Text

Proposed Instrumentation & Control TSs
	ML18059A694
Person / Time
Site:	Palisades
Issue date:	02/22/1994
From:	; CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:	;
Shared Package
ML18059A693	List: ML18059A692; ML18059A694;
References
	NUDOCS 9403070244
	Download: ML18059A694 (140)
	v • d • e

ATTACHMENT 1 Consumers Power Company Pali s.ades Pl ant Docket 50-255

INSTRUMENTATION AND CONTROL TECHNICAL SPECIFICATION CHANGE REQUEST Revised Proposed Pages February 22, 1994 101- Pages- -

(~~===-=~~~~~--.~

~g23070244 940222 ;. , ! )

p ADOCK 05000255 ' I PDR I, I

PALISADES PLANT FACILITY OPERATING LICENSE DPR-20 APPENDIX A TECHNICAL SPECIFICATIONS

As Amended Through Amendment No.

PALISADES PLANT TECHNICAL SPECIFICATIONS TABLE OF CONTENTS

SECTION 1.0 1.1

1.2 DESCRIPTION

DEFINITIONS OPERATING DEFINITIONS MISCELLANEOUS DEFINITIONS PAGE NO 1-1 1-1 1-5 2.0 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS 2-1 2.1 SAFETY LIMITS - REACTOR CORE 2-1 2.2 SAFETY LIMITS - PRIMARY COOLANT SYSTEM PRESSURE 2-1 2.3 LIMITING SAFETY SYSTEM SETTINGS - RPS 2-1 Table 2.3.1 Reactor Protective System Trip *Setting Limits 2-2 B2.1 Basis - Reactor Core Safety Limit B 2-1 B2.2 Basis - Primary Coolant System Safety Limit B 2-2 B2.3 Basis - Limiting Safety System Settings B 2-3 3.0 LIMITING CONDITIONS FOR OPERATION 3-1 3.0 APPLICABILITY 3-1 3 .1 PRIMARY COOLANT SYSTEM 3-lb 3.1.1 Operable Components 3-lb Figure 3-0 ASI vs Fraction of Rated Power 3-3a 3.1. 2 Heatup and Cooldown Rates 3-4 Figure 3-1 Pressure - Temperature Limits for Heatup 3-9 Figure 3-2 Pressure - Temperature Limits for Cooldown 3-10 Figure 3-3 Pressure - Temperature Limits for Hydro 3-11 3.1.3 Minimum Conditions for Criticality 3-12 3.1.4 Maximum Primary Coolant Radioactivity 3-17 3.1.5 Primary Coolant System Leakage Limits 3-20 3.1.6 Maximum PCS Oxygen and Halogen Concentration 3-23 3.1. 7 Primary and Secondary Safety Valves 3-25 3.1.8 Overpressure Protection Systems 3-25a 3.2 CHEMICAL AND VOLUME CONTROL SYSTEM 3-26 3.3 EMERGENCY CORE COOLING SYSTEM 3-29 3.4 CONTAINMENT COOLING 3-34 3.5 STEAM AND FEEDWATER SYSTEMS 3-38 3.6 CONTAINMENT SYSTEM 3-40 Table 3.6.1 Containment Penetrations and Valves 3-40b 3.7 ELECTRICAL SYSTEMS 3-41 3.8 REFUELING OPERATIONS 3-46 3.9 Deleted 3-49

i Amendment

PALISADES PLANT TECHNICAL SPECIFICATIONS TABLE OF CONTENTS

SECTION 3.0 3.10 3.10.1 3.

10.2 DESCRIPTION

LIMITING CONDITIONS FOR OPERATION (continued)

CONTROL ROD AND POWER DISTRIBUTION LIMITS Shutdown Margin Requirements Deleted PAGE NO 3-1 3-50 3-50 3-51 3.10.3 Part-Length Control *Rods 3-51 3.10.4 Misaligned or Inoperable Rod 3-52 3.10.5 Regulating Group Insertion Limits 3-52 3.10.6 Shutdown Rod Limits 3-53 3.10.7 Low Power Physics Testin~ 3-53 3.10.8 Center Control Rod Misalignment 3-53 Figure 3-6 Control Rod Insertion Limits 3-55 3.11 POWER DISTRIBUTION INSTRUMENTATION 3-56 3.11.1 Incore Detectors 3-56 3.11.2 Excore Power Distribution Monitoring System 3-57 Figure 3.11-1 Axial Variation Bounding Condition- 3-59 3.12 MODERATOR TEMPERATURE COEFFICIENT OF REACTIVITY 3-60 3.13 Deleted 3-60 3.14 CONTROL ROOM VENTILATION 3-61 3.15 REACTOR PRIMARY SHIELD COOLING SYSTEM 3-62 3.16 ESF SYSTEM INITIATION INSTRUMENTATION SETTINGS 3-63 Table 3.16.1 ESF System .Initiation Instrument Setting Limits 3-63 B3.16 Basis - ESF System Instrumentation Settings B 3.16-1 3.17 INSTRUMENTATION AND CONTROL SYSTEMS 3-64 3.17.1 Reactor Protective System Instruments 3-64 Table 3.17.1 Instrument Requirements for RPS 3-65 3.17.2 Engineered Safety Features Instruments 3-66 Table 3.17.2 Instrument Requirements for ESF Systems 3-67 3.17.3 Isolation Functions Instruments 3-68 Table 3.17.3 Instrument Requirements Isolation Functions 3-69 3.17.4 Accident Monitoring Instruments 3-70 Table 3.17.4 Instrument Requirements for Accident Monitoring 3-71 3.17.5 Alternate Shutdown System Instruments 3-72 Table 3.17.5 Instruments for the Alternate Shutdown.System . 3-73 3.17.6 Other Safety Feature Instruments 3-74 Table 3.17.6 Instruments for Other Safety Features 3-77 B3.17 Basis - Instrumentation Systems B 3.17-1 3.18 Deleted 3-79 3.19 IODINE REMOVAL SYSTEM 3-79 3.20 SHOCK SUPPRESSORS (Snubbers) 3-80 3.21 CRANE OPERATIONS A~D MOVEMENT HEAVY LOADs---* 3-81 3.22 Deleted 3-84 3.23 POWER DISTRIBUTION LIMITS 3-84 3.23.1 Linear Heat Rate 3-84 Table 3.23.l Linear Heat Rate Limits 3-86 Table 3.23.2 Radial Peaking Factor Limits 3-86 Table 3.23-3 Power Distribution Measurement Uncertainty 3-86 Figure 3.23-1 Allowable LHR vs Peak Power Location 3-87 3.23.2 Radial Peaking Factors 3-88 3.23.3 Quadrant Power Tilt - Tq 3-89

ii Amendment I

_ ___J

PALISADES PLANT TECHNICAL SPECIFICATIONS TABLE OF CONTENTS

SECTION 4.0 4 .1 4.2 Table 4.

2.1 DESCRIPTION

SURVEILLANCE REQUIREMENTS OVER PROTECTION SYSTEM TESTS EQUIPMENT AND SAMPLING TESTS Minimum Frequencies for Sampling Tests PAGE NO 4-1 4-6 4-7 4-9 Table 4.2.2 Minimum Frequencies for Equipment Tests 4-11 Table 4.2.3 HEPA Filter and Charcoal Adsorber Systems 4-14 4.3 SYSTEMS SURVEILLANCE 4-16 Table 4.3.l Primary Coolant System Pressure Isolation Valves 4-19 Table 4.3.2 Miscellaneous Surveillance Items 4-23 4.4 Deleted 4-24 4.5 CONTAINMENT TESTS 4-25 4.5.1 Integrated Leakage Rate Tests 4-25 4.5.2 Local Leak Detection Tests 4-27 4.5.3 Recirculation Heat Removal Systems 4-28a 4.5.4 Surveillance for Prestressing System 4-29 4.5.5 End Anchorage Concrete Surveillance 4-32 4.5.6 Containment Isolation Valves 4-32 4.5.7 Deleted 4-32a 4.5.8 Dome Delamination Surveillance 4-32a 4.6 SAFETY INJECTION AND CONTAINMENT SPRAY SYSTEMS TESTS 4-39 4.6.l Safety Injection System 4-39 4.6.2 Containment Spray System 4-39 4.6.3 Pumps 4-40 4.6.4 Valves 4-39 4.6.5 Containment Air Cooling System 4-40 4.7 EMERGENCY POWER SYSTEM PERIODIC TESTS 4-42 4.7.1 Diesel Generators 4-42 4.7.2 Station Batteries 4-42 4.7.3 Emergency Lighting 4-43 4.8 MAIN STEAM STOP VALVES 4-44 4.9 AUXILIARY FEEDWATER SYSTEM 4-45 4.10 REACTIVITY ANOMALIES 4-46 4.11 Deleted 4-46 4.12 AUGMENTED ISI PROGRAM FOR HIGH ENERGY LINES 4-60 4.13 Deleted 4-65 4.14 AUGMENTED ISI PROGRAM FOR STEAM GENERATORS 4-66 4.15 PRIMARY SYSTEM FLOW MEASUREMENT 4-70 4.16 ISI PROGRAM FOR SHOCK SUPPRESSORS (Snubbers) 4-71 4.17 INSTRUMENTATION SYSTEMS TESTS 4-75 Table 4.17.1 Surveillance for the RPS 4-76 Table 4-17.2 Surveillance for ESF Functions 4-77 Table 4-17.3 Surveillance for Isolation Functions 4-78 Table 4-17.4 Surveillance for Accident Monitoring 4-79 Table 4-17.5 Surveillance for Alternate Shutdown 4-80 Table 4-17.6 Surveillance for Other Safety Functions 4-81 B4.17 Basis - Instrumentation Systems Surveillance B 4.17-1

iii Amendment

PALISADES PLANT TECHNICAL SPECIFICATIONS TABLE OF CONTENTS

SECTION 4.0 4.18 4 .18 .1 4.

18.2 DESCRIPTION

SURVEILLANCE REQUIREMENTS (Continued)

POWER DISTRIBUTION INSTRUMENTATION Incore Detectors Excore Monitoring System PAGE NO 4-83 4-83 4-83 4.19 POWER DISTRIBUTION LIMITS 4-84 4.19.1 Linear Heat Rate 4-84 4.19.2 Radial Peaking Factors 4-84 4.20 MODERATOR TEMPERATURE COEFFICIENT (MTC) 4-85 5.0 DESIGN FEATURES 5-1 5.1 SITE 5-1 5.2 CONTAINMENT DESIGN FEATURES 5-1 5.2.1 Containment Structures 5-1 5.2.2 Penetrations 5-2 5.2.3 Containment Structure Cooling Systems 5-2 5.3 NUCLEAR STEAM SUPPLY SYSTEM (NSSS) 5-2 5.3 .1 Primary Coolant System 5-2 5.3.2 Reactor Core and Control 5-3 5.3.3 Emergency Core Cooling System 5-3 5.4 FUEL STORAGE 5-4 5.4.1 New Fuel Storage 5-4 5.4.2 Spent Fuel Storage 5-4a Figure 5-1 Site Environment TLD Stations 5-5 6.0 ADMINISTRATIVE CONTROLS 6-1 6.1 RESPONSIBILITY 6-1 6.2 ORGANIZATION 6-1 6.2.1 Offsite and Onsite Organizations 6-1 6.2.2 Plant Staff 6-2 6.3 PLANT STAFF QUALIFICATIONS 6-3 Table 6.2-1 Minimum Shift Crew Composition 6-4 6.4 TRAINING 6-5 6.5 REVIEW AND AUDIT 6-5 6.5.1 Plant Review Committee 6-5 6.5.2 Nuclear Performance Assessment Department 6-6a 6.5.3 Plant Safety and Licensing 6-9 iv

Amendment

TECHNICAl SPECIFICATIONS-

1.0 DEFINITIONS The following terms are defined for uniform interpretation of these Technical Specifications.

1.1 OPERATING DEFINITIONS ASSEMBLY RADIAL PEAKING FACTOR - FrA ASSEMBLY RADIAL PEAKING FACTOR shall be the maximum ratio of the power generated in any fuel assembly, to the average fuel assembly power. (Each of these power terms shall be integrated over core height and shall include tilt.)

AVERAGE DISINTEGRATION ENERGY - E AVERAGE DISINTEGRATION ENERGY shall be the average (weighted in proportion to the concentration of each radionuclide in the reactor coolant at the time of sampling) of the sum of the average beta and gamma energies per disintegration (in MEV) for isotopes, other than iodines, with half lives greater than 15 minutes, making up at least 95% of the total noniodine activity in the coolant.

AXIAL OFFSET or AXIAL SHAPE INDEX - AO or ASI AXIAL OFFSET or AXIAL SHAPE INDEX shall be the ratio of the power generated in the lower half of the core minus the power generated in the upper half of the core, to the sum of those powers .

CHANNEL CALIBRATION A CHANNEL CALIBRATION shall be the adjustment, as necessary, of the channel output such that it responds with the necessary range and accuracy to known values of the parameter which the channel monitors. The CHANNEL CALIBRATION shall encompass the entire channel including the sensor, alarm, interlock, and trip functions, and shall include the CHANNEL FUNCTIONAL TEST. The CHANNEL CALIBRATION may be performed*by,any series of*

sequential, overlapping, or total channel steps such that the entire channel is calibrated. Neutron detectors may be excluded from CHANNEL CALIBRATIONS.

CHANNEL CHECK A CHANNEL CHECK shall be the qualitative assessment of channel behavior during operation by observation. This determination shall include, where possible, comparison of the channel indication and stat~s ~ith other indications and status derived from independent instrument channels measuring the same parameter. A CHANNEL CHECK shall include verification that the monitored parameter is within limits imposed by the Technical Specifications .

Amendment No. 31, 43, 54, 57, 68, 118, 124, 128, 137, 1-1

I. I OPERATING DEFINITIONS {continued)

CHANNEL FUNCTIONAL TEST A CHANNEL FUNCTIONAL TEST shall be the injection of a simulated signal into the channel to verify that it is OPERABLE, including any alarm and trip initiating function.

COLD SHUTDOWN The COLD SHUTDOWN condition shall be when the primary coolant is at SHUTDOWN BORON CONCENTRATION and lave is less than 2I0°F.

CONTAINMENT INTEGRITY.

CONTAINMENT INTEGRITY is defined to exist when all the following are true:

a. All nonautomatic containment isolation valves and blind flanges are closed (OPERABLE) except as noted in Table 3.6.L *

b. The equipment hatch is properly closed and sealed.

c. At least one door in each personnel air lock is properly closed and sealed.

d. All automatic containment isolation valves are OPERABLE (as demonstrated by satisfying isolation times specified in lable 3.6.I and leakage criterion in Specification 4.5.2) or are locked closed.

e. The uncontrolled containment leakage satisfies Specification 4.5.

CONTROL RODS CONTROL RODS shall be all full-length shutdown and regulating rods.

DOSE EQUIVALENT I-I3I DOSE EQUIVALENT I-I3I shall be that concentration of I-I3I (µCi/gm) which alone would produce the same thyroid dose as the'quantity"and isotopic mixture of I-I3I, I-I32, I-I33, I-I34 and I-I35 actually present. The thyroid dose conversion factors used for this calculation shall be those listed in Table III of TID-I4844, "Calculation of Distance Factors for Power and Test Reactor Sites."

HOT SHUTDOWN The HOT SHUTDOWN condition shall be when the reactor is subcritical by an amount greater than or equal to the margi~* as specified in* Technical Specification 3.IO and Twe is greater than 525°F .

Amendment No. 31, 43, 64, 67, 68, 118, 124, 128, 137, I-2

1.1 OPERATING DEFINITIONS (continued)

HOT STANDBY The HOT STANDBY condition shall be when lave is greater than 525°F and any of the CONTROL RODS are withdrawn and the neutron flux power range instrumentation indicates less than 2% of RATED POWER.

LOW POWER PHYSICS TESTING LOW POWER PHYSICS TESTING shall be testing performed under approved written procedures to determine CONTROL ROD worths and other core nuclear properties. Reactor power during these tests shall not exceed 2% of RATED POWER, not including decay heat and PCS lave and PCS pressure shall be in the range of 371°F to 538°F and 415 psia to 2150 psia, respectively.

Certain deviations from normal operating practice which are necessary to enable performing some of these tests are permitted in accordance with the specific provisions in these Technical Specifications.

OPERABLE - OPERABILITY A system, subsystem, train, component, or device shall be OPERABLE, or have OPERABILITY, when it is capable of performing its specified functions, and when all necessary attendant instrumentation, controls, electrical power, cooling or seal water, lubrication, or other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified functions are also capable of performing their related support functions.

POWER OPERATION The POWER OPERATION condition shall be when the reactor is critical and the neutron flux power range instrumentation indicates greater than 2% of RATED POWER.

QUADRANT POWER TILT - lq QUADRANT POWER TILT shall be the algebraic ratio of quadrant power minus average quadrant power, to average quadrant power.--*

RATED POWER RATED POWER shall be* a steady state reactor core output of 2530 MWt.

REACTOR CRITICAL The reactor is considered critical for purposes of administrative control when the neutron flux wide range channel instrumentation indicates greater than 10-4% of RATED POWER .

Amendment No. 31, 43, 54, 57, 68, 118, 124, 128, 137, 1-3

I I.I OPERATING DEFINITIONS (continued)

REFUELING BORON CONCENTRATION REFUELING BORON CONCENTRATION shall be a Primary Coolant System boron concentration of at least I720 ppm AND sufficient to assure the reactor is subcritical by ~ 53 Ap with all CONTROL RODS withd.rawn.

REFUELING OPERATION A REFUELING OPERATION shall be any operation involving movement of core components (except for incore detectors) when the reactor vessel head is untensioned or removed with fuel in the reactor vessel.

REFUELING SHUTDOWN The REFUELING SHUTDOWN condition shall be when the primary coolant is at REFUELING BORON CONCENTRATION and Tave is less than 2I0°F.

SHUTDOWN BORON CONCENTRATION SHUTDOWN BORON CONCENTRATION shall be a Primary Coolant System boron concentration sufficient to assure the reactor is subcritical by ~ 23 Ap with all CONTROL RODS in the core and the highest worth CONTROL ROD fully withdrawn.

SHUTDOWN MARG IN SHUTDOWN MARGIN shall be the instantaneous amount of reactivity by which the reactor is subcritical or would be subcritical from its present condition assuming that all CONTROL RODS are fully inserted except for the

single highest worth CONTROL ROD which is assumed to be withdrawn.

TOTAL RADIAL PEAKING FACTOR - FrT The TOTAL RADIAL PEAKING FACTOR shall be the maximum product of the ratio of individual assembly power to core average assembly power, times the highest local peaking factor integrated over the total core height, including tilt. Local peaking factor is defined~as the maximum ratio of an individual fuel rod power to the assembly average rod power.

Amendment No. 31, 43, 54, 57, 68, 118, 124, 128, 137, 143, I-4

1.2 MISCELLANEOUS DEFINITIONS MEMBERCSl OF THE PUBLIC MEMBER(S) OF THE PUBLIC shall include all persons who are not occupation-ally associated with the plant. This category does not include employees of the utility, its contractors, or its vendors. Also excluded from this category are persons who enter the site to service equipment or to make deliveries.

OFFSITE DOSE CALCULATION MANUAL (ODCM)

The OFFSITE DOSE CALCULATION MANUAL shall contain the current methodology and parameters used in the calculation of offsite doses due to radioactive gaseous and liquid effluents, in the calculation of gaseous and liquid effluent monitoring alarm and trip setpoints, and in the conduct of the Radiological Environmental Monitoring Program. The ODCM shall also contain the (1) Radioactive Effluent Controls and Radiological Environmental Monitoring Programs required by Specification 6.8.4 and (2) descriptions of the information to be included in the Radiological Environmental Operating Report and the Radioactive Effluent Release Report required by Specification 6.9.3.

PROCESS CONTROL PROGRAM The PROCESS CONTROL PROGRAM shall contain the current formula, sampling, analyses, tests, and determinations to be made to ensure that the processing and packaging of solid radioactive wastes based on demonstrated processing of actual or simulated wet solid wastes will be accomplished in such a way as to assure compliance with 10 CFR 20, 10 CFR 71, Federal and State regulations, and other requirements governing the disposal of the radioactive waste.

SITE BOUNDARY The SITE BOUNDARY shall be that line beyond which the land is neither owned nor otherwise controlled by the licensee.

UNRESTRICTED AREA An UNRESTRICTED AREA shall be any area at or beyond the SITE BOUNDARY access to which is not controlled by the licensee for purposes of protection of individuals from exposure to radiation and radioactive materials or, any area within the SITE BOUNDARY used for residential quarters or for industrial, commercial, institutional, or recreational purposes .

1-5 Amendment No. 85, 154,

TABLE 2.3.1 REACTOR PROTECTIVE SYSTEM TRIP SETTING LIMITS Four Primary Coolant Three Primary Coolant RPS Tri R Unit Pumgs Ogerating Pumgs Ogerating

1. Variable High sl5% above core power, sl5% above core power Power with a minimum of with a minimum of s30% RATED POWER sl5% RATED POWER and a maximum of and a maximum of sl06.5% RATED POWER. s49% RATED POWER.

2. PCS Flow ~95% Full PCS Flow. ~60% Full PCS Fl ow.

3. High Pressure s2255 psia. S2255 psi a.

Pressurizer

4. Thermal Margin/ (a) (a)

Low Pressure

5. Steam Generator ~25.9% ~25.9%

Low Water Level Narrow Range Narrow Range

6. Steam Generator ~500 psia. ~500 psia.

Low Pressure

7. Containment High s3.70 psig. s3.70 psig.

Pressure

(a) The p~essure setpoint for the Thermal Margin/Low pressure Trip, the higher of two values, Pm~ and Pvm' both in psia:

Pmin = 1750 Pvar = 2012(QA)(QR,) + 17.0(Tin) - 9493

~~' is where:

QA QA =

=

-0.720tSll + 1.028;

-0.333 ASI + 1.067; when -0.628 s ASl'<"-0.lOO,*

when -0.100 s ASI < +0.200 QA = +0.375 ASI + 0.925; when +0.200 s ASI s +0.565 ASI = Measured ASI when Q ~ 0.0625 ASI = 0.0 when Q < 0.0625 QR, = 0.412(Q) + 0.588; when Q .s 1.0 ....

QR, = Q; when Q > 1.0 Q Core Power/RATED POWER Tin = Maximum primary coolant inlet temperature, in OF.

ASI, Tin' and Qare the existing values as measured by the associated instrument channel .

2-2 Amendment No. 31, 80, 118, 138, 150,

2.0 BASis-.: *safeVr Limits *and Limiting' Safety System Settings 2.3 Basis - Limiting Safety System Settings (continued)

5. Low Steam Generator Water Level - The low steam generator water level reactor trip protects against the loss of feed-water flow accidents

and assures that the design pressure of the primary coolant system will not be exceeded. The specified set point assures that there will be sufficient water inventory in the steam generator at the time of trip to allow a safe and orderly plant shutdown and to prevent ~team generator dryout assuming minimum auxiliary feedwater capacity. 61 The 25.9% narrow range minimum setting listed in Table 2.3.1 assures that the heat transfer surface (tubes) is covered with water when the reactor is critical. The 25.9% indicated level corresponds to the location of the feed ring, at 46.7" above the lower instrument tap.

The narrow range instrument spans 180" for its 100% range.

6. Low Steam Generator Pressure - A reactor trip on low steam ~enerator secondary pressure is provided to protect against an excessive rate of heat extraction from the steam generators and subsequent cooldown of the primary coolant. The setting of 500 psia is sufficiently below the rated load operating point of 739 psia so as not to interfere with normal operation, but still high enough to provide the required protection in the event of excessi~ely high steam flow. This setting was used in the accident analysis.

7. Containment High Pressure - A reactor trip on containment high pressure is provided to assure that the reactor is shutdown befohe the initiation of the safety injection system and containment spray. 71 References 1 EMF-92-178, Revision 1, Table 15.0.7-1 2 Updated FSAR, Section 7.2.3.3.

3 EMF-92-178, Revision 1, Section 15.0.7-1 4 XN-NF-86-9l(P) 5 ANF-90-078, Section 15.1.5 6 ANF-87-150(NP), Volume 2, Section 15.2.7 7 Updated FSAR, Section 7.2.3.9.

8 ANF-90-078, Section 15.2.1

Amendment No. 31, 82, 118, 137, 159, 156, 159, B 2-5

LIMITING- CONDITIONS- FOR OPERATION LIMITING CONDITIONS FOR OPERATION 3.0 APPLICABILITY 3.0.1 Compliance with the Limiting Conditions for Operation contained in the succeeding Specifications is required during the plant conditions or other conditions specified therein; except that upon failure to meet the Limiting Conditions for Operation, the associated action requirements shall be met.

3.0.2 Noncompliance with a Specification shall exist when the requirements of the Limiting Condition for Operation and associated action requirements are not met within the specified time intervals. If the Limiting Condition for Operation is restored prior to expiration of the specified time intervals, completion of the action requirements is not required.

3.0.3 When a Limiting Condition for Operation and/or associated action requirements cannot be satisfied because of circumstances in excess of those addressed in the specification, within one hour action shall be initiated to place the unit in a condition in which the Specification does not apply by placing it, as applicable, in:

1. At least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ,

2. At least HOT SHUTDOWN within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and

3. At least COLD SHUTDOWN within the subsequent 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Where corrective measures are completed that permit operation under the action requirements, the action may be taken in accordance with the specified time limits as measured from the time of failure to meet the Limiting Condition for Operation. Exceptions to these requirements are stated in the individual Specifications.

3.0.4 Entry into a reactor operating condition or other specified condition shall not be made when the conditions for the Limiting Conditions for Operation are not met and the associated action requires a shutdown if they are not met within a specified time interval. Entry into a reactor operating condition or other specified condition may be made*in accordance with action requirements when conformance to them permits continued operation of the facility for an unlimited period of time. This provision shall not prevent passage through or to reactor operating conditions as required to comply with action requirements. Exceptions to these requirements are stated in the individual specifications.

3.0.5 Equipment removed from service or declared inoperable to comply with action requirements may be returned to service under administrative control solely to perform testing required to demonstrate its OPERABILITY or the OPERABILITY of other equipment. This is an exception to Specification 3.0.1 for the system returned to service under administrative control to perform the testing required to demonstrate OPERABILITY .

3-1 Amendment No. 31, 85, 130,

3. o BAs1s*- - -Ccon*trnuedJ** * " * * ----* -*

LIMITING CONDITIONS FOR OPERATION Specification 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with action requirements. The sole purpose of this Specification is to provide an exception to Specification 3.0.l (e.g., to not comply with the applicable action requirements to allow the performance of surveillance testing to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or

b. The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to service in conflict with the action requirements is limited to the time necessary to perform the required surveillance. This Specification does not allow performance of any other preventive or corrective maintenance.

An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with action requir~ments and must be reopened to perform the surveillance. .

An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of a surveillance test on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of a surveillance test on another channel in the same trip system .

3-lac Amendment No.

3. 6 CONTAINMENT SYSTEM ,

Applicability Applies to the reactor containment building .

Objective To assure the integrity of the reactor containment building.

Specifications 3.6.1 Containment Integrity

a. Containment integrity as defined in Specification 1.0 shall not be violated unless the reactor is in the cold shutdown condition.

b. Containment integrity shall not be violated when the reactor vessel head is removed unless the boron concentration is greater than refueling concentration.

c. Except for testing one rod at a time, positive reactivity changes shall not be made by CONTROL ROD motion or boron dilution unless the containment integrity is intact.

ACTION:

With one or more containment isolation valves inoperable (including during performance of valve testing), maintain at least one isolation valve operable in each affected penetration that is open and either:

a. Restore the inoperable valves to operable status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , or

b.

c.

Isolate each affected penetration within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months by use of at least one deactivated automatic valve secured in the isolation position, or Isolate the affected penetration within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months by use of at least one closed manual valve or blind flange; or

d. Be in at least hot shutdown within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in cold

-shutdown within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

BASIS The operability of the containment isolation valves ensures that the containment atmosphere will be isolated from the outside environment in the event of a release of radioactive material to the containment atmosphere or pressurization of the containment .

3-40 Amendment No. -l-2-8,

3. 8 .. REFUELING. OPERATIONS (Continued) ,.

References (1) FSAR, Section 9 .11.

(2) FSAR, Section 3.3.2.

(3) FSAR, Amendment No. 17' Item 13.0.

(4) FSAR, Amendment No. 17, Item 9.0.

(5) FSAR, Appendix J.

3.9 Deleted

3-49 Amendment No. 81, 85, 154,

3.10 CONTROL ROD AND-POWER DISTRIBUTION LIMITS Applicability Applies to operation of CONTROL RODS and hot channel factors during operation.

Objective To specify limits of CONTROL ROD movement to assure an acceptable power distribution during power operation, limit worth of individual rods to values analyzed for accident conditions, maintain adeguate shutdown margin after a reactor trip and to specify acceptable power limits for power tilt conditions.

Specifications 3.10.l Shutdown Margin Reguirements

a. With four primary coolant pumps in operation at hot shutdown and above, the shutdown margin shall be 2%~

b. With less than four primary coolant pumps in operation at hot shutdown and above, boration shall be immediately initiated to increase and maintain the shutdown margin at ~3.75%.

c. At less than the hot shutdown condition, with at least one primary coolant pump in operation or at least one shutdown cooling pump in operation, with a flow rate ~2810 gpm, the boron concentration shall be greater than the cold shutdown boron concentration for normal cooldowns and heatups, ie, non-emergency conditions.

During non-emergency conditions, at less than the hot shutdown condition with no operating primary coolant pumps and a primary system recirculating flow rate < 2810 gpm but ~ 650 gpm, then within one hour either:

1. (a) Establish a shutdown margin of~ 3.5% and (b) Assure two of the three charging pumps are electrically disabled.

OR

2. At least every 15 minutes verify that no charging*pumps are operating.

If one or more charging pumps are determined to be operating in any 15 minute surveillance period, terminate charging pump operation and insure that the shutdown margin requirements are met and maintained .

Amendment No. 31, 43, 57, 68, 70, 118, 3-50

3. IO -CONTROL-ROD"AND""POWER" DISTRIBUTION LIMITS (Continued) ..

3.10.1 Shutdown Margin Requirements (Continued)

During non-emergency conditions, at less than the hot shutdown condition with no operating primary coolant pumps and a primary system recirculating flow rate less than 650 gpm, within one hour:

(a) Initiate surveillance at least every 15 minutes to verify that no charging pumps are operating. If one or more charging pumps are determined to be operating in any 15-minute surveillance period, terminate char~ing pump operation an insure that the shutdown margin requirements are met and maintained.

d. If a CONTROL ROD cannot be tripped, shutdown margin shall be increased by boration as necessary to compensate for the worth of the withdrawn inoperable CONTROL ROD.

e. The drop time of each CONTROL ROD shall be no greater than 2.5 seconds from the beginning of rod motion to 90% insertion.

3.10.2 (Deleted) 3.10.3 Part-Length Control Rods The part-length control rods will be completely withdrawn from the core (except for control rod exercises and physics tests) .

Amendment No. 21, 118, 3-51

3 .10* CONTROL ROD-AND POWER DISTRIBUTION LIMITS (Contd).

3.10.4 Misaligned or Inoperable CONTROL ROD or Part-Length Rod

a. A CONTROL ROD or a part-length rod is considered misaligned if it is out of position from the remainder of the bank by more than 8 inches.

b. A CONTROL ROD is considered inoperable if it cannot be moved by its operator or if it cannot be tripped. A part-length rod is considered inoperable if it is not fully withdrawn from the core and cannot be moved by its operator. If more than one CONTROL ROD or part-length rod becomes misaligned or inoperable, the reactor shall be placed in the hot shutdown condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

c. If a CONTROL ROD or a part-length rod is misaligned, hot channel factors must promptly be shown to be within design limits or reactor power shall be reduced to 75% or less of RATED POWER within two hours. In addition, shutdown margin and individual rod worth limits must be met. Individual rod worth calculations will consider the effects of xenon redistribution and reduced fuel burnup in the region of the misaligned CONTROL ROD or part-length rod.

3.10.5 Regulating Group Insertion Limits

a. To implement the limits on shutdown margin, individual rod worth and hot channel factors, the limits on CONTROL ROD regulating group insertion shall be established as shown on Figure 3-6. The 4-pump operation limits of Figure 3-6 do not apply for decreasing power level rapidly when such a decrease is needed to avoid or minimize a situation harmful to the plant personnel or equipment .

Once such a power decrease is achieved, the limits of Figure 3-6 will be returned to by borating the CONTROL RODS above the insertion limit within two hours. Limits more restrictive than Figure 3-6 may be implemented during fuel cycle life based on physics calculations and physics data obtained during plant start-up and subsequent operation. New limits shall be submitted to the NRC within 45 days.

b. The sequence of withdrawal of the regulating groups shall be 1, 2, 3, 4.

c. An overlap of control banks in excess to 40% shall not be permitted.

d. If the reactor is subcritical, the rod position at which criticality could be achieved if the CONTROL RODS were withdrawn in normal sequence.shall..not be lower.. than-the--insertion -limit for zero power shown on Figure 3-6.

Amendment No. 3-J:,

3-52

3 .10' CONTROL~"ROo-*ANo**powrn**orSTRIBUTION. LIMITS (Contd) -.. , .'

3.10.6 Shutdown Rod Limits

a. All shutdown rods shall be withdrawn before any regulating rods are withdrawn.

b. The shutdown rods shall not be withdrawn until normal water level is established in the pressurizer.

c. The shutdown rods shall not be tnserted below their exercise limit until all regulating rods are inserted.

3.10.7 Low Power Physics Testing Sections 3.10.1.a, 3.10.1.b, 3.10.3, 3.10.4.b, 3.10.5 and 3.10.6 may be deviated from during low power physics testing and CROM exercises if necessary to perform a test but only for the time necessary to perform the test.

3.10.8 Center CONTROL ROD Misalignment The requirements of Specifications 3.10.4.1, 3.10.4.a, and 3.10.5 may be suspended during the performance of physics tests to determine the isothermal temperature coefficient and power coefficient provided that only the center CONTROL ROD is misaligned and the limits of Specification 3.23 are maintained.

Basis Sufficient CONTROL RODS shall be withdrawn at all times to assure that the reactivity decrease from a reactor trip provides adequate shutdown margin. The available worth of withdrawn rods must include the reactivity defect of power and the failure of the withdrawn rod of highest worth to insert. The requirement for a shutdown margin of 2.0% in reactivity with 4-pump operation, and of 3.75% in reactivity with less than 4-pump operation, is consistent with the assumptions used in the analysis of accident conditions (including steam line break) as reported in Reference 1 and additional analysis. Requiring the boron concentration to be at cold shutdown boron concentration at less than hot shutdown assures adequate shutdown margin exists to ensure a return to power does not occur if an unanticipated cooldown accident occurs. This requirement~applies to normal *operating*

situations and not during emergency conditions where it is necessary to perform operations to mitigate the consequences of an accident. By imposing a minimum shutdown cooling pump flow rate of 2810 gpm, sufficient time is provided for the operator to terminate a boron dilution under asymmetric conditions. For operation with no primary coolant pumps operating and a recirculating flow rate less than 2810 gpm the increased shutdown.margin and controls on--charging .pump"".

operability or alternately the surveillance of the charging pumps will ensure that the acceptance criteria, for an inadvertent boron dilution event will not be violated. 11 The change in irisertfon limit with reactor power shown on Figure 3-6 insures that the shutdown margin requirements for 4-pump operation is met at all power levels. The 2.5-second drop time specified f,pr the CONTROL RODS is the drop time used in the transient analysis. 1

Amendment No. 31, 54, 57,. 68, 118, 137, 3-53

3.10 CONTROL ROD AN~ POWER.DISTRIBUTION LIMITS (Continued)

Basis (Continued)

The insertion of part-length rods into the core, except for rod exercises or physics tests, is not permitted since it has been demonstrated on other CE plants that design power distribution envelopes can, under some circumstances, be violated by using part-length rods. Further information may justify their use. Part-length rod insertion is permitted for physics tests, since resulting power distributions are closely monitored under test conditions. Part-length rod insertion for rod exercises (approximately 6 inches) is permitted since this amount of insertion has an insignificant effect on power distribution.

For a CONTROL ROD misaligned up to 8 inches from the remainder of the banks, hot channel factors will be well within design limits. If a CONTROL ROD is misaligned by more than 8 inches, the maximum reactor power will be reduced so that hot channel factors, shutdown margin and ejected rod worth limits are met. If in-core detectors are not available to measure power distribution and rod misalignments >8 inches.exist, then reactor power must not exceed 75% of RATED POWER to insure that hot channel conditions are met.

Continued operation with that rod fully inserted will only be permitted if the hot channel factors, shutdown margin and ejected rod worth limits are satisfied.

In the event a withdrawn CONTROL ROD cannot be tripped, shutdown margin requirements will be maintained by increasing the boron concentration by an amount equivalent in reactivity to that CONTROL ROD. The deviations permitted by Specification 3.10.7 are required in order that the CONTROL ROD worth values used in the reactor physics calculations, the plant safety analysis, and the Technical Specifications can be verified. These deviations will only be in effect for the time period required for the test being performed. The testing interval during which these deviations will be in effect will be kept to a minimum and special operating precautions will be in effect during these deviations in accordance with approved written testing procedures.

Violation of the power dependent insertion limits, when it is necessary to rapidly reduce power to avoid or minimize a situation harmful to plant personnel or equipment, is acceptable due to the brief period of time that such a violation would be expected to exist, and due to the fact that it is unlikely that core operating limits such as thermal margin and shutdown margin would be violated as a result of the rapid rod insertion. Core thermal margin will actually increase as a result of the rapid rod insertion. In addition, the required shutdown margin will most likely not---be-.,violated as a result of the rapid rod insertion because present power dependent insertion limits result in shutdown margin in excess of that required by the safety analysis.

References (1) ANF-90-078

Amendment No. 31, 43, 57, 68, 118, 137, 3-54

t

E TWO OR THREE PUMP OPERATION 60

~

N 50

~ -- MAXIMUM POWER LEVEL t'C w

- '40

~ ..

t 30

~

20

~ ~

t'C

"'~ ~

~

u

...: 10 U.I a:

0 0 20 '40 60 80 100 0 20 40 MCUP{!)

. * . GROUP

. ©,

0 20 "°~@60 80 100 CONTROL ROD INSERTION , PERCENT FOUR PUMP OPERATION 100 90

t 80

E -----...... ~

0 70 M

It) ............

N

...0 60 "-..

t'C w

50

"°

"" ~

t i 30 ""'-

~

t'C

~

(,,) 20 w

a:

10

- ... ~

~ ""--

0 20 '40 © 60. ao 100 0 20 @ 40 MOC.JP '

m.ouP 2 0 20 '40MCUP (!JO 80 100 CONTROL ROD INSERTION I PEACE NT CONTROL ROD INSERTION LIMITS I. Pl\LISADES TECHNICAL SPECIFICATION

,, FIGURE 3-6 Amendment No. 21, 31, 118, 3-55

~.11 POWER-DISTRIBUTION-INSTRUMENTATION 3.11.1 INCORE DETECTORS LIMITING CONDITION FOR OPERATION The incore detection system shall be operable:

a. With at least 160 of the 215 possible incore detectors and 2 incores per axial level per core quadrant.

b. With the incore alarming function of the datalogger operable and alarm set points entered into the datalogger.

APPLICABILITY (1) Item a. above is applicable when the incore detection system is used for:

Measuring quadrant power tilt, Measuring radial peaking factors, Measuring linear heat rate (LHR), or Determining target Axial Offset (AO) and excore monitoring allowable power level.

(2) Items a. and b. above are applicable when the incore detection system is used for monitoring LHR with automatic alarms. (lncore Alarm System.)

ACTION 1:

With less than the required number of incore detectors, do not use the system for the measuring and calibration functions under (1) above .

ACTION 2:

With the alarming function of the datalogger inoperable, do not use the system for automatic monitoring of LHR (Inoperable Incore Alarm System).

Operation may continue using the excore monitoring system as specified in 3.11.2 or by meeting the requirements of 3.23.1.

Basis The operability of the incore detectors with the specified minimum complement of equipment ensures that the measurements obtained from use of this system accurately represent the spatial neutron flux distribution of the reactor core. The operability of the incore alarm system depends on the availability of the datalogger as well-as the operability of a minimum number of incore detectors. Incore alarm.set.points-must-be-updated periodically based on measured power distributions. The incore detector Channel Check is normally performed by an off-line computer program that correlates readings with one another and with computed power shapes in order to identify inoperable detectors .

3-56 Amendment No. 50, 58, 68, 144,

. 3.11 POWER DISTRIBUTION"' INSTRUMENTATION._,. **

3.11.2 EXCORE POWER DISTRIBUTION MONITORING SYSTEM LIMITING CONDITION FOR OPERATION The excore monitoring system shall be OPERABLE with:

a. The target AXIAL OFFSET (AO) and the Excore Monitoring Allowable Power Level (APL) determined within the previous 31 days of power operation using the incore detectors, and the measured AO not deviated from the target AO by more than 0.05 in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b. The AO measured by the*excore detectors calibrated with the AO measured by the incore detectors.

c. The quadrant tilt measured by the excore*detectors calibrated with the quadrant tilt measured by the incore detectors.

APPLICABILITY:

(1) Items a., b. and c. above are applicable when the excore detectors are used for monitoring LHR.

(2) Item c. above is applicable when the excore detectors are used for monitoring quadrant tilt.

(3) Item b., above is applicable for each channel of the TM/LP trip and the AXIAL SHAPE INDEX (ASI) alarm.

ACTION 1:

With the excore monitoring system inoperable, do not use the system for monitoring LHR.

ACTION 2:

If the measured quadrant tilt has not been calibrated with the incores, do not use the system for monitoring quadrant tilt.

ACTION 3:

When the difference between the excore and the incore measured *AXIAL OFFSET exceeds 0.02, the TM/LP trip function and the ASI alarm setpoints shall be conservatively adjusted within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or that channel shall be declared inoperable.

ACTION 4:

When the difference between the excore.and-the. incore measured-QUADRANT POWER TILT exceeds 2%, calculate the QUADRANT POWER TILT at least once each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months using symmetric incore detectors .

3-57 Amendment No. 43, 50, 58, 68, 118,

3. ll POWER. DISTRIBUTION. INSTRUMENTATION-3.11.2 EXCORE POWER DISTRIBUTION MONITORING SYSTEM LIMITING CONDITION FOR OPERATION Basis The excore power distribution monitoring system consists of Power Range Detector Channels 5 through 8.

The OPERABILITY of the excore monitoring sy~tem ensures that the assumptions employed in the PDC-11 analysis 11 for determining AO limits that ensure operation within allowable LHR limits are valid.

Surveillance requirements ensure that the instruments are calibrated to agree with the incore measurements and that the target AO is based on the current operating conditions. Updating the Excore Monitoring APL ensures that the core LHR limits are protected within the +/-0.05 band on AO. The APL considers LOCA based LHR limits, and factors are included to account for changes in radial power shape and LHR limits-over the calibration interval.

The APL is determined from the following:

LHR(Zhs APL = [ - - - - - - - - - - - ] x RATED POWER 121 LHR(Z)Max X V(Z) X 1.02 Min Where:

(1) LHR(Z)Ts is the limiting LHR vs Core Height (from Section 3.23.1), *

(2) LHR(Z)Ma~. is the measured peak LHR including uncertainties vs Core Height, (3) V(Z) is the function (shown in Figure 3.11-1),

(4) The factor of 1.02 is an allowance for the effects of upburn, (5) The quantity in brackets is the minimum value for the entire core at any elevation (excluding the top and bottom 10%*of*core) considering limits for peak rods. If the quantity in brackets is greater than one, the APL shall be the RATED POWER level.

References (1) XN-NF-80-47 (2) EMF-91-177 Amendment No. 43, SO, 58, 68, 118, 143, 3-58

3.11 POWER~DISTRIBUTION -INSTRUMENTATION

1.25 AXIAL VARIATION BOUNDING CONDITION

1. 2 -

1. 15 -

/] (0.94, 1.15) n r LJ N 1. 1 - (0. 77, 1. 11) u

1. 05 >-

1 >- .

I I I I 0.95 0 0.2 0.4 0.6 0.8 1 Fraction of Active Fuel Height FIGURE 3.11-1

3-59 Amendment No. 68,

3 .12 MODERATOR' TEMPERATURE COEFFICIENT" OF REACTIVITY Applicability

. Applies to the moderator temperature coefficient of reactivity for the core.

Objective To specify a limit for the positive moderator coefficient.

Specifications The moderator temperature coefficient (MTC) shall be less positive than +0.5 x 10*4 Ap/°F at s 2% of RATED POWER.

Bases The limitations on moderator temperature coefficient (MTC) are provided to ensure that the assumptions used in the safety analysis 111 remain valid.

Reference (1) EMF-92-178 Section 15.0.5 3.13 Deleted

Amendment No. 111, 118, 137, 143, 156, 3-60

3 .14 CONTROL ROOM VENTILATION ': " * . ,*.'

Applicability This specification applies to the control room ventilation system .

Objective The operability of the control room ventilation system ensures that (1) the ambient air temperature does not exceed the allowable temperature for continuous duty rating for the equipment and instrumentation cooled by this system, and (2) the control room will remain habitable for Operations personnel during and following all credible accidents.

Specifications

a. If the control room air temperature reaches 120°F, immediate action shall be taken to reduce this temperature or to place the reactor in a hot shutdown condition.

b. The control room ventilation system, consisting of two fans and a filter system; shall be operable. With both fans inoperable or the filter system inoperable, restore the system to operable status within 3% days or be in cold shutdown within the next 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

Basis The reactor protective system and the engineered safeguards system were designed for and the instrumentation was tested at 120°F.

Therefore, if the temperature of the control room exceeds 120°F, the reactor will be shut down and the condition corrected to preclude failure of components in an untested environment. The control room ventilation systems are independent except for the charcoal filter and associated equipment. The charcoal filter system is designed to provide filtered makeup air to the control room following a design base accident and is not used during normal operation .

3-61 Amendment No. 8-l-,

3.15 REACTOR-PRIMARY SHIELD.COOLING SYSTEM.

Applicability Applies to the shield cooling system .

Objective To assure the concrete in the reactor cavity does not overheat and develop excessive thermal stress.

Specification One shield coolin~ pump and coolin~ coil shall be in operation whenever cooling is required to maintain the temperature of the concrete below approximately 165°F.

Basis The shield cooling system is used to maintain the concrete temperature below 165°F, thus preventing weakening of the structure through loss of moisture. The structure must remain intact during a DBA to preclude damage to the reactor building sump and the plugging of the suction lines to the engineered safeguards pumps. One pump and cooling coil is more than adeqH~te to remove the 120,000 Btu/hr heat load at RATED POWER operation.'

Reference (1) FSAR, Section 9.2.1 .

3-62 Amendment No. 8-l-,

3 .16 .ENGINEERED- SAFETY-FEATURES *svSTEM *rnsTRUMENTATION SETTINGS Specification 3.16 The Engineered Safety Features (ESF) system instrumentation setting limits shall be as stated in Table 3.16.

Applicability Specification 3.16 is applicable when associated ESF or Isolation Function instrumentation is required to be OPERABLE by Specification 3.17.2 or 3.17.3.

Action 3.16.1 If an ESF instrument setting is not within the allowable settings of Table 3.16, immediately declare the instrument inoperable and complete corrective action as directed by specification 3.17.

TABLE 3.16 Engineered Safety Features System Instrument Settings Instrument Channel Allowable Value I. Pressurizer Low Pressure ~ 1593 psia

2. Containment High Pressure 3.70 - 4.40 psig

3. Containment High Radiation ~ 20 R/h

4. Steam Generator Low Pressure ~ 500 psi a

5. Steam Generator Low Level ~ 25.9%

Narrow Range

6. SIRW Tank Low Level 21 - 27 inches Above Tank Bottom

7. Engineered Safefiuards Pump Room ~ 2.2 x 10 5 cpm Ventilation Hig Radiation

3-63 Amendment No. BG,

3 .17 INSTRUMENTATION-*svSTEMs--*.

Speci fi cation 3.17.1 Four Reactor Protective System (RPS) trip unit channels and the associated instrumentation for the functions listed in Table 3.17.1, and 6 matrix logic channels and 4 initiation logic channels shall be OPERABLE except as allowed by the permissible operational bypasses column.

Applicability Specification 3.17.1 applies when there is fuel in the reactor, more than one CONTROL ROD is capable of being withdrawn, and the PCS is less than REFUELING BORON CONCENTRATION.

Action 3.17.1.1 With one Manual Reactor Trip channel inoperable:

a) Restore the channel to OPERABLE status prior to the next reactor startup.

3.17.1.2 With one RPS trip unit or associated instrument channel inoperable for one or more functions:

a)* Place the affected trip unit in the tripped condition within 7 days.

3.17.1.3 With two RPS trip units or associated instrument channels inoperable for one or more functions:

a) Place one inoperable trip unit in the tripped condition within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , and b) If two Power Range Nuclear Instrument channels are inoperable, limit power to ~ 703 RATED POWER within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , and c)* Restore one RPS trip unit and associated instrument channel to OPERABLE status within 7 days.

3.17.1.4 With one RPS Matrix Logic channel inoperable:

a) Restore the channel to OPERABLE status within* 48 *hours-~

3.17.1.5 With one.RPS Initiation Logic channel inoperable:

a) De-energize the affected clutch power supplies within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

3.17.1.6 If any action required by 3.17.1 is not met AND the associated

completion time has expired,. or--if the--number--of-OPERABLE channels is less than specified in the "Minimum OPERABLE Channels":

a) The reactor shall be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and b) The reactor ~hall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

These Actions are not required for inoperable High Startup Rate or Loss of Load instrument channels .

3-64 Amendment No.

. 3.17 INSTRUMENTATION-SYSTEMS. -*.- ..... ' - .

Table 3.17.1 Instrumentation Operating Reguirements for Reactor Protective System Required Minimum Permissible RPS OPERABLE Ope rational Functional Unit Channels Channels Bypasses

1. Manual Trip 2 1 None.

2. Variable High Power 4 2 None.

3. High Start Up Rate 4 Below 10-4%101 or above 13% RATED POWER.

4. Thermal Margin/ 4 2 (b) & (c).

Low Pressure

5. High Pressurizer 4 2 None.

Pressure

6. Low PCS Flow 4 2 (b) & (c).

7. Loss of Load 1d1 4 2 Below 17% RATED POWER.

8. Low "A" Steam 4 2 None.

Generator Level

9. Low "B" Steam 4 2 None.

Generator Level

10. Low "A" Steam 4 2 (b) & (c).

Generator Pressure

11. Low "B" Steam 4 2 (b) & (c).

Generator Pressure

12. High Containment 4 2 None.

Pressure

13. RPS Matrix Logic 6 5 None.

14. RPS Initiation Logic 4 3 None.

(a) Two OPERABLE Wide Range Nuclear *lnstrument.-channels-are .. required* if, the Zero Power Mode bypass is used.

(b) Below 10-43 101 RATED POWER and at SHUTDOWN BORON CONCENTRATION for the COLD SHUTDOWN condition.

(c) For LOW POWER PHYSICS TESTING, setpoint may be increased from 10-4% to 1~ %; SHUTDOWN BORON CONCENTRATION is not required.

1 (d) Loss of Load not required to be OPERABLE when below 17% RATED POWER *

3-65 Amendment No. 118, 130, 136,

3 .17 INSTRUMENTATION"SYSTEMS .,. ..,. *-

Specification 3.17 .2 The Engineered Safety Feature (ESF) logic channels and associated instrumentation for the functions 1isted in Table 3.17.2 shall be OPERABLE except as allowed by the permissible operational bypasses

column.

App 1i cabil i ty Specification 3.17.2 applies when the PCS temperature is~ 300°F.

Action 3.17.2.1 With one ESF manual control channel or ESF logic channel inoperable for one or more functions:

a) Restore the channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3.17.2.2 With one ESF instrument channel inoperable for one or more functions, except SIRWT Level:

a) Place the trip unit for each affected ESF function in the tripped condition within 7 days.

3.17.2.3 With two ESF instrument channels inoperable for one or more functions, except SIRWT Level:

a) Place one channel trip unit for each affected ESF function in the tripped condition within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , and

3.17.2.4 b) a)

Restore one channel to OPERABLE status within 7 days.

With one SIRWT Level channel inoperable:

Bypass the level switch within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , and b) Restore the channel to OPERABLE status within 7 days.

3.17.2.5 With one or more Emergency Power Sequencers inoperable:

a) Declare the associated Diesel Generator inoperable, immediately.

3.17.2.6 If any action required by 3.17.2 is not met AND the associated completion time has expired, or if the number of OPERABLE channels is less than specified in the "Minimum OPERABLE Channels":

a) The reactor shall be placed in HOT SHUTDOWN-within-12-hoursj and b) The reactor shall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3-66 Amendment No.

3 .17 INSTRUMENTATION-SYSTEMS Table 3.17.2 Instrumentation Operating Requirements for

Functional *unit Engineered Safety Features Required ESF Channels Minimum OPERABLE Channels Permissible Operat i ona 1 Bypasses I. Safety Injection Signal (SIS)

a. Manual Initiation .2 I None.

b. SIS Logic

2 I None.

Initiation, Actuation, and fow pressure block auto reset)

c. CHP Signal SIS Initiation 2 I None.

(SP Relay Output)

d. Pressurizer Pressure 4 2 ~ 1700 psi a Instrument Channels PCS pressure.

2. Recirculation Actuation Signal (RAS)

a. Manual Initiation 2 I None.

b. RAS Logic 2 I None .

c.

3.

a.

SIRWT Level Switches 4 Auxil{ary Feedwater Actuation Signal (AFAS)

Manual Initiation 2 3

I None.

None.

b. AFAS Logic 2 1 None.

c. "A" Steam Generator Level 4* 2 None.

d. "B" Steam Generator Level 4 2 None.

4. Emergency Power Sequencers

a. DBA Sequencer 2 I None.

b. Normal Shutdown Sequencer 2 I None.

3-67 Amendment No.

3.17 - INSTRUMENTATION-SYSTEMS "

Specification

3.17 .3 The Isolation Function lo~ic channels and associated instrumentation for the functions listed in Table 3.17.3 shall be OPERABLE except as allowed by the permissible operational bypasses column.

Applicability Specification 3.17.3 applies when the PCS is above COLD SHUTDOWN.

Action 3.17.3.1 With one Isolation Function manual control or Isolation Function logic channel inopefable for one or more functions:

a) Restore the channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3.17.3.2 With one Isolation Function instrument channel inoperable for one or more functions:

a) Place the trip unit for each affected Isolation Function in the tripped condition within 7 days.

3.17.3.3 With two Isolation Function instrument channels inoperable for one or more functions:

a) Place one channel trip unit for each affected Isolation Function in the tripped condition within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , and

3.17.3.4 b) a)

Restore one channel to OPERABLE status within 7 days.

With one or two Engineered Safeguards Room Radiation Monitors inoperable:

Initiate action to isolate ventilation from the associated room immediately.

3.17.3.5 If any action required by 3.17.3 is not met AND the associated completion time has expired, or if the-number*of-'OPERABLE*channels is less than specified in the "Minimum OPERABLE Channels":

a) The reactor shall be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and b) The reactor shall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Amendment No .

3-68

3 . 17 lNSTRUMENTAT ION*- SYSTEMs*****

Table 3.17.3 Instrumentation Operating Requirements for

Functional Unit Isolation Functions Required Isolation Channels

Minimum OPERABLE Channels Permissible Operational Bypasses I. Containment High Pressure (CHP)

a. CHP logic Trains 2 I None.

b. Containment Pressure 4 2 None.

Switches - Left Train

c. Containment Pressure 4 2 None.

Switches - Right Train

2. Containment High Radiation (CHR)

a. Manual Initiat.ion 2 I None.

b. CHR Logic Trains 2 I None.

c. Containment Area 4 2 None.

Radiation Monitors

3. Steam Generator Low Pressure (SGLP)

a. Manual Actuation

b. SGLP Logic Trains I set/train 2

I set I

None.

< 550 ~sig Steam ressure.

c. "A" Steam Generator 4 *2 * < 550 ~sig Pressure Steam ressure.

d. "B" Steam Generator 4 2 < 550 ~sig Pressure Steam ressure.

4. Engineered Safeguards Pump Room High Radiation

a. East Room Monitor I 0 None.

b. West Room Monitor I 0 None.

3-69 Amendment No.

3 .17 INSTRUMENTATION-*svSTEMS --- *-' * * -- .,

Specification 3.17.4 The Accident Monitoring Instruments listed in Table 3.17.4 shall be OPERABLE. (Specifications 3.0.3, 3.0.4, and 4.0.4 do not apply.)

Applicability Specification 3.17.4 applies when the PCS temperature is > 300°F.

Action 3.17.4.1 With one required channel of functions 1 through 14 inoperable for one or more functions:

a) Restore channel to OPERABLE status within 7 days.

3.17.4.2 With two required channels of functions 1 through 14 inoperable for one or more functions:

a) Restore one channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3.17.4.3 With position indication inoperable for one or more Containment Isolation Valves:

a) Restore the indication to OPERABLE status or lock the associated valves in the closed position within 7 days.

3.17.4.4 If any action required by 3.17.4.1 through 3.17.4.3 is not met AND the associated completion time has expired, a) The reactor shall be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and b) The reactor shall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3.17.4.5 With one channel of functions 16 through 21 inoperable for one or more functions:

a) Restore the channel to OPERABLE status within 7 days.

3.17.4.6 With two required channels of functions 16-through *-21~* inoperable for one or more functions:

a) Restore one channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3.17.4.7 If any action required by 3.17.4.5 or 3.17.4.6 is not met AND the associated completion time has expired:

a) With two ~ETs.in any on~ quadrant inoperable, complete Action 3.17.4.4 in lieu of Action 3.17.4.7 c),

b) With two RVWL channels inoperable, initiate alternate monitoring within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , c) Submit a report to the NRC within 30 days after the event, outlining the action taken, the cause of the inoperability, and the plans and schedule for restoring the channels to OPERABLE status; and d) Restore the channels to OPERABLE status prior to startup from the next refueling.

Amendment No. 136, 147, 3-70

3 .17 .. INSTRUMENTATION *svsTEMS" Table 3.17.4 Instrumentation Operating Requirements for Accident Monitoring Required Instrument Channels

1. Wide Range TH 2

2. Wide Range Tc 2

3. Wide Range Flux 2

4. Containment Floor Water Level 2

5. Subcooled Margin Monitor 2

6. Wide Range Pressurizer Level 2

7. Containment H2 Concentration 2

8. Condensate Storage Tank Level 2

9. Wide Range Pressurizer Pressure 2

10. Wide Range Containment Pressure 2

11. Wide Range "A" Steam Generator Level 2

12. Wide Range "B" Steam Generator Level 13.

14.

15.

Narrow Range "A" Steam Generator Pressure Narrow Range "B" Steam Generator Pressure Position Indication for each 2

2 2

I/valve Containment Isolation Valve

16. Core Exit Thermocouples (CET) 4 Quadrant 1

17. Core Exit Thermocouples (CET) 4 Quadrant 2

18. Core Exit Thermocouples (CET) 4 Quadrant 3

19. Core Exit Thermocouples (CET) 4 Quadrant 4

20. Reactor Vessel Water Level (RVWL) 2

21. High Range Containment Radiation 2

3-71 Amendment No. -147-,

3.17 INSTRUMENTATION SYSTEMS*

Specification 3.17.5 The Alternate Shutdown System instrumentation and controls listed in Table 3.17.5 shall be OPERABLE.

Note: Specifications 3.0.3, 3.0.4, and 4.0.4 do not apply ..

Applicability Specification 3.17.5 applies when the PCS temperature is > 300°F.

Action 3.17.5.1 With one or more Alternate Shutdown System channels inoperable:

a) Provide equivalent shutdown capability within 7 days, and b) Restore the inoperable channels to OPERABLE status within 60 days.

3.17.5.2 If any action required by 3.17.5.1 is not met AND the associated completion time has expired:

a) The reactor shall be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and b) The reactor shall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3-72 Amendment No. 122, 146,

3 .17 INSTRUMENTATION .. SYSTEMS .

Table 3.17.5 Instrumentation Operating Requirements for

1.

Instrument or Control Start-up Range Flux Alternate Shutdown System Required Channels 1

2. Press~rizer Pressure 1

3. Pressurizer Level 1

4. #1 Hot Leg Temperature 1

5. #2 Hot Leg Temperature 1

6. #1 Cold Leg Temperature 1

7. #2 Cold Leg Temperature 1

8. "A" Steam Generator Pressure 1

9. "8" Steam Generator Pressure 1

10. "A" Steam Generator Level 1

11. "8" Steam Generator Level 1

12.

13.

14.

15.

SIRW Tank Level AFW Pump P-88 Flow to "A" SG AFW Pump P-88 Flow to "8" SG AFW Pump P-88 Suction Pressure Alarm 1

1 1

1

16. AFW Pump P-88 Steam Valve Control 1

17. AFW Flow Control "A" SG 1

18. AFW Flow Control "8" SG 1

19. Transfer Switches, C-150 2

20. Transfer Switch, C-150A - 1

3-73 Amendment No. 122, 136,

3 .17 lNSTRUMENTATION-*svSTEMS"' _.,. ,... *-- -

Specification

3.17.6 The Safety Function instruments listed in Table 3.17.6 shall be OPERABLE.

Applicability According to the Applicable Conditions column of Table 3.17.6.

Action 3.17.6.l With one or two Neutron Flux Monitoring channels inoperable:

a} Stop all positive reactivity additions immediately, and b} Be in HOT SHUTDOWN or below within 15 minutes, and c} Verify SHUTDOWN MARGIN within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , and once each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter.

3.17.6.2 With one channel of R6d Posi~ion Indication inoperabie for one or more CRDMs:

a} Verify that the associated rod group is within the limits of Specification 3.10 within 15 minutes after movement of any rod in that group.

3.17.6.3 With one or two SIRWT Temperature channels inoperable:

a} . Provide alternate means of temperature monitoring within 7 days.

3.17.6.4 With one Main Feedwater Flow channels inoperable:

a} Provide alternate means of flow monitoring within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.17.6.5 With one Main Feedwater Temperature channels inoperable:

a} Provide alternate means of temperature monitoring within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.17.6.6.1 With one AFW flow indicator-for one or more-flow path~inoperable:

a} Determine the OPERABILITY of the associated AFW flow control valve within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

3.17.6.6.2 With two AFW flow indicators for one flow path inoperable:

a} The associated control. valve -shal 1- immediately-be-declared-,. .... **

inoperable and the requirements of 3.5.2.e apply .

Amendment No. 3, 67, 96, 98, 115, 118, 121, 124, 129, 136, 3-74

3 .17 "INSTRUMENTATioN*-svsTEMS --

Action (continued)

3.17.6.7.1 With one required Leak Detection channel (7a, b, c, or d) a)

inoperable:

Restore the channel to OPERABLE status prior to the next startup from COLD SHUTDOWN.

3.17.6.7.2 With two or three required Leak Detection channels (7a, b, c, or d) inoperable:

a) Restore three channels to OPERABLE status within 30 days.

3.17.6.8 With one Primary Safety Valve Position Indicator channel inoperable, for one or more valves:

a) Restore the channels to OPERABLE status prior to the next startup from COLD SHUTDOWN.

3.17.6.9 With one or two PORV Position Indicator channels_ inoperable for one or more valves:

a) Restore the channels to OPERABLE status prior to the next startup from COLD SHUTDOWN.

3.17.6.10 With one PORV Block Valve Position Indicator channel inoperable, for one or more valves:

a) Restore the channel to OPERABLE status prior to the next startup from COLD SHUTDOWN, and, .

b) If the PORV path is required for LTOP or as a PCS vent, and the valve position lights inoperable, verify PORV Block Valve is open each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

3.17.6.11 With the Service Water Break Detector inoperable:

a) Restore the SWS Break Detector to OPERABLE status prior to the next startup.

3.17.6.12.1 With one Flux - AT Power Comparator channel inoperable:

a) Restore the channel to OPERABLE status prior to the next startup.

3.17.6.12.2 With two Flux - AT Power Comparator channels inoperable:

a) Limit power to~ 70% RATED POWER-within--2 hour-s******-* *

3.17.6.13 With one Rod Group Sequence Control/Alarm channel inoperable:

a) Verify that all regulating groups are within the limits of Specification 3.10 within 15 minutes after movement of any regulating rod .

Amendment No. 3, 67, 96, 98, 11§, 118, 121, 124, 129, 136, 3-75

3 .17 INSTRUMENTATION- SYSTEMS.

Action (continued)

3.17.6.14 a) 3.17.6.15 With the Cone Boric Acid Tank Lo Level Alarm inoperable:

Verify the level in the affected Boric Acid Tank is within limits each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

With the Excore Deviation Alarm inoperable:

a) Calculate the QUADRANT POWER TILT using the excore readings at least once each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

3.17.6.16 With one or two AXIAL SHAPE INDEX Alarm channels inoperable:

a) *Restore the system to OPERABLE status prior to the next startup from COLD SHUTDOWN.

3.17.6.17 With one or two SOC suction valve interlock channels inoperable:

a) Place circuit breaker for the associated valve operator in "Racked Out" position. The breaker may be racked in only during operation of associated valve.

3 .17 .6.18 With one Power Dependant Insertion Alarm channel inoperable:

a) Verify that each regulating group is within the limits of Specification 3.10 within 15 minutes after movement of any regulating rod ..

3.17.6.19 With one Fuel Pool Area Radiation Monitor inoperable:

a) Stop moving fuel within the Fuel Pool Area until monitoring capability is restored, and b) Restore monitor to OPERABLE status or provide equivalent monitoring capability within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

3.17.6.20 With one Containment refueling Radiation Monitor inoperable:

a) Stop REFUELING OPERATIONS in the containment:

3.17.6.21 If any action required by 3.17.6.1 through 3.17.6.18 is not met AND the associated completion time has expired, or if the number of OPERABLE channels is less than specified in the "Minimum OPERABLE Channels":

a) The reactor shall be placed in-HOT SHUTDOWN-within* 12-hours~ and b) The reactor shall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Amendment No. 3, 67, 96, 98, 115, 118, 121, 124, 129, 136, 3-76

3 .17. INSTRUMENTATIOW.SYSTEMS**** ... *. ** ** ...

Table 3.I7.6 Instrumentation Operating Requirements for Other Safety Functions Minimum Required OPERABLE Applicable Instrument Channels Channels Conditions

1. Neutron Flux Monitoring 2 0 Bel ow I0-43 RATED POWER, with fuel in the reactor.

2. Rod Posit ion 2 I When more than one CRDM is indication capable of rod withdrawal.

3. SIRW Tank Temperature I Above 300°F lave*

4. Main Feedwater Flow* I/Line 0 Above I5% RATED POWER.

5. Main Feedwater I/Line 0 Above I5% RATED POWER.

Temperature

6. AFW Flow Indication 2/line 0 Above 300° F lave*

4!a)(b)

7. PCS Leakage Detection Above 300 °F Tave.

a. Sump Level I

b. Atmos~ Gas Monitor I

c. Humidity Monitor I

d. Air Cooler "condensate I Flow Switch

8. Primary Safety Valve 2/val ve 1a1 I/valve Above 300°F lave*

Position Indication

9. PORV 3/va l ve 1a1 I/valve Above 2I0°F lave when PORV Position Indication block valve is open or its position* indication system is inoperable.

(a) The provisions of Specifications 3.0.4 and 4.0.4 are not applicable.

(b) The required channels shall be one channel each of 7a, 7b, 7c, and 7d.

(c) The minimum channels shall be any one channel of 7a, 7b, 7c, or 7d.

(continued)

Amendment No. 3, 67, 96, 98, 115, 118, 121, 124, 129, 136,

3-77

3.I7 INSTRUMENTATION *-SYSTEMS - -

Table 3.17.6 (continued)

Instrumentation Ogerating Reguirements for

No IO.

Instrument PORV Block Valve Other Safet~ Functions Required Channels 2/val ve 1a1 Minimum OPERABLE Channels I/Valve Applicable Conditions At all times, unless Position Indication the PCS is depressurized and vented in accordance with Specification 3.I.8.

Il. SWS Break Detector I (a) 0 HOT STANDBY and above.

I2. Flux-AT Power Comparator 4(a) 2 POWER OPERATION I3. Rod Group Sequence 2 I When more than one CRDM is Control/Alarm capable of rod withdrawal.

I4. Cone Boric Acid Tank I/tank 0 HOT STANDBY and above Lo Level Alarm I5. Excore Detector I 0 Above 25% RATED POWER.

Deviation Alarm I6. AXIAL SHAPE INDEX 4la) 2 Above 25% RATED POWER.

Alarm I7. SDC Suction Valve 2 0 Above 200 psia Interlocks PCS Pressure.

I8. Power Dependant 2 I HOT STANDBY and above.

Insertion Alarm I9. Fuel Pool Area 2(b) 0 When fuel is in Radiation Monitor fuel pool area.

20. Containment Refueling 2(a) 0 REFUELING OPERATIONS Radiation Monitor when irradiated fuel is in the Containment.

(a) Specifications 3.0.4 and 4.0.4 are not applicable.

(b) Specifications 3.0.3, 3.0.4, and 4.0.4 are-not- applicable~ --

Amendment No. 3, 67, 96*, 98, 115, 118, 121, 124, 129, 136, 3-78

_J

3.18 Deleted

3.19 IODINE REMOVAL SYSTEM Specification:

3.19 The Iodine Removal System shall be OPERABLE with:

a. The Sodium Hydroxide Tank (T-103) containing a minimum 4,200 +/- 300 gallons of 30.0 +/- 0.5 percent by weight sodium hydroxide solution.

b. T-103 capable of supplying sodium hydroxide solution to the containment spray pump suction headers.

Applicability Specification 3.19 is applicable during POWER OPERATION.

Action With the Iodine Removal System inoperable:

a. Restore the system to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or

b. Be in HOT SHUTDOWN within the next 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Bases The Iodine Removal System acts in conjunction with the containment spray system to reduce the post-accident level of fission products in the containment atmosphere. Sodium Hydroxide is added to the recirculated water after a LOCA to establish a neutral pH.

References FSAR, Section 6.4.

FSAR, Section 14.22 .

*Amendment No. 20, 31, 40, 43, 68, 110, 158, 3-79

j.20 s~~ck Suijrir~ssri~i CS~ubb~~~l~-:

Appl i cabil ity

Applies to the operating status of the safety-related p1p1ng shock suppressors (snubbers}. The only snubbers excluded from this requirement are those installed on non-safety-related systems and then only if their failure or failure of the system on which they are installed would have no adverse effect on any safety-related system.

Objective To minimize the possibility of unrestrained pipe motion as might occur during an earthquake or severe transient.

Specification 3.20.l When systems associated with snubbers in Specification 3.20 are required to be OPERABLE, the snubbers in those systems shall be OPERABLE except as noted below:

a. With one or more snubbers inoperable, within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months replace or restore the inoperable snubbers to OPERABLE status and perform an engineering evaluation per Specification 4.16.1.c. on the supported component or declare the system inoperable.

Snubbers are required to be OPERABLE to ensure that the structural

integrity of the reactor coolant system and all other safety-related systems is maintained during and following a seismic or other event initiating dynamic loads .

3-80

- Amendment No. 23, 69, 107,

3. 21 CRANE-" OPERATION .ANa-*MoVEMENT* OF'. HEAVY LOADS Applicability Applies to limitations in crane operation and the movement of heavy loads

over the 649' level of the auxiliary building and inside containment. A heavy load is a load, other than a fuel assembly, which weighs more than 1300 lbs.

Objective To minimize the probability of and the consequences of a heavy load drop.

Specification 3.21.1 Inside Containment

a. Heavy loads shall not be moved over the primary coolant system if the temperature of the coolant or the steam in the pressurizer exceeds 225°F.

b. Heavy loads shall not be moved unless the potential for a load drop is extremely small as defined by Generic Letter 85-11 or an evaluation in compliance with section 5.1 of NUREG-0612 has been completed.

3.21.2 Over the 649' Level of the Auxiliary Building The surface of the floor adjacent to the spent fuel pool is at the 649' level of the auxiliary building. The spent fuel pool is made up of two (2) zones. They are the main pool zone and the north tilt pit zone.

a. Heavy loads shall not be moved over fuel stored in the main pool zone .

b.

c.

Heavy loads shall not be moved over areas of the main pool zone which do not contain fuel unless the fuel stored in the main pool zone has decayed a minimum of 30 days when the charcoal filter is operating, or the fuel stored in the main pool zone has decayed a minimum of 90 days when the charcoal filter is not operating.

Heavy loads shall not be moved over the north tilt pit zone unless the fuel stored in the north tilt pit zone has decayed a minimum of 22 days when the charcoal filter is operating; or, the fuel in the north tilt pit zone has decayed a minimum of*77 days when*the charcoal filter is not operating.

d. Heavy loads shall not be moved over the 649' level of the auxiliary building unless:

(1) The fuel storage building crane interlocks are OPERABLE or they

.are bypassed and the crane-is-under- admin-istrative .. control of a supervisor, and (2) No fuel handling operations are in progress.

3-81 Amendment No. 3§, 111,

I 3.21 CRANE.OPERATION AND MOVEMENT OF HEAVY LOADS (Continued)

e. Loads weighing more than 25 tons shall not be moved over the main pool zone unless an evaluation in compliance with Section 5.1 of NUREG-0612 has been completed.

f. Heavy loads shall not be moved unless the potential for a load drop is extremely small as defined by Generic Letter 85-11 or an evaluation in compliance with section 5.1 of NUREG-0612 has been completed.

g. The Fuel Pool Building Crane shall not be used to move material past the fuel storage pool when its interlocks are inoperable.

Bases Reference (7) defines a heavy load as a load which weighs more than a fuel assembly and its handling tool. The lightest Palisades fuel assemblies weigh approximately 1298 lbs and the heaviest weigh approximately 1375 lbs.

The handling tool weighs 60-70 lbs. For conservatism, loads weighing more than 1300 lbs, except for fuel assemblies, are classified as heavy loads.

Heavy loads are not allowed over the pressurized primary coolant system to preclude dropping objects which could rupture the boundary of the primary coolant system allowing loss of coolant and overheating of the core.

Prohibiting movement of heavy loads over fuel stored in the main pool zone minimizes the criticality and radiological effects of a load drop.

Heavy loads are allowed over the fuel stored in the north tilt pit zone because the maximum number of fuel bundles which can be stored in that zone is relatively small and the north tilt pit lies under the only possible safe load path for moving heavy loads into and out of containment without passing over the main pool zone.

Requiring that the spent fuel pool crane interlocks are OPERABLE ensures that heavy loads or the unloaded crane will not drift over or be inadvertently moved over fuel stored in the main pool area.

Specific decay times with and without the charcoal filters operating are necessary to ensure that heavy loads are moved within analyzed conditions.

The charcoal filter is operating when at least one Fuel Handling Area exhaust fan is drawing suction through the charcoal filter and the Fuel Handling Area ventilation system is in the refueling mode.

Assuring that no fuel handling operations are in progress while heavy loads are being moved allows operator attention to be focused on the heavy load movement .

3-82 Amendment No. 35, 37, 111,

3.21 CRANE OPERATION AND MOVEMENT OF.HEAVY LOADS (Continued)

Bases (Continued)

The objectives of the Guidelines of Section 5.1 of NUREG-0612 are to assure that (1) the potential for a load drop is extremely small, or (2) for each area addressed, the following evaluation criteria are satisfied:

(1) Releases of radioactive material that may result from damage to spent fuel based on calculations involving accidental dropping of a postulated heavy load produce doses that are well within 10 CFR Part 100 limits of 300 rem thyroid and 25 rem whole body; (2) Damage to fuel and fuel storage racks based on calculations involving accidental dropping of a postulated heavy load does not result in a configuration of the fuel such that kett is larger than 0.95; (3) Damage to the reactor vessel or the spent fuel pool based on calculations of damage following accidental dropping of a postulated heavy load is limited so as not to result in water leakage that could uncover the fuel, (makeup water provided to overcome leakage shall be from a borated source of adequate concentration); and (4) Damage to equipment in redundant or dual safe shutdown paths, based on calculations assuming the accidental dropping of a postulated heavy load, will be limited so as not to result in loss of required safe shutdown functions.

Generic Letter 85-11 defines the potential for a heavy load drop as extremely small when a heavy load is moved in compliance with the Guidelines of section 5.1.1 of NUREG-0612.

References (1) Palisades Plant Evaluation of Postulated Cask Drop Accidents by Bechtel Associates Professional Corporation, August 1974.

(2) Palisades Plant Final Safety Analysis Report - Appendix J- Evaluation of Postulated Cask Drop Accidents, submitted to the NRC on August 9, 1974. (Structural Analysis only)

(3) Letter dated January 16, 1978 from D P Hoffman, CPC to Director NRR, entitled "Palisades Plant-Movement of Shielded Shipping*cask."

(4) Letter dated November 1, 1976 from DA Bixel, CPC, to Director NRR entitled "Spent Fuel Pool Modifications."

(5) SER supporting License Amendment No. 35 dated February 8, 1978.

(6) SER supporting License Amendment.No. 81-dated-May.-22, -1981.

(7) NUREG-0612 - Control of Heavy Loads in Nuclear Power Plants.

(8) Safety Analysis Report (Rev. 1) dated October 16, 1986 attached to letter dated October 16, 1986 from K WBerry, CPC, to NRC.

(9) Generic Letter 85-11 dated June 28, 1985.

3-83 Amendment No. 37, 111,

3. 22 Deleted*

3.23 POWER DISTRIBUTION LIMITS 3.23.1 LINEAR HEAT RATE. !LHRl The LHR in the peak power fuel rod at the peak power elevation Z shall not exceed the value in Table 3.23-1 times FA{Z) [the function FA{Z) is shown in Figure 3.23-1]. .

APPLICABILITY: Power operation above 50% of RATED POWER.

ACTION 1:

When using the incore alarm system to monitor LHR, and with four or more coincident incore alarms, initiate within 15 minutes corrective action to reduce the LHR to within the limits and restore the incore readings to less than the alarm setpoints within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or failing this, be at less than 50%

RATED POWER within the following 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

ACTION 2:

When using the excore monitoring system to monitor LHR and with the AO deviating from the target AO by more than 0.05, discontinue using the excore monitorin~ system for monitoring LHR. If the incore alarm system is inoperable, within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months be at 85% (or less) RATED POWER and follow the procedure in ACTION 3 below.

ACTION 3:

If the incore alarm system is inoperable and the excore monitoring system is not being used to monitor LHR, operation at less than or equal to 85%

RATED POWER may continue. provided that incore readings are recorded manually. Readings shall be taken on a minimum of 10 individual detectors per quadrant {to include-~ total number of 160detectors*in~a*10-hbur period) within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and at least every 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thereafter. If readings indicate a local power level equal to or greater than the alarm setpoints, the action specified in ACTION 1 above shall be taken .

Amendment No. 37, 60, 68, 118, 144, 3-84

POWER DISTRIBUTION"[IMITs**.

3.23.1 LINEAR NEAT RATE (LHR)

LIMITING CONDITION FOR OPERATION

Basis The limitation of LHR ensures that, in the event of11 ~ LOCA, the peak temperature of the cladding will not exceed 2200°F.

Either of the two core power distribution monitoring systems (the incore alarm system or the excore monitoring system) provides adequate monitoring of the core power distribution and is capable of verifying that the LHR does not exceed its limits. The incore alarm system performs this function by continuously monitoring the local power at many points throughout the core and comparing the measurements to predetermined setpoints above which the limit on LHR could be exceeded. The excore monitoring system performs this function by providing comparison of the measured core AO with predetermined AO limits based on incore measurements. An Excore Monitoring Allowable Power Level (APL), which may be less than RATED POWER, is applied when using the excore monitoring system to ensure that the AO limits adequately restrict the LHR to less than the limiting values.'~

If the incore alarm system and the excore monitoring system are both inoperable, power will be reduced to provide margin between the actual peak LHR and the LHR limits and the incore readings will be manually collected at the terminal blocks in the control room utilizing a suitable signal detector. If this is not feasible with the manpower available, the reactor power will be reduced to a point below which it is improbable that the LHR limits could be exceeded .

The time interval of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the minimum of 10 detectors per quadrant are sufficient to maintain adequate surveillance of the core power distribution to detect significant changes until the monitoring systems are returned to service. .

To ensure that the design margin of safety is maintained, the determination of both the incore alarm setpoints a~d1 the APL takes into account the local LHGR measurement uncertainty factors given in Table 3.23-3, an engineering uncertainty factor of 1.03,-and a* thermal* power measurement uncertainty factor of 1.02.

References (1) EMF-91-77 (2) (Deleted)

(3) (Deleted)

(4) XN-NF-80-47 (5) FSAR Section 3.3.2.5 (6) FSAR Section 7.6.2.4

3-85 Amendment No. 68, 82, 118, 144,

Peak Rod TABLE 3.23-1 LINEAR HEAT RATE LIMIT 15.28 kW/ft TABLE 3.23-2 RADIAL PEAKING FACTOR LIMITS, FL Peaking Factor Reload L &M Reload N Reload 0 Assembly FAr 1.57 1.66 1. 76 Peak Rod FTr 1.92 1.92 2.04

LHR/Peaking Factor Parameter TABLE 3.23-3 POWER DISTRIBUTION MEASUREMENT UNCERTAINTY FACTORS Measurement Uncerta i nty'al Measurement 1 1 Un cert ai nty b Measurement Uncerta i nty'cl LHR 0.0623 0.0664 0.0795 FAr 0.0401 0.0490 0.0695 FTr 0.0455 0.0526 0.0722 (ab) Measurement uncertainty for reload cores using--all. fresh--*incore. detectors.

( ) Measurement uncertainty for reload cores using a mixture of fresh and once-burned incore detectors.

(c) Measurement uncertainty when quadrant power tilt, as determired using incore measurements and an incore analysis computer program16 , exceeds 2.8%

but is less than or equal to 5% .

Amendment No. 68, 118, 143, 144, 156, 159, 3-86

3.23 POWER-DISTRIBUTION- LIMITS "

n 0::

I 1.15 ALLOWABLE LHR vs PEAK POWER LOCATION

_J E

J E 1.10 x

(\j 2

4- 1.05 0

[

0 co. 6, 1. 0)

+.! 1.00 u

((j l

ll u

0.95 0::

I (1.0, 0.93)

_J w

_J 0.90 m

<(

3:

o.

_J

_J 0.85

<( 0 b.2 0.4 0.6 0.8 PEAK POWER LOCATION FIGURE 3.23-1

3-87 Amendment No. 68, 118,

POWER. DISTRIBUTlON *11Mns*-** ..

3.23.2 RADIAL PEAKING FACTORS LIMITING CONDITION FOR OPERATION

The radial peaking factors FA, and FT shall be less than or equal to the value in Table 3.23-2 times {he following quantity. The quantity is [1.0 +

0.3 (1 - P)] for P ~ .5 and the quantity is 1.15 for P < .5. P is the core thermal power in fraction of RATED POWER.

APPLICABILITY: Power operation above 25% of RATED POWER.

ACTION:

1. For P < 50% of rated with any radial peaking factor exceeding its limit, be in at least hot shutdown within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

2. For P ~ 50% of rated with any radial peaking factor exceeding its limit, reduce thermal power within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to less than the lowest value of:

[1 - 3.33( Fr - 1) ] x RATED POWER

-r L

Where Fr is the measured value of either F~, or F~ and FL is the corresponding limit from Table 3.23-2.

Basis The limitations on F!, and F! are provided to ensure that assumptions used in the analysis for establishin~ DNB margin, LHR and the thermal margin/low-pressure and variable high-power trip set points remain valid during operation. Data from the incore detectors are used for determining the measured radial peaking factors. The periodic surveillance requirements for determining the measured radial peaking factors provide assurance that they remain within prescribed limits. Determining the measured radial peaking factors after each fuel loading prior to exceeding 50% of RATED POWER provides additional assurance that the core is properly loaded.

To ensure that the design margin of safety is maintained, .. the~determination of radial peaking factors takes into account the appropriate measurement uncertainty factors 111 given in Table 3.23-3 References (1) FSAR Section 3.3.2.5 Amendment No. 68, 118, 137, 143, 144, 156, 3-88

POWER DISTRIBUTION ... LIMITS*,**~.*

3.23.3 QUADRANT POWER TILT - Tq LIMITING CONDITION FOR OPERATION The quadrant power tilt (Tq) shall not exceed 5%.

APPLICABILITY: Power operation above 25% of RATED POWER.

ACTION:

1. With Tq > 5% but~ 10%.

a. Correct Tq within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after exceeding the limit, or

b. Determine within the next 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and at least once every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter, that the radial peaking factors are within the limits of Section 3.23.2, or

c. Reduce power, at the normal shutdown*rate, to less than 85% RATED POWER and determine that the radial peaking factors are within the limits of Section 3.23.2. At reduced power, determine at least once every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months that the radial peaking factors are within the limits of Section 3.23.2.

2. With Tq > 10%:

a. Correct Tq within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after exceeding the limit, or

b. Reduce power to less than 50% RATED POWER within the next 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and determine that the radial peaking factors are within the limits of Section 3.23.2. At reduced power, determine at least once every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months that the radial peaking factors are within the limits of Section 3.23.2.

3. With Tq > 15%, be in at least hot standby within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Limitations on quadrant power tilt are provided to ensure that design safety margins are maintained. Quadrant power tilt is determined from excore detector readings which are calibrated using incore detector measurements. 111 Quadrant* power ti 1t

cali bratforl" *factors are determined using incore measurements and an incore analysis computer program. 121 References (1) FSAR, Section 7.4.2.2 (2) FSAR, Section 7.6.2.4

3-89 Amendment No. 68, 118, 144, 164,

4. 0 SURVEilTANCE" REQUIREMENTS . -.. ****-**

4.0.1 Surveillance requirements shall be applicable during the reactor operating conditions associated with individual Limiting Conditions for Operation unless otherwise stated in an individual surveillance requirement.

4.0.2 Unless otherwise specified, each surveillance requirement shall be performed within the specified time interval with:

a. A maximum allowable extension not to exceed 25% of the surveillance interval, and

b. A total maximum combined interval time for any three consecutive surveillance intervals not to exceed 3.25 times the specified surveillance interval.

4.0.3 Failure to perform a Surveillance Requirement within the allowed surveillance interval, defined by Specification 4.0.2, shall constitute noncompliance with the operability requirements for a Limiting Condition for Operation. The time limits of the action requirements are applicable at the time it_is identified that a Surveillance Requirement has not been performed. The action requirements may be delayed for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to permit the completion of the surveillance when the allowable outage time limits of the action requirements are less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Surveillance Requirements do not have to be performed on inoperable equipment.

4.0.4 Entry into a reactor operating condition or other specified condition shall not be made unless the Surveillance Requirements associated with a Limiting Condition of Operation has been performed within the stated surveillance interval or as otherwise specified. This .

provision shall not-prevent passage through or to plant conditions as required to comply with action requirements.

4.0.5 Surveillance Requirements for inservice inspection and testing of ASME Code Class 1, 2, and 3 components shall be applicable as follows:

a. Inservice inspection of ASME Code Class 1, 2, and 3 components and inservice testing of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with-Section*~x1 of the ASME Boiler and Pressure Vessel Code and applicable Addenda as required by 10 CFR 50, Section 50.55a(g), except where specific written relief has been granted by the Commission pursuant to 10 CFR 50, Section 50.55a{g){6)(i).

Amendment No. 30, 51, 130, 4-1

4.0 SURVEILLANCE' REQUIREMENT" (Conti hued) ..

b. Surveillance intervals specified in Section XI of the ASME Boiler and Pressure Vessel Code and applicable Addenda for the inservice

inspection and testing activities required by the ASME Boiler and Pressure Vessel Code and applicable Addenda shall be applicable as follows in these Technical Specifications:

ASME Boiler and Pressure Vessel Code and applicable Addenda terminology for inservice Required frequencies for performing inservice inspection and testing inspection and testing activities activities Weekly At least once per 7 days Monthly At least once per 31 days Quarterly or every 3 months At least once per 92 days Semiannually or every 6 months At least once per 184 days Every 9 months At least once per 276 days Yearly or annually At least once per 366 days

c. The provisions of Specification 4.0.2 are applicable to the above required frequencies for performing.inservice.inspection and testing activities. *

d. Performance of the above inservice inspection and testin~

activities shall be in addition to other specified Surveillance Requirements.

e. Nothing in the ASME Boiler and Pressure Vessel Code shall be construed to supersede the requirements of any Technical Specification .

4-2 Amendment No. -l-3G,

4.0 BASIS Specifications 4.0.1 through 4.0.5 establish the general requirements applicable to Surveillance Requirements. These requirements are based on the Surveillance requirements stated in the code of Federal Regulations, 10 CFR 50.36(c)(3):

"Surveillance requirements are requirements relating to test, calibration, or inspection to ensure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions of operation will be met."

Specification 4.0.1 establishes the requirement that surveillances must be performed during reactor operating conditions or other conditions for which the requirements of the Limiting Conditions for Operation apply, unless otherwise stated in an individual Surveillance Requirement. The purpose of this specification is to ensure that surveillances are performed to verify the operational status of systems and components and that parameters are within specified limits to ensure safe operation of the facility when the plant is in a reactor operating condition or other specified condition for which the associated Limiting Conditions for Operation are applicable .. Surveillance Requirements do not have to be performed when the facility is in an operational conditi.on for which the requirements of the associated Limiting Condition for Operation do not apply, unless otherwise specified. The Surveilla~ce Requirements associated with a Special Test Exception are only applicable when the Special Test Exception is used as an allowable exception the requirements of a specification.

Specification 4.0.2 establishes the conditions under which the specified time interval for Surveillance Requ.i rements may be extended. Item a. permits an allowable extension of the normal surveillance interval to facilitate surveillance scheduling and consideration of plant operating conditions that may not be suitable for conducting the surveillance; e.g., transient conditions or other ongoing surveillance or maintenance activities. Item b.

limits the use of the provisions of item a. to ensure that it is not used repeatedly to extend the.surveillance interval beyond that specified. The limits of Specification 4.0.2 are based on engineerin~ judgment and the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the Surveillance Requirements. These provisions are sufficient to ensure that the reliability ensured through surveillance activities is not significantly degr'aded beyond that obtained from the specified surveillance interval.

Specification 4.0.3 establishes the failure to perform a Surveillance Requirement within the allowed surveillance interval, defined by the provisions of Specification 4.0.2, as a condition that constitutes a failure to meet the operability requirements for a Limiting Condition for Operation.

Under the provisions of thfs specification, -systems***and components**are *assumed to be operable when Surveillance Requirements have

4-3 Amendment No. 3-G,

4.0 BAS1s** (Contfnued)

been satisfactorily performed within the specified time interval. However, nothing in this provision is to be construed as implying that systems or

components are operable when they are found or known to be inoperable although still meeting the Surveillance Requirements. This specification also clarifies that the action requirements are applicable when Surveillance Requirements have not been completed within the allowed surveillance interval and that the time limits of the action requirements apply from the point in time it is identified that a surveillance has not been performed and not at the time that the allowed surveillance interval was exceeded. Completion of the Surveillance Requirement within the allowable outage time limits of the action requirements restores compliance with the requirements of Specification 4.0.3. However, this does not negate the fact that the failure to have performed the surveillance within the allowed surveillance interval, defined by the provisions of Specification 4.0.2, was a violation of the operability requirements of a Limiting Condition for Operation that is subject to enforcement action. Further, the failure to perform a surveillance within the provisions of Specifications 4.0.2 is a violation of a Technical Specification requirement and is, therefore, a reportable event under the requirements of 10 CFR 50.73(a)(2)(i)(B) because it is a condition prohibited by the plant's Technical Specifications. .

If the allowable outage time limits of the action requirements are less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or a shutdown is required to comply with action requirements, e.g.,

Specification 3.0.3, a 24-hour allowance is provided to permit a delay in implementing action requirements. This provides an adequate time limit to complete Surveillance Requirements that have not been performed. The purpose of this allowance is to permit the completion of a surveillance before a shutdown is required to comply with action requirements or before other remedial measures would be required that may preclude completion of a surveillance. The basis for this allowance includes consideration for plant

conditions, adequate planning, availability of personnel, the time required to perform the surveillance, and the safety significance of the delay in completing the required surveillance. This provision also provides a time limit for the completion of Surveillance Requirements that become applicable as a consequence of plant condition changes imposed by action requirements and for completing Surveillance Requirements that are applicable when an exception to the requirements of Specification 4.0.4 is allowed. If a surveillance is not completed within the 24-hour allowance, the time limits of the action requirements are applicable at that time. When a surveillance is performed within the 24-hour allowance and the Surveillance Requirements**are not met, the time limits of the action requirements are applicable at the time that the surveillance is terminated.

Surveillance Requirements do not have to be performed on inoperable equipment because the action requirements define the remedial measures that apply.

However, following expiration of the surveillance interval, the Surveillance Requirements have to be met to demonstrate that inoperabl~equipment-ha~ been restored to operable status .

4-4 Amendment No. ~'

4.0 BASIS (Continued}'"

Specification 4.0.4 establishes the requirement that all applicable surveillances must be met before entry into a reactor operating condition or other condition of operation specified in the Applicability statement.The purpose of this specification is to ensure that system and component operability requirements or parameter limits are met before entry into an operational condition for which these systems and components ensure safe operation of the facility. This provision applies to changes in reactor operating conditions or other specified conditions associated with plant shutdown as well as startup.

Under the provisions of this specification, the applicable Surveillance Requirements must be performed within the surveillance interval to ensure that the Limiting Conditions for Operation are met during initial plant startup or following a plant outage.

When a shutdown is required to comply with action requirements, the provisions of Specification 4.0.4 do not apply because this would delay placing the facility in a lower operational condition.

Specification 4.0.5 establishes the requirement that inservice inspection of ASME Code Class 1, 2, and 3 components and inservice testing of ASME Code Class 1,. 2, and 3 pumps and valves shall be performed in accordance with a periodically updated version of Section XI of the ASME Boiler and Pressure Vessel Code and Addenda as required by 10 CFR 50.55a. These requirements apply, except when relief has been provided in writing by the Commission.

This specification includes clarification of the frequencies for performing the inservice inspection and testing activities required by Section XI of the ASME Boiler and Pressure Vessel Code and applicable Addenda. This clarification is provided to ensure consistency in surveillance intervals throughout the Technical Specifications and to remove ambiguities relative to the frequencies for*performing the required inservice inspection and testing activities.

Under the terms of this specification, the more restrictive requirements of the Technical Specifications take precedence over the ASME Boiler and Pressure Vessel Code and applicable Addenda. The requirements of Specification 4.0.4 to perform surveillance activities before entry into a reactor operating condition or other specified condition takes precedence over the ASME Boiler and Pressure Vessel Code provision which allows pumps and valves to be tested up to one week after return to normal operation. The* Technical* Specification definition of operable does not allow a grace period before a component, that is not capable of performing its specified function, is declared inoperable and takes precedence over the ASME Boiler and Pressure Vessel Code provision which allows a valve to be incapable of performing its specified function for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months before being declared inoperable .

4-5 Amendment No . .f-3.G, I

J

4.1 OVERPRESSURE. PROTECTION-SYSTEM TESTS Surveillance Requirement

In addition to the requirements of Specification 4.0.5, each PORV shall be demonstrated OPERABLE by:

1. Testing the PORVs in accordance with the inservice inspection requirements for ASME Boiler and Pressure Vessel Code,Section XI, Section IWV, Category B valves.

2. Performance of a CHANNEL CALIBRATION on the PORV actuation channel at least once per 18 months.

3. When the PORV flow path is required to be OPERABLE by Specification 3.1.8.1:

{a) Performing a tomplete cycle of the PORV with the plant above COLD SHUTDOWN at least once per 18 months.

(b) Performing a complete cycle of the block valve prior to heatup from COLD SHUTDOWN, if not cycled within 92 days.

4. When the PORV flow path is required to be OPERABLE by Specification 3.1.8.2:

(a) Performance of a CHANNEL FUNCTIONAL TEST on the PORV actuation channel, but excluding valve operation, at least once per 31 days.

{b) Verifying the associated block valve is open at least once per 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

5. The required PCS vent path shall be verified OPERABLE by:

(a) Verifying the PCS vent path open at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when a vent pathway through a valve which is not locked, sealed, or otherwise secured in position is being used for overpressure protection.

(b) Verifying both PORVs and both PORV block valves open at least once per 7 days when open PORVs are used as an alternative to venting the PCS for overpressure protection.

(c) Verifying the PCS vent path open at least once per 31 days when being used for overpressure protection.

6. Both High Pressure Safety Injection pumps shall be verified inoperable at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , unless-the reactor head is removed, when either PCS cold leg temperature is < 260°F, or when both shutdown cooling suction valves, M0-3015 and M0-3016, are open.

Basis With the reactor vessel head installed when the PCS cold leg temperature is less than 260°F, or if the shutdown cooling system isolation valves M0-3015 and M0-3016 are open, the start of one HPSI pump could cause the Appendix G or the shutdown cooling system pressure limits to be exceeded; therefore, both pumps are rendered

inoperable.

4-6

~

0

z

+l c:

Q)

E

"'C c:

Q)

~

4.2 EQUIPMENT AND SAMPLING TESTS Applicability Applies to plant equipment and conditions related to safety .

Objective To specify the minimum frequency and type of surveillance to be applied to critical plant equipment and conditions.

Specifications Equipment and sampling tests shall be conducted as specified in Tables 4.2.1, 4.2.2 and 4.2.3.

Basis Sampling and Equipment Testing The equipment testing and system sampling frequencies specified in Tables 4.2.1, 4.2~2 and 4.2.3 are considered adequate, based upon experience, to maintain the .status of the equipment and system so as to assure safe operation. Thus, those systems where changes might occur relatively rapidly are sampled frequently and those static systems not subject to changes are sampled less frequently .

4-8 Amendment No. 20, 81,

4.2 EQUIPMENT" ANo** SAMPLING-TESTS-(Coritd) '

The operability of the equipment and systems reguired for the control of hydrogen gas ensures that this equipment will be available to maintain the hydrogen concentration within containment below its

flammable limit during post-LOCA conditions. Either recombiner unit or the purge system is capable of controlling the expected hydrogen generation associated with l) zirconium-water reactions, 2) radiolytic decomposition of water and 3) corrosion of metals within containment. These hydrogen control systems are consistent with the recommendations of Regulatory Guide 1.7, "Control of Combustible Gas Concentrations in Containment Following a LOCA."

The post-incident recirculation systems provide adequate mixing of the containment atmosphere following a LOCA. This mixing action will prevent localized accumulations of hydrogen from exceeding the flammable limit.

Proper hydrogen recombiner operation, after a LOCA, is assured by measuring (and adjusting, if necessary) the amount of electrical power provided to the recombiner unit. The temperature measuring equipment (thermocouple) is provided for convenience in testing and is not considered necessary to assure proper operation.-

4-9 Amendment No. 2-,

TABLE 4.2.1 Minimum Frequencies for Sampling Tests FSAR Section Test Frequency REFERENCE

1. Reactor Coolant Gross Activity Deter- 3 Times/7 days with a None Samples mination maximun of .72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months be-tween samples CT ave greater than 500"F).

Gross Ganma by Fission Continuous when T ave is None Product Monitor greater than 500

F111

Isotopic analysis 1/14 days during power None for dose equivalent operation 1-131 concentration Radiochemical for 1/6 months 121 None E determination Isotopic analysis a) Once/4 hours, whenever for iodine, including dose equivalent I-131 I-131, 133, 135 exceeds 1.0 µCi/gram, and b) One sample between 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months follow-ing a thermal power change exceeding 15%

of rated thermal power within a one hour period.

Chemistry (Cl and 02 ) 3 times/7 days with a maximum of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months between samples CT ave greater than 210"F).

Chemistry CF) Once/30 days and follow-ing modifications or repair to the primary coolant system involving welding.

2. Reactor Coolant Boron Concentration Twice/Week None Boron

3. SIRW Tank Water Boron Concentration Monthly* None Sample

4. Concentrated Boron Concentration Monthly None Boric Acid Tanks

5. SI Tanks Boron Concentration Monthly 6.1.2

4-10 Amendment No. 20, 74, 113,

Table 4.2.1 Minimum Frequencies for Sampling Tests

6. Spent Fuel Pool Test Boron Concentration frequency Monthly171 FSAR Section Reference 9.4 Bulk Water T~erature Continuously when None bundles are stored in tilt pit racks with less than one year decay<5>

7. Secondary Coolant Coolant Gross Radio- 3 times/7 days with None activity a maximum of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months between samples Isotopic Analysis for a) 1 per 31 days, Dose Equivalent 1-131 whenever the Concentration gross activity determination indicates iodine concentrations greater than 10%

of the allowable

limit b) 1 per 6 months, whenever the gross activity determination indicates iodine concentrations below 10% of the allowable limit (1) A daily sample shall be obtained and analyzed if fission product monitor is out of service.

(2) After at least 2 EFPD and at least 20 days since the last shutdown of longer than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

(3, 4, 5) Deleted.

(6) Reference Specification 3:8.5 for maximum bulk water temperature and monitoring requirements.

(7) Reference Bases section of Specification 3.8 and Section 5.4.2f of the Design Features for minimum boron concentration (~1720 ppm) *

4-11 Amendment No. 29, llQ, 123,

4.2 EQUIPMENT'SAMPUNG"AND' TESTS ... **-* .

Table 4.2.2 Minimum Freguencies for Eguigment Tests

I.

Item CONTROL RODS Test Oro~

Ful Times of All Length Rods Freguenc~

Refueling FSAR Reference 7.6.1.3

2. CONTROL.RODS Partial Movement Every 92 Days 7~6.1.3 of all Rods (Minimum of 6 In)

3. Pressurizer Safety Set Point One Each 4.3.7 Valves Refueling

4. Main Steam Safety Set Point Five Each 4.3.4 Valves Refueling

5. Refuelin~ System Functioning_ Prior to . . 9.11.4 Interloc s . Refueling Operations

6. Service Water Functioning Refueling 9.1. 2 System Valve Actuation on SIS and RAS

7. Primary System Evaluate Daily 4.7.1 Leakage

8. Diesel Fuel Supply Fuel Inventory Daily 8.4.1

9. Boric Acid Verify proper Daily Heat Tracing temperature readings.

Amendment No. 12, 81, 133, 152, 155, 157, 4-12

Table 4.2.2 (Continued)

Minimum Frequencies for Equipment Tests

11. Hydrogen Recombiners Each hydrogen recombiner unit shall be demonstrated operable:

a. At least once per 6 months by verifying functional test that the minimum heater during a recombiner unit sheath temperature increases to ~700°F* within 90 minutes. Upon reaching 700°F, increase power setting to maximum power for 2 minutes. Verify that the power meter reads ~60 Kw.

b. At least once per refueling cycle by:

I. Performing a channel calibration of all recombiner instrumentation and control circuits.

2. Verifying through a visual examination that there is no evidence of abnormal conditions within the recombiners (i.e., loose wiring of structural connections, deposits of foreign materials, etc).

3.* Verifying the integrity of all heater electrical circuits by performing a continuity and resistance to ground test immediately following the above required functional test.

The resistance to ground for any heater element shall be

~10,000 ohms .

As measured by installed or portable temperature measuring instruments .

4-13 Amendment No. 81, 99,

Table 4.2.2 (Contd)

Minimum Frequencies for Equipment Tests

12. Iodine Removal System The Iodine Removal System shall be demonstrated operable:

a. At least once per 31 days by verifying that each valve (manual, power operated or automatic) in the flow path that is not locked, sealed or otherwise secured in position, is in its correct position.

b. At least once per 6 months by:

1. Verifying the volume of sodium hydroxide in tank T-103.

2. Verifying the concentration of sodium hydroxide in T-103.

13. Containment Purge and Ventilation Isolation Valves ..

The Containment Purge and Ventilation Isolation Valves shall be determined closed:

a. At least once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months by checking the valve position indicator in the control room

b. At least once every 6 months by performing a leak rate test between the valves .

14. Main Feedwater Isolation

a. Verify that the Main Feedwater Regulating valve and the associated bypass valve close on an actual or simulated Containment High Pressure (CHP) signal once each 18 months.

b. Verify that the Main Feedwater Regulating valve and the associated bypass valve close on an actual or simulated Steam Generator Low Pressure (SGLP) signal once each 18 months.

Amendment No. 81, 90, 158, 4-14

Table 4.2.3 HEPA FILTER AND CHARCOAL ABSORBER SYSTEMS Control Room Ventilation and Isolation System (Rated flow: 765 cfm) Fuel Storage Area HEPA/Charcoal Exhaust System (Rated flow: 10,000 cfm, two fans or 7300 cfm, one fan).

The filters in each of the above systems shall be demonstrated operable:

a. At least once per 31 days by initiating, from the Control Room, flow through the HEPA filter and charcoal adsorbers and verifying that the system operates for at least 15 minutes.

b. At least once per refueling cycle or (1) after any structural maintenance on the HEPA filter or charcoal adsorber housings, or (2) following major painting, fire or chemical release in any ventilation zone communicating with the system when the HEPA Filter or charcoal adsorbers are.in operation by:

1. Verifying within 31 days after removal that a laboratory analysis of a representative carbon sample obtained in accordance with Regulatory Position C.6.b. of Regulatory Guide 1.52, Revision 2, March 1978, meets the laboratory testing criteria of Regulatory Position C.6.a of Regulatory Guide 1.52, Revision 2, March 1978 except that the Fuel Storage Area shall have a methyl iodide limit of 94% instead of 99,, or replacing with charcoal adsorbers meeting the specifications of Regulatory Guide 1.52, Position C.6.a, Revision 2, March 1978.

2. Verifying that the HEPA filter bank removes greater than or equal to 99% of the DOP when they are tested in-place in accordance with ANSI N510-1975 while operating the system at its rated flow

+/- 20%.

3. Verifying that the charcoal adsorber removes greater than *or equal to 99% of a hydrogenated hydrocarbon refrigerant test gas when they are tested in-place in accordance with ANSI N510-1975 while operating the system at its rated flow+/- 20%.

c. At least once per refueling cycle by:

I. Verifying that the pressure drop across the combined HEPA filter and charcoal adsorber bank is less than (6) inches Water Gauge while operating the system.

2. Verifying that on a containment high-pressure and high-radiation test signal, the system automatically switches into a recirculating mode of operation with flow through the HEPA filter and charcoal adsorber bank. (Control-Room vent-ilation only .* )

4-15 Amendment No. 8-l-,

Table 4.2.3 HEPA FILTER AND CHARCOAL ABSORBER SYSTEMS

3.

4.

Verifying that the system maintains the Control Room at a positive-pressure of greater than or equal to 0.10 inch WG relative to the viewing gallery (dPIC 1834) during system operation. (Control Room ventilation only.)

Verifying that with the ventilation system exhausting through the HEPA/Charcoal Filters at its rated flow+/- 203, the bypass flow through damper 1893 is less than 13 of total flow. (Fuel Storage Area only.)

d. After every 720 hours0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months (see Note 1) of charcoal adsorber operation by:

Verifying within 31 days*after removal that a laboratory analysis of a representative carbon sample obtained in accordance with Regulatory Position C.6.b. of Regulatory Guide 1.52, Revision 2, March 1978, meets the laboratory testing criteria of Regulatory Position C.6.a of Regulatory Guide 1.52, Revision 2, March 1978 except that the Fuel Storage Arei shall have a methyl iodide limit of.94% instead of 99%,

or replacing with charcoal adsorbers meeting the specifications of Regulatory Guide 1.52, position C.6., Revision 2, March 1978.

e. After each complete or partial replacement of a HEPA filter bank by:

Verifying that the HEPA filter bank removes greater than or equal to 99% of the DOP when they are tested in-place in accordance with ANSI N510-1975 while operating the system at its rated flow+/- 20%.

f. After each complete or partial replacement of a charcoal adsorber bank by:

Verifying that the charcoal adsorber removes greater than or equal to 99% of a hydrogenated hydrocarbon refrigerant test gas when they are tested in-place in accordance with ANSI N510-1975 while operating the system at its rated flow +/-20% . .

g. Verify that the Control Room temperature is <120°F once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when the temperature in the Control Room reaches 105°F.

Note 1. Should the 720-hour limitation occur during a plant operation requiring the use of the HEPA Filter and charcoal adsorber - such as during a refueling - testing may be delayed until the completion of the plant operation or up to 1,500 hours0.00579 days 0.139 hours 8.267196e-4 weeks 1.9025e-4 months of filter operation whichever occurs first .

4-16 Amendment No. 8+/-,

4*. 6- -SAFETY" INJECTlON'-*AND-CONTAINMENT' SPRAY SYSTEMS TESTS Surveillance Requirements

4.6.l a.

Safety Injection System System tests shall be performed at each reactor refueling interval.

A test safety injection signal will be applied to initiate operation of the system. The safety injection and shutdown cooling system pump motors may be de-energized for this test. The system will be considered satisfactory if control board indication and visual observations indicate that all components have received the safety injection signal in the proper sequence and timing (ie, the appropriate pump breakers shall have opened and closed, and all valves shall have completed their travel).

4.6.2 Containment Spray System

a. System test shall be performed at each reactor refueling interval.

The test sha 11 be performed with the i sol at ion valves in the spray supply lines at the containment blocked closed. Operation of the system is initiated by tripping the normal actuation instrumentation.

b. At least every five years the spray nozzles shall be verified to be open.

c. The test will be considered satisfactory if visual observations indicate all components have operated satisfactorily.

4.6.3 Pumps

a.

b.

The safety injection pumps, shutdown cooling pumps, and containment spray pumps shall be started at intervals not to exceed three months. Alternate manual starting between control room console and the local breaker shall be practiced in the test program.

Acceptable levels of performance shall be that the pumps start, reach their rated heads on recirculation flow, and operate for at least fifteen minutes.

4.6.4 Valves

a. Each Safety Injection Tank flow path shall be verified OPERABLE within 7 days prior to each reactor startup by verifying each motor operated isolation valve is open by observing valve position indication and valve itself, and locking open the associated circuit breakers.

b. The Low Pressure Safety Injection flow path shall be verified OPERABLE within 7 days prior to each reactor startup by verifying flow control valve CV-3006 is open, and its air supply is isolated .

Amendment No. 51, 73, 96, 117, 131, 4-39

4.6 SAFETY. INJECTION. ANDCONTAINMENT *sPRAY SYSTEMS TESTS Surveillance Reguirements (continued)

Valves c.

(continued)

The safety injection recirculation path shall be verified OPERABLE within 7 days prior to each reactor startup by verifying valves CV-3027 and 3056 are open and their switches HS-3027A, HS-3027B, HS-3056A, and HS-3056B are open.

d. Each Containment Spray Valve manual control shall be verified to be OPERABLE at least once each refueling by cycling each valve from the control room while observing valve operation at least each 18 months.

4.6.5 Containment Air Cooling System

a. Emergency mode automatic valve and fan operation will be checked for OPERABILITY during each refueling shutdown.

b. Each fan and valve required to function during accident conditions will be exercised at intervals not to exceed three months .

4-40 Amendment No. 59, 73, 77, 117,

4. 6 SAFETY .INJECTION .AND CONTAINMENT *sPRAY SYSTEMS. TESTS.

Basis

The safety injection system and the containment spray system are principal *plant safety features that are normally inoperative during reactor operation.

Complete systems tests cannot be performed when the reactor is operating because a safety injection signal causes containment isolation and a containment spray system test requires the system to be temporarily disabled. The method of assuring OPERABILITY of these systems is therefore, to combine systems tests to be performed during annual plant shutdowns, with more frequent component tests, which can be performed during reactor operation.

The annual systems tests demonstrate proper automatic operation of the safety injection and containment spray systems. A test signal is applied to initiate automatic action and verification made that the components receive the Safety Injection Signal in the proper sequence. The test demonstrates the oper,~tion of the valves, pump circuit breakers, and automatic circuitry. 1*

During reactor operation, the instrumentation which is depended on to initiate safety injection and containment spray is generally checked daily and the initiating circuits are tested monthly. In addition, the active components (pumps and valves) are to be tested every three months to check the operation of the starting circuits and to verify that the pumps are in satisfactory running order. The test interval of three months is based on the judgment that more frequent testing would not significantly increase the reliability (ie, the probability that the component would operate when required), yet more frequent test would result in increased wear over a long period of time. Verification that the spray piping and nozzles are open will be made initially by a smoke test or other suitably sensitive method, and at least every five years thereafter. Since the material is all stainless steel, normally in a dry condition, and with no plugging mechanism available, the retest every five years is considered to be more than adequate.

Other systems that are also important to the emergency cooling function are the SI tanks, the component cooling system, the service water system and the containment air coolers. The SI" tanks* are**a* passive* safety feature. In accordance with the specifications, the water volume and pressure in the SI tanks are checked periodically. The other systems mentioned operate when the reactor is in operation and by these means are continuously monitored for satisfactory performance.

References FSAR," Section 6.1.3.

FSAR, Section 6.2.3 .

4-41 Amendment No.117, 131,

4. 9 AUXILIARY- FEEDWATER SYSTEM -TESTS ..--

Surveillance Requirements Auxiliary Feedwater Pumps

a. At 1east once per *_31 days:

1. The OPERABILITY of each motor-driven pump shall be verified by starting from the control .room hand* switch, from the breaker and from the pump test-key switch in a three month period.

2. The OPERABILITY of the steam-driven pump shall be verified by starting alternately from eac~ control room switch and from the pump test-key switch in a three month period.

3. Verify that each non-automatic valve in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.

b. At least once per 18 months:

1. Verify that each Automatic Valve (CV-0736A, CV-0737A, CV-0727 and CV-0749) actuates to its correct position (or that specified f1ow is established) upon receipt of a simulated auxiliary feedwater pump start signal.

2. Verify that each pump starts automatically upon receipt of an auxiliary feedwater actuation test signal .

BASIS The periodic testing of Section 4.9.a will verify auxiliary feedwater pump control circuits.

The OPERABILITY testing of Section 4.9.b will verify auto initiation of the auxiliary feedwater system by simulating a low steam generator level and observation of pump start. To automatically start the "C" pump requires placing the "A" pump in manual. To automatically start the "B" pump requires placing the "A &C" pumps in*manual~ These tests may be performed.during plant operations. OPERABILITY of the flow control valves (CV-0736A, CV-0737A, CV-0727 and CV-0749) will be verified through simulation of an auxiliary feedwater pump start signal and observing auxiliary feedwater system flow as monitored by installed instrumentation.

REFERENCE FSAR, Section 9.7

4-45 Amendment No. 53' 96'

4 .17 INSTRUMENTATION SYSTEMS TESTS Surveillance Reguirement

Surveillance testing of instrument channels, logic channels, and control channels listed in Tables 3.17.1 through 3.17.6 shall be performed as specified in Tables 4.17.1 through 4.17.6, respectively

(

4-75 Amendment No. 37, 60, 69, 152,

4 .17 INSTRUMENTATION -SYSTEMS -TESTS Table 4.17.1 Instrumentation Surveillance Requirements for Reactor Protective System CHANNEL CHANNEL FUNCTIONAL CHANNEL Functional Unit CHECK TEST CALIBRATION

1. Manual Trip NA (a) NA

2. Variable High Power 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days (b, c, & d)

3. High Start Up Rate 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (a) 18 months 181

4. Thermal Margin/ 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months Low Pressure

5. High Pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months Pressure

6. Low PCS Flow 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months

7. Loss of Load NA (a) 18 months

8. Low "A" SG Level 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months

9. Low "B" SG Level 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months

10. Low "A" SG Pressure 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months

11.

12.

13.

Low "B" SG Pressure High Containment Pressure RPS Matrix Logic 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months NA NA 31 days 31 days 31 days 18 months 18 months NA

14. RPS Initiation Logic NA 31 days NA

15. Thermal Margin Monitor; Verify constants each 92 days.

(a) Once within 7 days prior to each reactor startup.

(b) Calibrate with Heat Balance each 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , when >15% RATED POWER.

(c) Calibrate Excores channels with test signal each 31 days.

(d) CHANNEL CALIBRATION each 18 months.

(e) Include verification of automatic Zero Power Mode Bypass removal.

Amendment No. 118, 130, 136, 150, 4-76

4 .1 T. INSTRUMENTATION"° SYSTEMS ..TESTS..... - .

Table 4.17.2 Instrumentation Surveillance Requirements for Engineered Safety Features CHANNEL CHANNEL FUNCTIONAL CHANNEL Functional Unit CHECK TEST CALIBRATION

1. Safety Injectjon Signal (SIS)

a. Manual Initiation NA 18 months NA

b. SIS Logic NA (a) NA Initiation, Actuation, and f ow pressure block auto reset)

c. CHP Signal SIS initiation NA 18 months NA (SP Relay Output)

d. Pressurizer Pressure 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months Instrument Channels

2. Recirculation Actuation Signal (RAS)

a. Manual Initiation NA 18 months NA

b. RAS Logic NA 18 months NA

c.

3.

a.

SIRWT Level Switches NA Auxiliary Feedwater Actuation Signal (AFAS)

Manual Initiation NA 18 months 18 months 18 months NA

b. AFAS Logic NA 92 days NA

c. "A" SG Level 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18*months

d. 11 8 SG Level 11 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months

4. Emergency Power Sequencers

a. DBA Sequencer NA 92 days--* 18-months

b. Normal Shutdown Sequencer NA 18 Months . 18 months (a) Test normal and emergency power functions using test circuits each 92 days. Verify all automatic actuations and automatic resetting of low pressure block each 18 months.

Amendment No.

4-77

4.17 INSTRUMENTATION.SYSTEMS TESTS -...

Table 4.17.3 Instrumentation Surveillance Requirements for Isolation Functions CHANNEL CHANNEL FUNCTIONAL CHANNEL Functional Unit CHECK TEST CALIBRATION

1. Containment High Pressure (CHP)

a. CHP logic Trains NA 18 months NA

b. Containment Pressure NA 31 days 18 months Switches - Left Train

c. Containment Pressure NA 31 days 18 months Switches - Right Train

2. Containment High Radiation (CHR)

a. Manual Initiation NA 18 months NA

b. CHR Logic Trains NA 18 months NA

c. Containment Area 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months Radiation Monitors

3. Steam Generator Low Pressure (SGLP)

a. Manual Actuation NA 18 months NA

b. SGLP Logic Trains NA 18 months NA

c. "A" Steam Generator 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months Pressure

d. "B" Steam Generator 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months Pressure

4. Engineered Safeguards Pump Room High Radiation- -

a. East Room Monitor 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months

b. West Room Monitor 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months

4-78 Amendment No.

4~ 17 INSTRUMENTATION ... SYSTEMS-TESTS. ,,_ ...

Table 4.17.4 Instrumentation Surveillance Requirements for Accident Monitoring CHANNEL CHANNEL Instrument CHECK CALIBRATION

1. Wide Range TH 31 days 18 months

2. Wide Range Tc 31 days 18 months

3. Wide Range Flux 31 days 18 months

4. Containment Floor Water Level 31 days 18 months

5. Subcooled Margin Monitor 31 days 18 months

6. Wide Range Pressurizer Level 31 days 18 months

7. Containment H2 Concentration 31 days 18 months

8. Condensate Storage Tank Level 31 days 18 months

9. Wide Range Pressurizer Pressure 31 days 18 months

10. Wide Range Containment Pressure 31 days 18 months

11. Wide Range "A" SG Level 31 days 18 months

12. Wide Range "B" SG Level 31 days 18 months

13. Narrow Range "A" SG Pressure 31 days 18 months

14. Narrow Range "B" SG Pressure 31 days 18 months

15. Position Indication for each 31 .days 18 months Containment Isolation Valve

16. Core Exit Thermocouples (CET} 31 days 18 months 1a1 Quadrant 1

17. Core Exit Thermocouples (CET} 31 days 18 months 181 Quadrant 2

18. Core Exit Thermocouples (CET} 31 days 18 months 1a1 Quadrant 3

19. Core Exit Thermocouples (CET} 31 days 18 months 1a1 Quadrant 4

20. Reactor Vessel Water Level (RVWL} 31 days 18 months

21. High Range Containment Radi~tion 31 days 18 months (a) Calibrate by substituting a known voltage for thermocouple .

4-79 Amendment No.

4.17- INSTRUMENTATION-SYSTEMS .. TESTS-,--- -- .

Table 4.17.5

Instrumentation Surveillance Reguirements for Instrument or Control Alternate Shutdown System CHANNEL CHECK CHANNEL FUNCTIONAL TEST CHANNEL CALIBRATION I. Start-up Range Flux (a) (a) 18 months

2. Pressurizer Pressure 92 days NA 18 months

3. Pressurizer Level 92 days NA 18 months

4. #1 Hot Leg Temperature 92 days NA 18 months

5. #2 Hot Leg Temperature 92 days NA 18 months

6. #1 Cold Leg Temperature 92 days NA 18 months

7. #2 Cold Leg Temperature 92 days NA 18 months

8. "A" SG Pressure 92 days NA 18 months

9. "8" SG Pressure 92 days NA 18 months

10. "A" SG Level 92 days NA 18 months

11. "B" SG Level 92 days NA 18 months

12. SIRW Tank Level 13.

14.

P-88 Flow to "A" SG P-88 Flow to "B" SG 92 days 18 months 18 months NA 18 months 18 months 18 months 18 months 18 months

15. P-88 Low Suction Alarm NA 18 months 18 months

16. P-88 Steam Valve Control* NA 18 months NA

17. AFW Flow Control "A" SG NA 18 months NA

18. AFW Flow Control "8" SG NA 18 months NA

19. Transfer Switches, C-150 NA 18 months NA

20. Transfer Switch, C-150A NA 18 months-****** NA*

{a) Once within 7 days prior to each reactor startup.

4-80 Amendment No. 122, 136,

4.17 INSTRUMENTATION*-*svsTEMS~"TESTS"' ....

Table 4.17.6 Instrumentation Surveillance Requirements for Other Safety Functions CHANNEL CHANNEL FUNCTIONAL CHANNEL Instrument CHECK TEST CALIBRATION

1. Neutron Flux Monitoring 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (a) lS months

2. Rod Position Indication 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (b) lS months

3. SIRW Tank Temperature 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months NA lS months

4. Main Feedwater Flow 12 h~urs Not Required lS months

5. Main Feedwater Temp. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Not Required lS months

6. AFW Flow Indication 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months lS months lS months

7. PCS Leakage Detection:

a. Sump Level 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months lS months lS months

b. Atmos. Gas Monitor 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months lS months lS months

c. Humidity Monitor 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months lS months lS months

d. Air Cooler Condensate NA lS months Not Required Flow Switch Sa. Primary Safety Valve NA lS months lS months acoustical monitor Sb/ Safety Valve / PORV 1c1 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months lS months lS months 9a. tailpipe temperature 9b. PORV Acoustical Monitor NA lS months lS months 9c. PORV Stem Position 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months lS months lS*months

10. PORV Block Valve 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months NA lS months Position Indication (a) Once within 7 days prior to each reactor startup.

(b) Verification of Regulating Rod Withdrawal and Shutdown Rod Insertion interlocks OPERABILITY only, once within 92 days prior. to each reactor startup AND once prior to startup after each refueling.

(c) The tailpipe temperature indicator is common to the safety valves and PORVs (continued)

4-Sl Amendment No.

4.17 INSTRUMENTATION-SYSTEMS-TESTs***

Table 4.17.6 (continued)

Instrumentation Surveillance Reguirements for Other Safet~ Functions CHANNEL CHANNEL FUNCTIONAL CHANNEL Instrument CHECK TEST CALIBRATION

11. SWS Break Detector NA 18 months 18 months

12. Flux - AT Comparator 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months

13. Rod Group Sequence NA 18 months 18 months Control/Alarm

14. BAT Low Level Alarm NA 18 months Not Required

15. Excore Deviation Alarm NA 18 months 18 months

16. ASI Alarm NA 18 months 18 months

17. SDC Suction Interlocks NA 18 months 18 months

18. PDIL Alarm NA 31 days!cl 18 months

19. Fuel Pool Rad Monitor 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 31 days 18 months

20. Containment Refueling 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 31 days 18 months Radiation Monitor

(c) Setpoint verification only.

4-82 Amendment No.

4 .18 POWER DISTRIBUTION~INSTRUMENTATION--TESTS .

Surveillance Requirements 4 .18 .1 Incore Detectors 4.18.1.1 The incore detection system shall be demonstrated operable:

a. By performance of a Channel Check prior to its use following a core alteration and at least once per 7 days during power operation when required for the functions listed in Section 3.11.1.

b. At least once per refueling by performance of a Channel Calibration which exempts the neutron detectors but includes electronic components.

4.18.1.2 The incore alarm system is demonstrated operable through use of the datalogger Sequence Error alarm. The Sequence Error alarm is demonstrated operable once per refueling by performance of a Channel Check.

4.18.2 Excore Monitoring System 4.18.2.1 At least every 31 days of power operation:

a. A target AO and excore monitoring allowable power level shall be determined using excore and incore detector readings at steady state near equilibrium conditions.

b. Individual excore channel measured AO shall be compared to the total core AO measured by the incores. If the difference is greater than 0.02, the excore monitoring system shall be recalibrated .

c. The excore measured Quadrant Power Tilt shall be compared to the incore measured Quadrant Power Tilt. If the difference is greater than 2%, the excore monitoring system shall be recalibrated .

4-83 Amendment No. 37, 68, 118,

4.19 POWER. DISTRIBUTION LIMIT.TESTS*******.

Surveillance Requirements 4.19.1 Linear Heat Rates

4.19.1:1 When using the incore alarm system to monitor LHR, prior to operation above 50% RATED POWER and every 7 days of power operation thereafter, incore alarms shall be set based on a measured power distribution.

4.19.1.2 When using the excore monitoring system to monitor LHR:

a. Prior to use, verify that the measured AO has not deviated from the target AO by more than 0.05 in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for each operable channel using the previous 24 hourly recorded values.

b. Once per day, verify that the measured Quadrant Power Tilt is less than or equal to 3%.

c. Once per hour, verify that the power is less than or equal to the APL and not more than 10% RATED POWER greater than the power level used in determining the AFL.

d. Continuously verify that the measured AO is within 0.05 of the established target AO for at least 3 of the 4, 2 of the 3, or 2 of the 2 operable channels, whichever is the applicable case.

4.19.2 Radial Peaking Factors 4.19.2.1 The measured radial peaking factors (FA and FT ) obtained by using the incore detection system, shall be Betermined to be less than or

a.

b*

equal to the values stated in the LCO at the following intervals:

After each fuel loading prior to operation above 50% RATED POWER, and At least once per week of po~er operation.

4-84 Amendment No. 68, 118, 137,

4.2a MODERATOR"TEMPERATUR~COEFFICIENT.TESTS Surveillance Requirements

4.20.1 Moderator Temperature Coefficient (MTC)

The MTC shall be determined to be within its limits by confirmatory measurements prior to initial operation above 2% of rated thermal power, after each refueling .

4-85 Amendment No. 85, 118, 122,

ATTACHMENT 2 Consumers Power Company Pa 1i sades Pl ant Docket 50-255

INSTRUMENTATION AND CONTROL TECHNICAL SPECIFICATION CHANGE REQUEST Revised Bases Pages February 22, 1994 41 Pages-

3.16 ESF SYSTEM INSTRUMENTATION SETTINGS Basis: ESF System Instrumentation Settings 3.16 Specification 3.16 assures that the ESF instruments will be adjusted to the proper setpoints during plant operation. The specified setpoints support assumptions used in the safety analyses. The instruments are required to be in proper adjustment whenever they are assumed to be OPERABLE. If an instrument channel is required to be OPERABLE by specification 3.17, and its setpoint does not agree with the specified allowable value the channel must be declared to be inoperable. The completion time of "immediately" does not mean "instantaneously", rather it implies "start as quickly as plant conditions permit and continue until completed."

Basisi Table 3.16

1. Pressurizer Low Pressure - The pressurizer low pressure signals are combined in two trains of 2 out of 4 logic to initiate a Safety Injection Signal (SIS) in each train. SIS is also actuated by a CHP signal or manual action in the same train. SIS starts High Pressure and Low Pressure Safety Injection Pumps and actuates-the required valves to-initiate safety injection flow to the PCS. It also shifts the containment air coolers to the accident mode of operation.

The setpoint was chosen so as to be low enough to avoid actuation during plant operating transients, but to be high enough to be quickly actuated by a Loss of Coolant Accident (LOCA) or Main Steam Line Break (MSLB). The settings include an uncertainty allowance of -22 p,sia and are the settings assumed in the Loss of Coolant Accident analysis. 11

2. Containment High Pressure - The containment high pressure signals are combined in two trains of 2 out of 4 logic to initiate a Containment High Pressure (CHP) signal in each train. CHP actuates SIS, initiates Containment Spray, closes containment isolation valves, switches control room ventilation to the emergency mode of operation, and isolates the main feed and main steam lines from the steam generators.

The setpoint was chosen so as to be high enough to avoid actuation by containment temperature or atmospheric pressure changes, but low enough to be quickly actuated by a LOCA or a MSLB in the containment.

3. Containment High Radiation - Four area monitors in the containment are connected in two trains of lout-of 4 logic-to-initi*at~-an-Containment High Radiation (CHR) signal in each train. CHR is also initiated by a manual action in each train. CHR closes containment isolation valves, disables auto start of the Engineered Safeguards Room sump pumps, and switches control room ventilation to the emergency mode.

The setpoint is based on the maximum primary coolant leakage to the containment atmosphere allowed by Specification 3.1.5 and the maximum activity allowed by Specification 3.1.4. N16 concentration reaches equilibrium in containment atmosphere due to its short half~life, but other activity was assumed to build up. At the end of a 24-hour leakage period

the dose rate is approximately 20 R/h as seen by the area monitors. A B 3.16-1 Revision: 02/21/94

3.16 ESF SYSTEM INSTRUMENTATION SETTINGS Basis: Table 3.16 (continued) large leak could cause the area dose rate to quickly exceed the 20 R/h

setting and initiate CHR.

4. Steam Generator Low Pressure - A separate Steam Generator Low Pressure (SGLP) signal is provided from each generator. The individual channel signals from each generator are combined in 2 out of 4 logic to initiate a SGLP signal for that generator. Each SGLP signal actuates closure of both Main Steam Isolation Valves (MSIVs) and closure of the feed water regulating valve and its bypass for the associated generator.

The setpoint was chosen to be low enough to avoid actuation during plant operation, but be close enough to full power operating pressure to be actuated quickly in the event of a MSLB. The setting of includes a -22 psi uncertain'tJ' allowance and was the setting used in the FSAR Section 14 analysis. 1

5. Steam Generator Low Level - The Auxiliary Feedwater Actuation Signal (AFAS) is initiated by 2 out of 4 low level signals occurring for either steam generator. The setpoint is the same as that for Reactor Trip. The setpoint was chosen to assure that Auxiliary Feedwater Flow would be initiated while the steam generator could still act as a heat sink and steam source, and to assure that a reactor trip would not occur on low level without the actuation of Auxiliary Feedwater .

6. SIRW Tank Low Level - Four SIRWT level sensors are arranged to provide two independent Recirculation Actuation Signals. Each low level sensors is powered from a separate Preferred AC bus; thus two are ultimately powered from each station battery. Each Recirculation Actuation Signal (RAS) circuit is wired with the contacts from the pair of level sensors powered from the same battery in parallel. These two parallel circuits are wired in series, producing a "l out of 2 taken twice" logic. RAS for each train is actuated by either switch from the left battery sensing low level concurrently with either switch from the right battery. This circuit is illustrated in reference 3.

The RAS signal is actuated by separate sensors from those which provide tank level indication. The allowable range of 21" to 27" above the tank floor corresponds to 1.1% to 3.3% indicated level. Typically the actual setting is near the midpoint of the allowable range.

Each RAS actuates the valves in the injection and spray pump suction lines for the associated train switching the water .supply .from.the SIRW tank to the containment sump for a recirculation mode of operation. The time required to reach the RAS setpoint depends on the initiating event.

Following a DBA, RAS would occur after a period of approximately 20 minutes. The setpoint was chosen to provide adequate water in the containment sump for HPSI pump net positive suction head following an accident, but prevent the pumps from running dry during the 60 second switchover .

B 3.16-2 Revision: 02/21/94

3.16 ESF SYSTEM INSTRUMENTATION SETTINGS Basis: Table 3.16 (continued)

7. Engineered Safeguards Pump Room Ventilation High Radiation - A single

radiation monitor is installed in each rooms outlet duct to provide an isolation signal upon high radioactivity levels.

The setting is based on dose levels at the site boundary. The design exhaust ventilation rate of 2400 cfm was assumed along with a 1 gpm leak rate into the room. The leaking fluid was assumed to be primary coolant (81,800 gallons) at the maximum allowable activity (Specification 3.1.4),

diluted with SIRW tank water (285,000 gallons) and Safety Injection Tank water (7,480 gallons). An average beta energy was calculated for each nuclide to convert individual isotopic activities to count rates measured by the monitor. Fuel meltin~ was not assumed to occur. The resultant count rate is about 2.2 x 10 cpm. Normal background for this monitor is expected to be < 1000 cpm.

References (1) FSAR, Section 14.17.

(2) FSAR, Section 14.14.

(3) P&ID RAS Logic Diagram E-17, Sh 5

8 3.16-3 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Instrumentation Systems 3.17 The Instrumentation OPERABILITY.requirements are listed in six sections, 3.17.1 through 3.17.6. The associated surveillance requirements are listed in sections 4.17.1 through 4.17.6, respectively. Each section of 3.17 contains a specification, which contains the OPERABILITY requirement; an Applicability statement, which determines the plant conditions when the specification is required to be met; and a list of Action statements, which provide compensatory required actions to be completed when specified parts of the specification are not met, as required by Specification 3.0.1. If the specification is not met and Action statements are not provided for the existing conditions, Specification 3.0.3 applies.

Completion of required Action: The listed Action is required to be completed within the specified time if the conditions of the specification are not met. If, prior to expiration of the specified completion time, the required conditions are restored, completion of the Action is not required, as stated in Specification 3.0.2. Each specified completion time starts at the time it is discovered that the Action statement is applicable.

The completion time of "immediately" does not mean "instantaneously",

rather it implies "start as quickly as plant conditions permit and continue until completed."

Required Channels: Specification 3.17 requires all instrument and control channels listed under "Required Channels" to be OPERABLE. If fewer channels are OPERABLE than specified under "Required Channels", the associated Action must be completed. Safety is not compromised, however, by continuing operation with certain instrumentation channels out of service since provisions were made for this in the plant design. This specification outlines Limiting Conditions for Operation to assure the effectiveness of the safety related instrumentation, and Action to be taken when any of the required channels are inoperable.

Minimum OPERABLE Channels: Several tables in section 3.17 contain a "Minimum OPERABLE Channels" column, this column specifies the minimum number of channels which must be OPERABLE for continued plant operation.

If the number of OPERABLE channels falls below the "Minimum OPERABLE Channels", the plant must be shutdown in accordance with the final Action statement of each section.

Operational Bypasses: During certain operating conditions, some of the required functions may be bypassed to prevent spurious actuation or undesired actuation due to normal plant activities.~uch-as-heatup and.

cooldown. This does not imply that they do not need to be OPERABLE! These bypasses are automatically actuated or enabled, and are automatically removed when plant conditions reach the conditions where the protection is designed to apply. Bypasses of this nature are referred to as "Operational Bypasses." The trips or automatic actuations which are bypassed may be relied upon to function if an accident should occur, even though they are bypassed. The way that protection may be provided, yet spurious or undesired functioning avoided is by having the bypass automatically removed prior to the trip or actuation being required .

B 3.17-1 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Instrumentation Systems 3.17 (continued)

One example of an operational bypass is the Zero Power Mode Bypass: Manual

1 actuation of this bypass is enabled when the wide range nuclear instrument channels indicate below 10*4% power. If an inadvertent rod withdrawal should cause a power excursion, the bypass would be removed when indicated power went above 10*4%, and the bypassed trips would be available to terminate the event. The conditions under which these operational bypasses are permitted are listed for each affected function.

Several instrument channels provide more than one required function. Table B 3.17-1 provides a listing of these channels and the specifications which they affect.

B 3.17-2 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Table B 3.17-1 Instruments Affecting Multiple Specifications

Required Instrument channels Startup Range NI-01 & 02 Count Rate Signal Startup Range NI-01 Count Rate Indication @ C-150 Affected Specifications 3.17.6 #1 3.17.5 #1 Wide Range NI-03 & 04 Flux level 104 interlock 3. 17. 1 #3' 4' 6' 10' & 11 Wide Range NI-03 & 04 Start-up Rate 3.17.1 #3 Wide Range NI-03 & 04 Flux Level Indication 3 .17 .4 #3 Power Range NI-05 - 08, Power level signal 3.17.6 #14, 17, & 20 Power Range NI-05 - 08, Power level signal 3.23.1 #A.2 Power Range NI-05 - 08, Q-power 3.17.1 #2 & 4 Power Range NI-05 - 08, ASI 3.17.1 #2 & 4 Power Range NI-05 - 08, ASI 3.17.6 #18 Power Range NI-05 - 08, ASI 3 .1.1 #g Power Range NI-05 & 06; 15% interlock 3 .17 .1 #3 & 7 Power Range NI-05 & 06; 15% interlock 3.17.6 #18 PCS Tc, Temperature signal 3.17.1 #4 PCS Tc, Temperature indication 3.17.5 #6 &7

PCS PCS Tc, Tc, Q-power Q-power PCS TH, Temperature indication PCS TH, Q-power 3.17.1 #2 & 4 3.17.6 # 14 3.17.5 #5 & 6 3 .17 .1 #2 & 4 PCS TH, Q-power 3.17.6 # 14 Pressurizer Pressure PI-0101 - 0104, Pressure signal 3 .17 .1 #4 & 5 Pressurizer Pressure PI-0101 - 0104, Pressure signal 3.17.2 #1.d Pressurizer Pressure PI-0101, Pressure indication 3.17.5 #2 Steam Generator Level LI-, Level Signal 3.17.1 #8 & 9 Steam Generator Level LI-, Level Signal -- *-* *** 3 ;' 17 . 2 #3 ; c & d Steam Generator Level LI-, Level indication 3.17.5 # 10 & 11 Steam Generator Pressure LI-, Pressure Signal 3.17.1 #10 & 11 Steam Generator Pressure LI-' Pressure Signal 3 . 17. 3 #3 . c & d Steam Generator Pressure LI-' Pressure Indication 3.17.4 #13 & 14 Steam Generator Pressure LI-, Pressure Indication 3 .17 .5 #8 & 9 Containment Pressure PS-1801, 2, 3, & 4, switch output 3.17.1 # 12

Containment Pressure PS-1801, 2, 3, & 4, switch output B 3.17-3 3.17.3 #1.a & b Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Reactor Protective System (RPS) Description 3.17.1 The purpose of the RPS is to initiate a reactor trip to protect against

violating the core fuel design limits and Primary Coolant System (PCS) pressure boundary during accidents and transients, and to assist the Engineered Safety Features (ESF) Systems in mitigating accidents.

The RPS employs 2 out of 4 trip logic. Four independent measurement channels are provided for each safety related function used to generate reactor trip signals. When any two channels of the same function reach their trip setpoint, a reactor trip signal is generated, the control rod drive mechanism (CROM) clutch power supplies deenergize, the CROM magnetic clutches open, and the full length control rods drop into the core.

Two reactor trips, Loss of Load and High Startup Rate, are equipment protective and are not required for safety. These trips are not provided with four sensor channels and are not single failure proof in the sensor channels. They are provided with four independent actuation channels within the RPS.

To assure that no single failure within the RPS will either cause an inadvertent trip, or prevent a required trip, a minimum of 2/3 trip logic is required. When performing maintenance or testing, or when removing a failed channel from service, RPS logic for the affected function is changed from 2/4 to 2/3 by a key operated "trip channel bypass" switch for the affected trips. Each RPS trip channel can be "trip channel bypassed", but, since only one key is available for each RPS function, only one channel of any function can be bypassed at a time .

In addition to the trip channel bypasses, there are also "operational bypasses" on five RPS trips. These bypasses are either automatically actuated or automatically enabled and manually actuated, in all four RPS channels, when plant conditions do not warrant specific trip protection.

All operating bypasses are automatically removed when permissible bypass conditions are no longer satisfied.

The TM/LP, Low PCS Flow, and Low Steam Generator Pressure trips can be manually bypassed with the Zero Power Mode Bypass Switch* if the associated wide range nuclear instrument channel indicates less than 10-4% RATED POWER. The bypass is provided to allow LOW POWER PHYSICS TESTING while plant conditions are not within limits for POWER OPERATION. Except during LOW POWER PHYSICS TESTS, the bypass also allows individual control rod testing when the plant is cold. The use of the bypass is prohibited unless the PCS is at SHUTDOWN BORON CONCENTRATION* for--the~- COLD- SHUTDOWN* condition.

This restriction increases the assurance that a continuous control rod bank withdrawn would not lead to an inadvertent criticality when there were fewer than 4 PCPs in operation, an event which has not been analyzed.

The safety grade instrument channels which supply input signals to the RPS may also supply input signals to ESF, Isolation, and other safety functions. It is possible, however, that a circuit failure in an input channel may affect one safety function but not another.

The RPS is made up from three major classes of components; trip units, matrix logic, and initiation logic. The arrangement of these components is shown in reference 3.

B 3.17-4 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: RPS Description {continued)

RPS Trip Units: The eleven sets of RPS trip units are the bistable

amplifiers which monitor the analog input functions for the RPS, and the Auxiliary Trip Units which replace the bistables for functions receiving a binary input signal. Most RPS trips monitor an analog signal, such as Steam Generator Level, and initiate a trip when the signal reaches a predetermined setpoint. Containment High Pressure and Loss of Load trips are actuated by pressure switches outside the RPS; High Startup Rate trip is actuated by bistables.in the Wide Range Nuclear Instrumentation {NI) drawers; High Power trip is actuated by a signal from the Thermal Margin Monitor. These four trips use relays, called Auxiliary Trip Units, in place of the RPS bistables. Each trip unit actuates three output relays, one in each of the associated matrix logic channels. Channel "A" trip units have output contacts in matrix logic channels A-B, A-C, and A-D; channel "B" trip units, in A-B, B-C, and B-D; and so on.

RPS Matrix Logic: The six RPS Matrix Logic channels are made up of the output contacts from individual trip units, testing and trip channel bypass contacts, coils of four Matrix Logic Relays; two power supplies, and various indicating lights. The contacts of the trip unit output relays are arranged to achieve the 2 out of 4 trip logic. Each matrix has four output relays; one with contacts in each Initiation Logic channel.

RPS Initiation Logic: The four RPS Initiation Logic channels are made up of a series arrangement of one contact from an output relay in each of the six matrix logic channels, contacts from the C0-1 manual trip button, contacts from the associated "K-Relays", and one "M~Contactor". The M-

Contactor controls power to two of the four clutch power supplies.

Basis: Applicability 3.17.1 The Reactor Protective System is only required to be OPERABLE when there is fuel in reactor vessel, the PCS is less than REFUELING BORON CONCENTRATION, and more than one control rod is capable of being withdrawn.

If there is no fuel in the reactor vessel a nuclear reaction cannot occur and the RPS function is not necessary.

If the PCS is at REFUELING BORON CONCENTRATION (~1720 ppm and subcritical by ~5% with all control rods removed from the core) there is no need for automatic control rod insertion.

If no more than one control rod can be withdrawn the RPS function is already fulfilled (the safety analyses and the SHUTDOWN MARGIN definition both use the assumption that the highest worth withdrawn control rod will fail to insert on a trip) and the safety analyses assumptions and SHUTDOWN MARGIN requirements will be met without the RPS trip function .

B 3.17-5 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Action statements 3.17.1 The listed Action is required to be completed within the specified time if

the conditions of the specification are not met. If, prior to expiration of the specified completion time, the required conditions are restored, completion of the Action is not required. Each specified completion time starts at the time it is discovered that the Action statement is applicable.

Action 3.17.1.1 - One Manual trip channel inoperable - Operation may continue until the reactor is shutdown for other reasons. Repair during operation is not required because one OPERABLE channel is all that is required for safe operation. No safety analyses assume operation of the Manual trip. In addition, the Manual Trip channels are not testable without actually causing a reactor trip, so even if the difficulty were corrected, the post maintenance testing necessary to declare the channel OPERABLE could not be completed during operation.

Action 3.17.1.2 - One RPS trip unit or associated instrument channel inoperable - Each RPS trip function has one trip unit for each of four RPS channels. If one of the associated instrument channels, or the trip unit itself, has a failure which disables the proper functioning of the RPS trip function for that channel, the channel should be declared inoperable.

The inoperable channel must be restored to OPERABLE status or placed in the trip condition within 7 days to limit the time when a channel might be

untrippable. The NRC has requested that plants, whose channel separation does not meet the requirements of Regulatory Guide 1.75, limit the time during which a safety channel is bypassed.

This action does not apply to the High Startup Rate or Loss of Load trips.

The safety analyses take no credit for the functioning of these trips, they are installed for equipment protection only.

This action may be taken separately for inoperable channels of different functions. Each inoperable channel would have its own completion time.

Action 3.17.1.3 - Two RPS trip units or associated instrument channels inoperable - If a second RPS channel for one function becomes inoperable, one inoperable trip unit must be placed in the tripped condition within one hour. One channel must be tripped to limit operation with the RPS in a 2 out of 2 mode where an. additional failure- could disable--the--tr~ip.function entirely.

One trip must be restored to OPERABLE status within 7 days to limit the time when a channel is untrippable. Operation with an RPS channel continuously bypassed or untrippable is only authorized for plants whose channel separation meets the requirements of Regulatory Guide 1.75.

Action c) does not apply to the High Startup Rate or Loss of Load trips.

The safety analyses take no credit for the functioning of these trips, they are installed for equipment protection only. If Action c) were applicable to these non-safety grade trips, failure of one Startup Rate* instrument during power operation, for instance, would limit plant operation to 7 days even though the trips are automatically bypassed.

B 3.17-6 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Action statements 3.17 {continued)

These actions may be taken separately for pairs of inoperable channels of different functions. Each pair of inoperable channels would have its own completion times.

Action 3.17.1.4 - One RPS Matrix Logic channel inoperable - Failures of matrix logic channels are infrequent since they are composed of only contact,pairs, indicating lights, and output relays. There is one Matrix Logic channel for each two-out-of-four combination such as A-B, A-C, A-D, B-C, etc. The failure of any single Matrix Logic channel could, at worst, defeat only a single two-out-of-four trip combination, and would not cause a loss of trip capability. Should a failure occur, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months are allowed for repair.

Action 3.17.1.5 - One RPS Initiation Logic channel inoperable - If a failure of an Initiation Logic channel should occur, it would most likely de-energize the associated clutch power supplies. Such a failure would not caus~ a reactor trip because the other two clutch power supplies would maintain the clutches energized. If a failure, such as a contact pair failing to open {which does not de-energize the associated clutch power supplies) did occur, the RPS Initiation logic trip capability could only be failed by a similar failure of the other initiation logic channel associated with the same power supplies. A single Initiation Logic failure, therefore, cannot cause a loss of trip capability. The associated power supplies must be de-energized within one hour .

Action 3.17.1.6 - Required action AND associated completion time not met -

If the required action cannot be met within the associated completion time, or if the number of OPERABLE channels is less than allowed, the plant must be placed in a condition where the inoperable equipment is not required.

Twelve hours are allowed to bring the plant to HOT SHUTDOWN and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where the affected equipment is not required, to avoid unusual plant transients. Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when it is discovered that Action 3.17.1.6 is applicabl~.

Basis: Table 3.17.1

1. - Manual Trip - The Manual Trip is provided to allow the operator to quickly shut down the reacto~ if such_action.is .. deemed necessary. -Mlhe safety analyses do not assume the use of the manual trip feature. Two separate manual trip channels are provided. One channel duplicates the function of the automatic trips, de-energizing contactors which interrupt power to the clutch power supplies. The second manual trip channel trips the circuit breakers which supply power to the clutch power supplies by de-energizing their undervoltage coils. The manual trip function is required to be OPERABLE under all conditions which require the RPS to be OPERABLE.

2. - Variable High Power Trip {VHPT) - The VHPT provides reactor core

protection against reactivity excursions. The safety analyses assume that this trip is OPERABLE to terminate excessive reactivity insertions during power operation and while shutdown.

B 3.17-7 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.1 (continued}

The VHPT and TM/LP trips both use power level inputs. The power level used

is designated Q Power, and is the higher of core thermal power (AT Power}

or nuclear power. AT ppwer uses hot leg and cold leg RTDs as inputs.

Nuclear power uses the power range nuclear instruments as inputs. Both the AT and Excore Power signals have provisions for calibration by calorimetric calculations.

At RATED POWER, at least 3 OPERABLE variable high power level channels are necessary to provide adequate flux tilt detection. If only 2 channels are OPERABLE, the reactor power level is limited to 70% RATED POWER, protecting reactor from exceeding design peaking factors due to undetected flux tilts.

The VHP trip is designed to limit maximum reactor power to its maximum design and to terminate power excursions initiating at lower powers without power reaching this full power limit. During a plant startup, the VHPT trip setpoint is initially at its minimum value~ 30%. It remains fixed until manually reset, at which point it increases*to ~ 15% above existing Q Power.

The power increase may then continue until the new setpoint is approached at which time the VHPT setpoint is again reset to 15% above the existing Q Power. This pattern continues until the VHPT setpoint reaches its maximum setting. Thus, during power escalation, the VHPT trip setpoint is never more than 15% above existing power. This limits the magnitude of any inadvertent reactivity insertion or power increase. On a power decrease, the VHPT trip setpoint automatically tracks power levels downwards so that

it is always a nominal 15% above the existing power. A minimum setting is provided.

3. - High Startup Rate - The wide range Nuclear Instrument channels provide a reactor trip on High Startup Rate as well as neutron flux level and startup rate indication, automatic bypassing and reinstatement of non-safety reactor trips, and automatic reset of the Zero Power Mode Bypass (of Low PCS Flow, Low SG Pressure, and TM/LP trips}. The safety analyses do not assume functioning of this trip. Two channels of wide range flux level indication and start up rate indication are provided.

The wide range flux level indication actuates bistable amplifiers which actuate the permissive signal for the Zero Power Mode Bypass (for the TM/LP, Low PCS Flow, and Low SG Pressure trips}, and bypass the startup rate trip. Wide range channel NI-003 provides-the bypass... permissive . . for RPS channels "A" and "C"; Nl-004, for "B" and "D". A separate bistable trip unit is provided for each RPS channel.

The same bistables that provide the Zero Power Mode Bypass permissive also automatically bypass the High Startup Rate trips below the setpoint and enables it above. When at very low power levels, the nuclear instrument signals are not steady; if the Startup Rate trips were not bypassed, spurious trips could occur during start up operations.

The High Startup Rate trip is automatically bypassed when power range indicated power exceeds about 15% RATED POWER. The trip is not useful above that power level since reactivity insertions at power would induce an immediate change in power level and eventually be terminated by the VHPT B 3 .17-8 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.1 (continued) without attaining any significant startup rate. This bypass is automatically removed when the associated power range indication decreases below the bistable setpoint. Power range NI-05 provides the bistable for RPS channel "A", NI-06 for "B", NI-07 for "C", and NI-08 for "D". These same power range bistable amplifiers also bypass the Loss of Load trip below the setpoint and enable the ASI alarm function above the setpoint.

In addition, these bistables in NI-05 and NI-06 bypass the Turbine Trip on Generator Trip function below 15%.

The operation of a bistable amplifier occurs at slightly different points during power increases and decreases due to the hysteresis, or dead band, of the instrument. Specified setpoints account for this difference and for sufficient tolerance to avoid constant re-adjustment.

4. - Thermal Margin/Low Pressure (TM/LP) - The TM/LP trip is* provided to prevent reactor operation when the Departure from Nucleate Boiling Ratio (DNBR) is insufficient. The TM/LP trip protects against slow reactivity or temperature increases, and against pressure decreases.

The TM/LP trip uses Q Power, ASI, and Tc as inputs.

Q Power, is the higher of core thermal power (AT Power) or nuclear power. AT power uses hot leg and cold leg RTDs as inputs. Nuclear power uses the power range nuclear instruments as inputs. Both the AT and Excore Power signals have provisions for calibration by calorimetric calculations .

ASI, AXIAL SHAPE INDEX, is calculated from the upper and lower excore detector signals, as explained in the definition section. The signal is corrected for the difference between the flux at the core periphery and the flux at the detectors.

Tc, cold leg temperature, is the higher of the two cold leg signals.

The TM/LP trip setpoint is a complex function of these inputs and represents a minimum acceptable PCS Pressure for the existing te~perature and power conditions. It is compared to actual PCS Pressure in the TM/LP Trip Unit. The TM/LP trips may be manually bypassed with the Zero Power Mode Bypass Switch if the associated wide range nuclear instrument channel indicates less than 10-4% RATED POWER and if the PCS is at SHUTDOWN BORON CONCENTRATION for the COLD SHUTDOWN condition.---This* bypass~-is-,,....

automatically removed at 10*43 power.

5. - High Pressurizer Pressure - The High Pressurizer Pressure trip, in conjunction with pressurizer safety valves and main steam safety valves, provides protection against over pressure conditions in the Primary Coolant System (PCS) when at operating temperature. *The safety analyses assume the High Pressurizer Pressure trip is OPERABLE during accidents and transients which suddenly reduce PCS cooling (Loss of Load, MSIV closure, etc) or which suddenly increase reactor power (Rod Ejection) .

B 3.17-9 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.1 (continued)

The High Pressurizer pressure trip shares four safety grade instrument channels with the TM/LP trip and the low pressurizer pressure Safety Injection Signal.

6. - Low PCS Flow - The Low PCS Flow trip provides protection during events which suddenly reduce the PCS flow rate during power operation, such as loss of power to, or seizure of, a Primary Coolant Pump.

The Low PCS Flow trip uses the summed hot leg to cold leg differential pressure signals as inputs. A trip setpoint is derived by correlating the pressure sum with conditions at RATED POWER.

The Low PCS Flow trips may be manually bypassed with the Zero Power Mode Bypass Switch if the associated wide range nuclear instrument channel indicates less than 10*4% RATED POWER and if the PCS is at SHUTDOWN BORON CONCENTRATION for the COLD SHUTDOWN condition. This bypass is automatically removed at 10*43 power.

7. - Loss of Load - The Loss of Load trip is provided to prevent lifting the-pressurjzer and main steam safety valves in the event of a turbine generator trip while at power. The trip is equipment protective. The safety analyses do not assume that this trip functions during any accident or transient. The Loss of Load trip uses single a pressure switch iri the turbine Auto Stop Oil circuit to sense a turbine trip for input to all four RPS auxiliary trip units.

The Loss of Load trip is automatically disabled when power is below a nominal 15% RATED POWER to allow startup and shutdown of the turbine generator. At low power the transient from a turbine trip would not cause safety valve operation. The Loss of load trip is automatically enabled and bypassed by the same power range bistable amplifiers that disable and enable the High Startup Rate trip. When power range channel NI-005 exceeds 15% RATED POWER, Loss of Load channels "A" and "C" are automatically enabled and High Startup Rate channels "A" and"C" are automatically disabled. Power range NI-006 bistable controls RPS channels "B" and "D" trips similarly.

The operation of the* bistable amplifiers do not occur at exactly the same indicated power during power increases as during decreases due to the hysteresis, or dead band, of the instrument~ -Setpoints-are-specified to account for this hysteresis and to provide a tolerance to avoid constant re-adjustment. *

8. & 9. - Low Steam Generator Level - The low steam generator level trips are provided to trip the reactor in the event of excessive steam demand and loss of feedwater events. Each steam generator level is sensed by measuring the differential pressure between the top and bottom of the downcomer annulus in the steam generator. These trips share four level

sensing channels on each steam generator with the Auxiliary Feedwater Actuation Signal.

B 3.17-10 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.1 (continued)

10. & 11. - Low Steam Generator Pressure - The Low Steam Generator Pressure

trips provide protection against excessive rates of heat extraction from the steam generators which result in a rapid uncontrolled cooldown of the PCS. These trips are needed to shutdown the reactor and assist the ESF System in the event of a steam or feedwater line break.

The Low SG Pressure trips may be manually bypassed with the Zero Power Mode Bypass Switch if the associated wide range nuclear instrument channel indicates less than 10-4% RATED POWER and if the PCS is at SHUTDOWN BORON CONCENTRATION for the COLD SHUTDOWN condition. This bypass is automatically removed at io-4% power.

The SG pressure channels are shared with the Steam Generator Low Pressure signals which isolate the steam and feedwater lines.

12. - High Containment Pressure - The High Containment Pressure trip provides a backup reactor trip in the event of a Loss of Coolant Accident, Main Steam Line Break, or Main Feedwater Line Break. - The High Containment Pressure trip shares sensors with the Containment High Pressure sensing logic for Safety Injection, Containment Isolation, and Containment Spray.

Each of these sensors has a single bellows which actuates two micro-switches. One micro switch on each of four sensors provides an input to the RPS.

13. - RPS Matrix Logic - The six channels of Matrix Logic provide the 2-out-of-4 trip logic for each RPS function. They are described in the RPS description, above, and illustrated in reference 3.

14. - RPS Initiation Logic - The four channels of Initiation Logic control the CROM clutch Power Supplies. They are described in the RPS description, above, and illustrated in reference 3.

Table 3.17.1 Footnotes:

Footnotes (a), (b), and (c) deal with an operational bypass called the Zero Power Mode Bypass.

The Zero Power Mode Bypass blocks operation of the TM/LP, Low PCS Flow, and Low Steam Generator Pressure Trips for the associated RPS channel. The Zero Power Mode Bypass for each RPS channel may be manually actuated by a key operated switch when the associated Wide Range channel indicates below the bistable4 setpoint. When wide range-channel-exceeds- the-setpointi normally 10- % RATED POWER, the Zero Power Mode Bypass is automatically removed.

Footnote (a) requires both wide range nuclear instrument range channels to be OPERABLE if the Zero Power Mode Bypass is used. This requirement assures that OPERABLE channels are available to restore the bypassed trips if reactor power should increase above the setpoint.

Footnote (b) allows bypassing of the TM/LP, Low PCS Flow, and Low Steam

Generator Pressure trips only if two conditions exist; reactor power must be less than 10-4%, and PCS boron concentration must be SHUTDOWN BORON CONCENTRATION for the COLD SHUTDOWN condition.

B 3.17-11 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS.

Basis: Table 3.17.1 (continued}

The requirement for power to be below 10-4% is a function of the circuitry. The bypass is enabled only when power is below the setpoint of bistables in the wide range nuclear instrument channels.

The requirement for boron concentration was imposed in response to Generic Letter 86-13. That letter discussed the possibility of accidents occurring under unanalysed conditions. The Palisades steam line break analysis assumed that four PCPs were in service. The requirement for SHUTDOWN BORON CONCENTRATION is intended to assure that when fewer than four pumps are in service, one of the following conditions exists:

(1) Operation will be limited to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months by the action statements of Specification 3.1.1 b, (2) The reactor will be tripped by the Low Flow trip, or (3} If the Low Flow trip is bypassed;* boron concentration will be sufficient to assure that cooldown caused by a steam line break will not cause a return to criticality.

Footnote {c) allows the Zero Power Mode Bypass to be used with the reactor critical up to 10-1% power during physics testing due to the strict procedural control during physics testing conducted at reduced temperature.

Performing testing with the reactor critical at significantly reduced temperature is not possible without bypassing the Low SG pressure and TM/LP trips. For example, initial criticality and the associated physics testing was performed at 260°F, where steam pressure would be about 35 psi. The Zero Power Mode Bypass will be automatically removed, arming the associated reactor trips, if an inadvertent power increase exceeds the setpoint of the bistable in the Wide Range channels.

Footnote {d) limits the applicability of Specification 3.17.1 for the Loss of Load Trip to above 17% power. The trip is automatically bypassed below 17% and cannot be completely tested unless the turbine is latched .

B 3.17-12 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Engineered Safety Features (ESF) Instruments 3.17.2 and 3.17.3 The ESF circuitry generates six actuating signals, each actuating signal

having two trains of relays. These required signals are listed in two tables, sorted by applicability. The Safety Injection Signal (SIS),

Recirculation Actuation Signal (RAS), and Auxiliary Feedwater Actuation Signal (AFAS) are listed in Table 3.17.2; Containment High Pressure (CHP),

Containment High Radiation (CHR), and Steam Generator Low Pressure (SGLP) in Table 3.17.3. In addition, Table 3.17.2 specifies operability of the sequencers which provide automatic diesel generator loading and Table 3.17.3 specifies operability of the radiation monitors which provide automatic isolation of the ECCS pump room ventilation.

The purpose of the ESF is to initiate protective actions which will isolate the containment, and supply makeup and cooling water to the PCS in the event of an accident. These features both protect the public from radioactive fission products and limit the extent of reactor core damage.

The ESF circuitry, with the exception of Recirculation Actuation Signal (RAS), employs 2 out of 4 logic. Four-independent measurement-channels are provided for each function used to generate ESF actuation signals. When any two channels of the same function reach their setpoint, actuating relays are energized which, in turn, initiate the protective actions. Two separate and redundant trains of actuating relays, each powered from separate power supplies, are utilized. These separate relay trains operate redundant trains of ESF equipment.

RAS logic consists of output contacts of the relays actuated by the SIRWT

level switches arranged in a "l out of 2 taken twice" logic. The contacts are arranged so that at least one low level signal powered from each station battery is required to initiate RAS. Loss of a single battery, therefore, cannot either cause or prevent RAS initiation.

Basis: Applicability 3.17.2 ESF circuits which actuate SIS, RAS, AFW, and Diesel Generator loading are not required to be OPERABLE when the PCS is below 300°F since the actuated equipment is not required to be OPERABLE.

CHP initiates functions listed in Table 3.17.3 as well as SIS listed in 3.17.2. The CHP circuits, therefore, are subject to the broader applicability of Specification 3.17.3 rather than 3.17.2.

Basis: Action Statements 3.17.2:

The listed Action is required to be completed within the specified time if the conditions of the specification are not met. If, prior to expiration of the specified completion time, the required conditions are restored, completion of the Action is not required. Each specified completion time starts at the time it is discovered that the Action statement is applicable .

Action 3.17.2.1 - One manual control or logic channel inoperable - With one manual control channel or one logic channel inoperable, control over one of B 3.17-13 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Action statements 3.17.2 (continued) the two trains of ESF is diminished. The train with the inoperable control channel no longer has the designed capability of automatic actuation with operator backup. The controls must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

This action may be taken separately for inoperable channels of different functions. Each inoperable channel would have its own completion times.

Action 3.17.2.2 - One ESF instrument channel inoperable - The inoperable channel must be repaired or placed in trip within 7 days to limit the time when a channel is bypassed. The NRC has requested that plants whose channel separation does not meet the requirements of Regulatory Guide 1.75 limit the time during which a safety channel is bypassed.

This action may be taken separately for inoperabl~ channels of different functions. Each inoperable channel would have its own completion time.

Action 3.17.2.3 - Two ESF instrument channels inoperable - With two inoperable instrument channels, the ESF could be in a 2 out of 2 logic.

The length of time spent in this mode should be minimized. Placing the trip unit for the affected ESF function in the tripped condition places the ESF in a 1 out of 2 mode. Eight hours is allowed for this action since it must be accomplished by a circuit modification, or by removing power from a circuit component .

The second inoperable channel must be repaired within 7 days to limit the time the unit is operated with an inoperable channel.

These actions may be taken separately for pairs of inoperable channels of different functions. Each pair of inoperable channels would have its own completion times.

Action 3.17.2.4 - One SIRWT level channel inoperable - The SIRWT low level circuitry is arranged in a 11 1 out of 2 taken twice" logic rather than the more frequently used 2 out of 4 logic. Therefore, the specified Action differs from other ESF functions. With a bypassed SIRWT low level channel, an additional failure might disable automatic RAS, but would not initiate a premature RAS. With a tripped channel, an additional failure could cause a premature RAS, but would not disable.-.the--automatic-RAS.*** ....... * *-*

Since considerable time is available after initiation of.SIS until RAS is required and there is quite a tolerance on the time when RAS must be initiated, and since a premature RAS could damage all the ESF pumps, it is preferable to bypass an inoperable channel and risk loss of automatic RAS than to trip a channel and risk a premature RAS. Eight hours is allowed for this action since it must be accomplished by circuit modification.

The inoperable channel must be repaired within *7* days to limit the time the unit is operated with an inoperable channel .

B 3.17-14 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Action statements 3.17.2 (continued)

Action 3.17.2.5 - One or more sequencers inoperable - The Shutdown

Sequencers provide automatic loading of the diesel generators in case of a loss of power to the associated safeguards 2400 volt bus. Both programmed sequences and the initiating logic must be operable. If a sequencer is inoperable, the associated diesel generator cannot perform its designed automatic loading and must be declared inoperable. The completion time of "immediately" does not mean "instantaneously", rather it implies "start as quickly as plant conditions permit and continue until completed."

Action 3.17.2.6 - Required action AND associated completion time not met -

If the required action cannot be met within the associated completion time, or if the number of OPERABLE channels is less than allowed, the plant must be placed in a condition where the inoperable equipment is not required.

Twelve hours are allowed to bring the plant to HOT SHUTDOWN, and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where the affected equipment is not required, to avoid unusual plant transients. Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when it is discovered that Action 3.17.2.6 is applicable.

Basis: Table 3.17.2

1. - Safety Injection Signal (SIS) - SIS is actuated by manual initiation, by a CHP signal, or by 2 out of 4 Pressurizer Pressure channels decreasing below the setpoint. SIS initiates the following actions:

a) b)

c)

Start HPSI & LPSI pumps Enable Containment Spray Pump Start on CHP Initiate Safety Injection Valve operations Each Manual Actuation channel consists of one pushbutton which directly starts the SIS actuation logic for the associated train.

The Low Pressurizer Pressure signal for each SIS train can be blocked when 3 out of 4 channels indicate below 1700 psia. This block prevents undesired actuation of SIS during a normal plant cooldown. The block signal is automatically removed when 2 out of 4 channels exceed the setpoint.

The pressurizer pressure instrument channels which provide input to SIS are the same channels which provide an input to the RPS. The RPS receives an analog signal from each Pressurizer. Pressure. channel ;--each-SIS---initiation logic train receives a binary signal from a group of four relays, *each actuated by a bistable in one of the four instrument channels. The contacts of these relays are wired into a 2 out of 4 logic. It is the output of this pressurizer pressure 2 out of four logic circuit that is blocked during plant cooldowns. A similar arrangement of bistables and relays provide the pressurizer low pressure block permissive signal. The initiation and block circuits are illustrated in reference 4.

Each SIS logic train is also actuated by a contact pair on one of the CHP initiation relays for the associated CHP train .

Each train of SIS actuation logic consists of a group of "SIS" relays which energize and seal in when the initiation logic is satisfied. These SIS B 3.17-15 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Tabl.e 3.17.2 (continued) relays actuate alarms and control functions. One of the control functions

selects between an immediate actuation circuit, if offsite power is available, and a time sequenced actuation circuit, if only diesel power is available. These actuation circuits initiate motor operated valve opening and pump starting. The SIS actuation logic is illustrated in reference 5.

2. - Recirculation Actuation Signal (RAS) - RAS is actuated by manually actuating the circuit "Test" switch or by two of the four level sensors in the SIRWT reaching their setpoints. RAS initiates the following actions:

a} Trip LPSI pumps (this trip can be manually bypassed}

b} Switch HPSI & Spray suction from SIRWT to Containment Sump c} Adjust cooling water to Shutdown Cooling Heat Exchangers Th~ four SIRWT level sensors each de-energize two relays, one per logic train, when tank level reaches the setpoint. Each channel of level sensor and associated output relays is powered from a different*Preferred AC bus.

Two Preferred AC buses are powered, through inverters, from each station battery. The manual RAS control for each train de-energizes two of these relays, initiating RAS through the logic train.

Each train of RAS logic consists of the output contacts of the relays actuated by the level switches arranged in a "l out of 2 taken twice" logic. The contacts are arranged so that at least one .low level signal powered from each station battery is required to initiate RAS. Loss of a

single battery, therefore, cannot either cause or prevent RAS initiation.

When the logic is satisfied, two DC relays are energized to initiate RAS actions and alarms. The RAS logic is illustrated in reference 6.

3. - Auxiliary Feedwater Actuation Signal (AFAS) - AFAS is actuated by manual action or by 2 out of 4 level sensors on either steam generator reaching their setpoints. Manual actuation of Auxiliary Feedwater may be accomplished through pushbutton actuation of each AFAS channel or by use of individual pump and valve controls. Each AFAS channel starts the associated AFW pump(s} and opens the associated flow control valves.

The steam generator level instrument channels which provide input to AFAS are the same channels which provide an input to the RPS. Both the AFAS cabinets and the RPS receive analog signals from the instrument channel, and both have* their own.bistables to initiate.. actuat-ion-on*--low*<leveL Each AFAS train contains a 2 out of 4 logic for each steam generator. One AFAS logic train actuates motor driven AFW pump P-8A and turbine driven pump P-BB and the associated flow control valves; the other actuates motor driven pump P-8C and the associated valves. Each train provides flow to both steam generators. The AFAS logic uses solid state logic circuits. It is illustrated in reference 7.

4. - Emergency Power Sequencers - The Emergency Power Sequencers provide signals to close selected circuit breakers*timed to provide emergency equipment as soon as possible after a loss of power, in the required sequence, yet not overload the diesel generator with the resultant starting B 3.17-16 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.2 (continued) currents. One solid state programmable sequencer is provided for each diesel generator. Two programmed sequences are provided by each sequencer, a "Design Basis Accident" (DBA) sequence which is actuated by a loss of power to the associated bus if a Safety Injection Signal is present, and a "Normal Shutdown" sequence which is actuated by a loss of power to the associated bus if a Safety Injection Signal is not present. The sequencers and associated circuitry are illustrated in reference 5 .

B 3.17-17 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Applicability 3.17.3 ESF circuitry which actuates the Isolation Functions is not required to be

OPERABLE when the PCS is in COLD SHUTDOWN because of the low energy content of the PCS and Steam Generator water.

Basis: Action statements 3.17.3 The listed Action is required to be completed within the specified time if the conditions of the specification are not met. If, prior to expiration of the specified completion time, the required conditions are restored, completion of the Action is not required. Each specified completion time starts at the time it is discovered that the Action statement is applicable.

Action 3.17.3.1 - One manual control or logic channel inoperable - With one manual control channel or one logic channel inoperable, control over one of the two trains of Isolation functions is diminished. The train with the inoperable control channel no longer has the designed capability of automatic actuation with operator backup. The controls must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

This action may be taken separately for inoperable channels of different functions.* Each inoperable channel would have its own completion time.

Action 3.17.3.2 - One Isolation Function instrument channel inoperable -

The inoperable channel must be repaired or placed in trip within 7 days to limit the time when a channel is inoperable. The NRC has requested that plants whose channel separation does not meet the requirements of Regulatory Guide 1.75 limit the time during which a safety channel is bypassed.

This action may be taken separately for inoperable channels of different functions. Each inoperable channel would have its own completion time.

Action 3.17.3.3 - Two Isolation Function instrument channels inoperable -

With two inoperable instrument channels, the Isolation Function could be in a 2 out of 2 logic. The length of time spent in this mode should be minimized. Placing the trip unit for the affected Isolation Function in the tripped condition places the. Isolation Function ~n a. 1 .out--of-2 mode.

Eight hours is allowed for this action since it must be accomplished by a circuit modification, or by removing power from a circuit component.

One inoperable channel must be repaired within 7 days to limit the time the unit is operated with an inoperable channel.

These actions may be taken separately for pairs of inoperable channels of different functions. Each pair of inoperable channels would have its. own completion times .

Action 3.17.3.4 - Engineered Safeguards Room Ventilation Radiation Monitor inoperable - The only safety function provided by the subject monitors is B 3.17-18 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Action statements 3.17.3 (continued) to isolate the ventilation to and from the room on high radiation. If this

function is completed manually, operation may continue indefinitely. The intent is to effect closure quickly for an instrument failure but not require a plant shutdown it a difficult to repair mechanical failure should take longer to accomplish. It is permissible to operate the dampers as part of the repair process in order to verify their operability.

Action 3.17.3.5 - Reguired action AND associated completion.time not met -

If the required action cannot be met within the associated completion time, or if the number of OPERABLE channels is less than allowed, the plant must be placed in a condition where the inoperable equipment is not required.

Twelve hours are allowed to bring the plant to HOT SHUTDOWN, and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where the affected equipment is not required, to avoid unusual plant transients. Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when i.t is discovered that Action 3.17.3.5 is applicable~*

Basis: Table 3.17.3

1. - Containment High Pressure (CHPl - CHP is actuated by 2 out of 4 pressure switches for the associated train reaching their setpoints. CHP initiates the following actions:

a} Containment Spray b} Safety Injection Signal c} Main Feedwater Isolation

d} Main Steam Line Isolation e}

f}

Control Room HVAC Emergency Mode Close Containment Isolation Valves Eight containment pressure channels are provided. Each channel consists of one pressure sensing bellows which actuates two micro-switches. Four of these sixteen micro-switches provide input to the RPS; the remainder are divided into two circuits of 2 out of 4 logic for the CHP logic trains.

Each CHP logic train consists of an arrangement of six micro-switch contacts and a test relay which energize a group of 5P relays when the 2 11 11 out of 4 logic is satisfied. The CHP logic is illustrated in reference 8.

2. - Containment High Radiation (CHRl - CHR is actuated by manual action or, during normal operation,. by 2 outof.4 radiation monitors.setpoints.

During refueling operations the CHR actuation is manually switched to actuate on 1 of 2 low range radiation monitors at a much lower setpoint.

CHR initiates the following actions:

a} Control Room HVAC Emergency Mode b} Close Containment Isolation Valves c}* Block automatic starting of ECCS pump room sump pumps The containment area radiation monitors which actuate CHR each de-energize an output relay upon reaching their setpoint. The output contacts of these relays are arranged into two trains of 2 out of 4 logic. Two manual controls each de-energize two of these relays, initiating both trains of CHR.

B 3.17-19 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.3 (continued)

When either train of 2 out of 4 logic is satisfied, a group of "5R" relays energize to initiate CHR actions. The CHR logic is illustrated in reference 9.

3. - Steam Generator Low Pressure (SGLP) - One SGLP circuit is provided for each steam generator. Each SGLP circuit is actuated by 2 out of 4 pressure channels on the associated steam generator reaching their setpoint. SGLP initiates the following actions:

a) Close the associated Feedwater Regulating valve and its bypass.

b). Close both Main Steam Isolation Valves.

The steam generator pressure instrument channels which provide input to SGLP are the same channels which provide an input to the RPS. Both the SGLP logic and the RPS receive analog signals from the instrument channel, and both have their own bistables to initiate actuation on low pressure.

The SGLP signal from each steam generator may be blocked when 3 of the 4 steam pressure channels indicate below 550 psia. This block prevents undesired actuation during a normal plant cooldown. The block signal is automatically removed when steam pressure exceeds the setpoint.

Each SGLP logic is made up of output contacts from four pressure bistables from the associated steam generator. When the logic circuit is satisfied, two relays are energized to actuate steam and feedwater line isolation. A similar logic circuit is provided for each block circuit. The block is automatically removed when the steam pressure exceeds 550 psig. SGLP logic is illustrated in reference 10.

4. - Engineered Safeguards Pump Room High Radiation - One Radiation Monitor is provided for each pump room. If the monitor reaches its setpoint, dampers are closed in the ventilation inlet and discharge for the associated room .

B 3.17-20 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Accident Monitoring Instruments (AMI) 3.17.4 The AMI provide information to assist the operator in monitoring accident

conditions within the PCS, the steam system, and the containment.

Two measurement channels provide the necessary information in the Control Room for ~dequate accident monitoring. The channels provide wide-range information which meet electrical and physical separation requirements for each function displayed. This design is consistent with the requirements of IEEE 279-1971. The channels are provided with equipment qualified to operate in the environments specified for design basis events in the FSAR.

These channels comply with the requirements of NUREG 0578 and recpmmendations of Regulatory Guide 1.97.

Basis: Applicability 3.17.4 The AMI are required to allow the operator to monitor the accident status while bringing the plant to shutdown cooling entry conditions. Therefore, the specified instrumentation is required to be operable.when PCS temperature is above 300°F, the temperature below which shutdown cooling may be initiated.

Basis: Action statements 3.17.4 The listed Action is required to be completed within the specified time if the conditions of the specification are not met. If, prior to expiration of the specified completion time, the required conditions are restored, completion of the Action is not required. Each specified completion time starts at the time it is discovered that the Action statement is applicable.

Action 3.17.4.1 - One channel inoperable (except position indication, CETs, reactor water level and containment radiation) - The inoperable channel must be restored to OPERABLE status within 7 days, or Action 3.17.4.4 must be entered. The 7 day completion time is arbitrarily assighed based on allowing time for repair on a non-emergency basis and the perceived low probability of an accident requiring use of AMI concurrent with failure of the remaining OPERABLE channel during the allotted time.

Action 3.17.4.2 - Two channels inoperable (except position-indication,.

CETs, reactor water level and containment radiation) - One inoperable channel must be restored to OPERABLE status within .48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or Action 3.17.4.4 must be entered. The 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months completion time is arbitrarily assigned based on allowing time for repair and the perceived low probability of an accident requiring use of AMI during the allotted time.

Action 3.17.4.3 - Position Indication inoperable - The inoperable channels must be restored to OPERABLE status or the associated isolation valve locked in the closed position within 7 days, or Action 3.17.4.4 must be entered. The 7 day completion time is arbitrarily assigned based on allowing time for repair on a non-emergency basis and the perceived low probability of an accident requiring use of AMI concurrent with failure of B 3.17-21 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Action statements 3.17.4 (continued) the position indication for the other valve on that penetration during the

allotted time .

Action 3.17.4.4 - Required action AND associated completion time not met -

If the required action of 3.17.4.1 through 3.17.4.3 cannot be met within the associated completion time, the plant must be placed in a condition where the inoperable equipment is not required. Twelve hours are allowed to bring the plant to HOT SHUTDOWN, and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where the affected equipment is not required, to avoid unusual plant transients.

Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when it is discovered that Action 3.17.4.4 is applicable.

Action 3.17.4.5 - One channel of CETs, reactor water level or containment radiation inoperable - The inoperable channel must be restored to OPERABLE status within 7 days, or action 3.17.4.7 must be entered. The 7 day completion time is assigned based on allowing time for repair of failures which affect equipment outside the containment on a non emergency basis.

Action 3.17.4.6 - Two channels of CETS, reactor water level or containment radiation inoperable - One inoperable channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or action 3.17.4.7 must be entered. The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months completion time is assigned to allow time for repair of failures which affect equipment outside the containment .

Action 3.17.4.7 - Required action not met within associated completion time a) - If two channels of CETs in any quadrant are inoperable for more than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , the reactor must be shutdown and cooled down in accordance with 3.17.4.4.

b) - If two RVWL channels are inoperable, alternate instrument channels must be used for monitoring reactor vessel water level. The alternate channels normally used are Subcooled Margin Monitors, Wide Range Pressurizer Level, and Core Exit Thermocouples required by Table 3.17.4.

c) - If other required actions of 3.17.4.5 or 3.17.4.6 cannot be met within the associated completion time, the intended corrective actions must be reported to the NRC within 30 days from-the-time the-inoperability was discovered. This report must be submitted even if the required actions are completed prior to the expiration of the 30 day completion.time. This Action is less stringent than 3.17.4.4 because the information provided by subject instrumentation is not used as the basis for operator action.

d) - All ~equired channels must be restored to OPERABLE status prior to startup from the next refueling. Since Specification 3.0.4 is not applicable, this action is necessary to assure that repair is accomplished when the equipment is accessible during the next refueling .

B 3.17-22 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.4 The functions listed in Table 3.17.4 are those in FSAR Appendix 7C, "REGULATORY GUIDE I. 97 INSTRUMENTATION" which are classed as "Category 111 or as "Type A11

Type A - ANSI/ANS-4.5, as quoted in Regulatory Guide 1.97, defines "Type A11 variables as those variables that provide primary information needed to permit the control room operating personnel to take manually controlled actions for which no automatic control is provided, but are required for safety systems to accomplish their safety functions for design basis accident events.

Category 1 - Regulatory Guide 1.97, in a table of design and qualification criterion for accident monitoring instrumentation, provides three classes of instruments of which "Category 111 , which they refer to as "key variables", is the most stringent.

Each core exit thermocouple (CET) channel consists of a single environmentally qualified thermocouple. -This definition of a CET channel differs from standard Technical Specifications. The CET requirements actions were added to the Palisades Technical Specifications by amendment 147 on June 22, 1992.

A Reactor Vessel Water Level channel consists of eight sensors in a probe.

A channel is OPERABLE if four or more sensors, two or more of the upper four and two or more of the lower four, are OPERABLE. There are two channels installed .

B 3.17-23 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: 3.17.5 Alternate Shutdown System The Alternate Shutdown System ensures that a fire will not preclude

achieving safe shutdown. The Alternate Shutdown System components are independent of areas where a fire could damage systems normally used to shut down the reactor. This capability is consistent with Regulatory Guide 1.97 and 10 CFR 50 Appendix R. There are no transient or accident analyses which take credit for operations conducted from the Remote Shutdown Panel.

The provisions of Specifications 3.0.3 and 3.0.4 do not apply to Specification 3.17.5, because the required equipment does not affect normal plant operations, and most repairs can be made while the plant is critical.

Basis: Applicability 3.17.5 The Alternate Shutdown equipment is designed to be able to bring the plant to, and maintain it in, a safe shutdown condition. Therefore, Specification 3.17.5 is not applicable when below 300°F*when the Shutdown Cooling System would be available.

Basis: Action statements 3.17.5 The listed Action is required to be completed within the specified time if the conditions of the specification are not met. If, prior to expiration of the specified completion time, the required conditions are restored, completion of the Action is not required. Each completion time starts at the time it is discovered that the Action statement is applicable .

Action 3.17.5.1 - One or more channels inoperable - Equivalent shutdown capability must be provided within 7 days, and the required equipment restored to OPERABLE status within 60 days. Seven days is intended to allow repair without subjecting the plant to a shutdown. If equivalent shutdown control or monitoring equipment can be provided, the repair period for the required channels may be extended to 60 days.

Action 3.17.5.2 - Required action AND associated completion time not met -

If the required action cannot be met within the associated completion time, or if the number of OPERABLE channels is less th~n allo~ed, the plant must be placed in a condition where the inoperable equipment is not required.

Twelve hours are allowed to bring the plant to HOT SHUTDOWN, and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where the affected equipment is not required, to avoid unusual plant transients. Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when it is discovered that Action 3.17.5.2 is applicable.

Basis: Table 3.17.5 Indication channels 3 through 14 use a transmitter which also serves normal control room instrumentation. When the control switches are changed to the "AHSDP" (Alternate Hot Shut Down Panel) position, the transmitter is isolated from its normal power supply and circuitry, and connected into the C-150 or C-150A panel circuit; control for AFW flow control valves CV-0727 and 0749 is also transferred to C-150. The transfer switches are alarmed in the control room .

Pressurizer Pressure indicator channel 2 is provided with its own pressure transmitter. Its circuitry is energized when the transfer switch is in the AHSDP position.

B 3.17-24 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: 3.17.6 Other Safety Features The Safety Functions required by Specification 3.17.6 provide alarm and

indication functions to assist the operator in monitoring plant conditions.

None* of the required functions provide automatic actions assumed to be available in the safety analysis, therefore, operation may continue even though the function is degraded or lost provided that the specified action is met.

The provisions of Specifications 3.0.4 and 4.0.4 are not applicable to several required instrument functions, as noted in Table 3.17.6. These instrument functions have sufficient redundancy to provide their required functions with one or more installed channels operable. The exception to 3.0.4 and 4.0.4 allows changing of plant operating conditions, but the required actions require eventual return to service.

Basis: Applicability 3.17.6 Specification 3.17.6 involves miscellaneous-instruments-with widely differing function. The applicability for each required instrument is provided in the Applicable Conditions column of Table 3.17.6.

Basis: Action statements 3.17.6 The listed Action is required to be completed within the specified time if the conditions of the specification are not met. If, prior to expiration

of the specified completion time, the required conditions are restored, completion of the Action is not required. Each specified completion time starts at the time it is discovered that the Action statement is applicable.

Sinee Table 3.17.6 consists of instruments of widely different function, each table entry has its own Action statements whose numbering corresponds to that of the table entries. These Actions are discussed following the basis for the associated channel.

Basis: Table 3.17.6

1. Neutron Flux Monitoring - Two channels of wide range neutron flux monitoring are required to be4 OPERABLE when there is fuel in the reactor.

When flux is greater than 10- 3, the- requ i.rements .. of.. Spec i fi ca ti on 3 A 7.1 assure adequate flux monitoring capability. Neutron flux channels are used to monitor core reactivity changes.

The count rate section of the wide range neutron flux monitoring channels is capable of detecting flux levels below the indicating scale. Flux levels decrease with time while the reactor is shutdown. After extended shutdowns the flux level may decrease below the indicating range. When flux is *below the indication range, channel OPERABILITY may be verified by using scaler-counters or other additional instrumentation~

Action 3.17.6.1 - One or two Neutron Flux Monitoring channels inoperable -

When there are fewer than two OPERABLE Neutron Flux Monitoring channels, B 3.17-25 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued) complete monitoring of core reactivity is not possible. All positive

reactivity changes must be terminated immediately, the reactor must be shutdown, if it was critical, and SHUTDOWN MARGIN verified within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter until the required monitoring is restored.

The completion time of "immediately" does not mean "instantaneously",

rather it implies "start as quickly as plant conditions permit and continue until completed."

2. Rod Position Indication - Two channels of rod position indication are required to be OPERABLE for each full-length and each part-length rod. Rod position indication is required to allow verification that the rods are positioned and aligned as required. Rod position channels are required to be OPERABLE whenever more than one CROM is capable of rod withdrawal. It is not required when only a single rod may be withdrawn for two reasons:

first, .it is necessary to withdraw a rod in order to perform the calibration necessary to declare the position indication channels OPERABLE, and second, the safety analyses assume that the most reactive rod is stuck in the fully withdrawn position. Both rod position channels are calibrated to read the height of the bottom of the control rod blade, in inches, above the full inserted position.

Primary rod position indication is operated by a gear train driven from the CRDM drive package, below the clutch. The gear train actuates cam operated limit switches and a synchro. The limit switches operate position indication lights; the synchro, together with the Primary Information

Processor (PIP), operate the digital position indication. Both the limit switches and the sync~ro signal are also used for alarm and control functions.

The primary rod position system is considered OPERABLE, for purposes of this specification, if the digital position readout or the cam operated position indication lights give positive indication of rod position.

Secondary Position Indication (SPI) is operated by a magnet integral with the connector nut and a magnetically operated reed switch stack attached to the CRDM housing. The reed switches are located at uniform intervals along the travel of the connector nut. The reed switches are wired so that the voltage read across the reed switch stack is proportional to rod position.

There is a dead band, near the bottom of the travel, where the CROM housing seismic support prevents operation of the switches. SPI also provides alarms, position indication lights, and.control .functions-based on--rod*

position.

The SPI for each control rod is considered OPERABLE, for purposes of LCO, if there are no-occurrences, other than the seismic support dead band, where two adjacent switches fail to respond to rod motion.

Action.3.17.6.2 - One rod position indication channel inoperable - If one channel of rod position indication is inoperable, control and alarm functions may also be inoperable. The position of each rod in the associated group must be verified to be within the limits of specification 3.10 within 15 minutes after moving any rod.

B 3.17-26 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued)

3. Safety Injection Refueling Water Tank Temperature - SIRWT temperature

instrumentation is required to verify that the SIRWT temperature is within limits. Two channels of temp~rature indication are provided.

SIRWT temperature instrumentation is not required below 300°F lave because the SIRWT and systems supported by the SIRWT are not required to be OPERABLE be 1ow 300 °F Tave.

SIRWT temperature indication has been excepted form the provisions of Specifications 3.0~4 and 4.0.4 because alternate means of obtaining the required information are readily available.

Action 3.17.6.3 - One.or two SIRWT temperature channels inoperable - With installed SIRWT temperature indication inoperable, operation may continue as long as temperature can be verified to be above the limit. The tank is not insulated and is accessible so alternate means of determining temperature are relatively simple. When ambient temperatures are well above the SIRWT limit, outside air temperature may be assumed to represent SIR~T temperature.

4. *Main Feedwater Flow Indication - The Main Feedwater Flow measurements are necessary to perform the required daily calorimetric calculation. One feedwater flow instrument is provided for each feed line. These flow indicators are the same instruments which provide flow indication to the Feedwater Control System .

The instrumentation is not required below 15% RATED POWER where calorimetric calculations are not required.

Action 3.17.6.4 - Main Feedwater Flow indication inoperable - If feedwater flow indication is inoperable, this specification allows operation to continue if alternate indication can be provided to allow completion of the required daily calorimetric calculation. The inoperable channel must be restored to OPERABLE status prior to the next reactor startup, as required by Specification 3.o.4*.

5. Main Feedwater Temperature Indication - The Main Feedwater Temperature measurements are necessary to perform the required daily calorimetric calculation. One feedwater temperature instrument is provided for each feed line.

The instrumentation is not required below 15% RATED POWER where calorimetric calculations are not required.

Action 3.17.6.5 - Main Feedwater Temperature indication inoperable - If feedwater temperature indication is inoperable, this specification allows operation to continue if alternate indication can be provided to allow completion of the required daily calorimetric calculation. The inoperable channel must be restored to OPERABLE status prior to the next reactor startup, as required by Specification 3.0.4 .

B 3.17-27 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis:* Table 3.17.6 (continued)

6. Auxiliary Feedwater Flow - The AFW system is arranged as two

independent trains of pumps, piping, flow control valves and electrical controls. Each train is capable of feeding each steam generator through separate feed lines and flow control valves. Each AFW feed line is provided with two separate flow indication channels. One channel provides an input to the associated AFW flow control valve as well as control room flow indication; the other provides flow indication in the control room. A flow switch from eath of the flow indicator channels provides a flow signal to the AFW pump sequencing circuitry. In addition, two of the flow transmitters associated with the turbine driven AFW pump, those which do n9t provide flow control, can be manually switched into a completely separate circuit which provides AFW flow information at Alternate Shutdown Panel C-150.

The AFW flow channels are not required to be OPERABLE when the PCS is below 300°F because the AFW system in not required to be OPERABLE below 300°F.

Action 3.17.6.6.1 - One AFW flow indicator inoperable - If one flow channel becomes inoperable, the OPERABILITY of the associated flow control valve must be determined. Those flow. indication channel failures which could prevent flow through that feed line cause the valve to be inoperable. Flow indication channel failures which affect only indication, or which cause the valve to fail open do not necessarily cause the valve to be inoperable.

Action 3.17.6.6.2 - Two AFW flow indicators inoperable - If two flow indication channels for one AFW feed line become inoperable there is no way

to verify flow through that line; the associated AFW flow control valve must be declared inoperable. The completion time of "immediately" does not mean "instantaneously", rather it implies "start as quickly as plant conditions permit and continue until completed."

7. PCS Leakage Detection Instrumentation - Four diverse systems for PCS leak detection are required to be OPERABLE, any one Containment Humidity Monitor, any one Containment Atmosphere Gaseous Activity Monitor, any one Containment Air Cooler Condensate Level Switch, and any one Containment Sump Level indicator. The air cooler level switch must be associated with an operating air cooler.

Footnotes (b} and (c} are intended to clarify that the requirement is for one instrument channel of each type to be operable, and that continued operation is not permftted unless at ~east-one-instrumen~-channel~out of all those specified, is operable. If one OPERABLE Instrument of each type is not available, the appropriate Action statement must be followed; if no PCS leakage Detection instrument channels are operable, Action 3.17.6.21 is applicable.

The PCS leakage detection instrumentation systems are not required to be OPERABLE when the PCS temperature is below 300°F because the consequence of leakage at reduced temperature and pressure is small, and because the PCS is accessible for local inspection .

Action 3.17.6.7.1 - One required leak detection system inoperable -

Operation may continue with one of the required four types of leak detection systems inoperable, but one instrument of each type must be B 3.17-28 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 {continued) restored to OPERABLE status prior to the next startup from COLD SHUTDOWN.

Several of the instruments cannot be conveniently repaired with the plant at eleva.ted temperature due to their location or their impact on containment integrity. Three separate leak detection systems, together with daily PCS inventory checks, are considered adequate for continued operation.

Action 3."17.6.7.2 - Two or three required leak detection systems inoperable

- Daily PCS inventory calculations provide adequate leakage detection for limited periods. Thirty days is considered adequate time in which to accomplish r~pairs necessary to return at least three of the required instruments to operable status.

8. Primary Safety Valve Position Indication - Each Primary Safety valve is provided with two means of detecting an open or leaking valve; one acoustical monitor and one tail pipe temperature indicator.

Primary Safety Valve position indication instrumentation is not required to be OPERABLE when the PCS temperature is below 300°F because the consequence of leakage at reduced temperature and pressure is small, and because the PCS is*accessible for local inspection.

Primary Safety Valve position indication has been excepted from the requirements of Specifications 3.0.4 and 4.0.4 to permit a startup from HOT SHUTDOWN with an inoperable channel. Without such an exception, no startup could be made without cooling down to repair the inoperable channel .

Action 3.17.6.8 - One Primary Safety Valve position indication channel inoperable - The Primary Safety valves are located on top of the pressurizer. During 9peration at elevated temperatures, the position indication is not accessible for repair. One OPERABLE channel provides sufficient capability to detect leakage for limited periods of time .. The inoperable channel must be restored to OPERABLE status prior to the next start up from COLD SHUTDOWN.

9. Power Operated Relief Valve Position Indication - Each PORV is provided with three means of position detection; a stem position indicator, an acoustical monitor mounted on the valve, and a temperature indicator mounted on the common tailpipe. The acoustic monitors and temperature i ndi ca tor provide i ndi cation of **leakage- through**the, PORV- and* its** associated block valve.

PORV position indication is required to be OPERABLE except when the PCS is in COLD SHUTDOWN or when the PORV is isolated by a closed PORV block valve which has OPERABLE position indication. When the plant is in COLD SHUTDOWN, PORV leakage is of little consequence. When the PORV is isolated, the block valve position indication provides the needed information.

PORV position indication has been excepted from the requirements of

Specifications 3.0.4 and 4.0.4 to permit a startup from HOT SHUTDOWN wi~h an inoperable channel. Without such an exception, no startup could be made without cooling down to repair the inoperable channel.

B 3.17-29 Revision: 02/21/94

3.I7 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued)

Action.3.17.6.9 - One or two PORV position indication channels inoperable -

The PORVs are located on top of the pressurizer. During operation at elevated temperatures, the position indication is not accessible for repair. One OPERABLE channel provides sufficient capability to detect leakage for limited periods of time. The inoperable channels must be restored to OPERABLE status prior to the next start up from COLD SHUTDOWN.

10. PORV Block Valve Position Indication - Each PORV block valve is provided with position indication lights operated by limit switches on the valve motor operator and by a temperature indicator mounted on the common PORV tailpipe.

PORV block valve pos.i ti on i ndi cation is required to be OPERABLE except when the PCS is depressurized and vented through a monitored path. The PORV block valves are required to be open at low temperatures so that the PORVs can provide Low Temperature Over Pressure protection.

PORV block Valve position indication has been excepted from the requirements of Specifications 3.0.4 and 4.0.4 to permit a startup from HOT SHUTDOWN with an inoperable channel. Without such an exception, no startup could be made without cooling down to repair the inoperable channel.

Action 3.I7.6.IO - PORV Block Valve position indication inoperable - The PORV block valves are located on top of the pressurizer. During operation at elevated temperatures, the position indication is not accessible for

repair. The PORV block valves are motor operated valves and are not likely to inadvertently change position. They are in series with the PORVs.

During operation at elevated temperatures, when LTOP is not required, operation may continue with only one channel of position indication. When LTOP protection is required, but valve position lights are inoperable, the PCS is accessible and operation may continue if position of the block valves is verified each I2 hours. Inoperable channels must be restored to OPERABLE status prior to the next start up from COLD SHUTDOWN.

II. SWS Break Detector - Flow indicators measuring Service Water System flow into and out of the containment are used to actuate an alarm if in flow significantly exceeds outflow. Such a mismatch could be indicative of a cooler leak or a pipe break. The Break Detector is intended to allow identification of a leaking* cooler by isolation of service water to each cooler in secession until. the alarm clears.---The- Break Detector is -strictly a maintenance aid and is intended to provide no safety function. (Ref. I2)

The SWS Break Detector is required to be OPERABLE at HOT STANDBY and above, when the containment is inaccessible for direct observation of leakage, yet the SWS is required. Specifications 3.0.4 and 4.0.4 are not applicable to the SWS break detector because it does not provide an accident related safety function.

Action 3.I7.6.II - SWS Break Detector inoperable* - If the break detector is inoperable, it must be restored to OPERABLE status prior to the next startup.

B 3.I7-30 Revision: 02/2I/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued)

12. Flux - AT Power Comparator - The Flux - AT Power comparator compares the two Q Power inputs (Excore Power Range flux and AT power) for that RPS channel, provides a meter indicating the difference between these inputs, and initiates an alarm if the difference exceeds a set value. Existence of a significant difference between the monitored signals indicates that either a flux tilt is developing, or that a calibration of the Excore Power Range or AT power circuits is required.

The Flux - AT Power Comparator is not required to be OPERABLE when the reactor is below 2% power because the differential temperature measurement is not meaningful at very low power levels.

Action 3.17.6.12.1 - One Flux - AT Power Comparator channel inoperable -

With one channel inoperable, the three remaining power comparator channels are sufficient to assure that no unobserved flux tilt is developing. The inoperable channel must be restored to OPERABLE status prior to the next reactor startup.

Action 3.17.6.12.2 - Two Flux - AT Power Comparator channels inoperable -

With two power comparator channels inoperable, power must be limited to 70%

of RATED POWER to assure that no unobserved flux tilt causes local power limits to be exceeded.

13. Rod Group Sequence Control/Alarm - The Rod position indication provides two regulating rod group sequence related functions. The PIP, using the signals from primary rod position indication synchros on the selected target rods, provides the actual control of group sequencing relays; the SPI, using the signals from the secondary position indication reed switches on the target rods, provides the Out-of-Sequence Alarm if the target rod position indicated that the group is out of position with respect to the other regulating groups. The Out-of-Sequence alarm provides assurance that the operator is aware of abnormal regulating rod positioning.

When only one control rod is capable of being withdrawn, group sequencing and Out-of-Sequence alarm provide no useful function and are not required.

Action 3;17.6.13 - Group Rod Group Sequence Control/Alarm channel inoperable - When either sequence function is inoperable, one of the methods of assuring correct control rod alignment is not available.

Adequate assurance. of correct rod. positioning** is* retained*" by* manua 1

verification of regulating rod position after each occurrence of rod motion.

14. Concentrated Boric Acid Tank Low Level Alarm - A common "Cone Boric Acid Tank Lo Level" alarm notifies the operator that one boric acid tank is below the required total inventory. There is one level switch mounted on each tank, either of which actuates the common alarm in the control room.

These two switches and the common alarm comprise the required channels .

The Concentrated Boric Acid Tank low level alarm is not required to be OPERABLE when the reactor is at HOT SHUTDOWN or below, because the inventory of boric acid is not require~.

B 3.17-31 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued)

Action 3.17.6.14 - One or Two Cone Boric Acid Tank low level alarm channels inoperable - When either a boric acid tank low level alarm switch or the common alarm is inoperable, the level in the tank or tanks without an operable level alarm should be verified to be within limits each shift.

15. Excore Detector Deviation Alarm - An alarm is derived by the Excore Detector Deviation Alarm channel on excessive flux tilt. The Excore Detector Deviation Alarm compares the combined average power reading of all four Excore Power Range channels to the average from each channel, and alarms if the setpoint is exceeded. One channel being significantly different from the average could indicate a developing Quadrant Power Tilt (Tq).

The Excore Det~ctor Deviation Alarm is required to be OPERABLE above 25%

RATED POWER, when the Tq specification is applicable.

Action 3.17.6.15 - Excore Deviation* Alarm inoperable ~-When the Excore Deviation Alarm is inoperable, continuous monitoring of Tq is unavailable.

The function of Tq monitoring must be maintained by manually calculating Tq each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

16. AXIAL SHAPE INDEX Alarm - The ASI Alarm Channel monitors the ASI using the Excore upper and lower detector signals as inputs and provides an alarm when ASI administrative limits are exceeded .

This alarm is only functional above a nominal 15% indicated power when the High Startup Rate trip is bypassed. It uses the High Startup Rate Pre-Trip Unit to provide the alarm function, and shares the same alarm window. It is not required to *be OPERABLE below 25% RATED POWER.

Action 3.17.6.16 - One or two ASI alarm channels inoperable - The ASI alarm is one function.of the Thermal Margin Monitor. Four channels are provided, but two are sufficient for ASI monitoring. If one or two.channels.are inoperable, they must be restored prior to the next startup from COLD SHUTDOWN.

17. Shutdown Cooling (SOC) Suction Valve Interlocks - Interlocks are provided for each SOC suction valve. These interlocks are pressure switches which prevent opening of the-associated-valv~*when PCS pressure is above the design pressure of the SOC system. One pressure switch is provided for each valve.

The interlocks are required to be OPERABLE when PCS pressure exceeds 200 psia to assure that the SOC System is not over pressurized by inadvertent opening of the suction valves at high PCS pressure.

Action 3.17.6.17 - One or two SOC suction interlocks inoperable - When an interlock is.inoperable assurance that the valve will-not be opened with high PCS pressure is reduced. The circuit breaker for the motor operator on the associated SOC suction valve must be racked out, except during actual operation of the valve. The extra action of having to rack in and

. B 3.17-32 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued) close the breaker prior to valve operation provides protection against

inadvertent valve operation.

18. Power Dependant Insertion Limit (PDIL) Alarm - PDIL Alarms are provided by both the primary and secondary rod position monitors. Each system monitors the position of each regulating group target rod and compares it to a setpoint which is a function of power level. The group deviation alarms assure that the operator is aware of any group misalignment. Maintaining the rods above the PDIL, when the reactor is critical, assures that adequate SHUTDOWN MARGIN is available.

The PDIL alarm is not required at HOT SHUTDOWN and below, since no more than one control rod would be withdrawn and the SHUTDOWN Margin calculation accounts for that.

Action 3.17.6.18 - One PDIL alarm inoperable - With one PDIL alarm inoperable assurance of proper SHUTDOWN MARGIN is reduced; Additional assurance of proper SHUTDOWN MARGIN is provided by verification of proper group position within 15 minutes following any regulating rod motion.

19. Fuel Pool Area Radiation Monitor - The spent fuel pool is provided with two radiation monitors. These instruments provide warning of a release in the case of a fuel handling accident and provide the fuel pool criticality monitoring required by 10 CFR 70.24 .

Action 3.17.6.19 - One or two Fuel Pool Area Monitors inoperable - With one or two Fuel Pool Area Radiation Monitors inoperable, fuel movement in the spent fuel pool area must be stopped. The monitor must be restored to OPERABLE status or equivalent monitoring capability provided within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The Fuel Pool is designed to be adequately subcritical even at zero ppm boron concentration. The specified 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is adequate to repair the installed instrumentation or to provide other monitoring equipment without incurring undue risk of a criticality.

20. Containment Refueling Radiation Monitors - Two radiation monitors are located in the refueling area of the containment which actuate the Containment High Radiation Logic when switched to the refueling mode. In this mode, a high level alarm on either monitor will actuate containment isolation through the associated CHR logic channel.-* The arrangement of these controls is illustrated in reference 7.

Action 3.17.6.20 - One or two Containment Refueling Monitors inoperable -

With one or two Containment Refueling Radiation Monitors inoperable, stop REFUELING OPERATIONS in the containment. This eliminates the possibility of damaging an irradiated fuel bundle.

Action 3.17.6.21 - Required action AND associated completion time not met -

If:any action specified by Action statements 3.17.6.1 through 3.17.6.18 (items 19 and 20 are not associated with reactor operation) is not met AND its completion time has expired, the plant must be placed in a condition where the inoperable equipment is not required. Twelve hours are allowed B 3.17-33 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued) to bring the plant to HOT SHUTDOWN, and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where

the affected equipment is not required, to avoid unusual plant transients.

Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when it is discovered that Action 3.17.21.6 is applicable .

B 3.17-34 Revision: 02/21/94

3.17 INSTRUMENTATION SYSTEMS References for 3 .17 Basis

(1)

(2)

(3)

Updated FSAR, Section 7.2.7.

Updated FSAR, Section 7.2.5.2 Updated FSAR, Figures 7-1 and 7-2 (4) P&ID SIS Logic Diagram E-17, Sh 3 (5) P&ID SIS Logic Diagram E-17, Sh 4 (6) P&ID RAS Logic Diagram E-17, Sh 5 (7) Updated FSAR, Figure 7-37 (8) P&ID CHP Logic Diagram E-17, Sh 6 (9). P&ID CHR Logic* Diagram E-17, Sh 7 (10) P&ID SGLP Logic Diagram E-17, Sh 20

( 11) Updated FSAR, Figure 7-56 (12) Service Water Functional Description, FD-M-111

B 3.17-35 Revision: 02/21/94

4.17 INSTRUMENTATION SYSTEMS TESTS Basis: Instrumentation Systems - Surveillance Requirements 4.17 The Surveillance Requirements listed in Tables 4.17.1 through 4.17.6 provide the periodic testing requirements to assure the OPERABILITY of the instrumentation systems required by Specifications 3.17.1 through 3.17.6, respectively. Typically three surveillance tests are required for each instrument channel: a CHANNEL CHECK, a CHANNEL FUNCTIONAL TEST, and a CHANNEL CALIBRATION. Those instrument channels which are not provided with indicators, such as pressure switch channels, do not have a CHANNEL CHECK specified. Similarly, channels which provide indication only do not have a CHANNEL FUNCTIONAL TEST SPECIFIED. Control channels typically have only a CHANNEL FYNCTIONAL TEST specified.

Basis: Table 4.17.1 CHANNEL CHECK - RPS Input Channels - A CHANNEL CHECK is performed each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months on each RPS trip input channel which is provided with an indicator to provide a qualitative assurance that the channel is working properly and that its readings are within limits. The Containment Pressure and Loss of Load channels are pressure switch actuated; they have no associated control room indicator and do not require a CHANNEL CHECK.

The RPS input channels consist of the following instruments:

Power Range Nuclear Power and Axial Shape Index AT Power and associated PCS temperature channels.

Start Up Rate and Wide Range Power

Pressurizer Pressure Primary Coolant System Flow

. Turbine Generator Auto Stop Oil Pressure Steam Generator Level Steam Generator Pressure Containment Pressure A CHANNEL CHECK is also required each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for the TM/LP calculated setpoint indicator channels.

CHANNEL FUNCTIONAL TEST - RPS Channels - A CHANNEL FUNCTIONAL TEST is performed on each required RPS channel which can be tested at power each 31 days. This test assures that the required automatic functions and alarms are actuated by that channel. Manual Trip, High Startup Rate, and Loss of Load channels are tested prior to each startup rather than each 31 days.

The High Startup Rate Trip is actuated by either of the Wide Range Nuclear Instrument Startup.Rate channels. NI-03 sends a trip_signal to RPS channels "A" and "C"; NI-04 to "B" and "D". Since each Startup Rate channel would cause a trip on two RPS channels, the Startup Rate Trip is not tested when the reactor is critical.

The four Loss of Load Trip channels are all actuated by a single pressure switch monitoring Turbine Auto Stop Oil pressure. It is not testable with the reactor critical. *

The Manual Trip channels are actuated by control room push buttons.

Pressing either button causes a reactor trip. They are not testable with the reactor critical.

B 4.17-1 Revision: 02/21/94

4.17 INSTRUMENTATION SYSTEMS TESTS Basis: Table 4.17.1 (continued)

CHANNEL CALIBRATION - RPS Input Channels - A CHANNEL CALIBRATION is performed on each RPS input channel each 18 months. This test verifies that the accuracy of the channel indication and of its automatic setpoints is within limits. The Excore power and AT power channels have additional calibration requirements:

AT Power and Excore Nuclear Instruments - Heat Balance - A Heat Balance, or "Calorimetric Calculation" is performed each 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to assure that the reactor power indications remain properly calibrated.

The heat balance is not required to be performed when the indicated power level is below 15% of RATED POWER because the measured parameters are not sufficiently steady to provide an accurate result and because, even without recent recalibration, the subject instruments are sufficient to assure no core limits are reached when they indicate less then 15% of RATED POWER.

Excore Power Range - Calibration with Internal Signal -~ A calibration of the excore nuclear instrumentation power range channels using the internal test circuitry must be performed every 31 days.

The RPS input channels consist of the following instruments:

Power Range Nuclear Power and Axial Shape Index AT Power and associated PCS temperature channels.

Start Up Rate and Wide Range Power Pressurizer Pressure Primary Coolant System Flow Turbine Generator Auto Stop Oil Pressure Steam Generator Level Steam Generator Pressure Containment Pressure As part of the CHANNEL CALIBRATION of the Wide Range Nuclear Instrumentation, the automatic removal of the Zero Power Mode Bypass of Low PCS Flow, TM/LP, and Low SG Pressure trips, and of the automatic bypassing of the Loss of Load and High Startup Rate trips must be verified to assure that these trips are available when required.

Thermal Margin Monitor - Verify Constants - This test verifies that the programmable constants used to calculate the setpoints generated by the digi_tal circuitry of the TMM are correct. . It is nearly equivalent- to a CHANNEL FUNCTIONAL TEST on an analog circuit .

B 4.17-2 Revision: 02/21/94

4.17 INSTRUMENTATION SYSTEMS TESTS Basis: Table 4.17.2 CHANNEL CHECK - ESF Input Channels - A CHANNEL CHECK is performed each 12

hours on each ESF input channel which is provided with an indicator to provide a qualitative assurance that the channel is working properly and that its readings are within limits. The Safety Injection and Refueling Water Tank (SIRWT) level channels have no associated control room indicator.

The ESF input channels consist of the following instruments:

Pressurizer Pressure SIRWT Level Steam Generator Level CHANNEL FUNCTIONAL TEST - ESF Channels - A CHANNEL FUNCTIONAL TEST is performed on each ESF channel to verify that it produces the proper outputs.

This test is required to be performed each 31 days on ESF input channels provided with on-line testing capability. It is not required for the SIRWT Level channels since they have no built in test capability. The CHANNEL FUNCTIONAL TEST for SIRWT Level channels is performed each 18 months as part of the required CHANNEL CALIBRATION.

A CHANNEL FUNCTIONAL TEST is performed each 92 days on the SIS logic circuits using the installed test circuits. Logic for SIS both with and without offsite.power*must be tested. When testing the "without power" circuits, proper operation of the DBA sequence and the associated logic circuit must be verified. The test circuits are designed to block those SIS functions, such as injection of concentrated boric acid, which would interfere with plant operation.

A CHANNEL FUNCTIONAL TEST is performed each 92 days on the AFAS logic circuits using the installed test circuits.

A CHANNEL FUNCTIONAL TEST of the complete SIS actuation logic is required each 18 months. The testing required by this surveillance is to insert an actual or simulated low pressure input into the Pressurizer Pressure channels feeding the SIS actuation logic and verify that all automatic normal automatic operations occur as designed. In addition, testing must also verify automatic removal of the low pressure block signal.

A CHANNEL FUNCTIONAL TEST is performed on the remaining ESF channels each 18 months. These functions are not designed for on-line.testing.

CHANNEL CALIBRATION - ESF Input Channels - Performance of a CHANNEL CALIBRATION every 18 months ensures that the channels are operating accurately and within specified tolerances. Operating experience has shown this test interval to be satisfactory.

The ESF input channels consist of the following instruments:*

Pressurizer Pressure SIRWT Level Steam Generator level B 4.17-3 Revision: 02/21/94

4.17 INSTRUMENTATION SYSTEMS TESTS Basis: Table 4.17.3 CHANNEL CHECK - Isolation Function Input Channels - A CHANNEL CHECK is

performed each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months on each Isolation Function input channel which is provided with an indicator to provide a qualitative assurance that the channel is working properly and that its readings are within limits. The Containment High Pressure channels have no associated control room indicator.

The Isolation Function input channels consist of the following instruments:

Containment Pressure Containment Radiation Steam Generator Pressure Engineered Safeguards Pump Room Radiation CHANNEL FUNCTIONAL TEST - Isolation Function Channels - A CHANNEL FUNCTIONAL TEST is performed on each Isolation Function channel to verify that it produces the proper outputs. This test i~ required to be performed each 31 days on ESF input channels.

A CHANNEL FUNCTIONAL TEST is performed each 18 months on the Isolation Function Manual actuation and Logic channels.

CHANNEL CALIBRATION - Isolation Function Input Channels - Performance of a CHANNEL CALIBRATION every 18 months ensures that the channels are operating

acctirately and within specified tolerances. Operating experience has shown this test interval to be satisfactory.

The ESF input channels consist of the following instruments:

Containment Pressure Containment Radiation Steam Generator Pressure Engineered Safeguards Pump Room Radiation Basis: Table 4.17.4 The Accident monitoring channels do not have a CHANNEL FUNCTIONAL TEST specified because their required function is-indication onlyi*--There* are no setpoints or automatic actions required by specification 3.17.4.

CHANNEL CHECK - Accident Monitoring Channels - A CHANNEL CHECK is performed each 31 days on each Accident Monitoring channel indicator to provide a qualitative assurance that the channel is working properly and that its readings are within limits.

CHANNEL CALIBRATION - Accident Monitoring channels - Performance of a CHANNEL CALIBRATION every 18 months ensures that the channels are operating accurately and within specified tolerances. Operating experience has shown this test interval to be satisfactory.

B 4.17-4 Revision: 02/21/94

4.17 INSTRUMENTATION SYSTEMS TESTS Basis: Table 4.17.5 CHANNEL CHECK - Alternate Shutdown indication channels - A CHANNEL CHECK is

performed each 92 days on each Alternate Shutdown indicator channel, except Startup Range and AFW flow, to provide a qualitative assurance that the channel is working properly and that its readings are within limits. The 92 day interval was chosen because completion of a CHANNEL CHECK requires actuating the circuits with the associated transfer switches and thereby deactivating several normal control room channels which share the same detectors. *The CHANNEL CHECK for the Startup Range is discussed below.

AFW flow indicators are excepted because during normal operation there is zero AFW flow and a CHANNEL CHECK would be inconclusive. A CHANNEL CHECK is performed on each AFW flow channel at 18 month intervals as part of the CHANNEL CALIBRATION.

CHANNEL CHECK and CHANNEL FUNCTIONAL TEST - Startup Range - A CHANNEL CHECK and a CHANNEL FUNCTIONAL TEST of the Startup Range is required prior to each reactor startup. The CHANNEL CHECK consists of comparing the remote indication with that from the control room. The Startup* Range provides no alarm or automatic functions; the CHANNEL FUNCTIONAL TEST consists of verifying proper response of the channel to the internal test signals, and verification that a detectable signal is available from the detector.

After lengthy shutdown periods flux may be below the range of the channel indication. Signal verification with test equipment is acceptable.

CHANNEL FUNCTIONAL TEST - Alternate Shutdown Controls Channels - A CHANNEL FUNCTIONAL TEST is performed on each Alternate Shutdown Panel control channel each 18 months to assure its operability. A CHANNEL FUNCTIONAL TEST is performed on the AFW pump suction pressure alarm as part of its CHANNEL CALIBRATION.

CHANNEL CALIBRATION - Alternate Shutdown Indication Channels - Performance of a CHANNEL CALIBRATION every 18 months ensures that the channels are operating accurately and within specified tolerances. Operating experience has shown this test interval to be satisfactory .

B 4.17-5 Revision: 02/21/94

4.17 INSTRUMENTATION SYSTEMS TESTS Basis: Table 4.17.6 CHANNEL CHECK - Other Safety Function indication channels - A CHANNEL CHECK

is performed each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months on each required indicator channel, except the Area Radiation Monitors which are checked each 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , to provide a qualitative assurance that the channel is working properly and that its readings are within limits.

The Acoustic valve position monitors have no indicator, therefore, no CHANNEL CHECK is required.

CHANNEL FUNCTIONAL TEST - Other Safety Function Channels - A CHANNEL FUNCTIONAL TEST is performed on each channel providing automatic actions to verify that it produces the_proper outputs.

This test is required to be performed at least each 18 months. In several cases it is performed as part of the required CHANNEL CALIBRATION. Those channels requiring more frequent testing are discussed below.

CHANNEL FUNCTIONAL TEST - Nuclear Flux Monitoring - The CHANNEL FUNCTIONAL TEST of each Wide Range is required prior to each reactor startup. The CHANNEL FUNCTIONAL TEST consists of verifying proper response of the channel to the internal test signals, and verification that a signal is available from the detector. After lengthy shutdown periods flux may be below the range if the channel indication. Signal verification with test equipment is acceptable .

CHANNEL FUNCTIONAL TEST - Rod Position Indication (CRDM Interlocks) - The ShutdQwn Rod Insertion and Regulating Rod Withdrawal interlock OPERABILITY must be verified within 92 days prior to each reactor startup and prior to startup after each refueling. If these interlocks are inoperable, the associated channel of rod position indication must be declared inoperable.

CHANNEL FUNCTIONAL TEST - Flux-AT Comparator - The alarm function of the Flux-AT Power Comparator must be verified by a CHANNEL FUNCTIONAL TEST each 31 days.

CHANNEL FUNCTIONAL TEST PDIL Alarm - (Setpoint Verification) - Each 31 days the PDIL setpoints for the existing plant power level are verified to assure OPERABILITY of the setpoint calculator.

CHANNEL FUNCTIONAL TEST - Fuel Pool and Containment Area Monitor - Each 31 days the Area Monitor OPERABILITY must* be- verified by -a-- check with* an internal test circuit or with a radioactive source.

CHANNEL CALIBRATION - Other Safety Function Indication Channels -

Performance of a CHANNEL CALIBRATION every 18 months ensures that the channels are operating accurately and within specified tolerances. The level switch actuated alarm channels on the Boric Acid Tanks (BAT) and the Condensate Flow Switches on the Containment Air Coolers do not require a calibration because their mounting assures that they are at the proper location. The required CHANNEL FUNCTIONAL TEST assures their OPERABILITY.

Operating experience has shown this test interval to be satisfactory .

B 4.17-6 Revision: 02/21/94

ATTACHMENT 3 Consumers Power Company Palisades Plant Docket 50-255

INSTRUMENTATION AND CONTROL TECHNICAL SPECIFICATION CHANGE REQUEST Answers to Reviewer's Questions February 22, 1994 4 Pages

Answers to questfons raised at meeting with reviewer (Igbal Ahmed):

0. Q. Discuss reasons for note on page 3-64 which excepts High Startup Rate and Loss of load trips from the requirement to place an inoperable channel in trip if it cannot be repaired.

A. The subject note would allow continued operation for an unlimited period (continuous bypass) with a single channel of either High Startup Rate trip or Loss of load trip bypassed.

I. Existing Palisades allow operation with continuous bypass of a single channel of .9D.Y RPS function, so the note would not constitute a change to or create a condition different from the current licensing basis.

2. Neither of these trips is assumed to function in the safety analyses; both are anticipatory, or equipment protective,

3. The High Startup Rate trip is not usually is service since it is automatically bypassed when the plant is operation above 15%

power. The trip provides no real-function during- shutdown-periods.

4. The instrumentation feeding these trips is not safety grade equipment; two wide range nuclear instrument channels provide the inputs for the four RPS High Startup Rate auxiliary trip units and one turbine Auto Stop Oil pressure switch provides the inputs to the four RPS Loss of Load auxiliary trip units.

5. The following situation was posed by one of our operators:

The plant is operating at full power, when the detector for one of the two Wide Range Nuclear Instrument channels fails:

The proposed Technical Specification, without the subject note, would require a shutdown since the Wide Range detector affects two RPS High Start Up Rate trip channels. While a shutdown is necessary to repair the detector, it makes little sense to shut down early due to loss of a function whose trip is designed to be bypassed at power and which is not credited in the safety analyses during the conditions when it is not bypassed.

A similar lack of urgency applies to the Loss of Load trip, but with some differences .. Since the Loss of--Load trip*i~-not -

bypassed at power, and a single detector feeds all four RPS channels, the trip is not testable during power operation. Those failures which do not cause a reactor trip would probably remain undetected.

The subject note was conceived to avoid an unnecessary shutdown due to a Wide Range Nuclear Instrument channel failure. Since the acceptability of the note was based on the lack of safety analysis credit and the lack of channel separation built into the High Startup Rate trip functions, it seemed appropriate to apply the note to both non-safety grade trip functions.

I

1. Q. Provide diicussion of tompletion time proposed for Action 3.17.3.4 ( 1 or 2 Engineered Safeguards room monitors inoperable).

A. The initially proposed 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time was chosen to allow sufficient time to isolate the Safeguards Room ventilation headers if the failure were to be of a mechanical nature rather than an instrument failure. It is proposed that the Action be reworded to "Initiate Action to isolate ventilation from the associated room immediately." That way an instrument failure would result in closure of the damper very quickly after discovery, yet a mechanical failure would be allowed sufficient time and not necessitate a plant shutdown. As with similar statements in NUREG 1432, "immediately" does not imply instantaneous, rather it implies "start as quickly as plant conditions permit and continue until completed."

The only existing Technical Specification on the Engineered Safeguards Monitors is 3.16, which simply lists the required setpoint, so the proposed action is conservative with respect to existing Technical Specifications.

While existing Palisades Technical Specifications have only a setpoint requirement for the subject monitors, The Off Site Dose Calculation Manual (ODCM) has operability, action, and surveillance requirements for them. The ODCM requirements were formerly in the Radiological Effluent Technical Specifications (RETS) but were relocated to the ODCM by Amendment 154. Since these monitors do meet the criterion of the Commission's interim policy statement on the content of Technical Specifications, it is proposed that they be retained in the Technical Speci fi cations .

These two Radiation instruments each monitor the associated Engineered Safeguards room and close the damper in the ventilation exhaust if the setpoint is exceeded. The ventilation system itself does not provide a safety function. Equipment cooling for DBA conditions is provided by a separate cooler which has its own fans.

The NRC is currently reviewing the updated methodology for our MHA analyses. The associated radiological analyses list separate MHA dose contributions by source. The total dose contributed by leakage within the Engineered Safeguards Rooms is 4.04 rem thyroid (in the stipulated 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) at the site boundary and 4.11 rem thyroid (in the stipulated 30 days) at the low population zone distance. Those values take credit for a factor of 2 reduction in Iodine release due to closure of the subject dampers. With one damper failing to close, assuming that all of the leakage occurs. in the room with the failed-damper~ the dose contributions from Engineered Safeguard rooms would double. The total calculated thyroid dose from all sources would~ then be 19.95 rem at the site boundary and 13.61 rem at the low population zone. The limiting thyroid doses given in 10CFRlOO are 300 rem for each location. Therefore, it can be seen that failure to isolate the Engineered Safeguards Rooms would not cause the plant to exceed 10CFRlOO limits.

2

2. Q. Which current specffitati~ri did Table 3.17.6, #5 (SIRW Tank Temperature) come from?

A. This item is currently found in Table 4.1.2, #17 a. & b. It is a surveillance requirement for which there is no corresponding LCO or Action.

3. Q. Where, in the safety analyses discussion accompanying the Technical Specifications change request, was action statement 3.17.6.13, and the associated equipment, discussed? Is the associated equipment "safety grade"?

A. The Service Water Break Detector is discussed on page 11 under items

9 )last paragraph) and #10.b, and on page 12 under item 13. The Service Water Break Detector is not "safety grade".

4. Q. Why are the applicabilities different for Table 3.17.6, #9 (safety valve position indication) and #10 (PORV position indication) of Table 3.17.4?

A. Item 10 was assigned the same applicability as* the current

specification, (existing Table 3.17.4 #9) and Item 11 applicability was derived from the existing applicability (existing Table 3.17.4

10) with the additional reasoning that PORV position was not terribly important when the plant was in Cold Shutdown (below 210°F at Palisades) where boiling would not occur. Under these conditions, an open or leaking PORV would reduce system pressure and make the Primary Coolant Pumps unavailable, but would not lead to a loss of decay heat removal capability. Both applicability requirements are discussed in the proposed bases, page B 3.17-20 .

5. Q. Was the change in (action 3.17.6.17) specified frequency for calculating Quadrant Power Tilt from 8 to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months discussed in the safety analyses accompanying the Technical Specification change request?

A. Yes, page 5, item #3 .

3

6. Q. Discuss apparent re laxatfon

in the mini mum operab 1e channe 1s of item 15 in Table 3.17.6, the Out of Sequence Monitor.

A. The Out of Sequence Monitor is currently listed as part of item 5, Table 3.17.4:

Table 3.17.4 Instrumentation Operating Requirements for Other Safety Feature Functions Minimum Minimum Permissible Operable Degree of Bypass Functional Unit Channels Redundancy Conditions 5 Primary and Secondary 1 None NA Rod Insertion and Out-of-Sequence Monitors This entry, like others in the current Technical Specifications, is somewhat ambiguous (one of the main reasons for submittal of this change request). It could be taken to require one channel of each:

Primary Rod Insertion Monitor, Secondary Rod Insertion monitor, and Out-of-Sequence Monitor; it could also be taken to require one channel out of the three. The issue is further complicated by the grouping of the "Insertion Monitors" with the Out-of-Sequence Monitor, and by the words "Insertion Monitor" which could refer to either the rod position indication channels or to the Power Dependant Insertion Alarm channels. Palisades has no equipment referred to as an "Insertion Monitor" .

The interpretation, with respect to the "Insertion Monitors" has always been that the requirement was for either Primary or Secondary Rod Position to be operable. That is supported by the "None" entry in the Minimum.Degree of Redundancy column. If the intent had been to require both channels, the Minimum Degree of Redundancy would have been 11 111

This requirement becomes item 2 of proposed Table 3.17.6.

There is, strictly speaking, only one Out-of-Sequence at Palisades.

It is a feature of the secondary rod position indication system which actuates an alarm if the control rod groups move in an incorrect sequence. The primary rod position indication controls the sequencing of the rods, but does not provide an alarm feature.

Reviewing Mr. Ahmed's question, and the related circuit features suggests a better solution:. Item 15 of table-3.17.6-- (and Table--

4.17.6) have been changed, in the attached updated proposed pages, to read "Rod Group Sequence Control/Alarm" with 2 Required channels and 1 minimum operable channel. The basis have been rewritten to explain that either the Primary Rod Position group sequencer control or the Secondary Rod Position group Out-of-Sequence alarm is required and that a compensatory action is required when either is inoperable.

7. Q. Which current specification did Table 3.17.6, #16 (Concentrated Boric Acid Tank Low Level Alarm) come from?*

A. This item is currently found in Table 4.1.2, #14. It is a surveillance requirement for which there is no corresponding LCO or Action.

4

ATTACHMENT 4 Consumers Power Company Palisades Plant Docket 50-255 INSTRUMENTATION AND CONTROL TECHNICAL SPECIFICATION CHANGE REQUEST Suggested Page Change Instructions

February 22, 1994 1 Page

ATTACHMENT TO LICENSE AMENDMENT NO.

FACILITY OPERATING LICENSE NO. DPR-20 DOCKET NO. 50-255 Revise Appendix A, Technical Specifications, by removing the pages identified below and inserting the attached pages. The revised pages are identified by amendment number and contain vertical lines indicating the areas of change.

CORRECTED PAGES REMOVE INSERT i

ii ii iii iii iv iv 1-1 1-1 1-2 1-2 l-2a 1-3 1-3 1-4 1-4 1-5 1-5 1-6

2-2 B 2-5 3-1 3-40 2-2 B 2-5 3-1 3-lac 3-40 3-49 through 3-75 3-49 through 3-63 B 3.16-1 through B 3.16-3 3-76 through 3-82 3-64 through 3-78 B 3.17-1 through B 3.17-35 3-83 through 3-136 3-79 through 3-89 4-1 through 4-15d 4-1 through 4-15 4-39 4-39 4-40 4-40 ...

4-41 4-41 4-45 4-45 4-47 through 4-88 4-75 through 4-85

ML18059A694

Contents

Text

1.2 DESCRIPTION

10.2 DESCRIPTION

2.1 DESCRIPTION

18.2 DESCRIPTION

Navigation menu

ML18059A694

Text

1.2 DESCRIPTION

10.2 DESCRIPTION

2.1 DESCRIPTION

18.2 DESCRIPTION

Navigation menu

Search