Text

Amend 162 to License DPR-20,completing Rewrite of Instrumentation Operability Requirements & Bases
	ML20076N029
Person / Time
Site:	Palisades
Issue date:	10/26/1994
From:	Hannon J; Office of Nuclear Reactor Regulation
To:	;
Shared Package
ML20076N031	List: ML20076N029; ML20076N034;
References
	NUDOCS 9411090141
	Download: ML20076N029 (132)
	v • d • e

i# "%t4 C

y-t UNITED STATES E

' NUCLEAR REGULATORY COMMISSION f

WASHINGTON, D.C. 20555-0001

,s,...../

CONSUMERS POWER COMPANY DOCKET NO. 50-255 PALISADES PLANT AMENDMENT TO FACILITY OPERATING LICENSE Amendment No.

162 License No. DPR-20 1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Consumers Power Company (the licensee) dated November 15, 1991, supplemented February 22, March 11, April 7, and August 23, 1994, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act),

and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with_ the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can-be conducted without endangering the health and safety of.the public; and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to the license amendment and Paragraph 2.C.(2)-of Facility Operating License No. DPR-20 is hereby amended to read as follows:

9411090141 941026 ADOCK050002]5 DR

r Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No.162, and the Environmental Protection Plan contained in Appendix B are hereby incorporated in the license. The licensee shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

i 3.

This license amendment is effective as of the date of issuance and is to be implemented within 90 days.

FOR THE NUCLEAR REG LATORY COMMISSION b

ohn N. Hannon, Director Project Directorate 111-1 Division of Reactor Projects - III/IV Office of Nuclear Reactor Regulation

Attachment:

Changes to the Technical Specifications i

Date of Issuance: October 26, 1994 l

i

ATTACHMENT TO LICENSE AMENDMENT NO. 162 FACILITY OPERATING LICENSE NO. DPR-20 DOCKET NO. 50-255 1

Revise Appendix A Technical Specifications by removing the pages identified below and inserting the attached pages. The revised pages are identified by amendment number and contain vertical lines indicating the areas of change.

1 REMOVE INSERT i

i 11 11 iii iii l

iv iv 1-1 1-1 l-2 1-2 1-2a 1-3 1-3 1-4 1-4 1-5 1-5 1-6 2-2 2-2 B 2-5 B 2-5

(

3-1 3-1 3-lac 3-40 3-40 3-49 through 3-75 3-49 through 3-63 B 3.16-1 through B 3.16-3 j

3-76 through 3-82 3-64 through 3-78 B 3.17-1 through B 3.17-35 1

3-83 through 3-136 3-79 through 3-89 4-1 through 4-15e 4-1 through 4-15 4-39 4-39 4-40 4-40

)

4-41 4-41 i

4-45 4-45 4-47 through 4-88 4-75 through 4-82 B 4.17-1 through B 4.17-6 4-83 through 4-85 j

l l

y 4

i I

PALISADES PLANT t

i FACILITY OPERATING LICENSE DPR-20 APPENDIX A i

I t

TECHNICAL SPECIFICATIONS I

)

P As Amended Through Amendment No. 162

PALISADES PLANT TECHNICAL SPECIFICATIONS IABLE OF CONTENTS SECTION' DESCRIPTION PAGE NO 1.0

' DEFINITIONS 1-1 1.1 OPERATING DEFINITIONS 1-1 1.2 MISCELLANE0US DEFINITIONS 1-5 3

2.0 SAFETY LIMITS AND LIMITING SAFETY SYSTEM SETTINGS 2-1 l

2.1 SAFETY LIMITS - REACTOR CORE 2-1 2.2 SAFETY LIMITS - PRIMARY COOLANT SYSTEM PRESSURE 2-1 2.3 LIMITING SAFETY SYSTEM SETTINGS - RPS 2-1 Table 2.3.1 Reactor Protective System Trip Setting Limits 2-2 B2.1 Basis - Reactor Core Safety Limit B 2-1 B2.2 Basis - Primary Coolant System Safety Limit B 2-2 B2.3 Basis - Limiting Safety System Settings B 2-3 3.0 LIMITING CONDITIONS FOR OPERATION 3-1 3.0 APPLICABILITY 3-1 3.1 PRIMARY COOLANT SYSTEM 3-lb 3.1.1 Operable Components 3-lb Figure 3-0 ASI vs Fraction of Rated Power 3-3a 3.1.2 Heatup and Cooldown Rates 3-4 Figure 3-1 Pressure - Temperature Limits for Heatup 3-9 Figure 3-2 Pressure - Temperature Limits for Cooldown 3-10 Figure 3-3 Pressure - Temperature Limits for Hydro 3-11 3.1.3 Minimum Conditions for Criticality 3-12 3.1.4 Maximum Primary Coolant Radioactivity 3-17 3.1.5 Primary Coolant System Leakage Limits 3-20 3.1.6 Maximum PCS 0xygen and Halogen Concentration 3-23 3.1.7 Primary and Secondary Safety Valves 3-25 3.1.8 Over Pressure Protection Systems 3-25a 3.1.9 Shutdown Cooling 3-25h 3.2 CHEMICAL AND VOLUME CONTROL SYSTEM 3-26 3.3 EMERGENCY CORE COOLING SYSTEM 3-29 3.4 CONTAINMENT COOLING 3-34 3.5 STEAM AND FEEDWATER SYSTEMS 3-38 3.6 CONTAINMENT SYSTEM 3-40 Table 3.6.1 Containment Penetrations and Valves 3-40b 3.7 ELECTRICAL SYSTEMS 3-41 3.8 REFUELING OPERATIONS 3-46 3.9 Deleted 3-49 l

6 I

i Amendment No. 162

i PALISADES PLANT TECHNICAL SPECIFICATIONS TABLE OF CONTENTS SECTION DESCRIPTION PAGE N0 3.0 LIMITING CONDITIONS FOR OPERATION (continued) 3-1 3.10 CONTROL R0D AND POWER DISTRIBUTION LIMITS 3-50 3.10.1 Shutdown Margin Requirements 3-50 3.10.2 Deleted 3-51 3.10.3 Part-Length Control Rods 3-51 3.10.4 Misaligned or Inoperable Rod 3-52 3.10.5 Regul atino Group Insertion Limits 3-52 3.10.6 ShutdownkodLimits 3-53 3.10.7 Low Power Physics Testing 3-53 3.10.8 Center Control Rod Misalignment 3-53 Figure 3-6 Centrol Rod Irisertion Limits 3-55 3.11 POWER DISTRIBUTION INSTRUMENTATION 3-56 3.11.1 Incore Detectors 3-56 3.11.2 Excore Power Distribution Monitoring System 3-57 Figure 3.11-1 Axial Variation Bounding Condition 3-59 3.12 MODERATOR TEMPERATURE COEFFICIENT OF REACTIVITY 3-60 3.13 Deleted 3-60 3.14 CONTROL ROOM VENTILATION 3-61 3,15 REACTOR PRIMARY SHIELD COOLING SYSTEM 3-62 3.16 ESF SYSTEM INITIATION INSTRUMENTATION SETTINGS 3-63 Table 3.16.1 ESF System Initiation Instrument Setting Limits 3-63 B3.16 Basis - ESF System Instrumentation Settings B 3.16-1 3.17 INSTRUMENTATION AND CONTROL SYSTEMS 3-64 3.17.1 Reactor Protective System Instruments 3-64 Table 3.17.1 Instrument Requirements for RPS 3-65 3.17.2 Engineered Safety Features Instruments 3-66 Table 3.17.2 Instrument Requirements for ESF Systems 3-67 3.17.3 Isolation Functions Instruments 3-68 Table 3.17.3 Instrument Requirements Isolation Functions 3-69 3.17.4 Accident Monitoring Instruments 3-70 Table 3.17.4 Instrument Requirements for Accident Monitoring 3-71 3.17.5 Alternate Shutdown System Instruments 3-72 Table 3.17.5 Instruments for the Alternate Shutdown System 3-73 3.17.6 Other Safety Feature Instruments 3-74 Table 3.17.6 Instruments for Other Safety Features 3-77 B3.17 Basis - Instrumentation Systems B 3.17-1 3.18 Deleted 3-79 3.19 IODINE REMOVAL SYSTEM 3-79 3.20 SHOCK SUPPRESSORS (Snubbers)T HEAVY LOADS 3-80 3.21 CRANE OPERATIONS AND MOVEMEN 3-81 3.22 Deleted 3-84 3.23 POWER DISTRIBUTION LIMITS 3-84 3.23.1 Linear Heat Rate 3-84 Table 3.23.1 Linear Heat Rate Limits 3-86 Table 3.23.2 Radial Peaking Factor Limits 3-86 Table 3.23-3 Power Distribution Measurement Uncertainty 3-86 Figure 3.23-1 Allowable LHR vs Peak Power Location 3-87 3.23.2 Radial Peaking Factors 3-88 3.23.3 Quadrant Power Tilt - Tq 3-89 11 Amwndment No. 162

PALISADES PLANT TECHNICAL SPECIFICATIONS TABLE OF CONTENTS SECTION DESCRIPTION PAGE N0 4.0 SURVEILLANCE REQUIREMENTS 4-1 4.1 OVER PRESSURE PROTECTION SYSTEM TESTS 4-6 4.2 EQUIPMENT AND SAMPLING TESTS 4-7 Table 4.2.1 Minimum Frequencies for Sampling Tests 4-9 Table 4.2.2 Minimum Frequencies for Equipment Tests 4-11 Table 4.2.3 HEPA Filter and Charcoal Adsorber Systems 4-14 4.3 SYSTEMS SURVEILLANCE 4-16 Table 4.3.1 Primary Coolant System Pressure Isolation Valves 4-19 Table 4.3.2 Miscellaneous Surveillance Items 4-23 4.4 Deleted 4-24 4.5 CONTAINMENT TESTS 4-25 4.5.1 Integrated Leakage Rate Tests 4-25 4.5.2 Local Leak Detection Tests 4-27 4.5.3 Recirculation Heat Removal Systems 4-28a 4.5.4 Surveillance for Prestressing System 4-29 4.5.5 End Anchorage Concrete Surveillance 4-32 4.5.6 Contcinment Isolation Valves 4-32 4.5.7 Deleted 4-32a 4.5.8 Dome Delamination Surveillance 4-32a 4.6 SAFETY INJECTION AND CONTAINMENT SPRAY SYSTEMS TESTS 4-39 4.6.1 Safety Injection System 4-39 4.6.2 Containment Spray System 4-39 4.6.3 Pumps 4-40 4.6.4 Valves 4-39 I

4.6.5 Containment Air Cooling System 4 4.7 EMERGENCY POWER SYSTEM PERIODIC TESTS 4-42 4.7.1 Diesel Generators 4-42 4.7.2 Station Batteries 4-42 4.7.3 Emergency Lighting 4-43 4.8 MAIN STEAM STOP VALVES 4-44 4.9 AUXILIARY FEEDWATER SYSTEM 4-45 4.10 REACTIVITY AN0MALIES 4-46 4.11 Deleted 4-46 4.12 AUGMENTED'ISI PROGRAM FOR HIGH ENERGY ulNES 4-60 4.13 Deleted 4-65 4.14 AUGMENTED ISI PROGRAM FOR STEAM GENERATORS 4-66 4.15 PRIMARY SYSTEM FLOW MEASUREMENT 4-70 4.16 ISI PROGRAM FOR SH0CK SUPPRESSORS (Snubbers) 4-71 4.17 INSTRUMENTATION SYSTEMS TESTS 4-75 Table 4.17.1 Surveillance for the RPS 4-76 Table 4-17.2 Surveillance for ESF Functions 4-77 Table 4-17.3 Surveillance for Isolation Functions 4-78 Table 4-17.4 Surveillance for Accident Monitoring 4-79 Table 4-17.5 Surveillance for Alternate Shutdown 4-80 Table 4-17.6 Surveillance for Other Safety Functions 4-81 B4.17 Basis - Instrumentation Systems Surveillance B 4.17-1 l

iii Amendment No. 162 t

PALISADES PLANT TECHNICAL SPECIFICATIONS TABLE OF CONTENTS SECTION DESCRIPTION PAGE N0 4.0 SURVEILLANCE REOUIREMENTS (Continued) 4.18 POWER DISTRIBUTION INSTRUMENTATION 4-83 4.18.1 Incore Detectors 4-83 4.18.2 Excore Monitoring System 4-83 4.19 POWER DISTRIBUTION LIMITS 4-84 4.19.1 Linear Heat Rate 4-84 4.19.2 Radial Peaking Factors 4-84 4.20 MODERATOR TEMPERATURE COEFFICIENT (MTC) 4-85 5.0 DESIGN FEATURES 5-1 5.1 SITE 5-1 5.2 CONTAINMENT DESIGN FEATURES 5-1 5.2.1 Containment Structures 5-1 5.2.2 Penetrations 5-2 5.2.3 Containment Structure Cooling Systems 5-2 5.3 NUCLEAR STEAM SUPPLY SYSTEM (NSSS) 5-2 5.3.1 Primary Coolant System 5-2 5.3.2 Reactor Core and Control 5-3 5.3.3 Emergency Core Cooling System 5-3 5.4 FUEL STORAGE 5-4 5.4.1 New Fuel Storage 5-4 5.4.2 Spent Fuel Storage 5-4a Figure 5-1 Site Environment TLD Stations 5-5 6.0 ADMINISTRATIVE CONTROLS 6-1 6.1 RESPONSIBILITY 6-1 6.2 ORGANIZATION 6-1 6.2.1 Offsite and Onsite Organizations 6-1 6.2.2 Plant Staff 6-2 6.3 PLANT STAFF QUALIFICATIONS 6-3 Table 6.2-1 Minimum Shift Crew Composition 6-4 6.4 TRAINING 6-5 6.5 REVIEW AND AUDIT 6-5 6.5.1 Plant Review Committee 6-5 6.5.2 Nuclear Performance Assessment Department 6-6a 6.5.3 Plant Safety and Licensing 6-9 iv Amendment No. 162

TECHNICAL SPECIFICATIONS 1.0 DEFINITIONS The following terms are defined for uniform interpretstion of these Technical Specifications.

1.1 OPERATING DEFINITIONS l

ASSEMBLY RADIAL PEAKING FACTOR - F,^

{

ASSEMBLY RADIAL PEAKING FACTOR shall be the maximum ratio of the power generated in any fuel assemblyll be integrated over core height and to the average fuel assembly power.

(Each of these power terms sha shall include tilt.)

AVERAGE DISINTEGRATION ENERGY - E AVERAGE DISINTEGRATION ENERGY shall be the average (weighted in ll proportion to the concentration of each radionuclide in the reactor coolant at the time of sampling) of the sum of the average beta and gamma energies per disintegration (in MEV)inutes, making up at least 95%

for isotopes, other than iodines, with half lives greater than 15 m of the total noniodine activity in the coolant.

AXIAL 0FFSET or AXIAL SHAPE INDEX - A0 or ASI AXIAL OFFSET or AXIAL SHAPE INDEX shall be the ratio of the power generated in the lower half of the core minus the power generated in the upper half of the core, to the sum of those powers.

1 CHANNEL CALIBRATION A CHANNEL CALIBRATION shall be the adjustment, as necessary, of the channel output such that it responds with the necessary range and accuracy to known values of the parameter which the channel monitors.

1 The CHANNEL CALIBRATION shall encompass the entire channel including the sensor, alarm, interlock, and trip functions, and shall include the CHANNEL FUNCTIONAL TEST. The CHANNEL CALIBRATION may be performed by any series of sequential overlapping, or total channel steps such that theentirechanneliscalibrated. Neutron detectors may be excluded from CHANNEL CALIBRATIONS.

1 CHANNEL CHECK A CHANNEL CHECK shall be the qualitative assessment of channel behavior during operation by observation. This determination shall include, where possible, comparison of the channel indication and status with other indications and status derived from independent instrument channels measuring the same parameter. A CHANNEL CHECK shall include verification that the monitored parameter is within limits imposed by i

the Technical Specifications.

Amendment No. 31, 13, 54, 57, SS, 118, 124, 123, 137, 162 1-1

l 1.1-OPERATING DEFINITIONS (continued)

CHANNEL FUNCTIONAL TEST I

A CHANNEL FUNCTIONAL TEST shall be the injection of a simulated signal into the channel to verify that it is OPERABLE, including any alarm and i

trip initiating function.

l 1

COLD SHUTDOWN l

The COLD SHUTDOWN condition shall be when the primary coolant is at SHUTDOWN BORON CONCENTRATION and T.,, is less than 210*F.

CONTAINMENT INTEGRITY l

CONTAINMENT INTEGRITY is defined to exist when all the following are true:

a.

All nonautomatic containment isolation valves and blind flanges are closed (OPERABLE) except as noted in Table 3.6.1.

l b.

The equipment hatch is properly closed and sealed.

c.

At least one door in each personnel air lock is properly closed and sealed.

d.

All automatic containment isclation valves are OPERABLE (as demonstrated by satisfying isolation times specified in Table 3.6.1 and leakage criterion in Specification 4.5.2) or are locked closed.

l e.

The uncontrolled containment leakage satisfies Specification 4.5.

CONTROL RODS l

CONTROL RODS shall be all full-length shutdown and regulating rods..

DOSE E0VIVALENT I 131 DOSE EQUIVALENT I-131 shall be that concentration of I-131 (yci/gm which alone would produce the same thyroid dose as the quantity and) isotopic mixture of I-131, I-132, I-133, I-134 and I-135 actually present. The thyroid dose conversion factors used for this calculation shall be those listed in Table III of TID-14844, " Calculation of Distance Factors for Power and Test Reactor Sites."

i HOT SHUTDOWN l

The HOT SHUTDOWN condition shall be when the reactor is subcritical by an amount greater than or equal to the margin as s Specification 3.10 and T,,, is greater than 525'F. pecified in Technical Amendment No. 31, 43, Si, 57, 58, 118, 121, 128, 137, 162 1-2

- = -

l 1.1

OPERATING DEFINITIONS (continued) l f

i HOT STANDBY

[

The HOT STANDBY condition shall be when T,The neutron flux power is greater than 525'F and any of the CONTROL RODS are withdrawn and instrumentation indicates less than 2% of RATED POWER.

[

LOW POWER PHYSICS TESTING LOW POWER PHYSICS TESTING shall be testing performed under approved written procedures.to determine CONTROL ROD worths and other core nuclear properties. Reactor power during these tests shall not exceed 3

2% of RATED POWER, not includinfo 538'F and 415 psia G 2150 psia,l decay heat and PCS T and PCS pressure shall be in the range of 371*F respectively. Certain deviations from normal operating practice which i

are necessary to enable performing some of these tests are permitted in accordance with the specific provisions in these Technical l

Specifications.

i OPERABLE - OPERABILITY l

A system, subs stem, train, component, or device shall be OPERABLE, or have OPERABILI Y when it is capable of performing its specified functions andwb electrical power,en all necessary attendant instrumentation, controls, cooling, equipment that are required for the system, subsystem, train, component, or device to perform its specified functions are also capable of performing their related support functions.

j POWER OPERATION The POWER OPERATION condition shall be when the reactor is critical and l

the neutron flux power range instrumentation indicates greater than 2%

i of RATED POWER.

OVADRANT POWER TILT - T, QUADRANT POWER TILT shall be the algebraic ratio of quadrant power minus average quadrant power, to average quadrant power.

RATED POWER RATED POWER shall be a steady state reactor core output of 2530 MW,.

]

REACTOR CRITICAL The reactor is considered critical for purposes of administrative contral when the neutron " flux wide range channel instrumentation l

indicates greater than 10 % of RATED POWER.

Amendment No. 31, 13, 50, 57, SS, 110, 124, 123, 137, 162 l-3

-m-

l 1.1 OPERATING DEFINITIONS (continued)

REFUELING BORON LONCENTRATION REFUELING BORON CONCENTRATION shall be a Primary Coolant System boron concentration of at least 1720 ppm AND sufficient to assure the reactor is subcritical by 2 5% Ap with all CONTROL RODS withdrawn.

REFUELING OPERATION A REFUELING OPERATION shall be any operation involving movement of core components (except for incore detectors) when the reactor vessel head is untensioned or removed with fuel in the reactor vessel.

REFUELING SHUTDOWN l

The REFUELING SHUTDOWN condition shall be when the primary coolant is at REFUELING BORON CONCENTRATION and T,,,, is less than 210*F.

SHUTDOWN BORON CONCENTRATION SHUTDOWN BORON CONCENTRATION shall be a Primary Coolant System boron concentration sufficient to assure the reactor is subcritical by 2 2% Ap with all CONTROL RODS in the core and the highest worth CONTROL R00 fully withdrawn.

SBUTDOWN MARGIN SHUTDOWN MARGIN shall be the instantaneous amount of reactivity by which the reactor is subcritical or would be subcritical from its present condition assuming that all CONTROL RODS are fully inserted except for the single highest worth CONTROL R0D which is assumed to be withdrawn.

TOTAL RADIAL PEAKING FACTOR -F/

The TOTAL RADIAL PEAKING FACTOR shall be the maximum product of the ratio of individual assembly power to core average assembly power, times the highest local peaking factor integrated over the total core height, including tilt.

Local peaking factor is defined as the maximum ratio of an individual fuel rod power to the assembly average rod power.

Amendment No. 31, 13, Si, 57, SS, IIS, 124, 128, 137, 143, 162 1-4 i

1.2 MISCELLANE0US DEFINITIONS l

MEMBER (S) 0F THE PUBLIC MEMBER (S) 0F THE PUBLIC shall include all persons who are not occupation-ally associated with the plant.

This category does not include employees of the utility, its contractors, or its vendors. Also excluded from this category are persons who enter the site to service equipment or to make deliveries.

OFFSITE DOSE CALCULATION MANUAL (00CM)

The OFFSITE DOSE CALCULATION MANUAL shall contain the current methodology and parameters used in the calculation of offsite doses due to radioactive gaseous and liquid effluents, in the calculation of gaseous and liquid effluent monitoring alarm and trip setpoints, and in the conduct of the Radiological Environmental Monitoring Program.

The ODCM shall also contain the (11 Radioactive Effluent Controls and Radiological Environmental Monhtoring Programs required by Specification 6.8.4 and (2) Environmental Operating Report and the Radioactive Effluent descriptions of the information to be included in the-Radiological Release Report required by Specification 6.9.3.

PROCESS CONTROL PROGRAM The PROCESS CONTROL PROGRAM shall contain the current formula, sampling, analyses, tests, and determinations to be made to ensure that the processing and packaging of solid radioactive wastes based on demonstrated processing of actual or simulated wet solid wastes will be accomplished in such a way as to assure compliance with 10 CFR 20, 10 CFR 71, Federal and State regulations, and other requirements governing the disposal of the radioactive waste.

SITE B0UNDARY The SITE B0UNDARY shall be that line beyond which the land is neither owned nor otherwise controlled by the licensee.

UNRESTRICTED AREA An UNRESTRICTED AREA shall be any area at or beyond the SITE B0UNDARY access to which is not controlled by the licensee for purposes of protection of individuals from exposure to radiation and radioactive materials or, any area within the SITE BOUNDARY used for residential quarters or for industrial, commercial, institutional, or recreational purposes.

Amendment No. 85, 154, 162 1-5

TABLE-2.3.1 REACTOR PROTECTIVE SYSTEM TRIP SETTING LIMITS Four Primary Coolant Three Primary Coolant RPS Trio Unit Pumos Ooeratina Pumos Operatina 1.

Variable High s15% above core power, s15% above core power Power with a minimum of with a minimum of s30% RATED POWER s15% RATED POWER and a maximum of and a maximum of s106.5% RATED POWER.

549% RATED POWER.

)

l 2.

PCS Flow 295% Full PCS Flow.

260% Full PCS Flow, 3.

High Pressure s2255 psia.

s2255 psia.

Pressurizer 4.

Thermal Margin /

(a)

Low Pressure 5.

Steam Generator 225.9%

225.9%

Low Water Level Narrow Range Narrow Range 6.

Steam Generator 2500 psia.

2500 psia.

Low Pressure 7.

Containment High s3.70 psig.

s3.70 psig.

Pressure f

(a)

The pressure setpoint for the Thermal Margin / Low Pressure Trip, P,,,, is 1

the higher of two values, P,in and P,r, both in psia:

y P,in 1750

=

P,, - 2012(QA)(QR ) + 17.0(T ) - 9493 y

i in i

where:

QA

= -0.720(ASI) + 1.028; when -0.628 s ASI < -0.100 QA

= -0.333(ASI) + 1.067; when -0.100 s ASI < +0.200 QA

= +0.375(ASI) + 0.925; when +0.200 s ASI s +0.565 ASI Measured ASI when Q 2 0.0625

=

ASI 0.0 when Q < 0.0625 0.412(Q) + 0.588; when Q s 1.0 QR 3

QR Q;

when Q > 1.0

=

3 Core Power / RATED POWER Q

=

Maximum primary coolant inlet temperature, in 'F.

T,n ASI, T, and Q are the existing values as measured by the associated in instrument channel.

Amendment No. M, 80, 444, BB, MO,162 2-2

.. ~.

2.0 BASIS - Safety Limits and Limitina Safety System Settinas 2.3 Basis - Limitina Safety System Settinas (continued) 5.

Low Steam Generator Water Level - The low steam generator water level reactor trip protects against the loss of feed-water flow accidents and assures that the design pressure of the primary coolant system will not be exceeded.- The specified set point assures that there will be sufficient water inventory in the steam generator at the time of trip-to allow a safe and orderly plant shutdown and to preven steam generator dryout assuming minimum auxiliary feedwater capacity.g3 The 25.9% narrow range minimum setting listed in Table 2.3.1 assures that the heat transfer surface (tubes) is covered with water when the reactor is critical. The 25.9% indicated level corresponds to the location of the feed ring, at 46.7" above the lower instrument tap. The narrow range instrument spans 180" for its 100% range.

6.

Low Steam Generator Pressure - A reactor trip on low steam generator secondary pressure is provided to protect against an excessive rate of heat extraction from the steam generators and subsequent cooldown of the primary coolant.

The setting of 500 psia is sufficiently below the rated load operating point of 739 psia so as not to interfere with normal operation, but still high enough to provide the required protection in the event of excessiv was used in the accident analysis.(,e,1y high steam flow.This setting 1

7.

Containment Hiah Pressure - A reactor trip on containment high pressure is provided to assure that the reactor is shutdown bef re the initiation ofthesafetyinjectionsystemandcontainmentspray.'p)

References (1)

EMF-92-178, Revision 1, Table 15.0.7-1 (2) Updated FSAR, Section 7.2.3.3.

(3)

EMF-92-178, Revision 1, Section 15.0.7-1 (4) XN-NF-86-91(P)

(5) ANF-90-078, Section 15.1.5 (6) ANF-87-150(NP), Volume 2, Section 15.2.7 (7) Updated FSAR, Section 7.2.3.9.

(8) ANF-90-078, Section 15.2.1 Amendment No. M, M, H B, H 7, M O, M 6, H 9, 162 B 2-5

)

LIMITING CONDITIONS FOR OPERATION

)

3.0 APPLICABILITY 3.0.1 Compliance with the Limiting Conditions for Operation contained in the i

succeeding Specifications is required during the plant conditions or other conditions specified therein; except that upon-failure to meet the Limiting Conditions for Operation, the associated action requirements shall be met.

3.0.2 Noncompliance with a Specification shall exist when the requirements of the Limiting Condition for Operation and associated action requirements are not met within the specified time intervals.

If the Limiting Condition for Operation is restored prior to expiration of the specified time intervals, completion of the action requirements is not required.

3.0.3 When a Limiting Condition for Operation and/or associated action requirements cannot be satisfied because of circumstances in excess of those addressed in the specification, within one hour action shall be initiated to place the unit in a condition in which the Specification does not apply by placing it, as applicable, in:

1.

At least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , 2.

At least HOT SHUTDOWN within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and 3.

At least COLD SHUTDOWN within the subsequent 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Where corrective measures are completed that permit operation under the action requirements, the action may be taken in accordance with the specified time limits as measured from the time of failure to meet the Limiting Condition for Operation.

Exceptions to these requirements are stated in the individual Specifications.

3.0.4 Entry into a reactor operating condition or other specified condition shall not be made when the conditions for the Limiting Conditions for Operation are not met and the associated action requires a shutdown if they are not met within a specified time interval.

Entry into a reactor operating condition or other specified condition may be made in accordance with action requirements when conformance to them permits continued operation of the facility for an unlimited period of time.

This provision shall not prevent passage through or to reactor operating conditions as required to comply with action requirements.

Exceptions to these requirements are stated in the individual specifications.

3.0.5 Equipment removed from service or declared inoperable to comply with action requirements may be returned to service under administrative control solely to perform testing required to demonstrate its OPERABILITY or the OPERABILITY of other equipment.

This is an exception to Specification 3.0.1 for the system returned to service under administrative control to perform the testing required to demonstrate OPERABILITY.

3-1 Amendment No. 31, 85, 130, 162

1 LIMITING CONDITIONS FOR OPERATION 3.0 BASIS (Continued)

Specification 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service i

or declared inoperable to comply with action requirements. The sole purpose 1

of this Specification is to provide an exception to Specification 3.0.1 (e.g., to not comply with the applicable action requirements to allow the i

performance of surveillance testing to demonstrate:

a.

The OPERASILITY of the equipment being returned to service; or b.

The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to service in conflict with the action requirements is limited to the-time necessary to perform the required surveillance. This Specification does not allow performance of any other preventive or corrective maintenance.

An example of demonstrating the OPERABILITY of the equipment being returned i

to service is reopening a containment isolation valve that has been closed to comply with action requirements and must be reopened to perform the i

surveillance.

1 An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of a surveillance test on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of a surveillance test on another channel in the same trip system.

1 i

3-lac i

Amendment No. 162

-3.6

.(pNTAINMENT SYSTEM Acolicability Applies to the reactor containment building..

Ob.iective To assure the integrity of the reactor containment building.

. Soecifications

+

3.6.1 Containment Intearity Cont'ainment integrity as defined in Specification 1.0 shall not be l

l a.

violated unless the reactor is in the cold shutdown condition.

b.

Containment integrity shall not be violated when the reactor vessel i

head is removed unless the boron concentration is greater than refueling concentration.

c.

Except for testing one rod at a time, positive reactivity changes shall not be made by CONTROL R0D motion or boron dilution unless l

l the containment-integrity is intact.

j ACTION:

With one or more containment isolation velves inoperable (including during performance of valve testing), maintain.at least one isolation

- valve operable in each affected penetration that is open and either:

a.

Restore the inoperable valves to operable status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , or i

b.

Isolate each affected penetration within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months by use of at least one deactivated automatic valve. secured in the isolation position, or j

c.

Isolate the affected penetration within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months by use of at least one closed manual valve or blind flange; or d.

Be in at least hot shutdown within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in cold shutdown within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

BASIS The operability of the containment isolation valves ensures that the containment atmosphere will be isolated from the outside environment in the event of a release of radioactive material to the containment atmosphere or pressurization of the containment.

i i

3-40 Amendment No. H B, 162 1

i

1 l

i 3.8 REFUELING OPERATIONS (Continued) required.

Valve alignment check sheets are completed to protect against sources of unborated water or draining of the system.

References (1)

FSAR, Section 9.11.

(2)

FSAR, Section 3.3.2.

(3)

FSAR, Amendment No. 17, Item 13.0.

(4)

FSAR, Amendment No. 17, item 9.0.

(5)

FSAR, Apendix J.

l l3.9 Deleted

)

l Amendment No. 01, 05, 154, 162 3-49

. '.4.

3.10 CONTROL R0D AND POWER DISTRIBUTION LIlillE Acolicability Applies to operation of CONTROL RODS and hot channel factors during l

operation.

Obiective To specify limits of CONTROL R0D movement to assure an acceptable power l

distribution during power operation, limit worth of individual rods to values analyzed for accident conditions, maintain adequate shutdown margin after a reactor trip and to specify acceptable power limits for power tilt conditions.

Soecifications 3.10.1 Shutdown Marcin Reauirements a.

With four primary coolant pumps in operation at hot shutdown and above, the shutdown margin shall be 2%.

b.

With less than four primary coolant pumps in operation at hot shutdown and above, boration shall be immediately initiated to increase and maintain the shutdown margin at 23.75%.

c.

At less than the hot shutdown condition, with at least one primary coolant pump in operation or at least one shutdown cooling pump in i

operation, with a flow rate 22810 gpm, the boron concentration i

shall be greater than the cold shutdown boron concentration for normal cooldowns and heatups, ie, non-emergency conditions.

{

l During non-emergency conditions, at less than the hot shutdown i

condition with no operating primary coolant pumps and a primary system recirculating flow rate < 2810 gpm but 2 650 gpm, then within one hour either:

i 1.

(a)

Establish a shutdown margin of 2 3.5% and (b) Assure two of the three charging pumps are electrically disabled.

OR 2.

At least every 15 minutes verify that no charging pumps are operating.

If one or more charging pumps are determined to be operating in any 15 minute surveillance period, terminate charging pump operation and insure that the shutdown margin requirements are met and maintained.

Amendment No. 31, 13, 57, 50, 70, 118, 162 3-50

y J

l

3.10 CONTROL R0D AND POWER DISTRIBUTION LIMITS (Continued) 3.10.1 Shutdown Marain Reauirements (Continued)

During non-emergency conditions, at less than the hot shutdown condition with no operating primary coolant pumps and a primary system recirculating flow rate less than 650 gpm, within one hour:

(a)

Initiate surveillance at least every 15 minutes to verify that no charging pumps are operating.

If one or more charging pumps are determined to be operating in any 15-minute surveillance period, terminate charging pump i

operation an insure that the' shutdown margin requirements are met and maintained.

l d.

If a CONTROL R0D cannot be tripped, shutdown margin shall be increased by boration as necessary to compensate for the worth l

of the withdrawn inoperable CONTROL ROD.

l e.

The drop time o# each CONTROL R00 shall be no greater than 2.5 seconds from the beginning of rod motion to 90% insertion.

3.10.2 (Deleted) 3.10.3

.Part-lenath Control Rods The part-length control rods will be completely withdrawn from the core (except for control rod exercises and physics. tests).

i 1

1 Amen /, ment No. 21, 118, 162 3-51

3.10 CONTROL R0D AND POWER DISTRIBUTION LIMITS (Cont'd) 3.10.4 Misalioned or Inocerable CONTROL R00 or Part-Lenath Rod l

a.

A CONTROL R00 or a part-length rod is considered misaligned if l

it is out of position from the remainder of the bank by more than 8 inches.

b.

A CONTROL R00 is considered inoperable if it cannot be moved l

by its operator or if it cannot be tripped. A part-length rod is.onsidered inoperable if it is not fully withdrawn from the core and cannot be moved by its operator.

If more than one CONTROL R0D or part-length rod becomes misaligned or l

inoperable, the reactor shall be placed in the hot shutdown condition within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

c.

If a CONTROL R0D or a part-length rod is misaligned, hot l

channel factors must promptly be shown to be within design limits or reactor power shall be reduced to 75% or less of RATED POWER within two hours.

In addition, shutdown margin i

l and individual rod worth limits must be met.

Individual rod worth calculations will consider the effects of xenon redistribution and reduced fuel burnup in the region of the misaligned CONTROL R00 or part-length rod.

l 3.10.5 Reaulatina Group Insertion limits a.

To implement the limits on shutdown margin, individual rod worth and hot channel factors, the limits on CONTROL R0D l

regulating group insertion shall be established as shown on Figure 3-6.

The 4-pump operation limits of Figure 3-6 do not apply for decreasing power level rapidly when such a decrease is needed to avoid or minimize a situation harmful to the plant personnel or equipment. Once such a power decrease is achieved, the limits of Figure 3-6 will be returned to by borating the CONTROL RODS above the insertion limit within two l

hours.

Limits more restrictive than Figure 3-6 may be implemented during fuel cycle life based on physics calculations and physics data obtained during plant start-up and subsequent operation.

New limits shall be submitted to the NRC within 45 days.

b.

The sequence of withdrawal of the regulating groups shall be 1, 2, 3, 4.

c.

An overlap of control banks in excess of 40% shall not be permitted.

d.

If the reactor is subcritical, the rod position at which criticality could be achieved if the CONTROL RODS were l

withdrawn in normal sequence shall not be lower than the insertion limit for zero ptwer shown on Figure 3-6.

Amendment No. M, M,162 3-52

3.10

.QfNTROL ROD AND POWER DISTRIBUTION LIMITS (Cont'd) 3.10.6 Shutdown Rod Limitt All shutdown rods shall be withdrawn before any regulating rods are a.

withdrawn.

b.

The shutdown rods shall not be withdrawn until normal water level is established in the pressurizer.

c.

The shutdown rods shall not be inserted below their exercise limit until all regulating rods are inserted.

3.10.7 Low Power Physics Testina Sections 3.10.1.a, 3.10.1.b, 3.10.3, 3.10.4.b, 3.10.5 and 3.10.6 may be deviated from during low power physics testing and CRDM exercises if necessary to perform a test but only for the time necessary to perform the test.

l 3.10.8 Center CONTROL R00 Misalianment The requirements of Specifications 3.10.4.1, 3.10.4.a, and 3.10.5 may be suspended during the performance of physics tests to determine the isothermal temperature coefficient and power coefficient provided that l

only the center CONTROL R0D is misaligned and the limits of Specification 3.23 are maintained.

flu.11 l

Sufficient CONTROL RODS shall be withdrawn at all times to assure that the reactivity decrease from a reactor trip provides adequate shutdown margin.

The available worth of withdrawn rods must include the reactivity defect of power and the failure of the withdrawn rod of highest worth to insert. The requirement for a shutdown margin of 2.0% in reactivity with 4-pump operation, and of 3.75% in reactivity with less than 4-pump operation, is consistent with the assumptions used in the analysis of accident conditions (including steam line break) as reported in Reference 1 and additional an& lysis. Requiring the boron concentration to be at cold shutdown boron concentration at less than hot shutdown assures adequate shutdown margin exists to ensure a return to power does not occur if an unanticipated cooldown accident occurs. This requirement applies to normal operating situations and not during emergency conditions where it is necessary to perform operations to mitigate the consequences of an accident.

By imposing a minimum shutdown cooling pump flow rate of 2810 gpm, sufficient time is provided for the operator to terminate a boron dilution under asymmetric conditions.

For operation with no primary coolant pumps operating and a recirculating flow rate less than 2810 gpm the increased shutdown margin and controls on charging pump operability or alternately the surveillance of the charging pumps will ensure that the acceptance criteria, for an inadvertent boron dilution event will not be violated."' The change in insertion limit with reactor power shown on Figure 3-6 insures that the shutdown margin requirements for 4-pump operation is met at all power levels.

The 2.5-second l

drop time specified for the CONTROL RODS is the drop time used in the transient analysis."'

Amendment No. 41, 54, 57, 58, IIS, 137, 162 3-53

3.10 CONTROL R0D AND POWER DISTRIBUTION LIMITS (Continued)

Basis (Continued)

The insertion of part-length rods into the core, except for rod exercises or physics tests, is not permitted since it has been demonstrated on other CE plants that design power distribution envelopes can, under some circumstances, be violated by using part-length rods. Further information may justify their use. Part-length rod insertion is permitted for physics tests, since resulting power distributions are closely monitored under test conditions.

Part-length rod insertion for rod exercises (approximately 6 inches) is permitted since this amount of insertion has an insignificant effect on power distribution.

For a CONTROL R0D misaligned up to 8 inches from the remainder of the banks, hot channel factors will be well within design limits. If a CONTROL R0D is misaligned by more than 8 inches, the maximum reactor power will be reduced so that hot channel factors, shutdown margin and ejected rod worth limits are met.

If in-core detectors are not available to measure power distribution and rod misalignments >8 inches exist, then reactor power must not exceed 75%

of RATED POWER to insure that hot channel conditions are met.

l Continued operation with that rod fully inserted will only be permitted if the hot channel factors, shutdown margin and ejected rod worth limits are satisfied.

In the event a withdrawn CONTROL R00 cannot be tripped, shutdown margin l

requirements will be maintained by increasing the boron concentration by an amount equivalent in reactivity to that CONTROL R0D. The deviations permitted by Specification 3.10.7 are required in order that the CONTROL R0D worth values used in the reactor physics calculations, the plant safety analysis, and the Technical Specifications can be verified.

These deviations will only be in effect for the time period required for the test being performed.

The testing interval during which these deviations will be in effect will be kept to a minimum and special operating precautions will be in effect during these deviations in accordance with approved written testing procedures.

Violation of the power dependent insertion limits, when it is necessary to rapidly reduce power to avoid or minimize a situation harmful to plant personnel or equipment, is acceptable due to the brief period of time that such a violation would be expected to exist, and due to the fact that it is unlikely that core operating limits such as thermal margin and shutdown margin would be violated as a result of the rapid rod insertion. Core thermal margin will actually increase as a result of the rapid rod insertion.

In addition, the required shutdown margin will most likely not be violated as a result of the rapid rod insertion because present power dependent insertion limits result in shutdown margin in excess of that required by the safety analysis.

References (1) ANF-90-078 Amendment No. 31, 13, 57, SS, 110, 1 9, 162 3-54

j TWO OR THREE PUMP OPERATION 3

60 g

i A

50 8

.i

[!

MAXRAJM POWER LEVEL 5,,

k 20

\\

< 10 0

0 20 40 6

80 10 0 0

20 40 -

-O

.0 O,

O ho 40 g 60 80 10 0 cour=x. noo meanr==, penccur FOUR PUMP OPERATION 10 0 90 80 3

N w

N

\\

60 mo hN J.,

\\

30 N

s" N

N O

20 40N @ 80

@ 40 00 10 0 0

20 0

20 40 s'O 10'O cowmot noo assimoM. MmCawr pausAoss moums CONTROL ROO INSERTION LIMfTS TECHNICAL SPECincATION 3-6 Amendment No. 21, 31, 113, 162 1

3-55

3.11 POWER DISTRIBUTION INSTRUMENTATION 3.11.1 INCORE DETECTORS LIMITING CONDITION FOR OPERATION The incore detection system shall be operable:

a.

With at least 160 of the 215 possible incore detectors and 2 incores per axial level per core quadrant.

b.

With the incore alarming function of the datalogger operable and alarm set points entered into the datalogger.

APPLICABILITY (1)

Item a. above is applicable when the incore detection system is used for:

Measuring quadrant power tilt, Measuring radial peaking factors, Measuring linear heat rate (LHR), or Determining target Axial Offset (A0) and excore monitoring allowable power level.

(2)

Items a. and b. above are applicable when the incore detection system is used for monitoring LHR with automatic alarms. (Incore Alarm System.)

ACTION 1:

With less than the required number of incore detectors, do not use the system for the measuring and calibration functions under (1) above.

ACTION 2:

With the alarming function of the datalogger inoperable, do not use the system for automatic monitoring of LHR (Inoperable Incore Alarm System).

operation may continue using the excore monitoring system as specified in 3.11.2 or by meeting the requirements of 3.23.1.

Basis The operability of the incore detectors with the specified minimum complement of equipment ensures that the measurements obtained from use of this system accurately represent the spatial neutron flux distribution of the reactor core. The operability of the incore alarm system depends on the availability of the datalogger as well-as the operability of a minimum number of incore detectors.

Incore alarm set points must be updated periodically based on measured power distributions. The incore detector Channel Check is normally performed by an off-line computer program that correlates readings with one another and with computed power shapes in order to identify inoperable detectors.

Amendment No. 50, SS, 58, 144, 162 3-56

3.11 POWER DISTRIBUTION INSTRUMENTATION

'3.11.2 EXCORE POWER DISTRIBUTION MONITORING SYSTEM LIMITING CONDITION FOR OPERATION The excore monitoring system shall be OPERABLE with:

a.

_The target AXIAL OFFSET (AO) and the Excore Monitoring Allowable Power Level (APL) determined within the previous 31 days of power operation using the incore detectors, and the measured A0 not deviated from the target A0 by more than 0.05 in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b.

The A0 measured by the excore detectors calibrated with the A0 measured by the incore detectors.

c.

The quadrant tilt measured by the excore detectors calibrated with I

ti:e quadrant tilt raeasured by the incore detectors.

APPLICABILITY:

(1)

Items a., b. and c. above are applicable when the excore detectors 2

are used for monitoring LHR.

(2)

Item c. above is applicable when the excore detectors are used for monitoring quadrant tilt.

]

(3)

Item b., above is applicable for each channel of the TM/LP trip and the AXIAL SHAPE INDEX (ASI) alarm.

j ACTION 1:

With the excore monitoring system inoperable, do not use the system for monitoring LHR.

ACTION 2:

If the measured quadrant tilt has not been calibrated with the incores, do not use the system for monitoring quadrant tilt.

ACTION 3:

When the difference between the excore and the incore measured AXIAL 0FFSET exceeds 0.02, the TM/LP trip function and the ASI alarm setpoints shall be conservatively adjusted within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or that channel shall be declared inoperable.

ACTION 4:

When the difference between the excore and the incore measured QUADRANT POWiR TILT exceeds 27., calculate the QUADRANT POWER TILT at least once each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months using symmetric incore detectors.

Amendment No. 43, 50, 58, SS, !!S, 162 3-57 e

3.11 POWER DISTRIBUTION INSTRUMENTATION l

3.11.2 EXCORE POWER DISTRIBUTION MONITORING SYSTEM LIMITING CONDITION FOR OPERATION Basis The excore power distribution monitoring system consists of Power Range Detector Channels 5 through 8.

The OPEPABILITY of the excore monitoring system ensures that the assumptions employed in the PDC-II analysis"' for determining A0 limits that ensure operation within allowable LHR limits are valid.

Surveillance requirements ensure that the instruments are calibrated to agree with the incore measurements and that the target A0 is based on the current operating conditions. Updating the Excore Monitoring APL ensures that the core LHR limits are protected within the 10.05 band on A0. The APL considers LOCA based LHR limits, and factors are included to account for changes in radial power shape and LHR limits over the calibration interval.

The APL is determined from the following:

APL = [

] x RATED POWERmi i

LHR(Z)u, x V(Z) x 1.02 um Where:

(1) LHR(Z)Ts is the limiting LHR vs Core Height (from i

Section 3.23.1),

(2)

LHR(Z)u, is the measured peak LHR including uncertainties

)

vs Core Height, (3) V(Z) is the function (shown in Figure 3.11-1),

(4) The factor of 1.02 is an allowance for the effects of upburn, (5) The quantity in brackets is the minimum value for the entire core at any elevation (excluding the top and bottom 10% of core) considering limits for peak rods.

If the quantity in brackets is greater than one, the APL shall be the RATED POWER level.

References (1) XN-NF-80-47 (2)

EMF-91-177 Amendment No. 43, 50, SS, SS, 11S, 143, 162 3-58 4

3.11 POWER DISTRIBUTION INSTRUMENTATION AXlAL VARIATION BOUNDING CONDITION 1.25

)

1 1.2 1.15 g

m t

N 1.1 (0.77, 1.11) 1.05 1

I 0.95 O

0.2 0.4 0.6 0.8 1

Fraction of Active Fuel Height FIGURE 3.11-1 Amendment No. 68, 162 3-59

f 3.12 MODERATOR TEMPERATURE COEFFICIENT OF REACTIVIJJ j

Applicability Applies to the moderator temperature coefficient of reactivity for the j

Core.

1 Ob.iective To specify a limit for the positive moderator coefficient.

Specifications The moderator temperature coefficient (MTC) shall be less positive than

+0.5 x 10 Ap/*F at s 2% of RATED POWER.

l Bases The limitaticns on moderator temperature coefficient (Mg) remain valid.

are provided to ensure that the assumptions used in the safety analysis Reference (1) EMF-92-178 Section 15.0.5 3.13 Deleted Amendment No. 111, 118, 137, 143, 155, 162 3-60 l

3.14 CONTROL ROOM VENTILATION Acolicability This specification applies to the control room ventilation rystem.

T Obiective The operability of the control room ventilation system ensures that (1) the ambient air temperature does not exceed the allowable temperature for continuous duty rating for the equipment and instrumentation cooled by this system, and (2) the control room will remain habitable for Operations personnel during and following all credible accidents.

Specifications.

a.

If the control room air temperature reaches 120*F, immediate action shall be taken to reduce this temperature or to place the reactor in a hot shutdown condition.

b.

The control room ventilation system, consisting of two fans and a filter ystem, shall be operable. With both fans inoperable or the filter system inoperable, restore the system to operable status within 3) days or be in cold shutdown within the next 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

Basis The reactor protective system and the engineered safeguards system were designed for and the instrumentation was tested at 120*F. Therefore, if the temperature of the control room exceeds 120*F, the reactor will be shut down and the condition corrected to preclude failure of components in an untested environment. The control room ventilation systems are independent except for the charcoal filter and associated equipment. The charcoal filter system is designed to provide filtered makeup air to the control room following a design base accident and is not used during normal operation.

4 I

Amendment No. 81, 162 3-61

3.15 REACTOR PRIMARY SHIELD COOLING SYSTEM Apolicability Applies to the shield cooling system.

Ob.iective To assure the concrete in the reactor cavity does not overheat and-develop excessive thermal stress.

Soecification One shield cooling pump and cooling coil shall be in operation whenever cooling is required to maintain the temperature of the concrete below approximately 165'F.

Basis The shield cooling system is used to maintain the concrete temperature below 165'F, thus preventing weakening of the structure through loss of moisture.

The structure must remain intact during a DBA to preclude damage to the reactor building sump and the plugging of the suction lines to the engineered e

safeguards pumps. One pump and cooling coil is more than adequate to remove the 120,000 Btu /hr heat load at RATED POWER operation.'"

l Reference (1) FSAR, Section 9.2.1.

l Amendment No. 81, 162 3-62

._~

3.16 ENGINEERED SAFETY FEATURES SYSTEM INSTRUMENTATION SETTINGS Specification i

3.16 The Engineered Safety Features (ESF) system instrumentation setting limits shall be as stated in Table 3.16.

Auolicability Specification 3.16 is applicable when associated ESF or Isolation Function instrumentation is required to be OPERABLE by Specification 3.17.2 or 3.17.3.

Action 3.16.1 If an ESF instrument setting is not within the allowable settings of

. Table 3.16, immediately declare the instrument inoperable and complete corrective action as directed by specification 3.17.

TABLE 3.16 Enaineered Safety Features System Instrument Settinas Instrument Channel Allowable Value 1.

Pressurizer low Pressure 2 1593 psia 2.

Containment High Pressure 3.70 - 4.40 psig 3.

Containment High Radiation s 20 R/h 4.

Steam Generator low Pressure 2 500 psia 5.

Steam Generator Low Level 2 25.9%

Narrow Range 6.

SIRW Tank Low Level 21 - 27 inches Above Tank Bottom 7.

Engineered Safeguards Pump Room s 2.2 x 10' cpm Ventilation High Radiation Amendment No. 80, 162 3-63

t 3.16 ESF SYSTEM INSTRUMENTATION SETTINGS Basis:

ESF System Instrumentation Settings 3.16 Specification 3.16 assures that the ESF instruments will be adjusted to the proper setpoints during plant operation. The specified setpoints support assumptions used in the safety analyses. The instruments are required to be in proper adjustment whenever they are assumed to be OPERABLE.

If an e

instrument channel is required to be OPERABLE by specification 3.17, and its setpoint does not agree with the specified allowable value the channel must be declared to be inoperable. The completion time of "immediately" does not mean " instantaneously", rather it implies " start as quickly as plant conditions permit and continue until completed."

Basis: Table 3.16 1.

Pressurizer low Pressure - The pressurizer low pressure signals are combined in two trains of 2 out of 4 logic to initiate a Safety Injection Signal (SIS) in each train. SIS is also actuated by a CHP signal or manual action in the same train.

SIS starts High Pressure and Low Pressure Safety Injection Pumps and actuates the required valves to initiate safety injection flow to the PCS.

It also shifts the containment air coolers to the accident mode of operation.

The setpoint was chosen so as to be low enough to avoid actuation during plant operating transients, but to be high enough to be quickly actuated by a loss of Coolant Accident (LOCA) or Main Steam Line Break (MSLB).

The settings include an uncertainty allowance of -22 p"sia and are the settings assumed in the Loss of Coolant Accident analysis.

2.

Containment Hiah Pressure - The containment high pressure signals are combined in two trains of 2 out of 4 logic to initiate a Containment High Pressure (CHP) signal in each train. CHP actuates SIS, initiates Containment Spray, closes containment isolation valves, switches control room ventilation to the emergency mode of operation, and isolates the main feed and main steam lines from the steam generators.

The setpoint was chosen so as to be high enough to avoid actuation by containment temperature or atmospheric pressure changes, but low enough to be quickly actuated by a LOCA or a MSLB in the containment.

3.

Containment Hiah Radiation - Four area monitors in the containment are connected in two trains of 2 out of 4 logic to initiate an Containment High Radiation (CHR) signal in each train. CHR is also initiated by a manual action in each train.

CHR closes containment isolation valves, disables auto start of the Engineered Safeguards Room sump pumps, and switches control room ventilation to the emergency mode.

The setpoint is based on the maximum primary coolant leakage to the containment atmosphere allowed by Specification 3.1.5 and the maximum activity allowed by Specification 3.1.4.

N" concentration reaches equilibrium in containment atmosphere due to its short half-life, but other activity was assumed to build up. At the end of a 24-hour leakage period the dose rate is approximately 20 R/h as seen by the area monitors. A large leak could cause the area dose rate to quickly exceed the 20 R/h setting and initiate CHR.

B 3.16-1 Amendment No. 162

3.16 ESF SYSTEM INSTRUMENTATION SETTINGS Basis: Table 3.16 (continued) 4.

Steam Generator low Pressure - A separate Steam Generator Low Pressure (SGLP) signal is provided from each generator. The individual channel signals from each generator are combined in 2 out of 4 logic to initiate a SGLP signal for that generator.

Each SGLP signal actuates closure of both Main Steam Isolation Valves (MSIVs) and closure of the feed water regulating valve and its bypass for the associated generator.

The setpoint was chosen to be low enough to avoid actuation during plant operation, but be close enough to full power operating pressure to be actuated quickly in the event of a MSLB. The setting of includes a -22 psi uncertaintyallowanceandwasthesettingusedintheFSARSection14 analysis.'

5.

Steam Generator low level - The Auxiliary Feedwater Actuation Signal (AFAS) is initiated by 2 out of 4 low level signals occurring for either steam generator. The setpoint is the same as that for Reactor Trip. The setpoint was chosen to assure that Auxiliary Feedwater Flow would be initiated while the steam generator could still act as a heat sink and steam source, and to assure that a reactor trip would not occur on low level without the actuation of Auxiliary Feedwater.

6.

SIRW Tank Low Level - Four SIRWT level sensors are arranged to provide two independent Recirculation Actuation Signals.

Each low level sensors is powered from a separate Preferred AC bus; thus two are ultimately powered from each station battery.

Each Recirculation Actuation Signal (RAS) circuit is wired with the contacts from the pair of level sensors powered from the same battery in parallel.

These two parallel circuits are wired in series, producing a "I out of 2 taken twice" logic.

RAS for each train is actlated by either switch from the left battery sensing low level concurrently with either switch from the right battery. This circuit is illustrated in-reference 3.

The RAS signal is actuated by separate sensors from those which provide tank level indication. The allowable range of 21" to 27" above the tank floor corresponds to 1.1% to 3.3% indicated level.

Typically the actual setting is near the midpoint of the allowable range.

Each RAS actuates the valves in the injection and spray pump suction lines for the associated train switching the water supply from the SIRW tank to the containment sump for a recirculation mode of operation.

The time required to reach the RAS setpoint depends on the initiating event.

Following a DBA, RAS would occur after a period of approximately 20 minutes. The setpoint was chosen to provide adequate water in the containment sump for HPSI pump net positive suction head following an accident, but prevent the pumps from running dry during the 60 second switchover.

B 3.16-2 Amendment No. 162 i

3.16 ESF SYSTEM INSTRUMENTATION SETTINGS Basis: Table 3.16 (continued) 7.

Enaineered Safeauards Pumo Room Ventilation Hiah Radiation - A single radiation monitor is installed in each rooms outlet duct to provide an isolation signal upon high radioactivity levels.

The setting is based on dose levels at the site boundary. The design exhaust ventilation rate of 2400 cfm was assumed along with a 1 gpm. leak rate into the room. The leaking fluid was assumed to be primary coolant (81,800 gallons) at the maximum allowable activity (Specification 3.1.4), diluted with SIRW tank water (285,000 gallons) and Safety Injection Tank water (7,480 gallons). An average beta energy was calculated for each nuclide to convert individual isotopic activities to count rates measured by the monitor.

Fuel i

melting was not assumed to occur. The resultant count rate is about 2.2 x 10' cpm. Normal background for this monitor is expected to be < 1000 cpm.

j i

References (1) FSAR, Section 14.17.

(2) FSAR, Section 14.14.

(3) P&ID RAS Logic Diagram E-17, Sh 5 4

l i

l B 3.16-3 Amendment No. 162 l

i

i 3.17 INSTRUMENTATION SYSTEMS Soecification 3.17.1 Four Reactor Protective System (he f) unctions listed in Table 3.17.1, and RPS trip unit channels and the associated instrumentation for t 6 matrix logic channels and 4 initiation logic channels shall be OPERABLE except as allowed by the. permissible operational bypasses column.

Aeolicability Specification 3.17.1 applies when there is fuel in the reactor, more than one CONTROL ROD is capable of being withdrawn, and the PCS is less than REFUELING BORON CONCENTRATION.

Action 3.17.1.1 With one Manual Reactor Trip channel inoperable:

a)

Restore the channel to OPERABLE status prior to the next reactor startup.

3.17.1.2 With one RPS trip unit or associated instrument channel inoperable for one or more functions:

a)* Place the affected trip unit in the tripped condition within 7 i

days.

3.17.1.3 With two RPS trip units or associated instrument channels inoperable for-one or more functions:

a)

Place one inoperable trip unit in the tripped condition within I hour, and b)

If two Power Range Nuclear Instrument channels are inoperable, limit power to s 70% RATED POWER within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , and c)* Restore one RPS trip unit and associated instrument channel to OPERABLE status within 7 days.

3.17.1.4 With one RPS Matrix Logic channel inoperable:

a)

Restore the channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3.17.1.5 With one RPS Initiation Logic channel inoperable:

a)

De-energize-the affected clutch power supplies within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

3.17.1.6 If any action required by 3.17.1 is not met AND the associated completion time has expired, or if the number of OPERABLE channels is less than specified in the " Minimum OPERABLE Channels":

a)

The reactor shall be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and b)

The reactor shall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

These Actions are not required for inoperable High Startup Rate or Loss of Load instrument channels.

Amendment No. 162 3-64 l

3.17 INSTRUMENTATION SYSTEMS Table 3.17.1 Instrumentation Operatino Reauirements for Reactor Protective System Required Minimum Permissible RPS OPERABLE Operational Functional Unit Channels Channels Bvoasses 1.

Manual Trip 2

1 None.

2.

Variable High Power 4

2 None.

3.

High Start Up Rate 4

2*

Below 10 %" or d

above 13% RATED POWER.

4.

Thermal Margin /

4 2

(b) & (c).

Low Pressure 5.

High Pressurizer 4

2 None.

Pressure 6.

Low PCS Flow 4

2 (b) & (c).

7.

Loss of Load'd' 4

2 Below 17% RATED POWER.

8.

Low "A" Ste m 4

2 None.

Generator Level 9.

Low "B" Steam 4

2 None.

Generator Level 10.

Low "A" Steam 4

2 (b) & (c).

Generator Pressure 11.

Low "B" Steam 4

2 (b) & (c).

Generator Pressure 12.

High Containment 4

2 None.

Pressure 15.

RPS Matrix Logic 6

5 None.

14.

RPS Initiation Logic 4

3 None.

(a) Two OPERABLE Wide Range Nuclear Instrument channels are required if the Zero Power Mode bypass is used.

(b)

Below 10 %" RATED POWER and at SHUTDOWN BORON CONCENTRATION for the COLD SHUTDOWN condition.

(c)

For LOW POWER PHYSICS TESTING, setpoint may be increased from 10'N to 10'%; SHUTDOWN BORON CONCENTRATION is not required.

(d)

Loss of Load not required to be OPERABLE when below 17% RATED POWER.

Amendment No. 118, 130, 136, 162 3-65

3.17 INSTRUMENTATION SYSTEMS Specification 3.17.2 The Engineered Safety Feature (ESF) logic channels and associated instrumentation for the functions listed in Table 3.17.2 shall be OPERABLE except as allowed by the permissible operational bypasses column.

Acolicabiitty Specificat;on 3.17.2 applies when the PCS temperature is 2 300*F.

Action 3.17.2.1 With one ESF manual control channel or ESF logic channel inoperable for one or more functions:

a)

Restore the channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3.17.2.2 With one ESF instrument channel inoperable for one or more functions, except SIRWT Level:

a)

Place the trip unit for each affected ESF function in the tripped condition within 7 days.

3.17.2.3 With two ESF instrument channels inoperable for one or more functions, except SIRWT Level:

a)

Place one channel trip unit for each affected ESF function in the tripped condition within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , and b)

Restore one channel to OPERABLE status within 7 days.

3.17.2.4 With one SIRWT Level channel inoperable:

a)

Bypass the level switch within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , and b)

Restore the channel to OPERABLE status within 7 days.

3.17.2.5 With one or more Emergency Power Sequencers inoperable:

a)

Declare the associated Diesel Generator inoperable, immediately.

3.17.2.6 If any action required by 3.17.2 is not met AND the associated completion time has expired, or if the number of OPERABLE channels is less than specified in the " Minimum OPERABLE Channels":

a)

The reactor shall be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and b)

The reactor shall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Amendment No. 162 3-66

3.17 INSTRUMENTATION SYSTEMS Table 3.17.2 Instrumentation Ooeratina Reauirements for Enaineered Safety Features Required Minimum Permissible ESF OPERABLE Operational Functional Unit Channels Channels Bvoasses 1.

Safety In.iection Sianal (SIS) a.

Manual Initiation 2

1 None.

b.

SIS Logic 2

1 None.

(Initiation, Actuation,and low pressure block auto reset) c.

CHP Signal SIS Initiation 2

1

.None.

(5P Relay Output) d.

Pressurizer Pressure 4

2 s 1700 psia Instrument Channels PCS pressure.

2.

Recirculation Actuation Sianal (RAS) a.

Manual Initiation 2

1 None.

t b.

RAS Logic 2

1 None.

f c.

SIRWT Level Switches 4

3 None.

3.

Auxiliary Feedwater Actuation Sianal (AFAS) a.

Manual Initiation 2

1

None, b.

AFAS Logic 2

1 None.

c.

"A" Steam Generator Level 4

2 None.

d.

"B" Steam Generator Level 4

2 None.

4.

Emeroency Power Seauencers a.

DBA Sequencer 2

1 None.

b.

Normal Shutdown Sequencer 2

1 None.

Amendment No. 162 3-67

3.17 INSTRUMENTATION SYSTEMS Soccification 3.17.3 The Isolation Function logic channels and associated instrumentation for the functions listed in Table 3.17.3 shall be OPERABLE except as allowed by the permissible operational bypasses column.

Aeolicability Specification 3.17.3 applies when the PCS is above COLD SHUTDOWN.

Action 3.17.3.1 With one Isolation Function manual control or Isolation Function logic channel inoperable for one or more functions:

a)

Restore the channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3.17.3.2 With one Isolation Function instrument channel inoperable for one or more functions:

a)

Place the trip unit for each affected Isolation Function in the tripped condition within 7 days.

3.17.3.3 With two Isolation Function instrument channels inoperable for one or more functions:

a)

Place one channel trip unit for each affected Isolation Function in the tripped condition within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , and b)

Restore one channel to OPERABLE status within 7 days.

l 3.17.3.4 With one or two Engineered Safeguards Room Radiation Monitors inoperable.

a)

Initiate action to isolate ventilation from the associated room immediately.

3.17.3.5 If any action required by 3.17.3 is not met AND the associated completion time has expired, or if the number of OPERABLE channels is i

less than specified in the " Minimum OPERABLE Channels":

a)

The reactor shall be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and b)

The reactor shall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Amendment No. 162 3-68

3.17-INSTRUMENTATION SYSTEMS Table 3.17.3 Instrumentation Operatino Reauirements for Isolation Functions.

Required Minimum Permissible Isolatien OPERABLE Operational Functional Unit Channels Channels Bvoasses

1. Containment Hiah Pressure (CHP)

a. CHP logic Trains 2

1 None.

b. Containment Pressure 4

2 None.

Switches - Left Train 1

c. Containment Pressure 4

2 None.

Switches - Right Train

2. Containment Hiah Radiation (CHR)

a. Manual Initiation 2

1 None.

b. CHR Logic Trains 2

1

None,

c. Containment Area 4

2 None.

Radiation Monitors

3. Steam Generator low Pressure (SGLP)

a. Manual Actuation 1 set / train 1 set None.

b. SGLP Logic Trains 2

1

< 550 psig Steam Pressure.

c.

"A" Steam Generator 4

2

< 550 psig Pressure Steam Pressure, d.

"B" Steam Generator 4

2

< 550 psig Pressure Steam Pressure.

4. Enaineered Safeauards Pumo Room Hiah Radiation a.

East Room Monitor 1

0 None.

b.

West Room Monitor 1

0 None.

s Amendment No. 162 3-69

3.17 INSTRUMENTATION SYSTEMS Soecification 3.17.4 The Accident Monitoring Instruments listed in Table 3.17.4 shall be OPERABLE. (Specifications 3.0.3, 3.0.4, and 4.0.4 do not apply.)

Acolicabi'<tv Spec fication 3.17.4 applies when the PCS temperature is > 300*F.

Action 3.17.4.1 With one required channel of functions 1 through 14 inoperable for one i

or more functions:

1 a)

Restore channel to OPERABLE status within 7 days.

3.17.4.2 With two required channels of functions 1 through 14 inoperable for one or more functions:

a)

Restore one channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3.17.4.3 With position indication inoperable for one or more Containment Isolation Valves:

a)

Restore the indication to OPERABLE status or lock the associated valves in the closed position within 7 days.

3.17.4.4 If any action required by 3.17.4.1 throu associated completion time has expired, gh 3.17.4.3 is not met AND the a)

The reactor shall be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and b)

The reactor shall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3.17.4.5 With one channel of functions 16 through 21 inoperable for one or more functions:

a)

Restore the channel to OPERABLE status within 7 days.

3.17.4.6 With two required channels of functions 16 through 21 inoperable f or one or more functions:

a)

Restore one channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

3.17.4.7 If any action required by 3.17.4.5 or 3.17.4.6 is not met AND the associated completion time has expired:

a)

With two CETs in any one quadrant inoperable, complete Action 3.17.4.4 in lieu of Action 3.17.4.7 c),

i b)

With two RVWL channels inoperable, initiate alternate monitoring within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , c)

Submit a report to the NRC within 30 days after the event, outlining the action taken, the cause of the inoperability, and the plans and schedule for restoring the channels to OPERABLE status; and d)

Restore the channels to OPERABLE status prior to startup from the next refueling.

Amendment No. 135, 147, 162 3-70

3.17 INSTRUMENTATION SYSTEMS Table 3.17.4 Instrumentation Operatina Reouirements for Accident Monitorina Required Instrument Channels 1.

Wide Range Ts 2

2.

Wide Range Tc 2

3.

Wide Range Flux 2

4.

Containment Floor Water Level 2

5.

Subcooled Margin Monitor 2

6.

Wide Range Pressurizer Level 2

7.

Containment H Concentration 2

2 8.

Condensate Storage Tank Level 2

9.

Wide Range Pressurizer Pressure 2

10. Wide Range Containment Pressure 2

11. Wide Range "A" Steam Generator Level 2

12. Wide Range "B" Steam Generator Level 2

13. Narrow Range "A" Steam Generator Pressure 2

14. Narrow Range "B" Steam Generator Pressure 2

15.

Position Indication for each 1/ valve Containment Isolation Valve 16.

Core Exit Thermocouples (CET) 4 i

Quadrant 1 17.

Core Exit Thermocouples (CET) 4 Quadrant 2

18. Core Exit Thermocouples (CET) 4 Quadrant 3 1

19. Core Exit Thermocouples (CET) 4 Quadrant 4 20.

Reactor Vessel Water Level (RVWL) 2

21. High Range Containment Radiation 2

Amendment No. 447, 162 3-71

1 3.17 INSTRVMENTATION SYSTEMS Specification 3.17.5 The Alternate Shutdown System instrumentation and controls listed in Table 3.17.5 shall be OPERABLE.

Note:

Specifications 3.0.3, 3.0.4, and 4.0.4 do not apply.

Apolicability Specification 3.17.5 applies when the PCS temperature is > 300*F.

Action j

3.17.5.1 With one or more Alternate Shutdown System channels inoperable:

a)-

Provide equivalent shutdown capability within 7 days, and b)

Restore the inoperable channels to OPERABLE status within 60 days.

3.17.5.2 If any action required by 3.17.5.1 is not met AND the associated completion time has expired:

a)

The reactor shall be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and '

b)

The reactor shall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Amendment No. 122, 145, 162 3-72 v

l 3.' 17 -

INSTRUMENTATION SYSTEMS Table 3.17.5 Instrumentation Operatino Reauirements for Alternate Shutdown System.

Required Instrument or Control Channels 1.

Start-up Range Flux 1

1 2.

Pressurizer Pressure 1

'l 3.

Pressurizer Level 1

-4.

1 Hot Leg Temperature 1

5.

2 Hot Leg Temperature-1 6.

1 Cold leg Temperature 1

i 7.

2 Cold Leg Temperature 1

8.

"A" Steam Generator Pressure 1

9.

"B" Steam Generator Pressure 1

10.

"A" Steam Generator Level 1

11.

"B" Steam Generator Level 1

12.

SIRW Tank Level 1

13. AFW Pump P-8B Flow to "A" SG 1

14. AFW Pump P-8B Flow to "B" SG 1

15. AFW Pump P-80 Suction Pressure Alarm 1

16. AFW Pump P-8B Steam Valve Control 1

17. AFW Flow Control "A" SG 1

18. AFW Flow Control "B" SG 1

19. Transfer Switches, C-150 2

20. Transfer Switch, C-150A 1

Amendment No. 122, 135, 162 3-73

3.17 INSTRUMENTATION SYSTEMS Soecification 3.17.6 The Safety function instruments listed in Table 3.17.6 shall be OPERABLE.

Acolicability Acccrding to the Applicable Conditions column of Table 3.17.6.

1 Action 3.17.6.1 With one or two Neutron Flux Monitoring channels inoperable:

a)

Stop all positive reactivity additions immediately, and b)

Be in HOT SHUTDOWN or below within 16 minutes, and c)

Verify SHUTDOWN MARGIN within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , and once each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter.

3.17.6.2 With one channel of Rod Position Indication inoperable for one or more CRDMs:

j a)

Verify that the associated rod group is within the limits of SpeciTication 3.10 within 15 minutes after movement of any rod in that group.

3.17.6.3 With one or two SIRWT Temperature channels inoperable:

J a)

Provide alternate means of temperature monitoring within 7 days.

3.17.6.4 With one Main Feedwater Flow channels inoperable:

a)

Provide alternate means of flow monitoring within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.17.6.5 With one Main Feedwater Temperature channels inoperable:

a)

Provide alternate means of temperature monitoring within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.17.6.6.1 With one AFW flow indicator for one or more flow path inoperable:

a)

Determine the OPERABILITY of the associated AFW flow control valve within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

3.17.6.6.2 With two AFW flow indicators for one flow path inoperable:

a)

The associated control valve shall immediately be declared inoperable and the requirements of 3.5.2.e apply.

Amendment No. 2, 57, 05, OS, 115, 118, 121, 124, 129, 136, 162 3-74

3.17 INSTRUMENTATION SYSTEMS Action (continued) 3.17.6.7.1 With one required Leak Detection channel (7a, b, c, or d) inoperable:

a)

Restore the channel to OPERABLE status prior to the next startup from COLD SHUTDOWN.

3.17.6.7.2 With two or three required Leak Detection channels (7a, b, c, or d) inoperable:

a)

Restore three channels to OPERABLE status within 30 days.

3.17.6.8 With one Primary Safety Valve Position Indicator channel inoperable, for one or more valves:

a)

Restore the. channels to OPERABLE status prior to the next startup from COLD SHUTDOWN.

3.17.6.9 With one or two PORV Position Indicator channels inoperable for one or more valves:

a)

Restore the channels to OPERABLE status prior to the next startup from COLD SHUTDOWN.

3.17.6.10 With one PORV Block Valve Position [ndicator channel inoperable, for one or more valves:

a)

Restore the channel to OPERABLE status prior to the next startup from COLD SHUTDOWN, and, b)

If the PORV path is required for LTOP or as a PCS vent, and the valve position lights inoperable, verify PORY Block Valve is open j

each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

3.17.6.11 With the Service Water Break Detector inoperable:

a)

Restore the SWS Break Detector to OPERABLE status prior to the next startup.

3.17.6.12.1 With one Flux - AT Power Comparator channel inoperable:

a)

Restore the channel to OPERABLE status prior to.the next startup.

3.17.6.12.2 With two Flux - AT Power Comparator channels inoperable:

a) 8.imit power to s 70% RATED POWER within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

3.17.6.13 With one Rod Group Sequence Control / Alarm channel inoperable:

a)

Verify that all regulating groups are within the limits of Specification 3.10 within 15 minutes after movement of any regulating rod.

Amendment No. 3, 57, 95, 03, 115, 118, 121, 124, 120, 135, 162 3-75 i

j

l 3.17 INSTRUMENTATION SYSTEMS Action (continued) 3.17.6.14 With the Conc Boric Acid Tank to Level Alarm inoperable:

a)

Verify the level in the affected Boric Acid Tank is within limits each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

3.17.6.15 With the Excore Deviation Alarm inoperable:

a)

Calculate the QUADRANT POWER TILT using the excore readings at least once each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

3.17.6.16 With one or two AXIAL SHAPE INDEX Alarm channels inoperable:

a)

Restore the system to OPERABLE status prior to the next startup from COLD SHUTDOWN.

3.17.6.17 With one or two SDC suction valve interlock channels inoperable:

a)

Place circuit breaker for the associated valve operator in " Racked Out" position. The breaker may be racked in only during operation of associated valve.

3.17.6.18 With one Power Dependant Insertion Alarm channel inoperable:

a)

Verify that each regulating group is within the limits of Specification 3.10 within 15 minutes after movement of any regulating rod.

3.17.6.19 With one Fuel Pool Area Radiation Monitor inoperable:

a)

Stop moving fuel within the Fuel Pool Area until monitoring capability is restored, and b)

Restore monitor to OPERABLE status or provide equivalent monitoring i

capability within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

3.17.6.20 With one Containment refueling Radiation Monitor inoperable:

j a)

Stop REFUELING OPERATIONS in the containment.

3.17.6.21 If any action required by 3.17.6.1 through 3.17.6.18 is not met AND the associated completion time has expired, or if the number of OPERABLE channels is less than specified in the " Minimum OPERABLE Channels":

a)

The reactor shall be placed in HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and b)

The reactor shall be placed in a condition where the affected equipment is not required, within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Amendment No. 3, 57, 95, DS, 115, 118, 121, 124, 120, 136, 162 3-76

3.17 INSTRUMENTATION SYSTEMS Table 3.17.6 Instrumentation Ooeratino Reauirements for Other Safety Functions Minimum Required OPERABLE Applicable Instrument Channels Channel s Conditions j

1.

Neutron Flux Monitoring 2

0 Below 10 % RATED POWER, with fuel in the reactor.

2.

Rod Position 2

1 When more than one CRDM is indication capable of rod withdrawal.

3.

SIRW Tank Temperature 2

1 Above 300*F T,,..

4.

Main Feedwater Flow 1/Line 0

Above 15% RATED POWER.

5.

Main Feedwater 1/Line 0

Above 15% RATED POWER.

Temperature 6.

AFW Flow Indication 2/line 0

Above 300*F T.,..

7.

PCS Leakage Detection 4

l

Above 300*F T,..

j a.

Sump Level 1

b.

Atmos. Gas Monitor 1

c.

Humidity Monitor 1

d.

Air Cooler Condensate 1

Flow Switch 8.

Primary Safety Valve 2/v al ve

1/ valve Above 300*F T....

Position Indication i

9.

PORY 3/ valve

1/ valve Above 210*F T when PORV Position Indication block valve is open or its position indication system is inoperable.

l (a) The provisions of Specifications 3.0.4 and 4.0.4 are not applicable.

(b) The required channels shall be one channel each of 7a, 7b, 7c, and 7d.

(c) The minimum channels shall be any one channel of 7a, 7b, 7c, or 7d.

(continued)

Amendment No. 3, 57, 95, 98, 115, 118, 121, 121, 129, 136, 162 3-77

-3.17 INSTRUMENTATION SYSTEMS Table 3.17.6 (continued)

Instrumentation Og ratina Reouirements for Other Safety Functions Minimum Required OPERABLE Applicable M

Instrument Channels Channels Conditions 10.

PORV Block Valve 2/va'l ve'd 1/ Valve At all times, unless Position In<lication the PCS is depressurized and vented in accordance with Specification 3.1.8.

11.

SWS Break Detector I'd 0

HOT STANDBY and above.

12.

Flux-AT Power Comparator 4,,

2 POWER OPERATION 13.

Rod Group Sequence 2

1 When more than one CRDM is Control / Alarm capable of rod withdrawal.

14. Conc Boric Acid Tank 1/ tank 0

HOT STANDBY and above Lo Levet Alarm 15.

Excore Detector 1

0 Above 25% RATED POWER.

Deviation Alarm

16. AXIAL SHAPE INDEX 4'd 2

Above 25% RATED POWER.

Alarm 17.

SDC Suction Valve 2

0 Above 200 psia Interlocks PCS Pressure.

18.

Power Dependant 2

1 HOT STANDBY and above.

Insertion Alarm If Fuel Pool Area 2'"

0 When fuel is in Radiation Monitor fuel pool area, i

20. Containment Refueling 2'd 0

RTFUELING OPERATIONS Radiation Monitor when irradiated fuel is in the Containment.

(a) Specifications 3.0.4 and 4.0.4 are not applicable.

(b)

Specifications 3.0.3, 3.0.4, and 4.0.4 are not applicable.

Amendment No. 3, 57, 95, 03, 115, 118, 121, 121, 120, 136, 162 3-78

3.17 INSTRUMENTATION SYSTEMS Basis:

Instrumentation Systems 3.17 The Instrumentation OPERABILITY requirements are listed in six sections, 3.17.1 through 3.17.6.

The associated surveillance requirements are listed in sections 4.17.1 through 4.17.6, respectively.

Each section of 3.17 contains a specification, which contains the OPERABILITY requirement; an Applicability statement, which determines the plant conditions when the specification is required to be met; and a list of Action statements, which provide compensatory required actions to be completed when specified parts of the specification are not met, as required by Specification 3.0.1.

If the specification is not met and Action statements are not provided for the existing conditions, Specification 3.0.3 applies.

Comoletion of reauired Action: The listed Action is required to be completed within the specified time if the conditions of the specification are not met.

If, prior to expiration of the specified completion time, the required conditions are restored, completion of the Action is not required, as stated in Specification 3.0.2.

Each specified completion time starts at the time it is discovered that the Action statement is applicable.

The completion time of "immediately" does not mean " instantaneously", rather it implies " start as quickly as plant conditions permit and continue until completed."

Reauired Channels: Specification 3.17 requires all instrument and centrol channels listed under " Required Channels" to be OPERABLE.

If fewer channels are OPERABLE than specified under " Required Channels", the associated Action must be completed. Safety is not compromised, however, by continuing operation with certain instrumentation channels out of service since provisions were made for this in the plant design. This specification outlines Limiting Conditions for Operation to assure the effectiveness of the safety related instrumentation, and Action to be taken when any of the required channels are inoperable.

Minimum OPERABLE Channels:

Several tables in section 3.17 contain a " Minimum OPERABLE Channels" column, this column specifies the minimum number of channels which must be OPERABLE for continued plant operation.

If the number of OPERABLE channels falls below the " Minimum OPERABLE Channels", the plant must be shutdown in accordance with the final Action statement of each section.

In a few instances, the entry in the tiinimum Operable Channels column is "0".

This occurs under two conditions, when the corrective actions specified are sufficient to allow continued operation even if there are none of the subject instrument channels OPERABLE, and when it is not practical to require that the plant be placed in a condition where the affected equipment is not required.

An example of the first condition is the Engineered Safeguards Pump Room Monitor, Table 3.17.3 #4.a & b.

These monitors are necessary to provide isolation of the ventilation from the associated rooms in the event of a leak of highly contaminated fluid in the room.

If the associated damper is closed, as the action requires, the safety function is already fulfilled and operation may continue without the monitor being OPERABLE.

B 3.17-1 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS

' Basis:

Instrumentation Systems 3.17 (continued)

An example of the second condition is the Neutron Flux Monitoring required during shutdown, Table 3.17.6 #1.

These monitors are required to provide continuous assurance of adequate shutdown margin. The action provides caly periodic verifications of shutdown' margin.

Since this requirement for neutron flux monitoring applies whenever the reactor is below 10-4% power with fuel in the reactor, it is impractical. to require the plant to be placed in a condition where the affected equipment is not required.

Ooerational Byoasses: During certain operating.:onditions, some of the required functions may be bypassed to prevent spurious actuation or undesired actuation due to normal plant activities such as heatup and cooldown. JALi does not imolv that they do not need to be OpERABLEI These bypasses are automatically actuated or enabled, and are automatically removed when plant conditions reach the conditions where the protection is designed to apply.

Bypasses of this nature are referred to as " Operational Bypasses." The trips or automatic actuations which are bypassed may be relied upon to function if an accident should occur, even though they are bypassed.

The way that protection may be provided, yet spurious or undesired functioning avoided is by having the bypass automatically removed prior to the trip or actuation being required.

One example of an operational bypass is the Zero Power Mode Bypass: Manual actuation of this bypass is enabled when the wide range nuclear instrument channels indicate below 10-4% power.

If an inadvertent rod withdrawal should cause a power excursion, the bypass would be removed when indicated power went above 10-4%, and the bypassed trips would be available to terminate the event.

The conditions under which these operational bypasses are permitted are listed for each affected function.

Several instrument channels provide more than one required function. Table B 3.17-1 provides a listing of these channels and the specifications which they affect.

I l

1 B 3.17-2 Amendment No. 162 l

0

3.17 INSTRUMENTATION SYSTEMS Basis:

Instrumentation Systems 3.17 (continued)

Table B 3.17-1 I

Instruments Affectina Multiole Soecifications Affected Required Instrument channels Specifications Startup Range NI-01 & 02 Count Rate Signal 3.17.6 #1 Startup Range NI-01 Count Rate Indication 9 C-150 3.17.5 #1 Wide Range NI-03104 Flux level 10-4 interlock 3.17.1 #3, 4, 6, 10, & 11 Wide Range NI-03 & 04 Start-up Rate 3.17.1 #3 Wide Range NI-03 & 04 Flux Level Indication 3.17.4 #3 Power Range NI 08, Power level signal 3.17.6 #14, 17, & 20 Power Range NI 08, Power level signal 3.23.1 #A.2 Power Range NI 08, Q-power 3.17.1 #2 & 4 Power Range NI 08, ASI 3.17.1 #2 & 4 Power Range NI 08, ASI 3.17.6 #18

)

Power Range NI 08, ASI 3.1.1 #g Power Range NI-05 & 06; 15% interlock 3.17.1 #3 & 7 Power Range NI-05 & 06; 15% interlock 3.17.6 #18 PCS TC, Temperature signal 3.17.1 #4 i

PCS TC, Temperature indication 3.17.5 #6 &7 PCS TC, Q-power 3.17.1 #2 & 4 i

PCS TC, Q-power 3.17.6 # 14 l

PCS TH, Temperature indication 3.17.5 #5 & 6 PCS TH, Q-power 3.17.1 #2 & 4 PCS TH, Q-power 3.17.6 # 14 Pressurizer Pressure PI-0101 - 0104, Pressure signal 3.17.1 #4 & 5 Pressurizer Pressure PI-0101 - 0104, Pressure signal 3.17.2 #1.d Pressurizer Pressure PI-0101, Pressure indication 3.17.5 #2 Steam Generator Level LI, Level Signal 3.17.1 #8 & 9 Steam Generator Level LI, Level Signal 3.17.2 #3.c & d Steam Generator Level LI, Level indication 3.17.5 # 10 & 11 Steam Generator Pressure LI, Pressure Signal 3.17.1 #10 & 11 Steam Generator Pressure LI, Pressure Signal 3.17.3 #3.c & d Steam Generator Pressure LI, Pressure Indication 3.17.4 #13 & 14 Steam Generator Pressure LI, Pressure Indication 3.17.5 #8 & 9

)

Containment Pressure PS-1801, 2, 3, & 4, switch output 3.17.1 # 12 Containment Pressure PS-1801, 2, 3, & 4, switch output 3.17.3 #1.a & b B 3.17-3 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: Reactor Protective System (RPS) Description 3.17.1 The purpose of the RPS is to initiate a reactor trip to protect against violating the core fuel design limits and Primary Coolant System (PCS) 3ressure boundary during accidents and transients, and to assist the Engineered Safety Features (ESF) Systems in mitigating accidents.

The RPS employs 2 out of 4 trip logic.

Four independent measurement channels are provided for each safety related function used to generate reactor trip signals. When any two channels of the same function reach their trip setpoint, a reactor trip signal is generated, the control rod drive mechanism (CRDM) clutch )ower supplies deenergize, the CRDM magnetic clutches open, and the full lengt1 control rods drop into the core.

Two reactor trips, Loss of Load and High Startup Rate, are equipment protective and are not required for safety. These trips are not provided with four sensor channels and are not single failure proof in the sensor channels. They are provided with four independent actuation channels within the RPS.

To assure that no single failure within the RPS will either cause an inadvertent trip, or prevent a required trip, a minimum of 2/3 trip logic is required. When performing maintenance or testing, or when removing a failed channel from service, RPS logic for the affected function is changed from 2/4 to 2/3 by a key operated " trip channel bypass" switch for the affected tri)s.

Each RPS trip channel can be " trip channel bypassed", but, since only one (ey is available for each RPS function, only one channel of any function can be bypassed at a time.

In addition to the trip channel bypasses, there are also " operational bypasses" on five RPS trips. These bypasses are either automatically actuated or automatically enabled and manually actuated, in all four RPS channels, when plant conditions do not warrant specific trip protection. All operating bypasses are automatically removed when permissible bypass conditions are no longer satisfied.

The TM/LP, Low PCS Flow, and Low Steam Generator Pressure trips can be l

manually bypassed with the Zero Power Mode Bypass Switch if the associated wide range nuclear instrument channel indicates less than 10-4% RATED POWEP,.

The bypass is provided to allow LOW POWER PHYSICS TESTING while plant conditions are not within limits for POWER OPERATION.

Except during LOW j

POWER PHYSICS TESTS, the bypass also allows individual control rod testing when the plant is cold.

The use of the bypass is prohibited unless the PCS is at SHUTDOWN BORON CONCENTRATION for the COLD SHUTDOWN condition. This restriction increases the assurance that a continuous control rod bank withdrawn would not lead to an inadvertent criticality when there were fewer than 4 PCPs in operation, an event which has not been analyzed.

The safety grade instrument channels which supply input signals to the RPS may also su) ply input signals to ESF, Isolation, and other safety functions.

It is possi)le, however, that a circuit failure in an input channel may affect one safety function but not another.

The RPS is made up from three major classes of components; trip units, matrix logic, and initiation logic. The arrangement of these components is shown in reference 3.

B 3.17-4 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: RPS Description (continued)

RPS Trio Units: The eleven sets of RPS trip units are the bistable amplifiers which monitor the analog input functions for the RPS, and the Auxiliary Trip Units which replace the bistables for functions receiving a binary input signal. Most RPS trips monitor an analog signal, such as Steam Generator Level, and initiate a trip when the signal reaches a predetermined setpoint. Containment High Pressure and Loss of Load trips are actuated by pressure switches outside the RPS; High Startup R te trip is actuated by bi: tables in the Wide Range Nuclear Instrumentation INI) drawers; High Power trip is actuated by a signal from the Thermal Margin R'nitor. These four trips use relays, called Auxiliary Trip Units, in place cf the RPS bistables.

Each trip unit actuates three output relays, one in each of the associated matrix logic channels. Channel "A" trip units have output contacts in matrix logic channels A-8, A-C, and A-D; channel "B" trip units, in A-B, B-C, and B-D; and so on.

RPS Matrix Loaic: The six RPS Matrix logic channels are made up of the output contacts from individual trip units, testing and trip channel bypass contacts, coils of four Matrix Logic Relays, two power supplies, and various indicating lights. The contacts of the trip unit output relays are arranged to achieve the 2 out of 4 trip logic.

Each matrix has four output relays; one with contacts in each Initiation Logic channel.

RPS Initiation loaic: The four RPS Initiation Logic channels are made up of a series arrangement of one contact from an output relay in each of the six matrix logic channels, contacts from the C0-1 manual trip button, contacts from the associated "X-Relays", and one "M-Contactor". The M-Contactor controls power to two of the four clutch power supplies.

Basis: Applicability 3.17.1 The Reactor Protective System is only required to be OPERABLE when there is fuel in reactor vessel, the PCS is less than REFUELING BORON CONCENTRATION, and more than one control rod is capable of being withdrawn.

If there is no fuel in the reactor vessel a nuclear reaction cannot occur and the RPS function is not necessary.

If the PCS is at REFUELING BORON CONCENTRATION (21720 ppm and subcritical by 25% with all control rods removed from the core) there is no need for automatic control rod insertion.

If no more than one control rod can be withdrawn the RPS function is already fulfilled (the safety analyses and the SHUTDOWN MARGIN definition both use the assumption that the highest worth withdrawn control rod will fail to insert on a trip) and the safety analyses assumptions and SHUTDOWN MARGIN requirements will be met without the RPS trip function.

B 3.17-5 Amendment No. 162

3.17 IffSTRUMENTATION SYSTEMS Basis: Action statements 3.17.1 The listed Action is required to be completed within the cpecified time if the conditions of the specification are not met.

If, prior to expiration of the specified completion time, the required conditions are restored, completion of the Action is not required. Each specified completion time starts at the time it is discovered that the Action statement is applicable.

Action 3.17.1.1 - One Manual trio channel inoperable - Operation may continue until the reactor is shutdown for other reasons.

Repair during operation is not required because one OPERABLE channel is all that is required for safe operation. No safety analyses assume operation of the Manual trip.

In addition, the Manual Trip channels are not testable without actually causing a reactor trip, so even if the difficulty were corrected, the post maintenance testing necessary to declare the channel OPERABLE could not be completed during operation.

Action 3.17.1.2 - One RPS trio unit or associated instrument channel inoperable - Each RPS trip function has one trip unit for each of four RPS channels.

If one of the associated instrument channels, or the trip unit itself, has a failure which disables the proper functioning of the RPS trip function for that channel, the channel should be declared inoperable.

The inoperable channel must be restored to OPERABLE status or placed in the trip condition within 7 days to limit the time when a channel might be untrippable. The NRC has requested that plants, whose channel separation does not meet the requirements of Regulatory Guide 1.75, limit the time during which a safety channel is bypassed.

This action does not apply to the High Startup Rate or loss of Load trips.

The safety analyses take no credit for the functioning of these trips, they are installed for equipment protection only.

This action may be taken separately for inoperable channels of different functions.

Each inoperable channel would have its own completion time.

Action 3.17.1.3 - Two RPS trio units or associated instrument channels inocerable - If a second RPS channel for one function becomes inoperable, one inoperable trip unit must be placed in the tripped condition within one hour.

One channel must be tripped to limit operation with the RPS in a 2 out of 2 mode where an additional failure could disable the trip function entirely.

1 One trip must be restored to OPERABLE status within 7 days to limit the time when a channel is untrippable. Operation with an RPS channel continuously bypassed or untrippable is only authorized for plants whose channel separation meets the requirements of P.egulatory Guide 1.75.

Action c) does not apply to the High 5i.attp Rate or Loss of Load trips. The safety analyses take no credit for the functioning of these trips, they are installed for equipment protection only.

If Action c) were applicable to these non-safety grade' trips, failure of one Startup Rate instrument during power operation, for instance, would limit plant operation to 7 days even though the trips are automatically bypassed.

B 3.17-6 Amendment No. 162

)

3.17 INSTRUMENTATION SYSTEMS Basis: Action Statements 3.17.1 (continued)

These actions may be taken separately for pairs of inoperable channels of different functions.

Each pair of inoperable channels would have its own completion times.

Action 3.17.1.4 - One RPS Matrix Loaic channel inocerable - Failures of matrix logic channels are infrequent since they are composed of only contact pairs, indicating lights, and output relays. There is one Matrix Logic channel for each two-out-of-four combination such as A-B, A-C, A-D, B-C, etc.

The failure of any single Matrix Logic channel could, at worst, defeat only a single two-out-of-four trip combination, and would not cause a loss of trip capability. Should a failure occur, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months are allowed for repair.

Action 3.17.1.5 - One RPS Initiation loaic channel inocerable - If a failure of an Initiation Logic channel should occur, it would most likely de-energize the associated clutch power supplies.

Such a failure would not cause a reactor trip because the other two clutch power supplies would maintain the clutches energized.

If a failure, such as a contact pair failing to open (which does not de-energize the associated clutch power supplies) did occur, the RPS Initiation logic trip capability could only be failed by a similar failure of the other initiation logic channel associated with the same power supplies. A single Initiation Logic failure, therefore, cannot cause a loss of trip capability. The associated power supplies must be de-energized within one hour.

Action 3.17.1.6 - Reauired action AND associated completion time not met - If the required action cannot be met within the associated completion time, or if the number of OPERABLE channels is less than allowed, the plant must be placed in a condition where the inoperable equipment is not required. Twelve hours are allowed to bring the plant to HOT SHUTDOWN and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where the affected equipment is not required, to avoid unusual plant transients.

Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when it is discovered that Action 3.17.1.6 is applicable.

Basis: Table 3.17.1

1. - Manual Trio - The Manual Trip is provided to allow the operator to quickly shut down the reactor if such action is deemed necessary.

The safety analyses do not assume the use of the manual trip feature. Two separate manual trip channels are provided. One channel duplicates the function of the automatic trips, de-energizing contactors which interrupt power to the clutch power supplies. The second manual trip channel trips the circuit breakers which supply power to the clutch power supplies by de-energizing their undervoltage coils. The manual trip function is required to be OPERABLE under all conditions which require the RPS to be OPERABLE.

2. - Variable Hiah Power Trio (VHPT) - The VHPT provides reactor core protection against reactivity excursions.

The safety analyses assume that this trip is OPERABLE to terminate excessive reactivity insertions during power operation and while shutdown.

B 3.17-7 Amendment No. 162 j

3.17 JNSTRUMENTATION SYSTEMS Basis:

Table 3.17.1 (continued) l The VHPT and TM/LP trips both use power level inputs. The power level used is designated Q Power, and is the higher of core thermal power (AT Power) or nuclear power. AT power uses hot leg and cold leg RTDs as inputs. Nuclear power uses the power range nuclear instruments as inputs. Both the AT and Excore Power signals have provisions for calibration by calorimetric calculations.

At RATED POWER, at least 3 OPERABLE variable high power level channels are necessary to provide adequate flux tilt detection.

If only 2 channels are OPERABLE, the reactor power level is limited to 70% RATED POWER, protecting reactor from exceeding design peaking factors due to undetected flux tilts.

The VHP trip is designed to limit maximum reactor power to its maximum design and to terminate power excursions initiating at lower powers without power reaching this full power limit. During a plant startup, the VHPT trip setpoint is initially at its minimum value, 30%.

It remains fixed until manually reset, at which point it increases to s 15% above existing Q Power.

The power increase may then continue until the new setpoint is approached at which time the VHPT setpoint is again reset to 15% above the existing Q Power.

This pattern continues until the VHPT setpoint reaches its maximum setting. Thus, during power escalation, the VHPT trip setpoint is never more than 15% above existing power. This limits the magnitude of any inadvertent reactivity insertion or power increase. On a power decrease, the VHPT trip setpoint automatically tracks power levels downwards so that it is always a nominal 15% above the existing power. A minimum setting is provided.

3. - Hiah Startuo Rate - The wide range Nuclear Instrument channels provide a reactor trip on High Startup Rate as well as neutron flux level and startup rate indication, automatic bypassing and reinstatement of non-safety reactor trips, and automatic reset of the Zero Power Mode Bypass (of Low PCS Flow, Low SG Pressure, and TM/LP trips). The safety analyses do not assume functioning of this trip. Two channels of wide range flux level indication and start up rate indication are provided.

The wide range flux level indication actuates bistable amplifiers which actuate the permissive signal for the Zero Power Mode Bypass (for the TM/LP, Low PCS Flow, and Low SG Pressure trips), and bypass the startup rate trip.

Wide range channel NI-003 provides the bypass permissive for RPS channels "A" and "C"; NI-004, for "B" and "D".

A separate bistable trip unit is provided for each RPS channel.

The same bistables that provide the Zero Power Mode Bypass permissive also automatically bypass the High Startup Rate trips below the setpoint and enables it above. When at very low power levels, the nuclear instrument signals are not steady; if the Startup Rate trips were not bypassed, spurious trips could occur during start up operations.

The High Startup Rate trip is automatically bypassed when power range indicated power exceeds about 15% RATED POWER. The trip is not useful above that power level since reactivity insertions at power would induce an immediate change in power level and eventually be terminated by the VHPT B 3.17-8 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS

-ILu111 Table 3.17.1 (continued) without attaining any significant startup rate.

This bypass is automatically removed when the associated power range indication decreases below the bi stable setpoint. Power range NI-05 provides the bistable for RPS channel "A", NI-06 for "B", NI-07 for "C", and NI-08 for "D".

These same power range bistable amplifiers also bypass the Loss of Load trip below the setpoint and enable the ASI alarm function above the setpoint.

In addition, these bistables in NI-05 and NI-06 bypass the Turbine Trip on Generator Trip fun: tion below 15%.

The operation of a bistable amplifier occurs at slightly different points durJng power increases and decreases due to the hysteresis, or dead band, of 1

the instrument. Specified setpoints account for this difference and for l

sufficient tolerance to avoid constant re-adjustment.

4. - Thermal Marain/ Low Pressure (TM/LP) - The TM/LP trip is provided to prevent reactor operation when the Departure from Nucleate Boiling Ratio (DNBR) is insufficient. The TM/LP trip protects against slow reactivity or temperature increases, and against pressure decreases.

The TM/LP trip uses Q Power, ASI, and Tc as inputs.

Q Power, is the higher of core thermal power (AT Power) or nuclear power. AT power uses hot leg and cold leg RTDs as inputs. Nuclear power uses the power range nuclear instruments as inputs.

Both the AT and Excore Power signals have provisions for calibration by calorimetric calculations.

ASI, AXIAL SHAPE INDEX, is calculated from the upper and lower excore detector signals, as explained in the definition section. The signal is corrected for the difference between the flux at the core periphery.and the flux at the detectors.

Tc, cold leg temperature, is the higher of the two cold leg signals.

The TM/LP trip setpoint is a complex function of these inputs and represents a minimum acceptable PCS Pressure for the existing temperature and power conditions.

It is compared to actual PCS Pressure in the TM/LP Trip Unit.

The TM/LP trips may be manually bypassed with the Zero Power Mode Bypass Switch if the associated wide range nuclear instrument channel indicates less than 10-4% RATED POWER and if the PCS is at SHUTDOWN BORON CONCENTRATION for the COLD SHUTDOWN condition. This bypass is automatically removed at 10-4%

power.

5. - Hiah Pressurizer Pressure - The High Pressurizer Pressure trip, in conjunction with pressurizer safety valves and main steam safety valves, provides protection against over pressure conditions in the Primary Coolant System (PCS) when at operating temperature. The safety analyses assume the High Pressurizer Pressure trip is OPERABLE during accidents and transients which suddenly reduce PCS cooling (Loss of Load, MSIV closure, etc) or which suddenly increase reactor power (Rod Ejection).

B 3.17-9 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.1 (continued)

The High Pressurizer pressure trip shares four safety grade instrument channels with the TM/LP trip and the low pressurizer pressure Safety Injection Signal.

6. - Low PCS Flow - The Low PCS Flow trip provides protection during events which suddenly reduce the PCS flow rate during power operation, such as loss of power to, or seizure of, a Primary Coolant Pump.

The Low PCS Flow trip uses the summed hot leg to cold leg differential pressure signals as inputs. A trip setpoint is derived by correlating the pressure sum with conditions at RATED POWER.

The Low PCS Flow trips may be manually bypassed with the Zero Power Mode Bypass Switch if the associated wide range nuclear instrument channel indicates less than 10-4% RATED POWER and if the PCS is at SHUTDOWN BORON CONCENTRATION for the COLD SHUTDOWN condition. This bypass is automatically removed at 10-4% power.

7. - Loss of load - The loss of Load trip is provided to prevent lifting the pressurizer and main steam safety valves in the event of a turbine generator trip while at power. The trip is equipment protective. The safety analyses do not assume that this trip functions during any accident or transient. The Loss of Load trip uses a single pressure switch in the turbine Auto Stop Oil l

circuit to sense a turbine trip for input to all four RPS auxiliary trip i

units.

The Loss of Load trip is automatically disabled when power is below a nominal 15% RATED POWER to allow startup and shutdown of the turbine generator. At

)

low power the transient from a turbine trip would not cause safety valve operation. The Loss of load trip is automatically enabled and bypassed by the same power range bistable amplifiers that disable and enable the High Startup Rate trip. When power range channel NI-005 exceeds 15% RATED POWER, Loss of Load channels "A" and "C" are automatically enabled and High Startup Rate channels "A" and"C" are automatically disabled.

Power range NI-006 bistable controls RPS channels "B" and "D" trips similarly.

The operation of the bistable amplifiers do not occur at exactly the same indicated power during power increases as during decreases due to the hysteresis, or dead band, of the instrument. Setpoints are specified to account for this hysteresis and to provide a tolerance to avoid constant re-adjustment.

8. & 9. - Low Steam Generator Level - The low steam generator level trips are provided to trip the reactor in the event of excessive steam demand and loss of feedwater events.

Each steam generator level is sensed by measuring the differential pressure between the top and bottom of the downcomer annulus in the steam generator.

These trips share four level sensing channels on each steam generator with the Auxiliary Feedwater Actuation Signal.

B 3.17-10 Amendment No. 162

3.17 JNSTRUMENTATION SYSTEMS Basis: Table 3.17.1 (continued)

10. & 11. - Low Steam Generator Pressure - The Low Steam Generator Pressure trips provide protection against excessive rates of heat extraction from the steam generators which result in a rapid uncontrolled cooldown of the PCS.

These trips are needed to shutdown the reactor and assist the ESF System in the event of a steam or feedwater line break.

The Low SG Pressure trips may be manually bypassed with the Zero Power Mode Bypass Switch if the associated wide range nuclear instrument channel indicates less than 10-4% RATED POWER and if the PCS is at SHUTDOWN BORON CONCENTRATION for the COLD SHUTDOWN condition. This bypass is automatically removed at 10-4% power.

The SG pressure channels are shared with the Steam Generator Low Pressure signals which isolate the steam and feedwater lines.

12. - Hiah Containment Pressure - The High Containment Pressure trip provides a backup reactor trip in the evant of a Loss of Coolant Accident, Main Steam Line Break, or Main Feedwater Line Break. The High Containment Pressure trip shares sensors with the Containment High Pressure sensing logic for Safety Injection, Containment Isolation, and Containment Spray.

Each of these sensors has a single bellows which actuates two micro-switches. One micro switch on each of four sensors provides an input to the RPS.

13. - RPS Matrix Loaic - The six channels of Matrix Logic provide the 2-out-of-4 trip logic for each RPS function. They are described in the RPS l

description, above, and illustrated in reference 3.

14. - RPS Initiation Loalg - The four channels of Initiation Logic control the CRDM clutch Power Supplies.

They are described in the RPS description, above, and illustrated in reference 3.

Table 3.17.1 Footnotes:

Footnotes (a), (b), and (c) deal with an operational bypass called the Zero Power Mode Bypass.

The Zero Power Mode Bypass blocks operation of the TM/LP, Low PCS Flow, and Low Steam Generator Pressure Trips for the associated RPS channel. The Zero Power Mode Bypass for each RPS channel may be manually actuated by a key operated switch when the associated Wide Range channel indicates below the bistable setpoint. When wide range channel exceeds the setpoint, normally 10-4% RATED POWER, the Zero Power Mode Bypass is automatically removed.

Footnote (a) requires both wide range nuclear instrument range channels to be OPERABLE if the Zero Power Mode Bypass is used. This requirement assures that OPERABLE channels are available to restore the bypassed trips if reactor power should increase above the setpoint.

Footnote (b) allows bypassing of the TM/LP, Low PCS Flow, and Low Steam Generator Pressure trips only if two conditions exist; reactor power must be less than 10-4%, and PCS boron concentration must be SHUTDOWN BORON CONCENTRATION for the COLD SHUTDOWN condition.

B 3.17-11 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS l

Basis: Table 3.17.1 (continued)

The requirement for power to be below 10-4% is a function of the circuitry. The bypass is enabled only when power is below the setpoint of bistables in the wide range nuclear instrument channels.

The requirement for boron concentration was imposed in response to Generic Letter 86-13. That letter discussed the possibility of accidents occurring under un-analyzed conditions. The Palisades steam line break analysis assumed that four PCPs were in service. The requirement for SHUTDOWN BORON CONCENTRATION is intended to assure that when fewer than four pumps are in service, one of the following conditions exists:

(1) Operation will be limited to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months by the action statements of Specification 3.1.1 b, (2) The reactor will be tripped by the Low Flow trip, or (3)

If the Low Flow trip is bypassed, baron concentration will be sufficient to assure that cooldown caused by a steam line break will not cause a return to criticality.

Footnote (c) allows the Zero Power Mode Bypass to be used with the reactor critical up to 10-l% power during physics testing due to the strict procedural control during physics testing conducted at reduced temperature.

Performing testing with the reactor critical at significantly reduced temperature is not possible without bypassing the Low SG pressure and TM/LP trips.

For example, initial criticality and the associated physics testing was performed at 260*F, where steam pressure would be about 35 psi. The Zero Power Mode Bypass will be automatically removed, arming the associated reactor trips, if an inadvertent power increase exceeds the setpoint of the bistable in the Wide Range channels.

Footnote (d) limits the applicability of Specification 3.17.1 for the Loss of Load Trip to above 17% power. The trip is automatically bypassed below 17%

and cannot be completely tested unless the turbine is latched.

B 3.17-12 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis:

Engineered Safety Features (ESF) Instruments 3.17.2 and 3.17.3 The ESF circuitry generates six actuating signals, each actuating signal having two trains of relays. These required signals are listed in two tables, sorted by applicability. The Safety Injection Signal (SIS),

Recirculation Actuation Signal (RAS), and Auxiliary Feedwater Actuation Signal (AFAS) are listed in Table 3.17.2; Containment High Pressure (CHP),

Containment High Radiation (CHR), and Steam Generator Low Pressure (SGLP) in Table 3.17.3.

In addition, Table 3.17.2 specifies operability of the sequencers which provide automatic diesel generator loading and Table 3.17.3 specifies operability of the radiation monitors which provide automatic isolation of the ECCS pump room ventilation.

The purpose of the ESF is to initiate protective actions which will isolate the containment, and supply makeup and cooling water to the PCS in the event of an accident. These features both protect the public from radioactive fission products and limit the extent of reactor core damage.

The ESF circuitry, with the exception of Recirculation Actuation Signal (RAS), employs 2 out of 4 logic.

Four independent measurement channels are provided for each function used to generate ESF actuation signals.

When any two channels of the same function reach their setpoint, actuating relays are energized which, in turn, initiate the protective actions. Two separate and redundant trains of actuating relays, each powered from separate power supplies, are utilized. These separate relay trains operate redundant trains of ESF equipment.

RAS logic consists of output contacts of the relays actuated by the SIRWT level switches arranged in a "I out of 2 taken twice" logic.

The contacts are arranged so that at least one low level signal powered from each station battery is required to initiate RAS.

Loss of a single battery, therefore, cannot either cause or prevent RAS initiation.

Basis: Applicability 3.17.2 ESF circuits which actuate SIS, RAS, AFW, and Diesel Generator loading are not required to be OPERABLE when the PCS is below 300*F since the actuated equipment is not required to be OPERABLE.

CHP initiates functions listed in Table 3.17.3 as well as SIS listed in 3.17.2.

The CHP circuits, therefore, are subject to the broader applicability of Specification 3.17.3 rather than 3.17.2.

Basis: Action Statements 3.17.2:

The listed Action is required to be completed within the specified time if the conditions of the specification are not met.

If, prior to expiration of the specified completion time, the required conditions are restored, completion of the Action is not required.

Each specified completion time starts at the time it is discovered that the Action statement is applicable.

Action 3.17.2.1 - One manual control or loaic channel inoperable - With one manual control channel or one logic channel inoperable, control over one of B 3.17-13 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: Action Statements 3.17.2 (continued) the two trains of ESF is diminished. The train with the inoperable control channel no longer has the designed capability of automatic actuation with operator backup. The controls must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

This action may be taken separately for inoperable channels of different functions.

Each inoperable channel would have its own completion times.

Action 3.17.2.2 - One ESF instrument channel inocerable - The inoperable channel must be repaired or placed in trip within 7 days to limit the time when a channel is bypassed. The NRC has requested that plants whose channel separation does not meet the requirements of Regulatory Guide 1.75 limit the time during which a safety channel is bypassed.

This action may be taken separately for inoperable channels of different functions.

Each inoperable channel would have its own completion time.

Action 3.17.2.3 - Two ESF instrument channels inoperable - With two inoperable instrument channels, the ESF could be in a 2 out of 2 logic. The length of time spent in this mode should be minimized.

Placing the trip unit for the affected ESF function in the tripped condition places the ESF in a 1 out of 2 mode.

Eight hours is allowed for this action since it must he accomplished by a circuit modification, or by removing power from a circuit component.

The second inoperable channel must be repaired within 7 days to limit the time the unit is operated with an inoperable channel.

These actions may be taken separately for pairs of inoperable channels of different functions.

Each pair of inoperable channels would have its own completion times.

Action 3.17.2.4 - One SIRWT level channel inoperable - The SIRWT low level circuitry is arranged in a "I out of 2 taken twice" logic rather than the more frequently used 2 out of 4 logic. Therefore, the specified Action differs from other ESF functions. With a bypassed SIRWT low level channel, an additional failure might disable automatic RAS, but would not initiate a premature RAS. With a tripped channel, an additional failure could cause a premature RAS, but would not disable the automatic RAS.

Since considerable time is available after initiation of SIS until RAS is required and there is quite a tolerance on the time when RAS must be initiated, and since a premature RAS could damage all the ESF pumps, it is preferable to bypass an inoperable channel and risk loss of automatic RAS than to trip a channel and risk a premature RAS.

Eight hours is allowed for this action since it must be accomplished by circuit modification.

The inoperable channel must be repaired within 7 days to limit the time the unit is operated with an inoperable channel.

B 3.17-14 Amendment No. 162

3.17' INSTRUMENTATION SYSTEMS Basis: Action Statements 3.17.2 (continued)

Action 3.17.2.5 - One or more seauencers inoperable - The Shutdown Sequencers provide automatic loading of the diesel generators in case of a loss of power to the associated safeguards 2400 volt bus. Both programmed sequences and the initiating logic must be operable.

If a sequencer is inoperable, the associated diesel generator cannot perform its designed automatic loading and must be declared inoperable. The completion time of "immediately" does not mean " instantaneously", rather it implies " start as quickly as plant conditions permit and continue until completed."

Action 3.17.2.6 - Reauired action AND associated completion time not met-- If the required action cannot be met within the associated completion time, or if the number of OPERABLE channels is less than allowed, the plant ;aust be placed in a condition where the inoperable equipment is not required.

Twelve hours are allowed to bring the plant to HOT SHUTDOWN, and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where the affected equipment is not required, to avoid unusual plant transients. Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when it is discovered that Action 3.17.2.6 is applicable.

Basis: Table 3.17.2

1. - Safety Iniection Sianal (SIS) - SIS is actuated by manual initiation, by a CHP signal, or by 2 out of 4 Pressurizer Pressure channels decreasing below the setpoint. SIS initiates the following actions:

a)

Start HPSI & LPSI pumps b)

Enable Containment Spray Pump Start on CHP c)

Initiate Safety Injection Valve operations Each Manual Actuation channel consists of one pushbutton which directly starts the SIS actuation logic for the associated train.

The Low Pressurizer Pressure signal for each SIS train can be blocked when 3 out of 4 channels indicate below 1700 psia. This block prevents undesired actuation of SIS during a normal plant cooldown. The block signal is automatically removed when 2 out of 4 channels exceed the setpoint.

The pressuri7.er pressure instrument channels which provide input to SIS are the same channels which provide an input to the RPS. The RPS receives an analog signal from each Pressurizer Pressure channel; each SIS initiation logic train receives a binary signal from a group of four relays, each actuated by a bistable in one of the four instrument channels.

The contacts of these relays are wired into a 2 out of 4 logic.

It is the output of this pressurizer pressure 2 out of four logic circuit that is blocked during plant cooldowns. A similar arrangement of bistables and relays provide the pressurizer low pressure block permissive signal. The initiation and block circuits are illustrated in reference 4.

Each SIS logic train is also actuated by a contact pair on one of tne CHP initiation relays for the associated CHP train.

Each train of SIS actuation logic consists of a group of " SIS" relays which energize and seal in when the initiation logic is satisfied. These SIS B 3.17-15 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis:

Table 3.17.2 (continued) relays actuate alarms and control functions. One of the control functions selects between an immediate actuation circuit, if offsite power is available, and a time sequenced actuation circuit, if only diesel power is available. These actuation circuits initiate motor operated valve opening and pump starting. The SIS actuation logic is illustrated in reference 5.

2. - Recirculation Actuation Sianal (RAS 1 - RAS is actuated by manually actuating the circuit " Test" switch or by two of the four level sensors in the SIRWT reaching their setpoints.

RAS initiates the following actions:

a)

Trip LPSI pumps (this trip can be manually bypassed) b)

Switch HPSI & Spray suction from SIRWT to Containment Sump c)

Adjust cooling water to Shutdown Cooling Heat Exchangers The four SIRWT level sensors each de-energize two relays, one per logic train, when tank level reaches the setpoint.

Each channel of level sensor and associated output relays is powered from a different Preferred AC bus.

1 Two Preferred AC buses are powered, through inverters, from each station battery. The manual RAS control for each train de-energizes two of these relays, initiating RAS through the logic train.

Each train of RAS logic consists of the output contacts of the relays actuated by the level switches arranged in a "I out of 2 taken twice" logic.

The contacts are arranged so that at least one low level signal powered from each station battery is required to initiate RAS.

Loss of a single battery, therefore, cannot either cause or prevent RAS initiation. When the logic is satisfied, two DC relays are energized to initiate RAS actions and alarms.

The RAS logic is illustrated in reference 6.

3. - Auxiliary Feedwater Actuation Sianal (AFAS1 - AFAS is actuated by manual action or by 2 out of 4 level sensors on either steam generator reaching their setpoints. Manual actuation of Auxiliary Feedwater may be accomplished through pushbutton actuation of each AFAS channel or by use of individual l

pump and valve controls.

Each AFAS channel starts the associated AFW pump (s) and opens the associated flow control valves.

The steam generator level instrument channels which provide input to AFAS are the same channels which provide an input to the RPS.

Both the AFAS cabinets and the RPS receive analog signals from the instrument channel, and both have their own bistables to initiate actuation on low level.

Each AFAS train contains a 2 out of 4 logic for each steam generator. One l

AFAS logic train actuates motor driven AFW pump P-8A and turbine driven pump P-8B and the associated flow control valves; the other actuates motor driven pump P-8C and the associated valves.

Each train provides flow to both steam generators.

The AFAS logic uses solid state logic circuits.

It is illustrated in reference 7.

4. - Emeraency Power Seauencers - The Emergency Power Sequencers provide signals to close selected circuit breakers timed to provide emergency equipment as soon as possible after a loss of power, in the required sequence, yet not overload the diesel generator with the resultant starting B 3.17-16 Amendment No. 162

~.

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.2 (continued) currents. One solid state programmable sequencer is provided for each diesel generator. Two programmed sequences are provided by each sequencer, a

" Design Basis Accident" (DBA) sequence which is actuated by a losslof power to the associated bus if a Safety Injection Signal is present, and a " Normal Shutdown" sequence which'is actuated by a loss of power to the associated bus if a Safety Injection Signal is not present. The sequencers and associated circuitry are illustrated in reference 5.

i 5

i 1

l l

l B 3.17-17 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS l

Basis: Applicability 3.17.3 ESF circuitry which actuates the Isolation Functions is not required _to be OPERABLE when the PCS is in COLD SHUTDOWN because of the low energy content of the PCS and Steam Generator water.

1 i

Basis: Action statements 3.17.3 The listed Action is required to be completed within the specified time if the conditions of the specification are not met.

If, prior to expiration of the specified completion time, the required conditions are restored, completion of the Action is not required.

Each specified completion time starts at the time it is discovered that the Action statement is applicable.

Action 3.17.3.1 - One manual control or looic channel inoperable - With one manual control channel or one logic channel inoperable, control over one of i

the two trains of Isolation functions is diminished. The train with the inoperable control channel no longer has the designed capability of automatic actuation with operator backup. The controls must be restored to OPERABLE l

status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

This action may be taken separately for inoperable channels of different functions.

Each inoperable channel would have its own completion time.

Action 3.17.3.2 - One Isolation Function instrument channel inoperable - The inoperable channel must be repaired or placed in trip within 7 days to limit the time when a channel is inoperable. The NRC has requested that plants whose channel separation does not meet the requirements of Regulatory Guide 1.75 limit the time during which a safety channel is bypassed.

1 This action may be taken separately for inoperable channels of different functior;.

Each inoperable channel would have'its own completion time.

l Act'sn 3.17.3.3 - Two Isolation Function instrument channels inoperable -

With two inoperable instrument channels, the Isolation Function could be in a 2 out of 2 logic. The length of time spent in' this mode should be minimized.

Placing the trip unit for the affected Isolation Function in the tripped condition places the Isolation Function in a 1 out of 2 mode.

Eight hours is allowed for this action since it must be accomplished by a circuit modification, or by removing power from a circuit component.

One inoperable channel must be repaired within 7 days to limit the time the unit is operated with an inoperable channel.

These actions may be taken separately for pairs of inoperable channels of different functions.

Each pair of inoperable channels would have its own completion times.

Action 3.17.3.4 - Enaineered Safeauards Room Ventilation Radiation Monitor inocerable - The only safety function provided by the subject monitors is B 3.17-18 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: Action Statements 3.17.3 (continued) to isolate the ventilation to and from the room on high radiation.

If this function is completed manually, operation may continue indefinitely. The intent is to effect closure quickly for an instrument failure but not require a plant shutdown if a difficult to repair mechanical failure should take longer to accomplish.

It is permissible to operate the dampers as part of the repair process in order to verify their operability.

Action 3.17.3.5 - Reauired action AND associated completion time not met - If the required action cannot be met within the associated completion time, or if the number of OPERABLE channels is less than allowed, the plant must be placed in a condition where the inoperable equipment is not required. Twelve hours are allowed to bring the plant to HOT SHUTDOWN, and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where the affected equipment is not required, to avoid unusual plant transients.

Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when it is discovered that Action 3.17.3.5 is applicable.

Basis: Table 3.17.3

1. - Containment Hiah Pressure (CHP) - CHP is actuated by 2 out of 4 pressure switches for the associated train reaching their setpoints.

CHP initiates the following actions:

a)

Containment Spray b)

Safety Injection Signal c)

Main Feedwater Isolation d)

Main Steam Line Isolation e)

Control Room HVAC Emergency Mode l

f)

Close Containment Isolation Valves Eight containment pressure channels are provided.

Each channel consists of one pressure sensing bellows which actuates two micro-switches.

Four of-these sixteen micro-switches provide input to the RPS; the remainder are divided into two circuits of 2 out of 4 logic for the CHP logic trains.

I Each CHP logic train consists of an arrangement of six micro-switch contacts and a test relay which energize a group of "5P" relays when the 2 out of 4 logic is satisfied. The CHP logic is illustrated in reference 8.

2. - Containment Hiah Radiation (CHR) - CHR is actuated by manual action or, during normal operation, by 2 out of 4 radiation monitors setpoints.

During refueling operations the CHR actuation is manually switched to actuate on 1 of 2 low range radiation monitors at a much lower setpoint.

CHR initiates the following actions:

a)

Control Room HVAC Emergency Mode b)

Close Containment Isolation Valves c)

Block automatic starting of ECCS pump room sump pumps The containment area radiation monitors which actuate CHR each de-energize an output relay upon reaching their setpoint. The output contacts of these relays are arranged into two trains of 2 out of 4 logic. Two manual controls each de-energize two of these relays, initiating both trains of CHR.

B 3.17-19 Amendment No. 162 i

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.3 (continued)

When either train of 2 out of 4 logic is satisfied, a group of "5R" relays energize to initiate CHR actions. The CHR logic is illustrated in reference 9.

3. - Steam Generator low Pressure (SGLP) - One SGLP circuit is provided for each steam generator.

Each SGLP circuit is actuated by 2 out of 4 pressure channels on the associated steam generator reaching their setpoint. SGLP initiates the following actions:

a)

Close the associated Feedwater Regulating valve and its bypass, b)

Close both Main Steam Isolation Valves.

The steam generator pressure instrument channels which provide input to SGLP are the same channels which provide an input to the RPS.

Both the SGLP logic and the RPS receive analog signals from the instrument channel, and both have their own bistables to initiate actuation on low pressure.

The SGLP signal from each steam generator may be blocked when 3 of the 4 steam pressure channels indicate below 550 psia. This block prevents undesired actuation during a normal plant cooldown. The block signal is automatically removed when steam pressure exceeds the setpoint.

Each SGLP logic is made up of output contacts from four pressure bistables from the associated steam generator. When the logic circuit is satisfied, two relays are energized to actuate steam and feedwater line isolation. A similar logic circuit is provided for each block circuit. The block is automatically removed when the steam pressure exceeds 550 psig. SGLP logic is illustrated in reference 10.

4. - Enaineered Safeauards Pumo Room Hiah Radiation - One Radiation Monitor is provided for each pump room.

If the monitor reaches its setpoint, dampers are closed in the ventilation inlet and discharge for the associated room.

B 3.17-20 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: Accident Monitoring Instruments (AMI) 3.17.4 The AMI provide information to assist the operator in monitoring accident conditions within the PCS, the steam system, and the containment.

Two measurement channels provide the necessary information in the Control Room for adequate accident monitoring. The channels provide wide-range

~

information which meet electrical and physical separation requirements for each function displayed. This design is consistent with the requirements of IEEE 279-1971. The channels are provided with equipment qualified to operate in the environments specified for design basis events in the FSAR. These channels comply with the requirements of NUREG 0578 and recommendations of Regulatory Guide 1.97.

Basis: Applicability 3.17.4 The AMI are required to allow the operator to monitor the accident status while bringing the plant to shutdown cooling entry conditions..Therefore, the specified instrumentation is required to be operable when PCS temperature is above 300*F, the temperature below which shutdown cooling may be initiated.

Basis: Action statements 3.17.4 The listed Action is required to be completed within the specified time if the conditions of the specification are not met.

If, prior to expiration of the specified completion time, the required. conditions are restored, completion of the Action is not required.

Each specified completion time starts at the time it is discovered that the Action statement is applicable.

Action 3.17.4.1 - One channel inoperable (except position indication, CETs, reactor water level and containment radiation) - The inoperable channel must be restored to OPERABLE status within 7 days, or Action 3.17.4.4 must be entered. The 7 day completion time is arbitrarily assigned based on allowing j

time for repair on a non-emergency basis and the perceived low probability of an accident requiring use of AMI concurrent with failure of the remaining OPERABLE channel during the allotted time.

Action 3.17.4.2 - Two channels inocerable (except position indication, CETs, reactor water level and containment radiation) - One inoperable channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or Action 3.17.4.4 must be entered. The 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months completion time is arbitrarily assigned based on allowing time for repair and the perceived low probability of an accident requiring use of AMI during the allotted time.

Action 3.17.4.3 - Position Indication inocerable - The inoperable channels nust be restored to OPERABLE status or the associated isolation valve locked in the closed position within 7 days, or Action 3.17.4.4 must be entered.

The 7 day completion time is arbitrarily assigned based on allowing time for repair on a non-emergency basis and the perceived low probability of an accident requiring use of AMI concurrent with failure of B 3.17-21 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS flanin Action statements 3.17.4 (continued) the position indication for the other valve on that penetration during the allotted time.

Action 3.17.4.4 - Reauired action AND associated completion time not met - If the required action of 3.17.4.1 through 3.17.4.3 cannot be met within the associated completion time, the plant must be placed in a condition where the inoperable equipment is not required. Twelve hours are allowed to bring the plant to HOT SHUTDOWN, and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where the affected equipment is not required, to avoid unusual plant transients.

Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when it is discovered that Action 3.17.4.4 i

is applicable.

)

i Action 3.17.4.5 - One channel of CETs. reactor water level or containment radiation inoperable - The inoperable channel must be restored to OPERABLE status within 7 days, or action 3.17.4.7 must be entered.

The 7 day completion time is assigned based on allowing time for repair of failures which affect equipment outside the containment on a non emergency basis.

Action 3.17.4.6 - Two channels of CETS. reactor water level or containment radiation inocerable - One inoperable channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or action 3.17.4.7 must be entered.

The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months I

completion time is assigned to allow time for repair of failures which affect equipment outside the containment.

Action 3.17.4.7 - Reauired action not met within associated comoletion time a) - If two channels of CETs in any quadrant are inoperable for more than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , the reactor must be shutdown and cooled down in accordance with 3.17.4.4.

b) - If two RVWL channels are inoperable, alternate instrument channels must be used for monitoring reactor vessel water level. The alternate channels normally used are Subcooled Margin Monitors, Wide Range Pressurizer Level, and Core Exit Thermocouples required by Table 3.17.4.

c) - If other required actions of 3.17.4.5 or 3.17.4.6 cannot be met within the associated completion time, the intended corrective actions must be reported to the NRC within 30 days from the time the inoperability was discovered.

This report must be submitted even if the required actions are completed prior to the expiration of the 30 day completion time.

This Action is less stringent than 3.17.4.4 because the information provided by subject instrumentation is not used as the basis for operator action.

d) - All required channels must be restored to OPERABLE status prior to startup from the next refueling.

Since Specification 3.0.4 is not applicable, this action is necessary to assure that repair is accomplished when the equipment is accessible during the next refueling.

B 3.17-22 Amendment No. 162

J 3.17-INSTRUMENTATION SYSTEMS Basis: Table 3.17.4 The functions listed in Table 3.17.4 are those in FSAR Appendix 7C,

" REGULATORY GUIDE 1.97 INSTRUMENTATION" which are classed as " Category 1" or as " Type A".

Iygg_A - ANSI /ANS-4.5, as quoted in Regulatory Guide 1.97, defines " Type A" variables as those variables that provide primary information needed to permit the control room operating personnel to take manually controlled actions for which no automatic control is provided, but are required for safety systems to accomplish their safety functions for design basis accident events.

Catecory 1 - Regulatory Guide 1.97, in a table of design and qualification criterion for accident monitoring instrumentation, provides three classes of instruments of which " Category 1", which they refer to as " key variables", is the most stringent.

Each core exit thermocouple (CET) channel consists of a singlo environmentally qualified thermocouple. This definition of a CET channel differs from standard Technical Specifications. The CET requirements actions were added to the Palisades Technical Specifications by amendment 147 on June 22, 1992.

A Reactor Vessel Water Level channel consists of eight sensors in a probe. A channel is OPERABLE if four or more sensors, two or more of the upper four and two or more of the lower four, are OPERABLE.

There are two channels installed.

B 3.17-23 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: 3.17.5 Alternate Shutdown System The Alternate Shutdown System ensures that a fire will not preclude achieving safe shutdown. The Alternate Shutdown System components are independent of areas where a fire could damage systems normally used to shut down the reactor. This capability is consistent with Regulatory Guide 1.97 and 10 CFR 50 Appendix R.

There are no transient or accident analyses which take credit for operations conducted from the Remote Shutdown Panel.

The provisions of Specifications 3.0.3 and 3.0.4 do not apply to Specification 3.17.5, because the required equipment does not affect normal plant operations, and most repairs can be made while the plant is critical.

Basis: Applicability 3.17.5 The Alternate Shutdown equipment is designed to be able to bring the plant to, and maintain it in, a safe shutdown condition.

Therefore, Specification 3.17.5 is not applicable when below 300'F when the Shutdown Cooling System would be available.

Basis: Action statements 3.17.5 The listed Action is required to be completed within the specified time if the conditions of the specification are not met.

If, prior to expiration of the specified completion time, the required conditions are restored, completion of the Action is not required.

Each completion time ~ starts at the time it is discovered that the Action statement is applicable.

Action 3.17.5.1 - One or more channels inocerable - Equivalent shutdown capability must be provided within 7 days, and the required equipment restored to OPERABLE status within 60 days. Seven days is intended to allow repair without subjecting the plant to a shutdown.

If equivalent shutdown control or monitoring equipment can be provided, the repair period for the required channels may be extended to 60 days.

Action 3.17.5.2 - Reauired action AND associated completion time not met - If the required action cannot be met within the associated completion time, or if the number of OPERABLE channels is less than allowed, the plant must be placed in a condition where the inoperable equipment is not required. Twelve hours are allowed to bring the plant to HOT SHUTDOWN, and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where the affected equipment is not required, to avoid unusual plant transients. Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when it is discovered that Action 3.17.5.2 is applicable.

Basis: Table 3.17.5 Indication channels 3 through 14 use a transmitter which also serves normal control room instrumentation. When the control switches are changed to the "AHSDP" (Alternate Hot Shut Down Panel) position, the transmitter is isolated from its normal power supply and circuitry, and connected into the C-150 or C-150A panel circuit; control for AFW flow control valves CV-0727 and 0749 is also transferred to C-150. The transfer switches are alarmed in the control room.

Pressurizer Pressure indicator channel 2 is provided with its own pressure transmitter.

Its circuitry is energized when the transfer switch is in the AHSDP position.

B 3.17-24 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: 3.17.6 Other Safety features i

The Safety Functions required by Specification 3.17.6 provide alarm and l

indication functions to assist the operator in monitoring plant conditions.

None of the required functions provide automatic actions assumed to be available in the safety analysis, therefore, operation may continue even though the function is degraded or lost provided that the specified action is met.

The provisions of Specifications 3.0.4 and 4.0.4 are not applicable to several required inst.ument functions, as noted in Table 3.17.6.

These instrument functions have sufficient redundancy to provide their required functions with one or more installed channels operable. The exception to 3.0.4 and 4.0.4 allows changing of plant operating conditions, but the required actions require eventual return to service.

Basis: Applicability 3.17.6 Specification 3.17.6 involves miscellaneous instruments with widely differing function. The applicability for each required instrument is provided in the j

Applicable Conditions column of Table 3.17.6.

l Basis: Action statements 3.17.6 The listed Action is required to be completed within the specified time if the conditions of the specification are not met.

If, prior to expiration of j

the specified completion time, the required conditions are restored, completion of the Action is not required.

Each specified completion time starts at the time it is discovered that the Action statement is applicable.

Since Table 3.17.6 consists of instruments of widely different function, each table entry has its own Action statements whose numbering corresponds to that of the table entries. These Actions are discussed following the basis for the associated channel.

Basis:

Table 3.17.6 1.

Neutron Flux Monitorina - Two channels of wide range neutron flux monitoring are required to be OPERABLE when there is fuel in the reactor.

When flux is greater than 10-4%, the requirements of Specification 3.17.1 assure adequate flux monitoring capability. Neutron flux channels are used to monitor core reactivity changes.

The count rate section of the wide range neutron flux monitoring channels is capable of detecting flux levels below the indicating scale.

Flux levels decrease with time while the reactor is shutdown. After extended shutdowns the flux level may decrease below the indicating range. When flux is below the indication range, channel OPERABILITY may be verified by using scaler-counters or other additional instrumentation.

Action 3.17.6.1 - One or two Neutron Flux Monitorina channels inocerable -

I When there are fewer than two OPERABLE Neutron Flux Monitoring channels, B 3.17-25 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued) complete monitoring of core reactivity is not possible. All positive reactivity changes must be terminated immediately, the reactor must be shutdown, if it was critical, and SHUTDOWN MARGIN verified within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter until the required monitoring is restored. The completion time of "immediately" does not mean " instantaneously", rather it implies " start as quickly as plant conditions permit and continue until completed."

2.

Rod Position Indication - Two channels of rod position indication are required to be OPERABLE for each full-length and each part-length rod.

Rod position indication is required to allow verification that the rods are positioned and aligned as required.

Rod position channels are required to be OPERABLE whenever more than one CRDM is capable of rod withdrawal.

It is not required when only a single rod may be withdrawn for two reasons: first, it is necessary to withdraw a rod in order to perform the calibration necessary to declare the position indication channels OPERABLE, and second, the safety analyses assume that the most reactive rod is stuck in the fully withdrawn position.

Both rod position channels are calibrated to read the height of the bottom of the control rod blade, in inches, above the full inserted

position, j

Primary rod position indication is operated by a gear train driven from the CRDM drive package, below the clutch. The gear train actuates cam operated limit switches and a synchro. The limit switches operate position indication lights; the synchro, together with the Primary Information Processor (PIP),

operate the digital position indication.

Both the limit switches and the synchro signal are also used for alarm and control functions.

The primary rod position system is considered OPERABLE, for purposes of this specification, if the digital position readout or the cam operated position indication lights give positive indication of rod position.

Secondary Position Indication (SPI) is operated by a magnet integral with the connector nut and a magnetically operated reed switch stack attached to the CRDM housing. The reed switches are located at uniform intervals along the travel of the connector nut.

The reed switches are wired so that the voltage read across the reed switch stack is proportional to rod position. There is a dead band, near the bottom of the travel, where the CRDM housing seismic support prevents operation of the switches.

SPI also provides alarms, position indication lights, and control functions based on rod position.

The SPI for each control rod is considered OPERABLE, for purposes of LCO, if there are no occurrences, other than the seismic support dead band, where two adjacent switches fail to respond to rod motion.

Action 3.17.6.2 - One rod oosition indication channel inoperable - If one channel of rod position indication is inoperable, control and alarm functions may also be inoperable. The position of each rod in the associated group must be verified to be within the limits of specification 3.10 within 15 minutes after moving any rod.

B 3.17-26 Amendment No. 162

l 3.17' INSTRUMENTATION' SYSTEMS Basis: Table 3.17.6 (continued) 3.

Safety Iniection Refuelina Water Tank'Temoerature - SIRWT temperature instrumentation is required to verify.that.the SIRWT temperature is within limits. Two channels of temperature indication are provided.

SIRWT temperature instrumentation is not required below 300*F Tave because the SIRWT and systems supported by the SIRWT are not required to be OPERABLE below 300*F Tave.

SIRWT temperature indication has been excepted form the provisions of Specifications 3.0.4 and 4.0.4 because alternate means of obtaining the required information are readily available.

Action 3.17.6.3 - One or two SIRWT temoerature channels inocerable - With installed SIRWT temperature indication inoperable, operation may continue as long as temperature can be verified to be above the limit.

The tank is not insulated and is accessible so alternate means of determining temperature are i

relatively simple. When ambient temperatures are well above the SIRWT limit, outside air temperature may be assumed to represent SIRWT temperature.

4.

Main Feedwater Flow Indication - The Main Feedwater Flow measurements are necessary to perform the required daily calorimetric calculation. One feedwater flow instrument is provided for each feed line.

These flow indicators are the same instruments which provide flow indication to the Feedwater Control System.

The instrumentation is not required below 15% RATED POWER where calorimetric calculations are not required.

Action 3.17.6.4 - Main Feedwater Flow indication inoperable - If feedwater flow indication is inoperable, this specification allows operation to continue if alternate indication can be provided to allow completion of the required daily calorimetric calculation. The inoperable channel must be restored to OPERABLE status prior to the next reactor startup, as required by Specification 3.0.4.

5.

Main Feedwater Temoerature Indication - The Main Feedwater Temperature measurements are necessary to perform the required daily calorimetric calculation. One feedwater temperature instrument is provided for each feed line.

The instrumentation is not required below 15% RATED POWER where calorimetric calculations are not required.

Action 3.17.6.5 - Main Feedwater Temperature indication inoperable - If feedwater temperature indication is inoperable, this specification allows operation to continue if alternate indication can be provided to allow completion of the required daily calorimetric calculation. The inoperable channel must be restored to OPERABLE status prior to the next reactor startup, as required by Specification 3.0.4.

B 3.17-27 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued) 6.

Auxiliary Feedwater Flow - The AFW system is arranged as two independent trains of pumps, piping, flow control valves and electrical controls.

Each train is capable of feeding each steam generator through separate feed lines and flow control valves. Each AFW feed line is provided with two separate flow indication channels. One channel provides an input to the associated AFW flow control valve as well as control room flow indication; the other provides flow indication in the control room. A flow switch from each of the flow indicator channels provides a flow signal to the AFW pump sequencing circuitry.

In addition, two of the flow transmitters associated with the turbine driven AFW pump, those which do not provide flow control, can be manually switched into a completely separate circuit which provides AFW flow information at Alternate Shutdown Panel C-150.

The AFW flow channels are not required to be OPERABLE when the PCS is below 300*F because the AFW system in not required to be OPERABLE below 300*F.

Action 3.17.6.6.1 - One AFW flow indicator inoperable - If one flow channel becomes inoperable, the OPERABILITY of the associated flow control valve must be determined. Those flow indication channel failures which could prevent flow through that feed line cause the valve to be inoperable.

Flow indication channel failures which affect only indication, or which cause the valve to fail open do not necessarily cause the valve to be inoperable.

i Action 3.17.6.6.2 - Two AFW flow indicators inonerable - If two flow indication channels for one AFW feed line become inoperable there is no way to verify flow through that line; the associated AFW ' low control valve must be declared inoperable. The completion time of "immediately" does not mean

" instantaneously", rather it implies " start as quickly as plant conditions permit and continue until completed."

l 7.

PCS Leakaae Detection Instrumentation - Four diverse systems for PCS leak detection are required to be OPERABLE, any one Containment Humidity Monitor, any one Containment Atmosphere Gaseous Activity Monitor, any one Containment Air Cooler Condensate Level Switch, and any one Containment Sump Level indicator. The air cooler level switch must be associated with an operating air cooler.

Footnotes (b) and (c) are intended to clarify that the requirement.is for one instrument channel of each type to be operable, and that continued operation is not permitted unless at least one instrument channel, out of all those specified, is operable.

If one OPERABLE Instrument of each type is not available, the appropriate Action statement must be followed; if no PCS leakage Detection instrument channels are operable, Action 3.17.6.21 is applicable.

The PCS leakage detection instrumentation systems are not required to be OPERABLE when the PCS temperature is below 300*F because the consequence of leakage at reduced temperature and pressure is small, and because the PCS is accessible for local inspection.

Action 3.17.6.7.1 - One reauired leak detection system inoperable - Operation may continue with one of the required four types of leak detection systems I

inoperable, but one instrument of each type must be restored to OPERABLE B 3.17-28 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued) status prior to the next startup from COLD SHUTDOWN.

Several of the instruments cannot be conveniently repaired with the plant at elevated temperature due to their location or their impact on containment integrity.

Three separate leak detection systems, together with daily PCS inventory checks, are considered adequate for continued operation.

Action 3.17.6.7.2 - Two or three reauired leak detection systems inoperable -

Daily PCS inventory calculations provide adequate leakage detection for limited periods. Thirty days is considered adequate time in which to accomplish repair" - tssary to return at least three of the required instruments to ops- " ' status.

8.

Primary Safety Valve Position Indication - Each Primary Safety valve is provided with two means of detecting an open or leaking valve; one acoustical monitor and one tail pipe temperature indicator.

Primary Safety Valve position mi _ tion instrumentation is not required to be OPERABLE when the PCS tempe, w e is below 300*F because the consequence of leakage at reduced temperature and pressure is small, and.because the PCS is accessible for local inspection.

Primary Safety Valve position indication has been excepted from the requirements of Specifications 3.0.4 and 4.0.4 to permit a startup from HOT SHUTDOWN with an inoperable channel. Without such an exception, no startup could be made without cooling down to repair the inoperable channel.

Action 3.17.6.8 - One Primars

.fety Valve oosition indication channel inoperable - The Primary Safety valves are located on top of the pressurizer.

During operation at elevated temperatures, the position indication is not accessible for repair. One OPERABLE channel provides sufficient capibility to detect leakage for limited periods of time.

The inoperable channel must be restored to OPERABLE status prior to the next start up from COLD SHUTDOWN.

9.

Power Operated Relief Valve Position Indication - Each PORY is provided with three means of position detection; a stem position indicator, an acoustical monitor mounted on the valve, and a temperature indicator mounted on the common tailpipe. The acoustic monitors and temperature indicator provide indication of leakage through the PORV and its associated block valve.

PORV position indication is required to be OPERABLE except when the PCS is in COLD SHUTDOWN or when the PORV is isolated by a closed PORV block valve which i

has OPERABLE position indication. When the plant is in COLD SHUTDOWN, PORV leakage is of little consequence. When the PORV is isolated, the block valve position indication provides the needed information.

PORY position indication has been excepted from the requirements of Specifications 3.0.4 and 4.0.4 to permit a startup from HOT SHUTDOWN with an inoperable channel. Without such an exceptien, no startup could be made without cooling down to repair the inoperable channel.

B 3.17-29 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued)

Action 3.17.6.9 - One or two PORY oosition indication channels inoperable -

The PORVs are located on top of the pressurizer. During operation at elevated temperatures, the position indication is not accessible for repair.

One OPERABLE channel provides sufficient capability to detect leakage for limited periods of time. The inoperable channels must be restored to OPERABLE status prior to the next start up from COLD SHUTDOWN.

10.

PORV Elock Valve Position Indication - Each PORV block valve is provided with position indication lights operated by limit switches on the valve motor operator and by a temperature indicator mounted on the common PORV tailpipe.

PORV block valve position indication is required to be OPERABLE except when the PCS is depressurized and vented through a monitored path. The PORV block valves are required to be open at low temperatures so that the PORVs can provide Low Temperature Over Pressure protection.

PORV block Valve position indication has been excepted from the requirements of Specifications 3.0.4 and 4.0.4 to permit a startup from H0T SHUTDOWN with an inoperable channel. Without such an exception, no startup could be made without cooling down to repair the inoperable channel.

Action 3.17.6.10 - PORV Block Valve oosition indication inocerable - The PORV block valves are located on top of the pressurizer. During operation at-elevated temperatures, the position indication is not accessible for repair.

The PORV block valves are motor operated valves and are not likely to inadvertently change position. They are in series with the PORVs. During operation at elevated temperatures, when LTOP is not required, operation may continue with only one channel of position indication. When LTOP protection is required, but valve position lights are inoperable, the PCS is accessible and operation may continue if position of the block valves is verified each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Inoperable channels must be restored to OPERABLE status prior to the next start up from COLD SHUTDOWN.

11.

SWS Break Detector - Flow indicators measuring Service Water System flow into and out of the containment are used to actuate an alarm if in flow significantly exceeds outflow.

Such a mismatch could be indicative of a cooler leak or a pipe break. The Break Detector is intended to allow identification of a leaking cooler by isolation of service water to each cooler in secession until the alarm clears. The Break Detector is strictly a maintenance aid and is intended to provide no safety function.

(Ref. 12)

The SWS Break Detector is required to be OPERABLE at HOT STANDBY and above, when the containment is inaccessible for direct observation of leakage, yet the SWS is required. Specifications 3.0.4 and 4.0.4 are not applicable to the SWS break detector because it does not provide an accident related safety l

function.

Action 3.17.6.11 - SWS Break Detector inoperable - If the break detector is inoperable, it must be restored to OPERABLE status prior to the next startup.

B 3.17-30 Amendment No. 162

)

i j

I 3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued) 12.

Flux - AT Power comoarator - The Flux - AT Power comparator compares the two Q Power inputs (Excore Power Range flux and AT power) for that RPS channel, provides a meter ind.cating the difference between these inputs, and i

initiates an alarm if the difference exceeds a set value.

Existence of a significant difference between the monitored signals indicates that either a flux tilt is developing, or that a calibration of the Excore Power Range or AT power circuits is required.

The Flux - AT Power Comparator is not required to be OPERABLE when the reactor is below 2% power because the differential temperature measurement is not meaningful at very low power levels.

i Action 3.17.6.12.1 - One Flux - AT Power Comparator channel inoperable - With one channel inoperable, the three remaining power comparator channels are sufficient to assure that no unobserved flux tilt is developing.

The inoperable channel must be restored to OPERABLE status prior to the next i

reactor startup.

Action 3.17.6.12.2 - Two Flux - AT Power Comoarator channels inocerable -

With two power comparator channels inoperable, power must be limited to 70%

of RATED POWER to assure that no unobserved flux tilt causes local power limits to be exceeded.

13. Rod Group Seauence Control / Alarm - The Rod position indication provides two regulating rod group sequence related functions. The PIP, using the signals from primary rod position indication synchros on the selected target rods, provides the actual control of group sequencing relays; the SPI, using the signals from the secondary position indication reed switches on the target rods, provides the Out-of-Sequence Alarm if the target rod position indicated that the group is out of position with respect.to the other regulating groups. The Out-of-Sequence alarm provides assurance that the operator is aware of abnormal regulating rod positioning.

When only one control rod is capable of being withdrawn, group sequencing and' Out-of-Sequence alarm provide no useful function and are not required.

Action 3.17.6.13 - Group Rod Group Seauence Control / Alarm channel inoperable

- When either sequence function is inoperable, one of the methods of assuring correct control rod alignment is not available.

Adequate assurance of correct rod positioning is retained by manual verification of regulating rod j

position after each occurrence of rod motion.

14. Concentrated Boric Acid Tank Low level Alarm - A common " Conc Boric Acid Tank Lo Level" alarm notifies the operator that one boric acid tank is below the required total inventory. There is one level switch mounted on each tank, eitner of which actuates the common alarm in the control room.

These two switches and the common alarm comprise the required channels.

The Concentrated Boric Acid Tank low level alarm is not required to be OPERABLE when the reactor is at HOT SHUTDOWN or below, because the inventory of boric acid is not required.

i B 3.17-31 Amendment No. 162 l

3.17 INSTRUMENTATION SYSTEMS Basis: Table 3.17.6 (continued)

Action 3.17.6.14 - One or Two Conc Boric Acid Tank low level alarm channels inoperable - When either a boric acid tank low level alarm switch or the common alarm is inoperable, the level in the tank or tanks without an operable level alarm should be verified to be within limits each shift.

15.

Excore Detector Deviation Alarm - An alarm is derived by the Excore Detector Deviation Alarm channel on excessive flux tilt. The Excore Detector Deviation Alarm compares the combined average power reading of all four Excore Power Range channels to the average from each channel, and alarms if the setpoint is exceeded. One channel being significantly different from the average could indicate a developing Quadrant Power Tilt (Tq).

The Excore Detector Deviation Alarm is required to be OPERABLE above 25%

RATED POWER, when the Tq specification is applicable.

Action 3.17.6.15 - Excore Deviation Alarm inocerable - When the Excore Deviation Alarm is inoperable, continuous monitoring of Tq is unavailable.

The function of Tq monitoring must be maintained by manually calculating Tq each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

16. AXIAL SHAPE INDEX Alarm - The ASI Alarm Channel monitors the ASI using the Excore upper and lower detector signals as inputs and provides an alarm when ASI administrative limits are exceeded.

This alarm is only functional ebove a nominal 15% indicated power when the High Startup Rate trip is bypassed.

It uses the High Startup Rate Pre-Trip Unit to provide the alarm function, and shares the same alarm window.

It is not required to be OPERABLE below 25% RATED POWER.

Action 3.17.6.16 - One or two ASI alarm channels inocerable - The ASI alarm is one function of the Thermal Margin Monitor.

Four channels are provided, but two are sufficient for ASI monitoring.

If one or two channels are inoperable, they must be restored prior to the next startup from COLD SHUTDOWN.

17.

Shutdown Coolina (SDC) Suction Valve Interlocks - Interlocks are provided for each SDC suction valve. These interlocks are pressure switches which prevent opening of the associated valve when PCS pressure is above the design pressure of the SDC system. One pressure switch is provided for each valve.

The interlocks are required to be OPERABLE when PCS pressure exceeds 200 psia to assure that the SDC System is not over pressurized by inadvertent opening of the suction valves at high PCS pressure.

Action 3.17.6.17 - One or two SDC suction interlocks inoperable - When an interlock is inoperable assurance that the valve will not be opened with high PCS pressure is reduced.

The circuit breaker for the motor operator on the associated SDC suction valve must be racked out, except during actual operation of the valve.

The extra action of having to rack in and B 3.17-32 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS

' Basis: Table 3.17.6 (continued) close the breaker prior to valve operation provides protection against inadvertent valve operation.

18. Power Decendant Insertion limit (PDIL) Alarm - PDIL Alarms are provided by both the primary and secondary rod position monitors.

Each system monitors the position of each regulating group target rod and compares it to a setpoint which is a function of power level. The group deviation alarms assure that the operator is aware of any group misalignment. Maintaining the rods above the PDIL, when the reactor is critical, assures that adequate i

SHUTDOWN MARGIN is available.

The PDIL alarm is not required at HOT SHUTDOWN and below, since no more than one control rod would be withdrawn and the SHUTDOWN Margin calculation accounts for that.

Action 3.17.6.18 - One PDIL alarm inocerable - With one PDIL alarm inoperable assurance of proper SHUTDOWN MARGIN is reduced. Additional assurance of proper SHUTDOWN MARGIN is provided by verification of proper group position within 15 minutes following any regulating rod motion.

19.

Fuel Pool Area Radiation Monitor - The spent fuel pool is provided with two radiation monitors. These instruments provide warning of a release in the case of a fuel handling accident and provide the fuel pool criticality 3

monitoring required by 10 CFR 70.24.

p-tion 3.17.6.19 - One or two Fuel Pool Area Monitors inoperable - With one or two Fuel Pool Area Radiation Monitors inoperable, fuel movement in the spent fuel pool area must be stopped. The monitor must be restored to OPERABLE status or equivalent monitoring capability provided within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The Fuel Pool is designed to be adequately subcritical even at zero ppm boron concentration. The specified 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is adequate to repair the installed instrumentation or to provide other monitoring equipment without incurring i

undue risk of a criticality.

]

20. Containment Refuelina Radiation Monitors - Two radiation monitors are located in the refueling area of the containment which actuate the Containment High Radiation Logic when switched to the refueling mode.

In this mode, a high level alarm on either monitor will actuate containment isolation through the associated CHR logic channel. The arrangement of these controls is illustrated in reference 7.

Action 3.17.6.20 - One or two Containment Refuelina Monitors inocerable -

With one or two Containment Refueling Radiation Monitors inoperable, stop REFUELING OPERATIONS in the containment. This eliminates the possibility of damaging an irradiated fuel bundle.

Action 3.17.6.21 - Reouired action AND associated completion time not met -

If any action specified by Action statements 3.17.6.1 through 3.17.6.18 (items 19 and 20 are not associated with reactor operation) is not met AND its completion time has expired, the plant must be placed in a condition where the inoperable equipment is not required.

Twelve hours are allowed B 3.17-33 Amendment No. 162

r 3.17 INSTRUMENTATION SYSTEMS t

Basis: Table 3.17.6 (continued)-

to bring the plant to HOT SHUTDOWN, and 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months to reach conditions where.the affected equipment is not required, to avoid unusual plant transients.- Both the 12 and the 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time periods start when it is discovered that Action 3.17.21.6 is applicable..

i J

8 i

i t

1 l

3 B 3.17-34 Amendment No. 162

3.17 INSTRUMENTATION SYSTEMS References for 3.17 Basis (1) Updated FSAR, Section 7.2.7.

(2) Updated FSAR, Section 7.2.5.2 j

(3) Updated FSAR, Figures 7-1 and 7-2 (4) P&ID SIS Logic Diagram E-17, Sh 3 (5) P&ID SIS Logic Diagram E-17, Sh 4 (6) P&ID RAS Logic Diagram E-17, Sh 5 (7) Updated FSAR, Figure 7-37 (8) P&ID CHP Logic Diagram E-17, Sh 6 (9)

P&ID CHR Logic Diagram E-17, Sh 7 (10) P&ID SGLP Logic Diagram E-17, Sh 20 (11) Updated FSAR, Figure 7-56 (12) Service Water Functional Description, FD-M-111 i

s B 3.17-35 Amendment No. 162

3.18 Deleted 3.19 IODINE REMOVAL SYSTEM Soecification:

3.19 The Iodine Removal System shall be OPERABLE with:

a.

The Sodium Hydroxide Tank (T-103) containing a minimum 4,200 300 gallons of 30.0 0.5 percent by weight sodium hydroxide solution.

b.

T-103 capable of supplying sodium hydroxide solution to the containment spray pump suction headers.

Aeolicability Specification 3.19 is applicable during POWER OPERATION.

Action With the Iodine Removal System inoperable:

a.

Restore the system to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or b.

Be in HOT SHUTDOWN within the next 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Basis The Iodine Removal System acts in conjunction with the containment spray system to reduce the post-accident level of fission products in the containment atmosphere.

Sodium Hydroxide is added to the recirculated water after a LOCA to establish a neutral pH.

References j

FSAR, Section 6.4.

FSAR, Section 14.22.

1 1

Amendment No. 20, 31, 10, 43, 58, 110, 158, 162 3-79

3.20 SH0CK SUPPRESSORS (Snubbers)

Acolicability Applies to the operating status of the safety-related piping shock suppressors (snubbers). The only snubbers excluded from this requirement are those installed on non-safety-related systems and then only if their failure or failure of the system on which they are installed would have no adverse effect on any safety-related system.

Ob.iective To minimize the possibility of unrestrained pipe motion as might occur during an earthquake or severe transient.

Soecification 3.20.1 When systems associated with snubbers in Specification 3.20 are required to be OPERABLE, the snubbers in those systems shall be OPERABLE except as noted below:

a.

With one or more snubbers inoperable, within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months replace or restore the inoperable snubbers to OPERABLE status and perform an engineering evaluation per Specification 4.16.1.c. on the supported component or declare the system inoperable.

Basis Snubbers are required to be OPERABLE to ensure that the structural integrity of the reactor coolant system and all other safety-related systems is maintained during and following a seismic or other event initiating dynamic loads.

Amendment No. 23, 59, 107, 162 3-80

l 3.21 CRANE OPERATION AND MOVEMENT OF HEAVY LOADS

[

Acolicability Applies to limitations in crane operation and the movement of heavy loads over the 649' level of the auxiliary building and inside containment. A heavy load is a load, other than a fuel assembly, which weighs more than 1300 lbs.

Ob.iective To minimize the probability of and the consequences of a heavy load drop.

Soecification 3.21.1 Inside Containment a.

Heavy loads shall not be moved over the primary coolant system if the temperature of the coolant or the steam in the pressurizer exceeds 225'F.

b.

Heavy loads shall not be moved unless the potential for a load drop-is extremely small as defined by Generic Letter 85-11 or an evaluation in compliance with section 5.1 of NUREG-0612 has been completed.

3.21.2 Over the 649' Level of the Auxiliary Buildina The surface of the floor adjacent to the spent fuel pool is at the 649' level of the auxiliary building. The spent fuel pool is made up of two (2) zones.

They are the main pool zone and the north tilt pit zone.

a.

Heavy leads shall not be moved over fuel stored in the main pool zone.

b.

Heavy loads shall not be moved over areas of the main pool zone which do not contain fuel unless the fuel stored in the main pool zone has decayed a minimum of 30 days when the charcoal filter is operating, or the fuel stored in the main pool zone has decayed a minimum of 90 days when the charcoal filter is not operating.

c.

Heavy loads shall not be moved over the north tilt pit zone unless the fuel stored in the north tilt pit zone has decayed a minimum of 22 days when the charcoal filter is operating; or, the fuel in the north tilt pit zone has decayed a minimum of 77 days when the charcoal filter is not operating.

d.

Heavy loads shall not be moved over the 649' level of the auxiliary building unless:

(1) The fuel storage building crane interlocks are OPERABLE or they are bypassed and the crane is under administrative control of a supervisor, and (2) No fuel handling operations are in progress.

Amendm.ent No. 35, Ill, 162 3-81

l 3.21 CRANE OPERATION AND MOVEMENT OF HEAVY LOADS (Continued) e.

Loads weighing more than 25 tons shall not be moved over the main pool zone unless an evaluation in compliance with Section 5.1 of NUREG-0612 has been completed.

f.

Heavy loads shall not be moved unless the potential for a load drop is extremely small as defined by Generic Letter 85-11 or an evaluation in compliance with section 5.1 of NUREG-0612 has been completed.

g.

The Fuel Pool Building Crane shall not be used to move material past the fuel storage pool when its interlocks are inoperable.

Basis Reference (7) defines a heavy load as a load which weighs more than a fuel assembly and its handling tool.

The lightest Palisades fuel assemblies weigh approximately 1298 lbs and the heaviest weigh approximately 1375 lbs. The handling tool weighs 60-70 lbs.

For conservatism, loads weighing more than 1300 lbs, except for fuel assemblies, are classified as heavy loads.

Heavy loads are not allowed over the pressurized primary coolant system to preclude dropping objects which could rupture the boundary of the primary coolant system allowing loss of coolant and overheating of the core.

Prohibiting movement of heavy loads over fuel stored in the main pool zone minimizes the criticality and radiological effects cf a load drop.

Heavy loads are allowed over the fuel stored in the north tilt pit zone because the maximum number of fuel bundles which can be stored in that zone is relatively small and the north tilt pit lies under the only possible safe load path for moving heavy loads into and out of containment without passing over the main pool zone.

Requiring that the spent fuel pool crane interlocks are OPERABLE ensures that heavy loads or the unloaded crane will not drift over or be inadvertently moved over fuel stored in the main pool area.

Specific decay times with and without the charcoal filters operating are necessary to ensure that heavy loads are moved within analyzed conditions.

The charcoal filter is operating when at least one Fuel Handling Area exhaust fan is drawing suction through the charcoal filter and the Fuel Handling Area ventilation system is in the refueling mode.

Assuring that no fuel handling operations are in progress while heavy loads are being moved allows operator attention to be focused on the heavy load movement.

Amendment No. 35, 37, 111, 162 3-82

3.21 CRANE OPERATION AND MOVEMENT OF HEAVY LOADS (Continued) l Basis (Continued)

The objectives of the Guidelines of Section 5.1 of NUREG-0612 are to assure that (1) the potential for a load ~ drop is extremely small, or (2) for each area addressed, the following evaluation criteria are satisfied:

(1) Releases of radioactive material that may result from damage to spent fuel based on calculations involving accidental dropping of a postulated heavy load produce doses that are well within 10 CFR Part 100 limits of 300 rem thyroid and 25 rem whole body; (2) Damage to fuel and fuel storage racks based on calculations involving accidental dropping of a postulated heavy load does not result in a i

configuration of the fuel such that k,n is larger than 0.95; i

(3) Damage to the reactor vessel or the spent fuel pool based on calculations of damage following accidental dropping of a postulated heavy load is limited so as not to result in water leakage that could uncover the fuel, (makeup water provided to overcome leakage shall be from a borated source of adequate concentration); and (4) Damage to equipment in redundant or dual safe shutdown paths, based on calculations assuming the accidental dropping of a postulated heavy load, will be limited so as not to result in loss of required safe shutdown functions.

Generic Letter 85-11 defines the potential for a heavy load drop as extremely small when a heavy load is moved in compliance with the Guidelines of section 5.1.1 of NUREG-0612.

References (1)

Palisades Plant Evaluation of Postulated Cask Drop Accidents by Bechtel Associates Professional Corporation, August 1974.

(2)

Palisades Plant Final Safety Analysis Report - Appendix J-Evaluation of Postulated Cask Drop Accidents, submitted to the NRC on August 9, 1974.

(Structural Analysis only)

(3)

Letter dated January 16, 1978 from D P Hoffman, CPC to Director NRR, entitled " Palisades Plant-Movement of Shielded Shipping Cask."

(4)

Letter dated November 1, 1976 from D A Bixel, CPC, to Director NRR entitled " Spent Fuel Pool Modifications."

(5) SER supporting License Amendment No. 35 dated February 8, 1978.

(6)

SER supporting License Amendment No. 81 dated May 22, 1981.

(7) NUREG-0612 - Control of Heavy Loads in Nuclear Power Plants.

(8) Safety Analysis Report (Rev. 1) dated October 16, 1986 attached to letter dated October 16, 1986 from K W Berry, CPC, to NRC.

(9) Generic Letter 85-11 dated June 28, 1985.

Amendment No. 27, Ill, 162 3-83

l 3.22 Deleted j

3.23 POWER DISTRIBUTION LIMITS 3.23.1 LINEAR HEAT RATE fLHR) l The LHR in the peak power fuel rod at the peak power elevation Z shall not exceed the value in Table 3.23-1 times F (Z) [the function F (Z) is 4

4 shown in Figure 3.23-1].

APPLICABILITY:

Power operation above 50% of RATED POWER.

ACTION 1:

)

When using the incore alarm system to monitor LHR, and with four or more coincident incore alarms, initiate within 15 minutes corrective action to reduce the LHR to within the limits and restore the incore readings to less than the alarm setpoints within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or failing this, be at less than 50% RATED POWER within the following 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

)

ACTION 2:

When using the excore monitoring system to monitor LHR and with the A0'

)

deviating from the target A0 by more than 0.05, discontinue using the excore monitoring system for monitoring LHR.

If the incore alarm system is inoperable, within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months be at 85% (or less) RATED POWER and follow l

the procedure in ACTION 3 below.

ACTION 3:

If the incore alarm system is inoperable and the excore monitoring i

system is not being used to monitor LHR, operation at less than or equal to 85% RATED POWER may continue provided that incore readings are recorded manually.

Readings shall be taken on a minimum of 10 individual ~ detectors per quadrant (to include a total number of 160 detectors in a 10-hour period) within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and at least every 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thereafter.

If readings indicate a local power level equal to or-greater than the alarm setpoints, the action specified in ACTION 1 above shall be taken.

Amendment No. 37, 50, SS, 118, lii, 162

)

3-84

POWER DISTRIBUTION LIMITS 3.23.1 LINEAR NEAT RATE (LHR)

LIMITING CONDITION FOR OPERATION Basis The limitation of LHR ensures that, in the event of a LOCA, the peak temperature of the cladding will not exceed 2200*F."'

Either of the two core power distribution monitoring systems (the incore alarm system or the excore monitoring system) provides adequate monitoring of the core power distribution and is capable of verifying that the LHR does not exceed its limits. The incore alarm system performs this function by continuously monitoring the local power at many points throughout the core and comparing the measurements to predetermined setpoints above which the limit on LHR could be exceeded. The excore monitoring system performs this function by providing comparison of the measured core A0 with predetermined A0 limits based on incore measurements. An Excore Monitoring Allowable Power Level (APL), which may be less than RATED POWER, is applied when using the excore monitoring system to ensure that the A0 limits adequately restrict the LHR to less than the limiting values.i2 If the incore alarm system and the excore monitoring system are both inoperable, power will be reduced to provide margin between the actual peak LHR and the LHR limits and the incore readings will be manually collected at the terminal blocks in the control room utilizing a suitable signal detector.

If this is not feasible with the manpower available, the reactor power will be reduced to a point below which it is improbable that the LHR limits could be exceeded.

i The time interval of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and the minimum of 10 detectors per quadrant are sufficient to maintain adequate surveillance of the core power distribution i

to detect significant changes until the monitoring systems are returned to service.

To ensure that the design margin of safety is maintained, the determination of both the incore alarm setpoints and the APL takes into account the local LHGR measurement uncertainty factors given in Table 3.23-3, an engineering uncertainty factor of 1.03, and a thermal power measurement uncertainty factor of 1.02.

References (1)

EMF-91-77 (2)

(Deleted)

(3)

(Deleted)

(4) XN-NF-80-47 (5)

FSAR Section 3.3.2.5 (6)

FSAR Section 7.6.2.4 Amendment No. SS, 82, 118, 114, 162 3-85

TABLE 3.23-1 LINEAR HEAT RATE LIMIT l

Peak Rod 15.28 kW/ft 1

i i

TABLE 3.23-2 RADIAL PEAKING FACTOR LIMITS, Ft Peaking Factor Reload L & M Reload N Reload 0 1

Assembly F^

1.57 1.66 1.76 PeakRodFI 1.92 1.92 2.04 1

TABLE 3.23-3 POWER DISTRIBUTION MEASUREMENT UNCERTAINTY FACTORS LHR/ Peaking Factor Measurement Measurement Measurement Parameter Uncertainty

Uncertainty

hub bh'*'

LHR 0.0623 0.0664 0.0795 F^

0.0401 0.0490 0.0695 FI 0.0455 0.0526 0.0722 (a)

Measurement uncertainty for reload cores using all fresh incore detectors.

(b)

Measurement un'ertainty for reload cores using a mixture of fresh and once-burned incore detectors.

(c)

Heasurement uncertainty when quadrant power tilt, as determined using incore measurements and an incore analysis computer program, exceeds 2.8% but is less than or equal to 5%.

Amendment No. 68, 118, 113, lii, 155, 159, 162 3-86

3.23 POWER DISTRIBUTION LIMITS ALLOWABLE LHR vs PEAK POWER LOCATION h 1.15 I

J 1.10 E

X g

1.05 0

C (0. 6, 1. 0) p 1.00 []

LL 0.95 O'

]

(1.0, 0 93

)

UJ 0.90 i

O J

J 0 85 4

0 0.2 0.4 0.6 0.8 1

PEAK POWER LOCATION FIGURE 3.23-1 Amendment No. 68, M B, 162 3-87

3.23 POWER DISTRIBUTION LIMITS 3.23.2 RADIAL PEAKING FACTORS LIMITING CONDITION FOR OPERATION A

T The radial peaking factors F, and F shall be less than or equal to the value in Table 3.23-2 tiInes the following quantity. The quantity is

[1.0 + 0.3 (1 - P)] for P 2.5 and the quantity is 1.15 for P <.5.

P is the core thermal power in fraction of RATED POWER.

APPLICABILITY:

Power operation above 25% of RATED POWER.

ACTION:

1.

For P < 50% of rated with any radial peaking factor exceeding its limit, be in at least hot shutdown within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

2.

For P 2 50% of rated with any radial peaking factor exceeding its limit, reduce thermal power within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to less than the lowest value of:

[1

- 3.33( r - 1) ] x RATED POWER T

L A

T Where F[ is the measured value of either F, or F, and F isthecorrespondinglimitfromTEble3.f3-2.

Bas.is A

T The limitations on F, and F are provided to ensure that assumptions used in the analy. sis for estEblishinh DNB margin, LHR and the thermal margin / low-pressure and variable high-power trip set points remain valid during i

operation. Data from the incore detectors are used for determining the measured radial peaking factors. The periodic surveillance requirements for determining the measured radial peaking factors provide assurance that they remain within prescribed limits.

Determining the measured radial peaking factors after each fuel loading prior to exceeding 50% of RATED POWER provides additional assurance that the core is properly loaded.

To ensure that the design margin of safety is maintained, the determination of radial peaking factors takes into account the appropriate measurement uncertainty factors'" given in Table 3.23-3 References I

(1)

FSAR Section 3.3.2.5 Amendment No. 58, 118, 137, 143, 141, 155, 162 3-88

3.23 POWER DISTRIBUTION LIMITS 3.23.3 OVADRANT POWER TILT - T_

LIMITING CONDITION FOR OPERATION The quadrant power tilt (T,) shall not exceed 5%.

APPLICABILITY:

Power operation above 25% of RATED POWER.

ACTION:

1.

With T, > 5% but s 10%,

a.

Correct T, within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after exceeding the limit, or b.

Determine within the next 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and at least once every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter, that the radial peaking factors are within the limits of Section 3.23.2, or c.

Reduce power, at the normal shutdown rate, to less than 85%

RATED POWER and determine that the radial peaking factors are within the limits of Section 3.23.2.

At reduced power, determine at least once every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months that the radial peaking factors are within the limits of Section 3.23.2.

2.

With T, > 10%:

a.

Correct T, within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after exceeding the limit, or b.

Reduce power to less than 50% RATED POWER within the next 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and determine that the radial peaking factors are within the limits of Section 3.23.2.

At reduced power, determine at least once every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months that the radial peaking factors are within the limits of Section 3.23.2.

3.

With T, > 15%, be in at least hot standby within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

RiL111 Limitations on quadrant power tilt are provided to ensure that design safety margins are maintained. Quadrant power tilt is determined from excore detector readings which are calibrated using incore detector measurements."'

Quadrant power tilt calibration factors are determined using incore measurements and an incore analysis computer program.t2 References (1)

FSAR, Section 7.4.2.2 (2)

FSAR, Section 7.6.2.4 Amendment No. 58, 118, lii, 154, 162 3-89

4.0 SURVEILLANCE RE0VIREMENTS 4.0.1 Surveillance requirements shall be applicable during the reactor operating conditions associated with individual Limiting Conditions for Operation unless otherwise stated in an individual surveillance requirement.

4.0.2 Unless otherwise specified, each surveillance requirement shall be performed within the specified time interval with:

a.

A maximum allowable extension not to exceed 25% of the surveillance interval, and b.

A total maximum combined interval time for any three consecutive surveillance intervals not to exceed 3.25 times the specified surveillance interval.

l 4.0.3 Failure to perform a Surveillance Requirement within the allowed surveillance interval, defined by Specification 4.0.2, shall constitute noncompliance with the operability requirements for a Limiting Condition for Operation. The time limits of the action requirements are applicable at the time it is identified that a Surveillance Requirement has not been performed. The action requirements may be delayed for up j

to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to permit the completion of the surveillance when the allowable outage time limits of the action requirements are less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Surveillance Requirements do not have to be performed on inoperable equipment.

4.0.4 Entry into a reactor operating condition or other specified condition 4

shall not be made unless the Surveillance Requirements associated with a Limiting Condition of Operation has been performed within the stated j

surveillance interval or as otherwise specified. This provision shall not prevent passage through or to plant conditions as required to comply with action requirements.

4 4.0.5 Surveillance Requirements for inservice inspection and testing of ASME Code Class 1, 2, and 3 components shall be applicable as follows:

a.

Inservice inspection of ASME Code Class 1, 2, and 3 components and inservice testing of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with Section XI of the ASME Boiler and Pressure Vessel Code and applicable Addenda as required by 10 CFR 50, Section 50.55a(g), except where specific written relief has been granted by the Commission pursuant to 10 CFR 50, Section 50.55a(g)(6)(1).

Amendment No. 30, 51, 130, 162 4-1

4.0 SURVEILLANCE RE0VIREMENT (Continued) b.

Surveillance intervals specified in Section XI of the ASME Boiler and Pressure Vessel Code and applicable Addenda for the inservice inspection and testing activities required by the ASME Boiler and Pressure Vessel Code and applicable Addenda shall be applicable as follows in these Technical Specifications:

ASME Boiler and Pressure Vessel Required frequencies Code and applicable Addenda for performing inservice terminology for inservice inspection and testing insoection and testina activities activities Weekly At least once per 7 days Monthly At least once per 31 days Quarterly or every 3 months At least once per 92 days Semiannually or every 6 months At least once per 184 days Every 9 months At leat'. once per 276 days Yearly or annually At least once per 366 days c.

The provisions'of Specification 4.0.2 are applicable to the above required frequencies for performing inservice inspection and testing activities.

d.

Performance of the above inservice inspection and testing activities shall be in addition to other specified Surveillance Requirements.

e.

Nothing in the ASME Boiler and Pressure Vessel Code shall be construed to supersede the requirements of any Technical Specification.

Amendment No. 440, 162 4-2

4.0 BASIS Specifications 4.0.1 through 4.0.5 establish the general requirements applicable to Surveillance Requirements. These requirements are based on the 1

Surveillance requirements stated in the code of Federal Regulations,10 CFR 50.36(c)(3):

" Surveillance requirements are requirements relating to test, calibration, or inspection to ensure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions of operation will be met."

j Specification 4.0.1 establishes the requirement that surveillances must be performed during reactor operating conditions or other conditions for which the requirements of the Limiting Conditions for Operation apply, unless otherwise stated in an individual Surveillance Requirement. The purpose of this specification is to ensure that surveillances are performed to verify the operational status of systems and components and that parameters are within specified limits to ensure safe operation of the facility when the plant is in a reactor operating condition or other specified condition for which the associated Limiting Conditions for Operation are applicable.

Surveillance Requirements do not have to be performed when the facility is in an operational condition for which the requirements of the associated Limiting Condition for Operation do not apply, unless otherwise specified.

The Surveillance Requirements associated with a Special Test Exception are only applicabie when the Special Test Exception is used as an allowable exception the requirements of a specification.

Specification 4.0.2 establishes the conditions under which the specified time interval for Surveillance Requirements may be extended.

Item a. permits an allowable extension of the normal surveillance interval to facilitate surveillance scheduling and consideration of plant operating conditions that may not be suitable for conducting the surveillance; e.g., transient conditions or other ongoing surveillance or maintenance activities.

Item b.

limits the use of the provisions of item a. to ensure that it is not used rept.atedly to extend the surveillance interval beyond that specified. The limits of Specification 4.0.2 are based on engineering judgment and the recognition that the most probable result of any particular surveillance being performed is the verification of conformance with the Surveillance Requirements. These provisions are sufficient to ensure that the reliability ensured through surveillance activities is not significantly degraded beyond that obtained from the specified surveillance interval.

Specification 4.0.3 establishes the failure to perform a Surveillance Requirement within the allowed surveillance interval, defined by the provisions of Specification 4.0.2, as a condition that constitutes a failure to meet the operability requirements for a Limiting Condition for Operation.

Under the provisions of this specification, systems and components are assumed to be operable when Surveillance Requirements have Amendment No. B O, 162 4-3

4.0 BASIS (Continued) been satisfactorily performed within the specified time interval. However, nothing in this provision is to be construed as implying that systems or components are operable when they are found or known to be inoperable although still meeting the Surveillance Requirements. This specification also clarifies that the action requirements are applicable when Surveillance Requirements have not been completed within the allowed surveillance interval and that the time limits of the action requirements apply from the point in time it is identified that a surveillance has not been performed and not at the time that the allowed surveillance interval was exceeded.

Completion of the Surveillance Requirement within the allowable outage time limits of the action requirements restores compliance with the requirements of Specification 4.0.3.

However, this does not negate the fact that the failure to have performed the surveillance within the allowed surveillance interval, defined by the provisions of Specification 4.0.2, was a violation of the operability requirements of a Limiting Condition for Operation that is subject to enforcement action.

Further, the failure to perform a surveillance within the provisions of Specifications 4.0.2 is a violation of a Technical Specification requirement and is, therefore, a reportable event under the requirements of 10 CFR 50.73(a)(2)(1)(B) because it is a condition prohibited by the plant's Technical Specifications.

If the allowable outage time limits of the action requirements are less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or a shutdown is required to comply with action requirements, e.g.,

Specification 3.0.3, a 24-hour allowance is provided to permit a delay in implementing action requirements. This provides an adequate time limit to complete Surveillance Requirements that have not been performed. The purpose of this allowance is to permit the completion of a surveillance before a shutdown is required to comply with action requirements or before other remedial measures would be required that may preclude completion of a surveillance. The basis for this allowance includes consideration for plant conditions, adequate planning, availability of personnel, the time required to perform the surveillance, and the safety significance of the delay in completing the required surveillance. This provision also provides a time limit for the completion of Surveillance Requirements that become applicable as a consequence of plant condition changes imposed by action requirements and for completing Surveillance Requirements that are applicable when an exception to the requirements of Specification 4.0.4 is allowed.

If a surveillance is not completed within the 24-hour allowance, the time limits of the action requirements are applicable at that time. When a surveillance is performed within the 24-hour allowance and the Surveillance Requirements are not met, the time limits of the action requirements are applicable at the time that the surveillance is terminated.

Surveillance Requirements do not have to be performed on inoperable equipment because the action requirements define the remedial measures that apply.

However, following expiration of the surveillance interval, the Surveillance Requirements have to be met to demonstrate that inoperable equipment has been restored to operable status.

Amendment No. MG,162 4-4

4.0 BASIS (Continued)

Specification 4.0.4 establishes the requirement that all applicable surveillances must be met before entry into a reactor operating condition or other condition of operation specified in the Applicability statement.The purpose of this specification is to ensure that system and component operability requirements or parameter limits are met before entry into an operational condition for which these systems and components ensure safe operation of the facility. This provision applies to changes in reactor operating conditions or other specified conditions associated with plant shutdown as well as startup.

Under the provisions of this specification, the applicable Surveillance Requirements must be performed within the surveillance interval to ensure that the Limiting Conditions for Operation are met during initial plant startup or following a plant outage.

When a shutdown is required to comply with action requirements, the provisions of Specification 4.0.4 do not apply because this would delay placing the facility in a lower operational condition.

Specification 4.0.5 establishes the requirement that inservice inspection of ASME Code Class 1, 2, and 3 components and inservice testing of ASME Code Class 1, 2, and 3 pumps and valves shall be performed in accordance with a periodically updated version of Section XI of the ASME Boiler and Pressure Vessel Code and Addenda as required by 10 CFR 50.55a. These requirements apply, except when relief has been provided in writing by the Commission.

This specification includes clarification of the frequencies for performing the inservice inspection and testing activities required by Section XI of the ASME Boiler and Pressure Vessel Code and applicable Addenda.

This clarification is provided to ensure consistency in surveillance intervals throughout the Technical Specifications and to remove ambiguities relative to the frequencies for performing the required inservice inspection and testing activities.

Under the terms of this specification, the more restrictive requirements of the Technical Specifications take precedence over the ASME Boiler and Pressure Vessel Code and applicable Addenda. The requirements of Specification 4.0.4 to perform surveillance activities before entry into a reactor operating condition or other specified condition takes precedence over the ASME Boiler and Pressure Vessel Code provision which allows pumps and valves to be tested up to one week after return to normal operation.

The Technical Specification definition of operable does not allow a grace period before a component, that is not capable of performing its specified function, is declared inoperable and takes precedence over the ASME Boiler and Pressure Vessel Code provision which allows a valve to be incapable of performing its specified function for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months before being declared inoperable.

Amendment No. H0, 162 4-5

4.1 OVERPRESSURE PROTECTION SYSTEM TESTS Surveillance Reauirements In addition to the requirements of Specification 4.0.5, each PORV flow path shall be demonstrated OPERABLE by:

J 1.

Testing the PORVs in accordance with the inservice inspection 1

requirements for ASME Boiler and Pressure Vessel Code,Section XI, Section IWV, Category B valves.

2.

Performance of a CHANNEL CALIBRATION on the PORV actuation channel at least once per 18 months.

3.

When the PORV flow path is required to be OPERABLE by Specification 3.1.8.1:

(a) Performing a complete cycle of the PORY with the plant above COLD SHUTDOWN at least once per 18 months.

(b)

Performing a complete cycle of the block valve prior to heatup from COLD SHUTDOWN, if not cycled within 92 days.

4.

When the PORV flow path is required to be OPERABLE by Specification j

3.1.8.2:

)

(a) Performance of a CHANNEL FUNCTIONAL TEST on the PORV actuation channel, but excluding valve operation, at least once per 31 l

days.

(b) Verifying the associated block valve is open at least once per 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

5.

Both High Pressure Safety Injection pumps shall be verified inoperable at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , unless the reactor h.ead is removed, when either PCS cold leg temperature is < 260*F, or when both shutdown cooling suction valves, H0-3015 and M0-3016, are open.

Basis With the reactor vessel head installed when the PCS cold leg temperature is less than 260*F, or if the shutdown cooling system isolation valves M0-3015 and M0-3016 are open, the start of one HPSI pump could cause the Appendix G or the shutdown cooling system pressure limits to be exceeded; therefore, both pumps are rendered inoperable.

l Amendment No. 130, 149, 150, 162 4-6

4.2 EOUIPMENT AND SAMPLING TESTS Aeolicability Applies to plant equipment and conditions related to safety.

Ob.iective To specify the minimum frequency and type of surveillance to be applied to critical plant equipment and conditions.

Specifications Equipment and sampling tests shall be conducted as specified in Tables 4.2.1, 4.2.2 and 4.2.3.

Basis Samolina and Eauioment Testina The equipment testing and system sampling frequencies specified in Tables 4.2.1, 4.2.2 and 4.2.3 are considered adequate, based upon experience, to maintain the status of the equipment and system so as to assure safe operation. Thus, those systems where changes might occur relatively rapidly are sampled frequently and those static systems not subject to changes are sampled less frequently.

l Amendment No. 20, 81, 162 4-7

4.2 f0VIPMENT AND SAMPLING TESTS Basis (continued)

The operability of the equipment and systems required for the control of hydrogen gas ensures that this equipment will be available to maintain the hydrogen concentration within containment below its flammable limit during post-LOCA conditions. Either recombiner unit or the purge system is capable of controlling the expected hydrogen generation associated with 1). zirconium-water reactions, 2) radiolytic decomposition of water and 3) corrosion of metals within containment. These hydrogen control systems are consistent with ti.e recommendations of Regulatory Guide 1.7, " Control of Combustible Gas Concentrations in Containment Following a LOCA."

The post-incident recirculation systems provide adequate mixing of the containment atmosphere following a LOCA..This mixing action will prevent localized accumulations of hydrogen from exceeding the flammable limit.

Proper. hydrogen recombiner operation, after a LOCA, is assured by measuring.

.(and adjusting, if necessary) the amount of electrical power provided to the recombiner unit. The temperature measuring equipment (thermocouple) is provided for convenience in testing and is not considered necessary to assure proper operation.

l Amendment No. -14,162 4-8

4.2 E0VIPMENT AND SEMPLING TESTS l

TABLE 4.2.1 Minimum Freauencies for Samolina Tests FSAR Section Test Freauency REFERENCE

1. Reactor Coolant Gross Activity Deter-3 Times /7 days with a None Samples mination maximum of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months be-tween sam)les (T ave greater tlan 500*F).

Gross Gamma by Fission Continuous when T None greaterthan500*F'geis Product Monitor Isotopic analysis 1/14 days during power None for dose equivalent operation I-131 concentration 2'

Radiochemical for 1/6 months None E determination Isotopic analysis a) Once/4 hours, whenever for iodine, including dose equivalent I-131 I-131, 133, 135 exceeds 1.0 yC1/ gram, and b) One sample between 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months follow-ing a thermal power change exceeding 15%

of rated thermal power within a one hour period.

Chemistry (Cl and 0 )

3 times /7 days with a 2

maximum of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months between samples (T ave greater than 210*F).

Chemistry (F)

Once/30 days and follow-ing modifications or repair to the primary coolant system involving welding.

2. Reactor Coolant Boron Concentration Twice/ Week None Boron

3. SIRW Tank Water Boron Concentration Monthly None Sample

4. Concentrated Boron Concentration Monthly None Boric Acid Tanks

5. SI Tanks Boron Concentration Monthly 6.1.2 Amendment No. 20, 71, 113, 162 4-9

4.2 E0VIPMENT AND SAMPLING TESTS Table 4.2.1 (continued)

Minimum Freauencies for Samplina Tests FSAR Section Test Freouency REFERENCE

6. Spent Fuel Boron Concentration Monthly'7' 9.4 Pool Bulk Water Temperature Continucusly when None bundles are stored in tilt pit racks with less than one year decay'*

7. Secondary Coolant Coolant Gross Radio-3 times /7 days with None activity a maximum of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months between samples Isoto)1c Analysis for a) I per 31 days, Dose Equivalent I-131 whenever the Concentration gross activity determination indicates iodine concentrations greater than 10%

of the allowable limit b) I per 6 months, whenever the gross activity determination indicates iodine concentrations below 10% of the allowable limit (1) A daily sample shall be obtained and analyzed if fission product monitor is out of service.

(2) After at least 2 EFPD and at least 20 days since the last shutdown of longer than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

(3, 4, 5) Deleted.

(6) Reference Specification 3.8.5 for maximum bulk water temperature and monitoring requirements.

(7) ~rieference Bases section of Specification 3.8 and Section 5.4.2f of the Design Features for minimum boron concentration (;t1720 ppm).

Amendment No. 29, 110, 123, 162 4-10

I 4.2 E0VIPMENT SAMPLING AND TESTS l

Table 4.2.2 Minimum Freauencies for Eauioment Tests FSAR Section Test Freauency REFERENCE FSAR

1. CONTROL RODS Drop Times of All Refueling 7.6.1.3 l

Full Length Rods

]

2. CONTROL RODS Partial Movement Every 92 Days 7.6.1.3 l

of all Rods (Minimum of 6 In)

3. Pressurizer Set Point One Each 4.3.7 Safety Valves Refueling

4. Main Steam Set Point Five Each 4.3.4 Safety Valves Refueling

5. Refueling System Functioning Prior to 9.11.4 Interlocks Refueling Operations

6. Service Water Functioning Refueling 9.1.2 System Valve Actuation on SIS and RAS

7. Primary System Evaluate Daily 4.7.1 Leakage

8. Diesel Fuel Fuel Inventory Daily 8.4.1 Supply

9. Boric Acid Verify proper Daily Heat Tracing temperature readings.

10. Safety Injection Verify that level and Each Shift Tank Level and pressure indication Pressure is between independent high hich/ low alarms for level and pressure.

Amendment No. 12, S1, 123, 152, 155, 157, 162 4-11

1 l 4.2 E0UIPMENT SAMPLING AND TESTS Table 4.2.2 (continued)

Minimum Freauencies for Eauioment Tests

11. Hydrogen Recombiners i

Each hydrogen recombiner unit shall be demonstrated operable-a.

At least once per 6 months by verifying during a recombiner unit functional test that the minimum heater sheath temperature increases to 2700'F* within 90 minutes. Upon reaching 700'F, increase power setting to maximum power for 2 minutes. Verify that the power meter reads 260 Kw.

b.

At least once per refueling cycle by:

1.

Performing a channel calibration of all recombiner instrumentation and control circuits.

2.

Verifying through a visual examination that there is no evidence of abnormal conditions within the recombiners (i.e.,

loose wiring of structural connections, deposits of foreign materials, etc).

3.

Verifying the integrity of all heater electrical circuits by performing a continuity and resistance to ground test immediately following the above required functional test. The resistance to ground for any heater element shall be 210,000 ohms.

4 2

1 I

i i

As measured by installed or portable temperature measuring instruments.

1 Amendment No. 31, 00, 162 i

4-12 1

i 4.2 E0VIPMENT SAMPLING AND TESTS Table 4.2.2 (continued)

Minimum Freauencies for Eouioment Tests 12.

Iodine Removal System The Iodine Removal System shall be demonstrated operable:

a.

At least once per 31 days by verifying'that each valve (manual, power operated or automatic) in the flow path that is not locked, sealed or otherwise_ secured in position, is in its correct position.

b.

At least once per 6 months by:

1.

Verifying the volume of sodium hydroxide in tank T-103.

2.

Verifying the concentration of sodium hydroxide in T-103..

13. Containment Purge and Ventilation Isolation Valves The Containment Purge and Ventilation Isolation Valves shall be determined closed:

a.

At least once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months by checking the valve position indicator in the control room.

b.

At least once every 6 months by performing a leak rate test between the valves.

14.

Shutdown Cooling To meet the shutdown cooling requirements of Section 3.1.9:

a.

The required reactor coolant pump (s), if not in operation should be determined to be OPERABLE once per 7 days by verifying correct breaker alignments and indicated power availability.

b.

The required steam generator (s) shall be determined OPERABLE by verifying the secondary water level to be 2-84% at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , c.

At least one coolant loop or train shall be verified to be in operation and circulating reactor coolant at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

15. Main Feedwater Isolation a.

Verify that the Main Feedwater Regulating valve and the associated bypass valve close on an actual or simulated Containment High Pressure (CHP) signal once each 18 months.

b.

Verify that the Main Feedwater Regulating valve and the associated bypass valve close on an actual or simulated Steam Generator low Pressure (SGLP) signal once each 18 months.

Amendment No. 81, 90, 150, 162 4-13 1

l 4.2 E0VIPMENT SAMPLING AND TESTS Tabl e ' 4. 2. 3 HEPA FILTER AND CHARC0AL ADSORBER SYSTEMS Control Room Ventilation and Isolation System (Rated flow: 765 cfm) Fuel Storage Area HEPA/ Charcoal Exhaust System (Rated flow: 10,000 cfm, two fans or 7300 cfs, one fan).

The filters in each of the above systems shall be demonstrated operable:

a.

At least once per 31 days by initiating, from the Control Room, flow through the HEPA filter and charcoal adsorbers and verifying that the system operates for at least 15 minutes.

b.

At least once per refueling cycle or (1) after any structural maintenance on the HEPA filter or charcoal adsorber housings, or (2) following major painting, fire or chemical release in any ventilation zone communicating with the system when the HEPA Filter or charcoal adsorbers are in operation by:

1.

Verifying within 31 days after removal that a laboratory analysis of a representative carbon sample obtained in accordance with Regulatory Position C.6.b. of Regulatory Guide 1.52, Revision 2, March 1978, meets the laboratory testing criteria of Regulatory Position C.6.a of Regulatory Guide 1.52, Revision 2, March 1978 except that the Fuel Storage Area shall have a methyl iodide limit of 94% instead of 99,, or replacing with charcoal adsorbers meeting the specifications of Regulatory Guide 1.52, Position C.6.a.

Revision 2, March 1978.

2.

Verifying that the HEPA filter bank removes greater than or equal to 99% of the D0P when they are tested in-place in accordance with ANSI N510-1975 while operating the system at its rated flow 20%.

3.

Verifying that the charcoal adsorber removes graater than or equal 1

to 99% of a hydrogenated hydrocarbon refrigerant test gas when they are tested in-place in accordance with ANSI N510-1975 while operating the system at its rated flow + 20%.

c.

At least once per refueling cycle by:

1.

Verifying that the pressure drop across the combined HEPA filter and charcoal adsorber bank is less than (6) inches Water Gauge while operating the system.

2.

Verifying that on a containment high-pressure and high-radiation j

test signal, the system automatically switches into a recirculating mode of operation with flow through the HEPA filter and charcoal adsorber bank.

(Control Room ventilation only.)

Amendment No. M, 162 4-14

4.2 E0VIPMENT SAMPLING AND TESTS l

Table 4.2.3 (continued) l HEPA FILTER AND CHARC0AL ALSORBER SYSTEMS 3.

Verifying that the system maintains the Control Room at a positive-pressure of greater than or equal to 0.10 inch WG relative to the viewing gallery (dPIC 1834) during system operation.

(Control Room ventilation only.)

4.

Verifying that with the ventilation system exhausting through the HEPA/ Charcoal Filters at its rated flow 20%, the bypass flow through damper 1893 is less than 1% of total flow.

(Fuel Storage Area only.)

d.

After every 720 hours0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months (see Note 1) of charcoal adsorber operation by:

Verifying within 31 days after removal that a laboratory analysis of a representative carbon sample obtained in accordance with Regulatory Position C.6.b. of Regulatory Guide 1.52, Revision 2, March 1978, meets the laboratory testing criteria of Regulatory Position C.6.a of Regulatory Guide 1.52, Revision 2, March 1978 except that the Fuel Storage Area shall have a methyl iodide limit of 94% instead of 99%, or replacing with charcoal adsorbers meeting the specifications of Regulatory Guide 1.52, position C.6., Revision 2, March 1978.

e.

After each complete or partial replacement of a HEPA filter bank by:

Verifying that the HEPA filter bank removes greater than or equal to 99%

of the DOP when they are tested in-place in accordance with ANSI N510-i 1975 while operating the system at its rated flow 20%.

f.

After each complete or partial replacement of a charcoal adsorber bank i

by:

Verifying that the charcoal adsorber removes greater than or equal to 99% of a hydrogenated hydrocarbon refrigerant test gas when they are-1 tested in-place in accordance with ANSI N510-1975 while operating the system at its rated flow i20%.

g.

Verify that the Control Room temperature is <120*F once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when the temperature in the Control Room reaches 105'F.

Note 1.

Should the 720-hour limitation occur during a plant operation requiring the use of the HEPA Filter and charcoal adsorber - such as during a refueling - testing may be delayed until the completion of the plant operation or up to 1,500 hours0.00579 days 0.139 hours 8.267196e-4 weeks 1.9025e-4 months of filter operation whichever occurs first.

Amendment No. M, 162 4-15

4.6 SAFETY INJECTION AND CONTAINMENT SPRAY SYSTEMS TESTS Surveillance Recuirements I

4.6.1 Safety Iniection System a.

System tests shall be performed at each reactor refueling interval.

A test safety injection signal will be applied to initiate operation of the system. The safety injection and shutdown cooling system pump motors may be de-energized for this test. The system will be considered satisfactory if control board indication and visual observations indicate that all components have received the safety injection signal in the proper sequence and timing (ie, the appropriate pump breakers shall have opened and closed, and all valves shall have completed their travel).

l 4.6.2 Containment Sorav System a.

System test shall be performed at each reactor refueling interval.

The test shall be performed with the isolation valves in the spray supply lines at the containment blocked closed. Operation of the system is initiated by tripping the normal actuation instrumentation.

b.

At least every five years the spray nozzles shall be verified to be open.

c.

The test will be considered satisfactory if visual observations indicate all components have operated satisfactorily.

4.6.3 Pumos a.

The safety injection pumps, shutdown cooling pumps, and containment spray pumps shall be started at intervals not to exceed three months. Alternate manual starting between control room console and the local breaker shall be practiced in the test program.

b.

Acceptable levels of performance shall be that the pumps start, reach their rated heads on recirculation flow, and operate for at l

least fifteen minutes.

4.6.4 Valves a.

Each Safety Injection Tank flow path shall be verified OPERABLE within 7 days prior to each reactor startup by verifying each motor operated isolation valve is open by observing valve position indication and valve itself, and locking open the associated circuit breakers.

b.

The Low Pressure Safety Injection flow path shall be verified OPERABLE within 7 days prior to each reactor startup by verifying flow control valve CV-3006 is open, and its air supply is isolated.

Amendment No. 51, 73, 95, 117, 131, 162 4-39

4.6 SAFETY INJECTION AND CONTAINMENT SPRAY SYSTEMS TESTS l

Surveillance Reouirements (continued)

Valves (continued) c.

The safety injection recirculation path shall be verified OPERABLE within 7 days prior to each reactor startup by verifying valves CV-3027 and 3056 are open and their switches HS-3027A, HS-30278, HS-3056A, and HS-3056B are open.

d.

Each Containment Spray Valve manual control shall be verified to be OPERABLE at least once each refueling by cycling each valve from the control room while observing valve operation at least each 18 months.

4.6.5 Containment Air Coolina System a.

Emergency mode automatic valve and fan operation will be checked for OPERABILITY during each refueling shutdown.

b.

Each fan and valve required to function during accident conditions will be exercised at intervals not to exceed three months.

l Amendment No. 50, 73, 77, 117, 162 i

4-40

r y

4.6 SAFETY INJECTION __AND CONTAINMENT SPRAY SYSTEMS TESTS Basis The safety injection system and the containment spray system are principal plant safety features that are normally inoperative during reactor operation.

Complate-systems tests cannot be performed when the reactor is operating

)

because a safety injection signal causes containment isolation and a containment spray system test requires the system to be temporarily disabled.

The method of assuring OPERABILITY of these systems is therefore, to combine systems tests to be performed during annual plant shutdowns, with more frequent component tests, which can be performed during reactor operation.

The annual systems tests demonstrate proper automatic operation of the safety injection and containment spray systems. A test signal is applied to initiate automatic action and verification made that the components receive the Safety Injection Signal in the proper sequence. The test demonstrates the operation of the valves, pump circuit breakers, and automatic circuitry.n.2 l

During reactor operation, the instrumentation which is depended on to initiate safety injection and containment spray is generally checked daily and the initiating circuits are tested monthly.

In addition, the active components (pumps and valves) are to be tested every'three months to check the operation of the starting circuits and to verify that the pumps are in satisfactory running order. The test interval of three months is based on the judgment that more frequent testing would not significantly increase the reliability (ie, the probability that the component would operate when required), yet more frequent test would result in increased wear over a long period of time.

Verification that the spray piping and nozzles are open will be made initially by a smoke test or other suitably sensitive method, and at least every five years thereafter. Since the material is all stainless steel, normally in a dry condition, and with no plugging mechanism available, the retest every five years is considered to be more than adequate.

Other systems that are also important to the emergency cooling function are the SI tanks, the component cooling system, the service water system and the containment air coolers.

The SI tanks are a passive safety feature.

In accordance with the specifications, the water volume and pressure in the SI tanks are checked periodically. The other systems mentioned operate when the i

reactor is in operation and by these means are continuously monitored for satisfactory performance.

l References (1)

FSAR, Section 6.1.3.

(2)

FSAR, Section 6.2.3.

Amendment No. 117, 131, 162 4-41

4.9 AUXILIARY FEEDWATER SYSTEM TESTS

~

I Surveillance Reouirements Auxiliary Feedwater Pumos

-l a.

At least once per 31 days:

1.

The OPERABILITY of each motor-driven pump shall be verified by starting from the control room hand switch, from the breaker and from the pump test-key switch in a three month period.

2.

The OPERABILITY of the steam-driven pump shall be verified by starting alternately from each control room switch and from the pump test-key switch in a three month period.

3.

Verify that each non-automatic valve in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.

b.

At least once per 18 months:

1.

Verify that each Automatic Valve (CV-0736A, CV-0737A, CV-0727 and CV-0749) actuates to its correct position (or that specified flow is established) upon receipt of a simulated j

auxiliary feedwater pump start signal.

2.

Verify that each pump starts automatically upon receipt of an auxiliary feedwater actuation test signal.

j BASIS l

The periodic testing of Section 4.9.a will verify auxiliary feedwater pump i

control circuits.

l The OPERABILITY testing of Section 4.9.b will verify auto initiation of the auxiliary feedwater system by simulating a low steam generator level and observation of pump start.

To automatically start the "C" pump requires i

placing the "A" pump in manual. To automatically start the "B" pump requires placing the "A & C" pumps in manual. These tests may be performed during plant operations. OPERABILITY of the flow control valves (CV-0736A, CV-0737A, CV-0727 and CV-0749) will be verified through simulation of an i

auxiliary feedwater pump start signal and observing auxiliary feedwater system flow as monitored by installed instrumentation.

REFERENCE FSAR, Section 9.7 Amendment No. 53, 95, 162 4-45

4.17 INSTRUMENTATION SYSTEMS TESTS' Surveillance Reauirement Surveillance testing of-instrument channels, logic channels, and control channels listed in Tables 3.17.1 through 3.17.6 shall be performed-as specified in Tables 4.17.1 through 4.17.6, respectively

)

t Amendment No. 37, 50, 50, 152, 162 1

4-75

4.17 INSTRUMENTATION SYSTEMS TESTS Table 4.17.1 Instrumentation Surveillance Reauirements for Reactor Protective System CHANNEL CHANNEL FilNCTIONAL CHANNEL Functional Unit CHECK TEST CALIBRATION 1.

Manual Trip NA (a)

NA 2.

Variable High Power 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days (b, c, & d) 3.

High Start Up Rate 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (a) 18 months

4.

Thermal Margin /

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months low Pressure 5.

High Pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months Pressure 6.

Low PCS Flow 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months 7.

Loss of Load NA (a) 18 months 8.

Low "A" SG Level 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months 9.

Low "B" SG Level 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months

10. Low "A" SG Pressure-12 hours 31 days 18 months

11. Low "B" SG Pressure 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months

12. High Containment Pressure NA 31 days 18 months

13. RPS Matrix Logic NA 31 days NA 14.

RPS Initiation Logic NA 31 days NA

15. Thermal Margin Monitor; Verify constants each 92 days.

(a) Once within 7 days prior to each reactor startup.

(b) Calibrate with Heat Balance each 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , when >15% RATED POWER.

(c) Calibrate Excores channels with test signal each 31 days.

(d) CHANNEL CALIBRATION each 18 months.

(e)

Include verification of automatic Zero Power Mode Bypass removal.

Amendment No. 118, 130, 135, 150, 162 4-76

4.17 INSTRUMENTATION-SYSTEMS TESTS-Table 4.17.2 Instrumentation Surveillance Reauirements for Enaineered Safety Features CHANNEL CHANNEL FUNCTIONAL CHANNEL Functional Unit CHECK TEST CALIBRATION 1.

Safety In.iection Sianal (SIS) a.

Manual Initiation NA 18 months NA b.

SIS Logic NA (a)

NA (Initiation, Actuation,and low pressure block auto reset) c.

CHP Signal SIS initiation NA 18 months NA (SP Relay Output) d.

Pressurizer Pressure 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months Instrument Channels 2.

Recirculation Actuation Sianal (RAS) a.

Manual Initiation NA 18 months NA b.

RAS Logic NA 18 months NA c.

SIRWT Level Switches NA 18 months 18 months 3.

Auxiliary Feedwater Actuation Sianal (AFAS) a.

Manual Initiation NA 18 months NA b.

AFAS Logic NA 92 days NA c.

"A" SG Level 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months d.

"B" SG Level 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 :::onths 4.

Emeraency Power Seauencers a.

DBA Sequencer NA 92 days 18 months b.

Normal Shutdown Sequencer NA 18 Months 18 months (a) Test normal and emergency power functions using test circuits each 92 days.

Verify all automatic actuations and automatic resetting of low pressure block each 18 months.

Amendment No. 162 4-77

4.17 INSTRUMENTATION SYSTEMS TESTS Table 4.17.3 Instrumentation Surveillance Reauirements for Isolation Functions CHANNEL CHANNEL FUNCTIONAL CHANNEL Functional Unit CHECK TEST CALIBRATION i

l

1. Containment Hiah Pressure (CHP)

a. CHP logic Trains NA 18 months NA

b. Containment Pressure NA 31 days 18 months Switches - Left Train

c. Containment Pressure NA 31 days 18 months Switches - Right Train

2. Containment Hiah Radiation (CHR)

a. Manual Initiation NA 18 months NA

b. CHR Logic Trains NA 18 months NA

c. Containment Area 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months Radiation Monitors

3. Steam Generator low Pressure (SGLP)

a. Manual Actuation NA 18 months NA

b. SGLP Logic Trains NA 18 months NA

c. "A" Steam Generator 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months 1

Pressure d.

"B" Steam Generator 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months Pressure j

4. Enaineered Safeauards Pumo Room Hiah Radiation a.

East Room Monitor 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months b.

West Room Honitor 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months Amendment No. 162 4-78

4.17 INSTRUMENTATION SYSTEMS TESTS Table 4.17.4 Instrumentation Surveillance Reauirements for Accident Monitoring CHANNEL CHANNEL Instrument CHECK CALIBRATION 1.

Wide Range Ts 31 days 18 months 2.

Wide Range Te 31 days 18 months 3.

Wide Range Flux 31 days 18 months 4.

Containment Floor Water Level 31 days 18 months 5.

Subcooled Margin Monitor 31 days 18 months 6.

Wide Range Pressurizer Level 31 days 18 months 7.

Containment H Concentration 31 days 18 months 2

8.

Condensate Storage Tank Level 31 days 18 months 9.

Wide Range Pressurizer Pressure 31 days 18 months

10. Wide Range Containment Pressure 31 days 18 months

11. Wide Range "A" SG Level 31 days 18 months

12. Wide Range "B" SG Level 31 days 18 months

13. Narrow Range "A" SG Pressure 31 days 18 months

14. Narrow Range "B" SG Pressure 31 days 18 months 15.

Position Indication for each 31 days 18 months Containment Isolation Valve

16. Core Exit Thermocouples (CET) 31 days 18 months

Quadrant 1

17. Core Exit Thermocouples (CET) 31 days 18 months

Quadrant 2

18. Core Exit Thermocouples (CET) 31 days 18 months

Quadrant 3

19. Core Exit Thermocouples (CET) 31 days 18 months

Quadrant 4

20. Reactor Vessel Water Level (RVWL) 31 days 18 months

21. High Range Containment Radiation 31 days 18 months (a) Calibrate by substituting a known voltage for thermocouple.

Amendment No. 162 4-79

4.17 ' INSTRUMENTATION SYSTEMS TESTS

]

Table 4.17.5 Instrumentation Surveillance Reauirements for Alternate Shutdown System CHANNEL CHANNEL FUNCTIONAL CHANNEL Instrument or Control CHECK TEST CALIBRATION i

1.

Start-up Range Flux (a)

(a) 18 months 1

2.

Pressurizer Pressure 92 days NA 18 months 3.

Pressurizer Level 92 days NA 18 months i

4.

1 Hot Leg Temperature 92 days NA 18 months 5.

2 Hot Leg Temperature 92 days NA 18 months 6.

1 Cold Leg Temperature 92 days NA 18 months 7.

2 Cold Leg Temperature 92 days NA 18 months 8.

"A" SG Pressure 92 days NA 18 months 9.

"B" SG Pressure 92 days NA 18 months 10.

"A" SG Level 92 days NA 18 months i

11.

"B" SG Level 92 days NA 18 months

12. SIRW Tank Level 92 days NA 18 months 13.

P-8B Flow to "A" SG 18 months 18 months 18 months 14.

P-8B Flow to "B" SG 18 months 18 months 18 months 15.

P-8B Low Suction Alarm NA 18 months 18 months 16.

P-8B Steam Valve Control NA 18 months NA

17. AFW Flow Control "A" SG NA 18 months NA

18. AFW Flow Control "B"

SG NA 18 months NA

19. Transfer Switches, C-150 NA 18 months NA

20. Transfer Switch, C-150A NA 18 months NA (a) Once within 7 days prior to each reactor startup.

Amendment No. 122, 135, 162 4-80

4.17 INSTRUMENTATION SYSTEMS TESTS Table 4.17.6

)

Instrumentation Surveillance Reauirements for Other Safety Functions CHANNEL CHANNEL FUNCTIONAL CHANNEL Instrument CHECK TEST CALIBRATION

]

1.

Neutron Flux Monitoring 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (a) 18 months 2.

Rod Position Indication 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (b) 18 months 3.

SIRW Tank Temperature 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months NA 18 months 4.

Main Feedwater Flow 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Not Required 18 months 5.

Main Feedwater Temp.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Not Required 18 months 6.

AFW Flow Indication 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 18 months 18 months 7.

PCS Leakage Detection:

a.

Sump Level 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 18 months 18 months b.

Atmos. Gas Monitor 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 18 months 18 months c.

Humidity Monitor 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 18 months 18 months d.

Air Cooler Condensate NA 18 months Not Required Flow Switch j

Ba. Primary Safety Valve NA 18 months 18 months acoustical monitor 8b/ Safety Valve / PORV

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 18 months 18 months 9a.

tailpipe temperature 9b.

PORV Acoustical Monitor NA 18 months 18 months 9c.

PORY Stem Position 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 18 months 18 months 10.

PORY Block Valve 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months NA 18 months Position Indication (a) Once within 7 days prior to each reactor startup.

(b) Verification of Regulating Rod Withdrawal and Shutdown Rod Insertion interlocks OPERABILITY only, once within 92 days prior to each reactor startup AND once prior to startup after each refueling.

(c) The tailpipe temperature indicator is common to the safety valves and PORVs (continued)

Amendment No. 162 4-81

4.17 VNSTRUMENTATION SYSTEMS TESTS Table 4.17.6 (continued)

Instrumentation Surveillance Reauirements for Other Safety Functions CHANNEL l

CHANNEL FUNCTIONAL CHANNEL Instrument CHECK TEST CALIBRATION

11. SWS Break Detector NA 18 months 18 months 12.

Flux - AT Comparator 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 31 days 18 months

13. Rod Group Sequence NA 18 months 18 months Control / Alarm 14.

BAT Low Level Alarm NA 18 months Not Required 15.

Excore Deviation Alarm NA 18 months 18 months

16. ASI Alarm NA 18 months 18 months 17.

SDC Suction Interlocks NA 18 months 18 months 18.

PDIL Alarm NA 31 days'd 18 months 19.

Fuel Pool Rad Monitor 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 31 days 18 months

20. Containment Refueling 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 31 days 18 months Radiation Monitor j

(c) Setpoint verification only.

I i

Amendment No. 162 4-82

4.17 INSTRUMENTATION SYSTEMS TESTS l

Basis:

Instrumentation Systems - Surveillance Requirements 4.17 The Surveillance Requirements listed in Tables 4.17.1 through 4.17.6 provide the periodic testing requirements to assure the OPERABILITY of the instrumentation systems required by Specifications 3.17.1 through 3.17.6, respectively. Typically three surveillance tests are required for each instrument channel: a CHANNEL CHECK, a CHANNEL FUNCTIONAL TEST, and a CHANNEL CALIBRATION. Those instrument channels which are not provided with indicators, such as pressure switch channels, do not have a CHANNEL CHECK specified.

Similarly, channels which provide indication only do not have a CHANNEL FUNCTIONAL TEST SPECIFIED. Control channels typically have only a CHANNEL FUNCTIONAL TEST specified.

Basis: Table 4.17.1 CHANNEL CHECK - RPS Inout Channels - A CHANNEL CHECK is performed each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months on each RPS trip input channel which is provided with an indicator to provide a qualitative assurance that the channel is working properly and that its readings are within limits. The Containment Pressure and Loss of Load channels are pressure switch actuated; they have no associated control room indicator and do not require a CHANNEL CHECK.

The RPS input channels consist of the following instruments:

Power Range Nuclear Power and Axial Shape Index AT Power and associated PCS temperature channels.

Start Up Rate and Wide Range Power Pressurizer Pressure Primary Coolant System Flow Turbine Generator Auto Stop Oil Pressure Steam Generator Level Steam Generator Pressure Containment Pressure A CHANNEL CHECK is also required each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for the TM/LP calculated setpoint indicator channels.

CHANNEL FUNCTIONAL TEST - RPS Channels - A CHANNEL FUNCTIONAL TEST is performed on each required RPS channel which can be tested at power each 31 days. This test assures that the required automatic functions and alarms are actuated by that channel. Manual Trip, High Startup Rate, and Loss of Load channels are tested prior to each startup rather than each 31 days.

The High Startup Rate Trip is actuated by either of the Wide Range Nuclear Instrument Startup Rate channels. NI-03 sends a trip signal to RPS channels "A" and "C"; NI-04 to "B"

and "D",

Since each Startup Rate channel would cause a trip on two RPS channels, the Startup Rate Trip is not tested when the reactor is critical.

The four Loss of Luad Trip channels are all actuated by a single pressure switch monitoring Turbine Auto Stop 011 pressure.

It is not testable with the reactor critical.

The Manual Trip channels are actuated by control room push buttons.

Pressing either button causes a reactor trip.

They are not testable with the reactor critical.

B 4.17-1 Amendment No. 162

4.17 INSTRUMENTATION SYSTEMS TESTS i

Basis: Table 4.17.1 (continued)

CHANNEL CALIBRATION - RPS Input Channels - A CHANNEL CALIBRATION is performed on each RPS input channel each 18 months. This test verifies that the accuracy of the channel indication and of its automatic setpoints is within limits.

The Excore power and AT power channels have additional calibration requirements:

AT Power and Excore Nuclear Instruments - Heat Balance - A Heat Balance, or " Calorimetric Calculation" is performed each 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to assure that the reactor power indications remain properly calibrated. The heat balance is not required to be performed when the indicated power level is below 15% of RATED POWER because the measured parameters are not sufficiently steady to provide an accurate result and because, even without recent recalibration, the subject instruments are sufficient to assure no core limits are reached when they indicate less then 15% of RATED POWER.

l Excore Power Range - Calibration with Internal Signal - A calibration of i

the excore nuclear instrumentation power range channels using the internal test circuitry must be performed every 31 days.

The RPS input channels consist of the following instruments:

j Power Range Nuclear Power and Axial Shape Index Al Power and associated PCS temperature channels.

Start Up Rate and Wide Range Power Pressurizer Pressure Primary Coolant System Flow Turbine Generator Auto Stop 011 Pressure Steam Generator Level Steam Generator Pressure Containment Pressure As part of the CHANNEL CALIBRATION of the Wide Range Nuclear Instrumentation, the automatic removal of the Zero Power Mode Bypass of Low PCS Flow, TM/LP, and Low SG Pressure trips, and of the automatic bypassing of the Loss of Load and High Startup Rate trips must be verified to assure that these trips are available when required.

Thermal Marain Monitor - Verify Constants - This test verifies that the programmable constants used to calculate the setpoints generated by the digital circuitry of the TMM are correct.

It is nearly equivalent to a CHANNEL FUNCTIONAL TEST on an analog circuit.

l B 4.17-2 Amendment No. 162

4.17 INSTRUMENTATION SYSTEMS TESTS Basis:

Table 4.17.2 CHANNEL CHECK - ESF Inout Channels - A CHANNEL CHECK is performed each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months on each ESF input channel which is provided with an indicator to provide a qualitative assurance that the channel is working properly and that its readings are within limits. The Safety Injection and Refueling Water Tank (SIRWT) level channels have no associated control room indicator.

The ESF input channels consist of the following instruments:

Pressurizer Pressure SIRWT Level Steam Generator Level CHANNEL FUNCTIONAL TEST - ESF Channels - A CHANNEL FUNCTIONAL TEST is performed on each ESF channel to verify that it produces the proper outputs.

This test is required to be performed each 31 days on ESF input channels provided with on-line testing capability.

It is not required for the SIRWT Level channels since they have no built in test capability.

The CHANNEL FUNCTIONAL TEST for SIRWT Level channels is performed each 18 months as part of the required CHANNEL CALIBRATION.

A CHANNEL FUNCTIONAL TEST is performed each 92 days on the SIS logic circuits using the installed test circuits.

Logic for SIS both with and without offsite power must be tested. When testing the "without power" circuits, proper operation of the DBA sequence and the associated logic circuit must be verified. The test circuits are designed to block those SIS functions, such as injection of concentrated boric acid, which would interfere with plant operation.

A CHANNEL FUNCTIONAL TEST is performed each 92 days on the AFAS logic circuits using the installed test circuits.

A CHANNEL FUNCTIONAL TEST of the complete SIS actuation logic is required each 18 months.

The testing required by this surveillance is to insert an actual or simulated low pressure input into the Pressurizer Pressure channels feeding the SIS actuation logic and verify that all automatic normal automatic operations occur as designed.

In addition, testing must also verify automatic removal of the low pressure block signal.

A CHANNEL FUNCTIONAL TEST is performed on the remaining ESF channels each 18 months.

These functions are not designed for on-line testing.

EHANNEL CALIBRATION - ESF Inpyt Channels - Performance of a CHANNEL CALIBRATION every 18 months ensures that the channels are operating accurately and within specified tolerances. Operating experience has shown this test interval to be satisfactory.

The ESF input channels consist of the following instruments:

Pressurizer Pressure SIRWT Level Steam Generator level B 4.17-3 Amendment No. 162

4.17 INSTRUMENTATION SYSTEMS TESTS Basis: Table 4.17.5 CHANNEL CHECK - Alternate Shutdown indication channels - A CHANNEL CHECK is performed each 92 days on each Alternate Shutdown indicator channel, except Startup Range and AFW flow, to provide a qualitative assurance that the channel is working properly and that its readings are within limits. The 92 day interval was chosen because completion of a CHANNEL CHECK requires actuating the circuits with the associated transfer switches and thereby deactivating several normal control room channels which share the same detectors. The CHANNEL CHECK for the Startup Range is discussed below. AFW flow indicators are excepted because during normal operation there is zero AFW flow and a CHANNEL CHECK would be inconclusive. A CHANNEL CHECK is performed on each AFW flow channel at 18 month intervals as part of the CHANNEL CALIBRATION.

CHANNEL CHECK and CHANNEL FUNCTIONAL TEST - Startuo Rance - A CHANNEL CHECK and a CHANNEL FUNCTIONAL TEST of the Startup Range is required prior to each reactor startup. The CHANNEL CHECK consists of comparing the remote indication with that from the control room.

The Startup Range provides no alarm or automatic functions; the CHANNEL FUNCTIONAL TEST consists of verifying proper response of the channel to the internal test signals, and verification that a detectable signal is available from the detector. After lengthy shutdown periods flux may be below the range of the channel indication.

Signal verification with test equipment is acceptable.

CHANNEL FUNCTIONAL TEST - Alternate Shutdown Controls Channels - A CHANNEL FUNCTIONAL TEST is performed on each Alternate Shutdown Panel control channel each 18 months to assure its operability. A CHANNEL FUNCTIONAL TEST is performed on the AFW pump section pressure alarm as part of its CHANNEL CALIBRATION.

CHANNEL CALIBRATION - Alternate Shutdown Indication Channels - Performance of a CHANNEL CALIBRATION every 18 months ensures that the channels are operating accurately and within specified tolerances. Operating experience has shown this test interval to be satisfactory.

B 4.17-5 Amendment No. 162

4.17 INSTRUMENTATION SYSTEMS TESTS Basis: Table 4.17.6 CHANNEL CHECK - Other Safety Function indication channels - A CHANNEL CHECK is performed each 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months on each required indicator channel, except the Area Radiation Monitors which are checked each 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , to provide a qualitative assurance that the channel is working properly and that its readings are within limits.

The Acoustic valve position monitors have no indicator, therefore, no CHANNEL CHECK is required.

CHANNEL FUNCTIONAL TEST - Other Safety Function Channels - A CHANNEL FUNCTMNAL TEST is performed on each channel providing automatic actions to verify that it produces the proper outputs.

This test is required to be performed at least each 18 months. In several cases it is performed as part of the required CHANNEL CALIBRATION.

Those channels requiring more frequent testing are discussed below.

Q1ANNEL FUNCTIONAL TEST - Nuclear Flux Monitorino - The CHANNEL FUNCTIONAL TEST of each Wide Range is required prior to each reactor startup.

The CHANNEL FUNCTIONAL TEST consists of verifying proper response of the channel to the internal test signals, and verification that a signal is available from the detector. After lengthy shutdown periods flux may be below the range if the channel indication. Signal verification with test equipment is acceptable.

CHANNEL FUNCTIONAL TEST - Rod Position Indication (CRDM Interlockil - The Shutdown Rod Insertion and Regulating Rod Withdrawal interlock OPERABILITY must be verified within 92 days prior to each reactor startup and prior to startup after each refueling.

If these interlocks are inoperable, the associated channel of rod position indication must be declared inoperable.

CHANNEL FUNCTIONAL TEST - Flux-AT Comparator - The alarm function of the Flux-AT Power Comparator must be verified by a CHANNEL FUNCTIONAL TEST each 31 days.

CHANNEL FUNCTIONAL TEST PDIL Alarm - (Setooint Verification 1 - Each 31 days the PDIL setpoints for the existing plant power level are verified to assure OPERABILITY of the setpoint calculator.

CHANNEL FUNCTIONAL TEST - Fuel Pool and Containment Area Monitor - Each 31 days the Area Monitor OPERABILITY must be verified by a check with an internal test circuit or with a radioactive source.

CHANNEL CALIBRATION - Other Safety Function Indication Channels - Performance of a CHANNEL CALIBRATION every 18 months ensures that the channels are operating accurately and within specified tolerances. The level switch actuated alarm channels on the Boric Acid Tanks (BAT) and the Condensate Flow Switches on the Containment Air Coolers do not require a calibration because their mounting assures that they are at the proper location.

The required CHANNEL FUNCTIONAL TEST assures their OPERABILITY. Operating experience has nown this test interval to be satisfactory.

B 4.17-6 Amendment No. 162

4.18 POWER DISTRIBUTION INSTRUMENTATION TESiS Surveillance Reauirements 4.18.1 Incore Detectors 4.18.1.1 The incore detection system shall be demonstrated operable:

a.

By performance of a Channel Check prior to its use following a core alteration and at least once per 7 days during power operation when required for the functions listed in Section 3.11.1.

b.

At least once per refueling by performance of a Channel Calibration which exempts the neutron detectors but includes electronic components.

4.18.1.2 The incore alarm system is demonstrated operable through use of the datalogger Sequence Error alarm. The Sequence Error alarm is l

demonstrated operable once per refueling by performance of a Channel Check.

4.18.2 Excore Monitorina System 4.18.2.1 At least every 31 days of power operation:

a.

A target A0 and excore monitoring allowable power level shall be determined using excore and incore detector readings at steady state near equilibrium conditions.

b.

Individual excore channel measured A0 shall be compared to the total core A0 measured by the incores.

If the difference is greater than 0.02, the excore monitoring system shall be recalibrated, c.

The excore measured Quadrant Power Tilt shall be compared to the incore measured Quadrant Power Tilt.

If the difference is greater than 2%, the excore monitoring system shall be recalibrated.

Amendment No. 37, 58, IIS, 162 4-83 l

4.19 POWER DISTRIBUTION LIMIT TESTS i

Surveillance Reauirements 4.19.1 Linear Heat Rates 4.19.1.1 When using the incore alarm system to monitor LHR, prior to operation above 50% RATED POWER and every 7 days of power operation thereafter, incore alarms shall be set based on a measured power distribution.

4.19.1.2 When using the excore monitoring system to monitor LHR:

a.

Prior to use, verify that the measured A0 has not deviated from the target A0 by more than 0.05 in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for each operable channel using the previous 24 hourly recorded values.

ll b.

Once per day, verify that the measured Quadrant Power Tilt is less than or equal to 3%.

c.

Once per hour, verify that the power is less than or equal to the APL and not more than 10% RATED POWER greater than the power level used in determining the APL.

i d.

Continuously verify that the measured A0 is within 0.05 of the established target A0 for at least 3 of the 4, 2 of the 3, or 2 of the 2 operable channels, whichever is the applicable case.

4.19.2 Radial Peakina Factors I

A T

4.19.2.1 The measured radial peaking factors (F and F obtained by using the incore detection system, shall be detefmined fo)be less than or equal to the values stated in the LC0 at the following intervals:

a.

After each fuel loading prior to operation above 50% RATED POWER, and b.

At least once per week of power operation.

e Amendment No. SS, 118, 117, 162 4-84

4.20 MODERATOR TEMPERATURE COEFFICIENT TElli Surveillance Reauirements 4.20.1 Moderator Temperature Coefficient (MTC)

The MTC shall be determined to be within its limits by confirmatory measurements prior to initial operation above 2% of rated thermal power, after each refueling.

Amendment No. 85, 118, 122, 162 4-85

ML20076N029

Text

Attachment:

Navigation menu

Search