3.7.11 - 7 Revision 4

CRACS B 3.7.12 B 3.7 PLANT SYSTEMS B 3.7.12 Contr'ol Room Air Conditioning System (CRACS) i BASES 7 . .. :

BACKGROUND 'The CRACS provides temperature control for the control room following i isolation of the control room.

The CRACS consists-of two trains that provide cooling of recirculated control room air.' Each train consists of, cooling coils.

instrumentation, and controls to provide for control room temperature control. The CRACS (CRACS 31 and CRACS 32) are powered from safeguards power trains 5A (EDG 33) and 6A (EDG 32), respectively.

The CRACS units are supplied with cooling water from the essential service water header-and each unit is capable of performing its design function during an accident with a service water inlet temperature

950F.

- The CRACS is an emergency system, parts of which may also operate during normal unit operations. Each CRACS unit is sized to provide 60% of the cooling capacity required during normal operation and 100%

of the cooling capacity required during an accident. The CRACS operation inmaintaining the control room temperature is discussed in the FSAR, Section.9.9'(Ref. 1).

During normal operation, five supplemental air-conditioning units in the Control Room are available to supplement the cooling capacity of the CRACS. These units also provide Control Room heating. These five supplemental air-conditioning units are not assumed to be available during a blackout or design basis accident and, therefore, are not governed by Technical Specifications.---

APPLICABLE SAFETY ANALYSES '

The design basis of the CRACS is to maintain the control

- room temperature for 30 days of continuous occupancy.

.. 'I (continued)

INDIAN POINT 3 B 3.7.12 - 1 Revision I

l4-CRACS B 3.7.12 BASES APPLICABLE SAFETY ANALYSES (continued)

The CRACS is designed so that the functional capacity of the Control Room is maintained at all times, including a Design Basis Accident.

Functional capacity of the Control Room means that the ambient temperature for safety equipment located in this room will not exceed 108.2 0F. Control Room safety equipment is specified to a temperature of 1200F and the 108.20F limit for Control room temperature is sufficient to account for the temperature rise in the enclosed cabinets. Functional capacity of the Control Room can be maintained by one train of CRACS being cooled by the essential service water system assuming the ultimate heat sink temperature is # 950F.

Analysis indicates that under worst case conditions, the Control Room temperature could rise to approximately 1069F following the loss of one CRACS train assuming all lights, except emergency lights, are turned off (Ref.1). Detectors and controls are provided for control room temperature control. The CRACS is designed in accordance with Seismic Category I requirements. The CRACS is capable of removing sensible and latent heat loads from the control room, which include consideration of equipment heat loads and personnel occupancy requirements, to ensure equipment OPERABILITY.

A failure of a component of the CRACS, assuming a loss of offsite power, does not impair the ability of the system to perform its design function. However, the original CRACS design was not required to meet single failure criteria and, although upgraded from the original design, CRACS does not satisfy all requirements in IEEE-279 for single failure tolerance.

The CRACS satisfies Criterion 3 of 10 CFR 50.36.

LCO Two trains of the CRACS are required to be OPERABLE to ensure that at least one is available, assuming a single failure disabling the other train. Total system failure could result in the equipment operating temperature exceeding limits in the event of an accident.

The CRACS is considered to be OPERABLE when the individual components necessary to maintain the control room temperature are OPERABLE in both trains. These components include the cooling coils and common temperature control instrumentation. In addition, the CRACS must be operable to the extent that air circulation can be maintained.

(continued)

INDIAN POINT 3 B 3.7.12 - 2 Revision 1

CRACS B 3.7.12 BASES APPLICABILITY In MODES 1, 2, 3 and 4, the CRACS must be OPERABLE to ensure that the control room temperature will not exceed equipment operational requirements following isolation of the control room.

The CRACS is'not required in MODE 5 or 6; or during movement of irradiated fuel assemblies and core alterations because analysis indicates that isolation of the control room is not required for maintaining radiation exposure within acceptable limits following a fuel handling accident'or gas decay tank rupture.

ACTIONS A.1 With one CRACS train inoperable, action must be taken to restore OPERABLE-status within.'30 days. Inthis Condition, the remaining OPERABLE CRACS train is adequate to maintain the control room temperature within limits. However, the overall reliability is reduced because a single failure in the OPERABLE CRACS train could result in loss of CRACS function. The 30 day Completion Time is based on the low probability'of an event requiring control room isolation, the consideration that the remaining train can provide the required protection, and that alternate nonsafety related cooling means are typically available.

BM When neither CRACS train isOperable, action must be taken to restore at least one train to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is acceptable because of the low probability of a DBA occurring during this time period and because alternate nonsafety cooling means are typically available.

C.1 and C.2 If Required Actions A.1 or B.1 are not met within the required Completion Time, the unit must be placed in a MODE that minimizes the risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

INDIAN POINT 3 B 3.7.12 - 3 Revision 1

-II-CRACS B 3.7.12 BASES SURVEILLANCE REQUIREMENTS SR 3.7.12.1 This SR verifies that the heat removal capability of the system is sufficient to remove the heat load required to maintain functional capacity of the Control Room at all times (Ref. 1). This SR consists of a combination of testing and calculations. The 24 month Frequency is appropriate since significant degradation of the CRACS is slow and is not expected over this time period.

REFERENCES 1. FSAR. Section 9.9.

2. Safety Evaluation Report (SER) for IP3 Amendment 224.

I INDIAN POINT 3 B 3.7. 12 - 4 Revision 1

Spend Fuel Pit Water Level B 3.7.14 B 3.7 PLANT SYSTEMS B 3.7.14 Spent Fuel Pit Water Level -

BASES-' '

BACKGROUND The minimum water level in the spent fuel pit meets the assumptions of iodine decontamination factors following a fuel handling accident.

The specified water level shields and minimizes the general area dose when the storage racks are filled to their maximum capacity. The water also provides shielding during the movement of spent fuel.

A general description of. the spent fuel pit design and the Spent Fuel Cooling and Cleanup"Systemis given in the FSAR. Section 9.5 (Ref. 1).

The assumptions of the fuel handling accident are given inthe FSAR.

Section 14.2 (Ref. 2).

APPLICABLE SAFETY ANALYSES The minimum water level in the spent fuel pit meets the assumptions of the fuel handling accident described in FSAR, Section 14.2 (Ref. 2).

The resultant 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 'thyroid dose per person at the exclusion area boundary satisfies the 10 CFR 50.67 (Ref. 3) limits.

According to Reference 2, there is23 ft of water between the top of the damaged fuel bundle and the fuel pool surface'during'a fuel '

handling accident. With 23 ft of water, the assumptions of Reference 4 can be used directly. Inpractice, this LCO preserves this assumption for the bulk of the fuel inthe storage racks.

The Spent Fuel Pit water level satisfies Criteria 2 and 3 of 10 CFR 50.36. -i LCO The spent fuel pit water level is required to be 23 ft over the top of irradiated fuel assemblies seated inthe storage racks. The specified

'water level:preserves the assumptions of-the fuel handling accident analysis (Ref. 2). As such, it is the minimum required for fuel storage and movement within the spent fuel pit.

(continued)

INDIAN POINT 3 B 3.7.14 - 1 Rio I Revision

Spend Fuel Pit Water Level B 3.7.14 BASES APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the spent fuel pit, since the potential for a release of fission products exists.

ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.

When the initial conditions for prevention of an accident cannot be met, steps should be taken to preclude the accident from occurring.

When the spent fuel pit water level is lower than the required level, the movement of irradiated fuel assemblies in the spent fuel pit is immediately suspended to a safe position. This action effectively precludes the occurrence of a fuel handling accident. This does not preclude movement of a fuel assembly to a safe position.

If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODES 1, 2, 3, and 4, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

SURVEILLANCE REQUIREMENTS SR 3.7.14.1 This SR verifies sufficient spent fuel pit water is available in the event of a fuel handling accident. The water level in the spent fuel pit must be checked periodically. The 7 day Frequency is appropriate because the volume in the spent fuel pit is normally stable. Water level changes are controlled by plant procedures and are acceptable based on operating experience.

During refueling operations, the level in the spent fuel pit is normally in equilibrium with the refueling canal and reactor cavity, and the level in the refueling reactor cavity is checked daily in accordance with SR 3.9.6.1.

(continued)

INDIAN POINT 3 B 3.7.14 - 2 Revision 1

Spend Fuel Pit Water Level B 3.7.14 BASES REFERENCES 1. FSAR, Section 9.5.

2. FSAR, Section 14.2.

3. 10 CFR 50.67.

4. Safety Evaluation Report (SER) for IP3 Amendment. I INDIAN POINT 3 B 3.7.14 - 3 Revision 1

Refueling Cavity Water Level B 3.9.6 B 3.9 REFUELING OPERATIONS B 3.9.6 Refueling Cavity Water Level BASES -

BACKGROUND The movement of irradiated fuel assemblies or performance of CORE ALTERATIONS, except during latching and unlatching of control rod drive shafts, within'containment requires a minimum water level of 23 ft above the top of the"reactor vessel flange. During refueling, this maintains sufficient'wat'er level in the containment, refueling canal, fuel transfer canal, refueling cavity, and spent fuel pit. Sufficient water is necessary'-to-retain iodine fission product activity in the water in the event of a fuel handling accident (Refs. 1 and 2).

Sufficient iodine activity would be retained to limit offsite doses from the accident to within RG 1.183 limits (Ref. 4).

APPLICABLE SAFETY ANALYSES During CORE ALTERATIONS and movement of irradiated fuel assemblies, the water-level in the refueling canal and the refueling cavity is an";initial condition-design parameter in the analysis 'of a fuel handling accident in containment, as postulated by Regulatory Guide 125-(Ref.'1). Inthe Fuel:Handling Accident (FHA) analysis (Ref. 6):,a fuel assembly'is assumed to be dropped and I damaged during refueling. Itis assumed that all of the fuel rods in one assembly are'damaged to the extent that all of the gap activity is released. The fuel handling accident isdescribed in Reference 2.

Doses from the FHA are calculated in accordance with the Alternate Source Term methodology of Regulatory Guide 1.183 (Ref. 4). For water level of 23 ft or greater above the fuel, RG 1.183 specifies an overall decontamination factor of 200. There is no retention of noble gases in the water. The decay time prior'to fuel movement is a -:

minimum of 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months . Credit is not taken for removal of iodine by filters, nor is credit taken for isolation of release paths.

Using RG 1.183 methodology,'all calculated offsite and control room doses are determined to be within the RG 1.183 specified fractions of the 10CFR50.67 limits for decay periods of > 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months .

(continued)

INDIAN POINT 3 B '3.9.6 - 1 Revision 2

Refueling Cavity Water Level B 3.9.6 BASES APPLICABLE SAFETY ANALYSES (continued)

Further reductions in the amount of radioactivity potentially released following a fuel handling accident inside containment are expected because the containment will be isolated either automatically or through operator action following a fuel handling accident.

Specifically, LCO 3.3.6, "Containment Purge System and Pressure Relief Line Isolation Instrumentation," requires the Operability of radiogas monitors R-11 and R-12, either of which could generate an automatic isolation signal, during the movement of irradiated fuel.

Refueling cavity water level satisfies Criterion 2 of 10 CFR 50.36.

LCO A minimum refueling cavity water level of 23 ft above the reactor vessel flange is required to ensure that the radiological consequences of a postulated fuel handling accident inside containment are within acceptable limits, as per Reference 6.

APPLICABILITY LCO 3.9.6 is applicable during CORE ALTERATIONS, except during latching and unlatching of control rod drive shafts, and when moving irradiated fuel assemblies within containment. The LCO minimizes the possibility-of a-fuel handling accident in containment that is beyond the assumptions of the safety analysis. If irradiated fuel assemblies are not present in containment, there can be no significant radioactivity release as.a result of a postulated fuel handling accident. Requirements for fuel handling accidents in the spent fuel pool are covered by LCO 3.7.14, "Spent Fuel Pit Water Level."

ACTIONS A.1 and A.2 With a water level of < 23 ft above the top of the reactor vessel flange, all operations involving CORE ALTERATIONS or movement of irradiated fuel assemblies within the containment shall be suspended immediately to ensure that a fuel handling accident cannot occur.

The suspension of CORE ALTERATIONS and fuel movement shall not preclude completion of movement of a component to a safe position.

(continued)

Revision 2 POINT 33 B 3.9.6-2 INDIAN POINT B 3.9.6 -2 Revision 2

Refueling Cavity Water Level B 3.9.6 BASES SURVEILLANCE REQUIREMENTS SR 3.9.6.1 Verification of a minimum water level of 23 ft above the top of the reactor vessel flange ensures that the design basis for the analysis of the postulated fuel handling accident during refueling operations is met. Water at the required level above the top of the reactor vessel flange limits the consequences of damaged fuel rods that are postulated to result from a fuel handling accident inside containment (Ref. 2).

The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on engineering judgment and is considered adequate in view of the large volume of water and the normal procedural controls of valve positions, which make significant unplanned level changes unlikely.

REFERENCES 1. Regulatory Guide 1.25, March 23, 1972.

2. FSAR. Section 14.2.

3. NUREG-0800, Section 15.7.4.

4. Regulatory Guide 1.183, July 2002.

5. Safety Evaluation Report (SER) for IP3 Amendment 224.

INDIAN POINT 3 B 3.9.6 -3 Revision 2

ML051090380

Text

Navigation menu

Search