Text

Technical Specification Bases
	ML052370231
Person / Time
Site:	Indian Point
Issue date:	08/08/2005
From:	; Entergy Nuclear Indian Point 3
To:	; Office of Nuclear Reactor Regulation
References
	IP-SMM-AD-103, Rev 0
	Download: ML052370231 (145)
	v • d • e

IPEC SITE QUALITY RELATED IP-SMM-AD-103 Revision 0

~E i7te rgy MANAGEMENT ADMINISTRATIVE PROCEDURE MANUAL INFORMATIONAL USE Page 13 of 21 ATTACHMENT 10.1 SMM CONTROLLED DOCUMENT TRANSMITTAL FORM SITE MANAGEMENT MANUAL CONTROLLED DOCUMENT TRANSMITTAL FORM - PROCEDURES.

Page 1 of 1 E--ntergy CONTROLLED DOCUMENT TRANSMITTAL FORM - PROCEDURES TO: DISTRIBUTION DATE: 8108105 PHONE NUMBER: 271-7057 FROM: IPEC DOCUMENT CONTROL The Document(s) identified below are forwarded for use. In accordance with IP-SMM-AD-1 03, please review to verify receipt, incorporate the document(s) into your controlled document file, properly disposition superseded, void, or inactive document(s). Sign and return the receipt acknowledgement below within fifteen (15) working days.

AFFECTED DOCUMENT: 1P3 ITS / BASES I TRM DOC# l REV# TITLE INSTRUCTIONS

- - - - FOLLOW THE ATTACHED INSTRUCTIONS*********

- - - - PLEASE NOTE EFFECTIVE DATE***********

RECEIPT OF THE ABOVE LISTED DOCUMENT(S) IS HEREBY ACKNOWLEDGED. I CERTIFY THAT ALL SUPERSEDED, VOID, OR INACTIVE COPIES OF THE ABOVE LISTED DOCUMENT(S) IN MY POSSESSION HAVE BEEN REMOVED FROM USE AND ALL UPDATES HAVE BEEN PERFORMED IN ACCORDANCE WITH EFFECTIVE DATE(S) (IF APPLICABLE) AS SHOWN ON THE DOCUMENT(S).

NAME (PRINT) SIGNATURE DATE CC# S-I 4~QoK

21-LJUL-05 Page: 87 DISTRIBUTION CONTROL LIST (bŽcument Name: ITS/BASES/TRM CCNAME NAME DEPT LOCATION 1 OPS PROCEDURE GROUP SUPV. OPS PROCEDURE GROUP IP2 3 PLANT MANAGER'S OFFICE UNIT 3(UNIT 3/IPEC ONLY) IP2 5 CONTROL ROOM & MASTER OPS(3PT-D001/6(U3/IPEC) IP3(ONLY) 11 RES DEPARTMENT MANAGER RES (UNIT 3/IPEC ONLY) 45-4-A 19 STEWART ANN LICENSING GSB-2D 20 CHEMISTRY SUPERVISOR CHEMISTRY DEPARTMENT 45-4-A 21 TSC(IP3) EEC BUILDING IP2 22 SHIFT MGR.(LUB-001-GEN) OPS (UNIT 3/IPEC ONLY) IP3 23 LIS LICENSING & INFO SERV OFFSITE 25 SIMULATOR TRAIN(UNIT 3/IPEC ONLY) 48-2-A 28 RESIDENT INSPECTOR US NRC 88' ELEVATION IP2 32 EOF E-PLAN (ALL EP'S) EOF 47 CHAPMAN N BECHTEL OFFSITE 50 TADEMY L. SHARON WESTINGHOUSE ELECTRIC OFFSITE 55 GSB TECHNICAL LIBRARY A MCCALLION/IPEC & IP3 GSB-3B 61 SIMULATOR TRAIN(UNIT 3/IPEC ONLY) 48-2-A 69 CONROY PAT LICENSING/ROOM 205 GSB-2D 99 BARANSKI J (ALL) ST. EMERG. MGMT. OFFICE OFFSITE 106 SIMULATOR INSTRUCT AREA TRG/3PT-DO01-DO06 ONLY) #48 164 CONTROL ROOM & MASTER OPS (3PT-D001/6 (U3/IPEC) IP3(ONLY) 207 TROY M PROCUREMENT ENG. GSB-4B 273 FAISON CHARLENE NUCLEAR LICENSING WPO-12 319 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 354 L.GRANT(LRQ-OPS/TRAIN) .LRQ (UNIT 3/IPEC ONLY) #48 357 L.GRANT(ITS/INFO ONLY) TRAINING - ILO CLASSES 48-2-A 424 GRANT LEAH (9 COPIES) (UNIT 3/IPEC ONLY) #48 474 OUELLETTE P ENG., PLAN & MGMT INC OFFSITE 483 SCHMITT RICHIE MAINTENANCE ENG/SUPV 45-1-A 484 HANSLER ROBERT REACTOR ENGINEERING 72'UNIT 2 489 CLOUGHNESSY PAT PLANT SUPPORT TEAM GSB-3B 492 FSS UNIT 3 OPERATIONS K-IP-I210 493 OPERATIONS FIN TEAM 33 TURBIN DECK 45-1-A 494 AEOF/A.GROSJEAN(ALL EP'S) E-PLAN (EOP'S ONLY) WPO-12D 495 JOINT NEWS CENTER EMER PLN (ALL EP'S) EOF 496 L.GRANT(LRQ-OPS/TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 497 L.GRANT(LRQ-OPS/TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 500 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 501 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 512 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48 513 L.GRANT (LRQ-OPS TRAIN) LRQ (UNIT 3/IPEC ONLY) #48

'518 DOCUMENT CONTROL DESK NRC (ALL EP'S) OFFSITE 527 MILIANO PATRICK NRC/SR. PROJECT MANAGER OFFSITE 529 FIELDS DEBBIE OUTAGE PLANNING IP3/OSB

INDIAN POINT 3 TECHNICAL SPECIFICATION BASES INSTRUCTIONS FOR UPDATE: 17-08/10105 Pages are to be inserted into your controlled copy of the IP3 Technical Specifications Bases following the instructions listed below. The TAB notation indicates which section the pages are located.

Remove Page

Insert Page TAB - List Of Effective Sections List of Effective Sections, Rev. 16 List of Effective Sections, Rev. 17 (4 pages) 1 (5 pages)

TABLE OF CONTENTS TOC, Rev. 1 l TOC, Rev. 2 (4 pages) 1(4 pages)

TAB 3.0 - LCO AND SR APPLICABILITY B 3.0, Rev. 1 l B 3.0, Rev. 2 (15 pages) 1(16 pages)

TAB 3.3 - INSTRUMENTATION B 3.3.3, Rev. 2 B 3.3.3, Rev. 3 (19 pages) (18 pages)

B 3.3.4, Rev. 0 B 3.3.4, Rev. 1 (7 pages) (6 pages)

TAB 3.4 - REACTOR COOLANT SYSTEM B 3.4.11, Rev. 0 B 3.4.11, Rev. 1 (8 pages) (7 pages)

B 3.4.12, Rev. 1 B 3.4.12, Rev. 2 (20 pages) (19 pages)

B 3.4.15, Rev. 2 B 3.4.15, Rev. 3 (7 pages) (7 pages)

B 3.4.16, Rev. 1 B 3.4.16, Rev. 2

( pages) (6 pages)

TAB 3.5 - ECCS B 3.5.3, Rev. 0 l B 3.5.3, Rev. 1 (4 pages) 1(4 pages)

TAB 3.6 - CONTAINMENT SYSTEMS B 3.6.8, Rev. 0 B 3.6.8, Rev. 1 (6 Pages) I (1 pages)

TAB 3.7- PLANT SYSTEMS B 3.7.4, Rev. 0 B 3.7.4, Rev. 1 (5 pages) (4 pages)

B 3.7.5, Rev. 2 B 3.7.5, Rev. 3 (9 pages) (9 pages)

B 3.7.11, Rev. 4 B 3.7.11, Rev. 5 (7 pages) (7 pages)

TAB 3.8 - ELECTRICAL POWER B 3.8.1, Rev. I B 3.8.1, Rev. 2 (32 pages) 1(30 pages)

Page 1 of 1

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE SECTIONS BASES NUMBER EFFECTIVE BASES l R NUMBER l EFFECTIVE SECTION REV OF PAGES DATE SECTION REV OFPAGESJ I ATE TbI of Cnt 2 4 08/10/2005 I B 3.6 CONTAINMENT -i` -

B 2.0 SAFETY LIMITS-, B 3.6.1 0 5 03/19/2001 B 2.1.1 1 4 T06/03/2005 B 3.6.2 1 9 06/03/2005 B 2.1.2 1 4 06/03/2005 B 3.6.3 0 17 03/19/2001

B 3.0 LCO AND SR APPLICABILITY B 3.6.4 0 3 03/19/2001 B 3.0 l 2 16 [ 08/10/2005 I B 3.6.5 1 5 06/20/2003 B 3.1 REACTIVITY CONTROL'.-: - ^ B 3.6.6 2 13 06/03/2005 B 3.1.1 1 6 06/03/2005 B 3.6.7 1 6 06/03/2005 B 3.1.2 0 7 03/19/2001 B 3.6.8 1 1 08/10/2005 I B 3.1.3 1 7 10/27/2004 B 3.6.9 1 8 06/03/2005 B 3.1.4 0 13 03/19/2001 B 3.6.10 1 12 06/03//2005 B 3.1.5 0 5 03/19/2001 - B 3.7 PLANT SYSTEMS B 3.1.6 0 6 03/19/2001 B 3.7.1 2 6 06/03/2005 B 3.1.7 0 8 03/19/2001 B 3.7.2 1 10 06/03/2005 B 3.1.8 0 7 03/19/2001 B 3.7.3 1 7 05/18/2001 B 3.2 POWER DISTRIBUTION LIMITS t-, B 3.7.4 1 4 08/10/2005 B 3.2.1 0 7 03/19/2001 B 3.7.5 3 9 08/10/2005 B 3.2.2 1 7 06/03/2005 B 3.7.6 2 4 06/03/2005 B 3.2.3 0 9 03/19/2001 B 3.7.7 1 4 12/17/2004 B 3.2.4 0 7 03/19/2001 B 3.7.8 1 7 06/03/2005

.B 3.3 INSTRUMENTATION' B 3.7.9 2 9 06/03/2005 B 3.3.1 2 58 06/03/2005 B 3.7.10 1 3 06/03/2005 B 3.3.2 4 45 04/08/2005 B 3.7.11 5 7 08/10/2005 I B 3.3.3 3 18 08/10/2005 B 3.7.12 0 4 03/19/2001 B 3.3.4 1 6 08/10/2005 B 3.7.13 3 7 06/03/2005 B 3.3.5 1 6 10/27/2004 B 3.7.14 1 3 04/08/2005 B 3.3.6 1 8 04/08/2005 B 3.7.15 0 5 03/19/2001 B 3.3.7 1 6 04/08/2005 B 3.7.16 0 6 03/19/2001 B 3.3.8 2 4 06/03/2005 B 3.7.17 1 4 06/03/2005

-B 3.4 REACTOR COOLANT SYSTEM* ! B 3.8 ELECTRICAL POWER ,>,`,

B 3.4.1 1 6 06/03/2005 B 3.8.1 2 30 08/10/2005 B 3.4.2 0 3 03/19/2001 I B 3.8.2 0 7 03/19/2001 B 3.4.3 2 9 06/03/2005 B 3.8.3 0 13 03/19/2001 B 3.4.4 0 4 03/19/2001 B 3.8.4 l 1 11 01/22/2002 B 3.4.5 0 6 03/19/2001 B 3.8.5 0 4 03/19/2001 B 3.4.6 1 6 06/03/2005 B 3.8.6 0 8 03/19/2001 B 3.4.7 0 7 03/19/2001 B 3.8.7 1 8 06/20/2003 B 3.4.8 0 4 03/19/2001 B 3.8.8 1 4 06/20/2003 B 3.4.9 3 5 06/03/2005 B 3.8.9 2 14 06/20/2003 B 3.4.10 0 5 03/19/2001 B 3.8.10 0 l 4 l 03/19/2001 B 3.4.11 1 7 08/10/2005 - ' 'B 3.9 REFUELING OPERATIONS - ::<t' B 3.4.12 2 19 08/10/2005 B 3.9.1 0 . 4 03/19/2001 B 3.4.13 3 6 06/03/2005 B 3.9.2 0 4 03/19/2001 B 3.4.14 0 10 03/19/2001 B 3.9.3 2 7 06/03/2005 B 3.4.15 3 7 08/10/2005 B 3.9.4 0 4 03/19/2001 B 3.4.16 2 6 08/10/2005 B 3.9.5 0 4 03/19/2001

______ ~ B 3.5 ECCS _ _ _ _ B 3.9.6 2 3 04/08/2005 B 3.5.1 1 10 10/27/2004 B 3.5.2 1 13 06/03/2005 B 3.5.3 1 4 08/10/2005 B 3.5.4 0 9 03/19/2001 I INDIAN POINT 3 Page 1 of 5 Revision 17

TECHNICAL SPECIFICATION BASES REVISION HISTORY REVISION HISTORY FOR BASES AFFECTED EFFECTIVE SECTIONS REV DATE DESCRIPTION Initial issue of Bases derived from NUREG-1431, in ALL 0 03/19/01 conjunction with Technical Specification Amendment 205 for conversion of 'Current Technical Specifications' to

'Improved Technical Specifications'.

- : BASES UPDATE PACKAGE 01-031901 ,,

0Changes regarding containment sump flow monitor per B 3.4.13 1 03/19/01 NSE 01-3-018 LWD Rev 0.

B 3.4.15 Change issued concurrent with Rev 0.

- BASES UPDATE PACKAGE 02-051801 -- :;

Table of Contents 1 05/18/01 Title of Section B 3.7.3 revised per Tech Spec Amend 207 B 3.7.3 1 05/18/01 Implementation of Tech Spec Amend 207

___________________ -,BASES UPDATE PACKAGE 03-:111901 Correction to statement regarding applicability of Function B 3.3.2 1 11/19/01 5, to be consistent with the Technical Specification.

Changes to reflect reclassification of certain SG narrow B 3.3.3 1 11/19/01 range level instruments as QA Category M per NSE 97 439, Rev 1.

Changes to reflect installation of a new control room alarm B 3.4.13 2 11/19/01 for 'VC Sump Pump Running'. Changes per NSE 01 B 3.4.15 018, Rev 1 and DCP 01-3-023 LWD.

Clarification of allowable flowrate for CRVS in 'incident B 3.7.11 1 11/19/01 mode with outside air makeup.'

A I. BASES UPDATE'PACKAGE 04-012202":¢*.9 < '

B 3.3.2 2 01/22/02 Clarify starting logic of 32 ABFP per EVL-01-3-078 MULTI, CRev 0.

B 3.8.1 1 01/22/02 Provide additional guidance for SR 3.8.1.1 and Condition Statements A.1 and B.1 per EVL-01-3-078 MULTI, Rev 0.

B 3.8.4 1 01/22/02 Revision of battery design description per plant modification and to reflect Tech Spec Amendment 209.

B 3.8.9 1 01/22/02 Provide additional information regarding MCC in Table B 3.8.9-1 per EVL-01-3-078 MULTI, Rev 0.

___________ >BASES

____ UPDATE-PACKAGE'05-093002. i>&>Jy*o .4wf, , ;

B 3.0 1 09/30/02 Changes to reflect Tech Spec Amendment 212 regarding delay period for a missed surveillance. Changes adopt TSTF 358, Rev 6.

B 3.3.1 1 09/30/02 Changes regarding description of turbine runback feature per EVAL-99-3-063 NIS.

B 3.3.3 2 09/30/02 Changes to reflect Tech Spec Amendment 211 regarding CETs and other PAM instruments.

B 3.7.9 1 09/30/02 Changes regarding SWN 1 and -2 valves per EVAL-00-3-095 SWS, Rev 0.

INDIAN POINT 3 Page 2 of 5 Revision 17

TECHNICAL SPECIFICATION BASES REVISION HISTORY AFFECTED l EFFECTIVE 1 SECTIONS l REV l DATE J DESCRIPTION

1..,.~~,j-~~,;,,-BASES UPDATEPACKAGE06-120402'---;-,,: -¢ i;.,:,

B 3.3.2 3 12/04/02 Changes to reflect Tech Spec Amendment 213 regarding B 3.6.6 1 1.4% power uprate.

B 3.7.1 1 B 3.7.6 1

- - BASES UPDATE PACKAGE 07-03170377'-;'-,- >, ,,

B 3.3.8 1 03/17/2003 Changes to reflect Tech Spec Amendment 215 regarding B 3.7.13 1 implementation of Alternate Source Term analysis B 3.9.3 1 methodology to the Fuel Handling Accident.

- -,BASES UPDATE'PACKAGE 08-032803 ,I B 3.4.9 1 03/28/2003 Changes to reflect Tech Spec Amendment 216 regarding relaxation of pressurizer level limits in MODE 3.

_________ _____ A.BASES UPDATE PACKAGE 09-'062003 < .-,^',--i B 3.4.9 2 06/20/2003 Changes to reflect commitment for a dedicated operator per Tech Spec Amendment 216.

B 3.6.5 1 06/20/2003 Implements Corrective Action 11 from CR-IP3-2002-02095; 4 FCUs should be in operation to assure representative measurement of containment air temperature.

B 3.7.11 2 06/20/2003 Correction to Background description regarding system response to Firestat detector actuation per ACT 02-62887.

B 3.7.13 2 06/20/2003 Revision to Background description of FSB air tempering units to reflect design change per DCP 95-3-142.

B 3.8.7 1 06/20/2003 Changes to reflect replacement of Inverter 34 per DCP-B 3.8.8 1 06/20/2003 01-022.

B 3.8.9 2 06/20/2003

.- ,' BASES UPDATE PACKAGE' 10-102704 '.; '-'of :, Ash B 3.1.3 1 10/27/2004 Clarification of the surveillance requirements for TS 3.1.3 per 50.59 screen.

B 3.3.5 1 10/27/2004 Clarify the requirements for performing a Trip Actuating Device Operational Test (TADOT) on the 480V degraded grid and undervoltage relays per 50.59 screen.

B 3.4.3 1 10/27/2004 Extension of the RCS pressure/temperature limits and corresponding OPS limits from 16.17 to 20 EFPY (TS B 3.4.12 1 Amendment 220).

B 3.5.1 1 10/27/2004 Changes to reflect Tech Spec Amendment 222 regarding extension of completion time for Accumulators.

--.--: ---;BASES UPDATE PACKAGE 11-121004' - ' -

B 3.7.7 1 12/17/2004 Addition of valves CT-1 300 and CT-1 302 to Surveillance SR 3.7.7.2 to verify that all city water header supply isolation valves are open. Reflects Tech Spec Amendment 218.

. 1 . '--BASES-UPDATE PACKAGE 12-012405 : ~

B 3.7.11 3 01/24/2005 Temporary allowance for use of KI/SCBA for unfiltered inleakage above limit.

INDIAN POINT 3 Page 3 of 5 Revision 17

TECHNICAL SPECIFICATION BASES REVISION HISTORY AFFECTED EFFECTIVE SECTIONS REV DATE DESCRIPTION

,_._,;__._'_Aty__';'L_ BASEStUPDATE PACKAGE 081005

I><; -a}-:.....................

i r -'^'

TOC 2 08/10/2005 B 3.3.3, B 3.6.8 - Removal of Hydrogen Recombiners from the bases as per Technical Specification Amendment B 3.0 2 228. B 3.3.3 is also affected by Amendment 226.

B 3.3.3 3 B 3.7.11 - Add reference that if the primary coolant source of containment is in question, refer to ITS 5.5.2.

B 3.3.4 1 All other bases changes for this revision are associated B 3.4.11 1 with Technical Specification Amendment 226 regarding increase flexibility in Mode Restraints.

B 3.4.12 2 8 3.4.15 3 B3.4.16 2 B 3.5.3 1 B 3.6.8 1 B 3.7.4 1 B 3.7.5 3 B 3.7.11 5 B 3.8.1 2 INDIAN POINT 3 Page 5 of 5 Revision 17

Facility Operating License No DPR-64 Appendix A - Technical Specification Bases TABLE OF CONTENTS B.2.0 SAFETY LIMITS (SLs)

B.2.1.1 Reactor Core SLs B.2.1.2 Reactor Coolant System Pressure SL B.3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY B.3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY -

B.3.1 REACTIVITY CONTROL SYSTEMS B.3.1.1 SHUTDOWN MARGIN B.3.1.2 Core Reactivity B.3.1.3 Moderator Temperature Coefficient (MTC)

B.3.1.4 Rod Group Alignment Limits B.3.1.5 Shutdown Bank Insertion Limits -

B.3.1.6 Control Bank Insertion Limits B.3.1.7 Rod Position Indication B.3.1.8 PHYSICS TESTS Exceptions-MODE 2 B.3.2 POWER DISTRIBUTION LIMITS B.3.2.1 Heat Flux Hot Channel Factor (FO(Z))

B.3.2.2 Nuclear Enthalpy Rise Hot Channel Factor (FN 1)

B.3.2.3 AXIAL FLUX DIFFERENCE (AFD) '

B.3.2.4 QUADRANT POWER TILT RATIO (OPTR)

B.3.3 INSTRUMENTATION B.3.3.1 Reactor Protection System (RPS) Instrumentation B.3.3.2 Engineered Safety Feature Actuation System (ESFAS)

Instrumentation B.3.3.3 Post Accident Monitoring (PAM) Instrumentation B.3.3.4 Remote Shutdown B.3.3.5 Loss of-Power (LOP) Diesel Generator (OG) Start Instrumentation B.3.3.6 Containment Purge System andPressure Relief Line Isolation Instrumentation B.3.3.7 Control Room Ventilation (CRVS) Actuation Instrumentation, B.3.3.8 - Fuel Storage Building Emergency Ventilation System (FSBEVS)-,

Actuation Instrumentation (continued)

INDIAN POINT 3 ' -B i Revision 2

Facility Operating License No DPR-64 Appendix A - Technical Specification Bases TABLE OF CONTENTS (continued)

J B.3.4 REACTOR COOLANT SYSTEM (RCS)

B.3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits B.3.4.2 RCS Minimum Temperature for Criticality B.3.4.3 RCS Pressure and Temperature (P/T) Limits B.3.4.4 RCS Loops-MODES 1 and 2 B.3.4.5 RCS Loops-MODE 3 B.3.4.6 RCS Loops-MODE 4 B.3.4.7 RCS Loops-MODE 5. Loops Filled B.3.4.8 RCS Loops-MODE 5, Loops Not Filled B.3.4.9 Pressurizer B.3.4.10 Pressurizer Safety Valves B.3.4. 11 Pressurizer Power Operated Relief Valves (PORVs)

B.3.4.12 Low Temperature Overpressure Protection (LTOP)

B.3.4.13 RCS Operational LEAKAGE B.3.4.14 RCS Pressure Isolation Valve (PIV) Leakage B.3.4.15 RCS Leakage Detection Instrumentation B.3.4.16 RCS Specific Activity B.3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B.3.5.1 Accumulators B.3.5.2 ECCS-Operating Ji B.3.5.3 ECCS-Shutdown B.3.5.4 Refueling Water Storage Tank (RWST)

B.3.6 CONTAINMENT SYSTEMS B.3.6.1 Containment B.3.6.2 Containment Air Locks B.3.6.3 Containment Isolation Valves B.3.6.4 Containment Pressure B.3.6.5 Containment Air Temperature B.3.6.6 Containment Spray System and Containment Fan Coolerr System B.3.6.7 Spray Additive System B.3.6.8 Not Used B.3.6.9 Isolation Valve Seal Water (IVSW) System I B.3.6.10 Weld Channel and Penetration Pressurization System (WC & PPS)

(continued)

INDIAN POINT 3 B ii Revision 2

'Facility Operating License No DPR-64 Appendix A - Technical- Specification"'Bases TABLE OF CONTENTS (continued)

B.3.7 PLANT SYSTEMS B.3.7.1 Main Steam Safety Valves (MSSVs)

B.3.7.2 Main Steam Isolation Valves (MSIVs) and Main Steam Check Valves (MSCVs)

B.3.7.3 Main Boiler Feedpump Discharg6eValves (MBFPDVs), Main Feedwater" Regulation Valves (MFRVs), Main Feedwater Inlet Isolation Valves (MFIIVs) and Main Feedwater'(MF) Low Flow Bypass Valves B.3.7.4 Atmospheric Dump Valves (ADVs)

B.3.7.5 Auxiliary Feedwater (AFW) System B.3.7.6 Condensate Storage Tank (CST)

B.3.7.7 City Water (CW)

B.3.7.8 Component Cooling Water (CCW) System B.3.7.9 Service Water (SW) System B.3.7.10 Ultimate Heat Sink (UHS)

B.3.7.11 Control Room Ventilation System (CRVS)

B.3.7.12 Control Room Air Conditioning System (CRACS)

B.3.7.13 Fuel Storage Building Emergency Ventilation System (FSBEVS)

B.3.7.14 Spent Fuel Pit Water Level B.3.7.15 Spent Fuel Pit Boron Concentration B.3.7.16 Spent Fuel Assembly Storage B.3.7.17 Secondary Specific Activity B.3.8 ELECTRICAL POWER SYSTEMS B.3.8.1 AC Sources-Operating B.3.8.2 AC Sources-Shutdown B.3.8.3 Diesel Fuel Oil and Starting Air B.3.8.4 DC Sources-Operating B.3.8.5 DC Sources-Shutdown B.3.8.6 Battery Cell Parameters B.3.8.7 Inverters-Operating B.3.8.8 Inverters-Shutdown B.3.8.9 Distribution Systems-Operating B.3.8.10 Distribution Systems-Shutdown (continued)

INDIAN POINT 3 ! B iii Revision 2

Facility Operating License No DPR-64 Appendix A - Technical Specification Bases TABLE OF CONTENTS (continued) J B.3.9 REFUELING OPERATIONS B.3.9.1 Boron Concentration B.3.9.2 Nuclear Instrumentation B.3.9.3 Containment Penetrations B.3.9.4 Residual Heat Removal (RHR) and Coolant Circulation-High Water Level B.3.9.5 Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level B.3.9.6 Refueling Cavity Water Level IJ INDIAN POINT 3 B iv Revision 2

LCO Applicability B 3.0 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOs LCO 3.0.1 through LCO 3.0.6 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.

LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to'be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification).

LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered. The Required Actions establish'those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This

-Specification establishes 'that:

a. Completion of the Required Actions'within the specified Completion Times constitutes compliance with a Specification:

and

b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.

There are two basic types of Required Actions.! The first type of Required Action specifies a time limit in which the LCO must be met.

This time limit is the Completion Time to restore an inoperable system or component to-OPERABLE status or to restore variables to within specified:limits. 'Ifthis'type of Required Action is not completed

'within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in-which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.)

(continued)

INDIAN POINT 3 B 3.0 - I Revision 2

LCO Applicability B 3.0 BASES J LCO 3.0.2 The second type of Required Action specifies the remedial (continued) measures that permit continued operation of the unit that is not further restricted by the Completion Time. In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation.

Completing the Required Actions is not required when an LCO is met or is no longer applicable, unless otherwise stated in the individual Specifications.

The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Conditions no longer exist. The individual LCO's ACTIONS specify the Required Actions where this is the case. An example of this is in LCO 3.4.3. "RCS Pressure and Temperature (P/T) Limits."

The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The reasons for intentionally relying on the ACTIONS include, but are not limited to. performance of Surveillances, preventive maintenance, corrective maintenance, or investigation of operational problems.

Entering ACTIONS for these reasons must be done in a manner that does not compromise safety. Intentional entry into ACTIONS should not be made for operational convenience. Additionally, if intentional entry into ACTIONS would result in redundant equipment being inoperable, alternatives should be used instead. Doing so limits the time both subsystems/trains of a safety function are inoperable and limits the time conditions exist which may result in LCO 3.0.3 being entered.

Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed.

When a change in MODE or other specified condition is required to comply with Required Actions, the unit may enter a MODE or other specified condition in which another Specification becomes applicable.

(continued)

INDIAN POINT 3 B 3.0 - 2 Revision 2

LCO Applicability B 3.0 BASES LCO 3.0.2 ' In this case, the Completion Times of the associated Required (continued) Actions would apply from the point in time that the new Specification becomes applicable,' and the ACTIONS Condition(s) are entered.

,,,r LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an LCO is'not met and:

a. An associated Required Action and Completion Time is not met and no other Condition applies; or

b. The condition of the'unit is not specifically addressed by the associated ACTIONS. This means'that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes,

'possible combinations of Conditions are such that entering LCO 3.0.3 is warranted;'in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.

This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be

- maintained within the limits for safe operation as defined by the LCO and its-ACTIONS. It is not intended to be used as an operational convenience that permits routine voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems'or components being inoperable.

Upon'enterinig LCO 3.0.3, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to prepare for an orderly shutdown before initiating a change in unit operation. This includes time to permit the'operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and

'-availability ofithe electrical grid. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled'and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit, assuming that only'the minimum required equipment is OPERABLE.

(continued)

INDIAN POINT 3 B 3.0 - 3' Revision 2

LCO Applicability B 3.0 BASES LCO 3.0.3 This reduces thermal stresses on components of the Reactor (continued) Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3. Completion Times.

A unit shutdown required in accordance with LCO 3.0.3 may be terminated and LCO 3.0.3 exited if any of the following occurs:

a. The LCO is now met.

b. A Condition exists for which the Required Actions have now been performed.

c. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.

The time limits of Specification 3.0.3 allow 37 hours4.282407e-4 days 0.0103 hours 6.117725e-5 weeks 1.40785e-5 months for the unit to be in MODE 5 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE applies. If a lower MODE is reached in less time than allowed, however, the total allowable time to reach MODE 5, or other-applicable MODE, is not reduced. For example, if MODE 3 is reached in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , then the time allowed for reaching MODE 4 is the next 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months , because the total time for reaching MODE 4 is not reduced from the allowable limit of 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months . Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.

In MODES 1, 2. 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 5 and 6 because the unit is already in the most restrictive Condition required by LCO 3.0.3. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1. 2. 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.

(continued)

INDIAN POINT 3 B 3.0 - 4 Revision 2

LCO Applicability B 3.0 BASES LCO 3.0.3 Exceptions to LCO 3.0.3 are provided in instances where requiring (continued) a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in LCO 3.7.14, -Spent Fuel Pit Water Level." LCO 3.7.14 has an Applicability of "During movement of irradiated fuel assemblies in-the Spent Fuel Pit." Therefore, this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.14 are not met while in MODE 1, 2. or 3.

there is no safety benefit to be gained by placing the unit in a shutdown condition. The Required Action of LCO 3.7.14 of "Suspend movement of irradiated'fuel assemblies in the Spent Fuel Pit" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the individual Specifications.

LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or

-other specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a MODE or other specified condition stated in that Applicability (e.g.. the Applicability desired to be entered) when unit conditions are such that the requirements of the LCO would not be met, in accordance with LCO 3.0.4.a. LCO 3.0.4.b, or LCO 3.0.4.c.

LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be entered permit'continued operation in the MODE or other specified condition in the Applicability for an unlimited period of time.

Compliance with Required Actions that permit'continued operation of the unit for an unlimited period of time in'a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change. Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made in accordance with the provisions of the'Required Actions.

LCO 3.0.4.b allows entry into a MODE or other specified condition in the Applicability with theLCO not met after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the'Applicability, and establishment of risk management actions, if appropriate.

(continued)

INDIAN POINT 3 B 3.0 - 5 Revision 2

LCO Applicability B 3.0 BASES J

LCO 3.0.4 The risk assessment may use quantitative, qualitative, or blended (continued) approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4), which requires that risk impacts of maintenance activities to be assessed and managed. The risk assessment, for the purposes of LCO 3.0.4(b). must take into account all inoperable Technical Specification equipment regardless of whether the equipment is included in the normal 10 CFR 50.65(a)(4) risk assessment scope.

The risk assessments will be conducted using the procedures and guidance endorsed by Regulatory guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants."

Regulatory Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to plan and conduct other activities in a manner that controls overall risk, increased risk awareness by shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable. Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability.

LCO 3.0.4.b may be used with single, or multiple systems and components unavailable. NUMARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components.

The results of the risk assessment shall be considered in determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented.

The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the Completion Time. Since this is allowable, and since in general the risk impact in that particular MODE bounds the risk of transitioning into and through the applicable MODES or other specified conditions in the Applicability of the LCO, the use of the LCO 3.0.4.b allowance should be generally acceptable, as long as the risk is assessed and managed as stated (continued)

INDIAN POINT 3 B 3.0 - 6 Revision 2

LCO Applicability B 3.0 BASES LCO 3.0.4 above. However, there is a small subset of systems and components (continued) that have been determined to be more important to risk and the use of the LCO 3.0.4.b allowance is prohibited. The LCOs governing these systems and components contain Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not applicable.

LCO 3.0.4.c allows entry into a MODE or other specified condition in the Applicability with the LCO not met based on'a Note in the Specification which states 'LCO 3.0.4.c is applicable. These specific allowances permit entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for-continued operation for an unlimited period of time and a risk assessment has not been performed.' This allowance may apply to all the ACTIONS or to a specific Required Action of a Specification.

The risk assessments performed to justify'the use of LCO 3.0.4.b usually only consider systems and components. For this reason. LCO 3.0.4.c is typically applied to Specifications which describe values and parameters (e.g., RCS specific activity), and may be applied to other Specifications based on NRC plant-specific approval.

. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.

The provisions of LCO-3.0.4 shall not prevent changes in MODES or other specified conditions'in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2. MODE 2 to MODE.3. MODE 3 to MODE 4, and MODE 4 to MODE 5.

Upon entry into a MODE or other specified condition in the Applicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry.in to the applicable Conditions and Required Actions until the Condition is resolved, until the LCO is met, o6runtil the unit is not within the Applicability of the Technical Specification.

Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for any Surveillances that have not been performed on inoperable equipment. However, SRs must be met to ensure (continued)

INDIAN POINT 3 B 3.0 - 7 1 Revision 2

LCO Applicability B 3.0 BASES J'

LCO 3.0.4 OPERABILITY prior to declaring the associated equipment OPERABLE (or (continued) variable within limits) and restoring compliance with the affected LCO.

LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or

b. The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the required testing to demonstrate OPERABILITY. This Specification does not provide time to perform any other preventive or corrective maintenance.

J An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the SRs.

An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of required testing on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system.

(continued) 1.

INDIAN POINT 3 B 3.0 - 8 Revision 2

LCO Applicability

B3.0 BASES LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS)'. This exception is provided because LCO 3.0.2'would require that the Conditions and Required Actions of the associated inoperable supported system LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the unit is maintained in a safe condition are specified in the support system LCO's Required Actions. These Required Actions may include entering the-supported system's Conditions and Required Actions or may specify other Required Actions.

When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as-a result of the support system inoperability. However, it is not necessary to enter into the supported systems' Conditions and Required Actions unless directed to do so by the support'system's Required Actions.' The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCOs' Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the unit is maintained in a safe condition in the support system's-Required Actions.-

However, there are instances where a support'system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system. This may occur immediately or after some specified delay to perform some other Required-Action.'` Regardless of whether it is immediate or after'some delay,'when a support system's Required Action directs'a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.

Specification 5.5.14. "Safety Function Determination Program (SFDP)."

ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6. an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.

(continued)

INDIAN POINT 3 B 3.0 - 9 ' - Revision 2

LCO Applicability B 3.0 BASES LCO 3.0.6 Cross train checks to identify a loss of safety function for J

(continued) those support systems that support multiple and redundant safety systems are required. The cross train check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained. If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

LCO 3.0.7 There are certain special tests and operations required to be performed at various times over the life of the unit. These special tests and operations are necessary to demonstrate select unit performance characteristics, to perform special maintenance activities, and to perform special evolutions. Test Exception LCOs, such as LCO 3.1.8, allow specified Technical Specification (TS) requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS. Unless otherwise specified, all the other TS requirements remain unchanged.

This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect. J The Applicability of a Test Exception LCO represents a condition not necessarily in compliance with the normal requirements of the TS.

Compliance with Test Exception LCOs is optional. A special operation may be performed either under the provisions of the appropriate Test Exception LCO or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the Test Exception LCO, the requirements of the Test Exception LCO shall be followed.

INDIAN POINT 3 B 3.0 - 10 Revision 2

SR Applicability B 3.0 B 3.O SURVEILLANCE REOUIREMENT (SR) APPLICABILITY BASES SRs SR 3.0.1 through SR 3.0.4 establish the general'requirements applicable to all Specifications and apply at:all times,' unless otherwise stated.

SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply. unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify theWOPERABILITY of systems and components, and that variables are within specified'limits. Failure'to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO.

Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or compon'ents'are OPERABLE when:

a. The systems or components are known to be inoperable, although still meeting the SRs; or

b. The requirements of the Surveillance(s) are known not to be met between required Surveillance performances.

Surveillances do not have to be performed when the unit is in a MODE or other specified condition for'which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a test exception are only applicable when the test exception is

-used as-an allowable exception to the requirements of a Specification.

Unplanned events may satisfy the requirements (including applicable

-acceptance criteria) for agiven SR. In-this case, the unplanned event may be credited as fulfilling the performance of the SR.

. .. * -* n )

> (continued)

INDIAN POINT 3 B 3.0 - 11' Revision 2

SR Applicability B 3.0 BASES SR 3.0.1 This allowance includes those SRs whose performance is normally (continued) precluded in a given MODE or other specified condition.

Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status.

Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed.

SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a "once per . . ." interval.

SR 3.0.2 permits a 25% extension of the interval specified in the Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).

The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency.

This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs.

(continued)

INDIAN POINT 3 B 3.0 - 12 Revision 2

SR Applicability B 3.0 BASES SR 3.0.2 - The exceptions to SR 3.0.2 are those-Surveillances for which the (continued) 25% extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications.

An example of where SR 3.0.2 does not apply is a Surveillance with a Frequency of "inaccordance'with 10 CFR 50, Appendix J. as modified by approved exemptions." The requirements ofWregulations take precedence

.. over the TS. The TS cannot in and of themselves extend a test interval specified in the regulations. Therefore, there-is a Note in the Frequency-stating, 'SR 3.0.-2 is not applicable."

As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a-periodic Completi6n-Time that requires performance

-on a "once per ... " basis. The 25% extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25% extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of.-redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.

The provisions of SR 3.0.2 are not intended to be used repeatedly merely as an operational convenience to extend Surveillance intervals

.(other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected

.. . equipment inoperable or an affected variable outside the specified limits-when a Surveillance has not been completed within the specified

-Frequency.l. A delay period of up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or 'upto the limit of the

-specified Frequency, whichever is greater, applies from the point in time that It'is discovered that the Surveillance has not been performed

in accordance with SR 3.0.2,'and not at the time that the specified

- Frequency was not met.,

,-This delay period provides adequate time to complete Surveillances that I have been misused. . - -' v .I

!. I I I , . ~ . . I' I (continued)

INDIAN POINT 3 B 3.0 - 13' Revision 2

SR Applicability B 3.0 BASES [

SR 3.0.3 This delay period permits the completion of a Surveillance before (continued) complying with Required Actions or other remedial measures that might preclude completion of the Surveillance.

The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.

When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g.. prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J. as modified by approved exemptions, etc.) is discovered to not have been performed when specified. SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.

SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions. J Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals.

While up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning.

availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.56(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182. 'Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants.'

This Regulatory Guide addresses consideration of temporary and (continued)

INDIAN POINT 3 B 3.0 - 14 Revision 2

SR Applicability B 3.0 BASES SR 3.0.3'- aggregate risk impacts, determination of risk management action (continued) thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative,'qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action.

All missed Surveillances will be placed in the licensee's Corrective

-Action Program.

If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered butside'the specified limits and the'Completion Times of the Required Actions for the applicable LCO'Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the'delay'period, then the equipment'is 'inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the' applicable LCO Conditions begin immediately upon the failure of the Surveillance.

Completion oflthe Surveillance'within the delay period allowed by this Specification, or within the Completion Time'of the ACTIONS, restores compliance with SR 3.0.1.

SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.

This Specification ensures'that system and'component OPERABILITY requirements 'and variable limits are met before entry Into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit. The provisions of this Specification should not be interpreted as endorsing the failure to exercise'the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition 'in'the Applicability.-

A provision is included'to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4.

(continued)

INDIAN POINT 3 B 3.0 - 15 Revision 2

SR Applicability B 3.0 BASES SR 3.0.4 However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1. which states that Surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability. However, since the LCO is not met.in this instance, LCO 3.0.4 will govern any restrictions that my (or may not) apply to MODE or other specified condition changes. SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3.

The provisions of SR 3.0.4 shall not prevent entry into MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicaiblity that result from any unit shutdown. In this context a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3. MODE 3 to MODE 4. and MODE 4 to MODE 5.

The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry in the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO's Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met. Alternately, the Surveillance may be stated in the form of a Note, as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4. Frequency.

INDIAN POINT 3 B 3.0 - 16 Revision 2

PAM Instrumentation B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND The primary purpose of the PAM instrumentation is to display unit variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to tak6 the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Accidents (DBAs). -

The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected unit parameters to monitor and to assess unit status and behavior following an accident.

The availability of accident monitoring instrumentation is important so that responses to corrective actions can be observed and the need for, and magnitude of, further actions can be determined. These instruments are identified by unit specific documents (Ref. 1) addressing the recommendations of Regulatory Guide 1.97 (Ref. 2) as required by Supplement 1 to NUREG-0737 (Ref. 3).

The instrument channels required to be OPERABLE by this LCO include two classes of parameters identified during unit specific implementation of Regulatory Guide 1.97. The instruments governed by this LCO are the Type A and Category I variables which are defined as follows:

Type A variables are included in this LCO because they provide the primary-information required for the control room operator to take specific manually controlled actions for which no automatic control is provided, and that are required for safety systems to accomplish their safety functions for DBAs.

(continued)

INDIAN POINT 3 B 3.3.3 - I Revision 3

PAM Instrumentation B 3.3.3 BASES BACKGROUND Category I variables are the key variables deemed risk (continued) significant because they are needed to:

Determine whether other systems important to safety are performing their intended functions;

Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release; and

Provide information regarding the release of radioactive materials to allow for early indication of the need to initiate action necessary to protect the public, and to estimate the magnitude of any impending threat.

These key variables are identified by the unit specific Regulatory Guide 1.97 analyses (Ref. 1). These analyses identify the unit specific Type A and Category I variables and provide justification for deviating from the NRC proposed list of Category I variables.

The specific instrument Functions listed in Table 3.3.3-1 are discussed in the LCO section. J APPLICABLE SAFETY ANALYSES The PAM instrumentation ensures the operability of Regulatory Guide 1.97 Type A and Category I variables so that the control room operating staff can:

Perform the diagnosis specified in the emergency operating procedures (these variables are restricted to preplanned actions for the primary success path of DBAs), e.g.. loss of coolant accident (LOCA);

Take the specified, pre-planned, manually controlled actions, for which no automatic control is provided, and that are required for safety systems to accomplish their safety function; (continued)

INDIAN POINT 3 B 3.3.3 - 2 Revision 3

PAM Instrumentation B 3.3.3 BASES APPLICABLE SAFETY ANALYSES (continued)

Determine whether systems important to safety are performing their intended functions;

Determine the likelihood of a gross breach of the barriers to radioactivity release;

Determine if a gross breach of a barrier has occurred: and

Initiate action necessary to protect the public and to estimate the magnitude of any impending threat.

PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of 10.CFR,50.36. Category I, non-Type A, instrumentation must be retained in TS because it is intended to assist operators in minimizing the consequences of accidents.

Therefore, Category I.,non-Type A. variables are important for reducing public risk and therefore, meet Criterion 4 of 10 CFR 50.36.

LCO The PAM instrumentation LCO provides OPERABILITY requirements for Regulatory Guide 1.97 Type A monitors, which provide information required by the control room operators to perform certain manual actions specified in the unit Emergency Operating Procedures. These manual actions ensure that a system can accomplish its safety function, and are credited in the safety analyses. Additionally, this LCO addresses Regulatory Guide 1.97 instruments that have been designated Category I, non-Type A.

The OPERABILITY of the PAM instrumentation provides information about selected unit parameters to monitor and assess unit status following an accident. This capability is consistent with the recommendations of Reference 1.

LCO 3.3.3 requires two OPERABLE channels for most functions. Two OPERABLE channels ensure no single failure prevents operators from getting the information necessary for them to determine the safety status of the unit, and to bring the unit to and maintain it in a safe condition following an accident.

(continued)

INDIAN POINT 3 B 3.3.3 - 3 Revision 3

PAM Instrumentation B 3.3.3 BASES J LCO Furthermore, OPERABILITY of two channels allows a CHANNEL CHECK (continued) during the post accident phase to confirm the validity of displayed information.

An exception to the two channel requirement is Containment Isolation Valve (CIV) Position. In this case, the important information is the status of the containment penetrations. The LCO requires one position indicator for each active CIV. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve, or via system boundary status.

If a normally active CIV is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE.

Table 3.3.3-1 provides a list of all Type A and Category I variables identified by the IP3 Regulatory Guide 1.97 analyses, as amended by the NRC's SER (Ref. 1). with one exception. Requirements for RWST level, which is a Type A and Category I variable, are stated in LCO 3.5.4.

Type A and Category I variables are required to meet Regulatory Guide 1.97 Category I (Ref. 2) design and qualification requirements for seismic and environmental qualification, utilization of emergency standby power, immediately accessible display, continuous readout, and recording of display.

The Safety Parameter Display System (SPDS) is provided to the Control Room to continuously display information from which plant status can be assessed. The SPDS consists of the Critical Functions Monitoring System (CFMS) and the Qualified Safety Parameters Display System (OSPDS). The CFMS displays and alarms critical safety functions (actions which preserve integrity of one or more physical barriers against radiation) in the Control Room and the emergency response facilities. The CFMS provides for historical data storage and retrieval capability. The CFMS is a redundant computer system not designed to seismic and electrical class 1E criteria. The OSPDS is a backup display system and is qualified to seismic and electrical class 1E standards (Ref. 4).

(continued)

INDIAN POINT 3 B 3.3.3 - 4 Revision 3

PAM Instrumentation B 3.3.3 BASES LCO Listed below are discussions of the specified instrument (continued) Functions listed in'Table 3.3.3-1.

1. Neutron Flux Neutron Flux indication covering full range of flux that may occur post accident is provided to verify reactor shutdown.

Neutron flux is'used for accident diagnosis, verification of subcriticality, and diagnosis of positive reactivity insertion.

To'satisfy these requirements, an Excore Neutron Flux Detection System consisting of two detectors (N38, N39) provides two channels of neutron flux indication capable of providing indication from the source range to'100% RTP. The Excore Neutron Flux Detection System is an indication only system that displays'on the OSPDS in the Control Room.

-2.3. Reactor Coolant System (RCS) Hot and Cold Leg Temperatures (Wide Range)' :

RCS Hot and Cold Leg Temperatures are Category I variables required for verification of core cooling and long term surveillance. RCS cold leg-temperature is used in conjunction with RCS hot leg temperature and steam generator pressure to verify the unit conditions necessary to establish natural circulation in the RCS.

This LCO is satisfied by the OPERABILITY of one hot leg channel and one cold leg channel in each of the four RCS loops:

Ho Le Lo -.

Hot Leg Loop No. 1 (T413A) Cold Leg Loop No. 1 (T413B)

Hot Leg Loop No. 2 (T423A) Cold Leg Loop No. 2 (T423B)

Hot Leg Loop No. 3 (T433A): Cold Leg Loop No. 3 (T433B)

Hot Leg Loop No.. 4 (T443A) Cold Leg Loop No. 4 (T443B)

X ,.The channels provide indication over a range of 0 F to 700 F.

(continued)

INDIAN POINT 3 B 3.3.3 - 5 Revi~sion 3

PAM Instrumentation B 3.3.3 BASES J LCO Redundancy for the Hot Leg RCS Temperature is provided by (continued) the core exit thermocouples (Functions 18, 19. 20 and 21) which is considered a diverse variable for the RCS Hot Leg indication.

Redundancy for the Cold Leg RCS Temperature is provided by Steam Generator Pressure (Function 16).

4. Reactor Coolant System Pressure (Wide Range)

RCS wide range pressure is a Category I variable required for verification of core cooling and RCS integrity long term surveillance.

RCS pressure is used to verify closure of manually closed pressurizer spray line valves and pressurizer power operated relief valves (PORVs). In addition, RCS pressure is used to develop RCS subcooling. for determining whether to terminate actuated SI or to reinitiate stopped SI. RCS pressure can also be used:

to determine when to reset SI and shut off low head SI; J,

to manually restart low head SI:

as reactor coolant pump (RCP) trip criteria: and

to make a determination on the nature of the accident in progress and where to go next in the procedure.

RCS pressure is also related to three decisions about depressurization. They are:

to determine whether to proceed with primary system depressurization:

to verify termination of depressurization: and

to determine whether to close accumulator isolation valves during a controlled cooldown/depressurization.

(continued) I INDIAN POINT 3 B 3.3.3 - 6 Revision 3

PAM Instrumentation B 3.3.3 BASES LCO RCS pressure and'pressurizer level are also used to determine (continued) whether to operate the pressurizer heaters.

RCS pressure is a Type A variable because the operator uses this indication to monitor the depressurization of the RCS following a steam generator tube rupture (SGTR) or small break LOCA.

Operator action's to maintain a'controlled cooldown, such as

adjusting steam generator (SG) pressure or level, would use this indication.

-,The LCO requirement for RCS Pressure (wide range) indication is satisfied by pressure transmitters designated PT-402 and PT-403.

Normal control-room indication or recorders or displays on the OSPDS in the Control Room will'satisfy this requirement.

Pressurizer pressure instrumentation (PT-455, PT-456, PT-457, and PT-474) is available as a 'diverse means of monitoring RCS pressure.

5. Reactor Vessel Water Level Reactor Vessel Water'Level is required for verification and long term surveillance of core cooling.' It is also used for accident diagnosis and to determine reactor coolant inventory adequacy.

This requirement is satisfied by the two channels of the Reactor

'Vessel Level Indicating System (RVLIS-A and RVLIS-B). The RVLIS automaticallycompensates for variations in fluid density as well as for the'effects of-reactor'coolant pump operation.

The level reading represents the amount of liquid mass that is in the reactor vessel. Measurement of the collapsed

.water level is selected because it is:'a direct indication of the water inventory. The level instrumentation is divided into the full range and'the dynamic range in order to measure level under all'conditions.' The full range gives-level indication from the bottom of the reactor vessel to the top of the reactor head during natural circulation .conditions. The dynamic range gives Indication of reactor. vessel liquid level for any combination of running RCP's.

(continued)

INDIAN POINT 3 B 3.3.3 - 7 Revision 3

PAM Instrumentation B 3.3.3 BASES LCO 6,7. Containment Water Level (Wide Range) and Recirculation Sump (continued) Level Containment Water Level is required for verification and long term surveillance of RCS integrity.

Containment Water Level is used for accident diagnosis and provides a diverse indication for RWST level regarding when to begin the recirculation procedure.

The LCO requirement for Containment Water Level indication is satisfied by level transmitters designated LT-1253 and LT-1254. The LCO requirement for Recirculation Sump Water Level indication is satisfied by transmitters designated LT-1251 and LT-1252. Normal control room recorders or OSPDS display will satisfy this requirement.

8. Containment Pressure (Wide Range)

Containment Pressure (Wide Range) is required for verification of need for and effectiveness of containment spray and fan cooler units.

The LCO requirement for Containment pressure indication is satisfied by pressure transmitters designated PT-1421 and PT-1422. Normal control room indication or OSPDS display will satisfy this requirement. Containment pressure narrow range instrumentation (PT-948A. B. C and PT-949A. B. C) is available to provide a diverse means of establishing containment pressure.

9. Automatic Containment Isolation Valve Position CIV Position is provided for verification of Containment OPERABILITY and Phase A and Phase B isolation.

When used to verify Phase A and Phase B isolation, the important information is the isolation status of the containment penetrations.

(continued)

INDIAN POINT 3 B 3.3.3 - 8 Revision 3

PAM Instrumentation B 3.3.3 BASES LCO The LCO requires one channel of valve closed position

-(continued) indication in the control room (or at local control stations for valves without control room indication) to be OPERABLE for each active CIV in a containment penetration flow path. i.e., two total channels of CIV position indication for a penetration flow path with two active valves. For containment penetrations with only one active CIV having control room indication, Note (b) requires a single channel of valve position indication to be OPERABLE. This is sufficient to redundantly verify the isolation of each isolable penetration either via indicated status of the active valve, as applicable, and prior knowledge of a passive valve, or via system boundary status. If a normally active CIV is known to be closed and deactivated, position indication is not needed to determine status.

Therefore, the position indication for valves in this state is not required to be OPERABLE.

Note (a)to the Required Channels states that the Function is not required for isolation valves whose associated penetration is isolated'by at least one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve.

Note that non-automatic containment isolation valves are not provided with'position indication. 'As described in the Bases or

'LCO 3.6.3, "Containment Isolation Valves, containment isolation valves classified as essential and non-automatic are maintained in the open position and are closed after the initial phases of an accident. Emergency procedures are utilized to control the closing of these valves. Non-essential containment isolation valves are maintained in the closed position and may be opened.

if necessary, for plant operation and for only as long as necessary to perform the intended function, under administrative controls described in'the Bases for LCO 3.6.3.

10. Containment Area Radiation (Hiah Ranae)

Containment Area Radiation is provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans.

(continued)

INDIAN POINT 3 B 3.3.3 '`9 - Revision 3

PAM Instrumentation B 3.3.3 BASES -1, LCO The LCO requirement for Containment Area Radiation (high (continued) range) monitoring is satisfied by radiation monitors designated R-25 and R-26.

11. Not Used

12. Pressurizer Level Pressurizer Level is used to determine whether to terminate SI.

if still in progress, or to reinitiate SI if it has been stopped. Knowledge of pressurizer water level is also used to verify that the unit is maintained in a safe shutdown condition.

The LCO requirement for 2 channels of pressurizer level J

indication is satisfied by any two of the level instruments designated LT-459, LT-460 and LT-461.

13. Steam Generator Water Level (Narrow Range)

SG Water Level is required to monitor operation of decay heat removal via the SGs.

Each Steam Generator (SG) has three narrow range transmitters which span a range from the top of the tube bundles up to the moisture separator.

(continued)

INDIAN POINT 3 B 3.3.3 - 10 Revision 3

PAM Instrumentation B 3.3.3 BASES LCO Requirements for steam generator water level indication assume (continued) that two of the four steam generators are required for heat removal.

Narrow range SG water level is a Category I. Type A variable used to determine If the SG's are being maintained as an adequate heat sink for decay heat removal and to maintain the SG level and prevent overfill. It is also used to determine whether SI should be terminated and may be used.to diagnose an SG tube rupture event. The LCO requirement is satisfied by the following two instruments for each SG:

- SG 1 S~ 32 G 33SG 3,4 LT-417A LT-427A LT-437A LT-447A LT-417C LT-427C LT-437C LT-447C The 'B-series' 'instruments (LT-4x7B) are QA Category M and are not used to satisfy this LCO requirement.

14. Steam Generator Water Level (Wide Range) and Auxiliary Feedwater Flow-Each steam generator has one level transmitter that spans a range from the-tube sheet up to the moisture separator. Wide range SG water level is a Category I. Type A variable used to determine if the SGs are being maintained as an adequate heat sink for decay heat removal. Since there isonly one instrument channel per steam generator, Auxiliary Feedwater (AFW) flow instrumentation is credited for providing a redundant means of determining if adequate'decay heat removal by 'the SGs is being maintained.

Although not a Category I or Type A variable for IP3. the AFW flow instrument channels provide redundancy for SG wide range level in the event of the limiting single failure of a power supply. The LCO requirement for this function is satisfied by one SG wide range level channel and one AFW flow channel for each steam generator. The instrument channels for SG wide range water level are designated LT-417D, LT-427D.LT-437D, and LT-447D. The instrument channels for AF4W flow are designated F1200. F1201, F1202. and F1203.

(continued)

INDIAN POINT 3 B 3.3.3 -- 11 Revision 3

PAM Instrumentation B 3.3.3 BASES

-I.

LCO 15. Not Used (continued)

16. Steam Generator Pressure Each SG contains 3 transmitters that indicate SG pressure.

Requirements for steam generator pressure indication assume that two of the four steam generators are required for heat removal.

SG pressure is a Category I. Type A variable used to determine if a high energy secondary line rupture occurred and which steam generator is faulted. SG pressure is also used as the redundant channel of RCS cold leg temperature for natural circulation determination.

The LCO requirements for steam generator pressure indication is satisfied by any two channels from the following list for each of the four SGs:

J PT-419A PT-429A PT-439A PT-449A PT-419B PT-429B PT-439B PT-449B PT-419C PT-429C PT-439C PT-449C

17. Condensate Storage Tank (CST) Level CST Level is provided to ensure water supply for auxiliary feedwater (AFW). The CST provides the ensured safety grade water supply for the AFW System.

CST Level is a Type A variable because the control room indication is the primary indication used by the operator.

The DBAs that require AFW are the loss of electric power. steam line break (SLB), and small break LOCA.

(continued)

I INDIAN POINT 3 B 3.3.3 - 12 Revision 3

PAM Instrumentation B 3.3.3 BASES LCO The CST is the initial source of water for the AFW System.

(continued) However, as the CST is depleted, manual operator action is necessary to replenish the CST or align suction to the AFW pumps to city water.

The LCO requirement for CST'level indication is satisfied by level transmitters designated LT-1128 and LT-1128A. Normal control room indication or displays on the OSPDS in the Control Room will satisfy this requirement.

18, 19. 20. 21. Core Exit Temperature Core Exit Temperature is required for verification and long term surveillance of core cooling. Core Exit Temperature is used as input for developing RCS Subcooling'(Function 24) and is also used for-unit stabilization and cooldown control. Core exit temperature also serves as a redundant channel for the RCS Hot Leg Temperature (Function 3).

There are 10 qualified core exit thermocouples (CETs) in each of

- two trains distributed among the four'core quadrants. 'The LCO requirement for Core-Exit Temperature is satisfied in each core quadrant-by requiring two core exit temperature channels for that quadrant. An OPERABLE core exit temperature channel consists of two OPERABLE CETs. Both CETs in the-channel must be from the same train. Requiring 2 CETs per channel in each of the four quadrants provides assurance that sufficient CETs are available to support evaluation of core radial decay power distribution.

22. Main Steam Line (MSL) Radiation The MSL radiation monitors are a Type A variable provided to

-allow detection of a gross secondary side radioactivity release and to provide a means to identify the faulted steam generator.

The LCO requirements for MSL radiation indication are satisfied by one channel in each of the 4 MSLs using instruments designated R62A, R62B, R62C, R62D. Steam generator narrow range level (Function 13) serves as the redundant channel for the one MSL radiation monitor provided per loop.

- - (continued)

INDIAN POINT 3 B 3.3.3 - 13 Revision 3

PAM Instrumentation B 3.3.3 BASES J LCO 23. Gross Failed Fuel Detector (continued)

The gross failed fuel detector is a Type A variable provided to allow determination of reactor coolant system radioactivity concentration. The LCO requirement is satisfied by instrument loops R63A and R63B.

24. RCS Subcooling RCS subcooling is a Type A variable provided to determine whether to terminate actuated SI or to reinitiate stopped SI, to determine when to terminate reactor coolant pump operation, and for unit stabilization and cooldown control. RCS subcooling is calculated and displayed in the plant Oualified Safety Parameter Display System using RCS Wide Range Pressure and Core Exit Temperature. Diverse indication is available using saturation pressure and steam tables.

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1, 2, and 3. These variables are related to the diagnosis and pre-planned actions J required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1. 2, and 3. In MODES 4, 5, and 6. unit conditions are such that the likelihood of an event that would require PAM instrumentation is low; therefore, the PAM instrumentation is not required to be OPERABLE in these MODES.

ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.3-1. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

(continued)

INDIAN POINT 3 B 3.3.3 - 14 Revision 3

PAM Instrumentation B 3.3.3 BASES ACTIONS (continued) Al Condition A applies when one'or more Functions have one required channel that is inoperable. Required Action A.1 requires restoring the inoperable channel to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account any remaining'OPERABLE channels, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.

Condition B applies when the Required Action and associated Completion Time for Condition A are not met. This Required Action specifies initiation of actions in Specification 5.6.7. which requires a written report to be submitted to the NRC immediately. This report discusses the results of the root'cause evaluation of the inoperability and identifies proposed restorative actions. This action is appropriate in lieu of a shutdown requirement since alternative actions are Identified before loss of functional capability, and given the likelihbod-of unit conditions that would require information provided by this instrumentation.-

Condition C applies when one or more Functions have all required channels for that Function inoperable. Most Functions in Table 3.3.3-1 have two required channels. and the first statement in Condition C addresses those situations when both'channels are inoperable.

However, there are three Functions (2., 3,'and 22) where there is only one channel available for the Function. 'Inthese cases, redundancy is provided by'instrument channels from another appropriate Function.

The last three statements in Condition C address'each of these Functions for the situation when the single channel in that Function it inoperable and'both channels in the Function used for redundancy are inoperable.-

_ (continued)

INDIAN POINT 3 B 3.3.3 -'15 Revision 3

PAM Instrumentation B 3.3.3 BASES ACTIONS CJ (continued)

Required Action C.1 requires restoring one channel in the affected Function(s) to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation.

Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.

M1 Condition D applies when the Required Action and associated Completion Time of Condition C is not met. Required Action 0.1 requires entering the appropriate Condition referenced in Table 3.3.3-1 for the channel immediately. The applicable Condition referenced in the Table is Function dependent. Each time an inoperable channel has not met any '

Required Action of Condition C and the associated Completion Time has expired. Condition D is entered for that channel and provides for transfer to the appropriate subsequent Condition.

E.1 and E.2 If the Required Action and associated Completion Time of Condition D is not met and Table 3.3.3-1 directs entry into Condition E. the unit must be brought to a MODE where the requirements of this LCO do not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

INDIAN POINT 3 B 3.3.3 - 16 Revision 3

PAM Instrumentation B 3.3.3 BASES ACTIONS E1 (continued)

Alternative means of monitoring neutron flux, condensate storage tank level, main steam line radiation, gross failed fuel, containment isolation valve position indications and containment area radiation are available. These alternate means may be used If the normal PAM channel cannot be restored to OPERABLE status within the allotted time. If these alternate means can be used, the'Required Action is not to shut down the unit but rather to follow the directions in Specification 5.6.7, in the Administrative Controls section of the TS.

The report provided to the NRC should discuss the alternate means available, describe the degree to which'the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels.,

SURVEILLANCE REQUIREMENTS A Note has been added to the SR Table to clarify that SR 3.3.3.1 and SR 3.3.3.3 apply to each PAM instrumentation Function in Table 3.3.3-

-' 1.

'- SR 3.3.3.1 -

Performance of the CHANNEL CHECK once every 31 days ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is ,based on the assumption that instrument channels 'monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in-one of the channels-or-of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each'CHANNEL CALIBRATION. The high radiation instrumentation should be compared to similar unit instruments located throughout the unit.

(continued)

'INDIAN POINT 3 B 3.3.3 -'17 Revision 3

PAM Instrumentation B 3.3.3 BASES SURVEILLANCE REOUIREMENTS SR 3.3.3.1 (continued)

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE.

As specified in the SR. a CHANNEL CHECK is only required for those channels that are normally energized.

The Frequency of 31 days is based on operating experience that demonstrates that channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.3.2 A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter with the necessary range and accuracy. This SR is modified by a Note that excludes neutron detectors. The calibration method for neutron detectors is described in the Bases of LCO 3.3.1, "Reactor Trip System (RTS)

Instrumentation." The Frequency is based on operating experience and consistency with the typical industry refueling cycle.

REFERENCES 1. Safety Evaluation: Conformance to Regulatory Guide 1.97. Revision 3, for Indian Point 3 (TAC No. 51099), dated April 3, 1991.

2. Regulatory Guide 1.97, Revision 3.

3. NUREG-0737, Supplement 1, "TMI Action Items."

4. FSAR, Section 7.

INDIAN POINT 3 B 3.3.3 - 18 Revision 3

Remote Shutdown B 3.3.4 B 3.3 INSTRUMENTATION B 3.3.4 Remote Shutdown BASES BACKGROUND Remote Shutdown provides'thecontrol room operator with sufficient instrumentation and controls to' place and'maintain the unit in a safe shutdown condition from a location other than'the control room. This capability is necessary to protect against the possibility that the control room becomes inaccessible. A safe shutdown condition is defined as'MODE 3. With the unit in MODE 3. the'Auxiliary Feedwater (AFW) System and the main steam safety'valves (MSSVs) or the SG atmospheric dump valves (ADVs) can be used to remove core decay heat and meet all safety requirements. The long term supply of water for the AFW System and the ability to borate the Reactor Coolant System (RCS) from outside the control room allows extended operation in MODE 3.

If the control room becomes inaccessible, the operators can establish control at various local control stations and place and maintain the unit in MODE 3. Controls and transfer switches are operated locally at the switchgear. motor control panels, or other local stations. The unit automatically reaches MODE 3 following a unit shutdown and can be maintained safely in MODE 3 for an extended period of time.

The OPERABILITY of the local control and instrumentation functions ensures there is sufficient information available on selected unit parameters to place and maintain the unit in MODE 3 should the control room become inaccessible.

APPLICABLE SAFETY ANALYSES -

Remote Shutdown is required to provide equipment at appropriate locations outside-the control room to promptly shut down and maintain the unit in a safe condition in MODE 3.

The criteria governing the design and specific system requirements of the Remote Shutdown are located in 10 CFR 50. Appendix A, GDC 19 (Ref.

1).

(continued)

INDIAN'POINT 3 B 3; 3.4 - I Revision 1

Remote Shutdown B 3.3.4 BASES J.

APPLICABLE SAFETY ANALYSES (continued)

Remote Shutdown capability and requirements for remote shutdown are presented in Reference 2.

Remote Shutdown is considered an important contributor to the reduction of unit risk to accidents and as such meets Criterion 4 of CFR 50.36.

LCO The Remote Shutdown LCO provides the OPERABILITY requirements of the instrumentation and controls necessary to place and maintain the unit in MODE 3 from a location other than the control room. The instrumentation and controls required are listed in Bases Table B 3.3.4-1.

The controls, instrumentation, and transfer switches are required for:

Core reactivity control (initial and long term):

RCS pressure control; 1.

Decay heat removal via the AFW System and the MSSVs or SG ADVs;

RCS inventory control via charging flow; and

Safety support systems for the above Functions, including service water, component cooling water, and onsite power, including the diesel generators.

A Function of a Remote Shutdown is OPERABLE if all instrument and control channels needed to support the Remote Shutdown Function are OPERABLE. In some cases. Table 3.3.4-1 may indicate that the required information or control capability is available from several alternate sources. In these cases, the Function is OPERABLE as long as one channel of any of the alternate information or control sources is OPERABLE.

(continued)

INDIAN POINT 3 B 3.3.4 -2 Revision I

Remote Shutdown B 3.3.4 BASES LCO The remote shutdown instrument and control circuits covered by (continued) this LCO do not need to be energized to be considered OPERABLE. This LCO is intended to ensure the instruments and control circuits will be OPERABLE if unit conditions require that the plant is shutdown from a location other than the control room'.

APPLICABILITY The Remote Shutdown LCO is applicable in MODES 1. 2, and 3. This is required so that the unit can be placed and maintained in MODE 3 for an extended period of time from a location'other than the control room.

This LCO is not applicable in MODE 4. 5, or 6. In these MODES, the facility is already subcritical and in a condition of reduced RCS energy. Under these conditions, considerable time is available to restore necessary instrument control functions if control room instruments or controls become unavailable.

ACTIONS A Note has been added to the ACTIONS to clarify the application of I Completion Time rules. Separate Condition entry isallowed for each Function listed on Table 3.3.4-1. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked

separately for each Function starting from the time the Condition was

entered for that Function.

'Condition Akaddresses the situation where one or more required Remote Shutdown Functionsiare inoperable. This includes any Function listed

-inTable 3.3.4-1. as well ai the control and transfer switches.

The Required Action is to restore the required Function to OPERABLE status within 30 days. The Completion Time is based on operating experiencefand'the low probability of an event that would require

-.-evacuation of the control "room. '

.(.c . .-- * -

,, ,, , - (continued)

'INDIAN POINT 3 B 3.3.4 -3 Revision I

Remote Shutdown B 3.3.4 BASES ACTIONS (continued) B.1 and B.

If the Required Action and associated Completion Time of Condition A is not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

The following Surveillance Requirements are applied to each of the remote shutdown function in Bawes Table B 3.3.4-1. as appropriate.

SURVEILLANCE REOUIREMENTS The following Surveillance Requirements are applied to each of the remote shutdown functions in Table B 3.3.4-1, as appropriate.

SR 3.3.4.1 Performance of the CHANNEL CHECK once every 31 days ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious.

CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If the channels are within the criteria, it is an indication that the channels are OPERABLE. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

(continued)

INDIAN POINT 3 B 3.3.4 - 4 Revision 1

Remote Shutdown B 3.3.4 K..> BASES SURVEILLANCE REOUIREMENTS SR 3.3.4.1 (continued)

As specified in the Surveillance, a CHANNEL CHECK is only required for

-those channels which are normally energized.;

The Frequency of 31 days is based upon operating experience which demonstrates that channel failure is rare. The CHANNEL CHECK supplements less formal checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.4.2 SR 3.3.4.2 verifies each required Remote Shutdown control circuit and transfer switch performs the intended function. This verification is performed locally. Operation of the equipment is not necessary. The Surveillance can be satisfied by performance of a continuity check.

This will ensure that if the control room becomes inaccessible, the unit can be placed and maintained in MODE 3 from the local control stations. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. (However; this Surveillance is not required to be performed only during a unit outage.) Operating experience demonstrates that remote shutdown control channels usually pass the Surveillance test when performed at the 24 month Frequency.

SR 3.3.4.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies that the channel responds to a-measured parameter within the necessary range and accuracy.

The Frequency of 24 months is based upon operating experience and consistency with the typical industry refueling cycle.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 19.

2. FSAR, Section 7.7.3.

INDIAN POINT 3 B 3.3.4-:-55 Revision I

Remote Shutdown B 3.3.4 BASES J Table B 3.3.4-1 (page 1 of 1)

Remote Shutdown Instrumentation and Controls FUNCTION/INSTRUMENT REOUIRED OR CONTROL PARAMETER NUMBER OF FUNCTIONS

1. Reactivity Control a.Source Range Neutron Flux 1 b.Reactor Trip Breaker Position 1 per trip breaker c.Manual Reactor Trip 2

2. Reactor Coolant System (RCS) Pressure Control a.Pressurizer Pressure 1 or RCS Wide Range Pressure b.Pressurizer Heaters 1

3. Decay Heat Removal via Steam Generators (SGs) a.RCS Hot Leg Temperature (loop 31) 1 b.RCS Cold Leg Temperature (loop 31) 1 c.AFW Controls 1 d.SG Pressure 1 e.SG Level 1

4. RCS Inventory Control a.Pressurizer Level 1 b.Charging Pump Controls 1 INDIAN POINT 3 B 3.3.4 - 6 Revision 1

Pressurizer PORVs

B3.4.11 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.11 Pressurizer'Power Operated Relief Valves (PORVs)

BASES BACKGROUND The pressurizer 'isequipped with two types of devices for pressure relief: pressurizer safety valves and PORVs. The PORVs are nitrogen operated valves that are controlled to open at a specific set pressure when the pressurizer pressure increases and close when the pressurizer pressure decreases. The PORVs may also be manually operated from the control room.

Block valves, which are normally open, are located between the pressurizer and the PORVs. The block yalves are used to isolate the PORVs in-case of excessive leakage or a stuck open PORV. Block valve closure is accomplished manually using controls in the control room.

'Astuck open PORV is, in effect, a small break loss of coolant accident (LOCA). As such, block valve closure terminates the RCS depressurization and coolant inventory loss.

The PORVs and their'associated block valves may be used by plant operators to depressurize the RCS to recover from certain transients if normal and alternate pressurizer spray is not available.

Additionally,' the series'arrangement of the PORVs and their block valves permit performance of surveillances on the valves during power operation.

The PORVs may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total loss of feedwater.

Electrical power needed to support the PORVs. their block valves, and their controls is supplied from the vital buses that normally receive power from offsite power sources, but is also capable of being supplied from emergency power sources in the event of a loss of offsite power. Two'PORVs and their associated block valves are powered from two separate safety trains (Ref. 1).--

(continued)

INDIAN POINT 3 B 3.4.11 - 1 R io Revi si on 1

Pressurizer PORVs B 3.4.11 BASES j

BACKGROUND The plant has two PORVs, each having a design relief capacity of (continued) 179,000 lb/hr at 2335 psig. The functional design of the PORVs is based on maintaining pressure below the Pressurizer Pressure -High reactor trip setpoint following a step reduction of 50% of full load with steam dump and automatic reactor control operation. In addition, the PORVs minimize challenges to the pressurizer safety valves and also may be used for low temperature overpressure protection (LTOP).

See LCO 3.4.12, 'Low Temperature Overpressure Protection (LTOP)

System."

APPLICABLE SAFETY ANALYSES Plant operators employ the PORVs to depressurize the RCS in response to certain plant transients if normal and alternate pressurizer spray are not available. For the Steam Generator Tube Rupture (SGTR) event, the safety analysis assumes that manual operator actions are required to mitigate the event. A loss of offsite power is assumed to accompany the event, and thus, normal pressurizer spray is unavailable to reduce RCS pressure. The PORVs or auxiliary spray are assumed to be used for RCS depressurization. which is one of the steps performed to equalize the primary and secondary pressures in order to terminate the primary to secondary break flow and the radioactive releases from the affected steam generator.

The PORVs are modeled in safety analyses for events that result in increasing RCS pressure for which departure from nucleate boiling ratio (DNBR) criteria are critical (Ref. 2). By assuming PORV manual actuation, the DNBR calculation is more conservative although not required to meet safety limits. As such, this actuation is not required to mitigate these events, and PORV automatic operation is not an assumed safety function.

Pressurizer PORVs satisfy Criterion 3 of 10 CFR 50.36.

LCO The LCO requires the PORVs and their associated block valves to be OPERABLE for manual operation to mitigate the effects associated with an SGTR.

(continued)

INDIAN POINT 3 B 3.4.11 - 2 Revision I

Pressurizer PORVs B 3.4.11 BASES LCO By maintaining two PORVs and their associated block valves (continued) OPERABLE, the single failure criterion is satisfied. An OPERABLE block valve may be either open, or closed and energized with the capability to be opened, since the required safety function is accomplished by manual operation. Although typically open to allow PORV operation, the block valves may be OPERABLE when closed to isolate the flow path of an inoperable PORV that is capable of being manually cycled (e.g.. as in the case of excessive PORV leakage).

Similarly, isolation of an OPERABLE PORV does not render that PORV or block valve inoperable provided the relief function remains available with manual action.'

An OPERABLE PORV is required to be capable-of manually opening and closing, and not experiencing excessive"seat leakage. Excessive seat leakage, although not associated with a specific acceptance criteria, exists when conditions dictate closure of the block valve to limit leakage. Satisfying the LCO helps minimize challenges to fission product barriers.

APPLICABILITY' In MODES 1, 2 and 3,'the PORV and its block valve are required to be OPERABLE to limit the potential for a small break LOCA through the flow path. The most likely cause for a PORV small break LOCA is a result of a pressure increase transient that causes the PORV to open.

Imbalances in the energy output of the core and heat removal by the secondary system can cause the RCS pressure to increase to the PORV opening setpoint. The most rapid'increases will occur at the higher operating power and pressure conditions of MODES 1 and 2. The PORVs are also required to be OPERABLE in-MODES 1, 2, and 3 for manual actuation to mitigate a'steam generator tube 'rupture event.

Pressure increases are less prominent in MODE 3 because the core input energy is reduced.,but the RCS pressure is high.' Therefore, the LCO is applicable in MODES 1.-2, and 3. The'LCO'is not applicable in MODE 4.'5 and 6 with the reactor vessel head in place when both pressure

-and core energy are'decreased and the pressure surges become much less significant. LCO 3.4.12'addresses'the PORV requirements in these MODES.

(continued)

INDIAN POINT 3 B 3.4.11 - 3 Revision I Rvin

Pressurizer PORVs B 3.4.11 BASES ACTIONS A Note has been added to clarify that all pressurizer PORVs are treated as separate entities, each with separate Completion Times (i.e., the Completion Time is on a component basis).

A,-l PORVs may be inoperable and capable of being manually cycled (e.g..

excessive seat leakage). In this condition, either the PORVs must be restored or the flow path isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The associated block valve is required to be closed, but power must be maintained to the associated block valve, since removal of power would render the block valve inoperable. This permits operation of the plant until the next refueling outage (MODE 6) so that maintenance can be performed on the PORVs to eliminate the problem condition.

Quick access to the PORV for pressure control can be made when power remains on the closed block valve. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on plant operating experience that has shown that minor problems can be corrected or closure accomplished in this time period.

B.1. B.2. and B.3 If one PORV is inoperable and not capable of being manually cycled, it must be either restored, or isolated by closing the associated block valve and removing the power to the associated block valve. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on challenges to the PORVs during this time period, and provide the operator adequate time to correct the situation. If the inoperable valve cannot be restored to OPERABLE status, it must be isolated within the specified time.

Because there is at least one PORV that remains OPERABLE, an additional 7 days is provided to restore the inoperable PORV to OPERABLE status. If the PORV cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition D.

(continued)

INDIAN POINT 3 B 3.4.11 - 4 Revision 1

Pressurizer PORVs

B 3.4.11 BASES ACTIONS C.1 and C.2 (continued)

If one block valve"is inoperable, then it is necessary to either restore the block valve to OPERABLE status within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or place the associated PORV in the closed position (i.e.,

switch in manual control). The prime importance 'for the capability to close the block valve is to isolate a stuckopern PORV. Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

the Required Action is to place the PORV-in manual control to preclude its automatic opening for an overpressure event and to avoid the potential for a-stuck'open PORV at a time that the block valve is inoperable. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation. Because at least one PORV remains OPERABLE, the operator is permitted a Completion Time of 7 days to restore the inoperable block valve to OPERABLE status. The time allowed to restore the block valve is based upon the Completion Time for restoring an inoperable PORV in Condition B. since the PORVs may not be capable of mitigating an overpressure event if the inoperable block valve is not full open. If the block valve is restored within the Completion Time of 7 days, the power will be restored to the PORV.' If it cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition D.

D.1 and D.2 If the Required Action of Condition A, B. or C is not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must belbrought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions-from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, automatic PORV OPERABILITY may be'required. See LCO 3.4.12.

(continued)

INDIAN POINT 3 B 3.4.11 - 5 R Revision I

Pressurizer PORVs B 3.4.11 BASES ACTIONS E.1. E.2. E.3 and E.4 (continued)

If more than one PORV is inoperable and not capable of being manually cycled, it is necessary to either restore at least one valve within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or isolate the flow path by closing and removing the power to the associated block valves. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the small potential for challenges to the system during this time and provides the operator time to correct the situation. If no PORVs are restored within the Completion Time, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

In MODES 4 and 5, maintaining PORV OPERABILITY may be required. See LCO 3.4.12.

F.1 and F.2 If more than one block valve is inoperable, it is necessary to either restore the block valves within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , or place the associated PORVs in manual control (i.e., closed position) and restore at least one block valve within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The Completion Times are reasonable, based on the small potential for challenges to the system during this time and provide the operator time to correct the situation.

G.1 and G.2 If the Required Actions of Condition F are not met, then the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5.

automatic PORV OPERABILITY may be required. See LCO 3.4.12.

(continued)

INDIAN POINT 3 B 3.4.11 - 6 Revision I

Pressurizer PORVs B 3.4.11 BASES SURVEILLANCE REOUIREMENTS SR- 3.4.11.1 Block valve cycling verifies that the valve(s) can be opened and closed if needed. The basis for the Frequency of 92 days is the ASME Code.Section XI (Ref. 3). If the block valve is closed to isolate a PORV that is capable of being manually cycled, the OPERABILITY of the block valve is important because opening the block valve is necessary to permit the PORV to be used for manual control of reactor pressure.

If the block valve is closed to isolate an inoperable PORV that is not capable of being manually cycled, the maximum Completion Time to restore the PORV and open the block valve is 7 days, which is well within the allowable limits (25%) to extend the block valve Frequency of 92 days. Furthermore, these test requirements would be completed by the reopening of a recently closed block valve upon restoration of the PORV to OPERABLE status.

The Note modifies this SR by stating that It is not required to be met with the block valve closed, in accordance with the Required Action of this LCO.

SR 3.4.11.2 SR 3.4.11.2 requires a complete cycle of each PORV. Operating a PORV through one complete cycle ensures that the PORV can be manually actuated for mitigation of an SGTR. The Frequency of 24 months is based on a typical refueling cycle and industry accepted practice.

REFERENCES 1. Regulatory Guide 1.32, February 1977.

2. FSAR, Section 14.

3. ASME, Boiler and Pressure Vessel Code,Section XI.

INDIAN POINT 3 B 3.4.11 - 7 Revision 1

LTOP B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12 Low Temperature Overpressure Protection (LTOP)

BASES BACKGROUNDz LTOP is established to limit RCS pressure at low temperatures so the integrity of the'reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of

10 CFR 50, Appendix G (Ref. 1).' The reactor vessel is the limiting RCPB component'for demonstrating such protection.- LCO 3.4.12. Figure 3.4.12-1'provides the'maximum allowable-nominal actuation logic setpoints'for the power operated relief valves -(PORVs) and the maximum

-'RCS'pressure'for the coldest existing RCS cold'leg temperature during cooldown. shutdown, and heatup to meet the Reference 1 requirements during the LTOP MODES.'

The reactor vessel material is less tough at low temperatures than at normal operating temperature.. As the' vessel neutron exposure

-accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures '(Ref. 2). RCS E pressure, therefore, is maintained low at low temperatures and is

-increased'only as temperature is increased.

The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only while shutdown because a pressure fluctuation can occur more quickly than'ah operator can react to

- relieve the condition. 'Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3.

-RCS Pressure and Temperature (P/T) Limits,".requires administrative

'control of RCS pressureand temperature"during heatup and cooldown to prevent exceeding the limits in Figure 3.4.12-1 When the RHR System is'isolated from the RCS, the RHR System is protected-from overpressure by two spring'loaded relief valves (SI-733A and SI-733B). When the RHR System'is not isolated from the RCS, the RHR System is protected from overpressure by spring loaded relief valve (i.e., AC-1836) which has sufficient'capacity to accommodate all 3 charging pumps. However, this relief- valve'does not have sufficient (continued)

INDIAN POINT 3 B 3.4.12 - I Revision 2

LTOP B 3.4.12 BASES BACKGROUND capacity to ensure that the RHR system does not exceed design pressure (continued) limits during a mass addition resulting from an inadvertent injection of one or more high head safety injection (HHSI) pumps. Therefore.

LTOP requirements are used to protect the RHR System whenever the RHR System is not isolated from the RCS.

This LCO provides RCS overpressure protection by limiting maximum coolant input capability and having adequate pressure relief capacity.

Limiting coolant input capability is achieved by not permitting any High Head Safety Injection (HHSI) pumps to be capable.of injection into the RCS and isolating the accumulators. The pressure relief capacity requires either two redundant power operated relief valves (PORVs) or a depressurized RCS and an RCS vent of sufficient size.

One PORV or the open RCS vent is sufficient to provide overpressure protection to terminate an increasing pressure event. Alternately, if redundant PORVs are not Operable or an RCS vent cannot be established, LTOP protection may be established by limiting the pressurizer level to within limits specified in Figure 3.4.12-2 and Figure 3.4.12-3 consistent with the number of charging pumps and number of high head safety injection (HHSI) pumps capable of injecting into the RCS. This approach is acceptable because pressurizer level can be maintained such that it will either accommodate any anticipated pressure surge or allow operators time to react to any unanticipated pressure surge.

When pressurizer level is used to satisfy LTOP requirements, operator action is assumed to terminate the unplanned HHSI pump injection within 10 minutes.

With high pressure coolant input capability limited, the ability to create an overpressure condition by coolant addition is restricted.

The LCO does not require the makeup control system deactivated or the safety injection (SI) actuation circuits blocked. Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve. There is no restriction on the status of charging pumps when LTOP is established using either a PORV or an RCS vent. If conditions require the use of more than one HHSI pump for makeup in the event of loss of inventory, then pumps can be made available through manual actions. Charging pumps and low pressure injection systems are available to provide makeup even when LTOP requirements are applicable.

(continued)

INDIAN POINT 3 B 3.4.12 - 2 Revision 2

LTOP B 3.4.12 BASES BACKGROUND. When configured to provide low temperature overpressure protection, (continued) the PORVs' are'part of the Overpressure Protection System (OPS). LTOP for pressure relief can consist of either the OPS (two PORVs with reduced lift settings),.'or a depressurized'RCS and an RCS vent of

sufficient size. 'Two PORVs are required for redundancy. One PORV has adequate relieving capability to keep from overpressurization for the required coolant input capability.

PORV Requirements The Overpressure Protection System (OPS) provides the low temperature overpressure protection by controlling the Power Operated Relief Valves (PORVs) and their associated block valves with pressure setpoints that vary with RCS cold leg temperature. Specifically, cold leg temperature signals from three RCS'loops are supplied to three associated function generators that calculate the maximum RCS pressures allowed at those temperatures. The maximum RCS pressure limits at any RCS temperature correspond to the 10 CFR 50, Appendix G.

limit curve maintained in the Pressure and Temperature Limits Report and are used as the OPS pressure setpoint. Having the setpoints of

-both valves within the limits in Figure 3.4.12-1 ensures that the Reference 1 limits will not be exceeded in any analyzed event.

-In addition to generating the'OPS pressure setpoint. the same cold leg

- temperature signals are used to "arm" the OPS when RCS temperature falls below the temperature at which lowttemperature overpressure protection is required (319 0F). This temperature includes an allowance of 14.4 0F for instrument uncertainty and margin. Each PORV opens when a two-out-of-two (temperature and pressure) coincidence

-logic is satisfied. OPS is "armed' when RCS temperature falls below Pt r, 6the temperature that satisfies one half of the two-out-of-two

--(temper'ature-pressure) coincidence logic.' When OPS is enabled, the PORVs will open if RCS pressure exceeds the calculated pressure setpoint that varies with RCS'temper'ature.

The PORV block valves open when the RCS temperature falls below the OPS arming temperature. :Note that the control switches for the PORV and PORV block valves'must be in the AUTO position and the OPS states links closed'for OPS signals to actuate the PORVs.

(continued)

INDIAN POINT 3 B 3.4.12 - 3 Revision 2

LTOP B 3.4.12 BASES BACKGROUND Three channels of RCS cold leg temperature are used in the two-out-of-(continued) three coincidence logic to satisfy the temperature portion of the two-out-of-two (temperature and pressure) coincidence logic for each PORV.

Three channels of RCS pressure are used in a two-out-of-three coincidence logic to satisfy the pressure portion of the two-out-of-two (temperature-pressure) coincidence logic for each PORV. Use of a two-out-of-three coincidence logic for pressure and for temperature ensures that a single failure will not cause or prevent an OPS actuation. Use of two PORVs, each with adequate relieving capability to prevent overpressurization, ensures that a single failure will not prevent an OPS actuation.

When a PORV is opened in an increasing pressure transient, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.

RCS Vent Requirements Once the RCS is depressurized. a vent exposed to the containment atmosphere will maintain the RCS at containment ambient pressure in an It RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass or heat input transient, and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.

Multiple methods exist for establishing the required RCS vent capacity including removing or blocking open a PORV and disabling its block valve in the open position. An RCS vent of > 2.00 square inches when no HHSI pump is capable of injecting into the RCS; or, an RCS vent with opening greater than or equal to one pressurizer code safety valve flange and up to two HHSI pumps capable of injecting into the RCS will satisfy LTOP requirements because either configuration ensures pressure limits are not exceed during a transient.

Alternately, an RCS vent of 2 2.00 square inches coupled with a pressurizer level < 0%and up to two HHSI pumps capable of injecting into the RCS will satisfy LTOP requirements because it ensures a minimum of 10 minutes for operator action before pressure limits are exceeded during a transient. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.

(continued) I INDIAN POINT 3 B 3.4.12 - 4 Revision 2

LTOP B 3.4.12 BASES APPLICABLE SAFETY ANALYSES Safety analyses (Ref. 3) demonstrate that the reactor vessel is adequately protected against exceeding the Reference 1 P/T limits. In MODES 1, 2, and 3, with RCS cold leg temperature exceeding 411 0F, the pressurizer safety Valves will prevent RCS pressure from exceeding the Reference 1 limits. At"319 OF and below,' overpressure prevention falls

-to two OPERABLE PORVs in conjunction with the Overpressure Protection System (OPS) or to a'depressurized RCS and a sufficient sized RCS vent. Each of these means has a limited overpressure relief capability. Alternately, if redundant PORVs are not Operable, Low Temperature Overpressure protection may be maintained by limiting the pressurizer level to within limits specified in Figure 3.4.12-2 and Figure 3.4.12-3 consistent with the number of charging pumps and number of high head safety injection (HHSI) pumps capable of injecting into the RCS. This approach is acceptable because pressurizer level can be established to either accommodate a6ny anticipated pressure surge or allow operators time to react to any unanticipated pressure surge.

When the RCS temperature is greater than the LTOP arming temperature (i.e., > 319OF) but below the minimum temperature at which the pressurizer safety valves'lift prior to violation of the 10 CFR 50.

Appendix G. limits (i.e., < 380 0F), administrative controls in the Technical Requirements Manual (TRM)'(Ref. 4) are used to limit the potential for exceeding 10 CFR 50, Appendix G. limits. These administrative controls may include operating with a bubble in the pressurizer and/or otherwise limiting plant time or activities when the RCS temperature is in the specified range. The use of administrative controls to govern operation above the LTOP arming temperature but'below the minimum temperature at which the pressurizer safety valves lift prior to violation of the 10 CFR 50, Appendix G.

limits is consistent with th6 guidance provided in Generic Letter 88-011, NRC Position on Radiation Embrittlement of Reactor Vessel Materials and its Impact on Plant Operations (Ref.2). GL 88-011 states that automatic, or passive, protection of the P-T limits will not be required but administratively controlled when in the upper end of the 10 CFR 50, Appendix G, temperature range.'

(continued)

INDIAN POINT 3 B 3.4.12 - 5 Revision 2

LTOP B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)

The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the Figure 3.4.12-1 curves are revised. LTOP must be re-evaluated to ensure its functional requirements can still be met using the OPS (PORVs) method or the depressurized and vented RCS condition.

Figure 3.4.12-1 contains the acceptance limits that define the LTOP requirements. Any change to the RCS must be evaluated against the Ref. 3 analyses to determine the impact of the change on the LTOP acceptance limits.

Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow:

Mass Input Type Transients

a. Inadvertent safety injection; or

b. Charging/letdown flow mismatch.

Heat Input Type Transients

a. Inadvertent actuation of pressurizer heaters;

b. Loss of RHR cooling; or

c. Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.

The following are required during the LTOP MODES to ensure that mass and heat input transients do not occur. This is accomplished by the following:

a. Rendering all HHSI pumps incapable of injection; (continued)

INDIAN POINT 3 B 3.4.12 - 6 Revision 2

LTOP B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)

b. Deactivating the accumulator discharge isolation valves in their

'closed positions or maintaining accumulator pressure less than the maximum'RCS pressure for the coldest existing RCS cold leg temperature allowed by the P/T limit curves'provided in Figure 3.4.12-1: and '

c. Disallowing start of an RCP unless'conditions are established that ensure a RCP pump start will not cause a pressure excursion

-';that will exceed LTOP limits. Required conditions for starting a RCP when LTOP-is required include a combination of primary and secondary water temperature differences and Overpressure Protection System (OPS) status or pressurizer level. Meeting the LTOP RCP starting surveillances ensures that theses conditions are satisfied prior to a RCP pump start.

The Ref. 3 analyses demonstrate'that either one PORV or the

,depressurized RCS and RCS vent can maintain RCS pressure below limits when no HHSI pump is capable of injecting into the RCS. This assumes an RCS vent of > 2.00'square"inches. The same protection can be provided when up to two HHSI pumps are capable of injecting into the RCS assuming an RCS vent with opening greater'than or equal to one

-code pressurizer safety valve flange. Alternately. LTOP requirements can be satisfied by various combinations of pressurizer level, RCS pressure, and RCS injection capability (i.e.'.,maximum number of HHSI pumps and/or charging pumps) shown in Figure 3.4.12-2 and 3.4.12-3.

These combinations of pressurizer level, RCS pressure, and RCS injection capability satisfy'LTOP requirements by ensuring a minimum of 10 minutes for operator action to terminate an unplanned event

prior to exceeding maximum allowable RCS pressure. None of the analyses addressed-the pressure transient need from accumulator injection, therefore, when-RCS temperature'is low, the LCO also requires .the accumulator isolation when accumulator pressure is greater than or equal to the!maximum RCS pressure for the coldest existing RCS cold legltemperature allowed in Figure 3.4.12-1.

(continued)

INDIAN POINT 3 B 3.4.'12 - 7 ' Revision 2

LTOP B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued)

If the accumulators are isolated and not depressurized. then the accumulators must have their discharge valves closed and the valve power supply breakers fixed in their open positions.

Fracture mechanics analyses established the temperature of LTOP Applicability at 319 OF.

The consequences of a loss of coolant accident (LOCA) in LTOP MODE 4 conform to 10 CFR 50.46 and 10 CFR 50. Appendix K (Refs. 5 and 6) requirements by having ECCS OPERABLE in accordance with requirements in LCO 3.5.3, ECCS-Shutdown.

PORV Performance The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the limit shown in Figure 3.4.12-1. The setpoints are derived by analyses that model the performance of the LTOP System, assuming the limiting LTOP transient with HHSI not injecting into the RCS. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensures the Reference 1 P/T limits will be met. The OPS setpoint is based on a comparative analysis of Reference 3. with allowances for metal/fluid temperature differences, static head due to elevation differences, and dynamic head from the operation of the reactor coolant pumps and RHR pumps.

The PORV setpoints in Figure 3.4.12-1 will be updated when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation.

Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.3. "RCS Pressure and Temperature (P/T) Limits," discuss these examinations.

The PORVs are considered active components. Thus, the failure of one PORV is assumed to represent the worst case, single active failure.

(continued)

INDIAN POINT 3 B 3.4.12 -8 Revision 2

LTOP B 3.4.12 BASES APPLICABLE SAFETY ANALYSES (continued) - '

RCS Vent Performance With the RCS depressurized. analyses shownavent size of 1.4 square inches is capable of mitigating the allowed LTOP overpressure transient assuming no HHSI pump and no accumulator injects into the RCS. The LCO limit for an RCS vent is conservatively established at

'2.00 square inches. The capacity of a vent this size is greater than the flow of the limiting transient for the LTOP configuration.

maintaining RCS pressure less than the maximum pressure on the P/T

'limit curve. An RCS vent with opening' greater than or equal to one pressurizer code safety valve flange and up to two HHSI pumps capable of injecting into the RCS will satisfy'LTOP requirements because it ensures pressure limits are not exceed during a transient. An RCS vent of Ž 2.00 square inches coupled with'a pressurizer level < 0% and up to two HHSI pumps capable of injecting into the RCS will satisfy LTOP requirements because it'ensures a'minimum of 10 minutes for "operator action before pressure limits are exceeded during a transient.

The RCS vent size will be re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material surveillance.

The RCS vent is passive and is not subject to active failure.

LTOP satisfies Criterion 2 of 10 CFR 50.36.

LCO This LCO requires that LTOP is OPERABLE. *LTOP is OPERABLE when the minimum'coolant input and pressure relief capabilities are OPERABLE.

Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient.

To limit the coolant input'capability, the'LCO requires that no HHSI pumps be capable of injecting into the RCS and all accumulator discharge isolation'valves' closed and de-energized if accumulator pressure is'greater than or equal to the maximum RCS pressure for the existing RCS cold leg temperature allowed in Figure 3.4.12-1. Maximum Allowable Nominal PORV Setpoint for LTOP (OPS).

(continued)

INDIAN POINT 3 B 3.4.12- 9 Revision 2

LTOP B 3.4.12 BASES J LCO The elements of the LCO that provide low temperature overpressure (continued) mitigation through pressure relief are:

a. Two OPERABLE PORVs configured as part of an OPERABLE Overpressure Protection System (OPS): or

b. A depressurized RCS and an RCS vent.

A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set to the limit required by Figure 3.4.12-1 and testing proves its ability to open at this setpoint. and motive power is available to the two valves and their control circuits.

The OPS is OPERABLE for LTOP when there are three OPERABLE RCS pressure channels and three OPERABLE RCS temperature channels. The OPS is still OPERABLE when an inoperable RCS pressure or temperature channel is in the tripped condition. OPS is considered OPERABLE for meeting LCO 3.4.12 requirements even if one or two RCS cold leg temperatures is above the LTOP Applicability limit.

An RCS vent is OPERABLE when open with an area of > 2.00 square inches.

.i Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.

APPLICABILITY This LCO is applicable whenever the RHR System is not isolated from the RCS to protect the RHR system piping. When all RCS cold leg temperatures are > 319 'F, RHR system piping is adequately protected by making the accumulators and all HHSI pumps incapable of injecting into the RCS. Therefore, a Note in the LCO specifies that requirements for the OPS System and/or an RCS vent are not Applicable when all RCS cold leg temperatures are > 319 OF.

This LCO is applicable to provide protection for the RCS pressure boundary in MODE 4 when any RCS cold leg temperature is < 319 OF, in MODE 5, and in MODE 6 when the reactor vessel head is on. The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above 319 OF. When the reactor vessel head is off, overpressurization cannot occur. Although LTOP is not (continued) ,1 INDIAN POINT 3 B 3.4.12 - 10 Revision 2

LTOP B 3.4.12 BASES APPLICABILITY Applicable when the RCS temperature is greater than the LTOP arming (continued) temperature (i.e., . 319 OF) but below the minimum temperature at which the pressurizer safety valves lift prior to violation of the 10 CFR 50, Appendix G. limits (i.e.,

380 OF); administrative controls in the Technical Requirements Manual (TRM) (Ref. 4) are used to limit the potential for exceeding 10 CFR 50, Appendix G. limits. LCO 3.4.3 provides the'operational P/T limits for all!MODES. LCO 3.4.10,

-'Pressurizer Safety Valves." requires the:OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above 319 0F when the RHR system is isolated from the RCS.

Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows operator action to mitigate the event.

The Applicability is modified by'three Notes, Note 1 states that accumulator isolation is only required when the accumulator pressure is more than the maximum RCS pressure for the existing temperature, as allowed by the P/T limit curves. This Note permits the accumulator discharge isolation valve Surveillance to be performed only under these pressure and temperature conditions.-

Note 2 ensures that LCO 3.4.12 will not prohibit a HHSI pump being energized and aligned to the RCS~as needed to support emergency boration or to respond to a loss of RHR cooling.

Note 3 specifies that one HHSI pump may be made capable of injecting into the RCS for a-period not to exceed 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to perform pump testing. During testing, administrative controls are used to ensure that HHSI testing-will not result in exceeding RCS or RHR system pressure limits.

- in,

.- , . . . . . -; . , l .

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable LTOP system. There is an increased risk associated with entering MODE 4 from MODE5 with LTOP inoperable and the'provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

(continued)

INDIAN POINT 3 B 3.4.12 -1 1 Revision 2

LTOP B 3.4.12 BASES ACTIONS A.1. A.2.1. A.2.2. A.2.3. A.3.1 and A.3.2 (continued)

When one or more HHSI pumps are capable of injecting into the RCS, LTOP assumptions regarding limits on mass input capability may not be met. Therefore. immediate action is required to limit injection capability consistent with the LTOP analysis assumptions and the existing combination of pressurizer level and RCS venting capacity.

Required Action A.1 requires restoration with LCO requirements.

Required Actions A.2 and A.3 require verification and periodic re-verification that alternate LTOP configurations are met. The Completion Times of immediately reflects the urgency that one of the acceptable LTOP configurations is established as soon as possible.

B.1. C.1 and C.2 To be considered isolated, an accumulator must have its discharge valves closed and the valve power supply breakers fixed in the open position.

An unisolated accumulator requires isolation within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This is only required when the accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T L limit curves.

If isolation is needed and cannot be accomplished in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Required Action C.1 and Required Action C.2 provide two options, either of which must be performed in the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . By increasing the RCS temperature to > 319 OF. an accumulator pressure of 700 psig cannot exceed the LTOP limits if the accumulators are injected. Isolating the RHR system from the RCS ensures that the RHR system is not subjected to accumulator pressure. Depressurizing the accumulators below the LTOP limit from Figure 3.4.12-1 also gives this protection.

Additionally, the RHR System must be isolated from the RCS to protect RHR piping from a potential mass addition event.

The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.

(continued)

INDIAN POINT 3 B 3.4.12 -12 Revision 2

LTOP B 3.4.12 BASES ACIONS EL1 (continued)

When any RCS cold leg temperature is < 319 OF, with one required PORV

'inoperable, the PORV must be restored to OPERABLE status within a Completion Time of 7 days. Two PORVs are required to provide low temperature overpressure mitigation while'withstanding a single failure of an active.component.

The Completion Time considers the facts that only oneof the PORVs is required to mitigate an overpressure transient and that the likelihood of an active failure of the remainingivalve path during this time period is very low.

iLl When both required PORVs are inoperable or the Required Action and associated Completion Time of-Condition C or"D Is not met, an alternate method of low temperature overpressure'protection must be established within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The acceptable alternate methods of LTOP include the following:

a. Depressurize the RCS and establish anRCS vent path; or

-b. Increase all RCS cold leg temperatures to 2 3190 F and isolate the RHR system from theRCS; or -

If the option selected is to depressurize the RCS and establish an RCS vent path, the vent must be sized . 2.00 square inches to ensure that the flow capacity is greater than that required for the worst case

mass input transient reasonable during the applicable MODES. This action is needed to protect'the RCPB from a-low temperature overpressure event and a possible brittle failure of the reactor vessel.

The Completion Time considers the time required to place the plant in

this Condition and the relatively low probalility'of an overpressure event during this time period due to increased operator awareness of administrative control requirements.

(continued)

INDIAN POINT 3 B 3.4.12 -13 Revision 2

LTOP B 3.4.12 BASES ACTIONS ELI (continued)

If LTOP requirements are not met for reasons other than Conditions A.

B. C, D or E, LTOP requirements must be re-established by depressurizing the RCS and establishing an RCS vent of 2 2.00 square inches within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

SURVEILLANCE REQUIREMENTS SR 3.4.12.1 and SR 3.4.12.2 To minimize the potential for a low temperature overpressure event by limiting the mass input capability, all HHSI pumps are verified incapable of injecting into the RCS. Additionally, the accumulator discharge isolation valves are verified closed and locked out or the accumulator pressure less than the maximum RCS pressure for the existing RCS cold leg temperature allowed by the P/T limit curves provided in Figure 3.4.12-1.

The HHSI pumps are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control. Other methods may be employed using at least two independent means to prevent a pump start such that a single failure or single action will not result in an injection into the RCS.

This may be accomplished through the pump control switch being placed in Trip Pullout and at least one valve in the discharge flow path being closed.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient, considering other indications and alarms available to the operator in the control room, to verify the required status of the equipment.

SR 3.412.3 The RCS vent of > 2.00 square inches is proven OPERABLE by verifying its open condition either:

a. Once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for a valve that is not locked.

(continued)

INDIAN POINT 3 B 3.4.12 -14 Revision 2

LTOP B 3.4.12 BASES SURVEILLANCE REOUIREMENTS SR 3.4.12.3 (continued)

b. Once'every 31 days for a valve that is locked, sealed, or secured in position. A removed pressurizer safety valve, PORV, or Manway Cover fits this category.

The passive vent arrangement must only be open to be OPERABLE. This Surveillance is required to be performed if the vent is being used to satisfy the pressure relief requirements of the LCO 3.4.12.b.

' ' ~SR 3.4.12.4

Performance of the CHANNEL CHECK of the Overpressure Protection System (OPS) RCS pressure and temperature channels every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the'same value. Significant deviations between the two instrument channels could be an indication of excessive:instrument drift in one of the channels'or of something even more serious. *ACHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff based on a combination' of the channel instrument uncertainties, including indication and readability. If a channel'is outside the criteria, it may be an indication that the sensor or thesignal processing equipment has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, 'checksof channels'during normal (continued)

INDIAN POINT 3 B 3.4.12 -1 5 Revision 2

_.LJ1 LTOP B 3.4.12 BASES J SURVEILLANCE REOUIREMENTS SR 3.4.12.4 (continued) operational use of the displays associated with the LCO required channels. This SR is required only when LCO 3.4.12.a is used to establish LTOP protection.

SR 3.4.12.5 The PORV block valve opens automatically when RCS cold leg temperature is below the OPS arming temperature; however, the valves must be verified open every 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to provide the flow path for each required PORV to perform its function when actuated. The valve may be remotely verified open in the control room. This Surveillance is performed only if the PORV is being used to satisfy LCO 3.4.12.a.

The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required removed, and the manual operator is not required locked in the inactive position. Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation. If closed, the block valve must be de-energized to prevent the valve from re-opening automatically.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Frequency is considered adequate because the PORV block valves are opened automatically by the OPS when below the OPS arming temperature if the valve control is positioned to auto and other administrative controls available to the operator in the control room, such as valve position indication, that verify that the PORV block valve remains open.

SR 3.4.12.6 Performance of a COT is required within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after decreasing all RCS temperatures to < 319 OF and every 31 days on each required PORV to verify and, as necessary, adjust its lift setpoint. The COT will (continued)

INDIAN POINT 3 B 3.4.12 - 16 Revision 2

LTOP B 3.4.12 BASES SURVEILLANCE REOUIREMENTS SR 3.4.12.6 (continued) verify the setpoint is within the allowed maximum limits in Figure 3.4.12-1. PORV actuation'could depressurize the RCS and is not required.

.The 24'month Frequency considers the demonstrated reliability of the Overpressure Protection System and the'PORVs.

A Note has been added indicating that this SR is required to be met 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after decreasing RCS cold leg temperature to < 319 OF. The COT cannot be performed until in the LTOP MODES when the PORV lift setpoint can be reduced to the LTOP setting. The test must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering the LTOP MODES.

SR 3.4.12.7

'Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required every 18 months. Performance of a CHANNEL CALIBRATION of RCS pressure and temperature instruments that support

-the'Overpressure Protection System is required every 24 months. These calibrations'verify both the OPS and PORV function and ensure the OPERABILITY of the whole channel so that it responds and the valve opens within the'required'range and 'accuracy to known input.

SR 3.4.12.8 and SR 3.4.12.9 The RCP starting prerequisites must be satisfied prior to starting or jogging any reactor coolant pump (RCP) when low temperature overpressure protection is required, The RCP starting prerequisites

'prevent an overpressure event due to thermal transients when an RCP is

'started. 'Plant conditions prior to the' RCP start determines whether SR 3.4.12.8 or SR 3.4.12.9 must be satisfied prior to starting any RCP. -'

(continued)

INDIAN POINT 3 B 3.4.12 -17i Revision 2

LTOP B 3.4.12 BASES SURVEILLANCE REOUIREMENTS SR 3.4.12.8 and SR 3.4.12.9 (continued)

The principal contributor to an RCP start induced thermal and pressure transient is the difference between RCS cold leg temperatures and secondary side water temperature of any SG prior to the start of an RCP. The RCP starting prerequisites vary depending on plant conditions but include the following: reactor coolant temperature relative to the LTOP enable temperature; secondary side water temperature of the hottest SG relative to the temperature of the coldest RCS cold leg temperature: and, status of the Overpressure Protection System (OPS). When the OPS is inoperable, additional compensatory requirements are required including limits for the pressurizer level and RCS pressure and temperature. When a pressurizer level is specified as a requirement, the level specified is sufficient to prevent the RCS from going water solid for 10 minutes which is sufficient time for operator action to terminate the pressure transient.

SR 3.4.12.8 is used if secondary side water temperature of the hottest steam generator (SG) is less than or equal to the coldest RCS cold leg temperature. SR 3.4.12.9 is more restrictive and is used if the secondary side water temperature of the hottest steam generator is <

64 OF above the coldest RCS cold leg temperature.

RCP starting is prohibited if the hottest steam generator is > 64 OF above RCS cold leg temperature or if neither of the RCP starting prerequisites SRs can be satisfied. The steam generator temperature may be measured using the Control Room instrumentation or, as a backup, from a contact reading off the steam generator's shells.

Pressurizer level may be determined using control room instrumentation or alternate methods.

The FREQUENCY of the RCP starting prerequisites SRs is Within 15 minutes prior to starting any RCP. This means that each of the required verifications must be performed within 15 minutes prior to the pump start and must be met at the time of the pump start.

(continued)

INDIAN POINT 3 B 3.4.12 -18 Revision 2

LTOP B 3.4.12 BASES SURVEILLANCE REOUIREMENTS SR 3.4.12.8 and SR 3.4.12.9 (continued)

SR 3.4.12.8 and SR 3.4.12.9 are each modified by two Notes. Note 1 specifies that these SRs are required as a condition for pump starting only when the RCS is below the LTOP arming temperature. Note 2 specifies that meeting either SR 3.4.12.8 or SR 3.4.12.9 ensures that pump starting prerequisites are met.

REFERENCES 1. 10 CFR 50. Appendix G.

2. Generic Letter 88-011, NRC Position on Radiation Embrittlement of Reactor Vessel Materials and its Impact on Plant Operations.

3. IP3 Low Temperature Overpressurization System Analysis Final Report, August 24, 1984. in conjunction with ASME Code Case N-514. Low Temperature Overpressure Protection, February 12. 1992.

4. IP3 Technical Requirements Manual.

5. 10 CFR 50, Section 50.46.

6. 10 CFR 50, Appendix K.

7. WCAP-16037 Revision 1, "Final Report on Pressure-Temperature Limits for Indian Point Unit 3 NPP.' Westinghouse Electric Company. May 2003.

INDIAN POINT 3 B 3.4.12 -19 Revision 2

RCS Leakage Detection Instrumentation B 3.4.15 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.15 RCS Leakage Detection Instrumentation BASES BACKGROUND GDC 30 of Appendix A to 10 CFR 50 (Ref. 1) requires means for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE.

-Leakage detection systems must have the capability to detect significant reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early'indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE.

Industry practice'has shown'that water flow changes of 0.5 to 1.0 gpm can be readily detected in contained volumes by monitoring changes in water level, in flow rate, or in the operating frequency of a pump.

The sensitivity for leak detection of the containment sump flow monitor used to allow quantification of the collected unidentified LEAKAGE in the containment sump can be improved with Incorporation of a-control room alarm (VC Sump Pump Running) or operator actions to increase monitoring of the'processing system '(i.e. sump flow monitor once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ). In addition, the containment fan cooler unit condensate measuring system is instrumented to alarm for increases of 0.5 to 1.0 gpm. This sensitivity is acceptable for detecting increases in unidentified LEAKAGE.

The reactor coolant contains radioactivity that, when released to the containment, can be detected by'radiation'monitoring instrumentation.

Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter', until activated corrosion products have been formed and fission products appear from fuel element cladding'contamination or cladding defects. Instrument sensitivities of 10-1O:Ci/cc radioactivity for'particulate monitoring and of 10-7*:Ci/cc radioactivity for gaseous monitoring are practical for these leakage detection systems. Radioactivity detection systems are included for monitoring both particulate (R-li) and gaseous activities (R-12) because of their sensitivities and rapid responses to RCS LEAKAGE.

(continued)

INDIAN POINT 3 B 3.4.15 - 1 Revision 3

LI U1-RCS Leakage Detection Instrumentation B 3.4.15 BASES BACKGROUND An increase in humidity of the containment atmosphere would (continued) indicate release of water vapor to the containment. Dew point temperature measurements can thus be used to monitor humidity levels of the containment atmosphere as an indicator of potential RCS LEAKAGE. A 10F increase in dew point is well within the sensitivity range of available instruments.

Since the humidity level is influenced by several factors, a quantitative evaluation of an indicated leakage rate by this means may be questionable and should be compared to observed increases in liquid flow into or from the containment sump and condensate flow from fan cooler unit condensate measuring system. Humidity level monitoring is considered most useful as an indirect alarm or indication to alert the operator to a potential problem. Humidity monitors are not required by this LCO.

Air temperature and pressure monitoring methods may also be used to infer unidentified LEAKAGE to the containment. Containment temperature and pressure fluctuate slightly during plant operation, but a rise above the normally indicated range of values may indicate RCS leakage into the containment. The relevance of temperature and pressure measurements are affected by containment free volume and, for temperature, detector location. Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment. Temperature and pressure monitors are not required by this LCO.

APPLICABLE SAFETY ANALYSES The need to evaluate the severity of an alarm or an indication is important to the operators, and the ability to compare and verify with indications from other systems is necessary. The system response times and sensitivities are described in the FSAR (Ref. 2).

The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS LEAKAGE into the containment area is necessary.

(continued)

INDIAN POINT 3 B 3.4.15 - 2 Revision 3

RCS Leakage Detection Instrumentation B 3.4.15 BASES APPLICABLE SAFETY ANALYSES (continued)

Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leakage occur detrimental to the safety of the unit and the public.

RCS leakage detection instrumentation satisfies Criterion 1 of 10 CFR 50.36.

LCO One method of protecting against large RCS leakage derives from the ability of instruments'to rapidly detect extremely small leaks. This LCO requires instruments of-diverse monitoring'principles to be OPERABLE to'provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.

The LCO is satisfied when monitors of diverse measurement means are available. Thus', the containment sump flow monitor, in combination with a gaseous or particulate radioactivity monitor and a containment fan cooler unit condensate measuring system, provides an acceptable minimum. The condensate measuring system associated with any one of the fan cooler unit satisfies the requirement for a fan cooler unit condensate measuring system. -

APPLICABILITY Because of elevated RCS temperature and pressure in MODES 1, 2, 3, and

' 4. RCS leakage detection instrumentation is required to be OPERABLE.

In MODE 5 or 6, the temperature is to be <?2000 F and pressure is maintained low or at atmospheric pressure. Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation are much smaller.

Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.

(continued)

INDIAN POINT 3 B 3.4.15 - 3 'Rs- Revision 3

RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS A.1 and A.2 With the required containment sump flow monitor inoperable, no other form of sampling can provide the equivalent information; however, the containment atmosphere radioactivity monitor or containment fan cooler unit will provide indications of changes in leakage. Together with the atmosphere monitor, the periodic surveillance for RCS water inventory balance, SR 3.4.13.1. must be performed at an increased frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to provide information that is adequate to detect leakage.

Restoration of the required sump flow monitor to OPERABLE status within a Completion Time of 30 days is required to regain the function after the monitor's failure. This time is acceptable, considering the Frequency and adequacy of the RCS water inventory balance required by Required Action A.1.

B.1.1. B.1.2. B.2.1 and B.2.2 With both gaseous and particulate containment atmosphere radioactivity monitoring instrumentation channels inoperable, alternative action is required. Either grab samples of the containment atmosphere must be taken and analyzed or water inventory balances, in accordance with SR 3.4.13.1. must be performed to provide alternate periodic information.

With a sample obtained and analyzed or water inventory balance performed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the reactor may be operated for up to 30 days to allow restoration of the required containment atmosphere radioactivity monitors. Alternatively, continued operation is allowed if the air cooler unit condensate measuring system is OPERABLE.

provided grab samples are taken or water inventory balance performed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

(continued)

INDIAN POINT 3 B 3.4.15 - 4 Revision 3

RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS B.1.1. B.1.2. B.2.1 and B.2.2 (continued)

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months interval provides periodic information that is adequate to detect leakage. The 30 day Completion Time Yecognizes at least one other form of leakage detection is available+.

C.1 and C.2 With the required containment fan cooler unit condensate measuring

'system inoperable, alternative action is again required. Either SR 3.4.15.1 must be performed or water inventory balances, in accordance with SR 3.4.13.1. must be performed to provide alternate periodic information. Provided a CHANNEL CHECK is performed every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or a water inventory balance is performed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , reactor'operation may continue while awaiting restoration of the containment fan cooler unit condensate measuring system to OPERABLE status.

The 24-hour interval provides periodic information that is adequate to detect.RCS LEAKAGE.

D.1 and-D.2 With the required containment atmosphere radioactivity monitor and the required containment fan cooler unit condensate measuring system inoperable, the only means of detecting leakage is the containment sump flow monitor. This Condition does-not provide the required diverse means of leakage detection. The Required Action is to restore either of the inoperable required monitors to OPERABLE status within 30 days to regain the intended leakage detection diversity. The 30 day Completion Time ensures that the plant will not be operated in a reduced configuration for a lengthy time period.

and E.2 If a Required Action of Condition A, B, C, or D cannot be met, the

. - plant must be brought to a MODE in which the requirement does not

-apply. To achieve this status,^the plant must be brought to at least

-MODE,3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE.5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

(continued)

INDIAN POINT 3 B 3.4.15 ' 5 R i Revision 3

-- L-L.v-RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS E.1 and E.2 (continued)

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

F.1 With all required monitors inoperable, no automatic means of monitoring leakage are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE REOUIREMENTS SR 3.4.15.1 SR 3.4.15.1 requires the performance of a CHANNEL CHECK of the required containment atmosphere radioactivity monitor. The check gives reasonable confidence that the channel is operating properly.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on instrument reliability and is reasonable for detecting off normal conditions.

SR 3.4.15.2 SR 3.4.15.2 requires the performance of a COT on the required containment atmosphere radioactivity monitor. The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string. The Frequency of 92 days considers instrument reliability, and operating experience has shown that it is proper for detecting degradation.

SR 3.4.15.3. SR 3.4.15.4 and SR 3.4.15.5 These SRs require the performance of a CHANNEL CALIBRATION for each of the RCS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Frequency of 24 months is a typical refueling cycle and considers channel reliability. Again, operating experience has proven that this Frequency is acceptable.

(continued)

INDIAN POINT 3 B 3.4.15 - 6 Revision 3

RCS Leakage Detection Instrumentation B 3.4.15 BASES REFERENCES 1. 10 CFR 50, Appendix A, Section IV,GDC 30.

2. FSAR, Section 6.

INDIAN POINT 3 B 3.4.15 - 7 Revision 3

RCS Specific Activity B 3.4.16 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.16 RCS Specific Activity BASES BACKGROUND The maximum dose that an individual at the site boundary can receive for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during an accident is specified in'10 CFR 50.67 (Ref. 1).

The limits on specific activity ensure that the doses are held to within the 10 CFR 50.67 limits during analyzed transients and accidents.-

The RCS specific activity LCO limits the allowable concentration level

'of radionuclides in the reactor coolant. -The LCO limits are established to minimize the offsite radioactivity dose consequences in the event of a steam generator tube rupture (SGTR) accident.

The LCO contains specific activity limits for both DOSE EQUIVALENT I-131 and gross specific activity. The allowable levels are intended to limit the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose at the'site'boundary to a small fraction of the 10 CFR 50.67 dose guideline limits. The limits in the LCO are standardized, based on parametric evaluations of offsite radioactivity dose consequences for typical-site locations.,

The parametric evaluations showed the'potential offsite dose levels for a SGTR accident were an appropriately small fraction of the 10 CFR 50.67 dose guideline limits. Each evaluation assumes a broad range of site applicable atmospheric dispersion factors in a parametric evaluation.

APPLICABLE SAFETY ANALYSES' i ,,

The LCO limits on the specific activity of the reactor coolant ensures that the resulting'2'hour doses at'the site boundary will not exceed the defined dose limits following a SGTR accident. The SGTR safety

-analysis (Ref. 2) assumes the specific activity of the reactor coolant

-' at the LCO limit and an' existing reactor coolant steam generator (SG)

' tube leakage rate of 1 gpm. The safety analysis-assumes the specific

-activity of the secondary coolant at'its limit of 0.1 pCi/gm DOSE EQUIVALENT I-131 from LCO 3.7.17, Secondary Specific Activity."

(continued)

INDIAN POINT 3 B 3.4.16 - I Revision 2

RCS Specific Activity B 3.4.16 BASES L APPLICABLE SAFETY ANALYSES (continued)

The analysis for the SGTR accident establishes the acceptance limits for RCS specific activity. Reference to this analysis is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.

The analysis is for two cases of reactor coolant specific activity.

One case assumes specific activity at 1.0 pCi/gm DOSE EQUIVALENT I-131 with a concurrent large iodine spike that increases the rate at which iodine activity is released to the reactor coolant. The second case assumes the initial reactor coolant iodine activity at 60.0 pCi/gm DOSE EQUIVALENT I-131 due to a pre-accident iodine spike caused by an RCS transient. In both cases, the noble gas activity in the reactor coolant assumes 1% failed fuel, which closely equals the LCO limit of 100/E(bar) pCi/gm for gross specific activity.

The analysis also assumes a loss of offsite power at the same time as the SGTR event. The SGTR causes a reduction in reactor coolant inventory. The reduction initiates a reactor trip from a low pressurizer pressure signal or an RCS overtemperature aT signal.

The coincident loss of offsite power causes the steam dump valves to close to protect the condenser. The rise in pressure in the ruptured SG discharges radioactively contaminated steam to the atmosphere through the SG atmospheric dump valves (ADVs) and the main steam safety valves. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends.

The safety analysis shows the radiological consequences of an SGTR accident are within the dose limits. Operation with iodine specific activity levels greater than the LCO limit is permissible, if the activity levels do not exceed the limits shown in Figure 3.4.16-1 for more than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The safety analysis has pre-accident iodine spiking levels up to 60.0 pCi/gm DOSE EQUIVALENT I-131.

The remainder of the above limit permissible iodine levels shown in Figure 3.4.16-1 are acceptable because of the low probability of a SGTR accident occurring during the established 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time limit.

The occurrence of an SGTR accident at these permissible levels could increase the site boundary dose levels, but still be within 10 CFR 50.67 dose guideline limits.

(continued)

INDIAN POINT 3 B 3.4.16 - 2 Revision 2

RCS Specific Activity B 3.4.16 BASES APPLICABLE SAFETY ANALYSES (continued)

The limits on RCS specific activity'are also used for establishing standardization in radiation shielding and plant personnel radiation protection practices.

RCS specific activity satisfies Criterion 2 of 10 CFR 50.36.

LCO 'The specific iodine activity is limited to 1.0 pCi/gm DOSE EQUIVALENT I-131, and the gross specific activity in the reactor coolant is limited to the number of pCi/gm equal to 100 divided by E(bar)

(average disintegration energy of the sum of the'average beta and gamma energies of the coolant nuclides). The limit on DOSE EQUIVALENT I-131 and the limit on gross specific activity ensures the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months does to an individual at the site boundary during the DBA will be below the allowed dose.

'The SGTR accident analysis (Ref. 2) shows that the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months site boundary dose levels are within acceptable limits. Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SGTR, lead to site boundary doses that exceed the 10 CFR 50.67 dose guideline limits.

APPLICABILITY In MODES 1 and 2.'and in MODE 3 with RCS average temperature

,>500EF, operation within the'LCO limits for DOSE EQUIVALENT I-131 and gross specific activity are necessary to contain the potential consequences of an SGTR to within the acceptable site boundary dose values.

For operation in MODE 3 with RCS average temperature < 5000F, and in MODES 4 and 5, the release of radioactivity in the event of a SGTR is unlikely since the saturation pressure of the reactor coolant is below the lift pressure settings of the main steam safety valves.

(continued)

INDIAN POINT 3 B 3.4.16 - 3 Revision 2

RCS Specific Activity B 3.4.16 BASES ACTIONS A.1 and A.2 With the DOSE EOUIVALENT I-131 greater than the LCO limit, samples at intervals of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months must be taken to demonstrate that the limits of Figure 3.4.16-1 are not exceeded. The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is required to obtain and analyze a sample. Sampling is done to establish the trend.

The DOSE EOUIVALENT I-131 must be restored to within limits within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is required to allow operation to continue, if the limit violation resulted from normal iodine spiking.

A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODE(S) while relying on the ACTIONS. This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to power operation.

With the gross specific activity in excess of the allowed limit. the unit must be placed in a MODE in which the requirement does not apply.

Placing the plant in MODE 3 with RCS average temperature < 500OF lowers the saturation pressure of the reactor coolant below the setpoints of the main steam safety valves and prevents venting the SG to the environment in an SGTR event. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 below 500OF from full power conditions in an orderly manner and without challenging plant systems.

If a Required Action and the associated Completion Time of Condition A is not met or if the DOSE EOUIVALENT I-131 is in the unacceptable region of Figure 3.4.16-1, the reactor must be brought to MODE 3 with RCS average temperature < 500OF within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 below 500 0F from full power conditions in an orderly manner and without challenging plant systems.

(continued)

INDIAN POINT 3 B 3.4.16 - 4 Revision 2

RCS Specific Activity B 3.4.16 BASES SURVEILLANCE REQUIREMENTS SR 3.4.16.1 SR 3.4.16.1 requires performing a gamma isotopic analysis as a measure of the gross specific activity of the reactor coolant at least once every 7 days. While basically a quantitative measure of radionuclides with half lives longer than 10 minutes, excluding iodines, this measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in gross specific activity.

Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The Surveillance is applicable in MODES 1 and 2, and in MODE 3 with Tavg at least 500 0F. The 7 day Frequency considers the low probability of a gross fuel failure during the time.

SR 3.4.16.2 This Surveillance is performed in MODE 1 only to ensure iodine remains within limit during normal operation and following fast power changes when fuel failure is more apt to occur. The 14 day Frequency is adequate to trend changes in the iodine activity level, considering gross activity is monitored every 7 days. The Frequency, between 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after a power change > 15% RTP within a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months period, is established because the Iodine levels peak during this time following fuel failure: samples at other times would provide inaccurate results.

SR 3.4.16.3 A radiochemical analysis for E(bar) determination is required every 184 days (6 months) with the plant operating in MODE 1 equilibrium conditions. The E(bar) determination directly relates to the LCO and is required to verify plant operation within the specified gross activity LCO limit. The analysis for E(bar) is a measurement of the average energies per disintegration for isotopes with half lives longer than 10 minutes, excluding iodines and non-garrma emitters. The 10 minute limit on half-lives ensures that Xenon-138 is included in the determination of E(bar). The Frequency of 184 days recognizes E(bar) does not change rapidly.

(continued)

INDIAN POINT 3 B 3.4.16 - 5 Revision 2

RCS Specific Activity B 3.4.16 BASES J

SURVEILLANCE REOUIREMENTS SR 3.4.16.3 (continued)

This SR has been modified by a Note that indicates sampling is required to be performed within 31 days after a minimum of 2 effective full power days and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for at least 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . This ensures that the radioactive materials are at equilibrium so the analysis for E(bar) is representative and not skewed by a crud burst or other similar event.

REFERENCES 1. 10 CFR 50.67.

2. FSAR, Section 14.2.

' J INDIAN POINT 3 B 3.4.16 - 6 Revision 2

ECCS- Shutdown B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.3 ECCS-Shutdown BASES ' -

BACKGROUND - The Background section for Bases 3.5.2."ECCS-'Operating." is applicable to these Bases, with the following modifications.

InMODE 4, one ECCS residual heat removal (RHR) subsystem and one ECCS Recirculation subsystem are required.

The ECCS flow paths consist of piping, valves,:heat exchangers, and pumps such that water from the refueling waterstorage tank (RWST) or the containment or recirculation sump can be injected into the Reactor Coolant System (RCS) following the accidents described in Bases 3.5.2.

! ' i' APPLICABLE SAFETY At4ALYSES I . .1 The Applicable Safety Analyses section of Bases 3.5.2 also applies to this Bases section.

Due to the stable conditions associated with operation in MODE 4 and

. . . .I the reduced probability of occurrence of-a Design Basis Accident (OBA), the ECCS operational requirements-are 'reduced. It is understood in these reductions that automatic'safety injection (SI) actuation is not available. In this MODE, sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA.

Only one ECCS residual heat removal (RHR) subsystem and one ECCS Recirculation subsystem are required for MODE 4.' This requirement dictates that single 'failures 'are not considered during this MODE of operation.'" The ECCS'trains satisfy Criterion 3 of 10 CFR 50.36.

LCO In MODE 4, one ECCS residual heat removal (RHR) subsystem and one ECCS Recirculation subsystem are required to be OPERABLE to ensure that sufficient ECCS flow is available to the core following a DBA.

(continued)

INDIAN POINT3 3 B 3.5.3-1: Revision I

Shutdown ECCS ECCS - Shutdown B 3.5.3 BASES J LCO In MODE 4. ECCS requirements may be met using containment (continued) Recirculation subsystem 31 or 32 and RHR subsystem 31 or 32.

An ECCS RHR subsystem consists of one RHR pump and one RHR heat exchanger as well as associated piping and valves and instrumentation and controls needed to transfer water from the RWST or containment sump to the core. Either RHR heat exchanger may be used with either RHR pump to meet requirements for an RHR subsystem.

A containment Recirculation subsystem consists of one Containment Recirculation pump and one RHR heat exchanger as well as associated piping, valves, instrumentation and'controls needed to transfer water from the recirculation sump to the'core. Note that Recirculation pump OPERABILITY requires the functional'availability of the associated auxiliary component cooling water pump. Either RHR heat exchanger may be used with either recirculation pump to meet requirements for a recirculation subsystem. The same RHR heat exchanger may be used to meet requirements for both the RHR subsystem and the Recirculation subsystem.

During an event requiring ECCS actuation, a flow path is required to J provide an abundant supply of water from the RWST to the RCS via the RHR pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, the recirculation flow path using the Recirculation sump or containment sump may be used to deliver its flow to the RCS cold legs.l This LCO Is modified by a Note that allows an RHR subsystem to be considered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows operation in the RHR mode during MODE 4. Similarly, this Note allows an RHR subsystem to be considered OPERABLE during alignment and operation for valve testing if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows testing of certain valves in MODE 4.

(continued)

INDIAN POINT 3 B 3.5.3-2 Revision I

ECCS- Shutdown B 3.5.3 BASES APPLICABILITY In MODES 1, 2.'and 3,:the OPERABILITY requirements for ECCS are covered by LCO 3.5.2; In MODE 4 with RCS temperature below 350 F, one

-OPERABLE 'ECCS residualbheat'removal (RHR) subsystem and one OPERABLE ECCS Recirculation subsystem is acceptable without single failure consideration, on the basis of'the stable reactivity of the reactor and the limited core cooling requirements. -

In MODES 5 and 6. plant conditions are such that the probability of an event requiring ECCS injection is extremely'low. Core cooling requirements in MODE 5 are addressed by LCO'3.4.7. "RCS Loops-MODE 5, Loops Filled," and LCO'3.4.8. "RCS Loops- MODE 5. Loops Not Filled."

MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation'- High Water Level," and LCO

'3.9.5, "Residual Heat Removal (RHR)-and'Coolant Circulation- Low Water Level."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to inoperable ECCS

-residual heat removal and ECCS recirculation subsystems when entering MODE 4. 'There is an increased risk associated with entering MODE 4 from MODE 5 with these subsystems inoperable and the provisions of LCO

- -3..4.b.which allow'entry into a MODE or other specified condition in the Applicability with the'LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

With no ECCS RHR subsystem OPERABLE, the plant is not prepared to respond to a loss of coolant accident or to continue a cooldown using the RHR pumps and heat exchangers. The Completion Time of immediately to initiate actions that would restore at least one ECCS RHR subsystem to OPERABLE status ensures that prompt actionhis taken to restore the required cooling capacity. Normally, in MODE 4. reactor decay heat is removed from the RCS by an RHR loop. If no RHR loop is OPERABLE for this function, reactor decay heat must be removed by some alternate method, :such as use of the steam generatoris.' The alternate means of heat removal must continue until the inoperable RHR loop components can be restored to operation so that decay heat removal is continuous.

(continued)

INDIAN POINT 3 B 3.5.3-3 Revision .1

ECCS - Shutdown B 3.5.3 BASES ACTIONS AL (continued)

With both RHR pumps and heat exchangers inoperable, it would be unwise to require the plant to go toMODE 5, where the only available heat removal system is the RHR. Therefore, the appropriate action is to initiate measures to restore one ECCS RHR subsystem and to continue the actions until the subsystem is restored to OPERABLE status.

BA With nocontainment Recirculation subsystem OPERABLE, due to the inoperability of the pump or flow path from the recirculation sump, the plant is not prepared to provide long, term cooling response to Design Basis Events requiring SI. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to restore at least one ECCS Recirculation subsystem to OPERABLE status ensures that prompt action is-taken to provide the required cooling capacity or to initiate actions to place the plant in MODE 5. where a recirculation subsystem is not required.

When the Required Actions of Condition B cannot be completed within the required Completion Time, a controlled shutdown should be initiated. Twenty-four hours is a reasonable time, based on operating experience, to reach MODE 5 in an orderly manner and without challenging plant systems or operators.

Note: Condition C should not be entered if-Condition A is applicable.

Required Action C.1 does not mandate a cooldown to MODE 5 when a required ECCS RHR subsystem is not OPERABLE (i.e., Condition A) because plant cooldown may not be possible with inoperable RHR subsystems.

SURVEILLANCE REOUIREMENTS SR 3.5.3.1 The applicable Surveillance descriptions from Bases 3.5.2 apply.

REFERENCES The applicable references from Bases 3.5.2 apply.

-J INDIAN POINT 3 B 3.5.3-4 Revision 1

Not Used B 3.6.8 B 3.6 CONTAINMENT SYSTEMS B 3.6.8 Not Used INDIAN POINT 3 B 3.6.8 - I Revision I

ADVs B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Atmospheric Dump Valves (ADVs) "

BASES - ' I l BACKGROUND The ADVs provide a method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sink via the Steam Bypass System (High Pressure'Steam Dump) to the condenser not be available;'as discussed in the FSAR, Section 10.2 (Ref. 1). This is done in conjunction with the Auxiliary Feedwater System providing cooling water'from the condensate storage tank (CST). The ADVs may

-also be required to meet the design cooldown rate during a normal cooldown when steam pressure drops too low for maintenance of a vacuum in the-condenser to permit use of the High Pressure Steam Dump System.

One ADV line for each of the four steam generators is provided. Each ADV line consists of one ADV and an associated manually operated block valve.

The block valves'are upstream of the ADVs 'to permit testing and maintenance at power,'and to provide an alternate means of isolation.

The ADVs are equipped with pneumatic controllers to permit control of the cooldown rate.

The ADVs are provided with a'pressurized gas supply of bottled nitrogen that is needed to support manual operation of the atmospheric dump valves. The nitrogen supply is sized to provide the sufficient pressurized gas to operate the ADVs for the time required for Reactor Coolant System cooldown to RHR entry conditions.

A description of the ADVs is found in Reference 1.

APPLICABLE SAFETY ANALYSES The'design basis'of the ADVs is established by the capability to cool the unit to RHR entry'conditions. The t6tal relief capacity of the four ADVs is approximately 10% of the rated steam flow.

(continued)

INDIAN POINT 3 B 3.7.4 - 1 Revision I

ADVs B 3.7.4 BASES APPLICABLE SAFETY ANALYSES (continued) J This is adequate to cool the unit to RHR entry conditions with only one steam generator and one ADV. utilizing the cooling water supply available in the CST.

In the accident analysis presented in Reference 1. the ADVs are assumed to be used by the operator to cool down the unit to RHR entry conditions for accidents accompanied by a loss of offsite power.

Prior to operator actions to cool down the unit, the main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the steam generator pressure below the design value. For the recovery from a steam generator tube rupture (SGTR) event, the operator is also required to perform a limited cooldown to establish adequate subcooling as a necessary step to terminate the primary to secondary break flow into the ruptured steam generator. The time required to terminate the primary to secondary break flow for an SGTR is more critical than the time required to cool down to RHR conditions for this event and also for other accidents. Thus, the SGTR is the limiting event for the ADVs. The requirement that 3 of the 4 ADVs must be OPERABLE is established to ensure that at least one ADV line is available under local control to conduct a plant cooldown following an event in which one steam generator becomes unavailable due to the event (i.e., SGTR or SLB), accompanied by a single, active failure of a second ADV line on an unaffected steam generator.

The ADVs are equipped with block valves in the event an ADV spuriously fails open or fails to close during use.

The ADVs satisfy Criterion 3 of 10 CFR 50.36.

LCO Three of the four ADV lines are required to be OPERABLE. One ADV line is required from each of three steam generators to ensure that at least one ADV line is available to conduct a unit cooldown following an SGTR, in which one steam generator becomes unavailable, accompanied by a single, active failure of a second ADV line on an unaffected steam generator. The block valves must be OPERABLE to isolate a failed open ADV line. A closed block valve does not render it or its ADV line inoperable because operator action time to open the block valve is supported in the accident analysis.

(continued) [

INDIAN POINT 3 B 3.7.4 - 2 Revision 1

ADVs B 3.7.4 BASES LCO Failure to meet the LCO can result in the inability to cool the unit (continued) to RHR entry conditions following an event in which the condenser is unavailable for use with the Turbine Steam Bypass System (High Pressure Steam Dump).

An ADV is considered OPERABLE when it is capable of providing controlled relief of the main steam flow-and capable of fully opening and closing on demand (either remotely or under-local control).

APPLICABILITY In MODES 1, 2, and 3, and in MODE 4. when a steam generator is being relied upon for heat removal, the ADVs are required to be OPERABLE.

In MODE 5 or 6. an SGTR is not a credible event.

ACTIONS A-With one required ADV line inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time allows for the redundant capability afforded by the remaining OPERABLE ADV lines.

Specifically, with one of the three required ADVs inoperable, at least one ADV line is available to conduct a plant cooldown following an event in which one steam generator becomes unavailable due to the event (i.e., SGTR or SLB), accompanied by a-single, active failure of a second ADV line on an unaffected steam generator.

.. . .l_ - Si;, th With two or more required ADV lines inoperable. action must be taken to-restore all but one-ADV line to OPERABLE'status. Sic~te bock valve can be closed to isolate an ADV, some repairs may be possible with the unit at power. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable to repair inoperable ADV lines, based on the availability of the Steam Bypass System (HP Steam Dump) and MSSVs, and the low probability of an event occurring during this period that would require the ADV lines.

(continued)

INDIAN POINT 3 B 3.7.4 - 3' Revision I

ADVs B 3.7.4 BASES ACTIONS C.1 and C.2 (continued)

If the AOV lines cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4, without reliance upon steam generator for heat removal, within 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE REQUIREMENTS SR 3.7.4.1 To perform a controlled cooldown of the RCS, the ADVs must be able to be opened either remotely or locally and throttled through their full range. This SR ensures that the ADVs are tested through a full control cycle at least once per fuel cycle. Performance of inservice testing or use of an ADV during a unit cooldown may satisfy this requirement. Operating experience has shown that these components usually pass the Surveillance when performed at the specified Frequency and, therefore, is acceptable from a reliability standpoint.

SR 3.7.4.2 The function of the block valve is to isolate a failed open ADV.

Cycling the block valve both closed and open demonstrates its capability to perform this function. Performance of inservice testing or use of the block valve during unit cooldown may satisfy this requirement. Operating experience has shown that these components usually pass the Surveillance when performed at the specified Frequency and, therefore, is acceptable from a reliability standpoint.

REFERENCES 1. FSAR, Section 10.2.

J INDIAN POINT 3 B 3.7.4 -4 Revision I

AFW System B3.7.5 B 3.7 PLANT SYSTEMS B 3.7.5 Auxiliary Feedwater (AFW) System BASES BACKGROUND The AFW System automatically supplies feedwater to the steam generators to remove decay heat from the Reactor Coolant System upon the loss-of normal feedwater supply. The AFW pumps take suction from the condensate storage tank (CST) (LCO 3.7.6)'and pump to the steam generator secondary side via a connection to the' main feedwater (MFW) piping at a point outside containment. The steam generators function as a heat' sink'for core'decay heat.' The heat load is dissipated by releasing steam to the atmosphere from the steam generators via the main steam~safety-valves (MSSVs) (LCO 3.7.1) or atmospheric dump valves (LCO 3.7.4). If the main condenser'is available, steam may be released via the steam bypass (High Pressure Steam Dump) valves and recirculated to the CST.

The AFW System consists of two motor driven AFW pumps and one steam turbine driven pump configured into three trains.' FSAR Section 10.2 (Ref. 1) describes this configuration as two pumping loops using two

'different types of motive power to the pumps. One auxiliary feedwater loop utilizes a steam turbine driven pump and the other utilizes two motor driven pumps. Technical specifications describe this configuration as three trains because each motor driven pump provides 100% of AFW flow capacity, and,'depending on steam conditions, the turbine driven pump capacity approaches 200% of the required capacity for automatic delivery of AFW to the steam'generators, as assumed in the accident analysis. The limiting transient for the AFW System is loss of main feedwater. For'this event, the licensing analysis credits 343 gpm delivered automatically to two steam generators and the minimum of an-additional 343 gpm delivered to the other two steam generators in 10 minutes. A near best estimate analysis has also been performed, and this' demonstrated that acceptance criteria are satisfied without assuming additional AFW flow in 10 minutes (Ref. 3).

The pumps are equipped with independent' recirculation lines to prevent pump operation against a closed system. Each motor driven AFW pump is powered from an independent!power supply and feeds two steam generators. The steam turbine driven AFW pump receives steam from two main steam lines upstream of the main steam isolation valves. Each of the steam feed lines will supply 100% of the requirements of the turbine driven AFW pump.

(continued)

INDIAN POINT 3 B 3.7.5 -1 Revision 3

AFW System B 3.7.5 BASES BACKGROUND The AFW System is capable of supplying feedwater to the steam J (continued) generators during normal unit startup, shutdown, and hot standby conditions.

The turbine driven AFW pump supplies a common header capable of feeding all steam generators. Each of the steam generators can also be supplied by one of the two motor driven AFW pumps. Any of the three pumps at full flow has sufficient capacity such that in the case of-complete loss of normal feedwater there is adequate time for operator action to start a second motor driven AFW pump or to align the turbine driven AFW pump to remove decay heat and cool the unit to residual heat removal (RHR) entry conditions. Thus, the requirement for diversity in motive power sources for the AFW System is met.

The AFW System is designed to supply sufficient water to the steam generator(s) to remove decay heat with steam generator pressure at the setpoint of the MSSVs. Subsequently, the AFW System supplies sufficient water to cool the unit to RHR entry conditions. with steam released through the ADVs.

The motor driven pumps are actuated by any one of the following:

1) Low-low level in any steam generator;

2) Loss of voltage (Non SI blackout) on 480 VAC bus 2A/3A (starts AFW Pump 31) and loss-of voltage (Non SI blackout) on 480 VAC bus 6A (starts AFW Pump 33);

3) Safety Injection signal:

4) Auto trip of either main boiler feed pump;

5) Manual actuation from the Control Room; and

6) Manual actuation locally at the pump room.

The steam turbine driven pump is actuated by any one of the following:

1) Low-low level in two of the four steam generators;

2) Loss of voltage (Non SI blackout) on 480 VAC busses 2A/3A or 6A; (continued) _

INDIAN POINT 3 B 3.7.5 -2 Revision 3

AFW System B 3.7.5 BASES BACKGROUND 3) Manual actuation fromthe Control Room; and (continued)

4) Manual actuation locally at the pump room.

The steam driven AFW pump must be throttled manually in order to bring the unit up to speed after a start signal. In addition, the steam driven pump discharge flow control valves must be manually opened as

- necessary to provide adequate auxiliary feedwater flow.

The AFW System is discussed in the FSAR, Section 10.2 (Ref. 1).

APPLICABLE SAFETY.-ANALYSES,.-,

-The AFW System mitigates the consequences of 'any'event with

, loss of normal feedwater. ' ' '

-The design basis of the AFW-System is to supply water to the steam generator to remove decay heat and other'residual heat by delivering at least the minimum required flow rate to'the steam generators at pressures corresponding to the lowest steam generator safety valve set pressure plus'accumulation.

In addition, the AFW System must supply enough makeup water to replace steam generator secondary inventory'lost as'the'unit cools to MODE 4 conditions. Sufficient'AFW-System flow must also be available to

,account for flow losses~'such as pump recirculation and line breaks.

The limiting events that require the AFW System are as follows:

a. small -break loss of coolant'accident:

b. loss of AC sources; and

c. 'los's of feedwater.

The AFW turbine driven pump actuates automatically when required to ensure an adequate feedwater supply to the steam generators is availableduring loss of power.: Power operated valves are provided for each AFW line to control the AFW-flow to each steam generator.

.The AFW System satisfies the requirements of Criterion 3 of 10 CFR 50.36. - ; - - -

(continued)

INDIAN POINT 3 B 3.7.5 - 3 Revision 3-

AFW System B 3.7.5 BASES LCO This LCO provides assurance that the AFW System will perform its __

design safety function to mitigate the consequences of events that could result in overpressurization of the reactor coolant pressure boundary. Three independent AFW pumps are required to be OPERABLE to ensure the capability to maintain the plant in hot shutdown with a loss of offsite power and a single failure. This is accomplished by powering two of the pumps from independent emergency buses. The third AFW pump is powered by a steam driven turbine supplied with steam from a source that is not isolated by closure of the MSIVs.

The AFW System is configured into three trains. The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow to the steam generators are OPERABLE.' This requires that the two motor driven AFW pumps be OPERABLE, each supplying AFW to two separate steam generators. The turbine driven AFW pump is required to be OPERABLE with steam supplies from each of two main steam lines upstream of the MSIVs, and shall be capable of supplying AFW to all of the steam generators. The piping, valves.

instrumentation, and controls in the required flow paths also are required to be OPERABLE.

The LCO is modified by a Note indicating that one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.

The motor driven AFW pump required to be OPERABLE in Mode 4 must be capable of supporting the SG(s) being credited as the redundant decay heat removal path in accordance with LCO 3.4.6. RCS Loops - MODE 4.

This requirement ensures the ability'to maintain the required level in the SG(s) (and decay heat removalcapacity) during extended periods in Mode 4 with or without offsite power. Requiring only one OPERABLE AFW pump is acceptable because of the reduced heat removal requirements and short period of time in MODE 4 during which the AFW is required and the insufficient steam available in MODE 4 to power the turbine driven AFW pump.

APPLICABILITY In MODES 1, 2. and 3, the AFW System is required to be OPERABLE in the event that' it is called upon to function when the MFW is lost. In addition, the AFW System is required to supply enough makeup water to replace the steam generator secondary inventory needed to achieve and maintain MODE 4 conditions.

In MODE 4; a motor driven AFW pump may be needed to support heat removal via the steam generators.

In MODE 5 or 6, the steam generators are not normally used for heat removal, and the AFW System is not required.

(continued) [

INDIAN POINT 3 B 3.7.5 -4 Revision 3

AFW System B'3.7.5 BASES ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable AFW train. There is an increased risk associated with entering a MODE or other'specified condition in the Applicability'with an AFW train inoperable and the provisions of LCO 3.0.4.b','which allow entry into a MODE or other specified condition in the'Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components,'should not be applied in'this circumstance.

Ld If one of the two steam supplies to the turbine driven AFW train is inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time is reasonable, based on the following reasons:

a. The redundant OPERABLE steam supply to the turbine driven AFW pump:

b. The availability of redundant OPERABLE motor driven AFW pumps; and

c. The'low probability of an event'occurring that requires the inoperable steam supply to the turbine driven AFW pump.

The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any"combination 'of Conditions to be inoperable'during any continuous failure to meet this LCO.

The 10 day Completion'Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 7 days and 10 days dictates that both Completion Times ap'ply simultaneously, and the more restrictive must be met. -

With'one of the required AFW trains (pump or flow path) inoperable in MODE 1,'2, or 3 for 'reasons other than Condition A, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Condition includes the loss of two steam supply lines to the turbine driven AFW pump. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 'Completion Time is reasonable, based on redundant capabilities'afforded by the AFW System,'time needed for repairs, and the lowprobability'of a'DBA occurring'during this time period.

.(continued)

INDIAN POINT 3 B 3.7.05' 5 - Revision 3 -

AFW System B 3.7.5 BASES ACTIONS B1 (continued)

The second Completion Time for Required Action B.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The MND connector between 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 days dictates that both Completion Times apply-simultaneously.

and the more restrictive must be met.

C.1 and C.2 When Required Action A.1 or B.1 cannot be completed within the required Completion Time, or if two AFW trains are inoperable in MODE

1. 2, or 3, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4.within 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months .

The allowed Completion Times are reasonable. based on operating experience, to reach the required unit conditions from full power J conditions in an orderly manner and without challenging unit systems.

In MODE 4 with two AFW trains inoperable, operation is allowed to continue because only one motor.driven, pump AFW train is required in accordance with the Note that modifies the LCO. Although not required, the unit may continue to cool down and initiate RHR.

If all three AFW trains are inoperable in MODE 1. 2. or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown. and only limited means for conducting a cooldown with nonsafety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires. that action be started immediately to restore one AFW train to OPERABLE status.

Required Action D.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status. In this case. LCO 3.0.3 is not applicable because it could force the unit into a less safe condition.

(continued) {,

INDIAN POINT 3 B 3.7.5 -6 Revision 3

AFW System B 3.7.5 BASES ACTIONS L' (continued)

In MODE 4, either the reactor coolant pumps or the RHR loops can be used to provide forced circulation. This is addressed in LCO 3.4.6.

RCS Loops-MODE 4.' With one required AFW train inoperable, action must'be taken to immediately restore the inoperable train to OPERABLE status. The immediate Completion Time is consistent with LCO 3.4.6.

SURVEILLANCE REQUIREMENTS

' ' SR 3.7.5.1" '

Verifying the correct alignment for manual, power operated, and automatic valves in the AFW System water and steam supply flow paths provides assurance that the proper flow paths will exist for AFW operation. This SR doe's not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. This SR also does snot apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation;.rather., it involves-verification that those valves capable of being mispositioned are in the correct position.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.,;

This SR is modified by a Note that states the SR is not required in MODE 4. Not performing this SR in MODE 4'is acceptable for the following reasons: AFW pumps are typically operated intermittently to keep the SGs filled when in MODE 4, the decay heat load is low; an RHR loop is required to be OPERABLE as the primary method of decay heat removal' in Mode 4: and, the SG is required to be maintained at a level

'that ensuresa significant inventory is available as a heat sink before the ,AFW 'pump is required to refill the SG. These factors ensure that a significant amount of time would be available to completeanyvalve realignments needed to-refill ,a SG when in Mode 4.

(continued)

INDIAN POINT 3 B 3.7.5 -7 Revision 3

AFW System B 3.7.5 BASES SURVEILLANCE REQUIREMENTS j (continued)

SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by Section XI of the ASME Code (Ref 2). Because it is undesirable to introduce cold AFW into the steam generators while'they are operating, this testing is performed on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY, trend performance,' and detect incipient failures by indicating abnormal performance. Performance of inservice testing discussed in the ASME Code.Section XI (Ref. 2) (only required at 3 month intervals) satisfies this requirement.

This SR is modified by a Note indicating that the SR should be deferred until suitable'test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test when SG pressure is <,600 psig.

J SR 3.7.5.3 This SR verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS. by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal. This Surveillance is not required for'valves that are locked.

sealed, or otherwise secured in the required position under administrative controls. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage.(i.e., unit at less than or equal to 97% power and in preparation for main generator breaker opening with no plans to raise power between'the time of the surveillance and breaker open) and the potential for an unplanned transient if the Surveillance were performed with the reactor at full power. The 24 month Frequency is acceptable based on operating experience and the design reliability of the equipment.

This SR is modified by a Note that states the SR is not required in MODE 4. In MODE 4, the required AFW train is operated as necessary to maintain SG water level.

(continued)

INDIAN POINT 3 B 3.7.5-8 Revi si on 3

AFW System B 3.7.5 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.5.4 This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an ESFAS by demonstrating that each AFW pump starts automatically on an actual or simulated actuation signal in MODES 1, 2, and 3. In MODE 4, the required pump is operated as necessary and the autostart function is not required. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

This SR is modified by two Notes. Note 1 indicates that the SR be deferred until suitable test conditions are established. This deferral allows the test to be performed at rated conditions. Note 2 states that the SR is not required in MODE 4. In MODE 4, the required pump is operated as necessary to maintain SG water level and the autostart function Is not required. In MODE 4. the heat removal requirements would be less providing more time for operator action to manually start the required AFW pump.

REFERENCES 1. FSAR. Section 10.2.

2. ASME, Boiler and Pressure Vessel Code.Section XI.

3. Safety Evaluation Report (SER) for IP3 Amendment 225.

INDIAN POINT 3 B 3.7.5 -9 Revision 3

CRVS B 3;7.11 B 3.7 PLANT SYSTEMS B 3.7.11 Control Room Ventilation System (CRVS)'

BASES BACKGROUND The CRVS provides a protected environment from which operators can control the unit following an uncontrolled release of radioactivity, chemicals, or toxic gas.,

The Control Room Ventilation System consists of the following equipment: a-single filter unit consisting of two roughing filters, two high efficiency particulate air (HEPA) filters; two activated charcoal adsorbers for removalof gaseous-activity (principally iodines): two 100% capacity filter booster fans: and, a single duct system-including dampers, controls and associated accessories to

- provide for three different air flow configurations. The air-conditioning units associated with the CRVS are governed by LCO 3.7.12. "Control Room Air Conditioning System (CRACS)."

The CRVS is divided into two trains with each train consisting of a filter booster fan with its associated inlet damper, an air conditioning unit fan powered from the same safeguards power train with its associated inlet damper, and the following components which are common to both trains: the control room filter unit. Damper A (filter unit bypass for outside' air makeup to the Control Room),

Damper B (filter unit inlet for outside air-makeup to the Control Room), and the toilet and locker room exhaust fan. The two filter booster fans (F 31 and F 32)-are powered from safeguards power trains 5A (EDG 33) and 6A (EDG 32), respectively. The automatic dampers that are common to both trains are positioned in the fail-safe position (open or closed) by either of the redundant actuation channels.

The CRVS is an emergency system, parts of which operate during normal unit operations.

The three different CRVS air flow configurations are as follows:

a) CRVS-Mode 2rNormal operation - Ventilation is provided to the CCR via outside air drawn through Damper A driven by the operation of the CRACS fan(s)'and the toilet/locker room exhaust

- fan; . ;.

.otne (continued)

INDIAN POINT 3 B 3.7. 11 .-1 Revision 5

CRVS B 3.7.11 BASES BACKGROUND b) CRVS Mode 3 Incident mode with outside air makeup (known as the (continued) 10% incident mode) - Ventilation and pressurization are provided for the CCR via altered outside air drawn through Damper B.

driven by the operation of the CRACS fan(s) and its associated filter booster fan; c) CRVS Mode 4 Incident mode with no outside air makeup (i.e. 100%

recirculation mode) - In this mode there is no ventilation provided to the CCR. Both A and B Dampers are closed and the only associated CRVS components operating are the CRACS fan(s).

CRVS Mode 3 (10% Incident Mode) is the required method of operation during any radiological event because it provides outside air for pressurization of the Control Room. It has been demonstrated via industry experience with tracer gas testing that increased pressurization helps attenuate unfiltered inleakage.

On a Safety Injection signal or high radiation in the Control Room (Radiation Monitor R-1). the CRVS will actuate to the CRVS Mode 3 incident mode with outside air makeup (known as the 10% incident mode). This will cause one of the two filters booster fans to start.

the locker room exhaust fan to stop, and CRVS dampers to open or close as necessary to filter all incoming outside air. In the event that the first booster fan fails to start, the second booster fan will start after a predetermined time delay.

A single train will create a slight positive pressure in the control room. The CRVS operation in maintaining the control room habitable is discussed in the FSAR, Section 9.9 (Ref. 1).

The control room is continuously monitored by radiation and toxic gas detectors.

The CRVS does not actuate automatically in response to toxic gases.

Separate chlorine, ammonia and oxygen probes are provided to detect the presence of these gases in the outside air intake. Additionally, monitors in the Control Room will detect low oxygen levels and high levels of chlorine and ammonia. The CRVS may be placed in the CRVS Mode 4 incident mode with no outside air-makeup (i.e. 100%

recirculation mode) to respond to these conditions. Instrumentation for toxic gas monitoring is governed by the IP3 Technical Requirements Manual (TRM) (Ref. 4). Generally, the manually initiated actions of the toxic gas isolation state are more restrictive, and will override the actions of the emergency radiation state.

(continued) j INDIAN POINT 3 B 3.7.11 - 2 Revision 5

CRVS B 3.7.11 BASES -

BACKGROUND If for any reason it is required or desired'to operate with 100%

(continued) recirculated air (e.g., toxic gas condition is identified), the CRVS can be placed in the CRVS Mode 4 incident mode with no outside air makeup (i.e. 100% recirculation mode) by remote-manually operated switches. The Firestat detectors will shutdown both air conditioning units associated with the CRVS, resulting in shutting the outside air dampers. However, if any filter booster fan.was running at that time, it will be tripped.'

The CRVS is designed in accordance with Seismic Category I requirements.

'The CRVS is designed to maintain the control room environment for 30 days of continuous occupancy after'a Design Basis Accident (DBA) without exceeding a 5 rem TEDE dose.

APPLICABLE SAFETY ANALYSES

- - The CRVS active components are arranged in redundant, safety related ventilation trains.' 'The location of components and ducting within the control building envelope provides protection from natural phenomena events. The CRVS provides airborne radiological protection for the control room operators, as demonstrated by the control room accident dose analyses for the most limiting design basis accident (i.e., DBA LOCA) fission product release (Ref. 3).'

Radiation monitor R-1 is not required for the Operability of the Control Room Ventilation System because control room isolation is initiated by the safety injection signal in MODES 1. 2, 3. 4. and control room isolation is not credited for maintaining radiation exposure within General Design Criteria 19 limits following a fuel handling'accident or gas-decay-tank rupture.

, .I The worst case active failure of a component of the CRVS, assuming a loss of offsite power,'does not impair the ability of the system to perform its design function.' However, the original CRVS design was not required to meet single failure criteria and, although upgraded from the original design, CRVS does not satisfy all requirements in IEEE-279 for single'failure tolerance.

* * (continued)

INDIAN POINT 3 B 3.7.11 - 3 Revision 5

CRVS B 3.7.11 BASES APPLICABLE SAFETY ANALYSES (continued)

Each of the automatic dampers that are common to both trains is positioned In the CRVS Mode 3 (10% incident mode) fail-safe position (open or closed) by either of the redundant actuation channels.

The CRVS satisfies Criterion 3 of 10 CFR 50.36.

LCO Two CRVS trains are required to be OPERABLE to ensure that at least one is available. Total system failure could result in exceeding a dose of 5 rem TEDE to the control room operator in the event of a large radioactive release.

The CRVS is considered OPERABLE when the individual components necessary to limit operator exposure are OPERABLE In both trains. A CRVS train is OPERABLE when the associated:

a. Filter booster fan and an air-conditioning unit fan powered from the same safeguards power train are OPERABLE:

b. HEPA filters and charcoal absorbers are not excessively restricting flow, and are capable of performing their filtration functions: and

c. Valves, and dampers are OPERABLE or In the incident mode, and air circulation can be maintained.

In addition, the control room boundary must be maintained, Including the Integrity of the walls, floors, ceilings, ductwork, and CCR access doors.

Criteria has been established for leakage from primary coolant sources outside of containment which could render the CCR Filter System Inoperable. For. more Information refer to Technical Specification 5.5.2, "Primary Coolant Sources Outside of Containment' and Procedure ENN-DC-197, 'Integrity of Systems Outside PWR Containment".

Instrumentation for toxic gas monitoring is governed by the IP3 Technical Requirements Manual (TRM) (Ref. 4) and Is not Included in the LCO.

(continued)

INDIAN POINT 3 B 3.7.11 - 4 Revision 5

CRVS B 3;7.11 BASES APPLICABILITY In MODES 1, 2, 3. 4 CRVS must be OPERABLE to limit-operator exposure during and following a DBA.

The CRVS is not required in MODE 5 or 6, or during movement of irradiated fuel assemblies and core alterations because analysis indicates that isolation of the control room is not required for maintaining radiation exposure within acceptable limits following a fuel handling accident or gas decay tank rupture.

Administrative controls address the role of the CRVS in maintaining control room habitability following an event atIndian Point Unit 2.

ACTIONS X, When one CRVS train islin'operable, action'must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CRVS train is adequate to perform the'control room protection l function. However, the overall reliability'is reduced because a failure in the OPERABLE CRVS train could result in loss of CRVS function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time peridd, and 'ability of the remaining train to provide the required capability.

L When neither CRVS train is Operable, action'must be taken to restore at least one train to OPERABLE-status within'72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is acceptable because of the'low probability of a DBA occurring during this time period.

C.1 and C.2

.If Required Actions A.1 or B.1 are not met within'the required

.-Completion-Time, the unit must be placed In'a MODE that minimizes

-accident risk. To achieve:this status, the unit must be placed in at

- least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within'36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The

' .t .':allowed Completion-Times are reaso'nable, .based-,on operating experience, to&reach'the' required unit'conditions from full power conditions in an 'orderly-manner and-without challenging unit systems.

(continued)

INDIAN POINT 3 B 3.7.11 .'-5 Revision 5

- LDL CRVS B 3.7.11 BASES SURVEILLANCE REQUIREMENTS SR 3.7.11.1 Standby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing each train once every month provides an adequate check of this system. Note that a CRVS train includes both the filter booster fan and an air-conditioning unit fan powered from the same safeguards power train. The 31 day Frequency is based on the reliability of the equipment and the two train redundancy availability.

SR 3.7.11.2 This SR verifies that the required CRVS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The CRVS filter tests are in accordance with the sections of Regulatory Guide 1.52 (Ref. 3) identified in the VFTP. The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and the physical properties of the activated charcoal. Specific test Frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.11.3 This SR verifies that each CRVS train starts and operates on an actual or simulated actuation signal. The Frequency of 24 months is based on operating experience which has demonstrated this Frequency provides a high degree of assurance that the booster fans will operate and dampers actuate to the correct position when required.

SR 3.7.11.4 This SR verifies the integrity of the control room enclosure, and the assumed inleakage rates of the potentially contaminated air. The control room positive pressure, with respect to potentially contaminated adjacent areas, is periodically tested to verify proper functioning of the CRVS. During operation in the CRVS Mode 3 (i.e.

10% Incident mode), the CRVS is designed to maintain the control room at a slight positive pressure with respect to adjacent areas in order to attenuate unfiltered inleakage. The acceptance criteria of > 1500 cfm filtered make-up air is the value used in the Control Room dose assessment.

(continued)

J, INDIAN POINT 3 B 3.7.11 - 6 Revision 5

CRVS B 3.7.11 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.11A4 The SR Frequency of 24 months on a staggered test basis is acceptable because operating experience has demonstrated that the control room boundary is not normally disturbed. Staggered testing is acceptable because the SR is primarily a verification of Control Room integrity because fan operation is tested elsewhere.

REFERENCES 1. FSAR, Section 9.9.

2. FSAR, Chapter 14.

3. Safety Evaluation Report (SER) for IP3 Amendment 224.

4. IP3 Technical Requirements Manual.

INDIAN POINT 3 B 3.7.11 - 7 Revision 5

AC Sources - Operating B 3.8.1 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources -Operating BASES BACKGROUND The unit Electrical Power Distribution System AC sources consist of the following: two offsite circuits (the normal or 138 kV circuit and the alternate or 13.8 kV circuit), each of'which has a preferred and backup feeder; and, the onsite'standby power circuit consisting of three diesel 'generators.' As required by 10 'CFR 50. Appendix A. GDC 17 (Ref. 1), the design of the AC electrical'power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.

The onsite'plant distribution system is configured around 6.9 kV buses

'Nos.-1, 2, 3. 4. 5. and 6. All offsite' power to safeguards buses enter the plant via 6.9 kV buses Nos.5 and 6'which are connected to the 138 kV (normal) offsite circuit and have the ability to be connected to the 13.8 kV (alternate) offsite circuit. 6.9 kV buses 1.

'2,3. and 4. which supply'power to the 4 reactor coolant pumps (RCPs),

typically receive power from the main generator via the unit auxiliary transformer (UAT) when the plant is at power.' However, when the main generator or UAT is not capable of supporting this arrangement, 6.9 kV buses 1 and 2 receive offsite power via 6.9 kV bus 5 and 6.9 kV buses 3 and 4 receive offsite power via 6.9 kV bus 6. Following a unit trip. 6.9 kV buses 1. 2, 3,-and 4 will auto transfer (fast transfer) to 6.9 kV buses 5 and 6 in order to receive offsite power. The 6.9 kV buses supply power to the 480 V buses using 6.9 kV/480 V station service transformers (SSTs) as follows: 6.9 kV bus 5 supplies 480 V bus 5A via SST 5; 6.9 kV bus 6 supplies 480 V busl6A via SST 6: 6.9 kV bus 2 supplies 480 V bus 2A via SST 2: and, 6.9 kV bus 3 supplies 480 V bus 3A via SST 3.

The onsite AC Power Distribution System begins with 480 V buses 5A.

6A, 2A and 3A and is'divided into 3 safeguards power trains (trains) consisting of the 480 volt safeguards bus(es) and associated AC electrical power distribution subsystems, 125 volt DC bus subsystems, and 120 volt vital AC instrument bus subsystems'. The three trains are designed such that any two trains are capable of meeting minimum requirements for accident mitigation and/or safe shutdown. The three safeguards power trains are train 5A (480 volt bus 5A and associated DG 33). train 6A (480 volt bus 6A and associated DG 32). and train 2A/3A (480 volt buses 2A and 3A and associated DG 31).

(continued)

INDIAN POINT 3 B 3.8.1 -1 -Revision 2 -

- I=

l~

AC Sources - Operating B 3.8.1 BASES BACKGROUND Offsite power is supplied to the plant from the transmission network (continued) by two electrically and physically separated circuits, the 138 kV or normal circuit and the 13.8 kV or alternate circuit. Each of the offsite circuits from the Buchanan substation into the plant is required to be supported by a physically independent circuit from the offsite network into the Buchanan substation. All offsite power enters the plant via 6.9 kV buses Nos.5 and 6 which are connected to the 138 kV (normal) offsite circuit and have the ability to be connected to the 13.8 kV (alternate) offsite circuit. This arrangement satisfies the requirement that at least one of the two required circuits can within a few seconds, provide power to safety-related equipment following a loss-of-coolant accident. Operator action is required to supply offsite power to the plant using the 13.8 kV (alternate) offsite source.

The 138 kV circuit and the 13.8 kV circuit each have a preferred and a backup feeder that connects the circuit to the Buchanan substation.

For both the 138 kV and 13.8 kV circuits, the preferred IP3 feeder is the backup IP2 feeder and the backup IP3 feeder is the preferred IP2 feeder.

For the 138 kV (i.e., normal) offsite circuit, IP2 and IP3 each have a dedicated Station Auxiliary Transformer (SAT) that can be supplied by either a preferred or backup feeder. The normal or 138 kV offsite circuit, including the SAT used exclusively for IP3. is designed to supply all IP3 loads,..including 4 operating RCPs and ESF loads, when using either the preferred (95331) or backup (95332) feeder. There are no special restrictions when IP2 and IP3 are both using the same 138 kV feeder concurrently.

For the 13.8 kV (i.e., alternate) offsite circuit, there is a 13.8 kV/6.9 kV auto-transformer associated with feeder 13W92 and a 13.8 kV/6.9 kV auto-transformer associated with feeder 13W93.

Feeder 13W93 and its associated auto-transformer is the preferred feeder for the IP3 alternate (13.8 kV) circuit and the backup feeder for the IP2 alternate (13.8 kV) circuit. Feeder 13W92 and its associated auto-transformer is the backup feeder for the IP3 alternate (13.8 kV) circuit and the preferred feeder for the IP2 alternate (13.8 kV) circuit.

(continued) J.

INDIAN POINT 3 B 3.8.1 -2 Revision 2

AC Sources - Operating B 3.8.1 BASES BACKGROUND An offsite circuit consists of all breakers, transformers, switches.

(continued) interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite 480 V ESF bus(es).

The onsite standby power source consists of 3 480 V diesel generators MOGs) with a separate DG dedicated to each of the safeguards power trains. 'Safeguards power train 5A (480 V bus 5A) is supported by DG 33; safeguards power train 6A (480 V bus 6A) is supported by DG 32:

and, safeguards power'train 2A/3A (480 V buses 2A and 3A) is'supported by DG 31. A DG starts

'automatically on a safety injection (SI) signal or on an ESF bus undervoltage signal (refer to LCO 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation"). After the DG has started, it

will automatically tie to its respective bus after offsite power is tripped as a consequence of ESF bus undervoltage, independent of or coincident with an SI signal.' The DGs will also start and operate in the standby mode without tying to the ESF bus on an SI signal alone.

Following the trip of'offsite power, an undervoltage signal strips nonpermanent loads from the ESF bus. When the DG is tied to the ESF bus, loads are then sequentially connected to its respective ESF bus by individual load timers. The sequencing logic controls the permissive-and starting signals to motor breakers to prevent overloading the DG by automatic load application.

In the event of a loss of 138 kV or normal offsite source, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a loss of coolant accident (LOCA).

Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the DG in the process.

Within 1 minute after the initiating signal is received, all loads needed to recover the unit or maintain it in a safe condition are returned to service.

Ratings for DGs 31, 32 and 33 are consistent with the requirements of Regulatory Guide 1.9 (Ref. 3). -The 3 DGs each consist of an Alco model 16-251-E'e'ngine coupled to a Westinghouse 2188 kVA, 0.8 power factor. 900 rpm, 3 phase, 60 cycle. 480 volt generator. The ESF loads that are powered from the 480 V ESF buses are listed in Reference 2.

(continued)

INDIAN POINT 3 B 3.8.1 -3 Revision 2 .'

-L1 - - ,

AC Sources - Operating B 3.8.1 BASES BACKGROUND (continued)

The EDGs have four capacity ratings as defined below that can be used to assess EOG operability.

Continuous: Electrical power output capability that can be maintained 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months /day, with no time constraint.

2000-hour: Electrical power output capability that can be maintained in one continuous run of 2000 hours0.0231 days 0.556 hours 0.00331 weeks 7.61e-4 months or in multiple shorter duration runs totaling 2000 hours0.0231 days 0.556 hours 0.00331 weeks 7.61e-4 months .

2-hour: Electrical power output capability that can be maintained for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in any 24-hour period.

1/2 - hour: Electrical power output capability that can be maintained for up to 30 minutes in any 24-hour period.

The electrical output capabilities (EDG load) applicable to these four ratings are as follows:

RATING EDG LOAD TIME CONSTRAINT Continuous

1750 kW None 2000-hour

1950 kW . 2000 hours0.0231 days 0.556 hours 0.00331 weeks 7.61e-4 months / calendar year 2-hour

1950 kW

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in a 24-hour period:

AND S 1750 kW for the remaining 22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months . [See NOTE A]

1/2-hour 5 2000 kW X 30 minutes in a 24-hour period:

AND 5 1750 kW for the remaining 23.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . (See NOTE Al (continued) I.

INDIAN POINT 3 B 3.8.1 -4 Revision 2

AC Sources - Operating B 3.8.1 BASES BACKGROUND NOTE A: The loading cycle permitted for the '2-hour' and the '1/2-(continued) hour' rating is operation at the overload condition (e.g. > 1750 kW) for the specified time followed by operation at the 'continuous' (e.g.

.1750kW) rating for the remaining time in the 24-hour period. This loading cycle may be repeated each day, as long as back-to-back operation in the overload condition does not occur. The 2000-hour cumulative-time constraint also applies to repetitive operation at the overload conditions allowed by the 2-hour and the 1/2-hour ratings.

Operation in excess of 2000 kW, regardless of the duration, is an unanalyzed condition. In such cases, the EDG is assumed to be inoperable and the vendor should be consulted to determine if accelerated or supplemental inspection and/or maintenance is necessary. The EDG can be returned to an operable status following completion of vendor-required inspection and/or maintenance.

APPLICABLE SAFETY ANALYSES The initial conditions of DBA and transient analyses in the FSAR, Chapter 6 (Ref. 4) and Chapter 14 (Ref. 5). assume ESF systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF~systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3 2. Power Distribution Limits; 3.4. Reactor Coolant System (RCS); and Section 3.6, Containment Systems.

The OPERABILITY of the AC electrical Kpower sources is consistent with the initial assumptions of the Accident analyses and is based upon meeting the design basis of the unit. This results in maintaining at least 2 of the 3 safeguards power trains energized from either onsite or offsite AC sources during Accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC power; and

b. A worst case single failure.

The AC sources satisfy Criterion 3 of 10 CFR 50.36.

(continued)

INDIAN POINT 3 B 3.8.1 -5 Revision 2

AC Sources - Operating B 3.8.1 BASES j LCO Two qualified circuits between the offsite transmission network and the onsite Electrical Power System and separate and independent DGs for each train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated DBA.

There are two qualified circuits (normal and alternate) from the transmission network at the Buchanan Station to the onsite electric distribution system. The normal circuit is 138 kV and the alternate circuit is 13.8 kV. If the alternate circuit is in use, the normal circuit is inoperable because the autotransfer functions mentioned in the following circuit descriptions are disabled. Both of these circuits must be supported by a circuit from the offsite network into the Buchanan substation that is physically independent from the other circuit to the extent practical. The circuits into the Buchanan substation that satisfy these requirements are 96951, 96952 and 95891.

The 138 kV (i.e., normal) offsite circuit consists of one of the following: 138 kV feeder 95331 (preferred); or, 138 kV feeder 95332 (backup). Additionally, the 138 kV/6.9 kV station auxiliary transformer, circuit breakers ST5 and ST6 which supply 6.9 kV buses 5 and 6, and the following components which are common to the normal and alternate offsite circuits:

a. The 480 V bus 5A supply consisting of 6.9 kV bus 5, station service transformer 5, and circuit breakers SS5 and 52/5A:

b. The 480 V bus 2A supply consisting of 6.9 kV bus 5, circuit breaker UT2-ST5 (including autotransfer function). 6.9 kV bus

2. station service transformer 2, and circuit breakers SS2 and 52/2A;

c. The 480 V bus 6A supply consisting of 6.9 kV bus 6, station service transformer 6, and circuit breakers SS6 and 52/6A; and,

d. The 480 V bus 3A supply consisting of 6.9 kV bus 6, circuit breaker UT3-ST6 (including autotransfer function), 6.9 kV bus 3, station service transformer 3, and circuit breakers SS3 and 52/3A.

(continued)

INDIAN POINT 3 B 3.8.1 -6 Revision 2

AC Sources - Operating B 3.8.1 BASES LCOI The 13.8 kV (i.e., alternate) offsite circuit consists of one of the (continued) following: 13.8 kV feeder'13W93 and its;associated 13.8/6.9 kV.'

autotransformer (preferred); or, 13.8 kV feeder 13W92 and its

.. . I associated 13.8/6.9 kV autotransformer (backup).- Circuit breakers GT35 and GT36; which supply 6.9 kV buses 5 and 6, and the following components are common to the normal and'alternate'offsite circuits:

a. The 480 V bus 5A supply consisting of 6.9 kV bus 5. station service transformer 5, and circuit breakers SS5 and 52/5A;

b. The 480 V bus 2A supply consisting of 6.9 kV bus 5. circuit breaker UT2-ST5 (not including autotransfer function), 6.9 kV bus 2, station service transformer"2. and circuit breakers SS2 and 52/2A;

c. The 480 V bus 6A supply consisting of'6.9 kV bus 6, station service transformer 6. and circuit breakers SS6 and 52/6A; and.

d. The 480 V bus 3A supply consisting of 6.9'kV bus 6. circuit breaker UT3-ST6 (not including autotransfer function), 6.9 kV bus 3. station service transformer 3. and circuit breakers SS3 and 52/3A. - - - I i*.

If the alternate (13.8 kV) offsite circuit is being used to supply power to the plant and the Unit Auxiliary-Transformer is supplying 6.9 kV bus 1, 2, 3 or 4,-the size of the 13.8 kV/6.9 kV auto-transformers requires that the automatic transfer of 6.9 kV buses 1. 2. 3. and 4 to 6.9 kV buses 5 and 6 (i.e., the offsite circuit) be disabled because neither.13.8 kV/6.9 kV auto-transformer is capable of supplying 4 operating RCPs. This requirement is not intended to preclude supplying 6.9 kV buses 1. 2, 3. and 4 using the alternate offsite circuit via the 13.8 kV/6.9 kV auto-transformers once sufficient loads have been stripped from 6.9 kV buses 1. 2. 3. and 4 to assure that the 13.8 kV/6.9 kV auto-transformer will not be overloaded by these manual actions.

If IP3 and IP2 are both using a single 13.8 kV feeder (13W92 or 13W93), administrative controls are used to ensure that the 13.8 kV/6.9 kV auto-transformer load restrictions will not be exceeded.

Each offsite circuitmustbe capable of maintaining rated frequency and voltage',and accepting required loads-during an accident, while connected to the ESF buses.

(continued)

INDIAN POINT 3 B 3.8.1 -7 Revision 2

I LI r-AC Sources - Operating B 3.8.1 BASES J LCO Three DGs must be capable of starting, accelerating to rated speed and (continued) voltage, and connecting to its respective ESF bus on detection of bus undervoltage. This will be accomplished within 10 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF buses.

Proper sequencing of loads. including tripping of nonessential loads, is a required function for DG OPERABILITY.

The AC sources in each safeguards power train must be separate and independent (to the extent possible) of the AC sources in the other train. For the DGs, separation and independence are complete.

For the offsite AC sources, separation and independence are to the extent practical. A circuit may be connected to more than one ESF bus, and not violate separation criteria. A circuit that is not connected to an ESF bus is required to have OPERABLE automatic or manual transfer capability to the ESF buses to support OPERABILITY of that circuit.

APPLICABILITY The AC sources are required to be OPERABLE in MODES 1. 2. 3. and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as'a result of AOOs or abnormal transients; and

b. Adequate core cooling is provided and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.

The AC power requirements for MODESS5 and 6 are covered in LCO 3.8.2, 'AC Sources -Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG or the 138 kV offsite circuit. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG. This also applies to the 138 kV offsite circuit, which is the only immediate access offsite circuit.

Therefore, the provisions of LCO 3.0.4.b. which allow entry into a (continued) j_1 INDIAN POINT 3 B 3.8.1 -8 Revi si on 2

AC Sources - Operating B 3.8.1 BASES ACTIONS MODE or other specified condition in the Applicability with the LCO (continued) not met after performance of a risk assessment addressing :inoperable

.:7 systems and components, should not be applied in this circumstance.

. .I ALl..:.-...;--

To ensure a highly.reliable power source remains with one offsite circuitinoperable, it is necessary to verify the OPERABILITY of the remaining required offsite circuit on a more frequent basis. For activities that will require entry into the associated Condition, performance of SR 3.8.1.1 for the offsite circuit(s) could be completed up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months prior to entry into the Condition.

Performanceof this SR before entry into the Condition can be credited to establish the accelerated Frequency-and therefore is equivalent to performing the SR within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after entry into the Condition. The LCO Bases describes the components and features which comprise the offsite circuits. Since the Required Action only specifies "perform,"

a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action not met.

However, if-a second required circuit fails SR 3.8.1.1. the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.. -

i A.2 Required Action A.2, applies only if-the 13.8 kV offsite power circuit is being used to feed 6.9,kV buses 5-and 6 and the UAT is supplying 6.9 kV bus 1. 2. 3 or 4. This action prevents the automatic transfer of 6.9 kV buses 1, 2, 3. and 4 from the UAT-to offsite power after a unit trip. Transfer of buses 1, 2, 3. and'4 from the UAT to offsite power could result in overloading the 13.8 kV/6.9 kV autotransformer.

This requirement is not intended to preclude supplying 6.9 kV buses 1.

2, 3. and 4 using the alternate offsite circuit via the 13.8 kV/6.9 kV auto-transformers once sufficient loads have'been stripped from 6.9 kV buses 1, 2. 3, and 4 to assure that the 13.8 kV/6.9 kV auto-transformer will not be overloaded by these manual actions.

Automatic transfer of buses 1. 2-, 3. and 4 can be disabled by placing 6.9 kV bus tie breaker control switches 1-5, 2-5, 3-6, and 4-6 in the "pull-out".position.. a-

',..r I- - ,a..,.ti Although the auto-transfer feature is normally disabled prior to placing the 13.8 kV offsite power circuit in service, a Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ensures that the 13.8 kV circuit meets requirements for Operability promptly when the alternate offsite circuit is configured to support the response of ESF functions.

(continued)

INDIAN POINT 3 B 3.8.1 -9.1 Revision 2

AC Sources - Operating B 3.8.1 BASES ACTIONS L3 (continued)

Required Action A.3, which only applies if the train will not be powered automatically from an offsite source when the main turbine generator trips, is intended to provide assurance that an event coincident with a single failure of the associated DG will not result in a complete loss of redundant required features. Required safety features are designed with a redundant safety feature that is powered from a different safeguards power train.

Therefore, if a required safety feature is supported by an inoperable offsite circuit; then the failure of the DG associated with that required safety feature will not result in the loss of a safety function because the safety function will be accomplished by the redundant safety feature that is powered from a different safeguards power train. However, if a required safety feature is supported by an inoperable offsite circuit and the redundant safety feature that is powered from a different safeguards power train is also Inoperable, then the failure of the DG associated with that required safety feature will result in the loss of a safety function. Required Action A.3 ensures that appropriate compensatory measures are taken for a Condition where the loss of a DG could result in the loss of a safety function when an offsite circuit is not OPERABLE.

The turbine driven auxiliary feedwater pump is not required to be considered a redundant required feature, and, therefore, not required to be'determined OPERABLE by this Required Action, because the design is such that the remaining OPERABLE motor driven auxiliary feedwater pump(s) is-capable (without any reliance on the motor driven auxiliary feedwater pump powered by the emergencylbus associated with the inoperable diesel generator) of providing 100% of the auxiliary feedwater flow assumed in the safety analysis.

The Completion Time for Required Action A.3 is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. The train will not have offsite power automatically supplying its loads following a trip of the main turbine generator: and (continued)

INDIAN POINT 3 B 3.8.1 -10 Revi sion 2

AC Sources - Operating B 3.8.1 BASES ACTIONS 'A3 (continued)

b. A required feature powered from'another safeguards power train is inoperable. - -

If.at any time during the'existence of Condition.A (one offsite

- circuit inoperable) a redundant required feature subsequently becomes

'inoperable, this Completion Time begins to be'tracked.

' :Discovering that offsite power is-not automatically available to one

'train of the onsite Electrical Power Distribution System coincident

.-with one or more inoperable required support or supported features, or both,-,that are associated with the other train'that has offsite power, results in starting the Completion Times'for the Required Action.

Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.

The remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the two remaining safeguards power trains of the onsite Distribution System. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the component'OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, 'the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the'capacity a'nd'ca ability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.,

-AA According-to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one offsite circuit inoperable. the reliability of-the offsite system is

degraded, and the potential for a loss'of offsite power is increased, with attendant potential for a challenge tiothe unit safety systems.

In this Condition, however, the remaining OPERABLE offsite circuit and

.. . . I I .I "' DGsare adequate-to supply electrical power to the onsite Distribution

.. I r -I System-. M

.. 0fJ1 1 i_, , !. I- II

. .,.The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Corkpletio'n'Time takes into'account the capacity and I.,.

( , f : i;

capability of..the'remaining AC sources, a reasonable time for repairs,

.. I I , '. and the low.probability of a DBA occurring during'this period.

. . .. I k (continued)

INDIAN.POINT 3 B 3.8.1 -11 ' Revision 2 -

AC Sources - Operating B 3.8.1 BASES ACTIONS EJ (continued)

To ensure a highly reliable power source remains with an inoperable DG. it -is necessary to verify the availability of the offsite circuits on a more frequent basis. For activities, that will require entry into the associated Condition, performance of SR 3.8.1.1 for the offslte circuit(s) could be completed up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months prior to entry into the Condition. Performance of this SR before entry into the Condition can be credited to establis h the accelerated Frequency and therefore is equivalent to performing the SR within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after entry into the Condition. Since the Required Action only specifies 'perform.' a failure of SR 3.8..1.1 acceptance criteria, does not result in a Required Action being not met. However, If a circuit falls to pass SR 3.8.1.1. it is inoperable. Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered.

Required Action B.2 is intended to provide assurance that a loss of offsite. power, during the period that a DG is inoperable, does not result in a complete loss of redundant required features. Required safety features are designed with a redundant safety feature that is powered from a different safeguards power train. Therefore. if a required safety feature is supported by an inoperable DG. then the failure of the offsite circuit will not result inthe loss of a safety function because the safety function will-be accomplished by the redundant safety feature that is powered from a different safeguards power train (and DG). However, if a required safety feature is supported by an inoperable DG and the redundant safety feature that is powered from a different safeguards power train is also inoperable.

then a loss of offsite power will result in the-loss of a safety function. Required Action B.2 ensures that appropriate compensatory measures are taken for a Condition where the loss of offsite power could result inthe loss of a safety function when a DG is not OPERABLE.

The turbine driven auxiliary feedwater pump is not required to be considered a redundant required feature, and, therefore, not required to be determined OPERABLE by this Required Action, because the design is such that the remaining OPERABLE motor driven auxiliary feedwater pumps is capable (without any reliance on' the motor driven auxiliary feedwater pump powered by the emergency bus associated with the inoperable diesel generator) of providing 1OO% of the auxiliary feedwater flow assumed in the safety analysis.

(continued)

INDIAN POINT 3 B 3.8.1 -12 Revision'.2

AC Sources - Operating B 3.8.1 BASES ACTIONS B,2 (continued)

The Completion Time-for Required Action B.2 is intended to allow the operator time to evaluate and repair any 'discovered inoperabilities.

This Completion Tire also allows for an exception to the normal "time zero" for, beginning the allowed outagetime-"clock." In this Required Action, the Completion Time only begins on discovery that both:

a. An inoperable DG exists;'a'nd'

b. A required feature powered from another safeguards power train

'isinoperable.'

If at any time during the existence of this Condition (one DG inoperable) a required feature subsequently7 becomes inoperable, this Completion Time would begin to be tracked.

Discovering one required DG inoperable coincident'with one or more inoperable-required support or supported features, or both, that are associated with either OPERABLE DG, results in starting the Completion Time for the Required Action. A COMPLETION TIME of four hours from the'discdvery of these events existing concurrently is Acceptable because it minimizes risk while allowing-time for restoration before subjecting the unit to transients associated with shutdown.

In this Condition, the remaining OPERABLE DGs and offsite circuits are

.adequate to supply electrical power to the onsite Distribution System.

Thus, on a'component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion'Time takes into account the OPERABILITY of the redundant counterpart to the inoperable required feature.

Addition'ally, the4 hour Completion Time takes into account the capacity rand capability of the remaining AC sources, a reasonable time for repairs, and the lowaprobability of a DBA occurring during this period.

-(continued)

INDIAN POINT 3 B 3.8.1 -13' 'in Revision Rvs 2

AC Sources - Operating B 3.8.1 BASES ACTIONS B.3.1 and B.3.2 (continued)

Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE OG(s). If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DGs, SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on other DG(s). the other DG(s) would be declared inoperable upon discovery and Condition E of LCO 3.8.1 would be entered. Once the failure is repaired, the common cause failure no longer exists, and Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s),

performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that DG.

In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2. the plant corrective action program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

According to Generic Letter 84-15 (Ref. 7), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable to confirm that the OPERABLE DGs are not affected by the same problem as the inoperable DG.

According to Regulatory Guide 1.93 (Ref. 6). operation may continue in Condition B for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

In Condition B. the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Distribution System.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

(continued)

INDIAN POINT 3 B 3.8.1 -14 Revision 2

AC Sources - Operating B 3.8.1 BASES ACTIONS C.1 and C.2 (continued)

Required Action C.1, which applies when two offsite circuits are inoperable, is intended-to provide assurance that an event with a coincident single failure will not result'in a complete loss of

-redundant required safety functions. Two offsite circuits are inoperable when both the immediate access circuit and the delayed offsite circuit are not available to one or more safeguards power trains. The most'probable cause is a failure in a portion of the circuit that is common to both offsite circuits. The Completion Time for this failure of redundant required features is reduced to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from that allowed for'one train without offsite power (Required Action A.3). The rationale for the reduction to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that three complete safeguards power trains are OPERABLE. When a redundant required feature is not OPERABLE, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are powered from redundant AC safety trains. This includes motor driven auxiliary feedwater pumps. Single train features, such as turbine driven auxiliary pumps, are included as discussed in the Bases for Required Action A.3. The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

-In this Required Action the Completion Time only begins on discovery that both:

a. All required offsite circuits areiinoperable; and

b. A required feature isinoperable.

If at any'time ,during the existence of Condition C (two offsite circuits inoperable) a required feature becomes inoperable. this

Comple'tion Time begins to be tracked.'

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition C.for a period that should not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

(continued)

INDIAN-POINT 3 B 3.8.1 -15 Rvin Revision 2

AC Sources - Operating B 3.8.1 BASES ACTIONS C.1 and C.2 (continued)

This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident: however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources Inoperable that involve one or more DGs inoperable. However, two factors tend to decrease the severity of this level of degradation:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and

b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient.

In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis In the safety analysis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

According to Reference 6, with the available offsite AC sources, two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

If two offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If only one offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues In accordance with Condition A.

(continued) 3 INDIAN POINT 3 B 3.8.1 -16 Revision 2

AC Sources - Operating

B 3.8.1 BASES ACTIONS D.1 and D.2 (continued)

Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable, resulting in de-energization. When the UAT'is being used to supply 6.9 kV buses 1. 2, 3 Or 4 and'the 13.8 kV 6ffsite circuit is being used to supply 6.9 kV buses 5 and 6. the autotransfer function is disabled. Therefore, 480 V safeguards buses 2A and 3A'(safeguards train 2A/3A) will not be automatically re-energized with offsite power following a plant trip until connected to the offsite circuit by operator action. Therefore, the Required'Actions of Condition D are modified by a Note to indicate that when Condition'D is entered with no offsite or DG AC power source automatically available to any train, the Conditions and Required Actions for LCO 3.8.9. 'Distribution Systems- Operating." must be

'immediately entered. This allows Condition 0to provide requirements for the loss of one offsite circuit and one'DG, without regard to whether a train would be de-energized during an event. LCO 3.8.9 provides the'appropriate restrictions for a~train that would be de-

-energized. ' .

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition D for a period that should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

In Condition D, individual redundancy is lost in both the offsite

-electrical power system 'and the onsite AC electrical power system.

Since power system redundancy'is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in'Condition C (loss of both required offsite circuits). This difference in reliability Is offset by the susceptibility of this power system configuration to a single bus or switching failure.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account the capacity and capability-of the'remaining AC sources, a'reasonable time for repairs, and the low probability of a DBA occurring during' this period.

(continued)

INDIAN POINT 3 B 3.8.1 Rio 2 Revision

AC Sources - Operating B 3.8.1 BASES ACTIONS ii.

(continued)

With two or more DGs inoperable, the remaining standby AC sources are not adequate to satisfy analysis assumptions. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total.loss of AC power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation Is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to Reference 6, with two or more DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

F.1 and F.2 If the inoperable AC electric power sources cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.

G.1 and H.1 Conditions G and H correspond to a level of degradation in which all redundancy in the AC electrical power supplies has been lost or a loss of safety function has already occurred. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.

(continued)

INDIAN POINT 3 B 3.8.1 -18 Revision 2

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS The AC sources are designed to permit inspection and testing of all important areas and features, especially those.that have a standby

-function, in accordance with 10 CFR 50. Appendix A. GDC 18 (Ref. 1).

-'Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions).

The SRs for demonstrating the OPERABILITY of the DGs are consistent with the recommendations of Regulatory Guide 1.9 (Ref.: 3), and Regulatory Guide 1.137 (Ref. 8).

Where the SRs discussed herein specify voltage and frequency tolerances, the following is applicable. The minimum steady state output voltage of 422 V is the value determined to be acceptable in the analysis of the degraded grid condition. This value allows for voltage dropto the-terminals of -480 V motors'. It also allows for voltage'drops to motors and other equipment down through the 120 V level where minimum operating voltage is also usually specified as 90%

of name plate rating. '

The specified maximum steady state output voltage of 500 V is equal to

the maximum operating voltage specified for 480 V circuit breakers.

The specified minimum and maximum frequencies of the DG are 58.8 Hz and 61.2 Hz, respectively. These values are equal to " 2% of the 60 Hz nominal frequency'and are derived fr6m the recommendations given in Regulatory Guide 1.9 (Ref. 3).

' G~R: 3.8.1.1'-

This SR ensures proper circuit'continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The verification includes a sufficient number of breakers in their correct position together with'proper bus'voltage to ensure that distribution buses and loads are 'appropriately connected to either their'preferred or backup

-power source for eachof the offsite circuits (Normal and Alternate),

and that appropriate independence of offsite circuits is maintained.

Portions of this SR may require telephone communication with the District Operator or IP2 Control Room personnel capable of confirming the status of the offsite circuits or some breaker positions. The 7 day Frequency is adequate since breaker position is not likely to change without the operator being aware of it and because 6.9 kV bus status and 13.8 kV circuit status are displayed in the control room.

(continued)

INDIAN POINT-3 B 3.8.1 -19 .Revision 2

AC Sources - Operating B 3.8.1 BASES 1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.2 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs are modified by a Note to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period.

For the purposes of SR 3.8.1.2. the DGs are started from standby conditions. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.

SR 3.8.1.2 requires that, at a 31 day Frequency, the DG starts from standby conditions and achieves required voltage and frequency within 10 seconds. The 10 second start requirement supports the assumptions of the design basis LOCA analysis in the FSAR. Chapter 14 (Ref. 5).

The normal 31 day Frequency for SR 3.8.1.2 is consistent with Regulatory Guide 1.9 (Ref. 3). This Frequency provides adequate assurance of DG OPERABILITY, while minimizing degradation resulting from testing. DGs have redundant air start motors and both air start motors are actuated by both channels of the start logic. The DG Is OPERABLE when either air start motor is OPERABLE: however, this SR will not demonstrate that both of the air start motors are Independently capable of starting the DG. If an air start motor is not capable of performing its intended function, a OG is inoperable until a timed start is conducted using the remaining air start motor.

Alternately, this SR may be performed using one air start motor (i.e..

redundant air start motor Isolated) on a staggered basis to ensure that the DG will start with either air start motor.

(continued)

INDIAN POINT 3 B 3.8.1 -20 Revision 2

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REOUIREMENTS (continued)

SR 3.8.1.3 This Surveillance verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting loads approximating

the maximum expected accident loads. A 'minimum run time of 60 minutes

'is required to stabillie engine temperatures, while minimizing the time that the DG is connected to the offsite-'source.

Although no power factor requirements are established by this SR. the DG is normally operated at'a power factor between 0.8 lagging and 1.0.

The 0.8 value is the design rating of the machine'.while the 1.0 is an operational limitation to ensure circulating currents are minimized.

The load band is provided to avoid routine overloading of the DG.

Routine overloading may result in more frequent teardown inspections

.i .

in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The 31 day Frequency for this Surveillance'is consistent with I I . I.

Regulatory Guide 1.9 (Ref. 3).

This SR is modified by four Notes. Note 1 indicates that diesel

- ';: engn'runs for-this Surveillance may include gradual loading, as

' recommended by the manufacturer; so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary

'transients. because of changing bus loads., do not invalidate this test. Similarly, momentary power factor' transients above the limit do

not invalidate the test. Note 3 indicates that this Surveillance shouldtbe conducted on only one DG at a time in order to avoid common

-cause failures that might result from offsite circuit or grid l . perturbations. Note 4-stipulates a prerequisite'requirement for performance of this SR. A successful DG'sta'rt must precede this test

-- i - to credit satisfactory performance.

,n.t.i . .

. (continued)

INDIAN POINT 3 B 3.8.1 Revision 2 .

Reiio

AC Sources - Operating B 3.8.1 BASES j, SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the level at which fuel oil is automatically added. The level is expressed as an equivalent volume in gallons, and is selected to ensure adequate fuel oil for approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of OG operation at full load.

The 31 day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low level alarms are provided and facility operators would be aware of any large uses of fuel oil during this period.

SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degradation.

There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive.

Removal of water from the fuel oil day tanks once every 31 days eliminates the necessary environment for bacterial survival. This is j the most effective means of controlling microbiological fouling. In addition, It eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources. including condensation, ground water, rain water, contaminated fuel oil. and breakdownof the fuel oil by bacteria.

Frequent checking for and removal of accumulated water minimizes fouling andprovides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are consistent with Regulatory Guide 1.137 (Ref. 8). This SR is for preventative maintenance. The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during the performance of this Surveillance.

(continued)

INDIAN POINT 3 B 3.8.1 -22 Revision 2

AC Sources - Operating

B 3.8.1 KJ BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.6 ThisSurveillance demonstrates that each required fuel oil transfer pump operates'and transfers fuel oil from its associated storage tank to its associated day tank.' This is required to support continuous

-- ' - operation of standby'power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed,

. and the controls and control systems for automatic fuel transfer systems are OPERABLE.'

The design of fuel transfer systems is'such that pumps operate automatically or must'be started manually in orde'r to maintain an

-adequate volume of fuel 'oil in the day tanks du'ring or following DG testing. Therefore, a 31'day Frequency is appropriate. Since proper operation of 'fuel transfer systems'is an inherent part of DG OPERABILITY, the Frequency of this SR is consistent with the 31 day

'Frequency for verification of DG operability.

I I . I 1. - - .,. . . , - . .

SR 3.8.1.7 Transfer of the offsite power supply from the normal offsite circuit

'to thealternate offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to'power the shutdown loads.

The 24 month Frequency of the Surveillance is based on engineering judgment,'taking into consideration the unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note. The reason for the Note is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and unit safety systems.

(continued)

INDIAN POINT 3 B 3.8.1 -23 Revision 2

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.8 Verification that 6.9 kV buses 2 and 3 will auto transfer (fast transfer) from the Unit Auxiliary transformer to 6.9 kV buses 5 and 6 (i.e. station auxiliary transformer) following a loss of voltage on 6.9 kV buses 2 and 3 is needed to confirm the Operability of a function assumed to operate to provide offsite power to safeguards power train 2A/3A following a trip of the main generator.

An actual demonstration of this feature requires the tripping of the main generator while the reactor is at power with the main generator supplying 6.9 kV buses 2 and 3. This will cause perturbations to the electrical distribution systems that could challenge unit safety systems during a plant shutdown. Therefore, in lieu of actually initiating a circuit transfer, testing that adequately shows the capability of the transfer is acceptable. This transfer testing may include anysequence of sequential, overlapping, or total steps so that the entire transfer sequence is verified. The 24 month Frequency is based on engineering judgement taking into consideration the plant conditions required to perform the Surveillance. and is intended to be consistent with expected fuel cycle length. J This SR is modified by two Notes. The reason for Note 1 is that.

during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge unit safety systems. Credit may be taken for unplanned events that satisfy this SR. As stated in Note 2, this SR is only required to be met when the 138 kV offsite circuit is supplying 6.9 kV buses 5 and 6 because, if the 13.8 kV circuit is supplying 6.9 kV buses 5 and 6. then the feature tested by this SR is required to be disabled.

(continued)

INDIAN POINT 3 B 3.8.1 -24 Revision 2

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.9

' This'Surveillance demonstrates that DG'noncritical protective

-'functions are bypassed on';a loss of voltage signal concurrent with an ESF actuation test signal,'and critical protective functions (engine overspeed, low lube oil pressure, and engine'overcrank) trip the DG to avert'substantial damage to the OG unit. The noncritical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the'operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operati6n of the DG.

The 24'month Frequency'is based on engineering judgment, taking into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

- Operating experience has shown that'these components usually pass the SR.: Therefore,'the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is"modified by a Note. -The reason for the Note is that performing the'Suirveillance would remove a required DG from service.

SR 3.8.1.10 IEEE-387-1995 (Ref. 9) requires demonstration once per 24 months that the DGs can start and run continuously at full load capability for an interval'of not'less'than'8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , $ 105 minutes of which is at a load

- equivalent to 110% of the continuous duty rating and the remainder of the time at a load equivalent to the continuous duty rating of the DG.

- ' ' The DG starts'for'this Surveillance can be performed either' from

' standby or hot conditions. The provisions for prelubricating and

wariup,' discussed in SR 3.8.1.2, and for gradual loading, discussed in

-SR-3.8.1.3, are applicable to this SR.

- ; (continued)

INDIAN POINT 3 B 3.8.1 -25 'Revision '

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.10 (continued)

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, testing must be performed using a power factor of # 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG would experience. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections In accordance with vendor recommendations in order to maintain OG OPERABILITY.

The 24 month Frequency is consistent with the recommendations of Ref.

9, and takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This Surveillance is modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the power factor limit will not invalidate the test. The reason for Note 2 is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and unit safety systems.

SR 3.8.1.11 Under accident conditions with concurrent loss of offsite power, loads are sequentially. connected to the bus by individual load timers to prevent overloading of the DGs due to high motor starting currents.

The design load sequence time interval tolerance ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. Reference 2 provides a summary of the automatic loading of ESF buses.

(continued)

INDIAN POINT 3 B 3.8.1 -26 Revision 2

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REOUIREMENTS SR 3.8.1.11 (continued)

The Frequency of 18 months is based on engineering judgment, taking into consideration operating experience that has shown that these components usually pass the SR.' Therefore, the Frequency was concluded to be acceptable from'a reliability standpoint.

This SR is modified by a Note that specifies that load timers associated with equipment that has automatic initiation capability disabled are not required to be OPERABLE. This note is needed because these time delay relays affect the OPERABILITY of both the AC sources (offsite'power and DG) and the specific load that the relay starts.

If a timerfails to start a required load or starts the load later than assumed in the analysis, then the required load is not OPERABLE.

If a timer starts the load outside the design interval (early or late), then the DG and offsite source are not OPERABLE because overlap of equipment starts may cause an offsite source to exceed limits for voltage or current or'a DG'to exceed limits' for voltage, current or frequency. Therefore, when an individual load sequence timer is not OPERABLE, because the timing ~sequence is outside the design interval, Condition D must be entered. -However, if the automatic initiation capability of the affected load is disabled, Condition D may be

exited,'and the Actions for'the inoperable load 'are taken. It is conservative to disable'the automatic initiation capability of a component rather than continue with the associated DG inoperable because of the following:'the potential for adverse impact on the DG by simultaneous start of ESF equipment Is eliminated; all other loads powered from the safeguards power train 'are available to respond to the event; and, the load with the inoperable'timer remains available

for a manual start after the one minute completion of the normal

-starting sequence.> '

(continued)

INDIAN POINT 3 B 3.8.1 -7 'Revision 2

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.12 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS. and containment design limits are not exceeded.

This Surveillance demonstrates the DG operation during a loss of offsite power actuation test signal in conjunction with an ESF actuation signal. This SR verifies all actions encountered from an ESF signal concurrent with the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

The DG autostart time of 10 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA.

The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability is achieved. 3 The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the OG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation.

For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, or high pressure injection systems are not capable of being operated, or residual heat removal (RHR) systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation.

In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may Include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

(continued) J INDIAN POINT 3 B 3.8.1 -28 Revision 2

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS SR 3.8.1.12 (continued)

The Frequency'of 24 months takes into consideration unit conditions required to perform the'Surveillance andis intended to be consistent with an expected fuel cycle length of 24 months.

This SR is modified by three Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is,'with the engine coolant and oil and temperature maintained and lube oil continuously circulated'consistent with manufacturer recommendations for DGs.

The reason for Note 2-is that the performance of the Surveillance would remove required'offsite circuits from service, perturb the

'electrical distribution system, and challenge safety systems.

The reason for Note 3 is to allow the SR to be conducted with only one safeguards train at a time or with two or three safeguards trains concurrently. Allowing the LOOP/LOCA test to be conducted using one safeguards power train and one DG at a time is acceptable because the safeguards power trains are designed to'respond to this event independently. Therefore, an individual test for each safeguards power train will provide an adequate verificationrof plant response to this event.

Simultaneous testing of all three safeguards power trains is acceptable as long as the following plant conditions are established:

.'- All three DGs'are available,'

diverse and redundant decay heat removal is available,

. no offsite power circuits'are inoperable, and no 'simultaneous'activities are performed that are precursors to events requiring AC power for mitigation (e.g., fuel handling accident or inadvertent'RCS draindown)

(continued)

INDIAN POINT 3 B 3.8.1 -29 Revision 2

l l I'm AC Sources - Operating B 3.8.1 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.13 This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously.

The 10 year Frequency is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3).

This SR is modified by two Notes. The reason for Note 1 is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations.

The reason for Note 2 is to allow SR 3.8.1.12 to satisfy the requirements of this SR If SR 3.8.1.12 is performed with more than one safeguards power train concurrently.

REFERENCES 1. 10 CFR 50, Appendix A.

2. FSAR, Chapter 8.

3. Regulatory Guide 1.9. Rev. 3, July 1993.

4. FSAR, Chapter 6.

5. FSAR. Chapter 14.

6. Regulatory Guide 1.93, Rev. 0. December 1974.

7. Generic Letter 84-15, Proposed Staff Actions to Improve and Maintain Diesel Generator Reliability.

8. Regulatory Guide 1.137, Rev. 0. 1978.

9. IEEE Standard 387-1995, IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations.

-3 INDIAN POINT 3 B 3.8.1 -30 Revision 2

ML052370231

Text

Navigation menu

Search