ML051670072
| ML051670072 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 06/03/2005 |
| From: | Entergy Nuclear Operations |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| IP-SMM-AD-103, Rev 0 | |
| Download: ML051670072 (267) | |
Text
{{#Wiki_filter:IPEC SITE QUALITY RELATED IP-SMM-AD-103 Revision 0
--- En tergy MANAGEMENT ADMINISTRATIVE PROCEDURE MANUAL INFORMATIONAL USE Page 13 of 21 ATTACHMENT 10.1 SMM CONTROLLED DOCUMENT TRANSMITTAL FORM SITE MANAGEMENT MANUAL CONTROLLED DOCUMENT TRANSMITTAL FORM - PROCEDURES Page 1 of I zEntergy CONTROLLED DOCUMENT TRANSMITTAL FORM - PROCEDURES TO: DISTRIBUTION DATE: 613/05 PHONE NUMBER: 271-7057 FROM: IPEC DOCUMENT CONTROL The Document(s) identified below are forwarded for use. In accordance with IP-SMM-AD-103, please review to verify receipt, incorporate the document(s) into your controlled document file, properly disposition superseded, void, or inactive document(s). Sign and return the receipt acknowledgement below within fifteen (15) working days.
AFFECTED DOCUMENT: IP3 ITS / BASES I TRM DOC# REV# l TITLE INSTRUCTIONS
*******FOLLOW THE ATTACHED INSTRUCTIONS*********
***********PLEASE NOTE EFFECTIVE DATE***********
RECEIPT OF THE ABOVE LISTED DOCUMENT(S) IS HEREBY ACKNOWLEDGED. I CERTIFY THAT ALL SUPERSEDED, VOID, OR INACTIVE COPIES OF THE ABOVE LISTED DOCUMENT(S) IN MY POSSESSION HAVE BEEN REMOVED FROM USE AND ALL UPDATES HAVE BEEN PERFORMED IN ACCORDANCE WITH EFFECTIVE DATE(S) (IF APPLICABLE) AS SHOWN ON THE DOCUMENT(S). NAME (PRINT) SIGNATURE DATE CC#
17-MAY-05 Page: 91 DISTRIBUTION CONTROL LIST Document Name: ITS/BASES/TRM CCNAME NAME DEPT LOCATION 1 OPS PROCEDURE GROUP SUPV.. OPS PROCEDURE GROUP IP2. 3 PLANT MANAGER'S OFFICE .UNIT 3(UNIT 3/IPEC ONLY) IP2 5 CONTROL ROOM & MASTER OPS(3PT-D001/6(U3/IPEC) IP3 (ONLY) 11 RES DEPARTMENT MANAGER RES (UNIT 3/IPEC ONLY) 45-4-A 19 STEWART ANN LICENSING GSB-2D 20 CHEMISTRY SUPERVISOR CHEMISTRY DEPARTMENT 45-4-A 21 TSC(IP3) EEC BUILDING IP2 22 SHIFT MGR.(LUB-001-GEN) OPS (UNIT 3/IPEC ONLY) IP3 23 LIS LICENSING & INFO SERV OFFSITE 25 SIMULATOR TRAIN(UNIT 3/IPEC ONLY) 48-2-A 28 RESIDENT INSPECTOR US NRC 88' ELEVATION IP2 32 EOF E-PLAN (ALL EP'S) EOF 47 CHAPMAN N BECHTEL OFFSITE 50 TADEMY L. SHARON WESTINGHOUSE ELECTRIC OFFSITE 55 GSB TECHNICAL LIBRARY A MCCALLION/IPEC & IP3 GSB-3B 61 SIMULATOR TRAIN(UNIT 3/IPEC ONLY) 48-2-A 69 CONROY PAT LICENSING/ROOM 205 GSB-2D 99 BARANSKI J (ALL) ST. EMERG. MGMT. OFFICE OFFSITE 106 SIMULATOR INSTRUCT AREA TRG/3PT-D001-D006 ONLY) #48 164 CONTROL ROOM & MASTER OPS(3PT-D001/6(U3/IPEC) IP3(ONLY) 207 TROY M PROCUREMENT ENG. GSB-4B 273 FAISON CHARLENE NUCLEAR LICENSING WPO-12 319 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 354 L.GRANT(LRQ-OPS/TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 357 L.GRANT(ITS/INFO ONLY) TRAINING - ILO CLASSES 48-2-A 424 GRANT LEAH (9 COPIES) (UNIT 3/IPEC ONLY) #48 474 OUELLETTE P ENG., PLAN & MGMT INC OFFSITE 483 SCHMITT RICHIE MAINTENANCE ENG/SUPV 45-1-A 484 HANSLER ROBERT REACTOR ENGINEERING 72'UNIT 2 489 CLOUGHNESSY PAT PLANT SUPPORT TEAM GSB-3B 491 ORLANDO TOM (MANAGER) PROGRAMS/COMPONENTS ENG 45-3-G 492 FSS UNIT 3 OPERATIONS K-IP-I210 493 OPERATIONS FIN TEAM 33 TURBIN DECK 45-1-A 494 AEOF/A.GROSJEAN(ALL EP'S) E-PLAN (EOP'S ONLY) WPO-12D 495 JOINT NEWS CENTER EMER PLN (ALL EP'S) EOF 496 L.GRANT(LRQ-OPS/TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 497 L.GRANT(LRQ-OPS/TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 500 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 501 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 512 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 513 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 518 DOCUMENT CONTROL DESK NRC (ALL EP'S) OFFSITE 527 MILIANO PATRICK NRC/SR. PROJECT MANAGER OFFSITE 529 FIELDS DEBBIE OUTAGE PLANNING IP3/OSB
Distribution of IP3 Technical Specification Amendment 228 (Approved by NRC April 14, 2005) Pages are to be inserted into your controlled copy of the IP3 Improved Technical Specifications following the instructions listed below. The TAB notation indicates which section the pages are located. REMOVE PAGES INSERT PAGES TAB - Facility Operating License Page 3, (Amendment 227) Page 3, (Amendment 228) TAB - List of Effective Pages Pages 1 through 3, Pages 1 through 3, (Amendment 227) (Amendment 228) TAB - List of Amendments Page 13 Page 13 TAB - Table of Contents Page ii (Amendment 227) Page ii (Amendment 228) TAB 3.3 - Instrumentation Page 3.3.3-4 (Amendment 211) Page 3.3.3-4 (Amendment 228) Page 3.3.3-5 (Amendment 211) Page 3.3.3-5 (Amendment 228) TAB 3.6 - Containment Systems Page 3.6.8-1 (Amendment 226) Page 3.6.6-1 (Amendment 228) Page 3.6.8-2 (Amendment 205) Page 1 of 1
(4) ENO pursuant to the Act and 10 CFR Pbrts 30, 40 and 70, Amdt. 203 to receive, possess, and use in amounts as required any 11/27/00 byproduct, source or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; (5) ENO pursuant to the Act and 10 CFR Parts 30 and 70, to Amdt. 203 possess, but not separate, such byproduct and special 11/27/00 nuclear materials as may be produced by the operation of the facility. C. This amended license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations in 10 CFR Chapter l: Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Sections 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70; and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below: (1) Maximum Power Level ENO is authorized to operate the facility at steady state reactor core power levels not in excess of 3216 megawatts thermal (100% of rated power). (2) Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 228 are hereby incorporated in the License. ENO shall operate the facility in accordance with the Technical Specifications. (3) (DELETED) Amdt. 205 2-27-01 (4) (DELETED) Amdt. 205 2-27-01 D. (DELETED) Amdt.46 2-16-83 E. (DELETED) Amdt.37 5-14-81 F. This amended license is also subject to appropriate conditions by the New York State Department of Environmental Conservation in its letter of May 2, 1975, to Consolidated Edison Company of New York, Inc., granting a Section 401 certification under the Federal Water Pollution Control Act Amendments of 1972. Amendment No. 228
INDIAN POINT 3 TECHNICAL SPECIFICATIONS - APPENDIX A LIST OF EFFECTIVE PAGES Page 1 of 3 Page I Amend Section 3.0 2 205 8 . 225 1 205 3 205- 9 213 Table of Contents 2 226 Section 3.2.3 10 205 i 227 3 205 1 205 11 225 ii 227 4 212 2 205 12 205 iii 227 5 226 3 205 13 205 iv 227 Section 3.1.1 4 205 Section 3.3.3 Section 1.1 1 1 205. Section 3.2.4 1 226 1 205 Section 3.1.2 205 2 211 2 205 1 205 2 205 3 205 3 224 2 205 205 4 228 4 205 Section 3.1.3 4 205 5 1228 I 5 225 1 205 Section 3.3.1 Section 3.3.4 6 205 2 J 205 1 205 1 226 7 205 Section 3.1.4 2 205 2 j 205 8 205 1 J 205 3 205 Section 3.3.5 Section 1.2 2 205 4 205 1 205 1 205 3 205 5 205 2 J 205 2 205 4 205 6 205 Section 3.3.6 3 205 5 205 7 205 1 205 Section 1.3 Section 3.1.5 8 205 2 205 1 205 1 205 9 205 3 205 2 205 2 205 10 205 4 205 3 205 Section 3.1.6 11 205 5 205 4 205 1 205 12 205 Section 3.3.7 5 205 2 205 13 225 1 l 205 6 205 3 205 14 205 2 205 7 205 Section 3.1.7 15 225 3 J 205 8 205 1 205 16 205 Section 3.3.8 9 205 2 205 17 2205 1 215 10 205 3 205l 18 205 2 J 205 11 205 4 205 19 225 Section 3.4.1 12 205 Section 3.1.8 20 225 1 225 13 205 1 1 205 Section 3.3.2 2 j 225 Section 1.4 2 J 205 1 205 Section 3.4.2 1 205 Section 3.2.1 2 205 1 l 205 2 205 1 205 3 205 Section 3.4.3 3 205 2 205 4 205 1 205 4 205 3 205 5 205 2 205 Section 2.0 Section 3.2.2 6 205 3 220 1 1 225 1 1 205 7 205 4 220 The latest amendment reflected in this list is: Amendment 228
INDIAN POINT 3 TECHNICAL SPECIFICATIONS - APPENDIX A LIST OF EFFECTIVE PAGES Page 2 of 3 ZLI220 Section 3.4.13 4 205 Section 3.7.3 Section 3.4.4 1 205 205 1 l__207 2 205 Section 3.6.3 2 J_207 Section 3.4.5 Section 3.4.14 1 205 3 J_207 1 205 1 205 2 205 Section 3.7.4 2 205 2 205 3 205 1 l 226 3 205 3 205 4 205 2 205 Section 3.4.6 4 205 5 205 Section 3.7.5 1 205 5 205 6 205 1 226 2 {205 Section 3.4.15 Section 3.6.4 2 205 3 205 1 226 1 e 205 3 205 Section 3.4.7 2 205 Section 3.6.5 4 J_205 1 205 3 205 Section 3.7.6 2 205 4 205 Section 3.6.6 1 205 3 205 Section 3.4.16 1 205 2 J_205 Section 3.4.8 1 226 2 205 Section 3.7.7 1 205 2 205 3 205 1 205 2 205 3 205 4 205 2 l_218 Section 3.4.9 4 205 Section 3.6.7 Section 3.7.8 1 l_225 Section 3.5.1 1 205 1 205 2 225 1 222 2 205 2 J_205 Section 3.4.10 2 205 Section 3.6.8 I Section 3.7.9 I 1 205 3 _205 I l 228 _ 1 205 2 J205 Section 3.5.2 Section 3.6.9 2 205 Section 3.4.11 1 205 1 l205 3 J_205 1 226 2 205 2 _ 205 Section 3.7.10 2 205 3 205 Section 3.6.10 1 I 205 3 205 4 205 1 205 Section 3.7.11 Section 3.4.12 Section 3.5.3 2 205 1 223 1 205 1 _226 3 205 2 J_205 2 226 2 205 4 - 205 Section 3.7.12 3 205 Section 3.5.4 Section 3.7.1 1 1 205 4 205 1 J205 1 205 Section 3.7.13 5 205 2 _205 2 205 1l 215 6 205 Section 3.6.1 3 225 2 1 205 7 205 1 205 4 205 Section 3.7.14 8 205 2 205 1 l 205 9 220 Section 3.6.2 Section 3.7.2 10 220 1 205 1 205 Section 3.7.15 11 220 2 205 2 205 1 l 205 12 220 3 205 3 205 2 [ 205 The latest amendment reflected in this list is: Amendment 228
INDIAN POINT 3 TECHNICAL SOEC.FICATIONS - APPENDIX A LIST OF EFFECTIVE PAGES Page 3 of 3 Section 3.7.16 Section 3.8.7 7 205 1 205 1 205 8 205 2 205 2 205 9 210 3 205 3 205 10 205 Section 3.7.17 Section 3.8.8 11 221 1 l 205 1 l 205 12 205 Section 3.8.1 2 J 205 13 205 1 226 Section 3.8.9 14 205 2 205 1 205 15 205 3 205 2 205 16 205 4 205 Section 3.8.10 17 205 5 205 1 1205 18 205 6 205 2 205 19 205 7 205 Section 3.9.1 20 205 8 205 1 l 205 21 224 9 205 Section 3.9.2 22 224 10 205 1 205 23 224 Section 3.8.2 2 205 24 224 1 205 Section 3.9.3 25 224 2 205 1 215 26 205 3 205 2 215 27 205 4 205 3 215 28 205 Section 3.8.3 Section 3.9.4 29 205 1 205 1 205 30 206 2 205 2 205 31 225 3 205 Section 3.9.5 32 227 4 205 1 205. 33 227 5 205 2 205 34 225 Section 3.8.4 Section 3.9.6 35 225 1 216 1 l 205 36 205 2 216 Section 4.0 37 205 3 216 1 205 38 205 Section 3.8.5 2 205 1 205 3 205 2 205 Section 5.0 1 205 Section 3.8.6 2 205 1 205 3 205 2 205 4 205 3 205 5 205 4 205 6 205 The latest amendment reflected in this list is: Amendment 228
Entergy Nuclear Operations, Inc Indian Point 3 Nuclear Power Plant License Amendments Page 13 AMENDMENT SUBJECT LETTER DATE 217 Use of Best-Estimate Large-Break Loss of 05/06/2003 Coolant Accident analysis methodology (WCAP 12945) 218 Revise City Water surveillance to reflect 08/04/2003 addition of (backflow preventer) valves 219 Revise Ventilation Filter Testing Program 10/30/2003 to adopt ASTM D3803 charcoal filter testing requirements per GL 99-02. 220 Extension of the RCS pressure/temperature 12/03/2003 limits and corresponding OPS limits from 16.17 to 20 EFPY. 221 Extension of RCP flywheel inspection interval 07/02/2004 (from 10 years to 20 years) per TSTF 421. 222 Inoperable accumulator time extended from 08/18/2004 1 hour to 24 hours per TSFT-370. 223 Extension of the allowed outage time to 01/19/2005 support the placement of the CRVS in an alternate configuration for tracer gas testing. 224 Full-scope adoption of alternate source term 03/22/2005 for dose consequence analysis of DBAs. 225 Stretch Power Uprate (4.85%) from 3067.4 MWt 03/24/2005 to 3216 MWt, and adoption of TSTF-339. 226 Adopt TSTF-359; Increased Flexibility in 04/06/2005 Mode Restraints. 227 Remove Monthly Operating Report and 04/14/2005 Occupational Radiation Exposure Report per TSTF-369. 228 Hydrogen Recombiner Elimination and Relaxation 04/14/2005 of Hydrogen Monitor Requirements per TSTF-447.
Facility.Operating License No. DPR-64 Appendix A - Technical Specifications TABLE OF CONTENTS 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits 3.4.2 RCS Minimum Temperature for Criticality 3.4.3 RCS Pressure and Temperature (P/T) Limits 3.4.4 RCS Loops-MODES 1 and 2 3.4.5 RCS Loops-MODE 3 3.4.6 RCS Loops-MODE 4 3.4.7 RCS Loops-MODE 5, Loops Filled 3.4.8 RCS Loops-MODE 5, Loops Not Filled 3.4.9 Pressurizer 3.4.10 Pressurizer Safety Valves 3.4.11 Pressurizer Power Operated Relief Valves (PORVs) 3.4.12 Low Temperature Overpressure Protection (LTOP) 3.4.13 RCS Operational LEAKAGE 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage 3.4.15 RCS Leakage Detection Instrumentation 3.4.16 RCS Specific Activity 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Accumulators 3.5.2 ECCS-Operating 3.5.3 ECCS-Shutdown 3.5.4 Refueling Water Storage Tank (RWST) 3.6 CONTAINMENT SYSTEMS 3.6.1 Containment 3.6.2 Containment Air Locks 3.6.3 Containment Isolation Valves 3.6.4 Containment Pressure 3.6.5 Containment Air Temperature 3.6.6 Containment Spray System and Containment Fan Cooler System 3.6.7 Spray Additive System 3.6.8 Not Used 3.6.9 Isolation Valve Seal Water (IVSW) System 3.6.10 Weld Channel and Penetration Pressurization System (WC & PPS) (continued) INDIAN POINT 3 ii Amendment 228
PAM Instrumentation 3.3.3 Table 3.3.3-1 (page 1 of 2) Post Accident Monitoring Instrumentation CONDITION REFERENCED SR 3.3.3.2 FROM REQUIRED SR 3.3.3.2 FUNCTION REQUIRED CHANNELS ACTION D.1 FREQUENCY
- 1. Neutron Flux 2 F 24 months
- 2. RCS Hot Leg Temperature (Wide Range) 1 per loop E 24 months (ThoO
- 3. RCS Cold Leg Temperature (Wide Range) 1 per loop E 24 months (Tcold)
- 4. RCS Pressure (Wide Range) 2 E 24 months
- 5. Reactor Vessel Water Level 2 E 24 months
- 6. Containment Water Level (Wide Range) 2 E 24 months
- 7. Containment Water Level (Recirculation 2 E 24 months Sump)
- 8. Containment Pressure 2 E 18 months
- 9. Automatic Containment Isolation Valve 2 per penetration flow F 24 months Position path(a)(b)
- 10. Containment Area Radiation (High Range) 2 F 24 months
- 11. NOT USED I
- 12. Pressurizer Level 2 E 24 months
- 13. SG Water Level (Narrow Range) 2perSG E 24 months
- 14. SG Water Level (Wide Range) and 1 each per SG E 24 months, SGL Auxiliary Feedwater Flow 18 months, AFF
- 15. NOT USED
- 16. Steam Generator Pressure 2 per SG E 24 months
- 17. Condensate Storage Tank Level 2 F 24 months
- 18. Core Exit Thermocouples-Quadrant 1 2(c) E 24 months
- 19. Core Exit Thermocouples-Quadrant 2 2 (c) E 24 months
- 20. Core Exit Thermocouples-Quadrant 3 2 (c) E 24 months
- 21. Core Exit Thermocouples-Quadrant 4 2 (c) E 24 months
- 22. Main Steam Une Radiation 1 per steam line F 24 months
- 23. Gross Failed Fuel Detector 2 F 24 months
- 24. RCS Subcooling Margin 2 E 24 months See NOTES, next page.
INDIAN POINT 3 3.3.3-4 Amendment 228
PAM Instrumentation 3.3.3 TABLE 3.3.3-1 (page 2 of 2) Post Accident Monitoring Instrumentation NOTES: (a) Not required for isolation valves whose associated penetration is isolated by at least one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured. (b) Only one position indication channel is required for penetration flow paths with only one installed control room indication channel. (c) A channel consists of two core exit thermocouples (CETs). INDIAN POINT 3 3.3.3-5 Amendment 228
Not Used 3.6.8 3.6 CONTAINMENT SYSTEMS 3.6.8 Not Used INDIAN POINT 3 3.6.8-1 Amendment 228
INDIAN POINT 3 TECHNICAL SPECIFICATION BASES INSTRUCTIONS FOR UPDATE: 16-06/03/05 Pages are to be inserted into your controlled copy of the IF3 Technical Specifications Bases following the instructions listed below. The TAB notation indicates which section the pages are located. Remove Paged, In" 'it Paege TAB - List Of Effective Sections List of Effective Sections, Rev. 15 l List of Effective Sections, Rev. 16 (4 pages) I TAB 2.0 - Safety Limits 8 2.1.1, Rev. 0 B 2.1.1, Rev. 1 (5 pages) (4 pages) B 2.1.2, Rev. 0 B 2.1.2, Rev. 1 (4 pages) (4 pages) TAB 3.1 - Reactivity Control B 3.1.1, Rev. 0 B 3.1.1, Rev. 1 (6 pages) (6 pages) TAB 3.2 - Power Distribution Limits B 3.2.2, Rev. 0 B 3.2.2, Rev. 1 (7 pages) 1 pages) TAB 3.3 - Instrumentation B 3.3.1, Rev. 1 B 3.3.1, Rev. 2 (59 pages) (58 pages) B 3.3.8, Rev. 1 B 3.3.8, Rev. 2 (4 pages) (4 pages) TAB 3.4 - Reactor Coolant System B 3.4.1, Rev. 0 B 3.4.1, Rev. 1 (6 pages) (6 pages) B 3.4.3, Rev. 1 B 3.4.3, Rev. 2 (9 pages) (9 pages) B 3.4.6, Rev. 0 B 3.4.6, Rev. 1 (6 pages) (6 pages) B 3.4.9, Rev. 2 B 3.4.9, Rev. 3 (5 pages) (5 pages) B 3.4.13, Rev. 2 B 3.4.13, Rev. 3 (6 pages) (6 pages) B 3.4.16, Rev. 0 B 3.4.16, Rev. 1 (7 pages) (7 pages) TAB 3.5 - ECCS B 3.5.2, Rev. 0 B 3.5.2, Rev. 1 (13 pages) 1 (13 pages) TAB 3.6 - Containment B 3.6.2, Rev. 0 B 3.6.2, Rev. 1 (9 pages) (9 pages) Page 1 of 2
Re.;:o've Page Insert Page' TAB 3.6 - Containment (continuedl B 3.6.6, Rev. 1 B 3.6.6, Rev. 2 (13 pages) (13 pages) B 3.6.7, Rev. 0 B 3.6.7, Rev. 1 (6 pages) (6 pages) B 3.6.9, Rev. 0 B 3.6.9, Rev. 1 (8 pages) (8 pages) B 3.6.10, Rev. 0 B 3.6.10, Rev. 1 (12 pages) 1(12 pages) TAB 3.7 - Plant Systems B 3.7.1, Rev. 1 B 3.7.1, Rev. 2 (6 pages) (6 pages) B 3.7.2, Rev. 0 B 3.7.2, Rev. 1 (10 pages) (10 pages) B 3.7.5, Rev. 1 B 3.7.5, Rev. 2 (9 pages) (9 pages) B 3.7.6, Rev. 1 B 3.7.6, Rev. 2 (4 pages) (4 pages) B 3.7.8, Rev. 0 B 3.7.8, Rev. 1 (7 pages) (7 pages) B 3.7.9, Rev. 1 B 3.7.9, Rev. 2 (9 pages) (9 pages) B 3.7.10, Rev. 0 B 3.7.10, Rev. 1 (3 pages) (3 pages) B 3.7.13, Rev. 2 B 3.7.13, Rev. 3 (7 pages) (7 pages) B 3.7.17, Rev. 0 B 3.7.17, Rev. 1 (4 pages) (4 pages) TAB 3.9 - Refueling Operations B 3.9.3, Rev. 1 B 3.9.3, Rev. 2 (8 pages) - (7 pages) Page 2 of 2
TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE SECTIONS BASES NUMBER EFFECTIVE BASES NUMBER f EFFECTIVE SECTION REV OF PAGES DATE SECTION REV OF PAGES DATE TbI of Cnt 1 4 05/18/2001 ,,___
- , B 3.6 CONTAINMENT- -
, B 2.0.SAFETY LIMITS ' ' B 3.6.1 0 5 03/19/2001 B 2.1.1 4 06/03/2005 B 3.6.2 1 9 06/03/2005 I B 2.1.2 111 4 06/0312005 I B 3.6.3 B 3.6.4 0
0 17 3 03/19/2001 03/19/2001 B 3.0 LCO AND SR APPLICABILIT-Y.-'v^ '; B3.0 l i 15 j09/30/2002 B 3.6.5 1 5 06/20/2003
- B 3.1 REACTIVITY CONTROLU -rli.-: . B 3.6.6 2 13 06/03/2005 B 3.1.1 1 6 06/03/2005 B 3.6.7 1 6 06/03/2005 I I B 3.1.2 0 7 03/19/2001 B 3.6.8 0 6 03/19/2001 B 3.1.3 1 7 -10/27/2004 B 3.6.9 1 8 06/03/2005 B 3.1.4 0 13 03/19/2001 B 3.6.10 1 12 06103//2005 B 3.1.5 0 5 03/19/2001 '_--. .- -B 3.7 PLANT SYSTEMS ;- . z -,1 B 3.1.6 0 6 03/19/2001 B 3.7.1 2 6 06/03/2005 B 3.1.7 0 8 03/19/2001 B 3.7.2 1 10 06/03/2005 B 3.1.8 0 7 03/19/2001 B 3.7.3 1 7 05/18/2001 B 3.2 POWER DISTRIBUTION LIMITS - B 3.7.4 0 5 03/19/2001 B 3.2.1 0 7 03/19/2001 B 3.7.5 2 9 06/03/2005 B 3.2.2 1 q7 06/03/2005 B 3.7.6 2 4 06/03/2005 B 3.2.3 0 9 03/19/2001 B 3.7.7 1 4 12/17/2004 B 3.2.4 0 7 03/19/2001 B 3.7.8 1 7 06/03/2005
._____.B 3.3 INSTRUMENTATION B 3.7.9 2 9 06/03/2005 B 3.3.1 2 58 06/03/2005 B 3.7.10 1 3 06/03/2005 B 3.3.2 4 45 04/08/2005 B 3.7.1 1 4 7 04/08/2005 B 3.3.3 2 19 09/30/2002 B 3.7.12 0 4 03/19/2001 B 3.3.4 0 7 03/19/2001 B 3.7.13 3 7 06/03/2005 B 3.3.5 1 6 10/27/2004 B 3.7.14 1 3 04/08/2005 B 3.3.6 1 8 04/08/2005 B 3.7.15 0 5 03/19/2001 B 3.3.7 1 6 04/08/2005 B 3.7.16 0 6 03/19/2001 B 3.3.8 2 4 06/03/2005 B 3.7.17 1 4 06/03/2005
.- ->B 3.4 REACTOR COOLANT SYSTEM - - . B 3.8' ELECTRICAL POWER,---'. C B 3.4.1 1 6 06/0312005 B 3.8.1 1 32 01/22/2002 B 3.4.2 0 3 03/19/2001 B 3.8.2 0 7 03/19/2001 B 3.4.3 2 9 06/03/2005 B 3.8.3 0 13 03/19/2001 B 3.4.4 0 4 03/19/2001 B 3.8.4 1 11 01/2212002 B 3.4.5 0 6 03/19/2001 B 3.8.5 0 4 03/19/2001 B 3.4.6 1 6 06/03/2005 B 3.8.6 0 8 03/19/2001 B 3.4.7 0 7 03/19/2001 B 3.8.7 1 8 06/20/2003 B 3.4.8 0 4 03/19/2001 B 3.8.8 1 4 06/20/2003 B 3.4.9 3 5 06/03/2005 B 3.8.9 2 14 06/20/2003 B 3.4.10 0 5 03/19/2001 B 3.8.10 0 4 03/19/2001 B 3.4.11 0 8 03/19/2001 B 3.9 REFUELING OPERATIONS ,'>' -3 ot-l B 3.4.12 1 20 10/27/2004 B 3.9.1 0 4 03/19/2001 B 3.4.13 3 6 06/03/2005 B 3.9.2 0 4 03/19/2001 B 3.4.14 0 10 03/19/2001 B 3.9.3 2 7 06/03/2005 B 3.4.15 2 7 11/19/2001 B 3.9.4 0 4 03/19/2001 B 3.4.16 1 7 06/03/2005 B 3.9.5 7 0 4 03/19/2001
-- - -'.B 3.5 ECCS - -,-i. ____
B 3.9.6 2 3 04/08/2005 B 3.5.1 ii 10 10/27/2004 1 06/03/2005 B 3.5.2 B 3.5.3 0 13 4 03/19/2001 I B 3.5.4 0 9 03/19/2001 INDIAN POINT 3 Page 1 of 4 Revision 16
TECHNICAL SPECIFICATION BASES REVISION HISTORY REVISION HISTORY FOR BASES AFFECTED EFFECTIVE SECTIONS REV DATE DESCRIPTION Initial issue of Bases derived from NUREG-1431, in ALL 0 03/19/01 conjunction with Technical Specification Amendment 205 for conversion of 'Current Technical Specifications' to
'Improved Technical Specifications'.
BASESUPDATE PACKAGE 01-031901 i' Changes regarding containment sump flow monitor per B 3.4.13 1 03/19/01 NSE 01-3-018 LWD Rev 0. B 3.4.15 Change issued concurrent with Rev 0. BASES UPDATE PACKAGE 02-051801 - - At - Table of Contents 1 05/18/01 Title of Section B 3.7.3 revised per Tech Spec Amend 207 B 3.7.3 1 05/18/01 Implementation of Tech Spec Amend 207 BASES UPDATE PACKAGE 03-111901'; -;;-; Correction to statement regarding applicability of Function B 3.3.2 1 11/19/01 5, to be consistent with the Technical Specification. Changes to reflect reclassification of certain SG narrow B 3.3.3 1 11/19/01 range level instruments as QA Category M per NSE 97 439, Rev 1. Changes to reflect installation of a new control room alarm B 3.4.13 2 11/19/01 for 'VC Sump Pump Running'. Changes per NSE 01 8 3.4.15 018, Rev 1 and DCP 01 023 LWD. Clarification of allowable flowrate for CRVS in 'incident 8 3.7.11 1 11/19/01 mode with outside air makeup.'
; BASES UPDATE PACKAGE 04 -01220222- At B 3.3.2 2 01/22/02 Clarify starting logic of 32 ABFP per EVL-01-3-078 MULTI, Rev 0.
B 3.8.1 1 01/22/02 Provide additional guidance for SR 3.8.1.1 and Condition Statements A.1 and B.1 per EVL-01-3-078 MULTI, Rev 0. B 3.8.4 1 01/22/02 Revision of battery design description per plant modification and to reflect Tech Spec Amendment 209. B 3.8.9 1 01/22/02 Provide additional information regarding MCC in Table B 3.8.9-1 per EVL-01-3-078 MULTI, Rev 0. r BASES UPDATE:PACKAGE:05-0 93002.;: B 3.0 1 09/30/02 Changes to reflect Tech Spec Amendment 212 regarding delay period for a missed surveillance. Changes adopt _ TSTF 358, Rev 6. B 3.3.1 1 09/30/02 Changes regarding description of turbine runback feature per EVAL-99-3-063 NIS. B 3.3.3 2 09/30/02 Changes lo reflect Tech Spec Amendment 211 regarding CETs and other PAM instruments. B 3.7.9 1 09/30/02 Changes regarding SWN 1 and -2 valves per EVAL-00-3-095 SWS, Rev 0. INDIAN POINT 3 Page 2 of 4 Revision 16
TECHNICAL SPECIFICATION BASES REVISION HISTORY AFFECTED EFFECTIVE SECTIONS REV DATE DESCRIPTION
,,_________ 5 -- 'BASES UPDATE PACKAGE 06-120402;..f--:
B 3.3.2 3 12/04/02 Changes to reflect Tech Spec Amendment 213 regarding B 3.6.6 1 11.4% power uprate. B 3.7.1 1 B 3.7.6 1 ' '.1/4', A c 6!-PBASES UPDATE PACKAGE 07-031703-,';-/-, B 3.3.8 1 03/17/2003 Changes to reflect Tech Spec Amendment 215 regarding B 3.7.13 1 implementation of Alternate Source Term analysis B 3.9.3 1 methodology to the Fuel Handling Accident. .,. ,BASES *UPDATE PACKAGE 08- 0328032.f.;.- B 3.4.9 1 03/28/2003 Changes lo reflect Tech Spec Amendment 216 regarding relaxation of pressurizer level limits in MODE 3. __________BASES UPDATE PACKAGE 09-062003?,a,- . C B 3.4.9 2 06/2012003 Changes to reflect commitment for a dedicated operator per Tech Spec Amendment 216. B 3.6.5 1 06/20/2003 Implements Corrective Action 11 from CR-IP3-2002-02095; 4 FCUs should be in operation to assure representative measurement of containment air
-temperature.
B 3.7.11 2 06/20/2003 Correction to Background description regarding system response to Firestat detector actuation per ACT 02-62887. B 3.7.13 2 06/20/2003 Revision to Background description of FSB air tempering units to reflect design change per DCP 95-3-142. B 3.8.7 1 06/20/2003 Changes to reflect replacement of Inverter 34 per DCP-B 3.8.8 1 06/20/2003 01-022. B 3.8.9 2 06/20/2003 _ r-W,¢;ka-T,-.;-' BASES UPDATE PACKAGE.01027 1027044;t,. U B 3.1.3 1 10/27/2004 Clarification of the surveillance requirements for TS 3.1.3 per 50.59 screen. B 3.3.5 1 10/27/2004 Clarify the requirements for performing a Trip Actuating Device Operational Test (TADOT) on the 480V degraded __ _ grid and undervoltage relays per 50.59 screen. B 3.4.3 1 10/27/2004 Extension of the RCS pressure/temperature limits and corresponding OPS limits from 16.17 to 20 EFPY (TS B 3.4.12 1 Amendment 220). B 3.5.1 1 10/27/2004 Changes to reflect Tech Spec Amendment 222 regarding extension of completion time for Accumulators. Z'S B 4 A; K-,SE BSAES EUPDATE PACKA GEAEI "A2 0E011 F 21004 i B 3.7.7 1 _f 12/17/2004 Addition of valves CT-1300 and CT-1302 to Surveillance SR 3.7.7.2 to verify that all city water header supply isolation valves are open. Reflects Tech Spec l_ Amendment 218. fe _E ><'4a f~b9-<>':BSSUPDATE P.ACKAGE 12-012405: ' .- >AFzg ; B 3.7.11 3 01/24/2005 Temporary allowance for use of KI/SCBA for unfiltered inleakage above limit. INDIAN POINT 3 Page 3 of 4 Revision 16
TECHNICAL SPECIFICATION BASES
-REVISION HISTORY AFFECTED EFFECTIVE 1 SECTIONS REV DATE l DESCRIPTION
,,- - -BASES UPDATE PACKAGE 13-022505-B 3.7.5 1 02125/2005 Clarification on Surveillance Requirement 3.7.5.3 as it relates to plant condition/frequency of performance of Auxiliary Feedwater Pump full flow testing.
,;________ __ ,.BASES UPDATE PACKAGE 14-030705^
B 3.9.6 1 03/07/2005 Changes to reflect that the decay time prior to fuel movement is a minimum of 84 hours per Tech Spec
, IAmendment 215.
BASES UPDATE PACKAGE 15-040805 - B 3.3.2 4 04/07/2005 Changes to reflect AST as per Tech Spec Amendment B 3.3.6 1 224. B. 3.3.7 1 B 3.7.11 4 NOTE: In addition to the AST changes to B. 3.7.11, the B 3.7.14 1 temporary allowance for use of Kl/SCBA for unfiltered B 3.9.6 2 inleakage above limit is being removed. Tracer Gas testing is complete. __________ :;W
, >~-vBASES
,; UPDATE PACKAGE 16-060305' '
B 2.1.1 1 06/03/2005 Changes to reflect SPU as per Tech Spec Amendment B 2.1.2 1 225. B 3.1.1 1 B 3.2.2 1 B 3.3.1 2 B 3.3.8 2 B 3.4.1 1 B 3.4.3 2 B 3.4.6 1 B 3.4.9 3 B3.4.13 3 B 3.4.16 1 B 3.5.2 1 B 3.6.2 1 B 3.6.6 2 B 3.6.7 1 B 3.6.9 1 B 3.6.10 1 B 3.7.1 2 B 3.7.2 1 B 3.7.5 2 B 3.7.6 2 B 3.7.8 1 B 3.7.9 2 B 3.7.10 1 B 3.7.13 3 B3.7.17 1 B 3.9.3 2 INDIAN POINT 3 Page 4 of 4 Revision 16
Reactor Core SLs B 2.1.1 B 2.0 SAFETY LIMITS (SLs) B 2.1.1 Reactor Core SLs . . .--_i; - il
- .. . . , I --
- , t ;. , I BASES BACKGROUND GDC 10'(Ref. 1) requires that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients.-and anticipated operational occurrences (AOOs). This is
- accomplished by hiving a departure from nucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95% confidence level (the 95/95.DNB criterion) that DNB will not occur and by requiring that fuel centerline temperature stays below the melting
- temperature.
The restrictions"'of -this SL prevent overheating of the fuel and cladding, as well aspossible cladding perforation, that would result in the release of-fis's'ion products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state
peak linear heat'rrate'(LHR) below the level at which fuel centerline
'-mel ting occurs. Overhating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime,
'wheree'the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant' saturation temperature.
Fuel centerline meltingo'ccurs when the local LHR. or power peaking, in a region of the fuel is high enough to cause the fuel centerline
- temperature to reach :the melting point of the fuel. Expansion of the pellet upon'centerline'melting-may cause the pellet to stress the
-cladding to the point of:failure.'-allowing an uncontrolled release of activity to the reactorcoolant.
Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature-because of the onset of DNB and the resultant sharp reduction in heat transfer coefficient. Inside the'steam filflm high cladding temperatures are reached.' and a cladding-water (zirconium'water) reaction may'take place. This chemical reaftion.:results'in oxidation'of the fuel cladding to a structurally weaker foim.- This weaker form may lose its integrity, resulting in an uncontrolled release of-activity to the reactor coolant. The proper functioning of the Reactor Protection System (RPS) and steam generator safety valves prevents violation of the reactor core SLs. (continued)
- evison .
INDIN PONT3B 2 1 *r 1 1 INDIAN POINT 3 B 2.1.'I' 1 ' .. Revision 1
i Reactor Core SLs 8 2.1.1 BASES ) APPLICABLE SAFETY ANALYSES The fuel cladding must not sustain damage as a result of normal operation and AOOs. The reactor core SLs are established to preclude violation of the following fuel design criteria:
- a. There must be at least 95X probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB;:and.
- b. The hot fuel pellet in the core'must not experience centerline fuel melting.
'The Reactor Protection System (Ref.-2). in combination with all the LCOs,'are desfied'to prevent any anticipated combination of transient conditions for Reactor Coolant System (RCS) temperature, pressure. RCS
, flow. Delta I. and THERMAL POWER level that would result in a departure from nucleate boiling ratio (DNBR) of less than the DNBR
' limit and preclude the existence of-flow instabilities.
Automatic enforcement of these reactor core SLs is provided by the appropriate operation of the RPS and the steam generator safety valve. Thelimitation that the average enthalpy in the hot leg be less than or equal'to the enthalpy of saturated liquid also ensures that the CDT measured by instrumentation, used in the RPS design as a measure of core power.,is proportional to core power. The SLs represent a design requirement for establishing the RPS trip setpoints identified previously. LCO 3.4.1.,"RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits.' or the assumed initial conditions of the safety analyses'(as indicated in the FSAR, Ref. 2) provide more restrictive limits to ensure that
-the SLs are not exceeded.
- ~~ ~ ~~
. . ;I SAFETY LIMITS The figure provided injthe COLR shows the loci of points of thermal [
power. Reactor Coolant System pressure and vessel inlet temperature for which the calculated DNBR is no less than the Safety Limit DNBR value or the average enthalpy at the vessel exit is less than the enthalpy of saturated liquid. (continued) ) INDIAN POINT 3 B 2.1.1 - 2 Revision 1
Reactor Core SLs B.2.1.1 BASES SAFETY LIMITS The reactor core SLs are established to preclude violation of the (continued) following fuel design'criteria:
- a. There must be at' least a 95X probability at a 95X confidence
- level (the-95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB; and -
- b. There must be at-least a 95X probability at a 95X confidence
- .1 evel that-the hot fuel pellet in the core does not experience centerline fuel melting.
The reactor core SLs are used to define the various RPS functions such that the above criteria are satisfied during steady state operations, normal operational' tiranie-ts, and anticipated operation occurrences (AQOs).. To ensure that the RPS precludes.the violation of the above criteria, additional criteria are applied to the Overtemperature and Overpower Treactor.trip functions. That is, it must be demonstrated
.that the average enthalpy in the hot leg is less than or equal to the saturation enthalpy and.the core exit quality is within the limits defined by the DNBR correlation. Appropriate functioning of the RPS ensures that for variations in the THERMAL POWER, RCS Pressure, RCS
- average temperature,.RCS flow rate, and Delta I that the reactor core SLs will be satisfied during steady state operation. normal operational transients; and A00s.
- The calculation of -these limits assumes:
- 1. FHU - FAHN limit at RTP specified in the COLR;
- 2. An equivalent average steam generator tube plugging level of less than or equal to 10 (Ref. 3);
- 3. Reactor coolant system total flow rate of greater than or equal to 364,700 gpm as measured at the plant; and,
- 4. A reference cosine with a peak of 1.55 for axial power shape.
(continued) INDIAN POINT 3 B22..1 - 3 Revision 1
Reactor Core SLs B 2.1.1 BASES- -- K)j APPLICABILITY SL 2.1.1 only applies in MODES 1 and 2 because these are the only MODES in which the reactor is critical. Automatic protection functions are required to be OPERABLE-during MODES 1 and 2 to ensure operation within the reactor core SLs. The steam generator safety valves or automatic protection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate a reactor trip function. which forces the unit into MODEl3. Setpoints for the reactor trip functions are specified in LCO 3.3.1. *Reactor Protection System (RPS) Instrumentation.' InMODES 3, 4. 5, and 6, Applicability is not required since the reactor is not generating significant THERMAL POWER. SAFETY-LIMIT If SL 2.1.1 is violated; the requirement to go to MODE 3 places VIOLATIONS the unit in a MODE in which this SL is not applicable. The allowed Completion Time of 1 hour recognizes the importance of bringing the unit to a-MODE of operation.where this SL is not applicable, and reduces the probability of fuel damage. REFERENCES 1. 10 CFR 50, Appendix A. I
- 2. FSAR, Section 7.2.
K) INDIAN POINT 3 B 2.1.1 -4 Revision 1
RCS Pressure SL B 2.1.2 B 2.0 'SAFETY LIMITS (SLs) - . a.
....RtC B..
2..2.ns... . RSrs..S B 2.1.2 Reactor Coolant-System (RCS) tPressure-SL-
. . . , ... .. I . -;
. . 1 . I *..
BASE.S : ' BACUCGROUND - The SL on RCS pressure'protects the integrity'of the RCS against overpressurization. In the event of fuel cladding failure, fission products are released'into the reactor coolant. The'RCS then serves
*as the primary barrier in-preventing the release of fission products into the atmosphere.-'By establishing an'pper'limit on RCS pressure.
the continued integrity of the RCS is ensured. According to 10 CFR
- 50. Appendix A. GDC 14. "Reactor Coolant Pressure Boundary. and GDC 15, "Reactor Coolant System Design" (Ref. 1). the reactor coolant pressure boundary (RCPB) design conditions,'are not to be exceeded during normal operation and 'anticipated operational occurrences (AOOs). Also, in 'accordance with GDC 28,"Reactivity Limits' (Ref.
1). reactivity accidents, including rod ejection, do not result in damage'to'the 'RCPB greater than limited local yielding. The design pressure of the RCS is 2485 psig.; During normal operation and AQOs, RCS pressure is limited from exceeding the design pressure by more than 1O,1 in'accordance with Section III of the ASME Code (Ref. 2). To ensure system integrity, all RCS components are hydrostatically tested'at 125% of design pressure, according to the ASME Code requirements prior to initial operation when there is no fuel in the core. Following inception of unit operation. RCS components shall be pressure tested, in accordance with the requirements of ASME Code. Section XI (Ref. 3). Overpressurization of..the'RCS could result in a'breach of the RCPB. If such a breach occurs in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere, raising concerns relative to limits on radioactive releases specified in 10 CFR 50.67. "Reactor Site Criteria' '(Ref. 4). I (continued) INDIAN POINT 3 B ` '2.12 -1 - IR6vision' 1
RCS Pressure SL B 2.1.2 BASES ) APPLICABLE SAFETY The RCS pressurizer safety valves, the main steam safety valves. ANALYSES (MSSVs), and the reactor high pressure trip have settings established to ensure that the RCS pressure SL will not be 'exceeded. The RCS pressurizer safety valves are sized to prevent system pressure from exceeding the design pressure by more than 10X, as specified in Section III of the ASME Code for Nuclear Power Plant Components (Ref. 2). The transient that establishes the required relief capacity, and hence valve size requirements and lift settings. is a complete loss of external load without a direct reactor trip.., During the transient, no control actions are assumed, except that the safety valves on the secondary plant are assumed to open when the steam pressure reaches the secondary plant safety valve settings, and nominal feedwater supply is maintained. The Reactor Protection System setpoints (Ref. 5), together with the settings of the MSSVs, provide pressure protection for normal operation and AOOs. The reactor high pressure trip setpoint is specifically set to provide protection against overpressurization (Ref. 5). The safety analyses-for both the high pressure trip and the RCS pressurizer safety valves are performed using conservative assumptions relative to pressure control devices. ' ) More specifically, no credit is taken for operation of the following:
- a. Pressurizer Power Operated Relief Valves (PORVs);
- b. Atmospheric Dump Valves;
- c. Steam Dump System;
- d. Reactor Control System;
- e. Pressurizer Level Control System; or
- f. Pressurizer Spray.
(continued) INDIAN POINT 3 B 2.1.2 -2 Revision 1
RCS Pressure SL B 2.1.2 BASES SAFETY LIMITS The maximum transient'pressure'allowed in the RCS pressure'vessel under the ASME Code, Section III. is 110% of design pressure. The maximum transient'pressure allowed inthe'RCS piping, valves, and fittings under USAS, Section B31.1 (Ref.'6) is 120% of design pressure. The most limiting of these two allowances is the 110% of design pressure'; therefore', the SL on maximum allowable RCS pressure is 2735 psig. APPLICABILITY SL 2.1.2 applies in MODES 1; 2, 3. 4. and 5 and-in MODE 6 when the reactor vessel head Is on because this SL could be approached or exceeded in'these MODES due'to overpressurization events. The SL is not applicable'-in MODE 6 when reactor vessel head is removed because the RCS can not beipressurized. SAFETY LIMIT If the RCS pressure SL is violated when the reactor is in MODE 1 VIOLATIONS or 2. the requirement is to restore compliance and be in MODE 3 within 1 hour. Exceeding the RCS pressure SL may cause immediate RCS failure and create a potential for radioactive releases in excess of 10 CFR 100. Reactor Site Criteria.' limits (Ref. 4). The allowable Completion Time of 1 hour recognizes the importance of reducing power level -to a MODE of operation where the potential for challenges to safety systems is minimized. If the RCS pressure SL is-exceeded in MODE 3. 4. or 5. RCS pressure must be restored to within the SL value within 5 minutes. Exceeding the RCS pressure SL In MODE 3. 4. or 5 is more severe than exceeding this SL in MODE I or 2, since the reactor vessel temperature may be lower and the vessel material, consequently, less ductile. As such, pressure must be reduced to less than the SL within 5-minutes. The action does not require reducing MODES, since this would require reducing temperature, which would compound the problem by adding thermal gradient stresses to the existing pressure stress. (continued) INDIAN POINT 3 B 2.1.2 - 3 Revision I '
I RCS Pressure SL B 2.1.2 BASES REFERENCES 1. 10 CFR 50, Appendix:A.
- 2. ASME, Boiler and Pressure Vessel Code. Section III, Article NB-7000.50433-
- 3. ASME, Boiler and Pressure Vessel Code, Section XI, Article IWX-5000.
- 4. 10 CFR 50.67.
I I
- 5. FSAR, Section 7.2.
- 6. USAS B31.1, Standard Code for Pressure Piping, American Society of Mechanical Engineers, 1967.
INDIAN POINT 3 B 2.1.2 -4 Revision 1
SDM B 3.1.1 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM) - BASES BACKGROUND 'According to GDC 26 (Ref. 1), the reactivity control systems must be redundant and capable'of holding the reactor core subcritical when' shut down under cold conditions. Maintenance of the SDM ensures that
- postulated reactivity events will not damage the fuel.
.SDM requirementsiprovide sufficient reactivity margin to ensure that
,.acceptable fuel design limits will not be.exceeded for normal shutdown
..and anticipated operational occurrences (AWOs). As such, the SDM
- .defines the degree of.subcriticality that would be obtained i'imediately following the insertion or scram of all shutdown and control rods. assuming-that the single rod.cluster assembly of highest
-reactivityworth is-fully withdrawn.
The system design requires that two independent reactivity control systems be provided,.and that one of these systems be capable of maintaining theicore~subcritical under cold conditions. These requirements are provided by the use of movable control assemblies and soluble boric acid-in the Reactor Coolant System (RCS). The Control
'.Rod.System can compensate forthe reactivity effects of the fuel and water.temperature Ichanges accompanying power level changes over the rangefrom fulload-;to no load. In addition, the Control Rod System, X together with the boration system, provides the SDM during power
, operation and is.capable of making the core subcritical rapidly enough to prevent exceeding acceptable fuel damage limits, assuming that the
..rod of;highest-reactivity worth remains fully withdrawn. The soluble
'boron system;can compensate for fuel depletion during operation and all xenon burnout reactivity changes and maintain the reactor
. subcritical under cold~conditions.
-Duringpower operation; SDM control is ensured'by operating with the
-.shutdown banks-withinthe limits of LCO 3;1.5. "Shutdown Bank Insertion Limits!,-andthe control banks within the limits of LCO
. 3.1.6. "Control BankInsertion Limits.'
(continued) INDIAN POINT 3 B. 3.1.1-ON 3 , I Revision 1
SD1 B 3.1.1 BASES BACKGROUND When the unit is in the shutdown and refueling mbdes, the 5DM (continued) requirements are met by means of adjustments to the RCS boron concentration. APPLICABLE SAFETY ANALYSES The minimum required SDM is assumed as an initial condition in safety analyses. The safety analysis (Ref. 2) establishes an SDM that ensures specified acceptable fuel design limits are not exceeded for normal operation and AOOs. with the assumption of the highest worth rod stuck out on scram. For MODE 5, the primary safety analysis that relies on the SDM limit is the boron dilution analysis. The acceptance criteria for the SDM requirements are that specified acceptable fuel design limits are maintained.' This is done by ensuring that:
- a. The reactor can be made subcritical from all operating conditions, transients, and Design'Basis Events;
- b. The reactivity transients associated with postulated accident K conditions are controllable within acceptable limits (departure from nucleate boiling ratio (DNBR). fuel centerline temperature limits~for AOOs, and energy deposition of 225 cal/gm for non-irradiated fuel and 200 cal/gm for irradiated fuel to satisfy requirements for the rod ejection accident): and
- c. The reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition.
The most limiting accident for the SDM requirements is based on a main steam line break (MSLB). as described in the accident analysis (Ref. 2). The increased steam flow resulting from a pipe break in the main steam'system causes an increased energy rem6val'from the affected steam generator (SG). and consequently the RCS. This results in a reduction of the reactor coolant temperature. The resultant coolant shrinkage causes a reduction in pressure. (continued) ) INDIAN POINT 3 B. 3.1.1 - 2 Revision 1
SUM
-iB 3.1.1 BASES APPLICABLE SAFETY ANALYSES (continued)
In the presence of a negative moderator temperature coefficient, this cooldown causes aniincrease-in core reactivity. As RCS temperature decreases. the 'severity of an MSLB decreases until the MODE 5 value is reached. The most limiting MSLB. with respect to potential fuel damage before'areacto'r 'trip occurs, is a'guillotine break of a main steam line'inside containment initiated at the end of core life. The positive reactivity'Waddition from the moderator temperature decrease will terminate when -the affected SG boils dry. thus terminating RCS heat removal and cooldown. Following' the MSLB. a post trip return to power may occur: however, no fuel damage occurs as a result of the
'post trip return to power. and THERMAL POWER does not violate the Safety' Limit '(SL)'requirement of SL 2.1.1.
In'addition to the limiting MSLB transient, the SUM requirement must also protect against:
*a. Inadvertent boron'dilution;
- b. An'uncontrolled rod withdrawal from subcritical or low power condition,':'>'> '
- c. Startup of an inactive reactor coolant pump (RCP); and
- d. Rod ejection.~--':-. :'
Each of these events is-discussed below.'
-In the borontdilution-'analysis, the'required SDM defines the reactivity difference'between an initial subcritical boron concentration and the cbrresponding'critical boron concentration.
These values.'-in c6njunction:with the configuration of the RCS and the
'assumed dilution flow 'rate.,directly affect'the results of the
'*analysis.. This'event^is'most limiting at the beginning of core life, when'critical boron' c6ncentrations are highest.-
Depending on the system initial conditions and reactivity insertion rate, the uncontrolled rod withdrawal transient is terminated by either a high neutron'flux level trip or a overterrperature T (continued) INDIAN POINT 3 B. 3.1.1-- 3 Rev~ision 1 Rion
I SDM B 3.1.1 BASES -iV APPLICABLE SAFETY ANALYSES (continued) trip. In all cases, power level, RCS pressure, linear heat rate, and the DNBR do not exceed allowable limits. The startup of an inactive RCP will not result in a mcold water" criticality, even if the maximum difference in temperature exists between the SG and the core. The maximum positive reactivity addition that can occur due to an inadvertent RCP start is less than the minimum required SDM. Startup of an idle RCP cannot, therefore, produce a return to power from the hot standby condition. The ejection of a control rod rapidly adds reactivity to the reactor core, causing both the core power level and heat flux to increase with corresponding increases in reactor coolant temperatures and pressure. The ejection of a rod also produces a time dependent redistribution of core power. SDM satisfies Criterion 2 of 10 CFR 50.36. Even though it is not directly observed from the control room, SDM is considered an initial condition process variable because it is periodically monitored to ensure that the unit is operating within the bounds of accident analysis assumptions. LCO SDM is a core design condition that can be ensured during operation through control rod positioning (control and shutdown banks) and through the soluble boron concentration. The MSLB (Ref. 2) and the boron dilution (Ref. 2) accidents are the most limiting analyses that establish the SDM value of the LCO. For MSLB accidents. if the LCO is violated, there is a potential to exceed the DNBR limit and to exceed 10 CFR 50.67, "Reactor Site Criteria.l limits (Ref. 3). For the boron dilution accident, if the LCO is violated, the minimum required time assumed for operator action to terminate dilution may no longer be applicable. (continued) 3 INDIAN POINT 3 B. 3.1.1 - 4 Revision 1
SDM B 3.1.1 BASES ... APPLICABILITY In MODE 2 with key < 1.0 and in MODES 3.'4,and 5.-the SDM requirements are applicable to provide sufficient negative reactivity to meet the
'assumptions of the safety analyses discussed above. In MODE 6. the shutdown reactivity'requirements are given in LCO 3.9.1. "Boron Concentration." In MODES I and 2. SUM is ensured by complying with LCO 3.1.5. "ShutdowfiiBank Insertion Limits,' and' CO 3.1.6. Control Bank Insertion Limits.
ACTIONS A.1 If theSDM requirements are not met. boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align.and start the'required systems and components. It is assumed that boration will be continued until the SDM requirements are met. In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. 'Since 'it'Isimperative to raise the'boron concentration of the RCS'as' soon as possible. the boron concentration should be a highly concentrated solution, such as that normally found in the boric acid storage tank, or the refueling water storage tank. The operator should'borate with' he'best source available for the plant conditions. SURVEILLANCE REOUIREMENTS' SR 3.1.1.1 In MODES 1 and 2. SDM is verified by observing that the requirements of LCO 3.1.5 and LCO 3.1.6 are met. In the event that a rod is known to be untrippable, however;'SDM verification must account for the worth of the untrippable rod as well as another rod of maximum worth. (continued) INDIAN-POINT 3 B. 3.1.1 5io IRevision Rv 1
SDM B 3.1.1 BASES ) SURVEILLANCE REOUIREMENTS (continued) In MODES 3, 4, and 5, the SDM is verified by performing a reactivity balance calculation, considering the listed reactivity effects:
- a. RCS boron concentration;
- b. Control bank position;
- c. RCS average loop temperature:
- d. Fuel burnup based on gross thermal energy generation;
- e. Xenon concentration:
- f. Samarium concentration; and
- g. Isothermal temperature coefficient (ITC).
Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS. 9 The Frequency of 24 hours is based on the generally slow change in required boron concentration and the low probability of an accident occurring without the required SDM. This allows time for the operator to collect the required data, which includes performing a boron concentration analysis, and complete the calculation. REFERENCES 1. 10 CFR 50, Appendix A.
- 2. FSAR, Chapter 14.
- 3. 10 CFR 50.67.
I) INDIAN POINT 3 B. 3.1.1 - 6 Revision 1
FNAH B 3.2.2 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 Nuclear Enthalpy Rise Hot Channel Factor (FNAH) BASES - BACKGROUND The purpose of this LCO 'isto establish limits on the power density at anyr point in the.core so that the fuel design criteria are not exceeded and the accident analysis assumptions remain valid. The design limits on local (pellet) and integrated fuel'rod peak power density are expressed in terms of hot channel factors. Control of the core power distribution with respect to these factors ensures that local conditions in the fuel rods and coolant channels do not challenge core integrity at any location during either normal operation or a postulated accident analyzed in the safety analyses. FNAH is defined as'<the ratio of the integral of the linear power along the fuel rod with the highest integrated power to the average
-integrated fuel r6d power'. Therefore. FNAH is a measure of the maximum total power produked in a fuel'rod.
FNAH is sensitive to.fuel loading patterns, bank insertion, and fuel burnup. FNM typically-increases with control bank insertion and typically decreases with fuel burnup. FN. ils not directly'measurable'but is inferred from a power distribution mapobtained with the movable incore detector system. Specifically, the results:of the three'dimensional power distribution map are analyzed by a computer to determine FNAH. This factor is calculated at-least every 31 EFPD. However, during power operation. the global power,,distribution is monitored by LCO 3.2.3. AXIAL FLUX DIFFERENCE (AFD),,andLCO 3.2.4. OQUADRANT.,POWER TILT RATIO (OPTR)," which address directly'and continuously measured process variables. The COLR provides' peaking factor limits that ensure that the design basis value of the departure from nucleate boiling (DNB) is met for normal operation'.operational transients, and any transient condition arising from events of moderate frequency. (continued) INDIAN POINT 3 B .3.2..2- 1 Rev~ision 1
I FNOm B 3.2.2 BASES K) BACKGROUND The DNB design basis precludes DNB and is met by limiting the (continued) minimum local DNB heat flux ratio to 1.3 using the W3 CHF correlation. All DNB limited transient events are assumed to begin with an FNM value that satisfies the LCO requirements. Operation outside the LCO limits may produce unacceptable consequences if a DNB limiting event occurs. The DNB design basis ensures that there is no overheating of the fuel that results in possible cladding perforation with the release of fission products to the reactor coolant. APPLICABLE SAFETY ANALYSES Limits on FNMu preclude core power distributions that exceed the following fuel design limits:
- a. There must be at least 95% probability at the 95% confidence level (the 95/95 INB criterion) that the hottest fuel rod in the core does not experience a DNB condition;
- b. During a large break loss of coolant accident (OCA), peak cladding temperature (PCT) must not exceed 2200EF:
- c. During an ejected rod accident, the energy deposition to the C) fuel must not exceed 225 calories/gram for non-irradiated fuel and 200 calories/gram for irradiated fuel (Ref. 1): and
- d. Fuel design limits required by GDC 26 (Ref. 2) for the condition when control rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn.
For transients that may be DNB limited, the Reactor Coolant System flow and FNO are the core parameters of most importance. The limits on FNm ensure that the DNB design basis is met for normal operation, operational transients, and any transients arising from events of moderate frequency. The DNB design basis is met by limiting the minimum DNBR to the 95/95 DNB criterion of applicable DNB correlation. This value provides a high degree of assurance that the hottest fuel rod in the core does not experience a DNB. (continued) ') INDIAN POINT 3 B 3.2.2 - 2 Revision 1
FNaH B 3.2.2 BASES APPLICABLE SAFETY ANALYSES (continued) The 'allowable FNHlimit increases with decreasing power level. This functionality in FNmn is included in the analyses that provide the Reactor Core Safety'Limits (SLs) of SL 2.1.1. Therefore, any DNB events in which the calculation of the core limits is modeled implicitly use this iariable value of FNAH in the analyses. Likewise. all transients thatimay be DNB limited are assumed to begin with an initial FNAH a function of power level defined by the COLR limit equation. The LOCA safety analysis indirectly models FNm as an input parameter. The Nuclear Heat Flux Hot'Channel Factor (FVOZ)) and the axial peaking factors are inserted directly into the LOCA'safety analyses that verify the acceptability of the resulting peak cladding temperature (Ref. 3). ' The'fuel is protected in part by Technical Specifications, which ensure'that the initial conditions assumed in the safety and accident analyses remain valid' JThe following LCOs ensure this: LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AF))." LCO 3.2.4. "QUADRANT POWER TILT RATIO (OPTR)." LCO 3.1.6.7'Control Bank Insertion Limits." LCO 3.2.2,'
'Nuclear Enthalpy Rise Hot Channel Factor (FNWm). and LCO 3.2.1.
"Heat Flux Hot Channel Factor (FO(Z))."
FNm and Fa(Z) are measured periodically using the movable incore detector system. Measurements are generally taken with the core at. or near, steady state conditions. Core monitoring and control under transient conditions (Condition 1 events) are accomplished by operating the core within the limits of the 'LCOs on AFD, OPTR, and Bank Insertion' Limits.' FNM satisfies Criterion2 of 10 CFR 50.36. LCO FNMi shall be maintained within the limits of the relationship provided in the COLR. The FNAH limit identifies the coolant flow channel with the maximum enthalpy rise. This channel has the least additional heat removal capability and thus the highest probability for a DNB. (continued) INDIAN POINT 3 B 3.2.-2-'3 Revision 1'
FNaH B 3.2.2 BASES IK) LCO The limiting value of FNAH , described by the equation contained in (continued) the COLR, is the design radial peaking factor used in the unit safety analyses. A power multiplication factor in this equation includes an additional margin for higher radial peaking from reduced thermal feedback and greater control rod insertion at low power levels. The limiting value of FN^i is allowed to Increase a small amount for every 1%RTP reduction in THERMAL POWER as specified in the COLR. APPLICABILITY The FNeM limits must be maintained in MODE 1 to preclude core power distributions from exceeding the fuel design limits for DNBR and PCT. Applicability in other modes is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the coolant to require a limit on the distribution of core power. Specifically, the design bases events that are sensitive to FNAH in other modes (MODES 2 through 5) have significant margin to DNB, and therefore, there is no need to restrict FNAH In these modes. A+/-1L1 (i ACTIONS With FNAH exceeding its limit, the unit is allowed 4 hours to restore FNAH to within its limits. This restoration may, for example, involve realigning any misaligned rods or reducing power enough to bring FNAH within its power dependent limit. When the FNAH limit is exceeded. the DNBR limit is not likely violated in steady state operation. because events that could significantly perturb the FNMi value (e.g., static control rod-misalignment) are considered in the safety analyses. However, the DNBR limit may be violated if a DNB limiting event occurs. Thus, the allowed Completion Time of 4 hours provides an acceptable time to restore FNH to within its limits without allowing the plant to remain in an unacceptable condition for an extended period of time. Condition A is modified by a Note that requires that Required Actions A.2 and A.3 must be completed whenever Condition A is entered. (continued) I) INDIAN POINT 3 B 3.2.2 -4 Revision 1
FNAH B 3.2.2 BASES SES ACTIONS A.U1. (continued) Thu, i.' .. , . uie cini Thus, if.power is not..reduced because this Req'uired Action is completed'within'the 4 hour time period, Required Action A.2 nevertheless requires another measurement and calculation of FNH jwithln'24 hours'jinaccordance with SR 3.2.2.1.
;'However, If~power is reducedbelow 50% RTP, Required Action A.3 requires that another determination of FNSH must be done prior to exceeding 50% RTP, prior to exceeding 75% RTP 'and within 24 hours after reaching or.exceeding 95% RTP. In addition. Required Action A.2
'isperformed if power ascension is delayed past 24 hours.
A.1.2.1 and A.1.2, If the value of FNIH is not restored to within its specified limit either by adjusting a misaligned rod or by reducing THERMAL POWER, the alternative option is toyreduceTHERMAL POWER to < 50% RTP in accordance with Required Action A.1.2.1 and reduce the Power Range Neutron Flux- High to # 55%-RTP in accordance with Required Action A.1.2.2. Reducing"THEFMAL POWER to < 50% RTP increases the DNB margin and does not likely'cause the DNBR limit to be violated in steady state operation.' :The reduction in trip"sSetpoints ensures that continuing operation remains at an acceptable low power level with adequate DNBR margin. The allowed Completion Time of 4 hours for Required Action A.1-2.1'is consistent with those' allowed for in Required Action A.1.1 and provides an acceptable' time to reach the required power level from full power operation without allowing the plant to remain in an unacceptable condition for an extended period of time. The Completion Times of 4 hours for Required Actions A.1.1 and A.1.2.1 are not additive.
-The allowed Cotrpletion'Time of 72 hours to reset the trip setpoints per Required Action'A.1.2.2 recognizes that, once power is reduced.
the safety analysis.assumptions are satisfied and there is no urgent need to reduce the trip setpoints. This is a sensitive operation that may inadvertently trip the'Reactor Protection System. (continued) 1.3. _'I.-2'"5 I Re.vision 1 INDIAN POINT 3
-A-FNAM B 3.2.2 BASES ACTIONS AK.
(continued) Once the power level has been reduced to < 50% RTP per Required Action A.1.2.1, an incore flux map (SR 3.2.2.1) must be obtained and the measured value of FNAH verified not to exceed the allowed limit at the lower power level. The unit is provided 20 additional hours to perform this task over and above the 4 hours allowed by either Action A.1.1 or Action A.1.2.1. The Completion Time of 24 hours is acceptable because of the increase in the DNB margin, which is obtained at lower power levels. and the low probability of having a DNB limiting event within this 24 hour period. Additionally. operating experience has indicated that this Completion Time is sufficient to obtain the incore flux map, perform the required calculations, and evaluate FNAH Verification that FNAH is within its specified limits after an out of limit occurrence ensures that the cause that led to the FNAH exceeding its limit is corrected, and that subsequent operation proceeds within the LCO limit. This Action demonstrates that the FNAH limit is within the LCO limits prior to exceeding 50% RTP, again prior to exceeding 75% RTP, and within 24 hours after THERMAL POWER is $ 95% RTP. This Required Action is modified by a Note that states that THERMAL POWER does not have to be reduced prior to performing this Action. B1 When Required Actions A.1.1 through A.3 cannot be completed within their required Completion Times, the plant must be placed in a mode in which the LCO requirements are not applicable. This is done by placing the plant in at least MODE 2 within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience regarding the time required to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems. (continued) K INDIAN POINT 3 B 3.2.2 -6 Revision 1
FN&H B 3.2.2 BASES SURVEILLANCE REQUIREMENTS The value of FNAH is determined by using the movable incore detector system to obtain a flux distribution map. A data reduction computer program then calculates the maximum value of FNAH from the measured flux distributions. The measured value of FNAH must be multiplied by 1.04 to account for measurement uncertainty before making comparisons to the FNAH limit. After each refueling, FNAH must be determined in MODE 1 prior to exceeding 75% RTP. This requirement ensures that FNai limits are met at the beginning of each fuel cycle. The 31 EFPD Frequency is acceptable because the power distribution changes relatively slowly over this amount of fuel burnup. Accordingly, this Frequency is short enough that the FNAH limit cannot be exceeded for any significant period of operation. REFERENCES 1. FSAR 14.2.6.
- 2. 10 CFR 50, Appendix A.
- 3. 10OCFR 50.46.- -
INDIAN POINT 3 B 3.2.2 - 7 Revision I
RPS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protection System (RPS)I'nstrumentation BASES ' - BACKGROUND The' RPS initiates a unit shutdown,based on the values of selected unit parameters.to-protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (AOOs) and to assist the
'Engineered Safety 'Features'(ESF) Systems'in mitigating accidents.
The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying limiting safety'system'settings (LSSS) in terms'of parameters directly monitored by the RPS, as well'as'specifying LCOs on other reactor system parameters and'equipment-performance. The LSSS, defined in~this'specification as the'Allowable Value, in conjunction with th6eLCOs, 'establish the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs,- During AOOs,*'which are those events expected to occur one or more times during the unit life, the acceptable limits are:
- 1. The Departure'from Nucleate Boiling Ratio'(DNBR) shall be maintained aabbvi the Safety Limit (SL) value to prevent departure from nucleate boiling (DNB):
- 2. Fuel centerline melt shall not occur; and
-3.;The RCS pressure SL of 2735 psig shall not be exceeded.
- Operation within thieSLs of Specification'2.0, 'Safety Limits (SLs).'
also maiitains the-abo~v values and assures that offsite dose will be within the 10 CFR'50 and 10 CFR 50.67 criteria during AOOs. I
- - (continued)
INDIAN POINT 3 "B-J.3;1-1 i Revision 2
VI RPS Instrumentation B 3.3.1 BASES 3 BACKGROUND Accidents are events that are analyzed even though they are not (continued) expected to occur during the unit life. The acceptable limit during accidents is that offsite dose shall be maintained within an acceptable fraction of 10 CFR 50.67 limits. Different accident categories are allowed a different fraction of these limits, based on probability of occurrence. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event. The RPS instrumentation is segmented into four distinct but interconnected modules as described in FSAR. Chapter 7 (Ref. 1). and as identified below:
- 1. Field transmitters or process sensors: provide a measurable electronic signal based upon the physical characteristics of the parameter being measured;
- 2. Signal Process Control and Protection System including Analog Protection System, Nuclear Instrumentation System (NIS). field contacts, and protection channels: provides signal conditioning, bistable setpoint comparison, process algorithm actuation. compatible electrical signal output to protection system devices, and control board/control room/miscellaneous 3
indications;
- 3. RPS automatic initiation relay logic. including input. logic, and output: initiates proper unit shutdown in accordance with the defined logic, which is based on the bistable outputs from the signal process control and protection system; and
- 4. Reactor trip switchgear, including reactor trip breakers (RTBs) and bypass breakers: provides the means to interrupt power to the control rod drive mechanisms (CRDMs) and allows the rod cluster control assemblies (RCCAs). or "rods,. to fall into the core and shut down the reactor. The bypass breakers allow testing of the RTBs at power.
(continued) &. INDIAN POINT 3 B 3.3.1-2 Revision 2
RPS Instrumentation B 3.3.1 . BASES .. ..-.... BACKGROUND Field Transmitters' or Sensors (continued) To meet the design demands for redundancy and reliability, more than one,.and often as'many as four, field transmitters or sensors are r - used to measure unit parameters. To account for the calibration
-tolerances and instrument drift, which are assumed to occur between calibrations, statistical'allowances are provided in the Allowable Values. *The OPERABILITY'of each transmitter or sensor can be evaluated when lts:.ias'found' calibration'data are compared against its documented Allowable Value.
Signal Process Control and Protection System
-Generally, three or'four channels of process control equipment are used for the signal'processing of unit parameters measured by the field instruments..' The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with
*setpoints establishedito ensure that actuation will occur within the limits assumed inthe accident analyses (Ref. 3). If the measured value of a unit parameter exceeds the predetermined setpoint. an output from a bistable is forwarded to the RPS relay logic. Channel separation is maintained up to'and through the actuation logic.
However, not allpunit'parameters require four channels of sensor measurement and signal processing. Some unit parameters provide input only to the RPS relay logic, while others provide input to the RPS relay'logic, the main'control board, the unit computer, and one or more control'systems. - Generally, if a parameter is used only for input to the protection circuits, three chaniels-.with'a two-out-of-three logic are sufficient td provide therequired-reliability and redundancy. If one channel fails in a'directi6 that would not result in a partial Function trip,,the Function'is still OPERABLE with a two-out-of-two logic. If one:channel falls, such that a partial Function trip occurs, a trip will not occur':and the Function isistill OPERABLE with a one-out-of-two logic'.' ' - Generally, if a parameter is used for input to the RPS relay logic and a control function, four channels with a two-out-of-four logic (continued) INDIAN POINT 3 B-3.3. 1---3 Revision 2'
RPS Instrumentation B 3.3.1 BASES I) BACKGROUND are sufficient to provide the required reliability and redundancy. (continued) The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Again, a single failure will neither cause nor prevent the protection function actuation. These requirements are described in IEEE-279-1968 (Ref. 4). The actual number of channels required for each unit parameter is specified in Reference 1 and discussed later in these Technical Specification Bases. Two logic channels are required to ensure no single random failure of a logic channel will disable the RPS. The logic channels are designed such that testing required while the reactor is at power may be accomplished without causing trip. TriD Setpoints and Allowable Values The following describes the relationship between the safety limit. analytical limit, allowable value and channel component calibration acceptance criteria:
- a. A Safety Limit (SL) is a limit on the combination of THERMAL POWER, RCS highest loop average temperature, and RCS pressure needed to protect the integrity of physical barriers that guard against the uncontrolled release of radioactivity (i.e., fuel.
fuel cladding. RCS pressure boundary and containment). The safety limits are identified in Technical Specification 2.0. Safety Limits (SLs).
- b. An Analytical Limit (AL) is the trip actuation point used as an input to the accident analyses presented in FSAR, Chapter 14 (Ref. 3). Analytical limits are developed from event analyses models which consider parameters such as process delays, rod insertion times, reactivity changes, instrument response times, etc. An analytical limit for a trip actuation point is established at a point that will ensure that a Safety Limit (SL) is not exceeded.
(continued) I3_ INDIAN POINT 3 B 3.3.1-4 Revision 2
RPS Instrumentation B 3.3.1 BASES .. BACKGROUND . c. AnAllowableValu&(AV) is the limiting actuation point for
' (continued) the entire channel of atrip function that will ensure', within the requiredlevel of'confidence, that sufficient allocation existsbetween.this actual trip function actuation point and
-the analytical:limit. The Allowable Value is more conservative than the'Analytical 'Limit to account for instrument uncertainties that either are not present or are not measured during periodic testing., Channel uncertainties that either are notipresent-or are not measured during periodic testing may include design'basis accident temperature and radiation effects (Ref. 5) or process dependent effects. The channel allowable value for each RPS function is controlled by Technical
*Specifications -and is listed in Table 3.3.1-1. Reactor Protection System Instrumentation.
- d. Calibration acceptance criteria are established by plant
,.administrative:programs for the components of a channel (i.e..
required sensor, alarm, interlock, display, and trip function). The calibration acceptance criteria are established to ensure. within the required.level of confidence, that the Allowable Value for the entire channel will not be exceeded during the calibration interval.- A description of the methodology used to calculate the channel allowable values and calibration acceptance criteria is provided in References 6 and 8.- iSetpoints in accordance with the Allowable iValue ensure that SLs are not violated during AOOs (and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at
- the onset of the AOO'or DBA and the equipment functions as designed).
Each channel-of the relay logic protection system can be tested on line to verify.that'the.signal or setpoint accuracy is within the specified allowance.requirements:of calculations performed in
.accordance with Reference.6 that are based on analytical limits consistent with Reference 3. Once a designated'channel is taken out of service for testing- a simulated signal is injected in place of the field instrument'signal.'
(continued) INDIAN POINT 3 B 13.3.1-5 Revision 2
RPS Instrumentation B 3.3.1 BASES
'\)
BACKGROUND The process equipment for the channel in test is then tested. (continued) verified, and calibrated. SRs for the channels are specified in the SRs section. The Allowable Values listed in Table 3.3.1-1 and the Trip Setpolnts calculated to ensure that Allowable Values are not exceeded during the calibration interval are based on the methodology described in Reference 6. which incorporates all of the known uncertainties applicable for each channel. All field sensors and signal processing equipment for these channels are assumed to operate within the allowances of these uncertainty magnitudes. Relay Logic Protection System Relay logic is used for the decision logic processing of outputs from the signal processing equipment bistables. To meet the redundancy requirements, two trains of relay logic, each performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide reactor trip and/or ESF actuation for the unit. If both trains are taken out of service or placed in test, a reactor trip will result. Each train Is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements. The system has been designed to trip In the event of a loss of power, directing the unit to a safe shutdown condition. The relay logic performs the decision logic for actuating a reactor trip or ESF actuation, generates the electrical output signal that will initiate the required trip or actuation, and provides the status, permissive, and annunciator output signals to the control room. The bistable outputs from the signal processing equipment are sensed by the relay logic equipment and combined into logic matrices that represent combinations indicative of various unit upset and accident transients. If a required logic matrix combination is completed, the system will initiate a reactor trip or send actuation signals via master and slave relays to those. components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition. Examples are given in the Applicable Safety Analyses, LCO. and Applicability sections of this Bases. (continued) INDIAN POINT 3 B 3.3.1-6 Revision 2
RPS Instrumentation I1 . B 3.3.1 BASES BACKGROUND - Reactor Trip Breakers (continued) The The RTBs are in the electrical power supply'line from the control rod drive motor generator set power supply to the CRDMs. Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods and control rods tf6fall into the' core by gravity. Each RTB is equipped with a bypass'breaker'to allow testing of the RTB while the unit is at power'. 'During normal operation the output from the reactor protection'system is a voltage signal that energizes the undervoltage coils in'the RTBs and bypass breakers, if in use. When the required logic matrix 'ombination is completed, the reactor protection system output voltage signal is removed, the undervoltage coils are de-energized,' the breaker trip lever is actuated by the de-energized undervoltage coil, and the RTBs and bypass breakers are tripped open. This allows the shutdown rods and control rods to fall into the core. In`additlon to the de-energization'of'the' undervoltage coils, each breaker is also equipped with a shunt trip device that is energized to trip the breaker open upon receipt of a reactor trip'signal from the reactor protection system. Either the undervoltage coil or the'shunt'trip mechanism is sufficient by Itself, thus providing a diverse trip mechanism. There are two reactor' trip breakers in series so that opening either will-interrupt power to the control rod drive mechanisms (CRDMs) and allow the rod cluster'control assemblies (RCCAs). or 'rods,' to fall into the core and:shut down the reactor. 'Each reactor trip breaker has a parallel reactor-trip bypass breaker that is normally open. This feature allows'testing of the reactor trip breakers at power. A trip'signal from RPS-logic train A will trip reactor trip breaker A and reactor trip bypass breaker B; and, a trip signal from logic train B will trip reactor trip breaker B and reactor trip bypass breaker A. During normal operation, both'reactor trip breakers are closed and both reactor trip bypass breakers are open. An interlock trips-both reactor trip bypass breakers if an'attempt is made to close a reactor'trip bypass breaker when the other reactor trip bypass breaker .isalready closed. A trip breaker train consists of both the reactor trip breaker and reactor trip bypass breaker associated with a single RPS logic train if the breaker is racked in, closed, and capable of supplying power (continued) INDIAN POINT 3 B ,3.3.1-7 . Revision 2
RPS Instrumentation B 3.3.1 BASES ) BACKGROUND to the CRD System. Thus, the train consists of the main breaker: or, (continued) the main breaker and bypass breaker associated with this same RPS logic train if both the breaker and bypass are racked in,closed, and capable of supplying power to the CRD System. The RPS decision logic Functions are described in the functional diagrams included in Reference 2. In addition to the reactor protection and ESFAS trips, the various permissive interlocks' that are associated with unit conditions are also described. When any one RPS train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed. APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY The RPS functions to maintain the Safety Limits (SLs) during all Abnormal Operating Occurrences (AOOs) and mitigates the consequences of DBAs in all MODES in which the Rod Control system is capable of rod withdrawal and one or more rods not fully inserted. Each of the analyzed accidents and transients can be detected by one \ or more RPS Functions. The accident analysis described in Reference 3 takes credit for most RPS trip Functions. RPS trip Functions not specifically credited in the accident analysis are qualitatively credited in the safety analysis and the NRC staff approved licensing basis. These RPS trip Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. They may also serve as backups to RPS trip Functions that were credited in the accident analysis. The LCO requires all instrumentation performing an RPS Function. listed in Table 3.3.1-1 in the accompanying LCO. to be OPERABLE. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. (continued) INDIAN POINT 3 B 3.3.1-8 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) The LCO generally requires OPERABILITY of four or three channels in each instrumentation Function, two channels of Manual Reactor Trip. and two trains in each Automatic Trip Logic Function. Generally, four OPERABLE instrumentation channels in a two-out-of-four configuration are required when one;RPS channel is also used as a control system
,,input. Isolation amplifiers prevent a control system failure from affecting-the-protection system (Ref. 1). This configuration accounts for the possibility of the shared channel failing in such a manner-that it creates a transient that:requires RPS action. In this case, the RPS will.still provide protection, even with random failure of one of the other three protection channels. Three OPERABLE instrumentation channels in a two-out-of-three configuration are generally required~when there is no potential for control system and protection system lnteraction that could simultaneously create a need for RPS.trip and disable-one RPS channel. The two-out-of-three and two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing a reactor trip. Specific exceptions to the-above general philosophy exist and are discussed below. - '
Reactor Protection System Functions The safety analyses'and OPERABILITY 'requirements applicable to each RPS Function are discussed below: 1.- Manual Reactor Trip The Manual Reactor Trip ensures that the control room operator can initiate~a:reactor trip at any time by using either of two reactor trip push buttons in the control room. A Manual Reactor Trip accomplishes the same results as any one of the automatic trip' Functions. It Is used by the reactor operator to shut'dow'n the reactor whenever any parameter is rapidly trending toward its Trip Setpoint. The LCO requires two Manual Reactor Trip channels to be OPERABLE. Each channel is controlled by a manual reactor trip push button. Each channel activates the reactor trip breaker
-(continued) 1, - - .;
INDIAN POINT 3 B 3.3.1-9 Revision 2
RPS Instrumentation B 3.3.1 BASES ) APPLICABLE SAFETY ANALYSES, LCO. and APPLICABILITY (continued) in both trains. Two independent channels are required to be OPERABLE so that no single random failure will disable the Manual Reactor Trip Function. In MODE 1 or 2. manual initiation of a reactor trip must be OPERABLE. These are the MODES in which the shutdown rods and/or control rods are partially or fully withdrawn from the core. In MODE 3. 4. or 5. the manual initiation Function must also be OPERABLE if one or more shutdown rods or control rods are withdrawn or the Rod Control System is capable of withdrawing the shutdown rods or the control rods. In this condition, inadvertent control rod withdrawal is possible. In MODE 3. 4, or 5. manual initiation of a reactor trip does not have to be OPERABLE if the Rod Control System is not capable of withdrawing the shutdown rods or control rods and if all rods are fully inserted. If the rods cannot be withdrawn from the core, or all of the rods are inserted there is no need to be able to trip the reactor. In MODE 6. neither the shutdown rods nor the control rods are permitted to be withdrawn and the CRDMs are disconnected from the control rods and shutdown rods. Therefore, the manual initiation Function is not required.
- 2. Power Range Neutron Flux The NIS power range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS power range detectors provide input to the Rod Control System and Turbine Control System. Four channels of NIS are required because the actuation logic must be able to withstand an input failure to the control system which may then require the protection function actuation and a single failure in the other three channels providing the protection function actuation. Note that this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip.
(continued) 3 INDIAN POINT 3 B 3.3.1-10 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) Limitingfurdther'rod'withdrawal may terminate the transient and eliminate the need to trip the reactor.
'a. Power RanQe Neutron 'Flux-High
-The Power'Range Neutron Flux-High trip Function ensures that protection is provided. from all power levels.
-against aipositive reactivity excursion leading to DNB
'during power operations. These can be caused by rod
'- - withdrawal.or reductions in RCS temperature.
The LCO requires all four of the Power Range Neutron Flux
-High chainels to be OPERABLE. These channels are considered OPERABLE during required Surveillance tests that re-quireeinsertion of a test signal if the channel remains untripped 'and capable of tripping due to an increasing neutron flux signal. During MODE 2 Physics Tests,' only'3 channels are required because the output
' from one'detector is used for test instrumentation.
In MODE 1 or 2. when a positive reactivity excursion could occur.'the,.Power Range Neutron Flux-High trip must be OPERABLE.- 'This-Function will terminate the reactivity excursion and'shut down the reactor prior to reaching a powerlevl 'that could damage the fuel. In MODE 3. 4. 5. or 6, th'NIS power range detectors cannot detect neutron levels in this 'range. In these MODES, the Power Range Neutron Flux-High does not have to be OPERABLE because the-reactor Is shut down'and reactivity excursions into the-power range are extremely unlikely. Other RPS Functions and administrative controls provide protection against reactivity additions when in MODE 3, 4. 5. or 6. (continued) INDIAN POINT 3 B 13.3.1'-11' , Revision 2
RPS Instrumentation B 3.3.1 BASES 3 APPLICABLE SAFETY ANALYSES. LCO. and APPLICABILITY (continued) The Power Range Neutron Flux-High Allowable Value and Trip Setpoint are in accordance with Consolidated Edison Company of New York. Inc. Indian Point Nuclear Generating Station Unit No. 3 Plant Manual Volume VI: Precautions. Limitations, and Setpoints. March 1975 (Ref. 8).
- b. Power Range Neutron Flux-Low The LCO requirement for the Power Range Neutron Flux-Low trip Function ensures that protection is provided against a positive reactivity excursion from low power or subcritical conditions.
The LCO requires all four of the Power Range Neutron Flux
-Low channels to be OPERABLE. During MODE 2 Physics Tests, only 3 channels are required because the output from one detector is used for test instrumentation.
In MODE 1. below the Power Range Neutron Flux (P-10 setpoint). and in MODE 2. the Power Range Neutron Flux-Low trip must be OPERABLE. This Function may be manually blocked by the operator when two out of four power range D channels are greater than approximately 10% RTP (P-10 setpoint). This Function is automatically unblocked when three out of four power range channels are below the P-10 setpoint. Above the P-10 setpoint. positive reactivity additions are mitigated by the Power Range Neutron Flux-High trip Function. In MODE 3. 4. 5. or 6. the Power Range Neutron Flux- Low trip Function does not have to be OPERABLE because the reactor is shut down and the NIS power range detectors cannot detect neutron levels in this range. Other RPS (continued) INDIAN POINT 3 B 3.3.1-12 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO,.and APPLICABILITY (continued)' trip Functions and administrative controls provide protection against positive reactivity additions or power excursions in MODE 3. 4, 5, or.6. ThePower Range Neutron Flux-Low Allowable Value and Trip Setpoint are in accordance with Consolidated Edison Company of New-York, Inc. Indian Point Nuclear Generating Station Unit No. 3 Plant Manual Volume VI: Precautions, Limitations, and.Setpoints, March 1975 (Ref. 8).
.3. Intermediate Range Neutron Flux The Intermediate Range Neutron Flux trip Function ensures that protection.isprovided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup.,.This trip Function provides redundant protection to the Power Range ,Neutron Flux-Low Setpoint trip Function.
.Therefore..only.oneof the two channels of Intermediate Range Neutron Flux, IsRequired to be OPERABLE in the Applicable
,MODES. Eitherofthe two channels can be used to satisfy this requirement.,;.The NIS intermediate range detectors are located external to the ,reactor vessel and measure neutrons leaking from the core.,iThe'NIS intermediate range detectors do not provide any input to control systems. Note that this Function also provides~a signal.to prevent automatic and manual rod
.withdrawal prior.to-initiating a reactor trip. Limiting further rod.withdrawal may terminate the transient and eliminate.the need,to trip the reactor.
The LCO. requires one channel of Intermediate Range Neutron Flux to be OPERABLE; One OPERABLE channel is sufficient to provide redundant protection to the Power Range Neutron flux-Low Setpoint trip Function. (continued) INDIAN POINT 3 B 3.3.1-13 Revision 2
RPS Instrumentation B 3.3.1 BASES 0 APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) Table 3.3.1-1 identifies the Technical Specification Allowable Value for this trip function as not applicable (NA) because LCO 3.3.1. Function 2.b. Power Range Neutron Flux-Low, is used to bound the analysis for an uncontrolled control rod assembly withdrawal from a subcritical condition. The surveillance acceptance criterion used for this function is <28% RTP. This value was established based on Indian Point Nuclear Generating Station Unit No. 3 Plant Manual Volume VI: Precautions, Limitations, and Setpoints. March 1975, (Ref. 8). Because this trip Function is important only during startup. there is generally no need to disable channels for testing while the Function is required to be OPERABLE. Therefore, a third channel is unnecessary. The Intermediate Range Neutron Flux trip must be OPERABLE in MODE 1 below the P-10 setpoint, and in MODE 2 above the P-6 setpoint, when there is a potential for an uncontrolled RCCA bank rod withdrawal accident during reactor startup. Above the P-10 setpoint, the Power Range Neutron Flux-High Setpoint trip provides core protection for a rod withdrawal accident. In MODE 2, below the P-6 setpoint, the source Range Neutron Flux 3 Trip provides backup core protection for reactivity accidents. In MODE 3. 4, or 5, the Intermediate Range Neutron Flux trip does not have to be OPERABLE because the control rods must be fully inserted and only the shutdown rods may be withdrawn. The reactor cannot be started up in this condition. The core also has the required SDM to mitigate the consequences of a positive reactivity addition accident. In MODE 6. all rods are fully inserted and the core has a required increased SDM. Also, the NIS intermediate range detectors cannot detect neutron levels present in this MODE. (continued) 9 INDIAN POINT 3 B 3.3.1-14 Revision 2
RPS Instrumentation B 3.3.1 BASES - APPLICABLE SAFETY ANALYSES, LCOP and APPLICABILITY (continued)
- 4. Source Ranae Neutron Flux TheULCO requirement-for the Source Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled 'RCCA bank rod withdrawal accident from a subcritical condition'during startup. This trip Function provides redundant'protection to the Power Range Neutron Flux-Low trip Function. Therefore. only 'one of the two channels of Source Range Neutron Flux is required to be OPERABLE in the Applicable'MODES.' Either of the two channels can be used to
-satisfy this'requirement. In MODES 3, 4. and 5. administrative controls also prevent the uncontrolled withdrawal of rods. The NIS source range detectors are located external to the reactor vessel and 'e'asureneutrons leaking from the core. The NIS source range detectors do not'provide any inputs to control systems. 'The source range trip is the only RPS automatic
'protection'function required in MODES 3, 4, and 5 when rods are capable of withdrawal or one or more rods are not fully inserted.
The LCO requires one channel of Source Range Neutron Flux to be OPERABLE. One OPERABLE channel is sufficient to provide redundant protection to the Power Range Neutron Flux-Low Setpoint trip Function. Table 3.3.1-1'identifies the Technical Specification Allowable Valuefor this trip function as not applicable (NA) because LCO 3.3.1, Function-2.b, Power Range Neutron Flux-Low, is used to
' bound the an'alysis for an uncontrolled control rod assembly withdrawal'from a subcritical condition. The surveillance acceptance criterion used for this function is s6.0 E+5 counts per second.
tT (continued) INDIAN POINT 3 8 3.3.1-'15 Revision 2
RPS Instrumentation B 3.3.1 BASES 3 APPLICABLE SAFETY ANALYSES, LCO. and APPLICABILITY (continued) The Source Range Neutron Flux Function provides protection for control rod withdrawal from subcritical. The Function also provides visual neutron flux indication in the control room. In MODE 2 when below the P-6 setpoint and in MODES 3. 4, and 5. when there is a potential for an uncontrolled RCCA bank withdrawal accident, the Source Range Neutron Flux trip must be OPERABLE. Above the P-6 setpoint. the Intermediate Range Neutron Flux trip and the Power Range Neutron Flux-Low trip will provide core protection for reactivity accidents. Above the P-6 setpoint, the NIS source range detectors are de-energized. In MODEs 3, 4, and 5 with all rods fully inserted and the Rod Control System not capable of rod withdrawal, and in MODE 6. the outputs of this function to the RPS logic are not required to be OPERABLE. The requirements for the NIS source range detectors in MODE 6 are addressed in LCO 3.9.2, 'Nuclear Instrumentation."
- 5. Overtemperature AT The Overtemperature AT trip Function is provided to ensure that the design limit DNBR is met. This trip Function also limits the range over which the Overpower AT trip Function must provide protection. The inputs to the Overtemperature AT trip include pressure, coolant temperature, axial power distribution, and reactor power as indicated by loop AT assuming full reactor coolant flow. Protection from violating the DNBR limit is assured for those transients that are slow with respect to delays from the core to the measurement system.
The Overtemperature AT trip Function uses each loop's AT as a measure of reactor power and is compared with a setpoint that is automatically varied with the following parameters: reactor coolant average temperature-the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature; (continued) INDIAN POINT 3 B 3.3.1-16 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) pressurizer pressure-the Trtp Setpoint is varied to correct for changes in system pressure; and
' ' .axial'power'distribution-f(AI), the Trip Setpoint is varied to account for imbalances in the axial power distribution as detected by the NIS upper and lower power range detectors. If axial peaks are greater than the
'Technical Specification limit, as indicated by the difference between the upper .and lower NIS power range detectors, the Trip Setpoint is reduced in accordance with Note 1'ioflTabie 3.3.1-1.
Dynamic compens'ation is included for system piping delays from the core to the-temperature measurement system. The Overtempe'rature AT trip Function is calculated for each loop as described in Note 1 of Table 3.3.1-1. Trip occurs if Overtemperature AT is indicated in two)loops. The pressure and temperature'signals are used for other control functions. Therefore, the actuation logit is designed to withstand an'input failure tothe control system, which may then'require the'protection function actuation, and a single failure'in the`other channels providing the protection function actuation. The LCO 'requires'all 'four channels of the Overtemperature AT trip Function'to be OPERABLE. Note that the Overtemperature AT Function receives input from channels shared with other RPS Functions. Failures that affect multiple Functions require entry into'tie Conditions'applicable to all affected Functions. In MODE 1 6r -2,the Overtemperature AT trip must be OPERABLE to prevent :DNB.'-Inr MODE 3. 4, 5, or 6.:this trip Function does not have to be OPERABLE because the reactor is not operating and there'is insufficient heat production to be concerned about DNB.
- (continued)
INDIAN POINT 3 B3.3.1-17 .Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES. LCO, and APPLICABILITY (continued)
- 6. Overpower AT The Overpower AT trip Function ensures that protection is provided to ensure the integrity of the fuel (i.e., no fuel pellet melting and less than 1% cladding strain) under all possible overpower conditions. This trip Function also limits the required range of the Overtemperature AT trip Function and provides a backup to the Power Range Neutron Flux-High Setpoint trip. The Overpower AT trip Function ensures that the allowable heat generation rate MkW/ft) of the fuel is not exceeded. It uses the AT of each loop as a measure of reactor power with a setpoint that is automatically varied with the following parameters:
reactor coolant average temperature-the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature; and rate of change of reactor coolant average temperature-including a constant determined by dynamic considerations that provides compensation for the delays between the core and the temperature measurement system. The Overpower AT trip Function is calculated for each loop as per Note 2 of Table 3.3.1-1. Trip occurs if Overpower AT is indicated in two loops. The temperature signals are used for other control functions. Therefore, the actuation logic is designed to withstand an input failure to the control system. which may then require the protection function actuation and a single failure in the remaining channels providing the protection function actuation. The LCO requires four channels of the Overpower AT trip Function to be OPERABLE. Note that the Overpower AT trip Function receives input from channels shared with other RPS Functions. Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions. (continued) INDIAN POINT 3 B 3.3.1-18 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES. LCO. and APPLICABILITY (continued) - In MODE 1 or 2. the Overpower AT trip Function must be OPERABLE. These are the only times that enough heat is generated inCthe fuel to be concerned about the heat generation rates and overheating of the fuel. In MODE 3. 4, 5. or 6. this
'trip Functidndoes not have to be OPERABLE because the reactor is not operatifg and there is insufficient heat production to be concerned 'about fuel overheating and fuel damage.
- 7. Pressurizer Pressure The same sensors provide input to the Pressurizer Pressure-High and -Low trips and the Overtemperature AT trip. The Pressurizer,'Pressure channels are also used to provide input to the Pressurizer 'Pressure Control System. Therefore, the actuation logic is designed to withstand an input failure to the control system, which may then require the protection function actuation'. and a single failure in the other channels providing the protection function actuation. Note that the plant design and-this LCO require 4 channels for the Pressurizer Pressu're-Low trips but requires only 3 channels of Pressurizer Pressure-High. This difference recognizes the role of pressurizer code safety valves in response to a high pressure condition.
- a. Pressurizer Pressure-Low The Pressurizer Pressure-Low trip Function ensures that protection is provided against violating the DNBR limit due'to low pressure.
The LCO requires'four channels of Pressurizer Pressure-Low to be OPERABLE. In MODE 1, when DNB is a major concern, the Pressurizer Pressure-Low trip must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-7 interlock (NIS power range P-10 or turbine first stage pressure greater than approximately 10 of full power equivalent). On decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, no conceivable power distributions can occur that would cause DNB concerns. (continued) INDIAN POINT 3 B 3.3.1-19 Revision; 2
RPS Instrumentation B 3.3.1 BASES 3 APPLICABLE SAFETY ANALYSES. LCO. and APPLICABILITY (continued)
- b. Pressurizer Pressure-High The Pressurizer Pressure-High trip Function ensures that protection is provided against overpressurizing the RCS.
This trip Function operates in conjunction with the pressurizer relief and safety valves to prevent RCS overpressure conditions. The LCO requires three channels of the Pressurizer Pressure-High to be OPERABLE. The Pressurizer Pressure-High Allowable Value is selected to be below the pressurizer safety valve actuation pressure and above the power operated relief valve (PORV) setting. This setting minimizes challenges to safety valves while avoiding unnecessary reactor trip for those pressure increases that can be controlled by the PORVs. In MODE 1 or 2. the Pressurizer Pressure-High trip must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the safety valves. In MODE 3, 4.
- 5. or 6. the Pressurizer Pressure-High trip Function does not have to be OPERABLE because transients that could cause an overpressure condition will be slow to occur.
Therefore, the operator will have sufficient time to evaluate unit conditions and take corrective actions. Additionally, low temperature overpressure protection systems provide overpressure protection when RCS temperature is less than the LTOP arming temperature specified in LCO 3.4.12, Low Temperature Overpressure Protection (LTOP). (continued) 3 INDIAN POINT 3 B 3.3.1-20 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) ' ' ' .'
- 8. Pressurizer Water Level-Hich The Pressurizer Water 'Level -High trip Function provides a backup signal for the Pressurizer Pressure-High trip and also provides protection against water relief through the pressurizer safety valves. These valves are designed to pass I
I steam in order-to ichieve 'their design energy removal rate. A
*reactor trip is actuated prior to the pressurizer becoming
. 7 water solid. HThe LCO requires three channels of Pressurizer
. I :
Water Level -High to be-OPERABLE. The pressurizer level channels are'used as input to the Pressurizer Level Control System. .A fourth channel is not required to address control/protection interaction concerns because the level channels do not actuate the safety valves, and the high pressure reactor trip is set below the safety valve setting.
-Therefore, slow rate of charging available, pressure
-withthe overshootrduelto level channel failure cannot cause the safety valve to lift before reactor high pressure trip.
- In MODE 1.,when there is a potential for overfilling the
'pressurizer;,the Pressurizer Water Level -High trip must be OPERABLE.. This trip Function is automatically enabled on increasing.power by'the P-7 interlock.
On decreasing power, this trip Function is automatically blocked below P-7. 'Below the P-7 setpoint, transients that could raise-the.pressurizer water level will be slow and the operator will have sufficient time to evaluate unit conditions and take corrective actions.
* ,. - I' ,
- O*%f l i' (continued)
INDIAN POINT 3 B.3.3.I -21 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES. LCO, and APPLICABILITY (continued)
- 9. Reactor Coolant Flow-Low
- a. Reactor Coolant Flow-Low (Single Loop)
The Reactor Coolant Flow-Low (Single Loop) trip Function ensures that protection is provided against violating the DNBR limit due to low flow in one or more RCS loops, while avoiding reactor trips due to normal variations in loop flow. Above the P-8 setpoint, a loss of flow in any RCS loop will actuate a reactor trip. Each RCS loop has three flow detectors to monitor flow. The flow signals are not used for any control system input. The LCO requires three Reactor Coolant Flow-Low channels per RCS loop to be OPERABLE in MODE 1 above P-B. Each reactor coolant loop is considered to be a separate function. Therefore, separate condition entry is allowed for each loop. In MODE 1 above the P-8 setpoint. a loss of flow in one RCS loop could result in DNB conditions in the core. In MODE 1 below the P-8 setpoint. a loss of flow in two or more loops is required to actuate a reactor trip (Function 9.b) because of the lower power level and the greater margin to the design limit DNBR.
- b. Reactor Coolant Flow-Low (Two Loops)
The Reactor Coolant Flow-Low (Two Loops) trip Function ensures that protection is provided against violating the DNBR limit due to low flow in two or more RCS loops while avoiding reactor trips due to normal variations in loop flow. Above the P-7 setpoint and below the P-8 setpoint. a loss of flow in two or more loops will initiate a reactor trip. Each loop has three flow detectors to monitor flow. The flow signals are not used for any control system input. (continued) INDIAN POINT 3 B 3.3.1-22 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO.-and APPLICABILITY (continued)-- ' -' ' ': The LCO requires three Reactor Coolant Flow-Low channels
-:per loop to~be OPERABLE. Each reactor coolant loop is
.. ; i ,I considered to'be a separate function. Therefore, separate I I
'condition entry is allowed for each loop.
- In MODE - above the P-7 setpoint and below the P-8
. I setpoint-'the'Reactor Coolant Flow-Low (Two Loops) trip I . . .
C I . must be'OPERABLE. 'Below'the P-7 setpoint, all reactor trips ondlow flow are automatically blocked since no conceivable-power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on low flow in two or more
- RCS loops is automatically enabled. Above the P-8 setpoint, aloss-of flow in any one loop (Function 9.a) will,-actuate 'areactor trip because of the higher power
- level 'and the-reduced margin to the design limit DNBR.
10.
- Reactor Coolant Pump (RCP) Breaker Position Both RCP Breaker Position trip Functions operate to anticipate the Reactor Coolant Flow-Low trips to avoid RCS heatup that would occur before the low flow trip actuates.
- a. Reactor Coolant Pump Breaker Position (Single Loop)
The RCP Breaker Position (Single Loop) trip Function
-ensures :that protection is provided against violating the
-DNBR limit!due to.a loss of flow in one RCS loop. The
- position of each .RCP breaker is monitored. If one RCP breaker 'isopen above the P-8 setpoint, a reactor trip is initiated. This trip Function will generate a reactor trip before the Reactor-Coolant Flow-Low (Single Loop)
Trip Setpoint .isreached. (continued) INDIAN POINT 3 B 3; 3.1 - 23 Revision 2
RPS Instrumentation B 3.3.1 BASES 3 APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) The LCO requires one RCP Breaker Position channel per RCP to be OPERABLE. One OPERABLE channel is sufficient for this trip Function because the RCS Flow-Low trip alone provides sufficient protection of unit SLs for loss of flow events. The RCP Breaker Position trip serves only to anticipate the low flow trip, minimizing the thermal transient associated with loss of a pump. Each reactor coolant loop is considered to be a separate function. Therefore, separate condition entry is allowed for each loop. This Function measures only the discrete position (open or closed) of the RCP breaker, using a position switch. Therefore, the Function has no adjustable trip setpoint with which to associate an LSSS. In MODE 1 above the P-8 setpoint, when a loss of flow in any RCS loop could result in DNB conditions in the core, the RCP Breaker Position (Single Loop) trip must be OPERABLE. In MODE 1 below the P-8 setpoint. a loss of flow in two or more loops (Function 1O.b) is required to 3 actuate a reactor trip because of the lower power level and the greater margin to the design limit DNBR.
- b. Reactor Coolant Pump Breaker Position (Two Loops)
The RCP Breaker Position (Two Loops) trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops. The position of each RCP breaker is monitored. Above the P-7 setpoint a loss of flow in two or more loops will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Two Loops) Trip Setpoint is reached. (continued) 3 INDIAN POINT 3 B 3.3.1-24 Revision 2
1I RPS Instrumentation B 3.3.1 BASES . .- APPLICABLE SAFETY ANALYSES."LCO. and"APPLICABILITY (continued) The LCO requires one RCP Breaker Position channel per RCP to'be OPERABLE. One OPERABLE channel is sufficient for this 'Functi6n because 'the RCS Flow-Low trip alone provides' sufficient protection of unit SLs for loss of flow events.I The RCP Breaker Position trip serves only to anticipate the'low flow trip, minimizing the thermal transient'associated with loss of an RCP. Each reactor coolanti loop'is considered to be a separate function. Ther'efore,sepa-rate condition'entry is allowed for each loop.,. This Function'measures only the discrete position (open or closed)6f the RCP breaker,'using a position switch.
'; Therefore.the Function has no adjustable trip setpoint with which to-associate an LSSS.
In MODE 1 above:'the P-7 setpoint and below the P-8 setpoint, the RCP Breaker Position (Two Loops) trip must be OPERABLE. Below the P-7 setpoint. all reactor trips on loss'of.flow are automatically blocked since no conceivable power distributions could occur that would
*cause"atDNB concern at this'low power level. Above the P-7 'setp6int'; -the'reactor trip on loss of flow in two RCS loops is automatically enabled. Above the P-8 setpoint, a loss of flow'-in any one loop (Function 1O.a) will actuate a reactor'trip because of the higher power level and the reduced -margin to the design'limit DNBR.
'11. 'Undervoltaqe'Reactor Coolant Pumps (6.9 kV Bus)
The Undervoltaje"RCPs direct reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss'of flowin'two or more-RCS'loops. The voltage to each 6.9 kV bus used to power an RCP is monitored. Above the P-7 setpointa'loss'of voltage detected on two or more RCP buses will initiate a direct reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Two Loops) Trip Setpoint is reached. Time delays are incorporated into the Undervoltage RCPs channels associated with the direct reactor trip and are provided to prevent reactor trips due to momentary electrical power transients. (continued) INDIAN POINT 3 B 3.3.A" 25 Revision 2
RPS Instrumentation B 3.3.1 BASES 3 APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) The LCO requires one Undervoltage RCPs channel per bus to be OPERABLE. The Allowable Value for this trip function is shown as NA because there is no Analytical Limit for RCP Undervoltage. The RCPs will continue to operate and deliver required RCS flow during an Undervoltage Condition. The reactor trip on RCP Undervoltage is a time-zero initiating event assumed in the safety analysis (Reference 3). The UV relay is adjusted for a nominal trip setpoint of 75X of the 6900 Vac bus voltage and the surveillance acceptance criterion used for this function is 270%. In MODE 1 above the P-7 setpoint, the Undervoltage RCP trip must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on loss of flow in two or more RCS loops is automatically enabled.
- 12. Underfrequency Reactor Coolant PumDs The Underfrequency RCPs reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops from a major network frequency disturbance. An underfrequency condition will slow down the pumps, thereby reducing their coastdown time following a pump trip. The proper coastdown time is required so that reactor heat can be removed immediately after reactor trip.
The frequency of each RCP bus is monitored. A loss of frequency detected on two or more RCP buses trips all four RCPs. a condition that will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow-Low (Two Loops) Trip Setpoint is reached. The LCO requires one Underfrequency RCP channel per bus to be OPERABLE. (continued) INDIAN POINT 3 B 3.3.1-26 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO. and APPLICABILITY (continued)' In Mode 1 above the P-7 Setpoint, the Underfrequency RCP's trip must be OPERABLE. Below the P-7 Setpoint, all reactor trips on loss off flow'are automatically blocked since no conceivable power distribution could occur that would cause a DNB Concern at this low power level. Above the P-7 Setpoint, the reactor
-trip on loss of flow in two or more RCS loops is automatically enabled.
'13. Steam Generator Witer Level-Low 'Low The'SG Water"L evel-Low Low trip Function ensures that protection is provided against a loss of heat sink and actuates the AFW System prior to uncovering the SG tubes. The SGs are the heat sink'for the 'reactor. In order to act as a heat sink, the SGs must contain a minimum amount of water. A narrow range low low level in-any SG'is indicative of a loss of heat sink
'for the reactor.' The ABE channel level transmitters provide input'to the'SG Level Control System. Therefore, the actuation logic must be able'to withstand an input failure to the control system, which'may then require the protection function actuationand a single failure in the other channels providing the protectibn"function actuation.'This Function also performs the ESFAS function of starting the AFW pumps on low low SG level.
The LCO requires three channels of SG Water Level-Low Low per SG tobe OPERABLE. 'Each SG is considered to be a separate function. Therefore', separate condition entry is allowed for each SG. In MODE 1 'or 2,,whn'the reactor requires a heat sink, the SG Water Level -Low Low trip must be OPERABLE. The normal source of water-forkthe'SGs is the Main Feedwater (MFW) System (not safety related).' The'MFW System'is only in operation in MODE I or 2. JThe`AFW!System is the safety related backup source of water to ensure'that the'SGs remain the heat sink for the reactor.-During normal startups and shutdowns, the AFW System provides feedwater to maintain SG level. In MODE 3, 4, 5, (continued) INDIAN POINT 3 B"3.3.1-'27 : Rev.ision 2
RPS Instrumentation B 3.3.1 BASES 3 APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) or 6. the SG Water Level -Low Low Function does not have to be OPERABLE because the MFW System is not in operation and the reactor is not critical. Decay heat removal is accomplished by the AFW System in MODE 3 and 4 and by the Residual Heat Removal (RHR) System in MODE 4. 5. or 6.
- 14. Steam Generator Water Level-Low. Coincident With Steam Flow/Feedwater Flow Mismatch SG Water Level -Low, in conjunction with the Steam Flow/Feedwater Flow Mismatch, ensures that protection is provided against a loss of heat sink and actuates the AFW System. In addition to a decreasing water level in the SG, the difference between feedwater flow and steam flow is evaluated to determine if feedwater flow is significantly less than steam flow. With less feedwater flow than steam flow. SG level will decrease at a rate dependent upon the magnitude of the difference in flow rates. The required logic is developed from two SG level channels and two Steam Flow/Feedwater Flow Mismatch channels per SG. One narrow range level channel coincident with the associated Steam Flow/Feedwater Flow Mismatch channel for the same SG (steam flow greater than feed flow) will actuate a reactor trip.
The LCO requires two channels of SG Water Level-Low coincident with Steam Flow/Feedwater Flow Mismatch. Each SG is considered to be a separate function. Therefore, separate condition entry is allowed for each SG. Table 3.3.1-1 identifies the Technical Specification Allowable Value for this trip function as not applicable (NA) because LCO 3.3.1. Function 13. Steam Generator Water Level-Low Low, is used to bound the analysis for a loss of feedwater event. The allowable values required for OPERABILITY of Function 13 is 2 4.0%. The surveillance acceptance criteria used for Function 14 are Ž7.5% narrow range level and *1.33E+6 pounds per hour steam flow/feedwater flow mismatch. (continued) INDIAN POINT 3 B 3.3.1-28 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO.'and APPLICABILITY (continued)- In MODE 1 or 2,'when the reactor requires a heat sink, the SG Water'Level-Low coincident with Steam Flow/Feedwater Flow Mismatch trip must be OPERABLE. The'normal source of water for the SGs is the MFW System (not safety related). The MFW System is only in operation in MODE 1 or 2.' The AFW System is the safety related backup source of water to ensure that the SGs remain the heat'sink for'the'reactor. During normal startups and shutdowns, the AFW System provides feedwater to maintain SG level. In MODE 3, 4. 5. or 6. the SG Water Level -Low coincident with Steam Flow/Feedwater'Flow Mismatch Function does not have t'obeOPERABLE because'the MFW System is not in
- 'operation aidthe'reactor is not critical. Decay heat removal is accomplished by the AFW System in MODE 3 and 4 and by the RHR System in MODE4, 5, or 6. The 1FW System is in operation
-only in'MODE-1LorI2 and,' therefore, this trip Function need only be'OPERABLE;in these MODES.
- 15. -Turbine TriD-"Low'Auto-Stop'Oil Pressure The Turbine Trip-'Low Auto-Stop Oil Pressure trip Function anticipates:theloss'6f heat removal capabilities of the secondary system-following a turbine trip. This trip Function acts to minimize the pressure/temperature transient on the reactor. Any turbine trip from a power level below the P-8
.setpoint will :noVactuate a reactor trip. Three pressure switches monitor the control oil pressure in the Turbine Control System. A low pressure condition sensed by two-out-of-threelpressure switches will actuate a reactor trip.
These pressure s:witch5es do not provide any input to the control system. The unit is designed to withstand a complete loss of load and not'sbstain'core damage or-challenge the RCS pressure limitations.: Core'protection is provided by the Pressurizer Pressure-High trip Function and RCS integrity is ensured by the pressurizer safety valves. The LCO requires three channels of Turbine Trip-Low Auto- Stop Oil Pressure to be OPERABLE in MODE 1 above P-8. (continued) INDIAN POINT 3 B 3.-3;1-!-29 Revision' 2-
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) Below the P-8 setpoint, a turbine trip does not actuate a reactor trip. In MODE 1 (below P-8 setpoint), 2, 3. 4, 5, or 6. there is no potential for a turbine trip that would require a reactor trip, and the Turbine Trip-Low Auto-Stop Oil Pressure trip Function does not need to be OPERABLE.
- 16. Safety Iniection Input from Engineered Safety Feature Actuation System The SI Input from ESFAS ensures that if a reactor trip has not already been generated by the RPS. the ESFAS automatic actuation logic will initiate a reactor trip signal upon any signal that initiates SI. This is a condition of acceptability for the LOCA. However, other transients and accidents take credit for varying levels of ESF performance and rely upon rod insertion, except for the most reactive rod that is assumed to be fully withdrawn, to ensure reactor shutdown. Therefore, a reactor trip is initiated every time an SI signal is present.
Trip Setpoint and Allowable Values are not applicable to this Function. The SI Input is provided by relay in the ESFAS. Therefore, there is no measurement signal with which to associate an LSSS. The LCO requires two trains of SI Input from ESFAS to be OPERABLE in MODE 1 or 2. A reactor trip is initiated every time an SI signal is present. Therefore, this trip Function must be OPERABLE in MODE 1 or 2. when the reactor is critical, and must be shut down in the event of an accident. In MODE 3, 4. 5. or 6. the reactor is not critical, and this trip Function does not need to be OPERABLE. (continued) INDIAN POINT 3 B 3.3.1-30 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)
- 17. Reactor Tri 'System Interlocks Reactor protectioninterlocks are provided to ensure reactor trips are in the correct configuration for the current unit status. They'back'up operator actions to ensure protection system Functionsiare not bypassed during unit conditions under which the safety'analysis assumes the Functions are not bypassed. Therefore, the interlock Functions do not need to be OPERABLE when the associated reactor trip functions are outside the applicable MODES. These are:
- a. Intermdiat&eRange Neutron Flux. P-6 The Intermediate'Range Neutron Flux, P-6 interlock is actuated when any NIS intermediate range channel goes approximately-one decade above the minimum channel
'reading."'If'both'channels drop below the setpoint. the permissive will automatically be defeated. Manual defeat of the 'P;6 interlock can be accomplished at any time by simultaneo,.s'actuation of both Reset pushbuttons. The LCO requirement for the P-6 interlock ensures that the following Functions are performed:
- . on increasing power, the P-6 interlock allows the
'manual'block of the NIS Source Range, Neutron Flux
'reactor trip. This prevents a premature block of the source range trip and allows the operator to ensure that the intermediate range is OPERABLE
- prior to leaving the source range. The source range trip is blocked by removing the high voltage to-the 'detectors;
. on decreasing power, the P-6 interlock automatically energizes the NIS source range
- detectors and enables the NIS Source Range Neutron Flux reactor trip; and The LCO requires two channels of Intermediate Range Neutron Flux.,P-6 interlock to be OPERABLE in MODE 2 when below the P-6 interlock setpoint.
(continued) INDIAN POINT 3 B'3'.3.'1-31 Revision 2
RPS Instrumentation B 3.3.1 BASES 0 APPLICABLE SAFETY ANALYSES. LCO. and APPLICABILITY (continued) Above the P-6 interlock setpoint, the NIS Source Range Neutron Flux reactor trip will be blocked, and this Function will no longer be necessary. In MODE 3. 4, 5, or 6, the P-6 interlock does not have to be OPERABLE because the NIS Source Range is providing core protection if required. The Allowable Value is NA for this function because there is no corresponding analytical limit modeled in the accident analysis. The surveillance acceptance criterion used for this Function is 03.1E-11 Amps.
- b. low Power Reactor Trips Block. P-7 The Low Power Reactor Trips Block. P-7 interlock, is actuated by input from either the Power Range Neutron Flux, P-10. or the Turbine First Stage Pressure. The LCO requirement for the P-7 interlock ensures that the following Functions are performed:
(1) on increasing power, the P-7 interlock (i.e., 2 of 4 Power Range channels increasing above the P-10 (Function 17.d) setpoint or 1 of 2 Turbine First Stage Pressure (Function 17.e) setpoint) automatically enables reactor trips on the following Functions:
- Pressurizer Pressure-Low:
- Pressurizer Water Level-High:
- Reactor Coolant Flow-Low (Two Loops):
- RCPs Breaker Open (Two Loops):
- Undervoltage RCPs: and
- Underfrequency RCPs (continued) 3 INDIAN POINT 3 B 3.3.1-32 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES,'LCO, 'and APPLICABILITY (continued)
'These rea'ctor trips are only required when operating above the P-7 setpoint (approximately 10X
-- power).The reactor trips provide protection
-against violating the DNBR limit. Below the P-7 setpoint. the RCS is capable of providing sufficient natural circulation without any RCP running.
- (2) on decreasing power, the P-7 interlock (i.e.. 3 of
- '4Power Range channels decreasing below the P-10 i-(Function'17.d) setpoint and 2 of 2 Turbine First
-Sta e Pressure channels decreasing below the
-- Turbine-First Stage Pressure (Function 17.e) setpoint) automatically blocks reactor trips on the following Functions:
a
. Pressurizer Pressure-Low; l -. Pressubrizer Water Level-High;
' 'Reactor Coolant Flow-Low (Two Loops);
-*-RCP Breaker' Position (Two Loops);
. Undervoltage RCPs; and
'Underfrequency RCPs An Allowable Value is not applicable to the P-7 interlock because it is a logic Function. The P-10 interlock (Function 17.d) governs input from the Power Range instruments and the Turbine First Stage Pressure interlock (Function'17.e) governs input for turbine power.
The P-7 interlock is a logic Function with train and not chann'l`identity. ' Therefore, the LCO requires one channel per train (i.e.. two trains) of Low Power Reactor Trips Block, P-7 interlock to be OPERABLE in MODE 1. (continued) INDIAN POINT 3 B'3;3'.1'-33' Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES. LCO. and APPLICABILITY (continued) The low power trips are blocked below the P-7 setpoint and unblocked above the P-7 setpoint. In MODE 2. 3. 4. 5. or 6. this Function does not have to be OPERABLE because the interlock performs its Function when power level drops below 10% power, which is in MODE 1.
- c. Power Range Neutron Flux. P-8 The Power Range Neutron Flux. P-8 interlock is actuated below 50% power as determined by NIS power range detectors. The P-8 interlock automatically enables the Reactor Coolant Flow-Low (Single Loop) and RCP Breaker Position (Single Loop) reactor trips on low flow in one or more RCS loops whenever at least 2 of 4 of the Power Range instruments increase to above the P-8 setpoint. The LCO requirement for this trip Function ensures that protection is provided against a loss of flow in any RCS loop that could result in DNB conditions in the core when greater than approximately 50% power. On decreasing power, the reactor trip on low flow in any loop is automatically blocked whenever at least 3 of 4 the Power Range instruments decrease to below the P-8 setpoint.
The LCO requires four channels of Power Range Neutron Flux, P-8 interlock to be OPERABLE in MODE 1. In MODE 1. a loss of flow in one RCS loop could result in DNB conditions, so the Power Range Neutron Flux, P-8 interlock must be OPERABLE. In MODE 2. 3. 4. 5, or 6, this Function does not have to be OPERABLE because the core is not producing sufficient power to be concerned about DNB conditions. The Allowable Value is NA for this Function because there is no corresponding analytical limit modeled in the accident analysis. The surveillance acceptance criterion used for this Function is s35% RTP. (continued) ) INDIAN POINT 3 B 3.3.1-34 Revision 2
RPS Instrumentation B 3.3.1 BASES --- APPLICABLE SAFETY ANALYSES, LCO,'and'APPLICABILITY- (continued) '-
* -. .C .
' d. PowerRinoeNeutron Flux. P-10 The PoweHr'Range Neutron Flux, P-10 interlock is actuated
'at approximately 10% power, as determined by two-out-of-four NIS power range detectors. If power level falls below 10% RTP on 3 of 4 channels. the nuclear
'instrument-trips-will be automatically unblocked. The LCO requireriment for the P-10 interlock ensures that the following Functions are performed:
'on increasing power, the P-10 interlock allows the
'roperator to manually block the Intermediate Range Neutron Flux reactor trip;
- on increasing power, the P-10 interlock allows the
-bperator-to manually block the Power Range Neutron Flux-Low reactor trip; on increasing power, the P-10 interlock
- automatically provides a backup signal to block the
.:'Source Range Neutron Flux reactor trip by de-
energizing the NIS source range detectors; the P-10-interlock provides one of the two inputs to the P-7 interlock; and
' on decreasing power, the P-10 interlock automatically enables the Power Range Neutron Flux-
""Low reactor trip and the Intermediate Range Neutron "Flux reactor trip (and rod stop).
The LCO requires four channels of Power Range Neutron Flux. P-10,Interlock to be OPERABLE in MODE 1 or 2. (continued) INDIAN POINT 3 B,3.-3.1' 7 35 Revision'2
RPS Instrumentation B 3.3.1 BASES 3 APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) OPERABILITY in MODE 1 ensures the Function is available to perform its decreasing power Functions in the event of a reactor shutdown. This Function must be OPERABLE in MODE 2 to ensure that core protection is provided during a startup or shutdown by the Power Range Neutron Flux- Low and Intermediate Range Neutron Flux reactor trips. In MODE 3, 4. 5, or 6. this Function does not have to be OPERABLE because the reactor is not at power and the Source Range Neutron Flux reactor trip provides core protection. The Allowable Value is NA for this Function because there is no corresponding analytical limit modeled in the accident analysis. The surveillance acceptance criterion used for this Function is *9% RTP.
- e. Turbine First Stace Pressure The Turbine First Stage Pressure interlock is actuated when the pressure in the first stage of the high pressure turbine is greater than approximately 10% of the rated full power pressure. This is determined by one-out-of-two pressure detectors. The LCO requirement for this Function ensures that one of the inputs to the P-7 interlock is available.
The LCO requires two channels of Turbine Impulse Pressure, input to the P-7 interlock, to be OPERABLE in MODE 1. The Turbine First Stage Pressure interlock must be OPERABLE when the turbine generator is operating. The interlock Function is not required OPERABLE in MODE 2. 3,
- 4. 5, or 6 because the turbine generator is not operating.
The Allowable Value is NA for this Function because there is no corresponding analytical limit modeled in the accident analysis. The surveillance acceptance criterion used for this Function is *9.5% RTP. (continued) 9 INDIAN POINT 3 B 3.3.1-36 Revision 2
RPS Instrumentation B 3.3.1 BASES APPLICABLE SAFETY ANALYSES. LCO. and APPLICABILITY (continued)
- 18. Reactor Trip Breakers' '
This trip Function applies to the RTBs exclusive of individual trip mechanisms. The LCO requires two OPERABLE trains of trip breakers. A trip breaker train consists of all trip breakers associated with a single'RPS logic train that are racked in, closed, and capable of supplying power to the Rod Control System.'o Thusithe train may consist of the main breaker. bypassbreaker, or main breaker,,and bypass breaker,'depending upon the system configuration. Two OPERABLE trains ensure no single random'failure'can disable the RPS trip capability. The LCO requifes'two OPERABLE'trains of trip breakers. Two OPERABLE trains ensure no single random failure can disable the RPS trip capabiity. -When a reactor trip breaker is being tested, both r'eactor trip breaker and the reactor trip bypass
'breaker associated with the'RPS logic train not in test are closed. In this configuration, a single failure in the RPS logic train 'not'in test could disable RPS trip capability; therefore.' 'limits on'the duration of testing are established.
These trip Functions must be OPERABLE in MODE 1 or 2 when the reactor is critical. In MODE 3. 4.,or 5. these RPS trip Functions must' be'OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully
~inserted. -
- 19. Reactor Trip Breaker Undervoltage and Shunt Trip Mechanisms The LCO requires both the Undervoltage and Shunt Trip Mechanisms to be OPERABLE for each RTB that is in service. The trip mechanisms are not required to be OPERABLE for trip breakers that are open, racked out, incapable of supplying power to the Rod Control System, or declared inoperable under Function 18 above. OPERABILITY of both trip mechanisms on each breaker ensures that no single trip mechanism failure will prevent opening any breaker on a valid signal.
(continued) INDIAN POINT 3 8 3.-3.1-37 Revision 2
RPS Instrumentation B 3.3.1 BASES 3 APPLICABLE SAFETY ANALYSES, LCO. and APPLICABILITY (continued) These trip Functions must be OPERABLE in MODE 1 or 2 when the reactor is critical. In MODE 3. 4, or 5, these RPS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.
- 20. Automatic Tri, Logic The LCO requirement for the RTBs (Functions 18 and 19) and Automatic Trip Logic (Function 20) ensures that means are provided to interrupt the power to allow the rods to fall into the reactor core. Each RTB is equipped with a bypass breaker (RTBB) to allow testing of the trip breaker while the unit is at power. Each RTB and RTBB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed. The reactor trip signals generated by the RPS Automatic Trip Logic cause the RTBs and associated bypass breakers to open and shut down the reactor.
The LCO requires two trains of RPS Automatic Trip Logic to be OPERABLE. Having two OPERABLE channels ensures that random failure of a single logic channel will not prevent reactor trip. These trip Functions must be OPERABLE in MODE 1 or 2 when the reactor is critical. In MODE 3. 4. or 5, these RPS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted. The RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36. (continued) INDIAN POINT 3 8 3.3.1-38 Revision 2
RPS Instrumentation B 3.3.1 BASES ACTIONS A Note has been added to the'ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently"'for each Function listed in Table 3.3.1-1. In the event a channel's Trip Setpoint is found nonconservative with
-respect to the Allowable Value, or the transmitter, instrument loop.
signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the-LCOCondition(s) entered for the protection Function(s) affected.-
-When the number-of inoperable channels ina trip Function exceed those specified in one or other related Conditions associated with a trip Function, then the unit is outside the safety analysis.
Therefore, LCO 3.0.3 must be immediately entered if applicable in the current MODE of operation. A.1 ' Condition A applies to.all RPS-protection Functions. Condition A addresses the situation where one or more required channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.1-1 and to take the Required Actions for the protection-functions affected. The Completion Times are those from the referenced Conditions and Required Actions. B.1 and 8.2 Condition B applies to the Manual Reactor Trip in MODE I'or 2. This action addresses-the train orientation of-the relay logic for this Function. With one channel inoperable. the inoperable channel must be restored to OPERABLE status within 48 hours. In this Condition. the remaining OPERABLE-channel is adequate to perform the safety function. - - -. ,, The Completion-Time of 48 hours is reasonable considering that there are two automatic actuation trains and another-manual initiation channel OPERABLE, and the low probability of an event occurring during this interval; - (continued) INDIAN POINT 3 B3.3.1-39 Revision 2
RPS Instrumentation B 3.3.1 BASES 3 ACTIONS B.1 and B.2 (continued) If the Manual Reactor Trip Function cannot be restored to OPERABLE status within the allowed 48 hour Completion Time, the unit must be brought to a MODE in which the requirement does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 additional hours (54 hours total time). The 6 additional hours to reach MODE 3 is reasonable, based on operating experience. to reach MODE 3 from full power operation in an orderly manner and without challenging unit systems. With the unit in MODE 3, ACTION C applies to any inoperable Manual Reactor Trip Function if the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted. C.1 and C.? Condition C applies to the following reactor trip Functions in MODE 3, 4, or 5 when the Rod Control System capable of rod withdrawal or one or more rods are not fully inserted:
- Manual Reactor Trip;
- RTBs:
- RTB Undervoltage and Shunt Trip Mechanisms; and
- Automatic Trip Logic.
This action addresses the train orientation of the relay logic for these Functions. With one channel or train inoperable, the inoperable channel or train must be restored to OPERABLE status within 48 hours. If the affected Function(s) cannot be restored to OPERABLE status within the allowed 48 hour Completion Time, the unit must be placed in a MODE in which the requirement does not apply. To achieve this status, action must be initiated within the same 48 hours to ensure that all rods are fully inserted, and the Rod Control System must be placed in a condition incapable of rod withdrawal within the next hour. The additional hour provides sufficient time to accomplish the action in an orderly manner. With rods fully inserted and the Rod Control System incapable of rod withdrawal. these Functions are no longer required. (continued) INDIAN POINT 3 B 3.3.1-40 Revision 2
RPS Instrumentation
- 3.3.1 BASES ACTIONS C.1 and C.2 (continued)
The Completion Time is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function, and given-the low probability of an event occurring during
..this interval. ,
D.1 and D.2 Condition D applies to the Power Range Neutron Flux-High Function. The NIS power range detectors provide input to the Rod Control System and, therefore, have a two-out-of-four trip logic. A known inoperable channel must be placed in the tripped condition. This results in a partial trip condition requiring only one-out-of-three logic for actuation.-,The 6 hours allowed to place the inoperable channel in the tripped condition is justified in WCAP-10271-P-A (Ref. 7).. The 6 hour Completion Time is consistent with LCO 3.2.4, QUADRANT POWER TILT RATIO (OPTR). As an alternative tothe above Actions, the plant must be placed in a MODE where this Function is no longer required OPERABLE. Twelve hours are allowed to place the plant in MODE 3. This is a reasonable time, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging plant systems. If Required Actions cannot be completed within their allowed Completion Times; LCO 3.0.3 must .be entered. The Required Actions have been modified by'a Note that allows placing the inoperable chan' 0l in the bypass condition for up to 8 hours while performing routine surveillance testing of other channels. The Note also allows placing the inoperable channel in the bypass condition to allow setpoint adjustments of other channels when required to reduce the setpoint in accordance with other Technical Specifications. (continued) INDIAN POINT 3 B 3.3.1-41 Revision 2
RPS Instrumentation B 3.3.1 BASES ACTIONS (continued) E.1 and E.2 Condition E applies to the following reactor trip Functions:
- Power Range Neutron Flux-Low;
- Overtemperature AT;
- Overpower AT:
- Pressurizer Pressure-High:
- SG Water Level -Low Low; and
- SG Water Level-Low coincident with Steam Flow/Feedwater Flow Mismatch.
A known inoperable channel must be placed in the tripped condition within 6 hours. Placing the channel in the tripped condition results in a partial trip condition requiring only one-out-of-two logic for actuation of the two-out-of-three trips and one-out-of-three logic for actuation of the two-out-of-four trips. The 6 hours allowed to place the inoperable channel in the tripped condition is justified in Reference 7. If the operable channel cannot be placed in the trip condition within the specified Completion Time, the unit must be placed in a MODE where these Functions are not required OPERABLE. An additional 6 hours is allowed to place the unit in MODE 3. Six hours is a reasonable time, based on operating experience, to place the unit in MODE 3 from full power in an orderly manner and without challenging unit systems. The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 8 hours while performing routine surveillance testing of the other channels. (continued) J INDIAN POINT 3 B 3.3.1-42 Revision 2
RPS Instrumentation B 3.3.1 BASES ACTIONS (continued) F.1 and F.2 Condition F applies when there are no Intermediate Range Neutron Flux trip channels OPERABLE in MODE 2 when THERMAL POWER is above the P-6 setpoint and below the P-10 setpoint. Required Actions specified in this Condition are onlylapplicable when' channelfailures do not result in reactor trip. Above the P-6 setpoint and below the P-10 setpoint, the NIS intermediate range detector performs the monitoring Functions. With no intermediate range channels OPERABLE, the Required Actions are'to suspend operations involving positive reactivity additions immediately. This will preclude any power level increase since thereiare no OPERABLE Intermediate Range Neutron Flux channels. The operator must also reduce THERMAL POWER below the P-6 setpoint within two hours. Below P-6. one or both Source Range Neutron Flux channels will be able to monitor the core power level. The Completion Time of:2 hours will allow a slow and controlled power reduction to less than the P-6 setpoint and takes into account the low probability of occurrence of an event during this period that may require the protection afforded by the NIS Intermediate Range Neutron Flux trip. G.1 Condition G applies when there are no Source Range Neutron Flux trip channels OPERABLE when in MODE 2, below the P-6;setpoint, and in MODE 3. 4. or 5 withthe Rod Control capable of rod withdrawal or one or more rods not rods fully inserted. With the unit in this Condition, below P-6. the NIS source range performs the monitoring and protection functions. With both source range channels noperable. the RTBs must be opened immediately. With the RTB's open, the core is in a more stablecondition.- (continued) INDIAN POINT 3 B 3.3.1-43 :-Revision 2
RPS Instrumentation B 3.3.1 BASES 3 ACTIONS (continued) H.1 and H.2 Condition H applies to the following reactor trip Functions:
- Pressurizer Pressure-Low;
- Pressurizer Water Level-High;
- Reactor Coolant Flow-Low;
- RCP Breaker Position (Two Loops);
- Undervoltage RCPs; and
- Underfrequency RCPs.
With one channel inoperable, the inoperable channel must be placed in the tripped condition within 6 hours. Placing the channel in the tripped condition results in a partial trip condition requiring only one additional channel to initiate a reactor trip above the P-7 setpoint for the two loop function and above the P-8 setpoint for the single loop function. These Functions do not have to be OPERABLE below the P-7 setpoint because there are no loss of flow trips below the P-7 setpoint. The 6 hours allowed to place the channel in the tripped condition is justified in Reference 7. An additional 6 hours is allowed to reduce THERMAL POWER to below P-7 if the inoperable channel cannot be restored to OPERABLE status or placed in trip within the specified Completion Time. The Reactor Coolant Flow-Low (Single Loop) reactor trip does not have to be OPERABLE below the P-8 setpoint; however. the Required Action must take the plant below the P-7 setpoint if the inoperable channel is not tripped within 6 hour because of the shared components between this function and the Reactor Coolant Flow-Low (Two Loop) reactor trip function. Allowance of this time interval takes into consideration the redundant capability provided by the remaining redundant OPERABLE channel, and the low probability of occurrence of an event during this period that may require the protection afforded by the Functions associated with Condition H. (continued) INDIAN POINT 3 B 3.3.1-44 Revision 2
RPS Instrumentation B 3.3.1 BASES ACTIONS H.1 and H.2 (continued) The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 8 hours
' while performing routine surveillance testing of the other channels.
1.1 'and 1.2 ConditionI appliesfto'the RCP Breaker Position (Single Loop) reactor trip' Function. There is one breaker position device per RCP breaker. With' one channel inoperable, the inoperable channel must be restored to OPERABLE status:within 6 hours. If the channel cannot be restored to OPERABLE status within the 6 hours. then THERMAL POWER must be reduced'below the P-8'setpoint within the next 4 hours. This places the unit inca MODE where the LCO is no longer applicable. This Function does not have to be OPERABLE below the P-8 setpoint because other RPS'Functions provide core protection below the P-8 setpoint. 'The 6'hours'allowed to restore the channel to OPERABLE status and the 4 additional hours allowed to reduce THERMAL POWER to below the P-8 setpoint are justified in Reference 7. The Required Actions have been modified by a Note that allows placing the inoperable ;channel'in the bypassed condition for up to 8 hours while performing routine'surveillance testing of the other channels.
-J.1 and J.2 Condition J applies to Turbine Trip on Low'Auto-Stop Oil Pressure.
With one channel inbperable. the inoperable channel must be placed in the trip condition'within 6 hours. If placed in the tripped condition. this results inr'a partial trip condition requiring only one additional channel'to initiate a reactor'trip. If the channel cannot be restored to OPERABLE status or placed, in the trip condition, then'power must'be reduced below the P-8 setpoint within the next 6 hours. t!The'6 hours allowed to-place the inoperable channelin the'tripped condition and the10 'hours allowed for reducing power!are-justified in Reference 7. The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 8 hours while performing routine surveillance testing of the other channels. (continued) INDIAN POINT 3 B .3.3.,I.;-45 Revision 2
RPS Instrumentation B 3.3.1 BASES ACTIONS (continued) K.1 and K.2 Condition K applies to the SI Input from ESFAS reactor trip and the RPS Automatic Trip Logic in MODES 1 and 2. These actions address the train orientation of the RPS for these Functions. With one train inoperable. 6 hours are allowed to restore the train to OPERABLE status (Required Action K.1) or the unit must be placed in MODE 3 within the next 6 hours. The Completion Time of 6 hours (Required Action K.1) is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function and given the low probability of an event during this interval. The Completion Time of 6 hours (Required Action K.2) is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. The Required Actions have been modified by a Note that allows bypassing one train up to 8 hours for surveillance testing, provided the other train is OPERABLE. L.1 and L.2 Condition L applies to the RTBs in MODES 1 and 2. These actions address the train orientation of the RPS for the RTBs. With one train inoperable. 1 hour is allowed to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the next 6 hours. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. The 1 hour and 6 hour Completion Times are equal to the time allowed by LCO 3.0.3 for shutdown actions in the event of a complete loss of RPS Function. Placing the unit in MODE 3 results in ACTION C entry while RTB(s) are inoperable. The Required Actions have been modified by two Notes. Note 1 allows one channel to be bypassed for up to 2 hours for surveillance testing, provided the other channel is OPERABLE. Note 2 allows one RTB to be bypassed for up to 2 hours for maintenance on undervoltage or shunt trip mechanisms if the other RTB train is OPERABLE. The 2 hour time limit is justified in Reference 7. (continued) INDIAN POINT 3 B 3.3.1-46 Revision 2
RPS Instrumentation B 3.3.1 BASES ACTIONS L.1 and L.2 (continued) As noted in Reference 9. the allowance of 2 hours for test'and maintenance of -reacto'r trip breakers provided in Condition L. Note 1, is less-than the'"6 Kour allowable out of service time and the 8 hour allowance for testing of RPS train A and train B. In practice, if the reactor trip breaker is'being tested atfthe same time as the associated logic tr'ainthe'8 hour allowance for testing of RPS train
'-A and train' B applies to both the logic train and the reactor trip
'breaker. This is'acceptable based on the'Safety Evaluation Report for'Reference 7. '
M.] and M.2
'Condition'M appliesto the P-6 and P-10 interlocks. With one or more channels inoperable f6r'6ne-out-of-two or two-out-of-four coincidence logic, the associated interlock must be verified to be in its required state for the' xisting unit condition-within 1 hour or the unit must'be plac'ed6 iiMODE 3 within the next 6 hours. Verifying the interlock status manually accomplishes the interlock's Function. The
'Completion Time of 1'hour is based on operating experience and the minimum amount' of time allowed for manual operator actions. The
- Completion Tim 'of 6Chours' is reasonable, based on operating experience, to'reaih MODE 3 from full power in an orderly manner and without challenging unit systems. The 1'hour and 6 hour Completion Times are equal to .the time allowed by LCO 3.0.3 for shutdown actions in the event of a complete loss of RPS Function.,
N.1 and N.2 Condition N'appliest to the P-7 and P-8 interlocks and the turbine first stage pressure input to P-7. With one or more channels inoperable .for'n~e'-out-of-two or two-oUt-of-four coincidence logic, the-associated interlocklmust be'verified'to~begin its required state for the existing unit condition within 1 hour or the unit must be placed in MODE 2 within0th6next 6 hours.:' These actions are
'conservative for-the case where-power'level is being raised.
Verifying the interlock'status manually accomplishes the interlock's Function.; The Completion&Time of 1'hour is based on operating experience and the minimum amount of time allowed for manual operator actions. The Completion-Time of 6'hours is reasonable, based on operating experience, to reach MODE 2 from full power in an orderly manner and without challenging unit systems. (continued) INDIAN POINT 3 B 3.3;3.1- 47 .Revision 2
RPS Instrumentation B 3.3.1 BASES ACTIONS 0.1 and 0.2 (continued) Condition 0 applies to the RTB Undervoltage and Shunt Trip Mechanisms, or diverse trip features, in MODES 1 and 2. With one of the diverse trip features inoperable, it must be restored to an OPERABLE status within 48 hours or the unit must be placed in a MODE where the requirement does not apply. This is accomplished by placing the unit in MODE 3 within the next 6 hours (54 hours total time). The Completion Time of 6 hours is a reasonable time, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. With the unit in MODE 3. ACTION C applies to any inoperable RTB trip mechanism. The affected RTB shall not be bypassed while one of the diverse features is inoperable except for the time required to perform maintenance to one of the diverse features. The allowable time for performing maintenance of the diverse features is 2 hours for the reasons stated under Condition L. The Completion Time of 48 hours for Required Action 0.1 is reasonable considering that in this Condition there is one remaining diverse feature for the affected RTB, and one OPERABLE RTB capable of performing the safety function and given the low probability of an event occurring during this interval. SURVEILLANCE REOUIREMENTS The SRs for each RPS Function are identified by the SRs column of Table 3.3.1-1 for that Function. A Note has been added to the SR Table stating that Table 3.3.1-1 determines which SRs apply to which RPS Functions. Note that each channel of process protection supplies both train A and train B of the RPS. When testing an individual channel, the SR is not met until both train A and train B logic are tested. The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies. (continued) INDIAN POINT 3 B 3.3.1-48 Revision 2
RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) SR 3.3.1.1
-'Performance of the:CHANNEL CHECK once every 12 hours ensures that gross failure of-instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption of that instrument channels'monitoring the same parameter should read approximately the"same value. Significant deviations between the two instrument channels ould be an'indication of excessive instrument
-drift in one of the channels'or of something more serious. A CHANNEL CHECK will detect gross channel failure: thus-it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
'Agreement criteria-are determined by the unit staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication'that the sensor or the signal processing equipment has drifted outside its limit.
,The Frequency is based on operating experience that demonstrates channel failure'is rare.: The CHANNEL CHECK supplements less formal checks of channels during normal operational use of the displays associated with the LCO required channels.-
SR 3.3.1.2 SR 3.3.1.2 compares the calorimetric heat balance calculation to the
- NIS.channel output every 24 hours.;- Ifthe calorimetric exceeds the
-NIS channel output by >i2X RTP. the NIS is not declared inoperable.
but must be adjusted. If the NIS channel output cannot be properly
-adjusted.tthe channel ;ls declared inoperable.
Two Notes modify SR 3.3.1.2. The first Note indicates that the NIS channel output shall: be.adjusted.consistent with the calorimetric results if the absolute difference between the NIS channel output and
, the calorimetric Js >,X2Z RTP.- The second Note clarifies that this Surveillance is requiredlonly if reactor power is 2 15X RTP and (continued)
INDIAN POINT 3 B33.1-49 Revision 2
RPS Instrumentation B 3.3.1 BASES 3 SURVEILLANCE REQUIREMENTS SR 3.3.1.2 (continued) that 24 hours is allowed for performing the first Surveillance after reaching 15% RTP. At lower power levels. calorimetric data are inaccurate. The Frequency of every 24 hours is adequate. It is based on unit operating experience, considering instrument reliability and operating history data for instrument drift. Together these factors demonstrate the change in the absolute difference between NIS and heat balance calculated powers rarely exceeds 2% in any 24 hour period. In addition, control room operators periodically monitor redundant indications and alarms to detect deviations in channel outputs. SR 3.3.1.3 SR 3.3.1.3 compares the incore system to the NIS channel output every 31 EFPD. If the absolute difference is 2 3%, the NIS channel is still OPERABLE, but must be readjusted. If the NIS channel cannot be properly readjusted, the channel is declared inoperable. This Surveillance is performed to verify the f(AI) input to the overtemperature AT Function. Two Notes modify SR 3.3.1.3. Note 1 indicates that the excore NIS channel shall be adjusted if the absolute difference between the incore and excore AFD is 2 3%. SR 3.3.1.3 is performed to ensure that the AFD input to the Overtemperature Delta T and the system used to monitor LCO 3.2.3. AFD, are within acceptable limits. The limiting AFD is established to provide the required margin when operating at the highest power level. As power level decreases, the thermal limit becomes less sensitive to AFD because the overall margin to the thermal limit increases. Note 2 clarifies that the Surveillance is required only if reactor power is 2 90% because the requirements of LCO 3.2.3. Axial Flux Difference (AFD), are relaxed significantly below 90% RTP. (continued) ) INDIAN POINT 3 B 3.3.1-50 Revision 2
RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS SR 3;3.1.3 (continued) The Frequency of eves' 31 EFPD is adequate. It is based on unit operating experience', considering instrument, reliability and operating history'da'y'tafor 'instrument drift.' Also, the slow changes in neutron flux during the fuel cycle can be detected during this interval.. SR 3.3.1.4 SR 3.3.1.4 is the'performance of a TADOT every.31 days on a STAGGERED TEST BASIS. This test shall verify OPERABILITY by actuation of the end devices. The RTB test shall include separate verification of the undervbltage and shunt trip mechanisms. Independent verification of RTB undervoltage and shunt trip Function'is not'required for the bypass breakers. No capability is'provided'for performing such a test at power. 'The independent test of the undervoltage and shunt trip function for bypass breakers is included in SR 3.3.1.14. The bypass breaker test shall include a local shunt trip. A Note has been added to indicate that this test must be'performed on the bypass breaker prior to placing it in service. The Frequency of every 31 days on a STAGGERED TEST BASIS is adequate. It is based on industry operating experience, considering instrument reliability and operating history data. SR '3.3.1.5 SR 3:3.1'.5 is the"pevrformance of an ACTUATION LOGIC TEST. The RPS relay logic is tested 'every'31 days on a 'STAGGERED TEST BASIS. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation. All possible logic combinations, with and without applicable permissives, are tested for each protection function required by,Table 3.31-1. The Frequency of every 31 days on a STAGGERED TEST bASIS is'adequate. It is based on industry operating experience,, considering instrument reliability and
'operating history data.
(continued) INDIAN POINT 3 ' -3.3.'l
'_ 'i, " 51 Revision 2
RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) SR 3.3.1.6 SR 3.3.1.6 is a calibration of the excore channels to the incore channels. If the measurements do not agree, the excore channels are not declared inoperable but must be calibrated to agree with the incore detector measurements. If the excore channels cannot be adjusted, the channels are declared inoperable. This Surveillance is performed to verify the f(A]) input to the overtemperature AT Function. A Note modifies SR 3.3.1.6. The Note states that this Surveillance is required only if reactor power is > 90% because the requirements of LCO 3.2.3. Axial Flux Difference (AFD). are relaxed significantly below 90% RTP. SR 3.3.1.6 is performed to ensure that the AFD input to the Overtemperature Delta T and the system used to monitor LCO 3.2.3 AFD are within acceptable limits. The limiting AFD is established to provide the required margin when operating at the highest power level. As power level decreases, the thermal limit becomes less sensitive to AFD because the overall margin to the thermal limit increases. . The Frequency of 92 EFPD is adequate based on operating experience, considering instrument reliability and operating history data for instrument drift. SR 3.3.1.7 SR 3.3.1.7 is the performance of a COT every 92 days. A COT is performed on each required channel to ensure the entire channel will perform the intended Function. Setpoints must be within the Allowable Values specified in Table 3.3.1-1. The "as found" and "as left" values must also be recorded and reviewed. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift (continued) 3 INDIAN POINT 3 B 3.3.1-52 Revision 2
RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS SR 3.3.1.7 (continued) allowance used'in the setpoint methodology. The setpoint shall be left set consistent with the assumptions of Reference 6 which incorporates the requirements of Reference 7. ' SR 3.3.1.'7 is modified by' a Note that provides a 4 hour'delay in the requirement to perform this Surveillance for source range instrumentation when'entering MODE 3 from MODE 2. This Note allows a normal -shutdown to proceed without a delay for'testing in MODE 2 and for 4 hours 'inMODE 3'"until the RTBs are open and SR 3.3.1.7 is no longer required to'be performed. If the unit is to be in MODE 3 with
the RTBs closed for,> 4 hours this Surveillance must be performed prior to 4 hours after entry'into MODE 3. The 4 hour deferral is needed because'the testing required by SR3.3.1.7 and SR 3.3.1.8 cannot be performed on'the'Source Range. Intermediate Range and Power Range Instruments until'in the Applicable Mode and the proximity of these instruments-prevents working on more than one instrument at any one time. -
The Frequency of 92 days'is justified in Reference 7. SR 3.3.1.8 SR 3.3.1.8 is the performance of a COT as described in SR 3.3.1.7. except it is modified.by.a Note that-this test shall include verification that the' P-6 and P-10 interlocks are in their required state for the existing 'unit condition. The Frequency is modified by a Note that allowsithis 'surveillance to-be satisfied if it has been performed within 92 days of the Frequencies prior to reactor startup and 12 hours after reducing power below P-10 and 4 hours after reducing power below P-6. The Frequency of "prior to startup, ensures this surveillance is performed prior to critical operations and applies to the source, intermediate and power range low
-instrument channels.-: The Frequency of'"12 hours after reducing power below P-10. (applicable to intermediate and power range low channels) and "4 hours after reducing power below P-6' (applicable to source range channels) allows a normal shutdown to be completed and the unit (continued)
INDIAN POINT 3 8 3.3.1-53 Revision 2
RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REOUIREMENTS SR 3.3.1.8 (continued) removed from the MODE of Applicability for this surveillance without a delay to perform the testing required by this surveillance. The Frequency of every 92 days thereafter applies if the plant remains in the MODE of Applicability after the initial performances of prior to reactor startup. Additionally, this SR must be completed for the intermediate and power range low channels within 12 hours after reducing power below the P-10 setpoint and must be completed for the source range low channel within 4 hours after reducing power below the P-6 setpoint. The MODE of Applicability for this surveillance is
< P-10 for the power range low and intermediate range channels and <
P-6 for the source range channels. Once the unit is in MODE 3. this surveillance is no longer required. If power is to be maintained < P-10 for more than 12 hours or < P-6 for more than 4 hours, then the testing required by this surveillance must be performed prior to the expiration of the time limit. The specified Frequency provides a reasonable time to complete the required testing or place the unit in a MODE where this surveillance is no longer required. This test ensures that the NIS source, intermediate, and power range low channels are OPERABLE prior to taking the reactor critical and within a reasonable time after reducing power into the applicable MODE (< P-10 or < P-6). The deferral of the requirement to perform this test until 12 and 4 hours after entering the Applicable condition is needed because the testing required by SR 3.3.1.7 and SR 3.3.1.8 cannot be performed on the Source Range. Intermediate Range. and Power Range instruments until in the Applicable Mode and the proximity of these instruments prevents working on more than one instrument at any one time. SR 3.3.1.9 SR 3.3.1.9 is the performance of a TADOT and is performed every 92 days, as justified in Reference 7. (continued) INDIAN POINT 3 B 3.3.1-54 Revision 2
1¶ RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REOUIREMENTS SR 3.3.1.9 (continued) The SR is modified by a Note'that excludes verification of setpoints from the TAOT.'Since'this SR applies-to RCP undervoltage and underfrequency'relays. "setpoint verification requires elaborate bench calibration and is accomplished during the CHANNEL CALIBRATION. SR 3.3.1.10 A CHANNEL CALIBRATION-is performed at every refueling and every 18 months for functionrll. ',CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the'channel responds:to 'ameasured parameter within the necessary range and accuracy. CHANNEL CALIBRATIONS must be performed consistent with the assumptions used in Reference 6. The difference between the current was found' values and-the'previous test "as left" values must be consistent with the drift allowance used in the'setpoint methodology. The Frequency is based on the calibration interval used for the determination of the magnitude of equipment drift in the setpoint methodology. ' SR 3.3.1.10 is modified by a Note stating that this test shall include verification'that',the time constants are adjusted to the prescribed values; whe'r "applic'able. SR 3.3.1.11 I t .,.: ". 7 1. , `_,, :
. I : !
SR 3.3.1.11 is the`performance of a CHANNEL CALIBRATION, as described in SR 3.3.1.10. every 24 months. This SR is'modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION.' This is needed-because the CHANNEL CALIBRATION for the
.nued) (c* n
- - -- -(continued)
INDIAN POINT 3 B 3.3.1--55 I Revision 2
RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REOUIREMENTS SR 3.3.1.11 (continued) power range neutron detectors consists of a normalization of the detectors based on a power calorimetric and flux map performed above 15% RTP. The CHANNEL CALIBRATION for the source range and intermediate range neutron detectors consists of obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturer's data. This Surveillance is not required for the NIS power range detectors for entry into MODE 2 or 1. and is not required for the NIS intermediate range detectors for entry into MODE 2. because the unit must be in at least MODE 2 to perform the test for the intermediate range detectors and MODE 1 for the power range detectors. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance when performed on the 24 month Frequency. SR 3.3.1.12 SR 3.3.1.12 is the performance of a CHANNEL CALIBRATION, as described in SR 3.3.1.10. every 24 months. This SR is modified by a Note stating that this test shall include verification of the rate lag compensation for flow from the core to the RTDs. Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of resistance temperature detectors (RTD) sensors, which may consist of an inplace qualitative assessment of sensor behavior and normal calibration of the remaining adjustable devices in the channel, is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed element. The Frequency is justified by the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. (continued) INDIAN POINT 3 B 3.3.1-56 Revision 2
RPS Instrumentation B 3.3.1 BASES SURVEILLANCE REQUIREMENTS (continued) SR 3.3.1.J3 SR 3.3.1.13 is the performance of a COT of RPS interlocks every 24 months. The Frequency is basedlon the known reliability of the interlocks and
'the multichannel redundancy available, and has been shown to be acceptable througho6pbirating experience.
SR 3.3.1.14 SR 3.3.1.14 is the performance of a TADOT of the Manual Reactor Trip, RCP Breaker Position, Turbine Trip, and the SI Input from ESFAS. This TADOT is performed every 24 months. The test shall independently verify the OPERABILITY of the undervoltage and shunt trip mechanisms for the Manual Reactor Trip Function for the Reactor Trip Breakers and Reactor Trip Bypass Breakers. The Reactor Trip Bypass Breaker test shall include testing of the automatic undervoltage trip. The Frequency is based on the known reliability of the Functions and the multichannel redundancy available, and has been shown to be acceptable through operating experience. The SR is modified by a Note that excludes verification of setpoints from the TADOT. The Functions affected have no setpoints associated with them. REFERENCES 1. FSAR. Chapter 7.
- 2. FSAR. Chapter 6.
- 3. FSAR. Chapter 14.
- 4. IEEE-279-1968
- 5. 10 CFR 50.49.
(continued) INDIAN POINT 3 B 3.3.1-.57 Revision 2
RPS Instrumentation B 3.3.1 BASES REFERENCES 6. Engineering Standards Manual IES-3 and IES-3B, Instrument Loop (continued) Accuracy and Setpoint Calculation Methodology (IP3).
- 7. WCAP-10271-P-A, Supplement 2, Rev. 1. June 1990.
- 8. Consolidated Edison Company of New York, Inc. Indian Point Nuclear Generating Station Unit No. 3 Plant Manual Volume VI:
Precautions, Limitations, and Setpoints. March 1975.
- 9. WCAP-14384, Implementation of RPS Technical Specification Relaxation Programs, Rev. 0. January 1996.
INDIAN POINT 3 B 3.3.1-58 Revision 2
FSBEVS Actuation Instrumentation B 3.3.8 B 3.3 INSTRUMENTATION B 3.3.8 Fuel Storage Building Emergency Ventilation System '(FSBEVS) Actuation - Instrumentation BASES BACKGROUND. The FSBEVS ensures'that-radioactive materials in the fuel building atmosphere following a fuel handling accident-involving handling recently irradiated fuel are filtered and adsorbed prior to exhausting to the environment. .The system is described in the Bases for LCO 3.7.13, Fuel Storag& Building Emergency' Ventilation System (FSBEVS). The system initiates filtered ventilation of the fuel storage building automatically following receipt of a high radiation signal from fuel storage building:area radiation monitor, R-5. High radiation levels'detected by the fuel storage building area radiation monitor;-R.5, initiates fuel storage building isolation and starts the FSBEVS. -These actions-function to prevent exfiltration of contaminated-air'byinitiating filtered ventilation, which imposes a negative pressure on the-fuel storage building.' Following an Area Radiation Monit6ri'(R-5) signal or local :manual actuation to the emergency mode of operation, the FSBEVS ventilation supply fans stop automatically and the associated ventilation supply dampers close aiutomatically.'..The':'charcoal filter face dampers (inlet and outlet dampers) open automatically, if not already open. Additionally, the rolling door closes.' if open.' and the inflatable seals on the man doors and rolling door are actuated. The FSB exhaust fan continues to operate.' APPLICABLE SAFETY ANALYSES TheFSBEVS enstires'that radioactive materials inthe fuel storage building atmosphere.following a fuel handling' 'accident involving
-handling 'recentlyirradiated fuel are filtered and adsorbed prior to being exhausted tothe environment when the FSBEVS is aligned and operates as describeidlin'the:Bases-for LCO 3.7.13. Fuel Storage Building Emergency Ventilation System (FSBEVS). 'This action (continued)
INDIAN POINT 3 B 3.3. 8 - I 'Revision 2
FSBEVS Actuation Instrumentation B 3.3.8 BASES 3 APPLICABLE SAFETY ANALYSES (continued) reduces the radioactive content in the fuel building exhaust following a LOCA or fuel handling accident so that offsite doses remain within the limits specified in 10 CFR 50.67 (Ref. 1). The FSBEVS actuation instrumentation satisfies Criterion 3 of 10 CFR 50.36. LCO The LCO requirements ensure that instrumentation necessary for local manual and automatic actuation of the FSBEVS is OPERABLE. Manual and automatic FSBEVS actuation instrumentation consists of one channel of Fuel Storage Building Area Radiation Monitor (R-5) and one channel of manual actuation. Manual actuation from the fan house and automatic FSBEVS actuation instrumentation are Operable when both the Fuel Storage Building Area Radiation Monitor (R-5) signal and manual initiation will cause the realignment of the FSBEVS to the accident mode of operation as described in the Bases for LCO 3.7.13. Fuel Storage Building Emergency Ventilation System (FSBEVS). The setpoint for Fuel Storage Building Area Radiation Monitor (R-5) is established in accordance with the FSAR (Ref. 2). APPLICABILITY The manual FSBEVS initiation must be OPERABLE when moving recently irradiated fuel assemblies in the fuel storage building, to ensure the FSBEVS operates to remove fission products associated with leakage after a fuel handling accident involving handling recently irradiated fuel. High radiation initiation of the FSBEVS must be OPERABLE in any MODE during movement of recently irradiated fuel assemblies in the fuel storage building to ensure automatic initiation of the FSBEVS when the potential for the limiting fuel handling accident exists. Due to radioactive decay, the FSBEVS instrumentation is only required to be OPERABLE during fuel handling involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84 hours). (continued) INDIAN POINT 3 B 3.3.8 - 2 Revision 2
FSBEVS Actuation Instrumentation B 3.3.8 BASES _ '- ACTIONS The most common cause of channel inoperability is outright failure or drift of the bistable or'process module sufficient to exceed the tolerance allowed by 'Reference 2. Typically.' the drift is found to be small and results in a delay of actuation rather than a total loss of
'function. -This'deter'mination is generally made during the performance of a COT, when the inostrumentation is set up'for'adjustment to bring it within specification. If the Trip Setpoint is less conservative
'than the tolerance specified by Reference'2, the channel must be declared inoperable immediately and the appropriate Condition entered.
A.1 and A.2
-This condition applies 'when the manual or automatic FSBEVS initiation capability is inoperable. The Required Action is to immediately place
-the system'in operatioin as'described in the Bases for LCO 3.7.13.
FSBEVS. This accomplishes the actuation instrumentation function that
'may have been lost and places the unit in.a accident mode of operation. Alternatively, 'movement of recently irradiated fuel
'assemblies in the'fuel-'storage building must be suspended immediately to eliminate the potential for events that could require FSBEVS actuation. The Completion Time of immediately requires that the Required Action be pursued without delay and in a controlled manner.
SURVEILLANCE REOUIREMENTS
' 'SR 3.3.8.1 Performance of-the"CHANNEL CHECK once every 24'hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK will detect gross-channel-failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
A CHANNEL CHECK for a single channel instrument ifs satisfied by verification that the sensor or the signal processing equipment has not drifted outside its limit. (continued) INDIAN POINT 3 B 3.3.8 -'3 - Revision 2
FSBEVS Actuation Instrumentation B 3.3.8 BASES D SURVEILLANCE REQUIREMENTS SR 3.3.8.1 (continued) The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal checks of a channel during normal operational use of the displays associated with the LCO required channel. SR 3.3.8.2 A COT is performed for both the manual and automatic function once every 92 days to ensure the entire channel will perform the intended function. This test verifies the capability of the instrumentation to provide the FSBEVS actuation. The setpoints shall be left consistent with requirements of Reference 2. The Frequency of 92 days is based on the known reliability of the monitoring equipment and has been shown to be acceptable through operating experience. This test is typically performed in conjunction with SR 3.7.13.4 which verifies OPERABILITY of the activated devices. SR 3.3.8.3 A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. The Frequency is based on operating experience and is consistent with the refueling cycle. REFERENCES 1. 10 CFR 50.67.
- 2. FSAR. Section 1.3.
INDIAN POINT 3 B 3.3.8 - 4 Revision 2
i RCS Pressure. Temperature. and Flow DNB Limits B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.1 RCS Pressure. Temperature, and Flow'Departure from Nucleate Boiling' ' (DNB)YLimits BASES BACKGROUND These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within limits assumed in the safety analyses. The safety analyses (Ref. 1) of normal operating conditions and anticipated operational occurrences assume initial conditions within the'normal'st ady'state'envelope. The limits placed on RCS pressure. temperature. and flow rate ensure that the minimum departure from nucleate boiling ratio (DNBR) will be met for each of the transients analyzed.- The RCS pressure limit-is consistent with operation within the nominal operational envelope-and'controlling to 2235 psig. Pressurizer pressure indications 'areaveraged to provide a Yalue for comparison to the limit.' The indicated limit is based on'the average of three control board'readings'. Aklower pressure will cause the reactor core to approach'DNB limits. The RCS coolant average loop temperature limit is consistent with full power operation within the nominal operational envelope and controlling to a full power Tavg of 572.00F. RCS average loop temperature is assumed to be the highest indicated value of the Tavg indicators and this-value' is compared to the limit. The indicated limit is based on the average of three control board readings. A higher average temperature will cause the core to approach DNB limits. The RCS flow rate normally remains constant during an operational fuel cycle with all pumps running.. The minimum RCS flow limit corresponds to that assumed for DNB analysis. -For the 24-month surveillance, RCS flow rate is determined :by performing a heat balance after each refueling at > 9OZ RTPj calculating the.flow rate for each RCS loop, calculating the sum of:.these loop flow rates. and the sum is compared to the limit. For,>the,12,-hour surveillance, RCS flow rate is determined from the average-of the loop flow indications on each RCS loop. calculating-the-sum of these loop flow rates, and the sum is compared to the limit. The indicated limit is-based on the average of two control board readings per RCS loop. A lower RCS flow rate will cause the core to approach DNB limits. (continued) INDIAN POINT 3 B 3.4.1 - 1R- Revision I
RCS Pressure. Temperature, and Flow DNB Limits B 3.4.1 BASES BACKGROUND Operation for significant periods of time outside these DNB limits (continued) increases the likelihood of a fuel cladding failure in a DNB limited event. Calculations have shown that reactor heat equivalent to 10% rated power can be removed via the steam generators with natural circulation without violating ONBR limits. This analysis assumed conservative flow resistances including steam generator tube plugging and a locked rotor in each loop (Ref. 1). APPLICABLE SAFETY ANALYSES The requirements of this LCO represent the initial conditions for DNB limited transients analyzed in the plant safety analyses (Ref. 1). The safety analyses have shown that transients initiated from the limits of this LCO will result in meeting the ONBR acceptance limit for the RCS DNB parameters. Changes to the unit that could impact these parameters must be assessed for their impact on the DNBR criteria. The transients analyzed include loss of coolant flow events and dropped or stuck rod events. A key assumption for the analysis of these events is that the core power distribution is within the limits of LCO 3.1.6. 'Control Bank Insertion Limits"; LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)"; and LCO 3.2.4. "QUADRANT POWER TILT RATIO (QPTR)." The pressurizer pressure limit and RCS average temperature limit specified in the COLR correspond to the analytical limits used in the safety analyses, with allowance for measurement uncertainty. The RCS DNB parameters satisfy Criterion 2 of the NRC Policy Statement. LCO This LCO specifies limits on the monitored process variables (i.e., pressurizer pressure. RCS average loop temperature, and RCS total flow rate, to ensure the core operates within the limits assumed in the safety analyses. These variables are contained in the COLR to provide operating and analysis flexibility from cycle to cycle. However, the minimum RCS flow, usually based on maximum analyzed steam generator tube plugging, is retained in the TS LCO. Operating within these limits will result in meeting the DNBR criterion in the event of a DNB limited transient. (continued) INDIAN POINT 3 B 3.4.1 - 2 Revision 1
I RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES LCO The RCS flow rate'limit of .364.700 gpm allows a measurement (continued) uncertainty of 2.9% associated with the average of two control board readings per RCS loop. A thermal design flow of 354.400 gpm and a minimumr'measured flow of 364,700'gpm (including measurement uncertainty) are assumed in the safety analysis. The control board loop RCS flow indications are normalized to the heat balance RCS loop flow measurements after each refueling. The pressurizer pressure limit of 2204 psig allows for a measurement uncertainty of 24 psig associated with the average of three control board readings. A minimum value of 2180 psig (including control and measurement uncertainties) is assumed in the safety analysis. The RCS average loop temperature limit of 576.3 0F allows for a measurement uncertainty of 3.20F 'associated with the average of three control board readings.'1 A maximum full power Tavg of 579.5 0F (including control'deadband'and measurement uncertainties) is assumed in the safety'analysis. '579.5 0F in the'safety analysis corresponds to a maximum Tavg control value of 572.0F The RCS DNB parameters satisfy Criterion 2 of 10 CFR 50.36. APPLICABILITY In MODE 1. the limits on pressurizer pressure, RCS coolant average temperature, and RCS flow rate must be maintained during steady state operation in order to ensure DNBR criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient. In all 6ther MODES. the power level-is low enough that DNB is not a concern. :' ':-' ' A Note has'been'added to indicate the limit onpressurizer pressure is not applicable during'short ter operational transients such as a THERMAL POWER'ramp:increa-s > 5% RTP per minute or a THERMAL POWER step'increas'e->'"10% RTP. 'These conditions represent short term perturbations where actions to control pressure variations might be counterproductive. Also, since they represent transients initiated from power levels < 100 RTP. an increased DNBR margin exists to offset the temporary pressure variations. (continued) INDIAN POINT 3 B 3.4.1 -'3 Revision I
RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES 3; APPLICABILITY The DNBR limit is provided in SL 2.1.1, "Reactor Core SLs." The (continued) conditions which define the DNBR limit are less restrictive than the limits of this LCO, but violation of a Safety Limit (SL) merits a stricter, more severe Required Action. Should a violation of this LCO occur, the operator must check whether or not an SL may have been exceeded. ACTIONS A.1 RCS pressure and RCS average loop temperature are controllable and measurable parameters. With one or both of these parameters not within LCO limits, action must be taken to restore parameter(s). RCS total flow rate is not a controllable parameter and is not expected to vary during steady state operation. If the indicated RCS total flow rate is below the LCO limit, power must be reduced, as required by Required Action B.1, to restore DNB margin and eliminate the potential for violation of the accident analysis bounds. The 2 hour Completion Time for restoration of the parameters provides sufficient time to adjust plant parameters, to determine the cause for the off normal condition, and to restore the readings within limits, and is based on plant operating experience. B.1 If Required Action A.1 is not met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours. In MODE 2. the reduced power condition eliminates the potential for violation of the accident analysis bounds. The Completion Time of 6 hours is reasonable to reach the required plant conditions in an orderly manner. (continued) INDIAN POINT 3 B 3.4.1 - 4 Revision 1
- RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEJLLANCE RECUIREMENTS SR 31/24.1.1 Since Required Action A.1 allows a Completion Time of 2 hours to restore parameters that are not within limits, the 12 hour Surveillance Frequency'for pressurizer pressure is sufficient to ensure the pressure can be restored to a normal operation, steady state condition following load changes and other expected transient operations. Pressurizer pressure indications are averaged to determine the value for comparison to the LCO limit. The 12 hour interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and-to verify operation is within safety analysis assumptions.
SR 3.4.1.2 Since Required Action'A.1 allows a Completion Time of 2 hours to restore parameters that are not within limits, the 12 hour Surveillance Frequency'for RCS average loop temperature is sufficient to ensure the temperature can be restored to a normal operation, steady state condition following load changes and other expected transient operations. RCS average loop temperature is assumed to be the highest indicated value of the Tavg indicators and this is the value that is compared to the acceptance criteria. The 12 hour interval has been shown by operating practice to be sufficient to regularly assess for potential.degradation and to verify operation is within safety analysis assumptions. SR 3.4.1.3 The 12 hour Surveillance Frequency for RCS total flow rate is performed using the installed flow instrumentation. The 12 hour interval has been'shown by operating practice to be sufficient to regularly assess potential degradation and to verify operation within safety analysis assumptions. (continued) INDIAN POINT 3 B 3.4.1 - 5 ' Revision I
RCS Pressure. Temperature, and Flow ONB Limits B 3.4.1 BASES SURVEILLANCE REQUIREMENTS (continued) SR 3.4.1.4 Measurement of RCS total flow rate by performance of a precision calorimetric heat balance once every 24 months verifies that the actual RCS flow rate is greater than or equal to the minimum required RCS flow rate. The Frequency of 24 months reflects the importance of verifying flow after a refueling outage when the core has been altered, SG tubes plugged or other activities performed, which may have caused an alteration of flow resistance. This SR is modified by a Note that allows entry into MODE 1. without having performed the SR. and placement of the unit in the best condition for performing the SR. The Note states that the SR is not required to be performed until 24 hours after > 90% RTP. This exception is appropriate since the heat balance requires the plant to be at a minimum of 90% RTP to obtain the stated RCS flow accuracies. The Surveillance shall be performed within 24 hours after reaching 90%
.RTP.
REFERENCES 1. FSAR, Section 14.
- )
INDIAN POINT 3 B 3.4.1 - 6 Revision 1
RCS P/T Limits B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.3 RCS Pressure and Temperature ,(P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads'due to system pressure and temperature changes. These loads are introduced'by startup (heatup) and shutdown (cooldown) operations. power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation. LCO 3.4.3, Figure' 3;4.3-1.'Heatup Limitations for the Reactor Coolant System. Figure, 3.4.3-2.1Cooldown Limitations for the Reactor Coolant System, and Figure 3.4.3-3. Hydrostatic and Inservice Leak Testing Limitations for the Reactor'Coolant System. -contain P/T limit curves for heatup. cooldown, and inservice leak and hydrostatic (]SLH)
'testing, respectively (Ref. 1).
Each P/T limit curve-defines-an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or coold6wn !maneuvering.'when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region. The happy face icon shown on Figure 3.4.3-1, Figure.- 3.4.3-2. and Figure 3.4.3-3, indicates the side of the curve in which operation is permissible. Conversely, the'sadiface icon indicates the'side of the curve in which operation is prohibited. - The LCO establishes'loperating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the pressurizer, which has different design characteristics and operating functions. (continued) INDIAN POINT 3 B 3.4.3 ~- 1 Revision 2
RCS P/T Limits B 3.4.3 BASES BACKGROUND 10 CFR 50, Appendix G (Ref. 2). requires the establishment of P/T (continued) limits for specific material fracture toughness requirements of the RCPB materials. Reference 2 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. Itmandates the use of the American Society of Mechanical Engineers (ASME) Code. Section III. Appendix G (Ref. 3). The neutron embrittlement effect on the material toughness is reflected by increasing the nil ductility reference temperature (RTNrr) as exposure to neutron fluence increases. The actual shift in the RTr4JT of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref.
- 4) and Appendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Regulatory Guide 1.99 (Ref. 6).
The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions. The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls. (continued) J INDIAN POINT 3 B 3.4.3 - 2 Revision 2
RCS P/T Limits B 3.4.3 BASES BACKGROUND The consequence of violating the LCO limits is that the RCS has (continuled) been operated underlconditio'ns that can result in brittle failure of
-the RCPB, possibly leading to a *nonisolable leak or loss of coolant accident. In the eventfthese limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components. The'ASME Code, Section XI. Appendix E (Ref. 7),
provides 'arecormended methodology for evaluating an operating event that causes an excursion'outside the limits.' APPLICABLE SAFETY ANALYSES The P/T limits are not derived from Design'Basis Accident (DBA) analyses.They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB,an unanalyzed condition. Reference I establishes the methodology for determining the P/T limits. Although the P/T limits are not derived from any DBA, the P/T limits are'acceptance limits since they preclude operation in an unanalyzed condition.- RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36.
.I L LCO The.two'elements'of this LCO are:
- a. The limit curVes for heatup, cooldown, and ISLH testing; and
- b. Limits on the rate'of change of temperature.
Figure 3.4.3-1, Heatup Limitations for the Reactor Coolant System, Figure, 3.4.3-2, Cooldown Limitations for the Reactor Coolant System, and Figure 3.4.3-3. Hydrostatic and Inservice Leak Testing Limitations for the Reactor Coolant System, contain P/T limit curves for heatup, cooldown, and inservice leak and hydrostatic (ISLH) testing, respectively. These figures specify the maximum RCS pressure for various heatup and cooldown rates at any given reactor coolant (continued) INDIAN POINT 3 B 3.4.3 -'3 Revsin Revision 2
RCS P/T Limits B 3.4.3 BASES 3 LCO temperature. The figures provide the limiting RCS pressure and (continued) reactor coolant temperature combination for reactor coolant temperature heatup rates up to 600 F/hr and reactor coolant temperature cooldown rates up to 100 0F/hr. Therefore, heatup rates that exceed 600F/hr and cooldown rates that exceed 100 0F/hr are considered not within the limits of this LCO. The LCO limits apply to all components of the RCS pressure boundary, except the pressurizer. These limits define allowable operating regions and permit a large number of operating cycles while providing a wide margin to nonductile failure. The limits for the rate of change of temperature control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown. and ISLH testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves. Heatup and cooldown limits are specified in hourly increments (i.e., the heatup and cooldown limits are based on the temperature change averaged over a one hour period). Limit lines for cooldown rates between those presented may be obtained by interpolation. . Violating the LCO limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCPB components. The consequences depend on several factors, as follows:
- a. The severity of the departure from the allowable operating P/T regime or the severity of the rate of change of temperature;
- b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and
- c. The existence, size, and orientation of flaws in the vessel material.
(continued) 3 INDIAN POINT 3 B 3.4.3 - 4 Revi si on 2
RCS P/T Limits B 3.4.3 BASES APPLICABILITY The RCS P/T limits LCO provides a definition of acceptable operation for prevention of nonductile failure in accordance with 10 CFR 50.
- Appendix.G (Ref. 2)-.:'Alth6ugh the P/T limits were developed to
- provide guidance -for opeiration during heatup or cooldown (MODES 3. 4, and 5) or ISLH testing, their Applicability is at all times in keeping with the concern for-nonductile failure. The limits do not apply to
--the pressurizer. i During MODES 1 .and 2,-:other Technical Specifications provide limits for operation that' can be more restrictive than or can supplement these P/T limits. LCO'3;4.1, `RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits"; LCO 3.4.2, 'RCS Minimum
;Temperature for Criticality"; and Safety Limit 2.1. "Safety Limits,"
also-provide operational restrictions for pressure and temperature and maximum pressure. oFurthermore, MODES I and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed for normal maneuvering profiles, such as power ascension or)'descent.- Figures 3.4.3-1 and 3.4.3-2 are applicable for 34EFPY at 3216 MWt. Both figures are labeled applicable for 20 EFPY solely for the low temperature over pressure protection system arming temperature. ACTIONS A.1 and A.2 e t
- 1 .:i .6 Operation 'r ', ,the:',
outside-the' imits f during P/T-T , me MODE1 2. 3. or 4 must be corrected so-that the"2RtPB is returned to a condition that has been verified by stress analyses. The 30 minuteComlSt urgency of restoring the parameters to within 'the an'alyzed range. Most violations will not be severe.'and-the"a~ctiVitycean be accomplished in this time in a controlled manner. Besides restoriTg'bperation within limits. an evaluation is required to determine if RCS.-oper'ation can continue.-The evaluation must verify the RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components. (continued) INDIAN POINT 3 B 3.4.3 -: 5 - Revision 2
RCS P/T Limits B 3.4.3 BASES ) ACTIONS A.1 and A.2 (continued) ASME Code, Section XI, Appendix E (Ref. 7). may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline. The 72 hour Completion Time is reasonable to accomplish the evaluation. The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed before continuing to operate. Condition A is modified by a Note requiring Required Action A.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity. B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not met, the plant must be placed in a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. In reduced pressure and temperature conditions, the possibility of propagation with undetected flaws is decreased. If the required restoration activity cannot be accomplished within 30 minutes, Required Action B.1 and Required Action B.2 must be implemented to reduce pressure and temperature. If the required evaluation for continued operation cannot be accomplished within 72 hours or the results are indeterminate or unfavorable, action must proceed to reduce pressure and temperature as (continued) _) INDIAN POINT 3 B 3.4.3 - 6 Revision 2
RCS P/T Limits B 3.4.3 BASES ACTIONS B.1 and B.2 (continued) specified in Required Action B.1 and Required Action B.2. A favorable evaluation must be completed and documented before returning to operating'pressur'e-and temperature conditions. Pressure and temperature are reduced by bringing the plant to MODE 3 within 6 hours and to MODE 5 with RCS pressure < 500 psig within 36 hours. Note that LCO 3.'412, Low Temperature Overpressure Protection (LTOP), will also apply and may require limits for operation that are more restrictive than or supplement this limit. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without;challenging plant systems. C.1 and C.2 : Actions must be initiated-irnMediately to correct operation outside of the P/T limits at'times other-than when in MODE'1, 2, 3, or 4, so that the RCPB is returned-to'a condition that-has been verified by stress analysis.
'The immediate Completion Time reflects the urgency of initiating action to restore the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.
Besides restoring operation within limits. an evaluation is required to determine if RCS operation can continue. The evaluation must
' verify that -the RCPB integrity remains acceptable and must be completed prior to -entry into MODE 4. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, or inspection of-the components.'
ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline. (continued) INDIAN POINT 3 B 3.4.3 Revision 2
RCS P/T Limits B 3.4.3 BASES 3 ACTIONS C.1 and C.2 (continued) Condition C is modified by a Note requiring Required Action C.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity. SURVEILLANCE REOUIREMENTS SR 3.4.3.1 Verification that operation is within the PT limits is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. This Frequency is considered reasonable in view of the control room indication available to monitor RCS status. Heatup and cooldown limits are specified in hourly increments (i.e.. the 3 heatup and cooldown limits are based on the temperature change averaged over a one hour period). Also, since temperature rate of change limits are specified in hourly increments. 30 minutes permits ) assessment and correction for minor deviations within a reasonable time. Surveillance for heatup. cooldown, or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied. This SR is modified by a Note that only requires this SR to be performed during system heatup. cooldown, and ISLH testing. No SR is given for criticality operations because LCO 3.4.2 contains a more restrictive requirement. 3 (continued) INDIAN POINT 3 B 3.4.3 - 8 Revision 2
RCS P/T Limits B 3.4.3 BASES REFERENCES 1. WCAP-7924-A. July 1972.
- 2. 10 CFR 50. Appendix G.
- 3. ASME, Boiler and Pressure Vessel Code, Section III, Appendix G.
- 4. ASTM E 185-70.
- 5. 10 CFR 50, Appendix H.
- 6. Regulatory Guide 1.99. Revision 2. May 1988.
- 7. ASME. Boiler and Pressure Vessel Code, Section XI. Appendix E.
- 8. WCAP - 16212P, Indian Point Nuclear Power Generating Unit No. 3 Stretch Power Uprate NSSS and BOP Licensing Report, June 2004.
INDIAN POINT 3 B 3.4.3 - 9 Revision 2
RCS Loops-MODE 4
.B3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)
B 3.4.6 RCS Loops -MODE 4 BASES' BACKGROUND In MODE 4, the primary'function of the reactor coolant is the removal of decay heat and the transfer of this heat to either the steam generator (SG) secondary side coolant or the 'component cooling water via the residual heat removal (RHR) heat exchangers. The secondary function of the reactorcoolant'is to act as a carrier for soluble aneutron
-- poison,'boriczacid.
The reactor coolant is circulated through fourRCS loops connected in parallel to the reactor vessel, each loop containing a SG and a reactor coolant pump'(RCP). Appropriate flow, pressure, and temperature instrumentation are available for control, protection, and indication. -The.RCPs and RHR pumps circulate the coolant through the reactor vessel andSGs-'at a'sufficient rate to ensure proper heat transfer and to prevent boric acid stratification. Each RHR loop consists of one RHR pump and one RHR heat exchanger as well as associated piping and valves to transfer heat between the RHR heat exchanger and the core. Although either'RHR heat exchanger may be credited for eitheriRHR loop, one RHR heat exchanger must be OPERABLE for'each!OPERABLE RHR loop. In MODE 4, either RCPsi or RHR loops can be used to provide forced circulation.' The intent of this LCO is to provide forced flow from at least one RCP or one'RHR loop for decay heat removal and transport. The flow provided by one .RCP loop or RHR'loop is adequate for decay heat removal. The other intent of this LCO is to require that two paths be available to-provide redundancy for decay heat removal. When the boron concentration of the RCS is reduced, the process should be uniform to prevent sudden reactivity changes.; Mixing of the reactor coolant'will be sufficient to maintain a uniform boron concentration if at least one reactor coolant pump or one (continued) INDIAN POINT 3 B 3.-4.6-1 ' Revision I
I RCS Loops- MODE 4 B 3.4.6 BASES BACKGROUND residual heat removal pump is running while boron concentration (continued) is being changed. The residual heat removal pump will circulate the primary system volume in approximately one half hour. Boron concentration in the pressurizer is not a concern because of the low pressurizer volume and because the pressurizer boron concentration will be higher than that of the rest of the reactor coolant. Calculations have shown that reactor decay heat equivalent to 10O rated power can be removed via the steam generators with natural circulation. This analysis assumed conservative flow resistances including steam generator tube plugging and a lock rotor in each loop (Ref. 1). APPLICABLE SAFETY ANALYSES In MODE 4, RCS circulation is considered in the determination of the time available for mitigation of the accidental boron dilution event. The RCS and RHR loops provide this circulation. Ii The;RHR System in conjunction with the CCW and SWS Systems function to cool the unit from RHR entry condition (T<350 0F) to Mode 5 (T.<2000F), during normal and post accident operations. The time required to cool from 350 0F to 2000F is a function of the'number of CCW, SWS and RHR trains operating. 'As presented in UFSAR, Section 9, two trains of pumps and heat exchangers are usually used to remove residual and
.sensible heat during normal plant cool-down. 'If one train of pumps and/or heat exchangers is not operable, safe operation is governed by Technical Specifications and safe shutdown of the plant is not affected; however, the time for cool-down is extended.
RCS Loops- MODE 4 satisfy Criterion 4 of 10 CFR 50.36. LCO The purpose of this LCO is to require that' at least two loops be OPERABLE in MODE 4 and that one of these loops be in operation. The LCO allowsithe two loops that are required to be OPERABLE to consist of any combination of RCS loops and RHR loops. Any one loop in operation provides enough flow to remove the decay heat from the core with forced circulation. An additional loop is required to be OPERABLE to provide redundancy for heat removal. (continued) INDIAN POINT 3 B 3.4.6 -2 Revision 1
RCS Loops- MODE 4 B 3.4.6 BASES LCO Note 1'permits all RCPs and RHR pumps to not be in (continued) operation for I1hour p'er 8 hour period. The purpose of the Note is to permit performance'of required tests or maintenance that can only be performed with no forced circulation. The 1-hour time period is acceptable because operating experience has shown that boron stratification is not' a problem during this short period with no forced flow. Utilization of Note 1 is permitted provided the following conditions are met along with 'any other conditions, imposed 'by test or maintenance procedures: - - -
- a. No operations are permitted that would dilute the RCS boron concentration,-therefore maintaining the margin to criticality.
Boron' reduction is'prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and
- b. Core outlet temperature is maintained at least 10 OF below
* - saturation temperature, so that no vapor bubble may form and possibly cause a-natural circulation flow obstruction.
Note 2 requires that *the reactor coolant pump starting requirements of LCO 3.4.12,1Low Temperature Overpressure Protection (LTOP), must be met before the start of an RCP with any RCS cold leg temperature less than or equal to the LTOP arming temperature.:. This restraint is to prevent a low temperature overpressure event due to a thermal transient when an'RCP;is-started. An OPERABLE RCS loopcomprises an OPERABLE RCP and an OPERABLE SG in accordance with the Steam Generator Tube Surveillance Program, which has the minimum water level specified in-SR 3.4.6.2. Similarly for the R-RSystem, an OPERABLE RHR loop comprises an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger. :RCPs and RHR pumps are OPERABLE if they are capable of being powered and are able to provide forced flow if required. (continued) INDIAN POINT 3 B-'1-4.6-3 ' Revision I
I - RCS Loops - MODE 4 B 3.4.6 BASES
)
APPLICABILITY In MODE 4. this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. One loop of either RCS or RHR provides sufficient circulation for these purposes. However, two loops consisting of any combination of RCS and RHR loops are required to be OPERABLE to meet single failure considerations. Operation in other MODES is covered by: LCO 3.4.4. "RCS Loops-MODES 1 and 2"; LCO 3.4.5. "RCS Loops -MODE 3*; LCO 3.4.7,."RCS Loops -MODE 5, Loops Filled"; LCO 3.4.8. "RCS Loops-MODE 5, Loops NotFilled"; LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation- High Water Level" (MODE 6); and LCO 3.9.5. "Residual Heat Removal (RHR) and Coolant Circulation -Low Water Level" (MODE 6). ACTIONS A.1
--Ifone required RCS loop is inoperable and two RHR loops are K) inoperable, redundancy for heat removal is lost. Action must be initiated to restore a second RCS or RHR loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal..
B.1 If one required RHR loop is OPERABLE and in operation and there are no RCS loops OPERABLE, an inoperable RCS or RHR loop must be restored to OPERABLE status to provide a redundant means for decay heat removal. If the parameters that are outside the limits cannot be restored, the unit must be brought to MODE 5 within 24 hours. Bringing the unit to MODE 5 is' a conservative action with regard to decay heat removal. With only one RHR loop OPERABLE, redundancy for decay heat removal is lost and, in the event of a loss of the only OPERABLE RHR loop, it would be safer to initiate that loss from MODE 5 (* 200 OF) rather than MODE 4 (200 to 350 'F). The Completion Time of 24 hours is a reasonable time, based on operating experience, to reach MODE 5 from MODE 4 in an orderly manner and without challenging plant systems. (continued) C) INDIAN POINT 3 B 3.4.6-4 Revision 1
RCS Loops - MODE 4 B 3.4.6 BASES . , ACTIONS C.I and C.2 (continued) If no loop is OPERABLE or in'operation, except during conditions permitted by Note 1 in the LCO section, all operations involving a reduction of RCS b6iron' concentration must be suspended and action to restore one RCS or'RHR loop to OPERABLE status and in operation must be initiated. Boron' dilution requires forced circulation for proper mixing, and the margin to criticality must not be reduced in this type of operation. The immediate Completion Times reflect the importance of maintaining operation for decay heat removal. The action to restore must be continued until one loop is restored to OPERABLE
-status and operation.
SURVEILLANCE REOUIREHENTS '- ;' SR 3.4.6.1 This SR requires verification every 12 hours that one RCS or RHR loop is in operation. Verification includes flow rate, temperature, or. pump status monitoring,'which help ensure that forced flow is-- providing heat removal. -The Frequency of 12 hours is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS and RHR loop performance. SR 3.4.6.2 SR 3.4.6.2 requires verification of SG OPERABILITY. SG OPERABILITY Is verified by ensuring that the actual secondary side water level is > 71% wide range for each required loop. Depending on plant conditions, either wide range or narrow range SG level instruments may be used to verify this SR is met. Operators may be required to adjust the indicated level to compensate for the effects of SG temperature. If the SG secondary side actual water level is < 71% wide range, the tubes may become uncovered and the associated loop may not be capable
.of providing the heat sink necessary for removal of decay heat.
(continued) INDIAN POINT 3 B;3.4.6 ' .Revision 1
RCS Loops - MODE 4 B 3.4.6 BASES SURVEILLANCE REOUIREMENTS SR 3.4.6.2 (continued) The 12 hour Frequency.is.considered adequate in view of other indications available in the control room to alert the operator to the loss of.SG level. SR 3.4.6. Verification that the required pump is OPERABLE ensures that an additional RCS or RHR pump can be placed in operation, if needed. to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pump and associated support.systems. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience. REFERENCES I.. ..FSAR Chapter: 14.1.6.. K) (9' INDIAN POINT 3 B 3.4.6-6 Revision 1
Pressurizer B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.9 Pressurizer . .. *-
,, , > , l-, . . .trl.. ,,
BASES BACKGROUND The pressurizer provides a point in the RCS where liquid and vapor are maintained .irequilibiium under saturated conditions for pressure
. I control purposes to'prevent bulk boiling in the remainder of the RCS.
Key functi6ns' include-m'aintaining required primary system pressure during steady state operation, and limiting the pressure changes caused by-reactor coolant thermal expansion and contraction during normal load transients. The pressure control components addressed by this LCO include the pressurizer water level, the required heaters, and emergency power supplies. Pressurizer'safety valves and pressurizer power operated relief valves are'addresed by LCO 3.4.1iO'"Pressurizer Safety Valves.' and LCO'3.4.11 'Pressurizer Power'Operated Relief Valves (PORVs)." respectively.: ' The-intent of the LCO is to ensure that a 'steam bubble exists in the pressurizer prior to power operation to minimize the consequences of
' ' 'potential overpresure transients. The presence of a steam bubble is consistent with analytical Relatively small amounts of
-ssumptions.
noncondensible 'gases can inhibit the condensation heat transfer between the pressurizer spray and the'steam, and diminish the spray effectiveness for pressure'control. ' Electrical immersion'heaters, located in the lower section of the pressurizer vessel, k'ee pthe water in the pressurizer at saturation temperature and maintain a constant operating pressure. A minimum required available' capacity of pressurizer heaters ensures that the
-;RCS pressure c~an bie maintained. The capability to maintain and
-control system presiire'is important for maintaining subcooled conditionsin'the RCS andensuring the capability to remove core decay
' heat by either forced or 'natural circulation of reactor coolant.
Unless adequate heater capacity is available, the hot, high pressure condition'cannotbe aintained indefinitely and still provide the
-' required subc oollig margin in the primary system. Inability to
*(continu)
- - -~~-~- -- ' ' ' (continued)
INDIAN POINT 3 B 3.4.9 - R Revision 33
Pressrize Pressurizer B 3.4.9 BASES .u BACKGROUND control the system pressure and maintain subcooling under conditions (continued) of natural circulation flow in the primary system could lead to a loss of single phase natural circulation and decreased capability to remove core decay heat. Pressurizer heaters are powered from either the offsite source or the diesel generators (DGs) through the four 480V vital buses as follows: bus 2A (DG 31) supports 485 kW of pressurizer heaters; bus 3A (MG31) supports 555 kW of pressurizer heaters; bus-SA'(DG 33) supports 485 kW of pressurizer heaters; and, bus 6A (DG 32)'supports 277 kW of pressurizer heaters. APPLICABLE SAFETY ANALYSES In Modes 1. 2, and 3, the LCO requirement on pressurizer water level ensures.that a steam bubble exists in the pressurizer. For events that result in pressurizer insurge (e.g.. loss of normal feedwater. loss of offsite'power and loss of load/turbi'ne.trip). the analyses assume that the limiting val'ue' forthe highest initial pressurizer level is 59.3%. This analytical limit is based on the pressurizer program level of 50.8% at a full.power Tavg 5720F plus a conservative 8.5% of span. For other events, the nominal, value of pressurizer level is assumed because'the effect of,the initial pressurizer level on-the results is small.. The analyses assume the existence of a steam bubble and saturated conditions in the,'pressurizer. In making this'assumption, the analyses neglect the small fraction of noncondensible gases normally present. The limiting scenario for these accident'analyses is with the'plant at full power. Therefore. the LCO requirement specified for MODE 1 ensures that the pressurizer initial condition assumption remains valid." Safety analyses presented in the FSAR (Ref. 1) that are examined for pressurizer.filling, the loss of normal Jfeedwater and loss of offsite power analyses. assume pressurizer heater operation as operation of the heaters makes the transient results more limiting by contributing to the thermal expansion of the water in the pressurizer. The maximum pressurizer water level limit, which ensures that a steam bubble exists in the pressurizer, satisfies Criterion 2 of 10 CFR 50.36. The need'to maintain subcooling in the long term during loss of offsite power, as indicated in NUREG-0737 (Ref. 2). is the reason for providing an LCO. (continued) 3 INDIAN POINT 3 B 3.4.9 - 2 Revision 3
Pressurizer B 3.4.9 BASES LCO The pressurizer water level limit is consistent within the nominal operational envelope and controlling to 50.8% level span at a full
'power Tavg of 572.00F.L'The pressurizer water level must be < 54.3Z for the pressurizer to be OPERABLE and will ensure that a steam bubble exists.' Pressurizeriwater level indications are averaged to provide a value for6comparison'to the limit. The indicated limit is based on the averageof'two control board readings, and allows for a measurement uncertainty of 5Z. Whenever pressurizer water level in MODE-3 is above'the MODE 1'and 2 limit, a dedicated operator is assigned for operating and controlling the chemical and volume control system,including'monitoring'pressurizer water level.
Limiting the LCO rraximum operating water level preserves the steam space for pressure control. The LCO has been established to ensure the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure transients.- "Requiring the presence of a steam bubble is
- also consistent with analytical assumptions..
The LCO requires two groups of OPERABLE pressurizer heaters, each with a capacity 2 150 kW, capable of being powered from either the offsite power -source or the emergency,power supply. Each of the 2 groups of pressurizer heaters'should be powered from a different DG to ensure that the minimum required:capacity of 150 kW can be energized during a loss of offsite power condition assuming the'failure of a single DG. The minimum heater capacity required is sufficient to maintain the RCS
- near normal operating pressure'when accounting for heat losses through
- the pressurizer insulation." By maintaining the pressure near the operating conditions.--a-wide margin to subcooling can be obtained in the loops. The value of 150 kW is sufficient to maintain pressure and is dependent on the heat losses.
APPLICABILITY '.-,The need for pressure control is most pertinent when core heat can
-. - cause the greatest:effect-on RCS temperature. resulting in the
.*greatesteffect-on'pressurizer level and RCS pressure control. Thus, applicability'has'been'designated for MODESTl and 2. The applicability is also provided for MODE 3. The purpose is to prevent solid water RCS operation during heatup and cooldown to avoid rapid pressure rises caused by normal operational perturbation, such as reactor coolant pump startup.
When RCS temperature 'isbelow 4110FY administrative controls in the (continued) 4 INDIAN POINT 3 B 3.4.9 - ;3 - - Revision 3
I Pressurizer B 3.4.9 K) BASES APPLICABILITY Technical Requirements Manual (Ref. 3) are used to limit the (continued) potential for exceeding 10 CFR 50, Appendix G limits. In MODES 1. 2. and 3. there is need to maintain the availability of pressurizer heaters, capable of being powered.from an emergency power supply.. In the event of, a loss of offsite power, the initial conditions of these MODES give the greatest demand for maintaining the RCS'in a hot pressurized condition with loop subcooling for an extended period. For MODE 4, 5,.or 6, it is not necessary to.controlpressure (by heaters) to ensure loop subcooling for heat transfer when the Residual Heat Removal (RHR) System is in service, and therefore, the LCO is not-applicable. ACTIONS A.1 and A.2 Pressurizer water level control malfunctions or other plant evolutions may result in a pressurizer water level above the nominal upper limit, even with the plant at steady state conditions. If the pressurizer water level is not within the limit, action must be taken to place the plant in a MODE in which the LCO does not apply. To achieve this status, the.unit must be brought to MODE 3, with the reactor trip.breakers open, within 6 hours and to MODE 4 within 12 hours. This takes the unit out of the applicable MODES.
- The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
B.1 If one required group of pressurizer heaters is inoperable, restoration is required within 72 hours. The Completion Time of 72 hours is reasonable considering that the redundant heater group is still available and the low probability.of an event during this period. Pressure control may be maintained during this time using remaining heaters. C.1 and C.2 If one group of pressurizer heaters are inoperable and cannot be restored in the allowed Completion Time of Required Action B.1. the (continued) ) INDIAN POINT 3 B 3.4.9 - 4 Revision 3
Pressurizer B 3.4.9 BASES ACTIONS C.1 and C.2 (continued) plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE REOUIREMENTS SR 3.4.9.1 This SR requires that during steady state operation, pressurizer level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The Surveillance is performed by observing the indicated level. The Frequency of 12 hours has been shown by operating practice to be sufficient to regularly assess level for any deviation and verify that operation is within safety analyses assumptions of ensuring that a steam bubble exists in the pressurizer. Alarms are also available for early detection of abnormal level indications.- SR 3.4.9.2 The SR is satisfied when the power supplies are demonstrated to be capable of producing the minimum power and the associated pressurizer heaters are verified to be at their design rating. This may be done separately by testing the power supply output and by performing an electrical check on heater element continuity and resistance. The Frequency of 24 months is considered adequate to detect heater degradation and has been shown by operating experience to be acceptable. REFERENCES 1. FSAR. Section 14.
- 2. NUREG-0737, November 1980.
- 3. IP3 Technical Requirements Manual.
INDIAN POINT 3 B 3.4.9 - 5 Revision 3
RCS Operational LEAKAGE B 3.4.13 B 3.4 REACTOR COOLANT SYSTEM (RCS) B 3.4.13 RCSOperational LEAKAGE BASES - - BACKGROUND Components that-contain or transport the coolant to or from the reactor core make up the RCS. Component joints are made by welding. bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.' - During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical. deterioration. The purpose' of the RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE. 10 CFR 50, Appendix A. GDC 30 (Ref. 1). requires means for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE. The safety significance of RCS LEAKAGE varies widely depending on its source, rate.-and duration. Therefore, detecting and monitoring reactor coolant-LEAKAGE Into the containment area is necessary. Ouickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur that is detrimental to the safety of the facility and the public. A limited amount of leakage-inside containment'is expected from auxiliary systems that cannot be-made 100% leaktight. Leakage from these systems should'be detected, located, and isolated from the containment atmosphere. if.possible. to not interfere with RCS leakage detection. This'LCO deals with grotection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling,
'in addition to preventing'the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).
(continued) INDIAN POINT 3 B.3.4.13 - I Revision 3
i RCS Operational LEAKAGE B 3.4.13 BASES APPLICABLE SAFETY ANALYSES Except for primary to secondary LEAKAGE, the safety analyses do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event. The safety analysis for events resulting in steam discharge to the atmosphere assumes a range of primary to secondary LEAKAGE from 0.1 gpm to 10 gpm as the initial condition.: Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a steam line break (SLB) accident. To a lesser extent. other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR). The leakage contaminates the secondary fluid. The FSAR (Ref. 2) analysis for SGTR assumes the contaminated secondary fluid is released via safety valves and atmospheric dump valves. The 1 gpm primary to secondary LEAKAGE is relatively inconsequential. The SLB is more limiting for site radiation releases. The safety analysis for the SLB accident assumes a range of primary to secondary LEAKAGE as an initial condition. The dose consequences resulting from the SLB accident are well within the limits defined in 10 CFR 50.67 and the staff approved licensing basis (i.e., a small fraction of these limits). The RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36. LCO RCS operational LEAKAGE shall be limited to:
- a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting (continued)
INDIAN POINT 3 B.3.4.13 - 2 Revision 3
RCS Operational LEAKAGE B 3.4.13 BASES LCO in higher LEAKAGE. Violation of this LCO could result in (continued) continueddegradation of the RCPB LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.
- b. Unidentified LEAKAGE One gallon per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount and is consistent with the capability of the equipment required by LCO 3.4.15. RCS Leakage -Detection Instrumentation.--Violation of this LCO could' result in continued degradation of the RCPB. if the LEAKAGE is from the pressure boundary.
- c. Identified LEAKAGE.-
Up to'10'gpm of-identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of unidentified LEAKAGE andis well within the capability of the RCS Makeup System. Identified LEAKAGE includes LEAKAGE to the'containment from specifically known and locatedsources; but does not include pressure boundary LEAKAGE, the leakageJintd'closed'systems or controlled reactor coolant pump (RCP) seal leakoff (a,normal function not considered LEAKAGE). 'Violation of. this LCO could result in continued degradation of ,a'componentor system.
- d. Primary to Secondary LEAKAGE throuch Ail Steam Generators (SGs)
Total primary to secondary LEAKAGE amounting to 1 gpm (1440 gpd) throughall SGs' produces acceptable offsite doses in'the SLB accident analysis. Violation of this LCO could exceed the off*ite dose limits for this accident. Primary to secondary "LEAKAGE must beIncluded in the total allowable limit for identified LEAKAGE. {continued) INDIAN POINT 3 B.3.4.13 -3 Revision 3 R
RCS Operational LEAKAGE B 3.4.13 BASES LCO e. Primary to Secondary-LEAKAGE through Any One SG (continued) The 432 gallons per day (0.3 gpm) limit on one SG is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line rupture. If leaked through many cracks, the cracks are very small, and the above assumption is conservative. APPLICABILITY In MODES 1;- 2, 3, and 4. the potential for RCPB LEAKAGE is greatest when the RCS is pressurized. In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE. Leakage past PIVs or other leakage into closed systems is that leakage that can be accounted for and contained by a system not directly connected to the atmosphere. Leakage past PIVs or other leakage into closed systems is not included in the limits for either identified or unidentified LEAKAGE but PIV leakage must be within the limits specified for PIVs in LCO 3.4.14. 'RCS Pressure Isolation Valves (PIV)." Leakage past PIVs or other leakage into closed systems is quantified before being exempted from the limits for identified LEAKAGE. ACTIONS L1 Unidentified LEAKAGE, identified LEAKAGE, or primary to secondary LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours. This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB. B.1Land B.2 If any pressure boundary LEAKAGE exists, or if unidentified LEAKAGE, identified LEAKAGE, or primary to secondary LEAKAGE cannot be (continued) INDIAN POINT 3 B.3.4.13 - 4 Revision 3
RCS Operational LEAKAGE 8 3.4.13 BASES ACTIONS B.1 and B.2 (continued) reduced to within limits within-4 hours, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences.-It should be noted that LEAKAGE past seals and.gaskets 'isnot pressure boundary LEAKAGE. The reactor must
'be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. This action reduces the LEAKAGE and also reduces the,factors that tend to
- 'degrade the pressure boundary.
The allowed Completipn;Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 5, the'pressure-stresses acting on the RCPB are much lower. and further deteriorationis much less likely-. SURVEILLANCE REQUIREMENTS , SR 3.4.13.1 ' Verifying RCS LEAKAGE-totbe within the LCO limits ensures the integrity of the RCPB~is maintained. Pressure boundary LEAKAGE would
'at first appear as unidentified LEAKAGE and can only be positively identified by inspection. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an RCS water inventory, balance.. Primary to secondary LEAKAGE is also measured by
,performance.ofan RCSwater inventory balance in conjunction with effluent monitoring within the secondary steam and blowdown systems.
"The RCS water inventory balance must be met with the reactor at steady state operating conditions and near operating pressure. Therefore, this-SR is not required to be performed-in MODES 3 and 4 until 12' hours of steadystate operation near operating pressure'have-been established. - K (continued)
INDIAN POINT 3 B.3.4.13 5 Revision 3
- i RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE REQUIREMENTS SR 3.4.13.1 (continued)
Steady state operation is'required to perform a proper inventory balance; calculations during maneuvering are not useful and a Note requires the Surveillance'to be met when steady state is established. For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows. An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is providedlby'the systems that monitor the containment atmosphere radioactivity and the operation of the containment sump pump. These leakage detection systems are specified-in-LCO 3.4.15. 'RCS Leakage Detection Instrumentation." It should be noted that LEAKAGE past seals and gaskets, measured leakage past PIVs, and other leakage into closed systems is not pressure boundary LEAKAGE. The 72 hour Frequency is a reasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. A Note under the Frequency column states that this SR is required to be performed during steady state operation. SR 3.4.13.2 This SR provides the means necessary to determine SG OPERABILITY in an operational MODE. The requirement to demonstrate SG tube integrity in accordance with the Steam Generator Tube Surveillance Program emphasizes the importance of SG tube Integrity. even though this Surveillance cannot be performed at normal operating conditions. REFERENCES 1. 10 CFR 50, Appendix A. GDC 30.
- 2. FSAR. Section 14.
INDIAN POINT 3 B.3.4.13 - 6 Revision 3
RCS Specific Activity B 3.4.16 B 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.16 RCS Specific Activity ' ' BASES : ' ' ' ' - -'. BACKGROUND .The .maximum dosethat an individual at the site boundary can receive for 2'hours'during'.an accident is specified in 10 CFR 50.67 (Ref. 1). The limits on specific activity ensure that.the doses are held to within the 1.CFR'50.67 limits during analyzed transients and accidents.' The'RCS specific;`activity' LCO limits the allowable concentration level of radionuclides in'the 'reactor coolant. The [CO limits are established -to minimizethe:offsite radioactivity dose consequences in
-the event of a steam generator tube rupture'(SGTR) accident.
The LCO contains'specific activity limits for both DOSE EQUIVALENT I-
'131 and gross specific~activity. -The allowable levels are intended to limit the 2 hour dose' at-the site boundaryto a'small fraction of the 10 CFR 50.67 'dose guideline'limits. The limits'in the LCO are standardized, based on parametric evaluations of offsite radioactivity dose consequences for, typical',site locations.".
The parametric evaluations showed the potential',offsite dose levels for a SGTR accident'were an appropriately small'fraction of the 10 CFR 50.67 dose guideline limits. .Each evaluation assumes a broad range of
'site applicable atmospheric dispersion factors'.in a parametric evaluation,.
APPLICABLE SAFETY ANALYSES TheLCO-limits.on the specific-activity of the reactor coolant ensures
.thet'eesultihg;2'hour doses at the site boundary will not exceed the deflned dose limits following a SGTR accident. The SGTR safety analysis (Ref. 2) assumes the specific activity of the reactor I (continued)
INDIAN POINT 3 B 3.4.16'- 1 Revision eiv o 1 I
I RCS Specific Activity B 3.4.16 BASES <1 APPLICABLE SAFETY ANALYSES (continued) coolant at the LCO limit and an existing reactorcoolant steam generator (SG) tube leakage rate of 1 gpm. The safety analysis assumes the specific activity of the secondary coolant at its limit of 0.1 pCi/gm DOSE EQUIVALENT I-131 from LCO 3.7.17. 'Secondary Specific Activity." The analysis for the SGTR accident establishes .the acceptance limits for RCS specific activity. Reference tothis analysis is used to assess changes to the unit that could affect RCS specific activity. as they relate to the acceptance limits. The analysis is for two cases of reactor coolant specific activity. One case assumes specific activity'at 1.0'pCi/gm DOSE EQUIVALENT I-131 with'a concurrent,large, iodine spike that increases the rate at which iodine activity is released to the' reactor coolant. The second case assumes the initial reactor coolant iodine activity at 60.0 pCi/gm DOSE EQUIVALENT I-131 due to a pre-accident iodine spike caused by an RCS transient. -In both cases, the noble gas activity in the reactor coolant'assumes 1% failed fuel, which closely equals the LCO limit of 100/E(bar) pCi/gm for gross specific activity. The analysis also assumes,a loss of offsite power at the same time as the SGTR event. The SGTR causes a reduction in reactor coolant inventory. The reduction initiates a reactor trip from a low pressurizer pressure signal or an RCS overtemperature AT signal. The coincident loss of offsitepower causes the steam dump valves to close to protect the condenser. The rise in pressure in the ruptured SG discharges radioactively contaminated'steam to the atmosphere through the SG atmospheric dump valves-(ADVs) and the main steam safety valves. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends. The'safety analysis'shows the radiological consequences of an SGTR accident are within the dose limits.' Operation with iodine specific (continued) INDIAN POINT 3 B 3.4.16 - 2 Revision I
' 'RCS Specific Activity B 3.4.16 BASES APPLICABLE SAFETY ANALYSES (continued)
-'-activity levels'greater than the LCO limit is permissible, if the activity levels'do'not exceed the limits-shown In Figure 3.4.16-1 for more than'48 hours.;The'safety'analysis has-pre-accident iodine spiking levels up to'60.0 pCi/gm DOSE EQUIVALENT 1-131.
The remainder of theabove limit permissible iodine levels shown in
- Figure-3.4.16-1 areacceptable because of the low probability of a
' SGTR accident'occurring during the established'48 hour time limit.
The occurrence of 'an'SGTR accident at these permissible levels could increase the site boundary dose levels, but still be within 10 CFR 50.67 dose guideline limits. The limits on RCS specific activity are also used for establishing
-standardization inlradiation shielding and plant personnel radiation protection practices.;
RCS specific activity'satisfies Criterion 2 of 10 CFR 50.36.
. ' 9 LCO- - The specific iodine:activity -is limited to 1.0 pCi/gm DOSE EQUIVALENT I-131, and the gross specific activity in the reactor coolant is limited to the number of pCi/gm equal to 100 divided by E(bar)
(average disintegration energy of the sum of the average beta and gamma 'energies'of the coolant nuclides). The'limit on DOSE EQUIVALENT I-131 and the limit on gross specific activity ensures the 2 hour does
-to'an 'individual at'the site boundary during' the DBA will be below the
- allowed dose.'
-The SGTR accident analysis (Ref. 2) shows 'that the 2 hour site
- -boundary dose levels are within acceptable limits. Violation of the LCO may result-in reactor coolant radioactivity levels that could, in the event of an SGTR..lead to site boundary doses that exceed the 10 CFR 50.67 dose guideline limits.
(continued) INDIAWPOINT 3 B 3.4.16- 3Rvsio L Revision .1
h RCS Specific Activity B 3.4.16 BASES APPLICABILITY In MODES 1 and 2. and in MODE 3 with RCS average temperature 2 500EF.-operation within the LCO limits for DOSE EQUIVALENT 1-131 and gross specific activity are necessary to contain the potential consequences of an SGTR to within the acceptable site boundary dose values. For operation in MODE 3 with RCS average temperature < 5000F. and in MODES 4 and 5, the release of radioactivity in:the event of a SGTR is unlikely since the saturation pressure of the reactor coolant is below the lift pressure settings of the main steam safety valves. ACTIONS A.1 and A.2 With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of 4 hours must be taken to demonstrate that the limits of Figure 3.4.16-1 are not exceeded. The Completion Time of 4 hours is required to obtain and analyze a sample. Sampling is done to establish the trend. The DOSE EQUIVALENT I-131 must be restored to within limits within 48 hours. The Completion Time of 48 hours is required to allow operation to~continue. if the limit violation resulted from normal iodine a spiking. A Note to the Required Actions of Condition A excludes the MODE change restriction of.LCO 3.0.4. This exception allows entry into the applicable MODE(S) while relying on the ACTIONS even though the ACTIONS may eventually require plant shutdown. This exception is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to power operation. (continued) 3 INDIAN POINT 3 B 3.4.16 - 4 Revision 1
RCS Specific Activity B 3.4.16 BASES ACTIONS fu -. ... (continued) With the gross specific activity in excess of the allowed limit. the unit must be placed in aiMODE in which the requirement does not apply.
' 5 Placing the'plant-in MODE 3 with RCS average temperature < 500OF lowers the saturation'pressure of the reactor coolant below the setpoints of the main steam safety valves and prevents venting the SG to the environmenti'nn:an SGTR event. The allowed Completion Time of 6 hours is reasonable. based on operating experience, to reach MODE 3 below 5000 F from full power conditions in an orderly manner and without challenging plant systems.
If a Required Action and the associated Completion Time of Condition A is not met or if the DOSE EOUIVALENT-1-131 is in the unacceptable region of Figure 3.4.16-1, the reactor must be brought to MODE 3 ,ith RCS average temperature < 5000 F within 6 hours. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 below 5000F from full power conditions In an orderly manner and without challenging plant systems. SURVEILLANCE REQUIREMENTS
,: -it
'- ~SR 3.4.16.1- - ---
SR 3.4.16.1 requires 'perfobming a gamma'isotopIc "analysis as a measure of the gross specific activity of the reactor coolant at least once
-every 7 days. While basically a quantitative measure of radionuclides with-half lives longer-than'10 minutes, excluding iodines, this
-measurement is the:sum of'the degassed gamma activities and the gaseous gamma activities- in'the sample taken. This Surveillance provides an indication-of'any increase in gross specific activity.
(continued) INDIAN POINT 3 B 3.4.16 -, 5 ein 1-Revision
RCS Specific Activity B 3.4.16 BASES j SURVEILLANCE REQUIREMENTS SR 3.i. 1 6.1 (continued) Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The Surveillance is applicable in MODES 1 and
- 2. and in MODE 3 with Tavg at least 500 0F. The 7 day Frequency considers the low probability of a gross fuel failure during the time.
SR 3.4.16.2 This Surveillance is performed in MODE 1 only to ensure Iodine remains within limit during normal operation and following fast power changes when fuel failure is more apt to occur. The.14 day Frequency is adequate to trend changes in the iodine activity level, considering gross activity is monitored every 7 days. The Frequency, between 2 and 6 hours after a power change X 15% RTP within a 1 hour period, is established because the iodine levels peak during this time following fuel failure: samples at other times would provide inaccurate results. SR 3.4.16.3 A radiochemical analysis for E(bar) determination is required every 184 days (6 months) with the plant operating in MODE 1 equilibrium conditions. The E(bar) determination directly relates to the LCO and is required to verify plant operation within the specified gross activity LCO limit. The analysis for E(bar) is a measurement of the average energies per disintegration for isotopes with half lives longer than 10 minutes,.excluding iodines and non-gamma emitters. The 10 minute limit on half-lives ensures that Xenon-138 is included in the determination of E(bar). The Frequency of 184 days recognizes E(bar) does not change rapidly. (continued) 3 INDIAN POINT 3 B 3.4.16 - 6 Revision 1
RCS Specific Activity B 3.4.16 BASES SURVEILLANCE REQUIREMENTS SR 3.4.16.3 (continued) This SR has been modified by a Note that Indicates sampling is required to be performed within 31 days after a minimum of 2 effective full power days and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for at least 48 hours. This ensures that the radioactive materials are at equilibrium so the analysis for E(bar) Is representative and not skewed by a crud burst or other similar event. REFERENCES 1. 10 CFR 50.67. .
- 2. FSAR, Section 14.2.
INDIAN POINT 3 B 3.4.16 - 7 Revision I
ECCS-Operating B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)- - B 3.5.2 ECCS-Operating I I I ..
.3 .. ", I . I I .. - .i - '..
BASES. ,1 , BACKGROUND The function of the'ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of
':the following'accidents: '
- a. Loss of coolant accident (LOCA), coolant leakage greater than the capability of the normal charging system;
- b. :Rod eJection accident;
'c' Loss of secondary coolant accident; and d.i Steam generator' tube rupture (SGTR).
The addition of'negative reactivity is designed primarily for the loss
- 'of secondary coolantfaccident where 'primary cooldown could add enough positive reactivity to achieve criticality and return to significant
- power. ' -
There are 'three phases of ECCS operation: injection, cold leg recirculation,-and'hbt Tlg'recirculation. In the injection phase, water'is'taken from the refueling water'storage tank (RWST) and inJected into the`Reactor Coolant System (RCS) through the cold legs. When sufficient watelis' removed from'the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the recirculation and containment sumps have'enough water to supply the
.. required net positive suction head to the ECCS pumps, suction is switched t the recirculation surrp or containment sump for cold leg recirculation.i'After 6.5 hours, the ECCS flow is shifted to the hot
,leg'recirculation phaserto provide a backflush. which would reduce the
.boiling in the top of the'core and any resulting boron precipitation.
Ir a-,
-- -_ ,-,- -(continued)
INDIAN POINT 3 B 3.5.2 -, 1 .Revision 1
I ECCS - Operating B 3.5.2 BASES ( BACKGROUND The ECCS FUNCTION is provided by three separate ECCS systems: (continued) high head safety injection (HHSI), residual heat removal (RHR) injection, and containment recirculation. Each ECCS system is divided into subsystems as follows: HHSI System is divided into three 50% capacity subsystems (i.e., HHSI 31. 32 and 33) which share two pump discharge headers (i.e.. 31 and 33). Each HHSI subsystem consists of one pump as well as associated piping and valves to transfer water from the suction source to the core. HHSI subsystem 32 is aligned to inject using the flow path associated with both HHSI subsystem 31 and 33. If either HHSI pump 31 or 33 fails to start. or achieve required discharge pressure. HHSI pump 32 will inject via the header associated with the failed pump. If all three HHSI pumps start, flow from HHSI pump 32 will be divided between header 31 and 33. Note that the HHSI pumps have a shutoff head of approximately 1500 psig. Therefore. IP3 is classified as a low head safety injection-plant.
- RHR injection System is divided into two: 100% capacity subsystems. Each ECCS RHR subsystem consists of one RHR pump and one RHR heat exchanger as well.as.associated piping and valves to transfer water from the suction source to the core.
Although eitherPRHR heat exchanger may be credited for either RHR subsystem, one RHR heat exchanger must be OPERABLE for each OPERABLE RHR injection subsystem.
- Containment Recirculation is divided into two 100% capacity subsystems. Each subsystem consists of one Containment Recirculation pump and one RHR heat exchanger as well as associated piping and valves to transfer water from the suction source to the core. Although either RHR heat exchanger may be credited for either Recirculation subsystem, one RHR heat exchanger must be OPERABLE for each OPERABLE Containment Recirculation subsystem.
(continued) INDIAN POINT 3 B 3.5.2 -2 Revision 1
ECCS -Operating B 3.5.2 BASES 'BACKGROUND
- The three. ECCSi ,sst~ems (3HHSI, 2'RHR and' 2 Recircul ati on)
(continued) are grouped'Into threie trains' (5. 2A/3A and 6A) such that any 2
,of the 3 trains are. capable of meeting all ECCS capability assumed in the la'dcident analysis. Each ECCS train consists of the followng:'
- a. ECC Trin5A includes subsystems H-HSI 31 and containment recic lton 31;..
- b. _ECCS'Tr6 in -2A/3A includes subsystems HHSI 32 and RHR 31; and.,~KiI
-c. ECCS, Train 6A includes subsystems HHSI 33, PWR 32. and
-contalrnm~ntlreci rcul ati on 32.
"The ECCS trains us h aedesignation as the Safeguards Power Trains reuired by ICO 3..9. Distribution'Systems - Operating, with Safeguards Power Train 5A supported by'DG 33, Safeguards Power Train 2A/23 supported by DG 31. ,Safeguards Power Train 6A supported by DG.
-; 32. -
The' ECC'S'accumulators and th~RbWST are also part of the ECCS, but are
-not considered part of' ani ECCS flow path'as~descriibed by this LCO.
The flow paths consist~of.'piping, valves heat exchangers, and esECCS
-pumps such that water-'from the RWST can~be.'in'jeted into the RCS following the ac'dd~t decie'n hsL The major components
*of each subsystem are the'high head saety'Injection pumps, the RHR pumps, heat exchangers,' and the containment'recirculation pumps. This Inteconectng and redundant subsystem:designpprvides the operators with thie'abilitytio'utilize'.components from different trains to aciive the required '100% -flow to thecoe During the Injection phase of LOCA recovery, .asuction header supplies water from the RW4ST to'theAHSI and RH-R pumps. The discharge from the HHSI and RHR pumps feed injection lines to each of the RCS cold legs.
Control valves are set to balance the HHSI flow to the RCS. (continued) INDIANIPOINT 3 B i 5 -.'2-:-3 ' ' B3523Rvso Revi.sion I '
i ECCS -Operating B 3.5.2 BASES BACKGROUND This balance ensures sufficient flow to the core to meet the analysis (continued) assumptions following a LOCA in one of the RCS cold legs. During the recirculation phase of LOCA recovery, the containment recirculation pumps take suction from the containment recirculation sump and direct flow through the RHR heat exchangers to the cold legs. The RHR pumps can be used to provide a backup method of recirculation in which case the RHR'pump suction is transferred to the containment sump. The RHR pumps then supply recirculation flow directly or supply the suction of the HHSI pumps. Initially. recirculation is through the same paths as the injection phase. Subsequently. recirculation injection is split between the hot and cold legs. The ECCS also functions to supply borated water to the reactor core following increased heat removal events, such as a main steam line break (MSLB). The limiting design conditions occur when the negative moderator temperature coefficient is highly negative. such as at the end of each cycle. During low temperature conditions in the RCS,'limitations are placed on the maximum number of HHSI pumps that may be OPERABLE. Refer to the Bases for LCO 3.4.12.i-Low Temperature Overpressure Protection (LTOP)System." for the basis of these'requirements. The ECCS subsystems, except for the containment recirculation subsystems, are actuated upon receipt of an SI signal. The actuation of 'safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start immediately in the programmed'sequence.' If offsite power is not available, the Engineered Safety Feature (ESF)_buses shed normal operating loads and are connected to the emergency diesel'generators (EDGs). Safeguard loads are then actuated in the programmed time sequence. The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required before pumped flow is available to the core following a LOCA. (continued) INDIAN POINT 3 B 3.5.2 -4 Revision 1
ECCS - Operating B 3.5.2 BASESS BACKGROUND The active ECCS components. along with the passive accumulators (continued) and the RWST covered iniCO 3.5.1'. Accumulators,' and LCO 3.5.4, "Refueling Water 'Storage 'Tank (RWST)P' provide the cooling water necessary to meet GDC 35 (Ref. 1). APPLICABLE SAFETY ANALYSES .'. ' , ; - - The CO hhelps to ensure that the following acceptance criteria for the ECCS. established'by'10 CFR 50.46 (Ref. 2), will be met following a LOCA:
- a. -Maximum-fuel element cladding temperature is < 22OPF;
- b. Maximum cladding oxidation is < 0.17 times the total cladding thickfiess.before'oxidation:
c..' Maximum hydrogen generation from a zirconium water reaction is <
.0.01 times the hypothetical amount generated if all'of the metal in' the cladding'cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;
;d. Core is maintained in a coolable geometry; and
- e. Adequate long term core cooling capability is maintained.
The LCO also limits1 the potential for a post trip return to power following an MSLB event'. ' Each ECCS subsystem'is taken credit for in a large break LOCA event at full power (Refs. 3 and 4)."; This event establishes the requirement Jfor runout flow for-the ECCS pumps, as well as the maximum response
'time for theiractuation. The HHSI ppumps are credited in a small break LOCA event. -The OPERABILITY requirements for the ECCS are based on the following LOCA analysis assumptions:
- a. A large break LOCA event, with loss of offsite power and a
single failure"disabling one EDG; and
'(continued)
I-INDIAN POINT 3 B 3.-5. 5 : -Revision'l
i ECCS-Operating B 3.5.2 BASES APPLICABLE SAFETY ANALYSES (continued)
- b. A small break LOCA'event, with a loss of offsite power and a single failure disabling one'EDG.
During the blowdown stage of a LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment. The nuclear reaction is terminated either by moderator voiding during large breaks or control rod insertion for small breaks. Following depressurization, emergency cooling water is injected into the cold legs, flows into the downcomer, fills thedlower plenum, and refloods the core. The effects on containment mass and energy releases are accounted for in appropriate analyses (Refs. 3 and 4). The LCO ensures that an ECCS train will deliver sufficient water to match boiloff rates soon enough to minimize the consequencesiof the core being uncovered following a large LOCA. It'also ensures that the HHSI pumps will deliver sufficient water and boron during a small LOCA to maintain core subcriticality. For a small break LOCA,'the steam generators continue to serve as'the heat sink, providing part of the required core cooling. The ECCS trains satisfy Criterion 3 of 10 CFR 50.36. LCO In MODES.1, 2, and 3, three ECCS trains are required to ensure that sufficient ECCS flow is available. assuming'a single failure affecting any one train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents. In MODES 1, 2, and 3. the ECCS consists of the following:
- a. ECCS Train 5A includes HHSI subsystem 31 and containment recirculation subsystem 31:
- b. ECCS Train 2A/3A includes HHSI subsystem 32 and RHR subsystem 31; and.
(continued) INDIAN POINT 3 B 3.5.2 -6 Revision 1
- I' -. ECCS - Operating B 3.5.2 BASES. ..
LCO' c. ECCS Train 6A Includes HHSI subsystem 33. RHR subsystem 32,
*(continued) and containment'rrecirculation subsystem 32.
- Each'HHSI subsystem consists of one pump as'well as associated
- instrumentation, piping and valves to transfer water from the suction source to the core .";HHSI. subsystem 32 is OPERABLE when capable of injecting using th" flow paths'associated with HHSI subsystem 31 and
- 33. Each ECCS RHR subsystem consists of.one RJR pump and one RHR heat exchanger aas wl as sociated instrumentation, piping and valves to
- transfer water from the suction source'to the core. Although either l- RHRheat exchanger may be credited for either RMR subsystem, one RHR
'heat exchanger must'be'OPERABLE for each'OPERABLE RHR injection subsystem..
Each containment recirculation subsystem consists of one Containment
-:Recirculation punp and one RHR heat exchanger as well as associated instrumentation piping and valves to transfer water from the suction source to the core.' Although either RHR.heat.exchanger may be credited for either Recirculation subsystem, one RHR heat exchanger must be OPERABLE for each OPERABLE Containment Recirculation subsystem." Note that Recirculation pump OPERABILITY requires the .-. ' -- functional availability-of the associated auxiliary component cooling water pump.
During an event requiring ECCS actuation, a-flow path is required to provide an abundant supply of water from the RWST to the RCS via the
.HHSI and R-HR: pumps and-their supply header to each of the four cold leg injection nozzles (8 cold leg injection nozzles for the HHSI
. pumps)... In the 'longtermjthis flow path may be switched to take its
- - supply from the containment recirculation sump using the containment recirculation pumps or, alternately, the' containment sump using the RHR pumps to supply its flow to the RCS hot and cold legs, either directly;into the"RCS or via :the HHSI pumps.
The flow path for-each train'must maintain'its designed independence to ensure.that'n6sifigle':failure can disable more than one ECCS train
* (except as described-in Reference 5).'
* - ;i;;(-c : . .u:
(continued) INDIAN POINT 3 B-3'.5.:2 -; 7 , Revision I
I ECCS - Operating B 3.5.2 BASES K) LCO As indicated in Note 1. the SI flow paths may be isolated for (continued) 2 hours in MODE 3, under controlled conditions, to perform pressure isolation valve testing per SR 3.4.14.1.- This is acceptable because the flow paths are readily restorable from the control room or the valves are opened under administrative controls that ensure prompt closure when required. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. As indicated in Note 2. operation in MODE 3 with ECCS trains made incapable of injecting pursuant to LCO 3.4.12, *Low Temperature Overpressure Protection (LTOP) System"A-is necessary for plants with an LTOP arming temperature at or near the MODE 3 boundary temperature of 350 0F. LCO 3.4.12 requires that certain pumps be made incapable of injecting at and below the LTOP arming temperature. When this temperature is at or near, the MODE 3 boundary temperature, time is needed to restore the Inoperable pumps to OPERABLE status. APPLICABILITY In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the I3 limiting Design Basis Accident, a large break LOCA. are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements when at lower power. The HHSI pump performance requirements are based on a small break LOCA. MODE 2 and MODE 3 requirements are bounded by the MODE 1 analysis. This LCO is only applicable in MODE 3 and above. Below MODE 3, system functional requirements are relaxed as described In LCO 3.5.3. 'ECCS-Shutdown." In MODES 5 and 6. plant conditions are;such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7. *RCS Loops-MODE 5, Loops Filled," and LCO 3.4.8, *RCS.Loops-MODE-5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level." (continued 3 INDIAN POINT 3 B 3.5.2 -8 Revision 1
ECCS-Operating B 3.5.2 BASES S ACTIONS Al-With one or more trains inoperable and any two HHSI pumps, any one RHR pump, and any one Containment Recirculation pump OPERABLE (i.e.. 100%
- of the ECCS capability .assumed in the accident analysis is available),' the inoperable components must be returned to OPERABLE status withinJ72 hours.The 72 hour Completion Time is based on an NRC reliability evaluation(Ref. 4) and'is a reasonable time for repair'of many ECCS'c6mponents. If 100% of the ECCS capability assumed in the accident analysis is niot OPERABLE, entry into LCO 3.0.3
.isrequired.' -
An ECCS train is inoperable if it is not capable of delivering design flow to the RCS. Individual components are-inoperable if they are not capable of performing'their design function or supporting systems are not available. The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, 'the'inoperability of one pump in a train does not render the ECCS incapable of performing its function." Neither does the inoperability of twobdifferent pumps, each in'a'different train, necessarily-result"in'a loss of function for the ECCS. The intent of this Condition is to maintain a combination of equipment such that 100% of the ECCS flow equivalent to two OPERABLE ECCS trains remains available. This'alibwi increased flexibility in plant operations
- under circumstances when'pumps in redundant trains are inoperable.
'An event accompanied by'a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref. 4) has shown that the impact of having one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours.
Reference 5 describes situations in which one component, such as the valves governed by SR 3.5.2.1, can disable more than one ECCS train. With one or more component(s) inoperable such that 100% of the flow equivalent for HHSI, RHR and Containment Recirculation is not available, the facility is'in a condition outside the accident analysis. Therefore, LCO 3.0.3 must be immediately entered. (continued) INDIAN POINT 3 B 3.5.2 -9 Revision 1
ECCS- Operating ECCS - Operating B 3.5.2 BASES ) ACTIONS (continued) B.1 and B.2 If the Inoperable trains cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and MODE 4 within 12 hours. The allowed Completion Times are reasonable. based on operating experience. to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE REQUIREMENTS SR 3.5.2.1 Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained. Misalignment of these valves could render more than one ECCS train inoperable. Securing these valves in position by, removal of power, or by key locking the control in the correct position ensures that they cannot change position as a result of an, active failure or, be inadvertently misaligned. These valves are of the type, described in Reference 5, that can. disable the function of more than one ECCS train and Invalidate the accident analyses. A 12 hour Frequency is considered reasonable in view of other administrative controls that will ensure a mispositioned valve is unlikely. (continued) K INDIAN POINT 3 B 3.5.2 -10 Revision 1
ECCS - Operating B 3.5.2 BASES SURVEILLANCE REOUIREMENTS (continued) SR 3.5.2.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS'flow paths provides assurance that the
-proper flow paths willexist for ECCS operation. This SR does not apply to valvesthat are locked, sealed, or'othe'rwise secured in
.-position.'since these,'were,'verified to be in the correct position prior to locking, sealing,' or'securing. A valve that receives an actuation signal is allowed to be in a'nonaccident position provided the valve will automatically reposition within the proper stroke time.
This Surveillance does notrequire any testing or valve manipulation.
' Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control. and an improper valve position would only affect a single train. This Frequency has been shownto be acceptable through operating experience. -
SR 3.5.2.3 Periodic surveillance'testing of.ECCS pumps to,detect gross
- degradation caused:by'impeller structural damage or other hydraulic component problems-ls required by Section XI of the ASME Code. This
type of testing'may be accomplished by measuring the pump developed head at only one polnt'of the pump characteristic curve. This verifies both that'the measured performance is within an acceptable toleranceof the'original pump baseline'performance and that the
- performance at the ,test flow is greater than'or..'equal to the performance assLiTed in'-the plant safety analysis. SRs are specified in the Inservice Testing Program. which encompasses Section XI of the ASME Code. Section XI of the ASME Code provides the activities and Frequencies necessary to satisfy the requirements.
i(o. . .i e
' , :- - -- -- (continued)
INDIAN POINT 3 B 3.i._2_"1'1' Revision 1
I ECCS - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued) SR 3.5.2.4 and SR 3.5.2.5 These Surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal and'that each ECCS.pump starts on receipt of'an actual or simulated SI signal. Note that the Containment Recirculation system is a manually Initiated system and is not included as part of this SR. Additionally, this Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 24 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the potential for unplanned 'plant transients if the Surveillances were performed with' the reactor at power. The 24 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part 'of ESF Actuation System testing. and equipment performance is monitored as part of the Inservice Testing Program. SR 3.5.2.6 Realignment of valves in the flow path on an SI-signal is necessary for proper ECCS performance. These valves have stops to allow proper positioning for restricted flow to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. Therefore, an improperly positioned valve could result in the inoperability of more than one injection flow path. The stops are set based on the results of the most recent ECCS operational flow test. The 24 month Frequency is based on the reasons stated in SR 3.5.2.4 and SR 3.5.2.5. SR 3.5.2.7 Periodic inspections of each containment and recirculation sump suction inlet ensure that each is unrestricted and stays in (continued) INDIAN POINT 3 B 3.5.2 -12 Revision 1
ECCS - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS SR 3.5.2.7 (continued) proper operating condition. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage, on the need to have access to the location, and because of the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This Frequency is sufficient to detect abnormal degradation and is confirmed by industry operating experience. REFERENCES 1. 10 CFR 50, Appendix A. GDC 35.
- 2. 10 CFR 50.46.
- 3. FSAR, Section 14.
- 4. NRC Memorandum to V. Stello, Jr., from R.L. Baer. Recommended Interim Revisions to LCOs for ECCS Components.' December 1.
1975.
- 5. IE Information Notice No. 87-01.
INDIAN POINT 3 B 3.5.2 -13 Revision I
Containment Air Locks B 3.6.2 B 3.6 CONTAINMENT SYSTEMS _.... B 3.6.2 Containment Air Locks BASES . BACKGROUND Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of operation .,..I. Each air lock isa cylinder with a door at each end.: One of the two'
.air locks is designed as a part of the containment structure and the other is designed ai-an integral part of the containment equipment hatch but otherwsed-the'two air locks function identically. Each air lock door'has been designed and tested to certify its ability to withstand a pressure in 'excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment. As such, closure;of a single-door 'supports containment OPERABILITY.
. Each air lock door and the equipment hatch is designed with double t ...gasketed :seals to pernit pressurization between the gaskets. The
'.-double gasketed seals are.normally continuously pressurized above
.accident pressure,.' Finally, to effect a leak tight seal, the air
.lock design uses pressure seated doors (i.e.. an increase in containment internal~pressure results in increased sealing force on each door) and local leakage rate testing capability is available to ensure containment integrity Is.being maintained.
' The doors' are interlock1 d to prevent simultan ous opening of the Inner and outer door. This interlock is a requirement for OPERABILITY.
During periods when containment is not required to be OPERABLE, the door interlock mechanism:may be disabled., allowing both doors of an air lock to remain.open for extended periods.when frequent containment entry is necessary.;' Each personnel air lock is provided with limit switches on both doors that provide control room indication when an airlock door is not fully closed. ,.m ;
-(cont* inue
--.- .(continued)
INDIAN POINT 3 B . f).'2'- I Revision 1-
Ai L Conainn Containment Air Locks B 3.6.2 BASES ) BACKGROUND The containment air locks form part of the containment pressure (continued) boundary. As such, air lock integrity and leak tightness is essential for maintaining the containment leakage rate within limit in the event of a DBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analyses. APPLICABLE SAFETY ANALYSES The DBAs that result in a release of radioactive material within containment are a loss of coolant accident and a rod ejection accident. In the analysis of each of these accidents, it is assumed that containment is. OPERABLE such that release of fission products to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of O.1% of containment air weight per day (Ref. 2). This leakage rate is defined in 10 CFR 50, Appendix J. Option B (Ref. 1), as La - 0.1X of containment air weight per day, the maximum allowable containment leakage rate at the calculated peak containment'internal pressure Pa 42.0 psig following a OBA (LBLOCA or MSLB). This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs 4-associated with the air locks. The containment air locks satisfy Criterion 3 of 10 CFR 50.36. LCO Each containment air lock forms part-of the containment pressure boundary.' As part of the containment pressure boundary, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event. Each air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of containment does not (continued) K INDIAN POINT 3 B 3.6.2 -2 Revision I
Containment Air Locks B 3.6.2 BASES LCO exist when containment'is required to be OPERABLE. Closure of a (continued) 'single door in each'air lock is sufficient to provide a leak tight
- barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used'for normal entry into or exit.from contairment.-
The program establiihed by'Specification 5.15.- "Containment Leakage Rate Test Program," which :conforms to NEI 94-01, Section 10.2.2 (Ref.
- 3) for Containment Air Locks, requires that air lock doors opened
-rduring periods when containment integrity is required must be tested
-' - within 7 daysaftiribeing opened. For Indian Point 3, which has air
-locks with testable -seals, this requirement is satisfied in accordance
;'-with ANSI/ANS-56.-8-1994 'Containment System Leakage Testing Requirements,"'(Ref: 4)by testing the seals (i.e., verifying that
- seals re-pressur'ize torthe:required pressure after an airlock door is closed). -Pressurization of air lock seals is not required for air lock OPERABILITY except as needed to satisfy testing requirements after'being opened.'.:"
APPLICABILITY In MODES 1, 2. 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment
-air locks'are not 2rehuired'in MODE 5 to prevent leakage of radioactive m-aterial from containment.The requirements for the containment air locks during MODE6 'area'ddressed in LCO 3.9.3,- "Containment Penetrations. "-
ACTIONS' '- The ACTIONS are modified by a Note that allows"'entry and exit to perform repairs on the affected air lock component. If the outer door is inoperable, then it may be easily accessed for most repairs. When the inner door is inoperable, it is preferred that the air lock be accessed from inside primary containment by entering through the other i OPERABLE ir lock. However, if this is not practicable, or if repairs on either'door must be performed from the barrel side of the door then it-is pe'rmissible to"e'nter the air lock through the OPERABLE door. which means there is a short time during which the containment
- '(continued)
INDIAN--POINT 3 B 3.6.2 -73 t: .. Revision I -
i Containment Air Locks B 3.6.2 BASES K) ACTIONS boundary is not intact (during access through the OPERABLE door). (continued) The ability to open the OPERABLE door, even If it means the containment boundary is temporarily not intact. is acceptable due to the-low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed. If ALARA conditions permit, entry and exit should be via an OPERABLE air lock. A second Note has been added to, provide clarification that, for this LCO, separate Condition entry is allowed for each air lock. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable air lock. Complying with the Required Actions may allow for continued operation. and a subsequent inoperable air lock is governed by subsequent Condition entry and application of associated Required Actions. In the event the air lock leakage results in exceeding the overall containment leakage rate, Note 3 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1, Containment. A.1. A.2. and A.3 K) With one air lock door in one or more containment air locks inoperable, the OPERABLE door must be verified closed (Required Action A.1) in each affected containment air lock. This ensures that a leak tight containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour. This specified time period is consistent with the ACTIONS of LCO 3.6.1. which requires containment be restored to OPERABLE status within 1 hour. In addition, the affected air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour Completion Time. The 24 hour Completion Time is reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed. (continued) K) INDIAN POINT 3 B 3.6.2 -4 Revision I
Containment Air Locks B 3.6.2 BASES ACTIONS A.1. A.2. and A.3 (continued)' Required Action A'.3'verifies that an air lock with an inoperable door has been isolated by theuse of a locked and closed OPERABLE air lock d6or:. This ensures'that "an acceptable containment leakage boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment"and is'considered adequate in view of the low likelihood'of alocked:door being mispositioned and other administrative controls.- Required Action'A.3 is modified by a Note that'applies to air lock doors located in high radiation areas and allows these doorsto be verified locked closed'by use of administrative means. Allowing verification by administrative means is considered acceptable. since access to these areas is typically restricted. Therefore,'thei probability of misalignment of the door, once it hastbeen~verified to be in the proper position, is small. The Required Action's'ihave been modified by two Notes. Note 1 ensures that'only the Required Actions and associated Completion Times of Condition C are 'required if both doors in the same air lock are
-inoperable. With both doors'in the same air'lock inoperable, an OPERABLE door is not available to be closed. 'Required Actions C.1 and.
C.2 are the appropriate-remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry' into Condition A; only the requirement to comply with the Required Actions. Note 2'allows use of the air lock for entry and exit for 7 days under administrative controls if both air locks have an inoperable door. This 7 day restriction begins when the second air lock is discovered inoperable. Containment entry may be required on a periodic basis t6 perform Technical Specifications (TS) Surveillances
'andRequired Actions.:as well as other activities on equipment inside containment that are required by TS or activities on equipment that support TS-requlred equipment. This Note is not intended to preclude
*performing other.activities (i.e., non-TS-required activities) if the containment is entered, using the inoperable air lock, to perform an
*allowed'.activity listed above. This allowance is acceptable due to the low'probability of an event that could pressurize the containment during the short.tiriethat the OPERABLE door is expected to be open.
(continued) INDIAN POINT 3 8 -3. 6. 2 -. 5 : Revision 1
I Containment Air Locks B 3.6.2 BASES Q ACTIONS B.1. B.2. and B.3 (continued) With an air lock interlock mechanism inoperable in one or more air locks, the Required Actions and associated Completion Times are consistent with those specified in Condition A. The Required Actions have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable. With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock). Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable. since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small. C.1. C.2. and C.3 With one or more air locks inoperable for reasons other than those described in Condition A or B. Required Action C.1 requires action to be initiated immediately to evaluate previous combined leakage rates using current air lock test results. An evaluation is acceptable. since it is overly conservative to immediately declare the containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 1 hour (per LCO 3.6.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test. the overall containment leakage rate can still be within limits. (continued) K) INDIAN POINT 3 B 3.6.2 -6 Revision 1
Containment Air Locks B 3.6.2 BASES ACTIONS C.1. C.2. and C.3 (continued) Required Action C.2 requires that one door in the affected containment air lock must'be'verified to be closed within the 1 hour Completion Time. This'specifi6d time period is consistent with the ACTIONS of
'LCO 3.6.1, which requires that containment be restored to OPERABLE status within 1 hour.
Additionally, the affected air lock(s) must be restored to OPERABLE status within the.,24'hour Completion Time unless Condition C is exited in accordance withICO 3.0.2 (i.e., one door is made OPERABLE). The
-specified time period is considered reasonable for restoring an inoperable air.lock'to OPERABLE status.'assuming that at least one
'door is maintained closed in each'affected air lock.
D.1 and D.2 If the inoperable containment air lock cannot be'restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCOdoes not apply.: To achieve this status, the plant must be brought to at least MODE 3 .within 6 hours and to MODE 5 within 36 hours.-'The allowed Completion Times are reasonable, based' on'operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging' plant systems. SURVEILLANCE REQUIREMENTS SR 3.6.2.1 . Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of 10 CFR 50, Appendix J (Ref. 1). required by Specification 5.5.15, Containment Leakage Rate Testing
'Program. This SR reflects'the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and containment
- -I - rI(continued) INDIAN POINT 3 B "3:'6.2 I .7 Revision 1
Containment Air Locks B 3.6.2 BASES SURVEILLANCE REOUIREMENTS SR 3.6.2.1 (continued) OPERABILITY testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is required by Specification 5.5.15, Containment Leakage'Rate Testing Program. The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the'overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR requiring the results to be evaluated against the acceptance criteria that is applicable to SR 3.6.1.1. This ensures that air lock leakage is properly accounted for in determining the combined Type B and C containment leakage rate. SR 3.6.2.2 The air lock interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since both the inner and outer doors of an air lock'are designed to withstand the maximum expected post accident containment pressure, closure of either door will support containment OPERABILITY. Thus, the door interlock feature supports containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous opening of the inner and outer doors will not inadvertently occur. Due to the purely mechanical nature of this interlock, and given that the interlock mechanism is not normally challenged when the containment air lock door is used for entry and exit (procedures require strict adherence to single door opening), this test is only required to be performed every 24 months. The 24 month Frequency is based on the need to perform this Surveillance under conditions that apply during a plant outage, and the potential (continued) INDIAN POINT 3 B 3.6.2 -8 Revision 1
Containment Air Locks B 3.6.2 BASES SURVEILLANCE REQUIREMENTS SR 3.6.2.2 (continued) for loss of containment OPERABILITY if the Surveillance were performed with the reactor at power. The 24 month Frequency for the interlock is justified based on generic operating experience. The Frequency Is based on engineering judgment and is considered adequate given that the interlock is not normally challenged during the use of the airlock. REFERENCES 1. 10 CFR 50, Appendix J. Option B.
- 2. FSAR. Section 6.6.
- 3. NEI 94-01. Section 10.2.2.
- 4. ANSI/ANS-56.8-1994. Containment System Leakage Testing Requirements."
INDIAN POINT 3 B 3.6.2 - 9 Revision I
- Containment Sirbay 'System and Containment Fan Cooler System SB 3.6.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.6 Containment Spray System and Containment Fan Cooler System' BASES
-BACKGROUND The Containment Spray System and Containment Fan Cooler System provide containment atmosphere'cooling to limit post accident pressure and
" ' temperature in containment to less than the design values. Reduction of containment pressure and'the iodine'removal capability reduces the release of'fission product'radioactivity from containment to the environment, 'inthe 'event of a Design Basis Accident (DBA). to within limits. :The Containment Spray and Containment Fan Cooler systems are designed to meet-"the requirements of 10 CFR 50,Appendix A, GDC 38, "Containment Heat Removal. GDC 39. 'Inspection of Containment Heat Removal Systems;! GDC 40, -"Testing of Containment Heat Removal
' Systems," GDC 41, "Containment Atmosphere Cleanup," GOC 42,
'Inspection of Contairnment'Atmosphere Cleanup Systems." and GDC 43, "Testing of Containment Atmosphere'Cleanup Systems" (Ref. 1).
- . . . i ! _ _ ,r ':, ri, The Containment Spray' System and Containment Fan Cooler System are Engineered Safety Feature (ESF) systems. They are designed to ensure that the'heat removal capability required during the post accident period can be attained. The Containment Spray System and the Containment Fan"CoolerSystem provide redundant methods to limit and maintain post-accident' conditions to less than the containment design values. -
Containment'Sprav.-System The Containment Spray System consists of two separate trains. Each traintincludes a containment spray pump, piping and valves and is independently capable of delivering one-half of the design flow needed to maintain the post-accident containment pressure below 47 psig. The spray water isinjected into the containment'through spray nozzles
- ,connected to four 360 degree ring headers located in the containment dome area.. Eachtrain supplies two of the-four ring headers. Each train is powered.from a separate safeguards power train. The
-: -refueling water'storage tank (RWST)'supplies borated water to the
- Containment Spray System during the injection'phase of operation.
(continued) INDIAN POINT 3 B 3.6.6 - 1 ' Revision 2
- - A Containment Spray System and Containment Fan Cooler System B 3.6.6 BASES I BACKGROUND After the Refueling Water Storage Tank has been'exhausted, the (continued) containment recirculation pumps or the Residual Heat Removal (RHR) pumps are used to supply the Containment Spray ring headers for the long-term containment cooling and iodine removal during the containment recirculation phase. In this configuration, the RHR heat exchangers provide the necessary cooling of the recirculated containment spray.
The Containment Spray System provides a. spray of cold borated water mixed with sodium hydroxide (NaOH) from the spray additive tank into the upper regions of containment to reduce the containment pressure and temperature. Additionally. these systemsreduce fission products from the containment atmosphere during a DBA. iThe RWST solution temperature is an important factor in determining the heat removal capability of the Containment SpraySystem during the injection phase. In the recirculation mode of operation, heat is removed from the containment sump or recirculation sump water by the residual heat removal heat exchangers.. Both trains of the Containment Spray System are needed to provide adequate, spray coverage to meet the system design requirements for containment heat removal assuming the Fan Cooler System is not available. The Spray.Additive System injects an NaOH solution into the spray. The resulting alkaline pH of the spray enhances the ability of the ( spray to scavenge fission products from the containment atmosphere. The NaOH added in the spray also ensures an alkaline pH for the solution recirculated in the containment sump. The alkaline pH of the containment sump water minimizes the evolution of iodine and minimizes the occurrence of chloride and caustic stress corrosion on mechanical systems and components exposed to the fluid. The Containment Spray System is actuated either automatically by a containment High-High pressure signal or manually. An automatic actuation starts the two containment spray pumps, opens the containment spray pump discharge valves. and begins the injection phase. A manual actuation of the Containment Spray System requires the operator to actuate two separate push buttons on the main control board to begin the same sequence. The injection phase continues until the RWST water supply is exhausted. After the Refueling Water Storage Tank has been exhausted, the containment recirculation pumps or the (continued) INDIAN POINT 3 B 3.6.6 - 2 Revision 2
Containment'Spriy -System and Containment Fan Cooler System
'1 - B 3.6.6 BASES -
BACKGROUND residual heat removal (RHR) pumps may be used to supply the (continued) '-'ContainmentSprayrng headers for the long-term containment cooling and iodine removal during the containment recirculation phase. In this configuration`, the 'RHR heat exchangers provide the necessary cooling of the'rie61 roulated containment spray.' The Containment Spray function in the recirculation mode may be used'to maintain an equilibrium temperature between the containment atmosphere and the recirculated sumpr 2water.' The Containment Spray function in the recirculation mode is controlled by the operator in accordance with
-the emergency operating' rocedures.
Containment Fan Cooler System The'Containment Fan Cooler System consists of five 20X capacity Fan
' Cooler Units (FCIs)located inside containment.' These FCUs are used for both normal and post accident cooling of the containment atmosphere. Each'FCU consists of a motor, fan, cooling coils.
moisture separators, HEPA filters, carbon filters, dampers, duct distribution system, instrumentation and controls. Service water is supplied to the cooling coils to perform the heat removal function. rma - .lat ea HEA fltr During normal plant'operation, the moisture' separators, HEPA filters and 'activated'carb6n'tfilter assembly are isolated from the main air recirculation stream. In this configuration,'service water is supplied to all five'FCUs and two or more FCUs fans are typically operated to limit the'affbient containment air temperature during normal unit operation to less than the limit specified in LCO 3.6.5, "Containment 'Air Temperature."'. This temperature limitation ensures that the containment temperature does not exceed the initial temperature 'conditions assumed for the DBAs. In post'accident'operation following an actuati6n signal, the Containment CoolingrSystem fans are'dedsig'ned to start automatically. Additionally.-the'actuation signal causes the air flow (air-steam mixture) in each FCU to be split into two parts by a bypass flow control damper that fails to a pre-set position for accident operation. A minimum of 8000 cfm is directed through the FCU filtration section (moisture separators, HEPA filters, and carbon filter assembly) with the remainder of the air flow bypassing the (continued) INDIAN POINT 3 B 3.6.6 -'3 Revision 2 R'vion
I Containment Spray System and Containment Fan Cooler System B 3.6.6 BASES 1) BACKGROUND filtration section. Both the filtered and unfiltered FCU flow passes (continued) through the cooling coils. The temperature of the service water is an important factor in the heat removal capability of the fan units. The accident analysis assumes 1400 gpm of service (cooling) water with a maximum river water inlet temperature of 950 F is supplied to each FCU. Containment Cooling and Iodine Removal Function The containment cooling and Iodine removal functions are provided by a combination of the containment spray and the containment fan cooler systems. Requirements for Containment Spray Trains may be designated by the number of the containment spray pump or the associated safeguards power train. Containment Spray Train 31 is associated with Safeguards Power Train 5A which is supported by DG 33. Containment Spray Train 32 is associated with Safeguards Power Train 6A which is supported by DG 32. Requirements for the five fan cooler units are designated by grouping the 5 fan cooler units into three trains based on the safeguards power train needed to support Operability. This results in the following J designations: Fan Cooler Train 5A consists of FCU 31 and FCU 33; Fan Cooler Train 2A/3A consists of FCU 32 and FCU 34; and Fan Cooler Train 6A consists of FCU 35. The configuration with one containment spray train and two fan cooler trains is the configuration available following the loss of any safeguards power train (e.g., diesel failure). (continued) 3 INDIAN POINT 3 B 3.6.6 - 4 Revisi on 2
- Containment 'SpraySystem and Containment Fan Cooler System B 3.6.6 BASES APPLICABLE SAFETY ANALYSES The Containment Spray System and Containment Fan Cooler System limit the temperature and pressure that could be experienced following a
-DBA. The limiting DBAs considered are the loss'of coolant accident
'it-(LOCA) and the steam'line break (SLB). The LOCA and SLB are analyzed using.computer codes designed to predict the'res'ultant containment pressure and temperature transients. No DBAs are assumed to occur
- - simultaneously orconsecutively. The postulated DBAs are analyzed with regard to containment7ESF systems: assuming the loss of one
* -' 'safeguards power train, which is the worst case single active failure and results in one train of Containment Spray"and one train of Fan Coolers being rendeFed inoperable.
The analysis and evaluation show that under the worst case scenario.
-the highest peak containment pressure and temperature may result from "either a LOCA or SLB; depending on the cycle specific analysis (Refs.
4 and 6). Both results meet-the intent of the design basis. (See the
-i-Bases for LCO 3.6.4. Containment Pressure," and LCO 3.6.5 for a
'detailed discussion.) The analyses and evaluations assume a unit specific power level of 102X and initial (pre-accident) containment conditions of 130 OF and 2.5 psig and a service water inlet
-temperature of 95 OF. ;The analyses also assume a response time delayed initiation to provide conservative peak calculated containment pressure and temperature responses.
For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure. For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather' than maximize, the calculated transient containment pressures in accordance with 10 CFR 50, Appendix K (Ref. 2). (continued) INDIAN POINT 3 B 3.6.6 - 5 Revision 2
I Containment Spray System and Containment Fan Cooler System B 3.6.6 BASES APPLICABLE SAFETY ANALYSES (continued) The effect of an inadvertent containment spray activation has been analyzed. An inadvertent spray activation results in a rapid reduction of containment pressure and is associated with the sudden cooling effect in the interior of a leak tight containment. Additional documentation is provided in the Bases for LCO 3.6.4. The modeled Containment Spray System actuation from the containment analysis is based on a response time associated with exceeding the containment High-High pressure setpoint to achieving full flow through the containment spray nozzles. The Containment Spray System total response time includes diesel generator (DG) startup (for loss of offsite power), loading of equipment, containment spray pump startup. and spray line filling. Containment cooling train performance for post accident conditions is given in References 3, 4 and 6. The result of the analysis is that accident analysis assumptions regarding containment air cooling and iodine removal are met by one containment spray train and any two fan cooler trains (i.e., at least three fan cooler units). This configuration is the configuration available following the loss of any safeguards power train (e.g.. diesel failure). (continued) INDIAN POINT 3 B 3.6.6 - 6 Revision 2
-'Containment Sp'ray'System and Containment Fan Cooler System B 3.6.6 BASES APPLICABLE SAFETY ANALYSES (continued)' "
The modeled Containmient Cooling'System actuation from the containment analysis is based upon a response time associated with exceeding the containment High-Hlgh pressure setpoint to achieving full Containment Fan'Cooler System'air'.and safety grade cooling water flow. The Containment Cooling System total response time includes signal delay, DG'startup (for lbssof offsite power).'and service water pump startup times (Ref.4). The Containment Spray System and Containment Fan Cooler System satisfy Criterion 3 of 10 CFR 50.36. LCO Accident analysis assumptions regarding containment air cooling and
'iodine removal are nmet'by one containment spray train and any two fan cooler trains (il.e.,"'at least three fan cooler units).
This configuration 's'the configuration available following the loss of any safeguards power train-{e.g.. diesel failure). Each Containment Spray System includes a spray pump, spray headers. nozzles.'valvespiping, instruments, and controls to ensure an OPERABLE flow path' capable of taking suction from the RWST upon an ESF actuation signal."- ', Each'FCU consists' of aCmotor, fan, cooling coils, moisture separators. HEPA filters', carbon filters, dampers. duct distribution system, instrumentation'and'controls necessary to maintain an OPERABLE flow path for the containment atmosphere through both the filtration unit and cooling coils and an OPERABLE flow path for service water through the cooling coils. 4 I
. : o .
(continued) INDIAN POINT 3 B 3.6.6 7 Revision 2 Rvin
I Containment Spray System and Containment Fan Cooler System B 3.6.6 BASES APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature requiring the operation of the containment spray trains and'containment cooling trains. In MODES 5 and 6. the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the Containment Spray System and Containment Fan Cooler System are not required to be OPERABLE in MODES 5 and 6. ACTIONS Ad With one containment spray train inoperable, the inoperable containment spray train must be restored to OPERABLE status within 72 hours. In this Condition, the remaining OPERABLE spray and fan cooler trains are adequate to perform the iodine removal and containment cooling functions. 'The 72 hour Completion Time takes into account the redundant heat removal capability afforded by the Containment Spray System, reasonable time for repairs, and low probability of a DBA occurring during this period. K) The 10 day portion of the Completion Time for Required Action A.1 is based upon engineering Judgment. It takes into account the low probability of coincident entry into two Conditions in this Specification coupled with the low probability of an accident occurring during this time. Refer to Section 1.3, Completion Times," for a more detailed discussion of the purpose of the from discovery of failure to meet the LCO' portion of the Completion Time. B.1 and B.2 If the inoperable containment spray train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 84 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. (continued) INDIAN POINT 3 B 3.6.6 - 8 Revision 2
Containment'Spray System and 'Containment Fan Cooler System B 3.6.6 BASES ACTTINS B.1 and B.2 (continued), . The extended interval'to reach MODE 5 allows additional time for attempting restoration .of the containment spray train and is I .. reasonable when considering the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3. -, With one of the required containment fan cooler trains inoperable, the Inoperable required .containment fan cooler train must be restored to OPERABLE status -wthin 7 days. The components in this degraded condition'provide6ldine removal capabilities and are capable of providing at least 100Z of the heat removal needs. The 7 day Completion'Time was developed taking into account the redundant heat removal capabilities afforded by combinations of the Containment Spray System and Containment Fan Cooler System and the low probability of DBA occurring during'this period. The 10 day. portionof.the Completion Time for.-Required Action C.1 is based upon engineering Judgment. It takes into account the low probability of coincident entry into two Conditions in this Specification coupled with the low probability of an 'accident occurring during this time. Refer to Section 1.3 for a more detailed discussion of the purpose of.the 'from discovery of failure to meet the LCO' portion of the Completion Time. With two required containment fan cooler trains'inoperable, one of the required containment'cooling trains must be restored to OPERABLE status within 72 hours.!rThis allowable-out of-service time is acceptable because the-minimum required containment cooling and iodine removal function-is'-maintained even though this configuration is a substantial'degradation from the design capability, and may be a loss of redundancy for'this function. (cnt':ine-(continued) INDIAN PIOINT 3 B 3.6.6-9 . Revision R n 22 -
Containment Spray System and Containment Fan Cooler System B 3.6.6 BASES ACTIONS E.1 and E.2 (continued) If the Required Action and associated Completion Time of Condition C or D of this LCO are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. Ed With two containment spray trains or any combination of three or more containment spray and fan cooler trains inoperable, the unit could be in a condition outside the accident analysis. Entering this Condition represents a substantial degradation of the containment heat removal and iodine removal function. Therefore, LCO 3.0.3 must be entered immediately.
)
SURVEILLANCE REQUIREMENTS SR 3.6.6.1 Verifying the correct alignment for manual, power operated, and automatic valves in the containment spray flow path provides assurance that the proper flow paths will exist for Containment Spray System operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those valves outside containment (check valves are inside containment) and capable of potentially being mispositioned are in the correct position. Valves in containment with remote position indication may be checked using remote position indication. (continued) K INDIAN POINT 3 B 3.6.6 - 10 Revision 2
- Containment Spray-System and Containment Fan Cooler System B 3.6.6 BASES SURVEILLANCE REQUIREMENTS (continued)
SR 3.6.6.2 Operating each containment fan cooler unit for > 15 minutes ensures
- that all'fan cooler units are OPERABLE and that all associated controls are functoning properly. It also ensures that blockage, fan or motor failure, br excessive vibration can be detected for
- corrective action.-'-Thee92 day Frequency was developed considering fan coolers are operated during normal plant operation, the known reliability of the far; units and controls', the two train redundancy available', and 'the'low 'probability of significant degradation of the containment fan c6oler units occurring between surveillances. It has also been shown to be acceptable through operating experience.
SR 3.6.6.3 -- Verifying that the service water flow rate to each fan cooler unit is
' 1400'gpm provides a'ssurance that the design flow rate assumed in the safety analyses will be achieved (Ref. 3). -The 92 day Frequency was developed considerin6 the known reliability of the Cooling Water System, the redundancy available, and the low probability of a significant degradation of flow occurring between surveillances.
'" -SR -3.6.6.,4 t Verifying 'each contairment spray pump's developed head at the flow test point is greater than-or equal to the required developed head ensures that spray pirp performance has not 'degraded during the cycle.
Flow and differential pressure are normal tests of centrifugal pump performance required by Section XI of the ASME Code (Ref. 5). Since the containment spray pumps cannot be tested with flow through the spray headers, they are tested on recirculation flow. This test confirms one point on the pump design curve andlis indicative of overall performance. Such inservice tests confirm component OPERABILITY,! trend'performance', and detect incipient failures by abnormal performanace. 'The 'Frequency of the -SR is in accordance with the Inservice TestinglProgram. - (continued) INDIAN POINT 3 B 3.6.6 - 1Rv11ion - Revision 2
Cooler System Spray System and Containment Fan Containment Containment Spray System and Containment Fan Cooler System B 3.6.6 BASES SURVEILLANCE REOUIREMENTS (continued) SR 3.6.6.5 and SR 3.6.6.6 These SRs require verification that each automatic containment spray valve actuates to its correct position and that each containment spray pump starts upon receipt of an actual or simulated actuation of a containment High-High pressure signal., This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The tests are performed with the isolation valves in the spray supply lines at the containment and the spray additive tank isolation valves blocked closed. The 24 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillances were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillances when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. SR 3.6.6.7 This SR requires verification that each containment fan cooler unit starts and damper re-positions to the emergency mode upon receipt of an actual or simulated safety injection signal. The 24 month Frequency is based on engineering judgment and has been shown to be acceptable through operating experience. See SR 3.6.6.5 and SR 3.6.6.6. above, for further discussion of the basis for the 24 month Frequency. SR 3.6.6.8 This SR verifies that the required Fan Cooler Unit testing is performed in accordance with Specification 5.5.10, Ventilation Filter Testing Program (VFTP). The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and (continued) INDIAN POINT 3 B 3.6.6 - 12 Revision 2
Containment Spray System and Containment Fan Cooler System B 3.6.6 BASES SURVEILLANCE REQUIREMENTS SR 3.6.6.8 (continued) the physical properties of the activated charcoal. Specific test Frequencies and additional information are discussed in detail in the VFTP. SR 3.6.6.9 With the containment spray inlet valves closed and the spray header drained of any solution, low pressure air or smoke can be blown through test connections. This SR ensures that each spray nozzle is unobstructed and provides assurance that spray coverage of the containment during an accident is not degraded. Due to the passive design of the nozzle. 'atest at 10 year intervals is considered adequate to detect obstruction of the nozzles. REFERENCES 1. 10 CFR 50. Appendix A.
- 2. 10 CFR 50, Appendix K.
- 3. FSAR, Sections 6.3 and 6.4.
- 4. FSAR. Section 14.3 Table 14.3-56.
- 5. ASME, Boiler and Pressure Vessel Code. Section XI.
- 6. WCAP - 16212P. Indian Point Nuclear Power Generating Unit No. 3 Stretch Power Uprate NSSS and BOP Licensing Report, June 2004.
INDIAN POINT 3 B 3.6.6 - 13 Revision 2
Spray Additive System B 3.6.7 - -B 3.6 CONTAINMENT SYSTEMS - -- B 3.6.7 Spray Additive System .4':J ,' B S.. . ..
'BASES ' ' -.. '.;
I . BI The Spray Additive System is a subsystem of the Containment Spray System that assists in reducing the iodine'fission product inventory in the containment atmosphere resulting from'a'Design Basis Accident (DBA).
-Radioiodine in its'varous forms is the fission product of primary concern in the evaluation of a DBA. It is absorbed by the.'spray from the containment atmosphere. To enhance the iodine absorption capacity of the spray. the.spray solution is adjusted to-an alkaline pH that
.'.promotes iodine hydrolysis, in which iodine is converted to nonvolatile forms. Because of its stability.when exposed to radiation and elevated temperature, sodium hydroxide (NaOH) is the preferred spray additive. *.The.NaOH added to the spray also ensures an alkaline pH of'th'e solution recirculated from the containment sump. An alkaline pH minimizes the evolution of iodine as well as the occurrence of chloride and caustic stress corrosion on mechanical systems'and'components.
The Spray Additive System consists of one spray additive tank that is shared by-the two trains of containment spray. Each train provides a flow path from the spray tank to a containment spray pump and consists of an eductor for each containment spray pump, valves, instrumentation, and connecting piping. Each eductor draws the NaOH spraylsolution fromnite common tank using a portion of the borated water discharged by 1thec'ontainment spray pump as the motive flow. The eductor mixes the NaOH solution and the borated water and
- discharges the mixture-into the spray pump suction line. The eductors are designed to ensure that the pH of the spray mixture is between 9.0 and 10.0.
The Containment Spray.System actuation signal opens the valves from
'the spray additive'tank tothe spray'pump'suctions after a 2 minute
- - delay. The 35%'tol38% NaOH solution is drawn'into the spray pump suctions. The: spra"additive tank capacity..provides for the
.(contiu ' -
.' (continued)
INDIAN POINT 3 B 3.6.7- 1 .Revision I -
SprayAddiive yste Spray Additive System B 3.6.7 BASES .1. BACKGROUND addition of NaOH solution to all of the water sprayed from the RWST (continued) into containment via the Containment Spray System. The percent solution and volume of solution sprayed into containment ensures a minimum long term equilibrium containment sump pH of approximately 8.0. This ensures the continued iodine retention effectiveness of the sump water during the recirculation phase of spray operation and also minimizes the occurrence of chloride Induced stress corrosion cracking of the stainless steel recirculation piping. APPLICABLE SAFETY ANALYSES The Spray Additive System, in conjunction with the Fan Cooler System. is essential to the removal of airborne iodine within containment following a DBA. Following the assumed release of radioactive materials into containment, the containment is assumed to leak at its design value volume following the accident. The analysis assumes that 80% of containment is covered by the spray (Ref. 1). The DBA response time assumed for the Spray Additive System is the same as for the Containment Spray System (plus a 2 minute delay) and is discussed in the Bases for LCO 3.6.6. Containment Spray and Fan Cooler System." The DBA analyses assume that one train of the Containment Spray System is inoperable and that the spray additive'is added to the remaining Containment Spray System flow path. The Spray Additive System satisfies Criterion 3 of 10 CFR 50.36. LCO The Spray Additive System reduces the release of radioactive material to the environment in the event of a DBA. To be considered OPERABLE, the volume and concentration of the spray additive solution must be sufficient to provide NaOH injection into the spray flow until the Containment Spray System suction path is switched from the RWST to the recirculation sump or containment sump, and to raise the average (continued) INDIAN POINT 3 B 3.6.7 - 2 Revision 1
1, . : Spray Additive System B 3.6.7 BASES LCO spray solution pH to a level -conducive to iodine removal, namely. 'to (continued) between 7.9 and 10.0. This pH range maximizes the effectiveness of
-the iodine removal-mechanism without'introducing conditions that may induce caustic stress corrosion cracking'of mechanical system components.: In addition.,it-is essential that valves in the Spray
;Additive System flow-paths are properly positioned and that automatic valves are capable of activating to their correct positions.
APPLICABILITY In MODES 1 2, 3. ahd 4.!a DBA could cause a release of radioactive
-material to containment requiring the operation of the Spray Additive System. The Spray Additive System assists in reducing .the iodine fission product inventory prior to release to the environment.
In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Thus, the Spray Additive System is not required to be OPERABLE in MODE 5 or 6. ACTIONS -- A' ; -
- If the Spray Additive System is inoperable.' it must be restored to OPERABLE within 72 hours... The pH adjustment of the Containment Spray System flow fr corrosion protection and iodine removal enhancement is reduced in this'condition. The Containment'Spray System and Containment Fan Cooler System are available and would remove iodine from the containment atmosphere in the event'of a DBA. The 72 hour Completion Time takes into account the redundant flow path capabilities and the low probability of the worst case DBA occurring during this period.
* - - \~~ "'. ; ; ; ,. . i:.
B.I and B.2. -' .' .
'..If the Spray Additive System'cannot be restored to OPERABLE status
-within'.the'~required Completion Time, the plant must be brought to a
- ; MODE in which the LCO does'not apply. To achieve this status, the
.(co.n'.:ne (continued)
INDIAN POINT 3 B 3.6.7,r-3 I. Revision 1,
Spra Addiive Spray Additive System B 3.6.7 BASES K-.) ACTIONS B.1 and B.2 (continued) plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 84 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 5 allows 48 hours for restoration of the Spray Additive System in MODE 3 and 36 hours to reach MODE 5. This is reasonable when considering the reduced pressure and temperature conditions in MODE 3 for the release of radioactive material from the Reactor Coolant System. SURVEILLANCE REQUIREMENTS SR 3.6.7.1 Verifying the correct alignment of Spray Additive System manual, power operated, and automatic valves in the spray additive flow path provides assurance that the system is able to provide additive to the Containment Spray System in the event of a DBA. This SR does not C apply to valves that are locked. sealed, or otherwise secured in position. since'these valves were verified to be in the correct position prior to locking, sealing.; or securing. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those valves outside containment and capable of potentially being mispositioned are in the correct position. SR 3.6.7.2 To provide effective iodine removal, the containment spray must be an alkaline solution. Since the RWST contents are normally acidic, the volume of the spray additive tank must provide a sufficient volume of spray additive to adjust pH for all water injected. This SR is performed to verify the availability of sufficient NaOH solution in the Spray Additive System. The 184 day Frequency was developed based on the low probability of an undetected change in tank volume (continued) INDIAN POINT 3 B 3.6.7 -4 Revision 1
' 'Spray Additive System B 3.6.7 BASES .
SURVEILLANCE REQUIREMENTS SR 3.6.7.2 (continued)'
'ccurring~during the SR interval (the tank is isolated during normal unit operations). Tank level is'also indicated and alarmed in the control room, so that there is high confidence that a substantial change in level would be detected.
- i SR' 3.6.7.3
-This SR provides"verification of the NaOH concentration in the spray
. additive tank'and is'sufficient to ensure that the spray solution being injected into containment is at the correct pH level. The 184
*day Frequency is-.sufficient':to ensure that the concentration level of NaOH in the spray additive tank remains within'the established limits.
This is based on thei1ow'likelihood of an uncontrolled change in concentration (the tankeis normally isolated) and the probability that.
- any substantial'varianice in tank volume will'be.detected.'
SR 3.6.7.4 This SR provides verification that each automatic valve in the Spray Additive System flow path actuates to its correct position. This
-'Surveillance is'not' required for valves that are locked, sealed. or otherwise secured in the required position under administrative controls. The test is performed with the isolation valves in the spray supply lines at the containment and the spray additive tank isolation valves blocked closed.
The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month Frequency. (continued) INDIAN POINT 3 B 3.6.7- 5 Revision 1
S Spray Additive System B 3.6.7 BASES ) SURVEILLANCE REQUIREMENTS SR 3.6.7. (continued) Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. SR 3.6.7.5 To ensure that the correct pH level is established in the borated water solution provided by the Containment Spray System, flow in the Spray Additive System is verified once every 5 years. This SR provides assurance that NaOH will be introduced into the flow path upon Containment Spray System initiation. This test is satisfied by a verification of spray additive system flow without pumping any NaOH solution from the spray additive tank and without draining the spray additive tank. Water may be used in lieu of NaOH for the performance of this SR which is not intended to require the transfer of NaOH. Due to the passive nature of the spray additive flow controls, the 5 year Frequency is sufficient to identify component degradation that may affect flow. REFERENCES 1. FSAR, Chapters 6 and 14. 0'_ INDIAN POINT 3 B 3.6.7 - 6 Revision 1
Isolation Valve Seal Water System B.3.6.9
- B3.6 CONTAINMENT SYSTEMS.
B 3.6.9 Isolation Valve Seal Water (IVSW) System
.. . _ I - .
B S. '.. ... . . BASES -'.'.,, BACKGROUND - The Isolation ValveSeal Water (IVSW) System improves the effectiveness.of certain containment isolation valves (CIVs) by providing a water se6l to valve leakage paths. This is accomplished by injecting water between the seats and stem packing of globe and double-aisk type isolation valves and into the-piping between other closed containment-isolation valves.' IVSW sealing water is maintained in a seal water supply,tank filled with water and pressurized with nitrogen.The.IVSW'System is actuated in conjunction with automatic initiation.of containment isolation and is applied to CIVs in lines connected to the Reac'to'r CoolantSystem or exposed to the containment atmosphere during an accident. The seal watereis injected at a pressure of at least.47 psig which is >1.1 times the calculated peak containment pressure(Pa).; For those valves sealed by IVSW. the possibility of leakage from the Containment or Reactor Coolant System to-the atmosphere outside containment is,eliminated because leakage will be fromnthe IVSW system 'into the. Containment. The containment is designed with an allowable leakage rate not to exceed 0.1%,of the containment air weight per-day. The maximum'. allowable leakage'rateJ1s-used to evaluate offsite doses resulting from a DBA.' Confirmation that the leakage rate is within limit is demonstrated by the performance of a Type A leakage rate test in accordance'with.the-.Containment Leakage Rate Testing Program as required by':LCO 3.6.1. "Containment." .During the performance of the Type A test,.no',credit is-taken for the IVSW.System in meeting the containment leakage.rate criteria.' As such, in the event of a DBA without an OPERABLE IVSW:System, both the whole body and thyroid offsite'doses~wold'be within the guidelines specified in 10 CFR Part 50.67. , I Although IVSW is not needed to maintain plant releases such that the whole body and thyroid offsite doses would be within the guidelines specified in 10 CFR Part 100 based on Type A leakage testing, Indian (continued) INDIAN POINT 3 B 3.6.9 - I -. Revision Re' I1
I Isolation Valve Seal Water System B.3.6.9 BASES BACKGROUND Point 3 elected to consider IVSW as a seal system as described in (continued) Reference 3. This election allows leakage through CIVs sealed by IVSW to be excluded when calculating Type B and C testing results. Therefore, operation of IVSW is an implicit assumption in the calculation of post accident offsite radiation doses. To satisfy the requirements of Reference 3, for excluding leakage from CIVs sealed by IVSW from Type B and C limits, Technical Specifications must ensure the IVSW sealing function (i.e.. both sealing water supply and nitrogen gas supply) is maintained at a pressure of 1.10 Pa for at least 30 days. Sealing water design capacity is sufficient to maintain a source of seal water at the required pressure for a minimum of 24 hours without operator intervention assuming worst'case leakage and the single failure of a CIV sealed by IVSW. The requirements for a 24 hour supply of'seal water under worst case conditions is satisfied by maintaining a minimum of 144 gallons in the 176 gallon capacity seal water tank. Nitrogen gas for IVSW seal water pressurization is satisfied by having three compressed nitrogen bottles in the IVSW supply bank aligned to K the IVSW supply tank. To satisfy the requirement of Reference 3 for maintaining the IVSW sealing function'for at least 30 days, manual operator action may be required'to'replenish the IVSW seal water'supply and/or compressed gas supply. Two sources of makeup water and two alternate sources of compressed gas with sufficient capacity to maintain the IVSW sealing function for 30 days are available. The two sources of makeup water are the primary water storage tank and the city water system. The two alternate sources of-compressed gas are the normally isolated nitrogen gas bottles in the nitrogen supply bank and the ability to refill or replace the IVSW nitrogen supply bottles from the plant Nitrogen System. Manual operations required to supply makeup water and gas to the IVSW system are performed in an area that is accessible during (continued) X INDIAN POINT 3 B 3.6.9 - 2 Revision 1
Isolation Valve Seal Water System B.3.6.9 BASES BACKGROUND an accident. The IVSW tank is instrumented to provide local (continued) indication of pressure and water level. Low water level, low pressure
- and high pressure'in theMIVSW supply tank are'alarmed.
The IVSW System distribution piping consists of five headers. Three
'of the five IVSW headers'are pressurized by opening either of a pair of normally closed air"operated header injection valves. These valves open automatically on a' containment Phase "A" isolation signal to
-admit seal water'to the associated CIVs. One-of the five IVSW headers is pressurized by opening 'either of a pair of normally closed, air-motor operated,- header injection 'valves. These valves open automatically'on a containment Phase "A" isolation signal to admit seal'water to the'associated CIVs. One IVSW header is used to supply seal water to CIVs on'process lines that'are'not automatically closed on a containment Phase "A'isolation signal. This header is normally pressurized by the IVSW System with a normally closed manual or air-motor operated isolation valve for each pair of CIVs served by this IVSW header. :-
- iRedundant automatic'header'injection valves.in parallel ensures the IVSW header is pressurized if there is a failure of one injection
' valve. Each of the twio' automatic header injection valves in each pair
- 'are actuated from separate 'and independent~'signals.
A related'system, the'Isolation Valve Seal Gas System, is not credited as a seal system as described in Reference 3, and is not addressed by this Technical Specification. ,This system uses the nitrogen bank used to supply the IVSW'System to supply high pressure nitrogen that may be used to seal lines subjected to pressure in excess of the 150 psig IVSW design pressure due to operation of the recirculation pumps. This system is manually initiated during the post accident recovery hahse and in ot parto the'IVSW System. (continued) INDIAN POINT 3 B 3.6.9 -3 Re'vision'l1
Isolation Valve Seal Water System B.3.6.9 BASES APPLICABLE SAFETY ANALYSES The IVSW System LCO was derived from the requirement related to the control of leakage from the containment during major accidents. This LCO is intended to ensure the actual containment leakage rate is maintained within the maximum value assumed in the safety analyses. As part of the containment boundary, containment isolation valves function to support the leak tightness of the containment. The IVSW System assures the effectiveness of-certain containment isolation valves by providing a water seal pressurized to > 1.1 times the maximum peak containment accident pressure at the valves and thereby reducing containment leakage. As such, the IVSW System is considered a seal system as described in Reference 3. Therefore, the safety analyses of any event requiring isolation of containment is applicable to this LCO. The DBA that results in a release of radioactive material within containment is a loss of coolant accident (LOCA)(Ref. 2). The DBAs assume that, within 60 seconds after the accident, isolation of the containment is complete and leakage terminated except for the design leakage rate. La. The containment isolation total response time of 60 seconds includes signal delay, diesel generator startup (for loss of offsite power) and containment isolation valve stroke time. The IVSW System actuates on a containment isolation signal and functions within 60 seconds to help reduce containment leakage within the allowable design leakage rate value. La. The Isolation Valve Seal Water System satisfies Criterion 3 of 10 CFR 50.36. LCO OPERABILITY of the IVSW System is based on the system's capability to supply seal water to selective containment isolation valves within the time assumed in the applicable safety analyses and to ensure pressure is maintained for at least 30 days. This requires the IVSW tank be maintained with an adequate volume of water, an air or nitrogen overpressure sufficient to provide the motive force to move the water to the applicable penetration, piping to provide an OPERABLE flow (continued) kJ INDIAN POINT 3 B 3.6.9 - 4 Revision I
Isolation Valve Seal Water System B.3.6.9 BASES LCO path and two air operated header injection valves on each (continued) automatically actuated branch header. APPLICABILITY; The IVSW System is required to be OPERABLE in MODES 1, 2. 3, and 4 because'a DBA could-cause a release of 'radioactive material to containment. In MODES 5 and 6. the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the IVSW System is not required to be OPERABLE in MODE 5 or 6. ACTIONS A.1 *, With one'IVSW System'header inoperable, a portion of the CIVs serviced by IVSW may not'receive-seal water at the required pressure and volume for effective sealing. However, the CIVs are OPERABLE and will still close, .the affected CIVs provide adequate isolation to meet containment isolation requirements without IVSW during the most recent Type A test, and the number of CIVs affected by the failure of one IVSW header is small compared to the total number of'CIVs. Therefore. the 7 days is allowed to restore the IVSW System header to OPERABLE status. With"one'IVSW autdmatic'actuation valve inoperable, the IVSW function is still available because the redundant automatic actuation valve is
'OPERABLE.' Therefo're'.the'7 'days is allowed to restore the IVSW
-automatic actuation Valve to OPERABLE status.-
* - , ~i% , ,; . , i, . ; .i With the'IVSW'system'inoperable-for reasons other than Condition A.
the effectiveness of CIVs sealed by IVSW may be compromised. This Condition may result from failure to meet any of the surveillance requirements needed to verify Operability of IVSW or the inoperability of multiple IVSW headers or automatic actuation devices. However, the CIVs are OPERABLE and will still close and the affected CIVs provide adequate isolation to-meet containment isolation requirements without (continued) INDIANIPOINT 3 B 3.6.9 ; 5 'e . Revision s- 1
Isolation Valve Seal Water System B.3.6.9 BASES ACTIONS B.1 (continued) IVSW during the most recent Type A test. Additionally, except in the unusual case where inoperability is the result of failure to meet SR 3.6.9.5, the affected CIVs have demonstrated the ability to satisfy IVSW leakage requirements using IVSW seal water in lieu of meeting Type C testing requirements. Therefore, the 24 hours is allowed to restore the IVSW System to OPERABLE status. C.1 and C.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE REQUIREMENTS SR 3.6.9.1 This SR verifies the IVSW tank has the necessary pressure to provide motive force to the seal water. A 47 psig pressure is sufficient to ensure the containment penetration flowpaths that are sealed by the IVSW System are.maintained at a pressure equal to or greater than 1.1 times the calculated peak containment internal pressure (Pa) related to the design bases accident. Verification of the IVSW tank pressure on a Frequency of once per 24 hours is acceptable because operating experience has shown this Frequency to be appropriate for early detection and correction of off normal trends. (continued) ) INDIAN POINT 3 B 3.6.9 - 6 Revision I
Isolation Valve Seal Water System B.3.6.9 BASES SURVEILLANCE REQUIREMENTS (continued) SR 3.6.9.2 This SR ensures'the capability of the IVSW nitrogen source to pressurize the IVSWsystem as needed to support IVSW operation for a minimum of 30 days. Verification of the IVSW tank pressure on a Frequency of once per.24 hours is acceptable because operating experience has shownthis Frequency to be appropriate for early detection and correction of off normal trends. SR 3.6.9.3 ' :
'This SR verifies th6IVSW tank has an initial volume of water
' :necessary to provide'seal water to'the containment isolation valves served by the IVSW System for a period of at least 24 hours assuming
- the failure ofLone CIV and the maximum allowed leakage past other CIVs
--served by IVSW. 'Verification of IVSW tanklevel on a Frequency of once per-24 hours'is acceptable since tank level is monitored by installed instrumentation' and will-alarm in the Primary Auxiliary Building prior to-level decreasing to 20 gallons which provides sufficient time to-re-fill the tank before it.Js depleted.
SR 3.'6.9.4 - ; This SR verifies thelstroke time of each automatic IVSW header injection solenoid valve is within limits. The frequency is 24 months.
'Previous operating ,experience has'shown that these valves usually pass the required test when performed.
SR 3.6.9.5 This SR ensures that automatic header injection valves actuate to the correct position on a simulated or actual signal. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the (continued) INDIAN POINT 3 B 3.6.9 -', 7 e si on II I-Revi
Isolation Valve Seal Water System B.3.6.9 BASES
.)
SURVEILLANCE REOUIREMENTS SR 3.6.9.5 (continued) reactor at power. Operating experience has shown these components usually pass the Surveillance when performed at the 24 month Frequency. SR 3.6.9.6 Integrity of the IVSW seal boundary is important in providing assurance that the design leakage value required for the system to perform its sealing function is not exceeded. This testing is performed in accordance with the requirements. Frequency and acceptance criteria established in Specification 5.5.15. Containment Leakage Rate Testing Program. This program was established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50, Appendix J, Option B. as modified by IP3 specific approved exemptions. This program conforms to guidelines contained in Regulatory Guide 1.163, "Performance-Based Containment Leak Test Program, dated September 1995.. 3 REFERENCES 1. FSAR, Section 6.
- 2. FSAR, Chapter 14.
- 3. 10 CFR 50, Appendix J. Option A. Section III. B 3
INDIAN POINT 3 B 3.6.9 - 8 Revision I
WC&PPS B 3.6.10 B 3.6 CONTAINMENT SYSTEMS B.3.6.10 Weld Channel and Penetration Pressurization System BASES BACKGROUND The'Weld Channel and Penetration Pressurization System (WC&PPS) is
- ' designed to continuously pressurize the double penetration barriers used at 1locations-)vhere plant systems penetrate-the containment boundary, the space between selected isolation valves, and most of the weld seam channels"'nstalled on the inside of the liner of the Containment.' Continuous pressurization by the WC&PPS provides a continuous, 'sensitive',-and accurate means of monitoring their status with respect to leakage; "Additionally. the'WC&PPS is maintained at a
- pressure above the`containment peak accident pressure so that any postulated-leakage past the monitored barriers will be into the
; ' cnanetrathethan out of the conanet The design basis leakage rate from the'WC&PPS is 0.2% of containment free volume per which assumeslakage of 0.1% of containment free volume per day
- -'day into the containment and an identical amount leaking to the environment. Following a design basis accident, the system will' maintain pressure -greater-than the post accident containment pressure
- - ' ' ~for 24 ho'u'rs'(Ref.' 1)'
'The WC&PPS is'divided into four independent zones to simplify the process of locating leiks during operation. If one zone has a leak
-during operation, the specific penetration, weld channel, or containment'isolation valve (CIV) containing the leak can be i-dentified by Isolatin'g the'individual air supply line to each component in the zone. Additionally, apped tube connection
- - installed in each'i ne'allows injecting leak-test gas (Ref. 1).
The instrument air'system provides a regulated supply of clean and dry
;compressed'air for'the WC&PPS. Two instrument air compressors are
- - used,although onl-ne is-required to maintain pressurization at the
-- 'maximum'allowable'-leakage';rate of the WC&PPS. A backup source of air
*~~ .. .s .*
(continued) INDIAN POINT 3 B 3.6.10 1 - Revision 1
I WC&PPS B 3.6.10 BASES K) BACKGROUND for the WC&PPS is the station air system which includes at least (continued) one station air compressor. Each WC&PPS zone is served by its own air receiver which will continue to supply air to the zone if the instrument air system and station air system are lost. Each of the air receivers is sized to supply air to its zone for a period of at least one hour based on a total leakage rate of 0.2% of the containment free volume per day. If the receivers are exhausted before normal and backup air supplies are restored, additional backup is provided by a bank of nitrogen cylinders. The nitrogen backup system will automatically deliver nitrogen at a pressure slightly lower than.the normal regulated air supply. Thus, in the event of failure of the normal and backup air supply systems during periods when the system is in operation. WC&PPS pressure requirements will be automatically maintained by the nitrogen supply. This assures reliable pressurization under both normal and accident conditions. The combination of the air receivers and nitrogen supply is sufficient to ensure WC&PPS pressure is above the peak containment pressure at the start of a LOCA and to maintain WC&PPS above the post-LOCA containment pressure profile for the 24 hour period following a LOCA at the design leakage rate of 0.2% of the containment free volume per day. Pressure control valves, isolation valves and check valves are K) generally located outside of the containment for ease of inspection and maintenance. The line to each of the four pressurized zones is equipped with a critical pressure drop orifice to assure that air consumption will be within the capacity of the system and that high air consumption in one zone does not affect the operation of the other zones. Additionally, restricting orifices are installed on pressurization lines, where required, to assure that air consumption, even on failure of an individual line, will not result in loss of pressure to the other components connected to the same pressurization header. All pressurized components have provisions for either local pressure indication, mounted outside the Containment, or remote low pressure alarms in the Control Room. The actuating pressure for each pressure alarm is set above incident pressure and below the nitrogen supply regulator setting. (continued) INDIAN POINT 3 B 3.6.10 - 2 Revision 1
WC&PPS B 3.6.10 BASES . - BACKGROUND WC&PPS air consumption is continuously monitored by a flow (continued) sensing device located in each of the headers supplying makeup air to
- the four WC&PPS zones. -Output from these sensors is applied to a
- - summing amplifie'r'which drives a total flow recorder. The flow easurement range'is'O-15 scfm with an accuracy of + IS of full scale.
High 'flow alarms ihthe Control Room are derived from the recording
' channel. With th& WC&PPS at 43 psig and the containment at approximately atmospheric pressure, an indicated WC&PPS flow rate of 14.2 scfm is equivalent to the WC&PPS design leakage limit. A WC&PPS
- flowj rate of 14.2'icfm.--;if sustained for 24 hours, is equivalent to
- ' 0.2% of the containment'tfree volume'at a pressure of 43 psig.
APPLICABLE SAFETY ANALYSES For Indian Point 3,3.offsite dose calculations'demonstrate compliance with 10 CFR 50.67'guideiires'and the results are well within those guidelines. 'Inthese calculations, it-is assumed that the Containment
-leaks at a rate.of-O.1% per day of Containment free volume for the first '24 hours and 0.05% per day of Containment free volume thereafter. No creditis -taken for the WC&PPS when determining the amount of radioactivity released for offsite dose evaluations because
; the integrated leakage rate'tests required'by Specification 5.15, Containment'Leakage Rate Testing Program, are performed with the double penetration an6d weld channel zones open to the containment atmosphere. However, WC&PPS does provide an-'additional means for ensuring that contaijfent leakage is minimized-(Ref. 3).
A'design function of'WC&PPS is to provide a continuous, sensitive. and accurate eansof monitoring leakage of selected containment isolation
'valvesU(CIVs).- the'air lock door seals, and containment welds that are pressurized by'this'system. WC&PPS leakage. even if below the WC&PPS design leakage rate,1/4rmay indicate that one of these supported components is exceeding its leakage rate'acceptance criteria. In this situation, the supported component may be inoperable and the APPLICABLE SAFETY`'ANALYSES for the supported component is applicable.
- 4. i d1.l.
s (continued) INDIAN POINT 3 B 3.6.10 - 3' I hevision, ei rI
WC&PPS B 3.6.10 BASES 3 APPLICABLE SAFETY ANALYSES (continued) Specification 5.15, Containment Leakage Rate Testing Program, allows an exemption to Regulatory Guide 1.163, "Performance-Based Containment Leak Test Program, and ANS 56.8-1994, Section 3.3.1, in that WC&PPS supply isolation valves are not required to be Type C tested. Note that the WC&PPS supply isolation valves are normally open valves. As specified in Reference 2. operating with these valves normally open and the exemption from type C testing is acceptable because: (1)the WC&PPS is monitored for changes to the system leakage rate; (2)the WC&PPS leakage rate is quantified every 36 months; and. (3)WC&PPS pressure is maintained higher than the containment peak accident pressure (Ref. 2). Therefore, if the required pressure is not maintained or excessive WC&PPS leakage is identified, then compensatory actions are required to ensure the containment boundary is maintained. For containment isolation valves (C]Vs) supported by WC&PPS. WC&PPS pressurization is applied to the space between those CIVs that are normally closed. CIVs supported by WC&PPS are Type C tested in accordance with Specification 5.5.15 because WC&PPS is not credited as a seal system. For loss of WCUPPS pressurization. isolation of the WC&PPS supply to the affected CIVs provides appropriate compensatory action because the supported CIVs are a tested boundary and isolating the depressurized WC&PPS supply eliminates WC&PPS as a potential leakage path. For high WC&PPS air consumption, a consideration is that the leakage may indicate that a supported CIV is exceeding its leakage rate acceptance criteria. If the leakage path is isolated from the supported CIVs when the WC&PPS supply to the CIV is isolated, isolation of the WC&PPS supply to the CIV restores the required safety function. If the leakage path is not isolated from the supported CIV when the WC&PPS supply to the CIV is isolated (i.e., the CIV is depressurized). the supported CIV may be inoperable and the requirements of LCO 3.6.3, "Containment Isolation Valves." are applicable. For the containment air lock door seals supported by WC&PPS, WC&PPS pressurization is normally applied to the space between the double gaskets on each of the airlock seals. (continued) 3 INDIAN POINT 3 B 3.6.10 - 4 Revision I
WC&PPS j .. . B 3.6.10 BASES APPLICABLE SAFETY ANALYSES (continued) Air lock operability does not require pressurization of the air lock door seals'except as needed to verify the seals have reseated after each air lock dooris'operated (see LCO 3.6.2. 'Containment Air Locks"). For loss of WC&PPS pressurization. isolation of the WC&PPS supply to the affected air lock door seals provides appropriate
' compensatory action because pressurization is not required for air lock 'operability (except as needed to verify the seals have reseated after each air lockdoor is.operated) and isolating the depressurized WC&PPS supply eliminates WC&PPS as a potential leakage path. For hioih WC&PPS air consumption. a consideration is that the leakage may indicate that a supported.air.lock seal is exceeding its leakage rate acceptance criteria. If the leakage path is isolated from the supported air lock when the WC&PPS supply to the air lock is isolated.
'isolation of the WC&PPS supply to the air lock restores the required safety function. 'Ifthe6leakage path is not isolated from the supported air lock'seal-when the WC&PPS-supply'to the air lock seal is isolated, the supported air lock may be inoperable and the requirements of LCO 3.6.2. "Containment Air-Locks," are applicable.
For weld channels and piing penetrations supported by WC&PPS. WC&PPS pressurizes what'is equivalent to a closed system inside containment. Becauseit 'isreasonable 'to assume that WC&PPS leakage is not the result of a containmefit'weld or piping penetration defect. WC&PPS leakage and/or lack of pressurization is a concern only 'because it presents a potential leakage path from containment to the atmosphere
'via'the depressuriiedWC&PPS. Therefore. isolation of the WC&PPS
'supply to the affected'section of weld channel or piping penetration
-provides appropriate compensatory action for both loss of pressurization and air consumption caused by flow from the WC&PPS into containment.Thisiassumes that containment leakage rate testing required by Specification 5.15 provides a high degree of assurance
*that WC&PPS airconsumption is not indicative of deterioration of the containment boundary.'; l WC&PPS'satisfies 1Criterion 3-of 10 CFR 50.36 where it is used to pressurize the spicei.between selected CIVs and pressurize air (continued)
INDIA.N.POINT 3 B 3.6.10-5Riso ' . Rdvision I
WC&PPS B 3.6.10 BASES ) APPLICABLE SAFETY ANALYSES (continued) lock door seals. The WC&PPS system, if not maintained at the required pressure, represents a potential leakage path to the environment if there is a single failure of a supported CIV or air lock seal. WC&PPS satisfies Criterion 4 of 10 CFR 50.36 it provides an additional means for ensuring that containment leakage is minimized although no credit is taken for the WC&PPS in calculating offsite dose for meeting 10 CFR 100 and GDC 19. LCO This LCO requires that the WC&PPS be OPERABLE. OPERABILITY requires the following: all, required portions of each WC&PPS zone are pressurized to a value that exceeds peak containment pressure during a design basis accident; and, total leakage (i.e., air consumption) from the required portions of the WC&PPS are within specified limits. Limits for air consumption are based on the integrated containment leak rate test acceptance criterion and the ability of the reserve air supplies in the air receivers and nitrogen cylinders to maintain WC&PPS pressure above calculated containment pressure for a minimum of 24 hours following an event. For a portion of the WC&PPS to be considered not required, it must meet all of the following criteria: 1) it must be inoperable (i.e., can not maintain a pressure above required limits and/or cause system air consumption to exceed required limits): 2) it must be isolated or disconnected from the system; and. 3) it must have been determined by written evaluation as not practicably accessible for repair. Inoperable sections of WC&PPS piping which can be considered as not practicably accessible for repair will satisfy one of the following criteria: 1) the piping is covered by concrete and repairs of the piping would involve the removal of some portion of the containment structure; or. 2) the piping is located behind plant equipment in the containment building and repairs of the piping would involve the relocation of the equipment. (continued) J INDIAN POINT 3 B 3.6.10 - 6 Revision I
WC&PPS B 3.6.10 BASES LCO The integrity of the welds associated with any disconnected or (continued) "isolated portionsof th6 WC&PPS is considered verified by integrated leak rate testing :erformed 'inaccordance with Specification 5.15. The provision that ailows for the disconnection of portions of the WC&PPS piping does'fift'apply to'any other WC&PPS piping. APPLICABILITY -In MODES 1. 2. 3.and 4..a.DBA could cause a release of radioactive material to'containment. WC&PPS is required to support OPERABILITY of
*the containment, containment air locks, and selected containment isolation valves. .hIn MODES 5 and 6, OPERABILITY of the containment, containment air locks._*and containment isolation valves is not required. Therefore.,ithe WC&PPS is not required to be OPERABLE in MODES 5 and 6. . -.
ACTIONS The ACTIONS are modified by two Notes. Note 1 is added to clarify that Separate.Condition entry is allowed for each component supplied by WC&PPS. This is acceptable because the Required Actions for each Condition provide appropriate compensatory.actions for each component supported by WC&PPS.7,-Complying with the Required Actions may allow for continued operation. 'and subsequent-inoperable WC&PPS components are governed by subsequent Condition entry and application of associated RequiredActions. Note 2 is added to.,direct entry into the applicable Conditions and Required Actions-of LCO 3.6.1. "Containment," if it is determined that
.WC&PPS inoperabilityis indicative of exceeding the overall containment leakage rate.- .Note that entry into-the Conditions and Required Actionsof.LCO 3.6.1 may be required even if WC&PPS air consumptionjlimits.,are not;exceeded. .-
A.1 and A.2 In the event one or more components supplied by WC&PPS is not within the pressure limit of SR 3.6.10.1, Required Action A.1 requires that the WC&PPS supply to the affected weld channels, penetrations, or containment isolation valves must be isolated within 4 hours. Required Action A.1 is needed because isolation of the WC&PPS (continued) INDIAN-POINT 3 NOB 3.6.10 -'7 -'Rs- . Revision I
WC&PPS B 3.6.10 BASES ACTIONS A.1 and A.2 (continued) supply to the affected component results in using an isolation valve as a substitute for pressurization. This prevents the WC&PPS from becoming a potential leakage path from the containment to the atmosphere. This action satisfies the required safety function because the leakage rate testing performed in accordance with Specification 5.15 has already verified that the containment leakage rate is within required limits without crediting the WC&PPS. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange (including Swagelok fittings), and a check valve with flow through the valve secured (Ref. 3). For a WC&PPS supply isolated in accordance with Required Action A.1, the device used to isolate the weld channel. penetration or containment isolation valves should be the closest available to component. Required Action A.1 must be completed within 4 hours. The 4 hour Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1. 2. 3, and 4. If a WC&PPS supply cannot be restored to OPERABLE status within the 4 hour Completion Time and is isolated in accordance with Required Action A.1. the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and not pressurized by WC&PPS will be in the isolation position should an event occur. Required Action A.2 does not require any testing or device manipulation. This action involves verification, through a system walkdown, that isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of once per 31 days for isolation devices outside containment" and exempting valves that are locked, sealed or otherwise secured in the required position is appropriate considering the fact that the devices are operated under administrative controls and the (continued) INDIAN POINT 3 B 3.6.10 - 8 Revision I
WC&PPS B 3.6.10 BASES ACTIONS A.1 and A.2. (continued),-
-' probability of.their misalignment is low. For the isolation devices inside containment',--the'time period specified as 'prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days' is based on'engineering judgment and is considered reasonable in view of the inaccessibility of the 'isolation devices and other administrative controls,thatw'lllns'ure that isolation device misalignment is an unlikely p6ssibility Required Action A.2 is modified by a Note that applies to isolation devices located in high'radiation areas and allows these devices to be verified closed by'use'of administrative means. Allowing verification by administrative means is'considered acceptable. since access to these areas is typically restricted. Therefore, the probability of misalignment of these'devices, once they have been verified to be in the proper position, is small.,
B.]. B.2 and B.3 Condition B applies if WC&PPS has air consumption that places the WC&PPS outside'the limits of SR 3.6.10.2. 'Inthis condition, Required Action B.3'requireslthat portions of the WC&PPS are isolated, as necessary. to restore WC&PPS leakage to within the limits of SR 3.6.10.2. However, safety function is not restored until any portions of the'WC&PPS thaftare depressurized by this Action are isolated. Therefore, Required'Action B.3. is modified by'a Note that requires entry into Condition'A fbr components not within the pressure limit of SR 3.6.10.1 as a result of isolating the leakage path. The Completion Time of 7 days to'isolate the leakage path is acceptable because all un-isolated portions of the WC&PPS are pressurized, otherwise. Condition A is applicable inmediately. Safety function is restored when leaking portions of the WC&PPS are isolated and at least one isolation device separates the containment barrier from the WC&PPS leakage path. If leakage exceeds 0.2%,'then replenishment would be required before 24 hours, during an accident. (continued) INDIAN POINT 3 B 3.6.10'- 9 ' Revision 1
WC&PPS B 3.6.10 BASES 3 ACTIONS B.1. B.2 and B.3 (continued) As discussed in the Applicable Safety Analyses above, safety function is not restored by Required Action B.3 if the air consumption leakage path is depressurized but not isolated from the supported containment isolation valves or containment air lock seal. In this situation, the WC&PPS air consumption leakage path could create a leakage path from containment to the atmosphere. Therefore, Required Action B.1 requires entry into the applicable Conditions and Required Actions of LCO 3.6.3, "Containment Isolation Valves' within 1 hour of discovery that the WC&PPS air consumption leakage path is depressurized and not isolated from the supported containment isolation valves. Likewise, Required Action B.2 requires entry into the applicable Conditions and Required Actions of LCO 3.6.2. "Containment Air Locks" within 1 hour of discovery that the WC&PPS air consumption leakage path is depressurized and not isolated from the supported air locks. The Required Actions of LCO 3.6.2 and LCO 3.6.3 will restore safety function for WC&PPS air consumption leakage path that is depressurized. C.1 and C.2 K ) If the Required Actions and associated Completion Times are not met. the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the' plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE REOUIREMENTS SR 3.6,10.1 This SR requires periodic verification during plant operation that the required portions of each WC& PPS zone are maintained at a pressure greater than the containment peak accident pressure. (continued) ) INDIAN POINT 3 B 3.6.10 - 10 Revision I
WC&PPS B 3.6.10 BASES SURVEILLANCE REOUIREMENTS - SR 36.10.1 (continued)' . This SR is satisfied by-verification of zone pressure on each of the four WC&PPS zones is above the specified limit. The 31 day Frequency is acceptable because there are'low pressure alarms in the Control Room to ensure that operators are aware that all WC&PPS zones are pressurized. SR 3.6.10.2 This SR requires periodic verification during plant operation that the WC&PPS air consumption is < 0.2% of the containment free volume per day. This SR is performed by taking the sum of the reading on the flow sensing devices located in each of the zone headers. A WC&PPS flow rate of 14.2 scfm. if sustained for 24 hours, is equivalent to 0.2% of the containment free volume at a pressure of 43 psig. The 31 day Frequency recognizes that WC&PPS air consumption indication and high flow alarms are provided in the control room. SR 3.6.10.3 This SR, sometimes called the sensitive leak rate test, ensures that the leakage rate for the WC&PPS is < 0.2% of the containment free volume per day when pressurized to > 43 psig above containment pressure. The sensitive leak rate test includes only the volume of the weld channels, double penetrations, and containment isolation valves supported by WC&PPS. This test is considered more sensitive than the integrated leakage rate test, as the instrumentation used permits a direct measurement of leakage from the pressurized zones. The 36 month Frequency is acceptable because experience has shown that the WC&PPS usually passes this Surveillance when performed at the 36 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. The Frequency is modified by a Note indicating that SR 3.0.2 is not applicable. (continued) INDIAN POINT 3 NPB3.6.10 - 11 Revision I I Rev'ision
I WC&PPS B 3.6.10 BASES REFERENCES 1. FSAR, Section 6.6.
- 2. Safety Evaluation Report for IP3 Amendment 174.
- 3. FSAR, Section 14.3.
- 4. Standard Review Plan Section 6.2.4.
INDIAN POINT 3 B 3.6.10 - 12 Revision I
MSSVs B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 'Main Steam Safety Valves (MSSVs) BASES BACKGROUND The primary purpose of the MSSVs is to provide overpressure protection
.. 1. I fo'r the secondary-system.' The MSSVs also provide protection against overprtessurizing'-the reactor coolant pressure'boundary (RCPB) by providing-a heat'sinkfor the removal-of energy from the Reactor Coolant System'(RCS)'if the preferred heat sink, provided by the Condenser and"Circulating Water System.1is not available.
Five MSSVs are located on each main steam header, outside containment. upstream of the main steam isolation valves and non-return valves. as described in the FSAR, Section 10.2 (Ref. 1). The five code safety valves per steam'g.e'erator consist of four'6 inch by 10 inch and one 6
-inch by 8 in; These'evales are set to open at 1065, 1080. 1095. 1110 and 1120 psig.,cre'siectlvely. The steam generator safety valve
' capacity is'rated to remove the maximum calculated steam flow (normally 105% of the maximum guaranteed steam flow) from the steam generators with6ut'exceeding IIOZ of the'steam system design pressure.
Table 3.7.'1-2 in'the'accompanying LCO, so that only the needed valves will 'actuate.; Staggered'setpoints reduce the potential for valve chattering that'lis due'to steam pressure'insufficient to fully open
-all valves'followin'g a turbine or reactor'trip.'
APPLICABLE SAFETY ANALYSES . *. . The design basis`'for the MSSVs comes from Reference 2 and its purpose is to limit the secondary system pressure to 110% of design pressure when passing 100% of design steam flow. This design basis is sufficient to cope with any anticipated operational occurrence (AOO) or accident considered in'the Design Basis Accident (DBA) and transient-analysis..
-- (continued)
INDIAN POINT 3 B'3.7.1 Revision' 2
MSSVs B 3.7.1 BASES ) APPLICABLE SAFETY ANALYSES (continued) The events that challenge the relieving capacity of the MSSVs. and thus RCS pressure, are those characterized as decreased heat removal events, which are presented in the FSAR. Section 14 (Ref. 3). Of these, the full power loss of external electrical load without steam dump is the limiting AOO. The transient response for loss of external electrical load without a direct reactor trip presents no hazard to the integrity of the RCS or the Main Steam System. If a minimum reactivity feedback is assumed. the reactor is tripped on high pressurizer pressure. In this case, the pressurizer safety valves open, and RCS pressure remains below 110% of the design value. The MSSVs also open to limit the secondary steam pressure. If maximum reactivity feedback is assumed, the reactor is tripped on overtemperature CDT. The departure from nucleate boiling ratio increases throughout the transient, and never drops below its initial value. Pressurizer relief valves and MSSVs are activated and prevent overpressurization in the primary and secondary systems. Startup and power operation with less than all five MSSVs OPERABLE for each steam generator is permissible, if THERMAL POWER is proportionally limited to the relief capacity of the remaining MSSVs. This is accomplished by reducing the neutron flux trip setpoint and reducing THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam generator. These limits on the neutron flux trip setpoint, specified in Table 3.7.1-1, are established based on guidance provided in Nuclear Safety Advisory Letter (NSAL) 94-001. Operation at Reduced Power Levels with Inoperable Main Steam Safety Valves (Ref. 6) and Information Notice 94-60, Potential Overpressurization of Main Steam System (Ref. 7). The reactor trip setpoint reductions are calculated as follows: Hit - (100 / 0) [(wshfgN) / K] Where: Hit - Safety Analysis high neutron flux setpoint (X RTP); (continued) a INDIAN POINT 3 B 3.7.1-2 Revision 2
MSSVs B 3.7.1 BASES . .. . . . A. I APPLICABLE SAFETY ANALYSES (continued) ' - '
. .. I . .0 '- Nominal NSSS power rating of the plant (including reactor coolant pump heat) in Mwt (i.e., 3230 M0t): I K,, - Conversion factor, 947.82 (Btu/sec)/Mwt:
s -i Minimum total steam flow rate capability of the operable MSS~s on any one'steam generator at the highest MSSV opening pressure, including tolerance and accumulation, as appropriate, in lb/sec. (ws - 150 + 228.61 * (4 - V) lb/sec.' where V'- Number of inoperable safety valves 'in the steam line of the most limiting steam generator). hfe 'Heat of vaporization for steam at the highest MSSV opening pressure including tolerance and accumulation. as
appropriate,'
Btu_/lbm (i.e.',608.5 Btu/lbm).
N' Numbe 6f 'loops in plant (i.e.. 4). The calculated reactor trip setpoint is further reduced by 9Z of full scale to account for instrument uncertainty and then rounded down. The MSSVs satisfy Criterion 3 of 10 CFR 50.36.' LCO The accident analysis requires five MSSVs per steam generator to provide overpressure protection for design basis transients occurring at 102% RTP.- An MSSV will be considered inoperable if it fails to open on demand. 'The6LCO requires that five MSSVs be OPERABLE in I compliance with'Reference 2. This is because'operation with less than
'the'full number of MSSVs requires limitations on allowable THERMAL POWER '(to meet ASME'Code' requirements).' These limitations are according~to Table 3.7.1-1 in the'accorpakying LCO. and Required Action"A.1.
'The OPERABILITY'of the'MSSVs is defined as the ability to open within the setpoint tolerances, relieve steam generator'overpressure, and reseat when pressure has been reduced.
(continued) INDIAN POINT 3 B 3.7.1-3 I .. I ' Revision 2 1
MSSVs B 3.7.1 BASES LCO The OPERABILITY of the MSSVs is determined by periodic surveillance K) (continued) testing in accordance with the Inservice Testing Program. The lift settings, according to Table 3.7.1-2 in the accompanying LCO. correspond to ambient conditions of the valve at nominal operating temperature and pressure. This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that could result in a challenge to the RCPB. APPLICABILITY In MODE 1 above 20% RTP. the number of MSSVs per steam generator required to be OPERABLE must be according to Table 3.7.1-1 in the accompanying LCO. Below 20% RTP in MODES 1. 2. and 3, only two MSSVs per steam generator are required to be OPERABLE. In MODES 4 and 5, there are no credible transients requiring the MSSVs. The steam generators are not normally used for heat removal in MODES 5 and 6. and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES. ACTIONS The ACTIONS table is modified by'a Note indicating that separate Condition entry is allowed for each MSSV. 3j A.1 Startup and power operation with up to three of the five MSSVs associated with each steam generator inoperable is permissible if the maximum allowed power level is below the heat removing capability of the operable MSSVs. Therefore, startup and power operation with inoperable main steam line safety valves is allowable if the neutron flux trip setpoints are restricted within the limits specified in Table 3.7.1-1. This ensures that reactor power level is limited so that the heat input from the primary side will not exceed the heat removing capability of the OPERABLE MSSVs of the most limiting steam generator. (continued) INDIAN POINT 3 B 3.7.1-4 Revision 2
MSSVs lB
. 3.7.1 BASES ACTIONS B.1 and B.2 (continued)
If the MSSVs cannot be restored to OPERABLE status within the associated Completion Time, or if one or more steam generators have less than two MSSVsIOPERABLE. the unit must be placed in a MODE in which the LCO does not apply. To achieve this'status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. The-allowed.Completion Times are reasonable, based on operating experience;.to reach the required unit conditions from full power conditions.in an.orderly.manner and without challenging unit systems. SURVEILLANCE REOUIREMENTS SR 3.7.1.1' This SR verifies the OPERABILITY of the MSSVs by the verification of
-each MSSV lift setpoint in accordance with the Inservice Testing Program. The ASME Code. Section XI (Ref. 4), requires that safety and relief valve tests be performed in accordance with ANSI/ASME OM-1-1987 (Ref. 5). According to Reference 5. the following tests are required:
- a. Visual examination; ...,
- b. Seat tightness determination:
- c. Setpoint pressure determination (lift setting); and
- d. Compliance with owner's seat tightness criteria.
The ANSI/ASME Standard requires that all valves be tested every 5 years, and a minimum of 20X of the valves be tested every 24 months. The ASME Code specifies the activities and frequencies necessary to satisfy the requirements. Table 3.7.1-2 allows a + 3X setpoint tolerance for OPERABILITY: however, the valves are reset to + 1X during the Surveillance to allow for drift. (continued) INDIAN POINT 3 B 3.7.1-5. - - Revision 2. -
MSSVs B 3.7.1 BASES SURVEILLANCE REQUIREMENTS SR 3.7.1.1 (continued) This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure. REFERENCES 1. FSAR, Section 10.2.
- 2. ASME, Boiler and Pressure Vessel Code. Section III. 1971 Edition.
- 3. FSAR. Section 14.
- 4. ASME, Boiler and Pressure Vessel Code, Section XI.
- 5. ANSI/ASME OM-1-1987.
- 6. Nuclear Safety Advisory Letter (NSAL) 94-001, Operation at Reduced Power Levels with Inoperable Main Steam Safety Valves.
- 7. Information Notice 94-60. Potential Overpressurization of Main Steam System.
INDIAN POINT 3 B 3.7.1-6 Revision 2
MSIVs and MSCVs B 3.7.2 B 3.7 PLANT SYSTEMS Or: . B 3.7.2 Main Steam Isolation Valves (MSIVs) and Main Steam Check Valves (MSCVs) I.
-. -,-__..CE, . .:.1 '.[, . .
BASES BACKGROUND The Main Steam System conducts steam from each of the four steam generators within the containment building to the turbine stop and control valves.' Thfour steam lines are interconnected near the
'turbine: Each steam-line is equipped with'an isolation valve identified as the Main Steam'Isolation Valve (MSIV) and a non-return valve identified as the Main Steam Check Valve (MSCV).
The MSIVs isolate 'steam flow'from the secondary side of the steam generators following a high energy line break (HELB). MSIV closure terminates flow frbm'the unaffected (intact) steam generators. The MSIVs are swing disc-type check valves that are aligned to prevent flow'out of thelsteam'generator. During'normal operation, the free swinging discs in the MSIVs are held out of the main steam flow path by an air piston and the MSIVs close to prevent the release of steam from the SG when air is removed from the' piston. The isolation valves are designed to and'required to close in less than five seconds. The MSIV operators aresupplied by instrument air and each MSIV is equipped with an air receiver to prevent spurious MSIV closure due to pressure transients in the instrument air system. Each MSIV is equipped with a bypass valve used to warm up the steam line during unit startup which equalizes pressure across the valve allowing it to be.opened. 'The bypass valves are manually operated and
,areclosed during normal plant operation.
--An MSIV closure signal is generated by the following signals:
High steam flow.in any two out of the four steam lines coincident withlow steam line pressure; or.
-High steam flow in anyitwo out'of'the four steam lines coincident with low Tavg: or.
(continued) INDIAN POINT 3 B 3.7.2 --'1 ; - Revision -I
MSIVs and MSCVs B 3.7.2 BASES BACKGROUND Two sets of the two-of-three high-high containment pressure (continued) signals; or, Manual actuation using a separate switch in the control room for each MSIV. Note that a turbine trip is initiated whenever an MSIV is not fully open. The MSCVs are swing disc type check valves that are aligned to prevent reverse flow of steam into an SG if an individual SG pressure falls below steamline pressure. One MSIV and one MSCV are located in each main steam line outside but close to containment. The MSIVs are downstream from the main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pump turbine steam supply to prevent MSSV and AFW isolation from the steam generators by MSIV closure. Closing the MSIVs isolates each steam generator from the others, and isolates the turbine, Steam Bypass System (High Pressure Steam Dump), and other auxiliary steam supplies from the steam generators. A description of the MSIVs and MSCVs is found in the FSAR, Section 10.2 (Ref. 1). APPLICABLE SAFETY ANALYSES The design basis of the MSIVs is established by the containment analysis for the large steam line break (SLB) inside containment (Ref. 2) and the accident analysis of the SLB events presented in the FSAR. Sections 6.2 and 14.2 (References 2 and
- 3. respectively). The combination of MSIVs and MSCVs precludes.the blowdown of more than one steam generator, assuming a single active component failure (e.g.. the failure of one MSIV to close on demand).
For a break upstream of an MSIV, either the MSIVs in the other three steam lines or the MSCV in the steam line with the faulted SG must close to prevent the blowdown of more than one SG. For a break downstream of an MSIV, the MSCVs are not required to function. (continued) INDIAN POINT 3 B 3.7.2 - 2 Revision 1
MSIVs and MSCVs B 3.7.2 BASES. APPLICABLE SAFETY ANALYSES (continued) The limiting case for'the containment analysis is the SLB inside
'containment,"without a loss of offsite power and failure to close of the MSCV on the affected steam generator or the failure to close of the MSIV associated with any other SG. With either of these failures.
only one SG blows down. The limiting SLBs occur at low power or hot shutdown because the magnitude and duration of the RCS cooldown will be greater if the SLB is initiated from these conditions. This occurs because, at low power conditions. thereis'!less stored energy in the fuel and the initial steam generator water inventory'is greatest at no load. Additionally. the magnitude and duration' of the RCS cooldown will be greater if RCPs continue to operate during the SLB. Therefore, an SLB without loss of offsite power is more'limiting.
' If it is assumed thifthe most reactive rod cluster control assembly is stuck in the fully withdrawn position, there is an increased possibility thatfthe- sore will become critical and return to power.
In the most limiting condition, the core is ultimately shut down by
' the boric acid injection delivered by the Emergency Core Cooling System. -
The accident analysis compares several different SLB events against different acceptan cecriteria. The large SLB outside containment upstream of the'MSIV'isrlimiting for offsite dose, although a break in this short section of main steam header has a very low probability. The large SLB inside'containment at hot zero power with offsite power available is the limiting case for a post trip return to power. The analysis includes scenarios with offsite power available, and with a loss of offsite power following turbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolant
.through the steam generators, maximizing the Reactor Coolant System cooldown. With a loss of offsite power, the response of mitigating systems is delayed. -
(continued) INDIAN POINT 3 B 3.7.2 -' 3 - - Revision 1
MSIVs and MSCVs B 3.7.2 BASES APPLICABLE SAFETY ANALYSES (continued) Significant single failures considered include: 1) failure of an MSIV or MSCV to close; 2) failure of a feedwater control or isolation valve to close: 3) failure of a diesel generator: and. 4) failure of auxiliary feedwater pump runout protection. The MSIVs serve only a safety function and remain open during power operation. These valves operate under the following situations:
- a. A HELB inside containment. In order to maximize the mass and energy release into containment, the analysis assumes that the MSCV in the affected steam generator remains open. For this accident scenario, steam is discharged into containment from all steam generators until the remaining MSIVs close. After MSIV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSIVs in the unaffected loops. Closure of the MSIVs isolates the break from the unaffected steam generators.
- b. A break outside of containment and upstream from the MSIVs.
This case is not a containment pressurization concern. The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown 0 and positive reactivity addition. Closure of the MSIVs isolates the break and limits the blowdown to a single steam generator.
- c. A break downstream of the MSIVs. This case will be isolated by the closure of the MSIVs.
- d. Following a steam generator tube rupture. In this case, closure of the MSIVs isolates the ruptured steam generator from the intact steam generators to minimize radiological releases.
(continued) INDIAN POINT 3 B 3.7.2 - 4 Revision 1
MSIVs and MSCVs B 3.7.2 (continued) APPLICABLE SAFETY ANALYSES (continued)
- e. The MSIVs'a're also utilized during other events such as a feedwater line break.' This event is less limiting so far as MSIV OPERABILITY is 'concerned.
The'MSIVs satisfy'Criterion 3 of 1O0CFR 50.36.' LCO This LCO requires that fourMSIVs and four MSCVs in the steam lines be OPERABLE. The MSIVi 'are considered OPERABLE when the isolation times are within limits, and they close on an isolation actuation signal. The MSCVs',are considered OPERABLE when inspections and testing required by the Inserv'ice Test Program are completed at the specified FREOUENCY, in accordance with' SR 3.7.2.2. This-LCO provides acsurance'that the MSIVs and MSCVs will perform their design safetyjfunction to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 50.67 I (Ref. 4) limits orlthe NRC staff approved licensing basis. APPLICABILITY "The MSIVs and MSCVs must be OPERABLE in MODE 1.and in MODES 2 and 3 except when MSIVs areclosed. These are the conditions when there is significant~mass'andienergy in the RCS and steam generators. When the MSIVs MSs are-closed, ar they
, ley are already performing the safety function.
InMODE 4, the steam generator. energy is low and the potential for and consequences of an SLBare significantly reduced. In MODE:5 or, 6, the:steam-generators do not contain much energy because their temperature is below the boiling point of water; therefore,-,theMSIVs are not required for isolation of potential high
--energy secondary system pipe breaks in these MODES.
. -(continued)
INDIAN POINT 3 B 3.7.2 -` 5' . Revisionn 4 -
I MSIVs and MSCVs B 3.7.2 BASES ACTIONS A.1 With one or more MSCVs inoperable, action must be taken to restore OPERABLE status within 48 hours. In this condition, the MSIVs in the other three steam lines must close to prevent the blowdown of more than one SG following an SLB upstream of an MSIV. Having more than one MSCV. inoperable will not increase the consequences of an SLB upstream of an MSIV because 'only the MSCV 'associated with the faulted SG needs to function to mitigate the failure of an MSIV associated with any of the other SGs. Additionally, an inoperable MSCV does not affect the consequences of an SLB downstream of the MSIV. The 48 hour Completion Time is acceptable'because of the following: all MSIVs are Operable, there is a low'probability of the failure of an MSIV during the 48hour period that one or more MSCVs are inoperable; and,-there is a low probability of an accident that would require a closure of the MSCVs or MSIVs during this period. B.1. B.2 and B.3 If the MSCVs cannot be restored to OPERABLE status within 48 hours. the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours 4 and'all MSIVs must be closed within 14'hours.' The Completion Times are reasonable, based on'operating experience, to reach MODE 2 and to close the MSIVs or complete a plant-cooldown-to MODE 4 in an orderly manner and without challenging unit systems.
'Ifan inoperable MSCVs cannot be'restored to OPERABLE status within the:specified Completion Time. then all MSIVs must be verified to be closed on a periodic basis while the plant is in MODE 2 or 3. This is necessary-to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of MSIV status indications:available in the control room, and other administrative controls, to ensure that these valves are in the closed position.
(continued) ( INDIAN POINT 3 B 3.7.2 - 6 Revision I
. MSIVs and MSCVs B 3.7.2 BASES ACTIONS C.1i (continued)
With 'one'.MSIV inoperable in;MODE F, action must be taken to restore
* . -OPERABLE status within 48 hours. Some repairs to the MSIV can be made
. with the unit hot. The 48 hour Completion Time is acceptable because the four OPERABLE'MSCVs prevent the blowdown of more than one SG following an SLB upstream of the MSIV even if more than one MSIV fails to close. :-Additionally, there is a low probability of the failure of
-an MSCV during.theA48"hour period that the MSIV is inoperable; and.
- there is a low probability'of 'an accident that would require a closure of the MSIVs occurring during this time period.
The 48 hour Completion Time is greater than that normally allowed for containment isolation valves because the MSIVs'are valves that isolate a closed system-penetrating'containment. These valves differ from most other containment isolation valves in'that the closed system provides an additional means for containment isolation. D.1 If the MSIV cannot be restored to OPERABLE status within 48 hours, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours r.and Condition E wound be rentered. The'Comrpletion Times are
-reasonabled -based onoperating experience. to reach MODE 2 and to close the MSIVs.in:an orderly manner and without challenging unit systems'.-
E.Land E. ' Condition E is:modified by a Note indicating that separate Condition entry is allowed foreach MSIV. (continued) INDIAN POINT 3 B 3.7.2 -:'7 'n Rvso. I Revision
I MSIVs and MSCVs B 3.7.2 BASES () ACTIONS E.1 and E.2 (continued)
'Since the MSIVs are required to be OPERABLE in MODES 2 and 3. the inoperable MSIVs.may either be restored to OPERABLE status or closed.
When closed, the MSIVs are already in the position required by the
-assumptions;in the safety analysis. .
.The 8 hour Completion Time is reasonable, based on operating experience; to close the MSIVs after reaching MODE 2 or complete a plant cooldown.to MODE 4 in an orderly manner and without challenging unit systems.
For inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time,. but are closed, the inoperable MSIVs must be verified on a periodic basis to be closed. This is necessary
;.to ensure that the assumptions in the safety-analysis remain valid.
The 7 day Completion Time is reasonable, based on engineering judgment, in view of MSIV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position. F.1 and F.2 .. If one MSIV is inoperable when one or more MSCVs are inoperable, then more than one SG may blowdown following an SLB upstream of an MSIV and the plant is outside.of the analysis assumptions-. The plant remains within the analysis assumptions for an SLB downstream of an MSIV although the ability to tolerate the failure of a second MSIV is lost. In this condition, all MSCVs must be restored to OPERABLE status or all MSIVs must be restored to OPERABLE status within 8 hours. The 8 hour Completion Time-is acceptable because of the low probability of an accident.that would require:a closure of the MSCVs or MSIVs during this time period. The 8 hour Completion Time is greater than that normally allowed for containment isolation valves because the MSIVs are valves that isolate a closed system penetrating (continued) INDIAN POINT 3 B 3.7.2 - 8 Revision 1 I
MSIVs and MSCVs I: B 3.7.2 BASES ACT] ONS F.1 and F.2 (continued) Containment. These valves differ from-most other containment isolation valves in that the closed system provides an additional means for containment isolation.
-G.1 and G.2 -
If the MSIVs or MSCVs cannot be'restored to OPERABLE status or are not closed within the'associated Completion Time, the unit must be placed inma MODE in which the LCO does not apply. To achieve this status. the unit must be placed at least in MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience.' to 'reach the required unit conditions from MODE 2 conditions inm'an orderly manner and without challenging unit systems.- - --- - SURVEILLANCE REQUIREMENTS SR 3.7.2.1 This SR verifies that MSIV closure time is # 5.0 seconds on an actual or simulated actuation signal. The MSIV closure time is assumed in the accident and containment analyses. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. The MSIVs are not tested at power because even a part stroke causes a turbine trip and valve closure. As the MSIVs are not tested at power, they are'exempt from the ASME Code, Section XI (Ref. 5), requirements during operation in MODE 1 or 2. The Frequency is in accordance with the Inservice Testing Program. The Frequency for valve closure time is based on the refueling cycle. Operating experience has shown that these components usually pass the Surveillance when performed at this Frequency. Therefore, the Frequency is acceptable from a reliability standpoint. (continued) INDIAN POINT 3 B 3.7.2 -`9 Rion Revision i-
MSIVs and MSCVs B 3.7.2 BASES f) SURVEILLANCE REOUIREMENTS SR 3.7.2.1 (continued) This test is conductedin MODE 3 with the unit-at operating temperature and pressure. as discussed in Reference 5. This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows 'a delay of testing until MODE
- 3. to establish conditions consistent with those under which the acceptance criterion was generated.
SR 3.7.2.2 Each MSCV must be i'nspected to ensure that it closes properly. This ensures that the safety analysis assumptions are met. The Frequency of this SR is based on Inservice Testing Program requirements and corresponds to the expected refueling cycle. REFERENCES 1. FSAR. Section 10.2.
-I
- 2. FSAR. Section 6.
3., FSAR. Section 14.
- 4. 10 CFR 50.67.
- 5. ASME, Boiler~and Pressure Vessel-Code, Section XI.
INDIAN POINT 3B B 3.7.2 3 7 2 - 10
- 10R Revision is o I1
AFW System B 3.7.5
~: I ", .- I 1 B 3.7 PLANT SYSTEMS B 3.7.5 Auxiliary Feedwater (AFW) System BASES
- BACIX:GROUND The AFW System automatically supplies feedwater to the steam generators'to remove decay-heat from'the Reactor Coolant System upon the loss of normal feedwater supply. The AFW pumps take suction from the condensate storage'tank.(CST) (LCO 3.7.6) and pump to the steam generator secondary side via'a connection to the main feedwater (MFW) piping at a point 'outside containment. The steam generators function as a heat sink for core decay heat. The heat load is dissipated by releasing steam to the atmosphere from the steam generators via the main steam safety valves (MSSVs) (LCO 3.7.1).or atmospheric dump
'valves (ICO 3.7.4).- If the main condenser is'available, steam may be released via the steam bypass (High Pressure Steam Dump) valves and recirculated to the CST.
The AFW System consists of two motor driven AFW pumps and one steam turbine driven'pump configured into three trains. FSAR Section 10.2 (Ref. 1) describes this 'configuration as two pumping loops using two different types of motive power to the pumps. One auxiliary feedwater loop utilizes a.steam turbine driven pump and the other utilizes two motor driven pumpL.`Technical specifications describe this configuration as three trains because' each motor driven pump provides 100% of AFW flow cpacity.'and, depending on steam conditions, the turbine driven.pump.capacity approaches 200% of the required capacity for automatic delivery of AFW to the steam generators, as assumed in the accident analysis. The limiting transient for the AFW System is
'loss ofmain feedwater. For this event, the licensing analysis credits 343 gpm delivered automatically to two steam generators and the minimum of an additional 343 gpm delivered to the other two steam generators in 10 minutes. A near best estimate analysis has also been performed, and this'demonstrated that acceptance criteria are satisfied without assuming additional AFW flow in 10 minutes (Ref. 3).
- -The pumps are equipped with independent recirculation lines to prevent pump operation against'a closed system. Each motor driven AFW pump is powered from an-independent power supply and feeds two steam generators. The steam turbine driven AFW pump receives steam from two main steam lines upstream of the main steam isolation valves. Each of the steam feed lines will supply 100% of the requirements of the turbine driven AFW pump.
(continued) INDIAN POINT 3 B 3'.7 '.'5 `_ 1 ' Revision 2
I AFW System B 3.7.5 BASES BACKGROUND (continued) The AFW System is capable of supplying feedwater to the steam generators during normal unit startup, shutdown, and hot standby K.) conditions. The turbine driven AFW pump supplies a common header capable of feeding all steam generators. Each of the steam generators can also be supplied by one of the two motor driven AFW pumps. Any of the three pumps at full flow has sufficient capacity such that in the case of complete loss of. normal feedwater there is adequate time for operator action to start a second motor.driven AFW pump or to align the turbine driven AFW pump to remove.decay heat and cool the unit to residual heat removal (RHR) entry conditions. Thus, the requirement for diversity in motive power sources for the AFW System is met. The AFW System is designed to supply sufficient water to the steam generator(s) to remove-decay heat with steam generator pressure at the setpoint of the MSSVs. Subsequently, the AFR System supplies sufficient water to cool the unit to RHR entry conditions, with steam released through the ADVs. The motor driven pumps are actuated by any one of the following:
- 1) Low-low level in any steam generator: -
- 2) Loss of voltage (Non SI blackout) on 480 VAC bus 2A/3A (starts AFW Pump 31) and loss of voltage-(Non SI blackout) on 480 VAC bus 6A (starts AFW Pump 33);
- 3) Safety Injection signal;
- 4) Auto trip of either main boiler feed pump;
- 5) Manual actuation from the Control Room; and
- 6) Manual actuation locally at the pump room.
The steam turbine driven pump is actuated by any one of the following:
- 1) Low-low level in two of the four steam generators;
- 2) Loss of voltage (Non SI blackout) on 480 VAC busses 2A/3A or 6A:
(continued) INDIAN POINT 3 B 3.7.5 -2 Revision 2
- 'AFW System B 3.7.5 BASES N BACKGROUND 3)- Manual actuation'from the Control Room: and (continued)
- 4) Manual actuation locally at the pump room.
The steam driven AFW pump'must be throttled manually in order to bring
-the unit up to speed after a start signal. In addition, the steam driven pump dischargeflow-control valves must be manually opened as necessary to provide adequate auxiliary feedwater flow.
The AFW System is discussed in the FSAR, Section 10.2 (Ref. 1). APPLICABLE SAFETY ANALYSES - The'AFW System mitigates the consequences of any event with loss of normal 'feedwater. The-design basis'of the'AFW System is to supply water to the steam generator to remove~decay heat and other residual heat by delivering at least the minimum required flow rate to the steam generators at pressures corresponding to the lowest steam generator safety valve set pressure plus accumulation.', In'addition, the AFW-System must supply enough makeup water to replace
'steam generator secondary inventory lost as the'unit cools to MODE 4 conditions. Sufficient-AFW System flow must also be available to accountfor flow losses' such as pump recirculation and line breaks.
The limiting events"'that require the AFW'System are as follows:
- a. small 'breakloss'of coolant accident:
- b. loss of AC sources; and
- c. loss of feedwater.
The-AFW turbine driven pump actuates automatically when required to ensure-an adequate-feedwater supply to the steam generators is available during loss'of power. Power operated valves are provided for each AFW line to control the-tAFW flow to each steam generator. The AFW System satisfies the requirements of Criterion 3 of 10 CFR 50.36. , (continued) INDIAN POINT 3 6 3.7.'5'.3 - - Revision 2
AFW System B 3.7.5 BASES LCO This LCO provides assurance that the AFW System will perform its design safety function to mitigate the consequences of events that could result in overpressurization of the reactor coolant pressure boundary. Three independent AFW pumps are required to be OPERABLE to ensure the capability to maintain the plant in hot shutdown with a loss of offsite power and a single failure. This is accomplished by powering two of the pumps-from independent emergency buses. The third AFW pump is powered by a steam driven turbine supplied with steam from a source that is not isolated by closure of the MSIVs. The AFW System is configured into three trains. The AFW System is considered OPERABLE when the components and-flow paths required to provide redundant AFW flow to the steam generators are OPERABLE. This requires that the two motor driven AFW pumps be OPERABLE, each supplying AFW to two separate steam generators. The turbine driven AFW pump is required to be OPERABLE with steam supplies from each of two main steam lines upstream of the MSIVs, and shall be capable of supplying AFW to all of-the steam generators. The piping, valves. instrumentation, and controls in the .required flow paths also are required to be OPERABLE. The LCO is modified by a Note indicating that one AFW train, which includes a motor driven pump. is required to be OPERABLE in MODE 4. The motor driven AFW pump required to be OPERABLE in Mode 4 must be K capable of supporting the SG(s) being credited as the redundant decay heat removal path in accordance with LCO 3.4.6. RCS Loops - MODE 4. This requirement-ensures the ability to maintain the required level in the SG(s) (and decay heat removalcapacity) during extended periods in Mode 4 with or without offsite power. Requiring only one OPERABLE AFW pump is acceptable because of the reduced heat removal requirements and short period of time in MODE 4 during which the AFW is required and the insufficient steam available in MODE 4 to power the turbine driven AFW pump. APPLJCABILITY In MODES 1. 2. and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW is lost. In addition, the AFW System is required to supply enough makeup water to replace the steam generator secondary inventory needed to achieve and maintain MODE 4 conditions. In MODE 4. a motor driven AFW pump may be needed to support heat removal via the steam generators. In MODE 5 or 6. the steam generators are not normally used for heat removal, and the AFW System is not required. (continued) INDIAN POINT 3 B 3.7.5 -4 Revision 2
AFW System B 3.7.5 BASES ACTIONS A.1 If one of the two steam supplies to the turbine driven AFW train is inoperable,.'action must be taken to restore OPERABLE status within 7
'days. The 7 day Completion Time is reasonable, based on the following reasons:
- a. The redundant OPERABLE steam supply to the turbine driven AFW pump:
- b. The availability of redundant OPERABLE motor driven AFW pumps; and,
- c. The low probability of an event occurring that requires the inoperable steam supply to the turbine'driven AFW pump.
The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable du'ring any continuous failure to meet this LCO. The 10 day Completion Time provides a limitation time allowed in this specified Condition-'afte'r discovery of failure to meet the LCO. This limit is'considered rteasonable for situations in which Conditions A and B are entered concurrently.. The AND connector between 7 days and 10 days dictates that both'Completion Times apply simultaneously, and the more restrictive must be met. B.
- With one of the requirred AFW trains (pump or flow path) inoperable in MODE 1, 2, or 3 f6rreasons other than Condition A, action must be
' itaken to restore OPERABLE status within-72 hours. This Condition includes the loss of two'steam supply lines to the turbine driven AFW
'pump. 'The 72 hour Completion Time is reasonable, based on redundant capabilities afforded bylthe AFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.
The second Completion Time for Required Action B.1 establishes a limit on the maximum time' allo0ed for any' combination of Conditions to be
'inoperable during any continuous failure ,to meet this CO.
(continued) INDIAN POINT 3 1. - I. B 3.'L5-5 Revision 2
i AFW System B 3.7.5 BASES 3 ACTIONS B.1 (continued) The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is conside'red reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 72 hours and 10 days dictates that both Completion Times apply simultaneously. and the more restrictive must be met. C.1 and C.2 When Required Action A.1 or B.1 cannot be completed within the required Completion Time, or if two AFW trains are inoperable in MODE
- 1. 2. or 3. the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 18 hours.
The allowed Completion Times are reasonable, based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4 with' two AFW trains inoperable, operation is allowed to continue because only one motor driven pump AFW train is required in accordance with the Note that modifies the LCO. Although not required.. the unit may continue to cool down and initiate RHR. If all three AFW trains are inoperable in MODE 1, 2. or 3. the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change. that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status. Required Action D.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status. In this case. LCO 3.0.3 is not applicable because it could force the unit into a less safe condition. (continued) INDIAN POINT 3 B 3.7.56-6 Revision 2
AFW System B 3.7.5 BASES ACTIONS E.1 (continued) In MODE 4, either the reactor coolant pumps or the RHR loops can be used to provide forced circulation. This is addressed in LCO 3.4.6.
'RCS Loops -MODE 4." With one required AFW train inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status. The immediate Completion Time is consistent with LCO 3.4.6.
SURVEILLANCE REQUIREMENTS '
- - SR 3.7.5.1 Verifying the correct alignment for manual, power operated, and automatic valves in'the'AFW System water and steam supply flow paths provides assurance'that the proper flow paths will exist for AFW operation. This;SR'does not apply to valves that are locked, sealed, or otherwise'securedin 'position, since they are verified to be in the correct 'position prior to locking, sealing, or securing. This SR also does not apply totvalV's-that cannot be inadvertently misaligned, such as check valves. This Surveillance does:not require any testing or valve manipulation; rather, it'involves verification that those valves capable of being mispositioned are in the correct position.
The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions. This SR is modified'by a Note that states the SR is not required in MODE 4. 'Not:performing this.SR in MODE 4 is acceptable for the following reasons: AFW:pumps'are typically operated intermittently to
'keep the SGs filled when in'MODE 4, the decay heat load is low; an RHR loop is required to be' OPERABLE as the 'primary method of decay heat removal iniMode 4;'and, the'SG is required to be maintained at a level
'that ensures a'significant inventory is available as a heat sink before the AFW pump -is'required to refill'the'SG. These factors ensure .that'a significant amount'of time would be available to
- complete any valve realignments needed to refill'a SG when in Mode 4.
, ,A, . i*
'r' ' "
(continued) INDIAN POINT 3 B;3.7.5-,7 Revision 2 '
AFW System B 3.7.5 BASES SURVEILLANCE REOUIREMENTS (continued) SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are normal' tests of centrifugal pump performance required by Section XI of the ASME Code (Ref 2). Because it~is undesirable to introduce cold AFW into the steam generators while they are operating, this testing is performed on-recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice testsconfirm component OPERABILITY, trend performance. and,detect incipient failures by indicating abnormal performance. Performance of inservice testing discussed in the ASME Code. Section XI (Ref. 2) (only required at 3 month intervals) satisfies this requirement. This SR is modified by a Note indicating that the SR should be deferred until suitable. test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test when SG pressure is < 600 psig. SR 3.7.5.3 This SR verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS, by demonstrating that each automatic valve in the flow path actuates to its correct positionon an actual or simulated actuation signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.: The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage (i.e.,-unit at less than or equalto 97X power and in preparation for main generator breaker opening with no plans to raise power'between the time of the surveillance and.breaker open) and the potential for an unplanned transient if the Surveillance were performed with the reactor at full power. The 24 month Frequency is acceptable based on operating experience and the design reliability of the equipment. This SR is modified by a Note that states the SR is not required in MODE 4. In MODE 4. the required AFW train is operated as necessary to maintain SG water level. (continued) INDIAN POINT 3 B 3.7.5 -8 Revision 2
AFW System B 3.7.5 BASES SURVEILLANCE REOUIREMENTS (continued) SR 3.7.5.4 This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an ESFAS by demonstrating that each AFW pump starts automatically on an actual or simulated actuation signal in MODES 1. 2, and 3. In MODE 4. the required pump is operated as necessary and the autostart function is not required. The '24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned'transient'if the Surveillance were performed with the reactor at power. This SR is modified by two Notes. Note 1 indicates that the SR be deferred until suitable test conditions are established. This deferral allows the test to be performed at rated conditions. Note 2 states that the SR is not required in MODE 4. In MODE 4. the required pump is operated as'necessary to maintain SG water level and the autostart function is'not required. In MODE 4, the heat removal requirements would'be less providing more time for operator action to manually start the required AFW pump. REFERENCES 1. FSAR, Section 10.2.
- 2. ASME. Boiler and Pressure Vessel Code. Section XI.
- 3. Safety Evaluation Report (SER) for IP3 Amendment 225.
INDIAN POINT 3 B 3.7.5 - 9 Revision 2
CST B 3.7.6 B 3.7 -PLANT SYSTEMS B 3.7.6 Condensate Storage Tank (CST) I BASES ; BACKGROUND .- The CST provides a'safety grade source ofwater to the steam generators for removing decay and sensible heat from the Reactor Coolant System (RCS). ;:The CST provides a passive flow of water, by gravity, to the Auxiliary Feedwater (AFW) System (LCO 3.7.5). The steam produced is-'released to the atmosphere'by the main steam-safety valves or the atmospheric dump valves. The AFW steam driven pump operates with a continuous recirculation to the CST. The motor driven AFW pumps have recirculation controllers that recirculate flow to the CST. as necessary, to maintain a minimum required AFW pump flow. When the main steam isolation valves are open, the preferred means of heat removal is to discharge steam to the condenser by the nonsafety grade path of the steam bypass (High Pressure Steam Dump) valves. The condensed steam is returned to the CST by the condensate pump. This has the advantage of conserving condensate while minimizing releases to the environment.:--- - Because the CST is.a principal component-in removing residual heat from the RCS. itis designed to withstand earthquakes and other natural phenomena&'The CST is designed toSeismic Class I to ensure availability of'the'auxiliary feedwater supply.' Auxiliary feedwater is also available from city water. The condensate makeup system connects the 600,000 gallon capacity condensate'storage tank to the main condenser. The condensate makeup system automatically supplies makeup water from the CST'to the condenser if there sa low level in the condenser hotwell. Redundant, Category I. isolating4 valves will close the condenser makeup when the condensate storage'tank level decreases to 360.000 gallons to reserve the required volume of condensate available-to the auxiliary feedwater pumps sufficient to hold the plant at hot shutdown for 24 hours following a trip at full'power. (continued) INDIAN POINT 3 B 3.'7.6-1 Revision 2
CST B 3.7.6 BASES BACKGROUND To ensure CST pressure is maintained within its design limits (continued) while limiting the amount of air in contact with the condensate, two Category I, 100% capacity breather valves are installed on the dome of the CST. CST venting is required for the CST to perform both its normal and emergency function. The venting function can be met by either of the'CST breather valves or equivalent venting capacity. A description of the CST is found in the FSAR, Section 10.2 (Ref. 1). APPLICABLE SAFETY ANALYSES The CST provides'cooling water to remove decay heat and the minimum amount of water in the condensate storage tank is the amount needed to maintain the plant for 24 hours'at hot shutdown following a trip from full power. When'the condensate storage tank supply is exhausted, city water will be used. The CST satisfies Criteria 2 and 3 of 10 CFR 50.36. LCO To satisfy accident analysis assumptions, the CST must contain sufficient cooling water to remove decay heat while in MODE 3 for 24 hours following a reactor trip from 102% RTP.. In doing this, it must retain sufficient water to ensure adequate net-positive suction head for the AFW pumps during cooling', as well as account for any losses I from the steam driven AFW pump turbine. When the condensate storage tank supply is exhausted. city water will be used. The CST level required is equivalent to a total volume of 292,200 gallons. which is based on holding the unit in MODE 3 for 24 hours. This basis is established in Reference.2. The CST total volume includes allowances for instrument accuracy and the unuseable volume in the CST. (continued) K) INDIAN POINT 3 B 3.7.6-2 Revision 2
CST B 3.7.6 BASES LCO The OPERABILITY of the CST is determined by maintaining the tank (continued) level at'or above the minimum required level. CST venting and pressure relief capability are required for the CST to perform both its normal and emergency function. The venting and pressure relief functions are satisfied'by either of the CST breather valves or equivalent venting'apacity. ' APPLICABILITY In MODES 1. 2, and,3.'and'in MODE 4. when-steam generator is being relied upon for heat removal, the CST is required to be OPERABLE. In MODE 5 or 6. the CST is not required because the AFW System is not required. ACTIONS A.1 and A.2 If the CST is not OPERABLE, the OPERABILITY of the backup supply (city water).should be verified by administrative means immediately and once every 12 hours thereafter. 'OPERABILITY of the backup auxiliary feedwater supply means that LCO'3.7.7, City Water, is met and includes
-verification that the flow paths from city water to the AFW pumps are OPERABLE. The CST must be'restored to OPERABLE status within 7 days.
The immediate Completion Time for'verification'of the OPERABILITY of the backup water supply ensures that Condition B is entered immediately if both the CST and City Water are inoperable. The 7 day Completion Time for restoration of the CST is reasonable, based on an OPERABLE backup water supply being available, and the low probability of an event occurring during'this time period requiring the CST. B.1and B.2 If the CST cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. (continued) INDIAN POINT 3 B 3.71.6-3 "' ReVision-2
CST B 3.7.6 BASES - ACTIONS B.1 and B.2 (continued) To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4, without reliance on the steam generator for heat removal, within 18-hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. If Condition B is entered when both the CST and City Water are not Operable, Conditions and Required Actions for LCO 3.7.5. Auxiliary Feedwater System, may be appropriate. SURVEILLANCE REOUIREMENTS SR 3.7.6.1 This SR.verifies that the CST contains the required volume of cooling water. The 12 hour Frequency is based on operating experience and the need for operator awareness of unit evolutions that may affect the CST inventory between checks. Also, the 12 hour Frequency is considered K) adequate in view of other indications in the control room, including alarms, to alert the operator to abnormal deviations in the CST level. REFERENCES 1. FSAR, Section 10.2.
- 2. WCAP - 16212P, Indian Point Nuclear Power Generating Unit No. 3 Stretch Power Uprate NSSS and BOP Licensing Report, June 2004.
K) INDIAN POINT 3 B 3.7.6-4 Revision 2 i
CCW System B 3.7.8 B 3.7 PLANT SYSTEMS B 3.7.8 Component Cooling Water (CCW) System BASES BACKGROUND The Component'CoolingWater (CCW) System is a,'closed-loop cooling systemithat providee cooling water for systems and components important to safety that are located in the Primary Auxiliary Building, the'Fuel'Storage Building. and the Containment Building. The CCW System transfers its heat load to the Service Water System via
'CCW heat exchangers.The Service Water System is a once through cooling system that transfers its heat load to the ultimate heat sink.
the Hudson'River.' The CCW'System provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation. the CCW System also provides thisfunction'for various nonessential components including the spent'fuel storage pool. The CCW System serves as a barrier toithe releas'e of radioactive byproducts between potentially radioactive systems'and the Service Water System, and thus to the environment. The CCW System consists of three pumps and two heat exchangers. These components are divided into two independent. full capacity cooling loops with each loop consisting of one pump and a heat exchanger. The third CCW pump can be aligned to replace the pump in either loop. Each of the three CCW pumps is powered from a separate safeguards power train. The CCW loops are cross connected during normal and emergency operation; however, the cooling loads are divided between the two
'loops-so that each loop is capable of supplying the necessary service to support continued containment sump and core recirculation following a LOCA while supplying normal loads. Operating CCW loops cross-connected allows use bf either CCW heat exchanger to cool all normal and post accident heat~loads.' Any service water'system pump can be used to support either or both CCW heat exchangers. Isolation valves allow each loop to be isolated and operated as an independent component cooling loop.
(continued) INDIAN POINT 3 6 3.'7.8 'T" ' Re.vision I
I CCW System B 3.7.8 BASES BACKGROUND This configuration facilitates detection of radioactivity (continued) entering the loop for leak detection or isolation of a piping or component failure during an.event. A surge tank in each loop ensures that sufficient net positive suction head is available. CCW pumps continue to operate following a safety injection signal without loss of offsite power (LOOP); however, CCW pumps are stripped and must be started 'as needed following any event that includes a LOOP. Note that the CCW pumps are not re-started during the injection phase: therefore, the water volume of the CCW system must act as a heat sink during the injection phase when the CCW pumps are not running, This is acceptable even though safety injection pump bearings are cooled byCCW because-the cooling water is circulated by a booster pump directly connected to the injection pump motor shaft. During the injection phase, the Recirculation Pumps are cooled by the Auxiliary Component Cooling Water pumps, which are not governed by this LCO.
-Additional information on the design and operation of the system.
along with a list of the components served, is presented in the FSAR, Section 9.3 (Ref. 1). The principal safety related function of the CCW System is the removal of decay heat,from the reactor via the Residual Heat Removal (RHR) System. This may be during a normal or post accident cooldown and shutdown. APPLICABLE SAFETY ANALYSES The design basis of the CCW System is for one CCW loop to remove the post loss of coolant accident (LOCA) heat load from the containment sump during the recirculation phase. Any one of the three CCW pumps in conjunction with any one of the two CCW heat exchangers is sufficient to accommodate the normal and post accident heat load if the CCW system is operated as two cross connected loops. Either CCW pump in conjunction with either CCW heat exchanger or the third CCW pump in conjunction with either associated CCW heat exchanger is sufficient if the CCW loops are isolated. (continued) INDIAN POINT 3 B 3.7.8 - 2 Revision 1
CCW System B 3.7.8 BASES APPLICABLE SAFETY ANALYSES (continued) - The CCW System also functions to cool the unit from RHR entry conditions (T<350iF) to Mode 5 (T<2000F). during normal and post accident operations. The time required to cool from 3500 F to 200OF is a function of the number'ofCCW. SWS and RHR trains operating. As presented in UFSAR.'Section 9. two trains of pumps and heat exchangers are 'usually used'to'remove residual and sensible heat during normal
'plant cool-down."If'one'train of pumps and/or heat exchangers is not operable, safety operation is governed by Technical Specifications and safe shutdown of the plant is not affected; however, the time for cool-down is extended One CCW train is sufficient to remove decay heat during subsequent operations with T<2000F. The above conditions assume a maximum service water temperature of 950 F occurring simultaneously with the maximum heat loads on the system.
Because'the component 'cooling pumps do not run during the injection phase if the event is accompanied by a loss'of offsite power, the water volume of the CCW system is used as a heat sink. -This heat load causes a temperature' rise of approximately 7 OF per hour in the component cooling waterwith no credit taken for the water volume in the surge tank. Withia minimum initial CCW temperature of 110 0 F at the start of the accident; 6 hours are available before the cooling water temperature reaches 150 9F:-10 hours is available before reaching 180 (F. Evaluations of the heat removal capability of the CCW system are contained-in Ref r'nces'2 and 3. The CCW System is designed to perform its function with a single failure'of any' active'component, assuming a loss of offsite power.' The CCW System satisfies Criterion 3 of 10 CFR 50.36. -LCO ; ' The CCW loops are independent of each other to the degree that each has separate controls'and power supplies and'the-operation of one does not depend on the-other.--In the event of a DBAk one CCW loop is required to provide the minimum heat removal capability assumed in the safety analysis'for the systems to which'it supplies cooling water. To ensure this requirement'is met, two loops-of CCW must be OPERABLE. At least one CCW loop will operate during the recirculation phase assuming the worst case single active failure occurs coincident with a loss of offsite'power. (continued) INDIAN POINT 3 B 3.7-.8 -'3 Revision 1
CCW System B 3.7.8 BASES LCO (continued) A CCW loop consists of any of the three CCW pumps in conjunction with a CCW heat exchanger. K) A CCW loop is considered OPERABLE when:
*a. The pump and associated surge tank are OPERABLE; and
- b. The associated piping, valves, heat exchanger, and instrumentation and controls required to perform the safety related function are OPERABLE.
The isolation of CCW from components or systems may render those components or systems inoperable but does not affect the OPERABILITY of the CCW System. Note that the auxiliary component cooling water pumps support the Containment Recirculation pumps only and are governed by LCO 3.5.2. ECCS - Operating. APPLICABILITY In MODES 1. 2. 3, and 4, the CCW System is a normally operating system, which must be prepared-to perform its post accident safety functions, primarily RCS heat removal, which is achieved by cooling the RHR heat exchanger. 3 In MODE S or 6. the OPERABILITY requirements of the CCW System are determined by the systems it supports. ACTIONS AA1 Required Action A.1 is modified by a Note indicating that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4," be entered if an inoperable CCW loop results in an inoperable
-RHR loop. This is an exception to LCO 3.0.6 and ensures the proper I actions are taken for these components.
If one CCW loop is inoperable, action must be taken to restore OPERABLE status within 72 hours. In this Condition, the (continued) INDIAN POINT 3 B 3.7.8 -4 Revision 1
CCW System B 3.7.8 -BASES ACTIONS A.1 (continued) I., . . remaining OPERABLE CCW loop is adequate to perform the heat removal function.: The 72 hour- Completion Time is reasonable, based on the redundant'capabilities 'a'fforded by the OPERABLE loop, and the low probability of a DBA occurring during this period.
'I.
B.1 and B.2' If the CCW loop cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be
- ' placed-in at'least'MODE 3 within 6 hours and in MODE 5 within 36 hours. The allowed'Completion Times are'reasonable, based on operating experience: to'reach the required unit conditions from full
,- . ; :power conditions inan o-rderly manner and without challenging unit systems; SURVEILLANCE REOUIREMENTS -;.
-SR 3.7.8.1 This SR is modified by a Note indicating that the isolation of the CCW flow to individual components may render those components inoperable but does not affect the OPERABILITY of the CCW System.
Verifying the correct alignment for manual, power operated, and automatic valves iithe CCW flow path provides assurance'that the proper flow paths exist for CCW operation.. This SR does not apply to
'-valves that are lockea'sealed, or otherwise' secured in position.
since these valves'liare verified to be in'the correct position prior to locking. sealing, or 'ecuring. Valves located inside containment are
' -considered to bei'ockbed.'-This-'SR'also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation:
rather, it involves verification that those valves capable of _ -(continued) INDIAN POINT 3 B 3.-7;'8 5 4' : Revision'l
CCW System B 3.7.8 BASES SURVEILLANCE REOUIREMENTS i SR 3.7.8.1 (continued) being mispositioned are in the correct position. Valves that are throttled are verified by verification of required flow. The 92 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions. SR 3.7.8.2 This SR verifies proper-automatic operation of the CCW valves on an actual orzsimulated actuation signal. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the-reactor at power. Operating experience has shown that these ( ) components usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint. SR 3.7.8.3 This SR verifies proper automatic operation of the CCW pumps on an actual or simulated actuation signal. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if (continued) 3 INDIAN POINT 3 B 3.7.8 - 6 Revision 1
CCW System B 3.7.8 BASES SURVEILLANCE REOUIREMENTS SR 3.7.8.3 (continued) the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint. REFERENCES 1. FSAR. Section 9.3.
- 2. FSAR, Section 6.2.
- 3. WCAP-12313, Safety Evaluation for an Ultimate Heat Sink Temperature Increased to 95 OF at IP-3."
INDIAN POINT 3 B 3.7.8 -7 Revision 1
SWS B 3.7.9 B 3.7 PLANT SYSTEMS B 3.7.9 Service Water System (SWS) BASES BACKGROUND The SWS provides a heat sink for the removal of process and operating heat from safety related components during a Design.Basis Accident O(DBA) or transient During normal operation, and a normal shutdown. the SWS also provides thii function for various safety related and I i . non-safety related components. The safety related function is covered by this LCO. .:'k The SWS consists of'two separate, 100 capacity, safety related, cooling water headers. Each header is supplied-by three pumps and includes the piping up' to and including the isolation valves on individual components cooled by the SW. Each of the 6 SWS pumps is equipped with rotary strainers and isolation valves.
-' SWS heat loads'are'dedsignated as either essential or nonessential.
' The essential SWS he'at-loads are those which must be supplied with cooling water immediately in the event of'a LOCA and/or loss of offsite power (LOOP). Examples of essential loads are the emergency diesel generators:(EDGs). containment.fan cooler units (FCUs) and control room air'conditioning system (CRACS). The nonessential SWS heat loads are"those which-are required only following the switch over to the recirculation phase following a postulated LOCA. Examples of nonessential loadsar'ethe component' cooling water (CCW) heat exchangers. :.,
. The FCUs are connected-in parallel to'the'essential SWS header.
Normal SWS flow to the FCUs is controlled by TCV-1103. Required ESFAS flow to all five FCUs is initiated when either of the redundant SWS to FCU ESFAS valves (TCV-1104 or TCV-1105) opens automatically in response to an ESFAS actuation signal.
*~~~ - --;j The EDGs are connected in parallel to the essential SWS header.
Required;ESFASflow.to all.three EDGs is initiated when either of the
.:.redundant.SWS to:EDG:ESFAS valves'(FCV-1176 or FCV-1176A) opens automatically in response.to an ESFAS actuation which starts the EDGs.
. (continued)
INDIAN POINT 3 B 3.7. 9 - 1 " Revision 2
I swS B 3.7.9 BASES Ko ) BACKGROUND The CRACS are connected in parallel to the essential SWS header'. (continued) Required ESFAS flow to both CRACS is provided continuously because the redundant SWS to CRACS valves (TCV-1310/1311 and TCV-1312/1313) have been modified to provide the required flow at all times. Either of the two SWS headers can be aligned to supply the essential heat loads or the nonessential SWS heat loads. Both the essential and nonessential SWS HEADERS are operated to support normal plant operation and the plant response to accidents and transients. The SWS PUMPS associated with the SWS header designated as the essential header will start automatically. The SWS pumps associated with the SWS header designated as the nonessential header must be manually started when required following a LOCA. The essential SWS heat loads can be cooled by any two of the three service water pumps on the essential header.; The nonessential SWS heat loads can be cooled by any one, of the three service water pumps on the nonessential header. To ensure adequate flow to the essential header, the essential and nonessential headers may be cross connected only as necessary while swapping the essential SWS header with the non essential SWS header. Service water pump suctions are located below the mean sea level in the HudsonRiver. the ultimate heat sink. This configuration ensures adequate submergence of the SWS pump suctions.
.Additional information about the design and operation of the SW. along with a list of the components served, is presented in the FSAR.
Section 9.6. (Ref. 1). The principal safety related function of the SWS is the removal of decay heat from the reactor via the CCW System. APPLICABLE SAFETY ANALYSES The design basis of the SWS is as follows: post accident essential SWS heat loads can be cooled by any two of the three service water pumps on the designated'essential header; and,'post accident nonessential SWS heat loads can be cooled by anyone of the three service water pumps on the designated nonessential header. With the minimum number of pumps operating, the essential and nonessential (continued) INDIAN POINT 3 B 3.7.9- 2 Revision 2
SWS B 3.7.9 BASES APPLICABLE SAFETY ANALYSES (continued)
.headers of the SWS have the required capacity to remove core decay heat following a design basis LOCA 'as discussed in References 1, 2 and
- 3. This prevents.the containment sump'fluid from increasing in temperature during ..the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied.tothe Reactor Coolant System by the ECCS pumps. The Service Water System was designed to fulfill 'required safety'functions while.sustaining:(a).,the single failure of -any active component used during the injection phase of a postulated LOCA with or without a
- LOOP. .or (b)thesingle failure of any active or passive component used during the long-term recirculation phase with or without a LOOP.
.The operating modes-of the 1P3 SWS are as follows: a) normal mode: b) post-LOCA injection mode; and, c) post-LOCA recirculation mode. The postulated failure'conditions of the SWS must include consideration of
' the limiting case-,for each operating mode of the system which are as follows: *
- a. Loss of the 10.inch.turbine building service water supply header during normal operation and a seismic event:
- b. Loss of.instrument-air. during the post-LOCA injection phase concurrent with single active component failure.
- c. Loss-of a SWS:.pump~on both the essential and nonessential headers (resulting-from an EDG failure) during the post-LOCA reci rcul ation phase..
The SW,. in conjunction with the CCW System, also cools the unit from residual heat removal (RHR) entry conditions to MODE 5 during normal and post accident operations. The time required for this evolution is
-a function of CCW and:RHR:system flow,-SS flow .and UHS temperature.
The design assumesia maximum SWS temperature of 95 OF occurring simultaneously.with;maximum heat loads on the system (Ref. 3). As presented in UFSAR..Section 9, two trains of pumps and heat exchangers are usually used to remove residual and sensible heat during normal
.plant cool-down.- If.onetrain or pumps and/or heat exchangers is not operable,.safe operation is governed by Technical Specifications and safe shutdown of the plant is not affected: however, the time for cool-down is extended.
The SWS satisfies Criterion 3 of 10 CFR 50.36. (continued) INDIAN POINT 3 B 3.7.9,-7 3 Revision 2
swS B 3.7.9 BASES LCO Three of the three SWS pumps associated with the SWS header designated as the essential header: and, two of the three SWS pumps associated with the SWS header designated as the nonessential header must be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident heat loads, while sustaining: (a) the single failure of any active component used'during the injection phase of a postulated LOCA with or without a LOOP. or (b)the single failure of any active or passive component used during the long-term recirculation phase with or without a LOOP. An SWS header is considered OPERABLE during MODES 1. 2. 3. and 4 when:
- a. The required number of pumps, consistent with the header's designation as the'essential or nonessential header, are OPERABLE; and
- b. The essential and nonessential headers are isolated from each other by at least one closed valve except as specified by the NOTE to the ACTIONS:
c; The associated piping, valves, instrumentation and controls required to perform the safety related function are OPERABLE. The SWS to FCU valves (TCV-1104 or TCV-1105) and SWS to EDG valves (FCV-1176 or FCV-1176A) are OPERABLE when they open automatically in response to ESFAS actuation signal or are blocked open. Service water valves SWN-35-1 and SWN-35-2, at'the CCWHX 31 and 32 outlets, are required to be opened no more than 27.5 and 27 degrees open, respectively, for single pump runout protection during the re-establishment of non-essential service water for.long term recirculation and non-SI Blackout for MODES'1 to 4. The exception to this is during plant cool-down from 350 OF to Cold Shutdown (MODE 5) where these valves may be opened without restriction provided that: Two non-essential service water pumps are operating, the non-essential SW header low pressure alarm is maintained clear, and the valves are restored to their 27.5 / 27 degrees open positions should a reduction to single non-essential pump operation result. (continued) \ INDIAN POINT 3 B 3.7.9 - 4 Revision 2
sWS B 3.7.9
. err LCO The latter is achieved by the implemeitation of 'administrative (continued) controls to ensure that a dedicated Operator with direct communication from the Control Room takes manual action to restore the valves to their prescribed position limits well within 2 hours. These administrative controls also include procedural'guidance and
-restrictions, such as not'allowingthis configuration with the headers being swapped or'cross-tied.
APPLICABILITY In MODES 1. 2. 3,3and 4, the SWS is a normally operating system that is required to support the OPERABILITY of the equipment serviced by the SWS and required-to be OPERABLE in these MODES. In MODES 5 and 6. the OPERABILITY requirements of the SWS are determined by the systems it supports. ACTIONS The ACTIONS are modified by a Note that specifies that LCO 3.0.3 is
-'notapplicable for 8 hours while swapping the essential SWS header with the nonessentialaSWS header but only if LCO 3.7.9 will be met after the essential and non-essential header are swapped. This means that the essentialiand nonessential' SWS headers may be cross-connected for up to 8 hours'du'ring transfer of the designated essential SWS header to'the alternate SWS header. This is acceptable because the transfer is performed infrequently.(i.e.. approximately every 90 days)
- and the low probability of an-event while the headers are cross connected.
A.] and'B.- If one of the three-required SWS pumps on the essential SWS header is' inoperable (i.e.. Condition A). three Operable pumps must be restored to the essential SWS header within 72 hours. Likewise, if one of the two required SWS pumps on nonessential SWS header is inoperable (i.e.,
' Condition B).'the'header must be restored so that there are two
'Operable pumps fo'the nonessential SWS header within 72 hours. With one required SWS'-pu'mpinoperable on either or both SWS headers, the
'remaining OPERABLE SWS pumps are adequate to perform the heat removal
'- 'function.- However'the'ov'erall reliability is reduced because a single:failure in'anOPERABLE SWS pump could result in loss of SWS function. -The 72hhour Completion Time is based on the redundant capabilities afforded by the OPERABLE pump(s) in the same header. and the low probability of a DBA occurring during this time period.
(continued) INDIAN POINT 3 B 3.7.9 ' 5 .' ,' Revision' 2
sWS B 3.7.9 BASES ACTIONS C.1 and D.1 Q) (continued) Required ESFAS flow to all three EDGs is initiated when either of the redundant SWS to EDG valves (FCV-1176 or FCV-1176A) opens automatically in response to an ESFAS actuation which starts the EDGs. Similarly, required ESFAS flow to all five FCUs is initiated when either of the redundant SWS to FCU valves (TCV-1104 or TCV-11O5) opens automatically in response to an ESFAS actuation signal. The SWS to FCU valves and SWS to EDG valves are OPERABLE when they open automatically in response to an ESFAS actuation signal or are blocked open. If one of the redundant SWS to EDG valves is inoperable, a single failure of the redundant valve could result in the failure of all three EDGs shortly after the initiation of an event. If one of the redundant SWS to FCU valves is inoperable, a single failure of the redundant valve could result in the failure of all five FCUs. Therefore, a Completion Time of 12 hours is established to restore the required redundancy. A 12 hour Completion Time-is acceptable for the SWS to EDG valves because SWS to the EDGs is still available and the low probability of an event with a loss of offsite power during this period. A 12 hour Completion Time is acceptable for the SWS to FCU valves because SWS to the FCUs is still available, the availability of Containment Spray. K1) and the low probability of an event during this period. If both SWS to EDG valves or both SWS to FCU valves are inoperable. entry into LCO 3.0.3 is required. Ei If the SWS piping and valves are inoperable for reasons other than those listed in Conditions A. B. C or D. the SWS must be restored within 12 hours. This is necessary to ensure that repairs to affected portions of the SWS are completed in a timely manner. This Action also ensures no unnecessary transients (i.e. plant shutdown) are placed on the plant as a result of conditions in the SWS that may challenge OPERABILITY but do not result in a loss of function. (continued) K~ INDIAN POINT 3 B 3.7.9 - 6 Revision 2
S B 3.7.9 BASES ACTIONS E.1 (continued) A 12 hour Completion Time is acceptable for SWS piping and valves other than those listed in Conditions A, B. C. or D based on the low probability of an event during this period. Additionally, the 12 hour Completion Time allows'>the Operator to perform the evaluations and/or actions necessary for restoring the SWS OPERABILITY. This Action is
' 'in lieu of the 'potential for decreased safety as-a result of diverting II 4.
- the Operator's attentio'n'to the actions associated with taking the unit to shutdown.'
.. I I I . . . : 2 .
.. ., an - l F.1 and F.2 --- ' - '
If more than one required SWS pump in either the'essential or the nonessential header is inoperable; or. if the flow path associated with either'header'is'not capable of performing its safety function (e.g., both SWS to EDG valves or both SWS to;FCU valves are inoperable), then the unit must be placed in a MODE in which the LCO does not'apply.' ;- Additionally, if an SWS header cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply.
-To achieve the required'status' the unit must'be placed in at least
- MODE 3 within 6 hours and'in MODE 5 within 36 hours. The allowed
-Completion Times arerreaionable, based on operating experience, to reach the required unit'conditions from full power conditions in an orderly manner and without challenging unit systems.
SURVEI LLANCE REOUIREMENTS '
. I .
,I :
- SR 3.7.9.1 I ..,
This SR is modified by a Note indicating that the isolation of the SWS components or systems-may render those components inoperable, but does not affect the OPERABILITY of the SW. (continued) INDIAN POINT 3 B 3'.'7.9 --' 7. ", ..Revision 2
sws B 3.7.9 BASES ) SURVEILLANCE REOUIREMENTS SR 3.7.9.1 (continued) Verifying the correct alignment for manual. power operated, and automatic valves in the SWS flow path provides assurance that the proper flow paths exist for SWS operation. This SR does not apply to valves that-are locked,-sealed, or otherwise secured in position. since they are verified to be in the correct position prior to being locked, sealed, or secured. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For SWN-35-1 and SWN-35-2. see Bases LCO section for valve position requirements below 350 OF. The 92 day Frequency is based on engineering judgment. is consistent with the procedural controls governing valve operation, and ensures correct valve positions. SR 3.7.9.2 This SR verifies proper automatic operation of the SWS valves on an actual orsimulated actuation signal. The SWS is a normally operating system that cannot be fully actuated as part of normal testing. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint. (continued) 3 INDIAN POINT 3 B 3.7.9 - 8 Revision 2
SWS B 3.7.9 BASES SURVEILLANCE REOUIREMENTS (continued) SR 3.7.9.3 This SR verifies proper automatic operation of the SWS pumps on an actual or simulated actuation signal. The SWS is a normally operating system that cannot be fully actuated as part of normal testing during normal operation. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint. REFERENCES 1. FSAR, Section 9.6.
- 2. FSAR, Section 6.2.
- 3. WCAP - 16212P, Indian Point Nuclear Power Generating Unit No. 3 Stretch Power Uprate NSSS and BOP Licensing Report, June 2004.
INDIAN POINT 3 B -3.7.9- 9 Revision 2
UHS B 3.7.10 B 3.7 PLANT SYSTEMS I B 3.7.10 Ultimate Heat Sink (UHS) BASES BACKGROUND ' 'The UHS provides' a'heat "sink for processing and operating heat from
.'safety related' components during a transient or accident, as well as during normal operation This is done by utilizing the Service Water System (SWS) and the Component Cooling Water (CCW) System.
- The ultimate heat sink'for IP3 is the Hudson River. The UHS and
*supporting structures are.capable of providing sufficient cooling for thirty'da'ys and are'sufficient to:
(a)Support'simultaneous safe shutdown and cooldown of both operating nuclear units'at'the Indian Point site and maintain them in a safe condition, a'nd"' - (b) In'the event of'an accident in one unit, support required response to that accident',and permit simultaneous safe shutdown and cooldown of the remaining unit and maintain them in a safe shutdown condition. In"the event of anhaccident in one unit, support required response to that'accident and'p-eriitsimultaneous safe shutdown and cooldown of the remaining unit and maintain them in a safe shutdown condition. The'ultimate heat sink is capable of withstanding the effects of the most severe natural phenomena associated with the Indian Point site, other site related events and a single failure of man-made structural features. The two principal'functionis of the UHS areithe dissipation of residual heat'after reactor shutdown,' and dissipation of residual heat after an accident. APPLICABLE SAFETY ANALYSESYE The UHS is the sink for heat removed from the reactor core following all accidents and anticipated operational occurrences in which the unit is cooled down and placed on residual heat removal (RHR) operation. Because IP3 uses the UHS as the
.(continued)
, , . v INDIAN POINT 3 B 3.7.0-1 . Reviion Ri I
i UHS B 3.7.10 BASES APPLICABLE SAFETY ANALYSES (continued) K) normal heat sink for condenser cooling via the Circulating Water System, unit operation at full power is its maximum heat load. Its maximum post accident heat load occurs shortly after a design basis loss of coolant accident (LOCA). Near this time, the unit switches. from injection to recirculation and the containment cooling systems and containment recirculation system are required to remove the core decay heat. The operating limits are based on conservative heat transfer analyses for the worst case LOCA. Reference 1 provides' the details of the assumptions used in the. analysis, which include worst expected meteorological conditions, conservative uncertainties when calculating decay heat, and worst case single active failure (e.g.. single failure of a manmade structure). The UHS meets Regulatory Guide 1.27 (Ref.3), which requires a 30 day supply of cooling water in the UHS. The UHS satisfies Criterion 3 of 10 CFR 50.36. LCO The UHS is required to be OPERABLE and is considered OPERABLE if it contains water at or below the maximum temperature that would allow V the SWS to operate for at least 30 days following the design basis LOCA without the loss of net positive suction head (NPSH). and without exceeding the maximum design temperature of the equipment served by I) the SWS.. To meet this condition., the UHS temperature must not exceed 95 OF. APPLICABILITY In MODES 1. 2. 3, and 4, the UHS is required to support the OPERABILITY of the equipment serviced by the UHS and required to be OPERABLE in these MODES. In MODE 5 or 6. the OPERABILITY requirements of the UHS are determined by the systems it supports. (continued) INDIAN POINT 3 B 3.7.10 - 2 Revision 1
UHS B 3.7.10 BASES ACTIONS A.1 and A.2 If UHS temperature > 95 OF, or is inoperable for reasons other than high temperature, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 7 hours and in MODE 5 within 37 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE REOUIREMENTS SR 3.7.10.1 This SR verifies that the SWS is available to cool the CCW System to at least its maximum design temperature with the maximum accident or normal design heat loads for 30 days following a Design Basis Accident. The 24 hour Frequency is based on operating experience related to trending of the parameter variations during the applicable MODES. This SR verifies that the average water temperature of the UHS is < 95EF. Requirements for UHS monitoring instrumentation are governed by the Technical Requirements Manual (Ref. 4). REFERENCES 1. FSAR, Section 9.6.
- 2. WCAP - 16212P, Indian Point Nuclear Power Generating Unit No. 3 Stretch Power Uprate NSSS and BOP Licensing Report, June 2004.
- 3. Regulatory Guide 1.27.
- 4. IP3 Technical Requirements Manual.
INDIAN POINT 3 B 3.7.10 - 3 Revision I
FSBEVS B 3.7.13 B 3.7 PLANT SYSTEMS B 3.7.13 Fuel Storage Building Emergency Ventilation System (FSBEVS) BASES BACKGROUND The FSBEVS filters ;airborne radioactive particulates from the area of the fuel pool following asfuel handling accident. The FSBEVS, in conjunction with other normally operating systems, also provides envirohmental control 'of temperature and humidity in the fuel storage building. The Fuel Storage Building (FSB) ventilation system maintains environmental conditions in the building enclosing .the spent fuel pit and consists of the'.folloWing:
- Two FSB air'tempering units, each consisting of: a steam heating coil, a suppl 'fan, and an isolation damper; One FSB exhaust fan and associated outlet damper; One FSB exhaust filtration unit consisting of roughing. HEPA.
and charcoal filters which includes the pneumatically operated
inlet and 6utlkt'dampers for the carbon filter and manually operated dampers'that'allow the carbon filter to be bypassed;
-Inflatable seals on-man doors and truck door.
Area'Radiation Monitor (R-5) consisting of an extended range area monitor used to'measure the- area radiation fields of the Fuel Storage Building; and, Ductwork.' dampe'rs', and instrumentation needed to support system operation, : '
,.-, - ^--;-r
'During normal o6eration. the FSB air tempering units and the FSB exhaust fan operate, as necessary, to ventilate and, if necessary.
heat the FSB. Only one air tempering unit used to supply outside air to the south end of the FSB and the FSB exhaust fan is used to exhaust (continued) INDIAN POINT 3 B 3.7.13 -1 Re-v son 3
-Revision
FSBEVS B 3.7.13 BASES BACKGROUND (continued) air from the north end of the FSB through the roughing filters and HEPA filters and is released to the environment via the plant vent. 9 FSB air flow is directed from radiologically clean to less clean areas to prevent the spread of contamination. Additionally, the FSBEVS is designed so that the exhaust fan capacity is greater than the supply fan(s) capacity so that the FSB is normally maintained at a slight negative pressure. This ensures that ventilation air leaving the FSB passes through the filters and HEPA in the exhaust filtration unit and is released to the environment via the plant vent. When not handing irradiated fuel in the FSB, the carbon filter in the exhaust filtration unit is normally bypassed to extend the life of the charcoal. In this configuration, the manually operated charcoal filter bypass dampers are left open and the automatically operated charcoal filter face dampers (inlet and outlet dampers) are closed. During irradiated fuel handling activities in the FSB. the FSBEVS is operated as described above except that the manually operated charcoal filter bypass dampers are closed and the charcoal filter face dampers (inlet and outlet dampers) are opened. In this configuration, the FSB is still maintained at a slight negative pressure but all FSB ventilation exhaust is directed through the roughing filters, HEPA filters, and charcoal, filters and is released to the environment via the plant vent. FollowinQ an Area Radiation Monitor (R-5) signal or manual actuation to the emergency mode of operation, the ventilation supply fans stop automatically and the associated ventilation supply dampers close automatically. The charcoal filter face dampers (inlet and outlet dampers) open automatically, if not already open. Additionally, the rolling truck door. closes. if open, and the inflatable seals on the man doors and truck door are actuated. The FSB exhaust fan continues to operate. With the FSB ventilation .supply stopped and the FSB boundary secured, the FSB exhaust fan is capable of maintaining the FSB at a pressure . -0.5 inches water gauge with respect to atmospheric pressure with the exhaust flow rate
- 20.000 cfm.
Ventilation dampers required to establish the boundary or flow path (e.g.. air tempering unit ventilation supply inlet dampers) will fail-(continued) 0 INDIAN POINT 3 B 3.7.13 - 2 Revision 3
FSBEVS B 3.7.13 BASES BACKGROUND safe into the required emergency mode position. Note that the (continueed) inflatable 'seals'on man doors and truck door are not required for maintaining the FSB'at these required post accident conditions.
..A push button switch adjacent to the 95' elevation door leading to the Fan House allows.the Fuel Storage Building'Exhaust Fan to be
-momentarily shut'down and airremoved from the man door seal to allow
-* thedoor to be~opened for FSB ingress oregress when in the emergency mode of operation. The fan will automatically restart and the door is resealed after a :preset time has elapsed (approximately 30 seconds).
-The FSBEVS is discussed in the FSAR, Sections 9.5, and 14.2 (Refs. 1 and 2, respectively).
. . t 14 . . . I I APPLICABLE SAFETY ANALYSES The FSBEVCS design basis is established by the consequences of
- the limiting Design'Basis Accident (MBA). which is a fuel handling accident involving handling recently irradiated fuel.
The analysis for a fuel handling accident assumes that the FSB exhaust fan can maintain the FSB at'a slight negative pressure (i.e., < -0.125 inches water'gauge)'with respect to atmospheric pressure with the exhaust flow rate < 20,000'cfm. Under these 'conditions. all FSB ventilation exhaust is assumed to be directed through the roughing filters; HEPA filters,--and 'charcoal filters and is released to the environment via the plant vent"' This ensures that offsite post accident dose rates are within'required limits. Due to radioactive decay. FSBEVS is-only required to isolate during fuel handling -
- :-accidents involving handling' recently irradiated fuel (i.e., fuel that has occupied part of-a~critical reactor core'within the previous 84 hours).- This analysis is described in Reference 2.
The FSBEVS satisfies Criterion 3 of 10 CFR 50.36. I.(continued) INDIAWPOINT 3 B 3.7.13 - 3 7. Reviso Revision 3
FSBEVS B 3.7.13 BASES LCO This LCO requires that the Fuel Storage Building Emergency Ventilation System is OPERABLE and the FSB boundary is intact. This ensures that the required negative pressure is maintained in the FSB and FSB ventilation exhaust is directed through the roughing filters. HEPA filters, and charcoal filters and is released to the environment via the plant vent. Failure of the FSBEVS or the FSB boundary could result in the atmospheric release from the fuel'storage building exceeding the 10 CFR 50.67 (Ref. 3) limits in the event of a fuel handling accident involving handling recently irradiated fuel. The FSBEVS is considered OPERABLE when the individual components necessary to control exposure in the fuel storage building are OPERABLE. FSBEVS is considered OPERABLE when its associated:
- a. Exhaust fan is OPERABLE;
- b. Roughing filter. HEPA filter and charcoal adsorber are not excessively restricting flow, and are capable of performing their filtration function;
- c. Ductwork and dampers are OPERABLE as needed to ensure air circulation can be-maintained through the filter;
- d. Ventilation supply fan trip function and ventilation supply isolation dampers closure function are OPERABLE or secured in incident position; and
- e. FSBEVS charcoal filter bypass dampers are closed and leak tested.
The inflatable seals on man doors and truck, door are not required for maintaining the FSB at these required post accident conditions. Additionally, the FSBEVS is not rendered inoperable when the FSBEVS exhaust fan is momentarily shut down and air removed from the door seal to allow the door to be opened for FSB ingress or egress when in the emergency mode of operation. Requirements for the OPERABILITY of the Area Radiation Monitor (R-5) and associated instrumentation that initiates the FSBEVS are addressed in LCO 3.3.8. "Fuel Storage Building Emergency Ventilation System Actuation Instrumentation." (continued) INDIAN POINT 3 B 3.7.13 - 4 Revision 3
FSBEVS 8 3.7.13 BASES LCO Requirements for leak testing the FSBEVS charcoal filter bypass (continued) dampers following closure are governed by the IP3 FSAR. APPLICABILITY; -During movement of iecently irradiated fuel in the fuel storage
-building, the'FSBEVS is required to be OPERABLE to mitigate the consequences of thellimiting fuel handling accident.
ACTIONS A.1 When the FSBEVS is inoperable during movement of recently irradiated fuel assemblies in-the fuel'storage building, action must be taken to
' place the unit in'$a condition in which'the. LCO does not apply. Action must be taken' immediatelyto suspend movement of recently irradiated fuel assemblies inrthe fuel storage building. This does not preclude
-the movement of fuel to'a safe position.
.~. .4 .- . .
SURVEILLANCE REQUIREMENTS SR 3.7.13,1 This SR requires periodic verification that the FSBEVS charcoal filter bypass dampers are installed and leak tested. This SR is performed by a visual verifictationthat the bypass dampers are installed and an administrative verification that required leak testing was performed following the'last..installation of the dampers. Requirements for leak
" testing the'-FSBEVSicharcoal filter bypass,dampers following closure are governed by the IP3'FSAR.'
This SR is performed prior to movement of recently irradiated fuel assemblies in the fuel storage building, and once per 92 days thereafter. The 92 day Frequency is appropriate because the bypass dampers are operated under administrative controls which provide a high degree of assurance that the dampers will remain in the required position. This Frequency has been shown to be acceptable through operating experience. (continued) INDIAN POINT 3 -B3.7.13 - 5 'Revision
'Rv'sin 3
FSBEVS B 3.7.13 BASES SURVEILLANCE REOUIREMENTS (continued) SR 3.7.13.2 Standby systems should be checked periodically to ensure that they function properly. As the environmental and normal operating conditions on this system are not severe, testing the FSBEVS once every 31 days provides an adequate check on this system. Systems are operated for > 15 minutes to demonstrate the function of the system. The 31 day Frequency is based on the known reliability of the equipment. SR 3.7.13.3 This SR verifies that the required FSBEVS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The FSBEVS filter tests are in ac6ordance with the applicable portions of Regulatory Guide 1.52 (Ref. 4) as specified in the VFTP. The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). Specific test frequencies and additional information are discussed in detail in the VFTP. SR 3.7.13.4 This SR verifies that the FSBEVS starts and operates on an actual or simulated actuation signal. The 92 day-Frequency ensures that the SR is performed'within a short'time prior to a potential need for the FSBEVS and allows'the SR to be performed only once prior to or during a refueling outage. This'SR Frequency is based on the demonstrated reliability of the system. (continued) INDIAN POINT 3 B 3.7.13 - 6 Revision 3
FSBEVS B 3.7.13 BASES SURVEILLANCE REOUIREMENTS (continued) SR 3.7.13.5 This SR verifies the integrity of the fuel storage building enclosure. The ability of the fuel building to maintain negative pressure with respect to potentially uncontaminated adjacent areas is periodically tested to verify proper function of the FSBEVS. During the normal mode of operation, the FSBEVS is designed to maintain a slight negative pressure in the fuel storage building, to prevent unfiltered LEAKAGE. This test verifies that the FSB exhaust fan can maintain the FSB at a slight negative pressure (i.e., < -0.125 inches water gauge) with respect to atmospheric pressure with the exhaust flow rate < 20,000 cfm during a fuel handling accident. The Frequency of 24 months is consistent with the guidance provided in NUREG-0800, Section 6.5.1 (Ref. 5). REFERENCES 1. FSAR. Section 9.5.
- 2. FSAR, Section 14.2.
- 3. 10 CFR 50.67.
- 4. Regulatory Guide 1.52 (Rev. 2).
- 5. NUREG-0800, Section 6.5.1, Rev. 2, July 1981.
I INDIAN POINT 3 B 3.7..13 - 7 Revision 3
Secondary Specific Activity B 3.7.17 B 3.7 PLANT SYSTEMS B 3.7.17 Secondary Specific Activity BASES. BACKGROUND Activity in'the secondary coolant results from steam generator tube outleakage from the Reactor Coolant System (RCS). Under steady'state'conditions, the activity is primarily iodines with relatively short 'half lives and, thus, indicates current conditions. During transients, 1-131 spikes have been observed as well as increased releases of some noblegases. Other fission product isotope's,; aswell as activated corrosion products in lesser amounts, may'also be'found in the secondary coolant.
' limit on secondary coolant specific activity during power A
operation minimizes releases to the environment because of normal
'operation, anticipated operational occurrences, and accidents.
This limit is lower than the activity value that might be expected from a 1 gpm tubeleakk(LCO 3.4.13. mRCS Operational LEAKAGE") of primary coolant 'itthe limit of 1.0 pCi/gm (LCO 3.4.16. 'RCS Specific Activity'4'. 'The steam line failure is assumed to result in the-release `of tthe noble gas'and iodine activity contained in
'the steam generator'lnventory, the feedwater, and the reactor coolant LEAKAGE. Most of the iodine isotopes have short half lives, (i.e.,. < 20 hours).-
Operating'a unit'-at the allowable limits could result in a 2 hour exclusion area boundary (EAB) or site boundary exposure of a small fraction (i.e.. 10X) of the 10 CFR 50.67 (Ref. 1) limits or the limits established as the NRC staff approved licensing basis. APPLICABLE-SAFETY ANALYSES'-' iThe accident analysis of the' main steam line break (MSLB), as discussed-in theFSAR, Chapter 14.2 (Ref. 2) assumes the initial secondary coolant specific activity to have a radioactive isotope concentration of 0.10 pCi/gm DOSE EQUIVALENT 1-131. This (continued) INDIAN POINT 3 '-B-J.4.17--:1 Revision I
Secondary Specific Activity B 3.7.17 BASES APPLICABLE SAFETY ANALYSES (continued) assumption is used in the analysis for determining the radiological consequences of the postulated accident. The accident analysis, based on this and other assumptions, shows that the radiological consequences of an MSLB do not exceed a small fraction of the EAB (i.e., site boundary) limits (Ref. 1) for whole body and thyroid dose rates. With the loss of offsite power, the remaining steam generators are available for core decay heat dissipation by venting steam to the atmosphere through the MSSVs'and steam generator atmospheric dump valves (ADVs). The Auxiliary Feedwater System supplies the necessary makeup to the steam generators. Venting continues until the reactor coolant temperature and pressure have decreased sufficiently'for the Residual Heat Removal System to complete the cooldown. In the evaluation of the radiological consequences of this accident, the activity released from the steam generator connected to the failed steam line is assumed to be released directly to the environment. The unaffected steam generator is assumed to 5 discharge steam and any entrained activity through the MSSVs and ADVs during the event. Credit is taken in the analysis for activity plateout or retention; however, the resultant radiological consequences represent a conservative estimate of the potential integrated dose due to the postulated steam line failure. Secondary specific activity limits satisfy Criterion 2 of 10 CFR 50.36. LCO As indicated in the Applicable Safety Analyses, the specific activity of the secondary coolant is required to be s 0.10 pCi/gm DOSE EOUIVALENT 1-131 to limit the radiological consequences of a Design Basis Accident (DBA) to a small fraction of the required limit (Ref. 1). (continued) 1) INDIAN POINT 3 B 3.7.17-2 Revision 1 i
Secondary Specific Activity B 3.7.17 BASES iCO Monitoring the specific activity of the secondary coolant ensures (continued) that when secondary specific activity limits'are exceeded,- appropriate actions are taken in a timely manner to place-the unit in an operational MODE that would minimize the radiological consequences of a DBA. 'APPLICABILITY ' In MODES 1, 2. 3, and n4,the limits on secondary specific activity apply'due to the pot0ential'for secondary steam releases to the atmosphere. In MODES 5 and '6,5 the steam generators are not normally used for heat removal. Both the RCS and steam generators are depressurized. and primary to secondary LEAKAGE is minimal. Therefore, monitoring of secondary specific activity is'not required. ACTIONS A.1 and A.2 DOSE EOUIVALENT 1-131 exceeding the allowable value in the secondary coolant, is an indication of a problem in the RCS and contributes to increased post accident doses. If the secondary specific activity cannot be restored to within limits within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours. and in MODE 5 within 36 hours.' The'allowed Completion Times are reasonable. based on operating-experience,!to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE REOUIREMENTS SR 3.7.17.1 This SR verifies that the secondary specific activity is within the limits of the'accident analysis. A gamma isotopic analysis of the secondary coolant, which determines DOSE EOUIVALENT 1-131, (continued) INDIAN POINT 3 B -3.7.17-3 Revision 1
Secondary Specific Activity B 3.7.17
^i BASES SURVEILLANCE REQUIREMENTS SR 3.7.17.1 (continued) confirms the validity of the safety analysis assumptions as to the source terms in post accident releases. It also serves to
.identify and trend any unusual isotopic concentrations that might indicate changes in reactor coolant activity or LEAKAGE. The 31 day Frequency is based on the detection of increasing trends of the level of DOSE EQUIVALENT 1-131. and allows for appropriate action to be taken to maintain levels below the LCO limit.
REFERENCES 1. 10 CFR 50.67.
- 2. FSAR. Chapter 14.2.
. I I) 3/4)
INDIAN POINT 3 B 3.7.17-4 Revision I i
Containment Penetrations B 3.9.3 B 3.9 REFUELING OPERATIONS B 3.9.3 Containment Penetrations BASES - : .... I3ACKGROUND - 'During movement of 'recently irradiated fuel assemblies within
-'containment, areleaseof fission product radioactivity within containment will be'restrifted from escaping to the environment when the LCO requirements 'are met. In MODES 1, 2, 3. and 4, this is accomplished by maintaining containment OPERABLE as described in LCO 3.6.1. Containment." In MODE 6. the potential for containment pressurization as a `result of an accident is not likely; therefore, requirements to isolate the containment from the outside atmosphere
',can be less stringent. The LCO requirements are referred to as
'containment closure" rather than-containment OPERABILITY."
Containment'.closure'mens 'that all potential escape paths are closed, except for the'OPERABLE Purge System Penetration. Since there is no potential for containment pressurization. the Appendix J leakage criteria and tests'-are'nottrequired. The containment-servesito'contain fission product radioactivity that may be released from the-reactor core following an accident, such that offsite radiation exposures are maintained well within the requirements of 2O'CFR 50.67. Accident Source Term. Additionally, the containment provide -radiation shielding from the fission products that may be-present"i6 the'containment atmosphere following accident conditions. The containment equioment'hatch, which is part of the containment pressure boundary. provides a means for moving large equipment and components into -and out of containment. During movement of recently
.-'- irradiated fuel assemblies within containment, the equipment hatch must be held -inplace by'at least four bolts. :Good engineering practice dictates that.the bolts required by this' LCO be approximately
'equally spaced. -': X -- .
;In lieu of mnaintaining:the equipment hatch in place for containment closure, a'temporarry :`closure device may be used to maintain
' containme'nt closure during movement of recently irradiated fuel (continued)
INDIAN POINT 3 B 3.9.3 -- I I- ';,Revi si on 2
I Containment Penetrations B 3.9.3 BASES 0
- Jl BACKGROUND assemblies within containment. The temporary closure device may (continued) provide penetrations for temporary services or personnel access. The temporary closure device will be designed to withstand a seismic event and designed to withstand a pressure which ensures containment closure during refueling operations. The closure device will provide the same level of protection as that of the equipment hatch for the fuel handling accident involving handling recently irradiated fuel by restricting direct air, flow from the containment to the environment.
The containment air locks, which are also part of the containment pressure boundary, provide a means for personnel access during MODES
- 1. 2. 3. and 4 unit operation in accordance with LCO 3.6.2.
"Containment Air Locks." Each-air lock has a door at both ends. The doors are normally interlocked to prevent simultaneous opening when containment OPERABILITY is required. During periods of unit shutdown when containment closure is not required. the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary. During movement of recently irradiated fuel assemblies within containment.
containment closure is required; therefore, the door interlock mechanism may remain disabled, but one air lock door must always remain capable of being closed. The requirements for containment penetration closure ensure that a l release of fission product radioactivity within containment will be restricted to within regulatory limits. The Containment Purge System consists of the 36-inch containment purge supply and exhaust ducts. The supply system includes roughing filters, heating coils, fan and a containment penetration with two butterfly valves for isolation. The exhaust system includes a containment penetration with two butterfly valves for isolation and can be aligned to discharge to the atmosphere through the plant vent either directly or through the Containment Purge Filter System (i.e., a filter bank with roughing, HEPA and charcoal filters). The Containment Purge System must be isolated when in Modes 1. 2. 3 or 4 in accordance with requirements established in LCO 3.6.3, Containment Isolation Valves. In Modes 5 and 6. the Containment Purge System may be used for containment ventilation. When open, the Containment Purge System isolation valves are capable of closing in response to the detection of high radiation levels in accordance with requirements established in LCO 3.3.6, Containment Purge and Pressure Relief Isolation Instrumentation (Ref. 1). (continued) 3 INDIAN POINT 3 B 3.9.3 - 2 Revision 2 I
Containment Penetrations B 3.9.3 BASES . BACKGROUND The Containment PressureRelief Line'(i.e.. Containment Vent) consists (continued) of a single ]O-inch-containment vent line that is used to handle normal-pressure.changes'in the Containment when in Modes 1, 2, 3 and 4
-(Ref. 1). The Containment Pressure Relief Line is equipped with three quick-closing butterfly type isolation valves, one inside and two outside-the containmenit which isolate automatically in accordance with
-requirements
. established'in LCO 3.3.2. 'Engineered Safety Feature Actuation-System (ESFAS) Instrumentation". and LCO 3.3.6. 'Containment Purge System and Pressure Relief Line Isolation Instrumentation." The Containment.Pres'sure Relief,'Line discharges to the atmosphere via the Containment Auxiliary'Charcoal Filter System (i.e.. a filter bank with roughing,. HEPA andfcharcoal filters).
- The other containment penetrations that provide direct access from containment atmbsphere to outside atmosphere must be isolated on at least one side or may be unisolated under administrative control.
Isolation may be achieved by an OPERABLE automatic isolation valve, or by a manual isolation :valve.-blind flange, or equivalent. Equivalent isolation methods must be approved and may include use of a material that can provide a temporary, atmospheric pressure, ventilation
- barrier-for the other containment penetrations during fuel movements.
APPLICABLE SAFETY ANALYSES - '; During movement of-'recently irradiated fuiel assemblies within containment, the most severe radiological consequences result from a I..-fuel handling accident involving handling recently irradiated fuel.
'The fuel handling;accident is a'Postulated event that involves damage to irradiated fuel '(Ref. 5).- Fuel handling accidents, analyzed in Reference 2. include dropping a single irradiated fuel assembly and
-.-handling-tool orra heavy object onto other irradiated fuel assemblies.
The release of-radioactivity from the containment following a fuel
.handling accident.is limited by the following:
a) The requirements of LCO 3.9.6. "Refueling Cavity Water Level;"
*b) the'minimum decay'time of 84 hours prior to moving irradiated fuel; and,;'":
c) the use of'administrative controls'to ensure prompt closure of any containment openings'with direct'access from the containment atmosphere to the outside atmosphere. Containment penetrations satisfy Criterion 3 of 10 CFR 50.36. (continued) INDIAN POINT 3 B 3.9.3 - 3 : I Revision,2
I Containment Penetrations B 3.9.3 BASES LCO This LCO limits the consequences of a fuel handling accident involving handling recently irradiated fuel in containment by limiting the potential escape paths for fission product radioactivity released within containment. The LCO'requires any penetration providing direct access from the containment atmosphere to the outside atmosphere to be closed except for the OPERABLE containment purge system penetrations. For the OPERABLE containment purge system penetrations, this LCO ensures that these penetrations are isolable by the Containment Purge isolation instrumentation. The containment personnel airlock doors and the personnel access door in the equipment hatch closure plate may be open during movement of irradiated fuel provided that at least one door in each opening is capable of being closed in the event of a fuel handling accident. In addition, the LCO is modified by a Note allowing penetration flow paths with direct access from the containment atmosphere to the outside atmosphere to be unisolated under administrative controls. 'Administrative controls, consistent with Appendix B of Regulatory Guide 1.183 (Reference 3), are required to assure that, in the event of a fuel handling accident inside containment, at least'one door in each personnel access opening will be clcsed following an evacuation of containment, and penetration flow paths unisolated under administrative control will be promptly closed. The administrative controls assure that:
- 1. appropriate personnel are aware of the open status of the doors and penetration flow paths during movement of irradiated fuel assemblies within containment, and
- 2. specified individuals are designated and readily available to direct and perform isolation of affected openings in the event of a fuel handling accident, and
- 3. any obstructions (e.g., cables and hoses) that would prevent rapid closure of an open flow path can be quickly removed. Any cables or hoses to be disconnected should not be supplying services that support personnel safety (e.g., breathing air), and
- 4. during fuel handling operations and core alterations, ventilation system and radiation monitor availability should be assessed with the goal of minimizing the potential for radioactive releases, following a potential accident, even further below that provided by the natural decay that occurs following reactor shutdown.
(continued) INDIAN POINT 3 B 3.9.3-4 Revision 2 i
Containment Penetrations B 3.9.3 BASES LCO (continued) The administrative controls must also be consistent with any pertinent assumptions in the dose analysis for the fuel handling accident. Note that the Indian Point 3 Final Safety Analysis Report (Reference 2) specifies:' "No movement of irradiated fuel in the reactor is made until the reactor has'been subcritical for at'least 84 hours." Therefore, theFSAR prohibits movement of any fuel that can be classified as "recertly irradiated." APPLICABILITY The containment penetration requirements are applicable during movement of recently irradiated fuel assemblies within containment because this is when there Jis a potential for the limiting fuel handling accident; In MODES 1,-2, 3. and 4. containment penetration' requirements are-addressed by LCO'3.6.1. In MODES 5 and 6. when move-ent of recently irradiated fuel assemblies within containment'is'nit'kbing conducted, the potential for the limiting fuel handling accideht'does not exist. Therefore, under these conditions no Technical Specification requirements are placed on containment penetration' status. However, if personnel access doors or containment penetration flow paths are unisolated during any movement of irradiated fuel assemblies in containment, administrative controls are established to ensure prompt closure of these openings in the event of a fuel handling accident.' . ACTIONS A.1 ' ' ; - If-the containment equipm'enthatch, air'locks, 'or any containment penetration that provides direct access from the containment atmosphere to the outside atmosphere is not in.the required status, including the Containment Purge system isolation instrumentation not capable of automatic'actuation when the purge and exhaust valves are open, the unit must be placed in a condition where the isolation function is not needed. This is accomplished by immediately suspending the movement of recently irradiated fuel assemblies within containment. Performance of these actions shall not preclude completion of movement of a component to a safe position. (continued) INDIAN POINT 3 B 3.9.'3 - 5 : . Revision 2
I Containment Penetrations B 3.9.3 BASES SURVEILLANCE REOUIREMENTS SR 3.9.3.1 This Surveillance demonstrates that each of the containment penetrations is either.closed or capable of-being closed under administrative control. The Surveillance on the open purge and exhaust valves will demonstrate that the valves are not blocked from closing. Also the Surveillance will demonstrate that each valve operator has motive power.- which will ensure that each valve is capable of being closed by an OPERABLE automatic containment purge and exhaust isolation signal. The Surveillance is performed within 7 days of movement of recently irradiated fuel assemblies within containment. The Surveillance interval is selected to be commensurate with the 84-hour decay time that defines recently irradiated fuel. A surveillance before the start of refueling operations will not have to be repeated during the applicable period for this.LCO. As'such, this Surveillance ensures that a postulated fuel handling accident that releases fission product radioactivity within the containment will not result in a release of fission product radioactivity to th-e environment. SR 3.9.3.2 This Surveillance demonstrates that each containment purge and exhaust valve actuates to its isolation position on an actual or simulated high radiation signal. The 92-day Frequency ensures that this SR is performed prior to this function being required and periodically thereafter. In LCO 3.3.6. the Containment Purge system isolation instrumentation requires a CHANNEL CHECK every 12 hours and a COT every 92 days to ensure the channel OPERABILITY during refueling operations. Every 24 months a CHANNEL CALIBRATION is performed. SR 3.6.3.5 demonstrates that the isolation time 6f'each valve is in accordance with the Inservice Testing Program requirements. (continued) INDIAN POINT 3 B 3.9.3- 6 Revision 2 1
Containment Penetrations B 3.9.3 BASES SURVEILLANCE REOUIREMENTS SR 3.9.3.2 (continued) These Surveillances performed during MODE 6 will ensure that the valves are capable of closing after a postulated fuel handling accident to limit a release of fission product radioactivity-fromn the containment. REFERENCES 1. FSAR. Section 5.3.
- 2. FSAR, Section 14.2.
- 3. Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors". July 2000.
- 4. 10 CFR 50 Appendix A. "General Design Criteria". Criterion 19.
Control Room.
- 5. Safety Evaluation Report (SER) for IP3 Amendment 224.
INDIAN POINT 3 8 3.9.3-7 Revision 2}}