Text

Proposed Final Tech Specs Pages for License Change Application ECR 97-02809,incorporating end-of-cycle Recirculation Pump Trip Sys at Plant
	ML20151T042
Person / Time
Site:	Peach Bottom
Issue date:	08/31/1998
From:	; PECO ENERGY CO., (FORMERLY PHILADELPHIA ELECTRIC
To:	;
Shared Package
ML20151T033	List: ML20151T030; ML20151T042;
References
	NUDOCS 9809090206
	Download: ML20151T042 (125)
	v • d • e

TABLE OF CONTENTS 1.0 USE AND APPLICATION .................... 1.1-1 1.1 Definitions ........ . ............. 1.1-1 l 1.2' Logical Connectors . . . . . . . . . . . . . . . . . . . 1.2-1 l 1.3 Completion Times . . . . . . . . . . . . . . . . . . . . 1.3-1 i 1.4 Frequency ....................... 1.4-1 !

2.0 SAFETY LIMITS (SLs) .................... 2.0-1 2.1 SLs ........................ 2.0-1 2.2 SL Violations ..................... 2.0-1 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY . . . . 3.0-1 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY ........ 3.0-4 0.1 REACTIVITY CONTROL SYSTEMS . . . . . . . . . . . . . . . 3.1-1 3.1.1 SHUTDOWN MARGIN (SDM) ............... 3.1-1 3.1.2 Reactivity Anomalies . . . . . . . . . . . . . . . . 3.1-5 3.1.3 Control Rod OPERABILITY .............. 3.1-7 3.1.4 Control Rod Scram Times .......... ... 3.1-12 3.1.5 Control Rod Scram Accumulators . . . . . . . . . . . 3.1-15 3.1.6 Rod Pattern Control ................ 3.1-18 3.1.7 Standby Liquid Control (SLC) System ........ 3.1-20 3.1.8 Scram Discharge Volume (SDV) Vent and Drain Valves . 3.1-26 3.2 POWER DISTRIBUTION LIMITS ............... 3.2-1 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR) .................... 3.2-1 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR) ........ 3.2-2 3.2.3 LINEAR HEAT GENERATION RATE (LHGR) ........ 3.2-4 3.3 INSTRUMENTATION .................... 3.3-1 3.3.1.1 Reactor Protection System (RPS) Instrumentation .. 3.3-1 3.3.1.2 Wide Range Neutron Monitor (WRNM) Instrumentation . 3.3-10 3.3.2.1 Control Rod Block Instrumentation ......... 3.3-16 3.3.2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation . . . . . . . . . . . . . . . . . 3.3-22 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation . . . 3.3-24 l 3.3.3.2 Remote Shutdown System . . . . . . . . . . . . . . . 3.3-27 l 3.3.4.1 Anticipated Transient Without Scram Recirculation ,

Pump Trip (ATWS-RPT) Instrumentation ...... 3.3-29 3.3.4.2 End of Cycle Recirculation i Pump Trip (E0C-RPT) Instrumentation . . . . . . . 3.3-32 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation 3.3-35 3.3.5.2 Reactor Core Isolation Cooling (RCIC) System Instrumentation . . . . . . . . . . . . . . . . . 3.3-47 3.3.6.1 Primary Containment Isolation Instrumentation ... 3.3-51 3.3.6.2 Secondary Containment Isolation Instrumentation .. 3.3-58 3.3.7.1 Main Cc-+rol Room Emergency Ven+ilation (MCREV)

Sy! n Mstrumentation ............. 3.3-62 3.3.8.1 Loss (' + .r (LOP) Instrumentation ........ 3.3-64 3.3.8.2 Reactor otection System (RPS) Electric Power l Monitoring . . . . . . . . . . . . . . . . . . . . . 3.3-69 9909090206 990831 PDR ADOCK 05000277 (continued)

P PDR PBAPS UNIT 2 i Amendment No.

Definitions 1.1 1.1 Definitions (continued)

END OF CYCLE The E0C-RPT SYSTEM RESPONSE TIME shall be that RECIRCULATION PUMP TRIP time interval from initial signal generation by ,

(EOC-RPT) SYSTEM RESPONSE the associated turbine stop valve limit switch or i TIME from when the turbine control valve hydraulic oil I control oil pressure drops below the pressure !

switch setpoint to complete suppression of the '

electric arc between the fully open contacts of the recirculation pump circuit breaker. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured.

LEAKAGE LEAKAGE shall be: I

a. Identified LEAKAGE

1. LEAKAGE into the drywell, such as that from pump seals or valve packing, that is captured and conducted to a sump or collecting tank; or

2. LEAKAGE into the drywell atmosphere from sources that are both specifically located and known either not to interfere with the operation of leakage detection systems or not to be pressure boundary LEAKAGE;

b. Unidentified LEAKAGE All LEAKAGE into the drywell that is not identified LEAKAGE-

c. Total LEAKAGE Sum of the identified and unidentified LEAKAGE;

d. Pressure Boundary LEAKAGE LEAKAGE through a nonisolable fault in a Reactor Coolant System (RCS) component body, pipe wall, or vessel wall.

LINEAR HEAT GENERATION The LHGR shall be the heat generation rate per RATE (LHGR) unit length of fuel rod. It is the integral of the heat flux over the heat transfer area associated with the unit length.

(continued)

PBAPS UNIT 2 1.1-3 Amendment No.

E0C-RPT Instrumentation 3.3.4.2 3.3 INSTRUMENTATION -

3.3.4.2 End of Cycle Recirculation Pump Trip (E0C-RPT) Instrumentation LCO 3.3.4.2 a. Two channels per trip system for each E0C-RPT instrumentation Function listed below shall be OPERABLE:

1. Turbine Stop Valve (TSV)-Closure; and

2. Turbine Control Valve (TCV) Fast Closure, Trip Oil Pressure-Low.

E

b. The following limits are made applicable: j

1. LC0 3.2.1, " AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," limits for inoperable E0C-RPT as specified in the COLR; and

2. LCO 3.2.2, " MINIMUM CRITICAL POWER RATIO (MCPR),"

limits for inoperable E0C-RPT as specified in the COLR. l APPLICABILITY: THERMAL POWER :t 30% RTP.

ACTIONS

NOTE-------------------------------------

Separate Condition entry is allowed for each channel.

l CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Restore channel to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

E A.2 --------NOTE---------

Not applicable if inoperable channel is the result of an inoperable breaker.

Place channel in 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months trip.

(continued)

PBAPS UNIT 2 3.3-32 Amendment No.

-. ___..___.________._m._.m ___ _ _ _ .

' EOC-RPT instrumentation 3.3.4.2 l

ACTIONS (continued) l I

l CONDITION REQUIRED ACTION COMPLETION TIME B. One or more Functions. B.1 Restore EOC-RPT trip 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months i with EOC-RPT trip capability.

capability not maintained.

l i

C. Required Action and C.I Remove the associated 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ,

associated Completion recirculation pump i Time not met. s from service. '

DE C.2 Reduce THERMAL POWER 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months i to < 30% RTP. ;

i SURVEILLANCE REQUIREMENTS

NOTE------------------------------------- I When a channel is placed in an inoperable status solely for performance of I required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains EOC-RPT trip capability.

l l SURVEILLANCE FREQUENCY SR 3.3.4.2.1 Perform CHANNEL FUNCTIONAL TEST. 92 days (continued) i i

a PBAPS UNIT 2 3.3-33 Amendment No. l 1

l

l l

E0C-RPT Instrumentation 3.3.4.2 I

f l

SURVEILLANCE REQUIREMENTS (continued) l l l l SURVEILLANCE FREQUENCY 1 l

SR 3.3.4.2.2 Perform CHANNEL CALIBRATION. The 24 months i 1

Allowable Values shall be: '

TSV-Closure: s 10% closed; and TCV Fast f,?osure, Trip 011 Pressure-Low: i a 500 psig. '

l l

~.

SR 3.3.4.2.3 Perform LOGIC SYSTEM FUNCTIONAL TEST 24 months including breaker actuation.

! SR 3.3.4.2.4 Verify TSV-Closure and TCV Fast Closure, 24 months l Trip 011 Pressure-Low Functions are not l bypassed when THERMAL POWER is a 30% RTP.

i SR 3.3.4.2.5 ------------------NOTE-------------------

I Breaker interruption time may be assumed from the most recent performance of SR 3.3.4.2.6.

l

Verify the EOC-RPT SYSTEM RESPONSE TIME 24 months on a

! is within limits. STAGGERED TEST ;

i BASIS l l

l SR 3.3.4.2.6 Determine RPT breaker interruption time. 60 months l

l i

1 PBAPS UNIT 2 3.3 34 Amendment No.

I l

l

ECCS Instrumentation 3.3.5.1 ,

3.3 INSTRUMENTATION l 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation LCO 3.3.5.1 The ECCS instrumentation for each Function in Table 3.3.5.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.5.1-1.

ACTIONS j i

NOTE-------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMDLETION TIME A. One or more channels A.1 Enter the Condition Immediately inoperable. referenced in Table 3.3.5.1-1 for the channel.

B. As required by B.1 ------- NOTES--------

Required Action A.1 1. Only applicable and referenced in in MODES 1, 2, Table 3.3.5.1-1. and 3.

2. Only applicable for Functions 1.a, 1.b, 2.a.

and 2.b.

Declare supported I hour from feature (s) inoperable discovery of when its redundant loss of feature j feature ECCS initiation initiation capability capability in is inoperable. both trip systems MQ (continued)

PBAPS UNIT 2 3.3-35 Amendment No.

e - 5 -4s-Ai., --, J - - u - ad JF6,-n 4 ,.h-h,.4 a w -n-+ ,di -+>4- .>4*e, A4 -..Ar44a,21.if +4 uas-w4M.*,ALA 4 4--- 4-.mA,4-wr l-ne.DA* +a .E ECCS fnstrumentation 3.3.5.1 ACTIONS

CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.2 --------NOTE---------

Only applicable for Functions 3.a and 3.b.

Declare High Pressure I hour from Coolant Injection discovery of (HPCI) System loss of HPCI inoperable. initiation capability AND B.3 Place channel in 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months trip.

C. As required by C.1 --------NOTES--------

Required Action A.1 1. Only applicable and referenced in in MODES 1, 2, Table 3.3.5.1-1. and 3.

)

2. Only applicable for Functions 1.c, 1.e, 1.f, 2.c, 2.d, and 2.f.

Declare supported I hour from feature (s) inoperable discovery of when its redundant loss of feature ECCS subsystem initiation capability initiation i s inoperable. ~ capability in both subsystems AMI C.2 Restore channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

(continued)

PBAPS UNIT 2 3.3-36 Amendment No.

l

ECCS Instrumentation 3.3.5.1 .

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. As required by D.1 --------NOTE---------

Required Action A.1 Only applicable if and referenced in HPCI pump suction is Table 3.3.5.1-1. not aligned to the suppression pool.

Declare HPCI System I hour from inoperable. discovery of i 1

loss of HPCI l initiation capability b.Np D.2.1 Place channel in 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months trip.

QB i D.2.2 Align the HPCI pump 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months !

suction to the j suppression pool.

(continued) I i

PBAPS UNIT 2 3.3-37 Amendment No.

ECCS Instrumentation 3.3.5.1 ,

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. As required by E.1 --------NOTES--------

Required Action A.1 1. Only applicable and referenced in in MODES I, 2, Table 3.3.5.1-1. and 3.

2. Only applicable to Functions 1.d and 2.g.

Declare supported I hour from feature (s) inoperable discovery of when its redundant loss of feature ECCS subsystem initiation capability initiation is inoperable. capability in both subsystems 8!iQ E.2 Restore channel to 7 days OPERABLE status.

(continued)

PBAPS UNIT 2 3.3-38 Amendment No.

t

! i I

! ECCS Instrumentation l l 3.3.5.1 ACTIONS (continued) !

CONDITION REQUIRED ACTION COMPLETION TIME !

F. As required by F.I Declare Automatic 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from !

Required Action A.1 Depressurization discovery of '

and referenced in System (ADS) valves loss of ADS Table 3.3.5.1-1. inoperable. initiation capability in both trip systems .

t M

F.2 Place channel in 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from i trip. discovery of inoperable i.

channel ;

concurrent with HPCI or reactor core isolation cooling (RCIC) inoperable ,

M l 8 days (continued) l l

l l

l 4

I PBAPS UNIT 2 3.3-39 Amendment No. i l _.

s ECCS Instrumentation-3.3.5.1 ,

l ACTIONS (continued)- ,

CONDITION REQUIRED ACTION COMPLETION TIME I i

G. As required by G.1 Declare ADS valves I hour from !

Required Action A.1 inoperable. discovery of 3 and referenced in loss of ADS Table 3.3.5.1-1. initiation i capability in l both trip '

systems M '

G.2 Restore channel to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from OPERABLE status, discovery of inoperable channel concurrent with HPCI or RCIC inoperable M

8 days 1

1 1

H. Required Action and H.1 Declare associated Immediately !

associated Completion supported feature (s) i Time of Condition B, inoperable.

C, D, E, F, or G not '

met. '

l o

I 4

5

, PBAPS UNIT 2- 3.3-40 Amendment No.

i ' ... . . . ..=

l ECCS Instrumentation 3.3.5.1 ,

SURVEILLANCE REQUIREMENTS

_____________________----------------NOTES------------------------------------

1. Refer to Table 3.3.5.1-1 to determine which SRs apply for each ECCS Function.

2. When a channel is placed in an inoperable status solely for performance of ;

required Surveillances, entry into associated Conditions and Required i Actions may be delayed as follows: (a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions 3.c and 3.f; and (b) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions other than 3.c and 3.f provided the associated Function or the redundant Function maintains ECCS initiation capability.

SURVEILLANCE FREQUENCY SR 3.3.5.1.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.5.1.2 Perform CHANNEL FUNCTIONAL TEST. 92 days SR 3.3.5.1.3 Perform CHANNEL CALIBRATION. 92 days SR 3.3.5.1.4 Perform CHANNEL CALIBRATION. 24 months SR 3.3.5.1.5 Perform LOGIC SYSTEM FUNCTIONAL TEST. 24 months i

I l

! PBAPS UNIT 2 3.3-41 Amendment No.

i-ECCS fnstruir.entation L

3.3.5.1 .

Table 3.3.5.1 1 (pose 1 of 5)

Energency Core Cooling System Instrumentation APPLICABLE CONDITIONS MODES REQUIRED REFERENCED OR OTHER CHANNELS FROM SPECIFIED PER REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS FUNCTION ACTION A.1 REQUIREMENTS VALUE

1. Core Spray System

s. Reactor vessel Water 1,2,3, 4(b) B- SR 3.3.5.1.1 t 160.0 Level-Low Low Low SR 3.3.5.1.2 inches (Levet 1) 4(a), 5(*) SR 3.3.5.1.4 SR 3.3.5.1.5

b. Drywell 1,2,3 4(b) B SR 3.3.5.1.1 s 2.0 psig Pressure - HIgh SR 3.3.5.1.2 SR 3.3.5.1.4 !

SR 3.3.5.1.5

c. Reactor Pressure-Low 1,2,3 4 C SR 3.3.5.1.1 2 425.0 psig (Injection Permissive) SR 3.3.5.1.2 and 1

SR 3.3.5.1.4 s 475.0 psig :

SR 3.3.5.1.5 4(a), 5(a) 4 s SR 3.3.5.1.1 t 425.0 psig SR 3.3.5.1.2 and SR 3.3.5.1.4 s 475.0 pois SR 3.3.5.1.5

d. Core Spray Ptap 1,2,3, 4 E SR 3.3.5.1.2 a 319.0 paid Discharge Flow-Low (1 per SR 3.3.5.1.4 and (typass) 4(*), 5(a) pump) s 351.0 paid

e. Core Spray Puup Start- 1,2,3 4 C SR 3.3.5.1.4 t 5.0 seconds Time Delay Relay (Loss (1 per SR 3.3.5.1.5 and of offsite power) 4(a), $(a) pump) s 7.0 seconds

f. Core Spray Ptap Start-Time Delay Retey.

(offsite power eveltabte)

Ptaps A,C 1,2,3 2 C SR 3.3.5.1.4 t 12.1 (1 per SR 3.3.5.1.5 seconds and 4(*), 5(*) puup) s 13.9 seconds Pimps B,0 1,2,3 2 C SR 3.3.5.1.4 t 21.4 (1 per SR 3.3.5.1.5 seconds and 4(a), $(a) pump) s 24.6 seconds (continued)

(a) When associated subsystem (s) are required to be OPERABLE.

(b) Also required to initiate the associated diesel generator (DG).

i-l P8APS UNIT 2 3.3-42 Amendment No.

ll l

l 1

ECCS Instrumentation 3.3.5.1 -

Teble 3.3.5.1 1 (page 2 of 5)

Emergcxy Core Cooling System Instrumentation APPLICABLE CONDITIONS MobEs REQUIRED REFERENCED OR OTHER CHANNELS FROM !

SPECIFIED PER REQUIRED SURVEILLANCE ALLOWABLE i FUNCT10N CONDITIONS FUNCTION ACTION A.1 REQUIREMENTS VALUE 1

2. Low Pressure Coolant Injection (LPCI) system f

a. Reactor vessel Water 1,2.3, 4 B sa 3.3.5.1.1 t 160 inches Level-Low Low Low SR 3.3.5.1.2 ;

(Level 1) 4(a),5(a) sa 3.3.5.1.4

.SR 3.3.5.1.5 !

b. Drywell 1,2,3 4 s sa 3.3.5.1.1 s 2.0 pelo Pressure - High SR 3.3.5.1.2 '

SR 3.3.5.1.4 i sR 3.3.5.1.5 '

c. Reactor Pressure-Low 1,2,3 4 C SR 3.3.5.1.1 2 425.0 psis (Injection Permissive) sR 3.3.5.1.2 and SR 3.3.5.1.4 s 475.0 psig sa 3.3.5.1.5 4(a), $(a) 4 8 SR 3.3.5.1.1 t 425.0 psig !

SR 3.3.5.1.2 and st 3.3.5.1.4 5 475.0 psig SR 3.3.5.1.5

d. Reactor Pressure-Low 1(c) 2(c)

, , 4 C st 3.3.5.1.1 t 211.0 psig Low (Recirculation SR 3.3.5.1.2 Discharge Velve 3(C) sa 3.3.5.1.4 Permissive) SR 3.3.5.1.5

e. Reactor Vessel shroud 1,2,3 2 B sa 3.3.5.1.1 t 226.0 Level - Level 0 st 3.3.5.1.2 inches sa 3.3.5.1.4 SR 3.3.5.1.5

f. Low Pressure coolant 1,2,3, 8 C SR 3.3.5.1.4 Injection Pu g (2 per SR 3.3.5.1.5 start - Time Delay - 4(a), 5(a) p,p)

Relay (offsite power avellable)

Ptaps A,8 t 1.9 seconds and 5 2.1 seconds Ptaips C,0 t 7.5 seconds and s 8.5 seconds 1

g. Low Pressure Coolant 1,2,3 4 E sa 3.3.5.1.2 t 299.0 paid Injection Pump (1 per SR 3.3.5.1.4 and Discharge Flow-Low 4(a), 5(a) pump) sa 3.3.5.1.5 s 331.0 paid (Bypass)

(continued)

(a) When associated subsystem (s) are required to be OPERABLE.

(c) With associated recirculation plaip discharge valve open. i I

PBAPS UNIT 2 3.3-43 Amendment No.

ECCS Instrumention 3.3.5.1 Table 3.3.5.1 1 (page 3 of 5)

Emergency Core Cooling System instrunentation APPLICABLE CONDIT10NS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS FUNCTION ACTION A.1 REQUIREMENTS VALUE l

3. High Pressure Coolant Injection (HPCI) System

a. Reactor vessel Water 1, 4 B SR 3.3.5.1.1 t -48.0 Level - Low Low SR 3.3.5.1.2 inches (Level 2) 2Cd) ,3 Cd) SR 3.3.5.1.4 SR 3.3.5.1.5

b. Drywell 1, 4 B SR 3.3.5.1.1 5 2.0 psis Pressure - High SR 3.3.5.1.2 2(d), 3(d) SR 3.3.5.1.4 SR 3.3.5.1.5 i

c. Reactor vessel Water 1, 2 C SR 3.3.5.1.1 5 46.0 inches ,

Level-High (Level 8) SR 3.3.5.1.2 '

2(d), 3(d) SR 3.3.5.1.4 SR 3.3.5.1.5

d. Condensate storage 1, 2 0 SR 3.3.5.1.2 a 5.25 ft Tank Level - Low SR 3.3.5.1.4 above tank 2(d), 3(d) SR 3.3.5.1.5 bottom

e. Suppression Pool Water 1, 2 D SR 3.3.5.1.2 s 5.0 inches l Level - High SR 3.3.5.1.4 above torus )

2(d), 3(d) SR 3.3.5.1.5 midpoint ;

f. High Pressure Coolant 1, 1 E SR 3.3.5.1.2 t 3.5 in-we Injection Pump SR 3.3.5.1.4 and s 19.0

,i Discharge Flow-Low 2(d),3(d) SR 3.3.5.1.5 in-we ,

(Bypass) -

4. Automatic Depressurization l System (ADS) Trip System A l

a. Reactor Vessel Water 1, 2 F SR 3.3.5.1.1 t -160.0 1 Level - Low Low Low SR 3.3.5.1.2 inches I (Level 1) 2('), 3(*) SR 3.3.5.1.4 l SR 3.3.5.1.5 l

b. Drywell 1, 2 F SR 3.3.5.1.1 5 2.0 psig Pressure - High SR 3.3.5.1.2 2('), 3(') SR 3.3.5.1.4 SR 3.3.5.1.5

c. Automatic 1, 1 G SR 3.3.5.1.4 s 115.0 Depressurization SR 3.3.5.1.5 seconds System Initiation 2('), 3(*)

Timer (continued)

(d) With reactor steam dome pressure > 150 psig.

(e) With reactor steam done pressure > 100 psig.

PBAPS UNIT 2 3.3-44 Amendment No.

ECCS Instrumentation i 3.3.5.1 .

Table 3.3.5.1 1 (page 4 of 5)

Emergency Core Cooling System Instrunentation '

APPLICABLE CONDITIONS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS FUNCTION ACTION A.1 RCQUIREMENTS VALUE i

4. ADS Trip System A (continued)

d. Reactor vessel Water 1, 2 F SR 3.3.5.1.1 2 -160.0 Level-Lt,w Low Low SR 3.3.5.1.2 inches (Levet 1), 2('), 3(*) SR 3.3.5.1.4 (Permissive) SR 3.3.5.1.5

e. Reactor Vessel Water 1, SR 3.3.5.1.1 1 F 2 6.0 inches Confirmatory SR 3.3.5.1.2 Level-Low (Level 4) 2('), 3(') SR 3.3.5.1.4 SR 3.3.5.1.5

f. Core Spray Puip 1, 4 G SR 3.3.5.1.3 e 175.0 psig Discharge SR 3.3.5.1.5 and Pressure - High 2('), 3(') s 195.0 psis

g. Low Pressure Coolant 1, 8 G SR 3.3.5.1.3 a 40.0 psig injection Puup SR 3.3.5.1.5 and Discharge 2(*), 3(') s 60.3 psig Pressure - High

h. Automatic 1, 2 G SR 3.3.5.1.4 5 9.5 minutes j Depressurization SR 3.3.5.1.5 '

System Low Water Level 2('), 3(') l Actuatloa Timer j

5. ADS Trip System B '

a. Reactor Vessel Water 1, 2 F SR 3.3.5.1.1 2 -160.0 Level-Low Low Low SR 3.3.5.1.2 inches (Level 1) 2('), 3(') _ SR 3.3.5.1.4 SR 3.3.5.1.5

b. Drywell 1, 2 F SR 3.3.5.1.1 5 2.0 psig Pressure - High SR 3.3.5.1.2 2('), 3(*) SR 3.3.5.1.4 SR 3.3.5.1.5

c. Automatic 1, 1 G SR 3.3.5.1.4 s 115.0 Depressurization SR 3.3.5.1.5 seconds System Initiation 2('), 3(') 1 Timer

d. Reactor Vessel Water 1, 2 F SR 3.3.5.1.1 t 160.0 Level Low Low Low SR 3.3.5.1.2 inches (Level 1), 2('), 3(*) SR 3.3.5.1.4 (Permissive) SR 3.3.5.1.5 (continued)

(e) With reactor steam done pressure > 100 psis.

PBAPS UNIT 2 3.3-45 Amendment No.

!~ l l

ECCS Instrumentation 3.3.5.1 .

Table 3.3.5.1 1 (page 5 of 5)

Emergency Core Cooling System Instrumentation APPLICABLE CONDITIONS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS FUNCTION ACTION A.1 REQUIREMENTS VALUE

5. ADE Trip system B (continued)

e. Reactor Vessel Water 1, 1 F st 3.3.5.1.1 t 6.0 inches Confirmatory SR 3.3.5.1.2

' Love!-Low (Level 4) 2('), 3(') st 3.3.5.1.4 SR 3.3.5.1.5

f. Core sprey Ptap 1, 4 G SR 3.3.5.1.3 t 175.0 pois Discherse SR 3.3.5.1.5 and Pressure - High 2(e), 3(e) g 195.0 psig

g. Low Pressure Coolant 1, 8 G st 3.3.5.1.3 e 40.0 peig Injection Ptap SR 3.3.5.1.5 and Discharge 2(*), 3(*) s 60.0 pois Pressure - Nigh

h. Automatic 1, 2 G SR 3.3.5.1.4 s 9.5 minutes Depressurization sa 3.3.5.1.5 System Low Water Level 2(*), 3(*)

Actuation Timor (e) With reactor steem dome pressure > 100 psig.

l i

i i

l l

i, I

'PBAPS UNIT 2 3.3-46 Amendment No.

1

I l

RCIC System Instrumentation 3.3.5.2 ,

j 3.3- INSTRUMENTATION !

3.3.5.2 ' Reactor Core Isolation Cooling (RCIC) System Instrumentation LCO -3.3.5.2 The.RCIC System instrumentation for each Function in l Table 3.3.5.2-1 shall be OPERABLE. j APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig. ;

i ACTIONS l

1

NOTE-------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME l A. 'One or more. channels A.1 Enter the Condition Immediately inoperable. referenced in Table 3.3.5.2-1 for the channel.

B. As required by. B.1 Declare RCIC System I hour from Required Action A.1 inoperable. discovery of and referenced in loss of RCIC 1

' Table 3.3.5.2-1. initiation 3 capability '

8!iQ 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months B.2 Place channel in trip.

C. As required by C.1 Restore channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Required Action A.1 OPERABLE status, and referenced in Table 3.3.5.2-1.

(continued)

PBAPS UNIT 2 3.3-47 Amendment No.

__ .- . - _ _ _ - - n-

. - - - -. ..-.- - . . . - . - . . . . . - - _ - . . - . _ ~ . . _ . . _ - . . - . _ . . . _ -

RCIC System Instrumentation 3.3.5.2 .

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. As required by D.1 --------NOTE---------

Required Action A.1 Only applicable if and referenced in RCIC pump suction is Table 3.3.5.2-1. not aligned to the suppression pool.

Declare RCIC System I hour from inoperable. discovery of loss of RCIC initiation capability A!iQ D.2.1 Place channel in 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months trip.

9_6 l

D.2.2 Align RCIC pump 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months '

suction to the suppression pool.

E. Required Action and E.1 Declare RCIC System Immediately associated Completion inoperable.

Time of Condition B, C, or D not met.

l PBAPS UNIT 2 3.3-48 Amendment No.

. - . .~ . .- - .~ . - - - - . .-.-.-. ..- . .-_.- ._. .- . - ..~. . ... - - -. - .

RCIC System Instrumentation 3.3.5.2 SURVEILLANCE REQUIREMENTS i

NOTES------------------------------------ i

1. Refer to Table 3.3.5.2-1 to determine which SRs apply for each RCIC 1 Function.

i

2. When a channel is placed in an inoperable status solely for performance of l required Surveillances, entry into associated Conditions and Required l Actions may be delayed as follows: (a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Function 2; .

I and (b) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions 1 and 3 provided the associated l E

Function maintains RCIC initiation capability.

I SURVEILLANCE FREQUENCY I

i SR 3.3.5.2.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months i

l- l l SR 3.3.5.2.2 Perform CHANNEL FUNCTIONAL TEST. 92 days i

J l i SR 3.3.5.2.3 Perform CHANNEL CALIBRATION. 24 months , j l l SR 3.3.5.2.4 Perform LOGIC SYSTEM FUNCTIONAL TEST. 24 months 1

l l

PBAPS UNIT 2 3.3-49 Amendment No. j i

i

..--n- ~

RCIC System Instrumentation 3.3.5.2 .

Table 3.3.5.2-1 (page 1 of 1)

Reactor Core Isolation Cooling System Instrumentation CONDITIONS REQUIRED REFERENCED CHANNELS FROM REQUIRED SURVE!LLANCE ALLOWABLE FUNCTION PER FUNCTION ACTION A.1 REQUIREMENTS VALUE

1. Reactor vessel Water 4 B SR 3.3.5.2.1 t 48.0 inches Level-Low Low (Level 2) SR 3.3.5.2.2 SR 3.3.5.2.3 SR 3.3.5.2.4

2. Reactor vessel Water 2 C SR 3.3.5.2.1 s 46.D inches Level-Nigh (Level 8) SR 3.3.5.2.2 SR 3.3.5.2.3 SR 3.3.5.2.4

3. Condensate Storage Tank 2 D SR 3.3.5.2.1 t 5.25 ft above Level - Low SR 3.3.5.2.2 tank bottom SR 3.3.5.2.3 SR 3.3.5.2.4 1

1 l

l PBAPS UNIT 2 3.3-50 Amendment No.

l Primary Containment Isolation Instrumentation 3.3.6.1 .

3.3 INSTRUMENTATION l 3.3.6.1 Primary Containment Isolation Instrumentation l l LCO 3.3.6.1 The primary containment isolation ir.strumentation for each l

Function in Table 3.3.6.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.6.1-1.

ACTIONS l

NOTE-------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Place channel in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for channels inoperable. trip. Functions 1.d, 2.a, and 2.b l AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Functions 1.d, 2.a, and j 2.b "

8.. One or more Functions B.1 Restore isolation I hour with isolation capability.

capability not maintained.

C. Required Action and C.1 Enter the Condition Immediately associated Completion referenced in Time of Condition A or Table 3.3.6.1-1 for B not met. the channel.

1 (continued)

PBAPS UNIT 2 3.3-51 Amendment No.

Primary Containment Isolation Instrumentation

, 3.3.6.1 .

l' ACTIONS-(continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. As required by D.1 Isolate associated 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Required Action C.1 main steam line and referenced in (MSL).

Table 3.3.6.1-1.

l QB D.2.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 8HQ D.2.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months E. As required by E.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Required Action C.1 and referenced in Table 3.3.6.1-1.

-F. As required by F.1 Isolete the affected I hour Required Action C.1 penetration flow and referenced in path (s).

Table 3.3.6.1-1.

G. As required by G.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months l Required Action C.1 '

and referenced in 88Q Table 3.3.6.1-1.

G.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months ,

0E i Required Action and associated Completion Time of Condition F not met.

(continued) l I

t PBAPS UNIT 2 3.3-52 Amendment No.

Primary Containment 1 solation Instrumentation 3.3.6.1 ,

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME H. -As required by H.1 Declare associated I hour Required Action C.1 standby liquid and referenced in control (SLC)

Table 3.3.6.1-1. subsystem inoperable.

QB H.2 Isoitte the Reactor 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Water Cleanup System. ,

I. As required by I.1 Initiate action to Immediately Required Action C.1 restore channel to and referenced in OPERABLE status.

Table 3.3.6.1-1.

I.2 Initiate action to Immediately l isolate the Residual i Heat Removal (RHR)

Shutdown Cooling l System. '

i ll PBAPS UNIT 2 3.3-53 Amendment No.

i a , - , e-

Primary Containment Isolation Instrumentation 3.3.6.1 .

SURVEILLANCE REQUIREMENTS

_________________________________---NOTES------------------------------------

1. Refer to Table 3.3.6.1-1 to determine which SRs apply for each Primary Containment Isolation Function.

2. When a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function h)aintains primary containment isolation capability.

SURVEILLANCE FREQUENCY SR 3.3.6.1.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.6.1.2' Perform CHANNEL FUNCTIONAL TEST. 92 days SR 3.3.6.1.3 ------------------NOTE-------------------

For Function 1.d, radiation detectors are excluded.

Perform CHANNEL CALIBRATION. 92 days SR 3.3.6.1.4 Perform CHANNEL CALIBRATION. 18 months SR 3.3.6.1.5 Perform CHANNEL CALIBRATION. 24 months SR 3.3.6.1.6 Calibrate each radiation detector. 24 months SR 3.3 6.1.7 Perform LOGIC SYSTEM FUNCTIONAL TEST. 24 months PBAPS UNIT 2- 3.3-54 Amendment ilo.

f . .

Primary Containment Isolation Instrumentation 3.3.6.1 .

Table 3.3.6.1 1 (page 1 of 3)

Primary Containment Isolation Instrumentation l

APPLICABLE CONDITIONS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPCCIFIED PER TRIP REQUIRED SURVEILLANCE ALLOWA8LE FUNCTION CONDITIONS STSTEM ACTION C.1 REQUIREMENTS VALUE

1. Main Steam Line Isolation

a. Reactor vessel Water 1,2,3 2 D SR 3.3.6.1.1 t 160.0 Level-Low Low Low SR 3.3.6.1.2 inches (Level 1) SR 3.3.6.1.5 SR 3.3.6.1.7

b. Main Steam Line 1 2 E SR 3.3.6.1.3 t 850.0 psig Pressure - Low SR 3.3.6.1.7

c. Main Steam Line 1,2,3 2 per D SR 3.3.6.1.1 s 123.3 paid Flow - High MSL SR 3.3.6.1.2 SR 3.3.6.1.5 SR 3.3.6.1.7

d. Main Steam Line - High 1,2,3 2 D SR 3.3.6.1.1 5 15 X Full Radiation SR 3.3.6.1.3 Power SR 3.3.6.1.6 Background SR 3.3.6.1.7

e. Main Steam Tunnel 1,2,3 8 D SR 3.3.6.1.1 s 200.0*F

saperature - High SR 3.3.6.1.2 SR 3.3.6.1.5 SR 3.3.6.1.7

2. Primary Containment Isolation

a. Reactor Vessel Water 1,2,3 2 G SR 3.3.6.1.1 t 1.0 inches Level-Low (Level 3) SR 3.3.6.1.2 SR 3.3.6.1.5 SR 3.3.6.1.7

b. Drywell Pressure - High 1,2,3 2 G SR 3.3.6.1.1 5 2.0 psig SR 3.3.6.1.2 SR 3.3.6.1.5 SR 3.3.6.1.7

c. Main Stack Monitor 1,2,3 1 F SR 3.3.6.1.1 5 2 X 10' Radiat ion - High SR 3.3.6.1.2 gCl/cc t SR 3.3.6.1.4 l SR 3.3.6.1.7

d. Reactor Building 1,2,3 2 G SR 3.3.6.1.1 5 16.0 mR/hr Ventilation Exhaust SR 3.3.6.1.3 Radiation - High SR 3.3.6.1.7

e. Refueling Floor 1,2,3 2 G SR 3.3.6.1.1 s 16.0 mR/hr Ventilation Exhaust SR 3.3.6.1.3 Radiation - High SR 3.3.6.1.7 (continued)

PBAPS UNIT 2 3.3-55 Amendment No.

l Primary Containment Isolation Instrumentation 3.3.6.1 .

Table 3.3.6.1 1 (page 2 of 3)

Primary Containment Isolation Instrunentation APPLICABLE CONDIT!DNS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER TRIP REQUIRED SURVE!LLANCE ALLOWABLE FUNCTION CONDITIONS STSTEM ACTION C.1 REQUIREMENTS VALUE

3. High Pressure Coolant Injection (HPCI) System Isolation

a. HPCI Steam Line 1,2,3 1 F SR 3.3.6.1.3 s 225.0 in-we Flow - High SR 3.3.6.1.7

b. HPCI Steam Line 1,2,3 1 F SR 3.3.6.1.5 s 10.0 seconds Flow-Time Delay SR 3.3.6.1.7 Relays

c. HPCI Steam Supply Line 1,2,3 2 F SR 3.3.6.1.3 a 60.0 psig Pressure - Low SR 3.3.6.1.7

d. Drywell Pressure-High 1,2,3 2 F SR 3.3.6.1.1 5 2.0 peig (Vacuus Breakers) SR 3.3.6.1.2 SR 3.3.6.1.5 SR 3.3.6.1.7

e. HPCI compartment and 1,2,3 8 F SR 3.3.6.1.1 s 200.0*F Steam Line Area SR 3.3.6.1.2 Temperature - High SR 3.3.6.1.5 SR 3.3.6.1.7

4. Reactor Core Isolation Cooling (RCIC) System Isolation

s. RCIC Steam Line 1,2,3 1 F SR 3.3.6.1.3 5 450.0 in-wc F tow - Migh SR 3.3.6.1.7

b. RCIC Steam Line 1,2,3 1 F SR 3.3.6.1.5 s 10.0 seconds Flow-Time Delay SR 3.3.6.1.7 Relays

c. RCIC Steam Supply Line 1,2,3 2 F SR 3.3.6.1.3 t 60.0 psis Pressure - Low SR 3.2.6.1.7

d. Drywell Pressure - High 1,2,3 2 F SR 3.3.6.1.1 s 2.0 psig (Vacuun Breakers) SR 3.3.6.1.2 SR 3.3.6.1.5 SR 3.3.6.1.7

e. RCIC Compartment and 1,2,3 8 F SR 3.3.6.1.1 s 200.0'F Steam Line Area SR 3.3.6.1.2 Temperature - Migh SR 3.3.6.1.5 SR 3.3.6.1.7 (continued)

PBAPS UNIT 2 3.3-E6 Amendment No.

Primary Containment 1 solation Instrumentation 3.3.6.1 .

Table 3.3.6.1 1 (page 3 of 3)

Primary Containment Isolation Instrumentation APPLICABLE CONDITIONS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER TRIP REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CCNDITIONS SYSTEM ACTION C.1 REQUIREMENTS VALUE

5. Reactor Water Cleanup (RWCU) System Isolation

s. RWCU Flow- High 1,2,3 1 F SR 3.3.6.1.1 s 125% rated SR 3.3.6.1.3 flow (23.0 SR 3.3.6.1.7 in-wc)

b. SLC System Init{stion 1,2 1 H SR 3.3.6.1.7 NA

c. Reactor Vessel Water 1,2,3 2 F SR 3.3.6.1.1 2 1.0 inches Level-Low (Level 3) SR 3.3.6.1.2 SR 3.3.6.1.5 SR 3.3.6.1.7

6. RHR Shutdown Cooling System Isolation

a. Reactor Pressure-High 1,2,3 1 F SR 3.3.6.1.3 s 70.0 psig SR 3.3.6.1.7

b. Reactor vessel Water 3,4,5 2(a) I SR 3.3.6.1.1 2 1.0 inches Level-Low (Level 3) SR 3.3.6.1.2 SR 3.3.6.1.5 SR 3.3.6.1.7

7. Feedwar f Recirculation isolation

a. Reactor Pressure-High 1,2,3 2 F SR 3.3.6.1.1 s 600 psig SR 3.3.6.1.2 SR 3.3.6.1.5 SR 3.3.6.1.7 (a) In MODES 4 and 5, provided RHR Shutdown Cooling System integrity is maintained, only one channel per trip system with an isolation signal available to one shutdown coolleg punp suction isolation valve is required.

l l

PBAPS UNIT 2 3.3-57 Amendment No.

Secondary Containment Isolation Instrumentation

, 3.3.6.2 ,

3.3 INSTRUMENTATION 3.3.6.2 Secondary Containment Isolation Instrumentation i

1 LC0 3.3.6.2 The secondary containment isolation instrumentation for each Function in Table 3.3.6.2-1 shall be OPERABLE.

l APPLICABILITY: According to Table 3.3.6.2-1.

i ACTIONS

NOTE------------------------------------- i Separa'e Condition e..try is allowed for each channel. l

\

l CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Place channel in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for inoperable. trip. Functions 1 and 2

AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Functions 1 and 2 B. One or more Functions B.1 Restore isolation I hour with isolation capability, capability not maintained.

(continued)

PBAPS UNIT 2 3.3-58 Amendment No.

)

Secondary Containment Isolation Instrumentation 3.3.6.2 .

ACTIONS (continued) l CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1.1 Isolate the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

. associated Completion associated secondary

. Time of Condition A or containment B not met, penetration flow path (s).

08

C.I.2 Declare associated I hour

!- secondary containment i I

isolation valves inoperable.

AHQ j C.2.1 Place the associated I hour i

standby gas treatment (SGT) subsystem (s) in operation.

QB C.2.2 Declare associated I hour SGT subsystem (s) inoperable.

L l

l i

i PBAPS UNIT 2 3.3-59 Amendment No.

Secondary Containment Isolation Instrumentation 3.3.6.2 ,

SURVEILLANCE REQUIREMENTS

NOTES------------------------------------

1. Refer to Table 3.3.6.2-1 to determine which SRs apply for each Secondary Containment Isolation Function.

2. When a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required :

Acti(ns may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains secondary containment isolation capability.

SURVEILLANCE FREQUENCY SR 3.3.6.2.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.6.2.2 Perform CHANNEL FUNCTIONAL TEST. 92 days SR 3.3.6.2.3 Perform CHANNEL CALIBRATION. 92 days SR 3.3.6.2.4 Perform CHANNEL CALIBRATION. 24 months ,

i SR 3.3.6.2.S Perform LOGIC SYSTEM FUNCTIONAL TEST. 24 months i l

l I

PBAPS UNIT 2 3.3-60 Amendment No.

Secondary Containment Isolation lnstrumentation 3.3.6.2 Table 3.3.6.21 (page 1 of 1)

Secondary containment Isolation Instrunentation APPLICABLE MODES OR REQUIRED OTHER OHANNELS SPECIFIED PER SURVE!LLANCE ALLOWABLE FUNCTION CONDITIONS TRIP SYSTEM REQUIREMENTS VALUE

1. Reactor vessel Water 1,2,3, 2 SR 3.3.6.2.1 t 1.0 inches Level- Low (Love 13) (a) SR 3.3.6.2.2 SR 3.3.6.2.4 SR 3.3.6.2.5

2. Drywel1 Pressure - High 1,2,3 2 SR 3.3.6.2.1 s 2.0 psis SR 3.3.6.2.2 SR 3.3.6.2.4 i SR 3.3.6.2.5

3. Reactor Building 1,2,3, 2 SR 3.3.6.2.1 s 16.0 aft /hr Ventilation Exhaust (a),(b) SR 3.3.6.2.3 Radiat ton - High SR 3.3.6.2.5

4. Refueling Floor 1,2,3, 2 SR 3.3.6.2.1 s 16.0 aft /hr Ventilation Exhaust (a),(b) SR 3.3.6.2.3 Radt ation - High SR 3.3.6.2.5 (a) During operations with a potential for draining the reactor vessel.

(b) During CORE ALTERATIONS, and during movement of irradiated fuel assemblies in secondary containment.

l I

i PBAPS UNIT 2 3.3-61 Amendment No.

1 l

l MCREV System Instrumentation 1 3.3.7.1 .

3.3 INSTRUMENTATION 3.3.7.1 Main Control Room Emergency Ventilation (MCREV) System Instrumentation 1

i i LCO 3.3.7.1 Two channels per trip system of the Control Room Air Intake Radiation-High Function shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, During movement of irradiated fuel assemblies ir. the secondary containment, l

During CORE ALTERATIONS, During operations with a potential for draining the reactor vessel (OPDRVs).

l ACTIONS 1

NOTE-------------------------------------

Separate Condition entry is allowed for each channel.

m. -

CONDITION REQUIRED ACTION COMPLETION TIME I

A. One or more required A.1 Declare associated 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from channels inoperable. MCREV subsystems discovery of inoperable. loss of MCREV l l

System i initiation-capability L

h.HQ A.2 Place channel in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months trip.

(continued) i i

i l

i PBAPS UNIT 2 3.3-62 Amendment No.

l l

MCREV System Instrumentation 3.3.7.1 ,

. ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. Required. Action and B.1 Place the associated I hour associated Completion MCREV subsystem (s) in Time not met, operation.

QB B.2 Declare associated I hour MCREV subsystem (s) i inoperable.

SURVEILLANCE REQUIREMENTS

NOTE-------------------------------------

When a channel is placed in an inopert.St. status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains MCREV System initiation capability.

SURVEILLANCE FREQUENCY SR 3.3.7.1.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.7.1.2 Perform CHANNEL FUNCTIONAL TEST. 92 days SR 3.3.7.1.3 Perform CHANNEL CALIBRATION. The 18 months ,

Allowable Value shall be s 400 cpm.

SR 3.3.7.1.4 Perform LOGIC SYSTEM FUNCTIONAL TEST. 24 months PBAPS UNIT 2 3.3-63 Amendment No.

, , - - - , r- - - - , - . - , , . - -

w -

t l

LOP Instrumentation ,

3.3.8.1 '

3.3 -INSTRUMENTATION ,

3.3.8.1 Loss of Power (LOP) Instrumentation

~ LCO 3.3.8.1 The Unit 2 LOP instrumentation for each Function in Table 3.3.8.1-1: shall be OPERABLE.

8HQ '

The Unit 3 LOP instrumentation for Functions 1, 2, 3, and 5

. in Unit 3 Table 3.3.8.1-1 shall be OPERABLE.

APPLICA8ILITY: When the associated diesel generator and offsite circuit are required to be OPERABLE by LCO 3.8.1, "AC Sources- i Operating," or LC0 3.8.2, "AC Sources-Shutdown."

ACTIONS

NOTE------------------------------------- I Separate Condition entry is allowed for each channel.

_________________________________________________________________. ___________ i CONDITION REQUIRED ACTION COMPLETION TIME t

A. One 4 kV emergency bus A.1 --------NOTE---------

with'one or two Enter applicable required Function 3 Conditions and channels inoperable. Required Actions of LC0 3.8.1 for offsite QB circuits made ,

inoperable by LOP #

One 4.kV emergency bus instrumentation. I with one or two ---------------------

required Function 5 channels inoperable. Place channel in 14 days trip.

(continued)

. 'PBAPS UNIT 2 3.3-64 Amendment No.

LOP Instrumentation 3.3.8.I ,

ACTIONS (continued) ,

CONDITION REQUIRED ACTION COMPLETION TIME B. Two 4 kV emergency B.I --------NOTE---------

buses with one Enter applicable required Function 3 Conditions and channel inoperable. Required Actions of LCO 3.8.I for offsite E circuits made inoperable by LOP Two 4 kV emergency instrumentation.

buses with one ---------------------

required Function 5 channel inoperable. Place the channel in 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months trip.

M One 4 kV emergency bus with one required Function 3 channel inoperable and a ;

different 4 kV ;

emergency bus with one required Function 5 channel inoperable.

(continued)

PBAPS UNIT 2 3.3-65 Amendment No.

1 l

LOP Instrumentation 3.3.8.1 .

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One or more 4 kV C.1 --------NOTE---------

emergency buses with Enter applicable one or more required Conditions and Function 1, 2, or 4 Required Actions of channels inoperable. LC0 3.8.1 for offsite circuits made QR inoperable by LOP instrumentation.

One 4 kV emergency bus ---------------------

with one required Function 3 channel and Place the channel in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months one required Function trip.

5 channel inoperable.

QR Any combination of three or more required Function 3 and Function 5 channels inoperable.

D. Required Action and D.1 Declare associated Immediately associated Completion diesel generator (DG)

Time not met. inoperable, i i

i PBAPS, UNIT 2 3.3-66 Amendment No.

I LOP Instrumentation 3.3.8.1 : ;

SURVEILLANCE REQUIREMENTS

NOTES------------------------------------

1. . Refer to Table 3.3.8.1-1 to determine which SRs apply for each Unit 2 LOP Function. SR 3.3.8.1.5 is applicable only to the Unit 3 LOP instrumentation.

2. When a channel'is'placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required

' Actions may be delayed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided: (a) for Function 1, the associated Function maintains initiation capability for three DGs; and (b) for Functions 2, 3, 4, and 5, the associated Function maintains undervoltage transfer capability for three 4 kV emergency buses. '

SURVEILLANCE FREQUENCY 1 SR 3.3.8.1.1 Perform CHANNEL FUNCTIONAL TEST. 31 days :

SR 3.3.8.1.2 Perform CHANNEL CALIBRATION. 18 months SR 3.3.8.1.3 Perform CHANNEL FUNCTIONAL TEST. 24 months i

SR 3.3.8.1.4 Perform LOGIC SYSTEM FUNCTIONAL TEST. 24 months SR 3.3.8.1.5 For required Unit 3 LOP instrumentation In accordance Functions, the SRs of Unit 3 with applicable Specification 3.3.8.1 are applicable. SRs '

I i

1 PBAPS UNIT 2 3.3-67 Amendment No.

l I

LOP Instrumentation 3.3.8.1 .

Table 3.3.8.1 1 (page 1 of 1)

Loss of Power Instrumentation l

REQUIRED '

CHANNELS SURVE!LLANCE ALLOWABLE FUNCTION PER Bus REQUIREMENTS VALUE i l

i l

1. 4 kV Emergency Bus Undervoltage (Loss of Voltage)

a. Bus Undervoltage 1 SR 3.3.8.1.3 NA SR 3.3.8.1.4

2. 4 kV Emergency Bus Undervoltage l (Degraded Voltage Low Setting)

a. Bus undervoltage 2 SR 3.3.8.1.1 t 2288 V and 5 2704 V (1 per SR 3.3.8.1.2 source) SR 3.3.8.1.4

b. Time Delay 2 $R 3.3.8.1.1 t 1.6 seconds and 1 l (1 per SR 3.3.8.1.2 5 2.0 seconds source) st 3.3.8.1.4

3. 4 kV Emergency Bus Undervoltage (Degraded Voltage High setting)

, s. Sus Undervoltage 2 st 3.3.8.1.1 2 3411 y and s 3827 V l (1 per SR 3.3.8.1.2 l source) SR 3.3.8.1.4

b. Time Delay 2 $R 3.3.8.1.1 t 27.0 seconds and (1 per SR 3.3.8.1.2 s 33.0 seconds J source) SR 3.3.8.1.4 1

4. 4 kV Emergency Bus Undervoltage '

(Degraded Voltage LOCA)

a. Bus undervoltage 2 st 3.3.8.1.1 t 3691 y and 5 3713 V, l l (1 per SR 3.3.8.1.2 with internal time delay j source) SR 3.3.8.1.4 set t 0 9 seconds and 5 1.1 seconds 1 l

h. Time Delay 2 st 3.3.8.1.1 2 8.4 seconds and (1 per SR 3.3.8.1.2 5 9.6 seconds source) SR 3.3.8.1.4 l 5. 4 Os *meroency sus undervoltage l (Degraded Voltage non LOCA) l a. Bus Undervoltage 2 sa 3.3.8.1.1 t 4065 y and s 4089 V, (1 per SR 3.3.8.1.2 with internal time delay L source) st 3.3.8.1.4 set t 0.9 seconds and 5 1.1 seconds

b. Time Delay 2 sa 3.3.8.1.1 t 57.0 seconds and s 63.0 (1 per st 3.3.8.1.2- seconds source) SR 3.3.8.1.4 l

L PBAPS UNIT 2 3.3-68 Amendment No.

J

.. . . . - . . .- .- . - . - . . - - . - . . - . - . . . - - . ~ . -.... - . .

RPS Electric Power Monitoring 3.3.8.2 ,

3.3' INSTRUMENTATION i 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring {

LCO 3.3.8.2 Two RPS electric power monitoring assemblies shall be l

l OPERABLE for each inservice RPS motor generator set or !

alternate power supply.

APPLICABILITY: MODES 1 and 2, MODES 3, 4, and 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or both inservice A.1 Remove associated 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months power supplies with inservice power one electric power supply (s) from monitoring assembly service.

inoperable.

B. One or both inservice B.1 Remove associated I hour power supplies with inservice power both electric power . supply (s) from monitoring assemblies service.

inoperable.

C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months {

associated Completion l Time of Condition A or i B not met in MODE 1 or 2.

l (continued) l l

PBAPS UNIT 2 3.3-69 Amendment No,

RPS Electric Power Monitoring 3.3.8.2 .

. ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME.

D. Required Action and. D.1 Initiate action to Immediately associated Completion fully insert all Time of Condition A or insertable control B not met in MODE 3, rods in core cells 4, or 5 with any containing one or control rod' withdrawn more fuel assemblies.

from a core cell containing one or more fuel assemblies.

SURVEILLANCE REQUIREMENTS

. SURVEILLANCE FREQUENCY SR 3.3.8.2.1 ------------------NOTE-------------------

Only required to be performed prior to entering MODE 2 or 3 from MODE 4, when in MODE 4 for a'24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Perform CHANNEL FUNCTIONAL TEST. 184 days SR 3.3.8.2.2 Perform CHANNEL CALIBRATION for each RPS 24 months motor generator set electric power monitoring assembly. The Allowable Values shall be:

a. Overvoltage s 133 V, with time delay set to s 1.5 seconds.

b. Undervoltage 2 111 V, with time delay set to s 1.5 seconds.

c. Underfrequency 2 56.8 Hz, with time delay set to s 7.0 seconds.

(continued)

PBAPS UNIT 2 3.3-70 Amendment No.

.. . - - . -._ . . - .. __ _ - . = _ - - - . --.

RPS Electric Power Monitoring ,

3.3.8.2 ,

SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.3.8.2.3 Perform CHANNEL CALIBRATION for each RPS 24 months alternate power supply electric power monitoring assembly. The Allowable Values shall be:

a. Overvoltage s 133 V, with time delay set to s 1.5 seconds. I

b. Undervoltage 2 111 V, with time delay set to s 4.0 seconds.

c. Underfrequency a 56.8 Hz, with time ;

delay set to s 1.5 seconds. l l

SR 3.3.8.2.4 Perform a system functional test. 24 months ;

l l

I l

l PBAPS UNIT 2 3.3-71 Amendment No.

I TABLE OF CONTENTS B 2.0 SAFETY LIMITS (SLs) ................... B 2.0-1 B 2.1.1 Reactor Core SLs . . . . . . . . . . . . . . . . . B 2.0-1 B 2.1.2 Reactor Coolant System (RCS) Pressure SL .... B 2.0-7 8 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY . . . B 3.0-1 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY ....... B 3.0-10 B 3.1 REACTIVITY CONTROL SYSTEMS . . . . . . . . . .'. . . . B 3.1-1 B 3.1.1 SHUTDOWN MARGIN (SDM) .............. B 3.1-1 B 3.1.2 Reactivity Anomalies . . . . . . . . . . . . . . . B 3.1-8 B 3.1.3 Control Rod OPERABILITY ............. B 3.1-13 B 3.1.4 Control Rod Scram Times ............. B 3.1-22 B 3.1.5 Control Rod Scram Accumulators . . . . . . . . . . B 3.1-29 l B 3.1.6 Rod Pattern Control ............... B 3.1-34 8 3.1.7 Standby Liquid Control (SLC) System ....... B 3.1-39 B 3.1.8 Scram Discharge Volume (SDV) Vent and Drain Valves B 3.1-48 B 3.2 POWER DISTRIBUTION LIMITS .............. B 3.2-1 I B 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE I (APLHGR) ................... B 3.2-1 l B 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR) ....... B 3.2-6 i B 3.2.3 LINEAR HEAT GENERATION RATE (LHGR) ....... B 3.2-11 !

B 3.3 INSTRUMENTATION ................... B 3.3-1 i B 3.3.1.1 Reactor Protection System (RPS) Instrumentation . B 3.3-1 B 3.3.1.2 Wide Range Neutron Monitor (WRNM) Instrumentation B 3.3-36 B 3.3.2.1 Control Rod Block Instrumentation ........ B 3.3-45 B 3.3.2.2 Feedwater and Main Turbine High Water Level Trip Instrumentation . . . . . . . . . . . . . . . . B 3.3-58 8 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation . . B 3.3-65 B 3.3.3. Remote Shutdown System . . . . . . . . . . . . . . B 3.3-76 B 3.3.4.1 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation ..... B 3.3-83 B 3.3.4.2 End of Cycle Recirculation Pump Trip (E0C-RPT) Instrumentation . . . . . . B 3.3-92 B 3.3.5.1 Emergency Core Cooling System (ECCS) l Instrumentation . . . . . . . . . . . . . . . . B 3.3-102 B 3.3.5.2 Reactor Core Isolation Cooling (RCIC) System Instrumentation . . . . . . . . . . . . . . . . B 3.3-140 8 3.3.6.1 Primary Containment Isolation Instrumentation .. B 3.3-151 B 3.3.6.2 Secondary Containment Isolation _ Instrumentation . B 3.3-179 8 3.3.7.1 Main Control Room Emergency Ventilation (MCREV)

System Instrumentation ............ B 3.3-190 B 3.3.8.1 Loss of Power (LOP) Instrumentation ....... B 3.3-197 B 3.3.8.2 Reactor Protection System (RPS) Electric Power l ' Monitoring .................. B 3.3-209 (continued)

PBAPS UNIT 2 i Revision No.

. - - ..- - . . . . . . - .- .- - - . - . . - - - . . - . - . ~ . -

I EOC-RPT Instrumentation '

B 3 3.4.2 0 l

B 3.3' INSTRUMENTATION

. B 3;3.4.2 End of Cycle Recirculation Pump. Trip (EOC-RPT) Instrumentation i l

L BASES l l i i

BACKGROUND The.EOC-RPT instrumentation initiates a. recirculation pump f trip (RPT) to reduce the peak reactor pressure and power -

resulting from turbine trip or generator load rejection '

l transients and to minimize the decrease in core MCPR during these transients.

The benefit of the additional negative reactivity in excess I of that normally inserted on a scram reflects end of cycle i reactivity considerations. Flux shapes at the end of cycle l are such that the control rods insert only a small amount of ;

L negative reactivity during the first few feet of rod travel !

upon a scram caused by Turbine Control Valve (TCV) Fast 'l Closure, Trip 011 Pressure-Low or Turbine Stop Valve t

, (TSV)-Closure. The physical phenomenon involved is that j L the void reactivity feedback due to a pressurization j t

transient can add positive reactivity at a faster rate than i the control rods can add negative reactivity. '

l- .

(

l The EOC-RPT instrumentation, as shown in Reference 1, is j l composed of sensors that detect initiation of closure of the !

TSVs or. fast closure of the TCVs, combined with relays, '

logic circuits, and fast acting circuit breakers that interrupt power from the recirculation pump motor generator l (MG) set generators to each of the recirculation pump motors. When the setpoint is exceeded, the channel output

! relay actuates, which then outputs an EOC-RPT signal to the L trip logic. When the RPT breakers trip open, the recirculation pumps coast down under their own inertia. The.

EOC-RPT has two identical trip systems, either of which can actuate an RPT.

l l Each EOC-RPT trip system is a two-out-of-two logic for each L Function; thus, either two TSV-Closure or 'two TCV Fast Closure, Trip 011 Pressure-Low signals are required for a i

trip system to actuate. If either trip system actuates, ;

both recirculation pumps will trip. There are two EOC-RPT l breakers in series per recirculation pump. One trip system I l trips one of the two E0C-RPT breakers for each recirculation '

l (continued) !

I i

I PBAPS UNIT 2 B 3.3-92 Revision No.

i j

L !

I %. ,. - . . - , -. - - _ , . - ..,_,._m_ I

i E0C-RPT Instrumentation '

B 3.3.4.2

-BASES

-BACKGROUND pump, and the second trip system. trips the other E0C-RPT (continued). breaker for each recirculation pump. !

APPLICABLE The TSV-Closure and the TCV Fast Closure, Trip 011' SAFETY ANALYSES, Pressure-Low Functions are designed to trip the.

LCO, and- recirculation pumps in the event of a turbine trip or

~ APPLICABILITY generator load rejection to mitigate the neutron flux, heat flux, and pressurization transients, and to minimize the decrease in MCPR. The analytical methods and assumptions used in evaluating the turbine trip and generator load rejection, as well as other safety analyses that utilitt EOC-RPT, are summarized in References 2, 3, and 4. ,

.To mitigate pressurization transient effects, the EOC-RPT must trip.the recirculation pumps after initiation of closure movement of either the TSVs or the TCVs. The combined effects of.this trip and a. scram reduce fuel bundle ,

power more rapidly than a scram alone so that the Safety Limit MCPR is not exceeded. Alternatively, APLHGR limits !

(power-dependent APLHGR multiplier, MAPFAC, of LCO 3.2.1, i

" AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"), the MCPR operating limits and the power-dependent MCPR limits (MCPR,) (LCO 3.2.2, " MINIMUM CRITICAL POWER RATIO (MCPR)")

for an inoperable EOC-RPT, as specified in the COLR,.are sufficient to allow this LCO to be met. The EOC-RPT function is automatically disabled when turbine first stage pressure is < 30% RTP.

EOC-RPT instrumentation satisfies Criterion 3 of the NRC Policy. Statement.

The OPERABILITY of the EOC-RPT is dependent on the.

OPERABILITY of the individual instrumentation channel Functions, i.e., the TSV-Closure and'the TCV Fast Closure, Trip 011 Pressure-Low functions. Each function must have a required number of OPERABLE channels in each trip system, with their setpoints within the specified Allowable Value of SR 3.3.4.2.3. Channel OPERABILITY also includes the associated EOC-RP1 breakers. Each channel (including the associated EOC-RPT breakers) must also respond within its l assumed response time.

l Allowable Values are specified for each EOC-RPT Function specified in the LCO. Trip setpoints are specified in the plant design documentation. The trip setpoints are selected ;

l (continued)

PBAPS UNIT 2 B 3.3-93 Revision No;

I EOC-RPT Instrumentation !

B 3.3.4.2 i i

' BASES APPLICABLE to. ensure that the actual setpoints do not exceed the SAFETY ANALYSES, Allowable Value between successive CHANNEL CALIBRATIONS.

LCO, and Operation with a trip setpoint less conservative than the APPLICABILITY trip :,dpoint, but within its Allowable Value, is (continued) acceptable. A channel is inoperable if-its actual trip I setting is not within its required Allowable Value. Trip -

setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to ;

the actual process parameters (e.g. TSV position), and when the measured output value of'the process parameter exceeds ,

the setpoint, the associated device (e.g., limit switch) !

changes state. The analytic limit for the TCV Fast Closure, i Trip 011 Pressure-Low Function was determined based on the '

TCV hydraulic oil circuit design. The Aliowable Value is :

derived from the analytic limit, corrected for calibration, !

! process, and instrument errors. The trip setpoint is ;

determined from the analytical limit corrected for l

calibration, process, and instrumentation errors, as well as instrument drift, as applicable. The Allowable Value and j trip setpoint for the TSV-Closure Function was determined by ~

engineering judgment and historically accepted practice for similar trip functions.

The specific Applicable Safety Analysis, LCO, and i Applicability discussions are listed below on a Function by Function basis.

Alternatively, since the instrumentation protects against a MCPR SL violation, with the instrumentation inoperable, l i modifications to the APLHGR limits (power-dependent APLHGR i

multiplier, MAPFAC. of LC0 3.2.1, " AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"), the MCPR operating limits and the power-dependent MCPR limits (MCPR,) (LCO 3.2.2,

" MINIMUM CRITICAL POWER RATIO (MCPR)") may be applied to allow this LCO to be met. The appropriate MCPR operating limits and power-dependent thermal limit adjustments for the EOC-RPT inoperable condition are specified.in the COLR.

Turbine Stoo Valve-Closure Closure of the TSVs and a main turbine trip result in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited.

Therefore, an RPT is initiated on TSV-Closure in anticipation of the transients that would result from closure of these valves. EOC-RPT decreases peak reactor power and aids the reactor scram in ensuring that the MCPR SL is not exceeded during the worst case transient. !

J (continued)

PBAPS UNIT 2 B 3.3-94 Revision No. .

i

EOC-RPT Instrumentation B 3.3.4.2 BASES APPLICABLE Turbine Stoo Valve-Closure (continued)

SAFETY ANALYSIS, LCO, and Closure of the TSVs is determined by measuring the position APPLICABILITY of each valve. There are position switches associated with each stop valve, the signal from each switch being assigned to a separate trip channel. The logic for the TSV-Closure Function is such that two or more TSVs must be closed to produce an EOC-RPT. This Function must be enabled at THERMAL POWER 2 30% RTP as measured at the turbine first stage pressure. This is normally accomplished automatically.

by pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect this Function. Four channels of TSV-Closure, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an E0C-RPT from this Function on a valid signal.

The TSV-Closure Allowable Value is selected to detect imminent TSV closure.

This EOC-RPT Function is required, consistent with the safety analysis assumptions, whenever THERMAL POWER is 2 30% RTP. Below 30% RTP, the Reactor Pressure-High and the Average Power Range Monitor (APRM) Scram Clamp Functions of the Reactor Protection System (RPS) are adequate to l maintain the necessary safety margins.

Turbine Control Valve Fast Closure. Trio 011 Pressure-Low i

Fast closure of the TCVs during a generator load rejection !

results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that.must be. limited. Therefore, an RPT is initiated on TCV Fast Closure, Trip 011 Pressure-Low in anticipation of the transients that would result from the closure of these valves. The EOC-RPT decreases peak reactor power and aids l the reactor scram in ensuring that the MCPR SL is not exceeded during the worst case transient. ,

Fast closure of the TCVs is determined by measuring the electrohydraulic control fluid pressure at each control valve. There is one pressure switch associated with each control valve, and the signal from each switch is assigned to a separate trip channel. The logic for the TCV Fast Closure, Trip Oil Pressure-Low Function is such that two or more-TCVs must be closed (pressure switch trips)

(continued)

PBAPS UNIT 2- B 3.3-95 Revision No.

EOC-RPT Instrumentation i B 3.3.4.2

]

\

BASES' .

l APPLICABLE Turbine Control Valve Fast Closure. Trio 011 Pressure-Low I SAFETY ANALYSIS, (continued) l 1

LCO, and l APPLICABILITY to produce an EOC-RPT. This Function must be enabled at '

THERMAL POWER a 30% RTP as measured at the turbine first I stage pressure. This is normally accomplished automatically by. pressure switches sensing turbine first stage pressure; therefore, opening of the turbine bypass valves may affect this function. Four channels of TCV Fast Closure, Trip 011 Pressure-Low, with two channels in.each trip system, are available and required to be OPERABLE to ensure that no single instrument fail'. 1 will preclude an EOC-RPT from this Function on a valid signal. The TCV Fast

- Closure, Trip 011 Pressure-Low Allowi. ale Value is selected high enough to detect imminent TCV fast closure.

This protection is required consistent with the safety analysis whenever THERMAL POWER is a 30% RTP. Below 30% RTP, the Reactor Pressure-High and the APRM Scram Clamp Functions of the RPS are adequate to maintain the necessary safety margins.

ACTIONS A Note has been provided to modify the ACTIONS related to EOC-RPT instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required -l Actions of the Condition continue to apply for each j additional failure, with Completion Times based on initial _ :

entry into the Condition. However, the Required Actions for i inoperable EOC-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable EOC-RPT instrumentation channel. ,

i l

(continued)

PBAPS UNIT 2' B 3.3-96 Revision No.

. = - - --. -- -

l E0C-RPT Instrumentation )

B 3.3.4.2 BASES ACTIONS M (continued) ,

With one or more channels inoperable, but with E0C-RPT trip !

capability maintained (refer to Required Action B.1 Bases), l the E0C-RPT System is capable of performing the intended function. However, the reliability and redundancy of the E0C-RPT instrumentation is reduced such that a single l failure in the remaining trip system could result in the l inability of the E0C-RPT System to perform the intended function. Therefore, only a limited time is allowed to restore compliance with the LCO. Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of an E0C-RPT, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is i provided to restore the inoperable channels (Required !

Action A.1). Alternately, the inoperable channels may be ;

placed in trip (Required Action A.2) since this would i conservatively compensate for the inoperability, restore !

capability to accommodate a single failure, and allow l operation to continue. As noted, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable breaker, !

since this may not adequately compensate for the inoperable i breaker (e.g., the breaker may be inoperable such that it l will not open). If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an RPT, or if the inoperable channel is the result of an inoperable breaker), Condition C must be entered and its Required Actions taken.

M Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not maintaining E0C-RPT trip capability. A Function is considered to be maintaining E0C-RPT trip c'apability when l sufficient channels are OPERABLE or in trip, such that the EOC-RPT System will generate a trip signal from the given l Function on a valid signal and both recirculation pumps can be tripped. This requires two channels of the Function in the same trip system, to each be OPERABLE or in trip, and the associated EOC-RPT breakers to be OPERABLE.

(continued)

PBAPS UNIT 2 B 3.3-97 Revision No.

- . . .. . . - .= - . -

E0C-RPT Instrumentation B 3.3.4.2 i

j BASES I l ACTIONS JLJ (continued) l i

1 The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is sufficient time for the l operator to take corrective action, and takes into account the likelihood of an event requiring actuation of the 1 EOC-RPT instrumentation during this period. It is also I

consistent with the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time provided in LCO 3.2.1 and 3.2.2 for Required Action A.1, since this

instrumentation's purpose is to preclude a thermal limit l

violation.

l l C.1 and C.2 i With any Required Action and associated Completion Time not

met, THERMAL POWER must be reduced to < 30% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Alternately, for an inoperable breaker (e.g., the breaker may be inoperable such that it will not open) the

, associated recirculation pump may be removed from service, since this performs the intended function of the I' . instrumentation. The allowed Completion Tim of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable, based on operating experience, to reduce THERMAL i POWER to < 30% RTP from full power conditions in an orderly l manner and without challenging plant systems.

SURVEILLANCE The Surveillances are modified by a Note to indicate that !

l REQUIREMENTS when a channel is placed in an inoperable status solely for ,

. performance of required Surveillances, entry into associated l

, Conditions and Required Actions may be delayed for up to I 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains E0C-RPT i trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 5) assumption of the average time required to perform channel Surveillance. That i analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does

not significantly reduce the probability that the L recirculation pumps will trip when necessary.

l l

! (continued) l PBAPS UNIT 2 B 3.3-98 Revision No.

l

E0C-RPT Instrumentation B 3.3.4.2 BASES SURVEILLANCE SR 3.3.4.2.1 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

The Frequency of 92 days is based on reliability analysis of Reference 5.

SR 3.3.4.2.2 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of' equipment drift in the setpoint analysis.

SR 3.3.4.2.3 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. . The system functional test of the pump breakers is included as a part of this test, overlapping the LOGIC SYSTEM FUNCTIONAL TEST, to provide complete testing of the associated safety function. Therefore, if a breaker is incapable of operating, the associated instrument channel (s) would also be inoperable.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential . for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance when performed at the 24 month Frequency.

(continued)

PBAPS UNIT 2 B 3.3-99 Revision No.

E0C-RPT Instrumentation L

B 3.304.2 1 BASES SURVEILLANCE SR 3.3.4.2.4 REQUIREMENTS (continued)- 'This SR ensures that an E0C-RPT initiated from the TSV-C1osure and TCV Fast Closure, Trip 011 Pressure-Low Functions will not be inadvertently bypassed when THERMAL POWER is a 30% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument _setpoint methodologies are incorporated into the actual setpoint.

Because main turbine bypass flow can affect this setpoirt nonconservatively (THERMAL POWER is derived from first stage pressure) the main turbine bypass valves must remain closed during the calibration at THERMAL POWER 2 30% RTP to ensure that the calibration remains valid. If any bypass channel's setpoint is nonconservative (i.e., the Functions are bypassed at 2 30% RTP, either due to open main turbine bypass valves or other- reasons), the affected TSV-Closure and TCV Fast Closure, Trip 011 Pressure-Low Functions are considered inoperable. Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met with the channel considered OPERABLE.

The Frequency of 24 months is based on engineering judgement and reliability of the components.

SR 3.3.4.2.5 This SR ensures that the individual channel response times r

are less than or equal to the maximum values assumed in the accident analysis. The E0C-RPT SYSTEM RESPONSE TIME acceptance criterion is included in Reference 6.

A Note to the Surveillance states that breaker interruption time may be assumed from the most recent performance of SR 3.3.4.2.6. This is allowed since the time to open the contacts after energization of the trip coil and the arc suppression time are short and do not appre.ciably change, due to the design of the breaker opening device and the fact that the breaker is not routinely cycled.

l (continued)

PBAPS UNIT 2 B 3.3-100 Revision No.

E0C-RPT Instrumentation B 3.3.4.2 BASES SURVEILLANCE SR 3.3.4.2.5 (continued)

REQUIREMENTS EOC-RPT SYSTEM RESPONSE TIME tests are conducted on a 24 month STAGGERED TEST BASIS. Response times cannot be determined at power because operation of final actuated devices is required. Therefore, the 24 month Frequency is consistent with the typical industry refueling cycle and is based upon plant operating experience, which shows that random failures of instrumentation components that cause serious response time degradation, but not channel failure, are infrequent occurrences.

SR 3.3.4.2.6 This SR ensures that the RPT breaker interruption time (arc suppression time plus time to open the contacts) is provided to the EOC-RPT SYSTEM RESPONSE TIME test. The 60 month Frequency of the testing is based on the difficulty of performing the test and the reliability of the circuit breakers.

REFERENCES 1. UFSAR, Figure 7.9.4A, Sheet 3 of 3 (E0C-RPT logic diagram).

2. UFSAR, Section 7.9.4.4.3.

3. UFSAR, Section 14.5.1.2.4.

4. NEDE-24011-P-A, " General Electric Standard Application for Reactor Fuel," latest approved version.

5. GENE-770-06-1-A, " Bases for Changes to Surveillance Test Intervals and Allowed Out-0f-Service Times for Selected Instrumentation Technical Specifications,"

December 1992.

6. Core Operating Limits Report.

.PBAPS UNIT 2 B 3.3-101 Revision No.

I m,as,w--

ECCS Instrumentation B 3.3.5.1 .

B 3.3 INSTRUMENTATION B 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation BASES 1

BACKGROUND The purpose of the ECCS instrumentation is to initiate appropriate responses from the systems to ensure that the fuel is adequately cooled in the event of a design basis accident or transient.

For most abnormal operational transients and Design Basis Accidents (DBAs), a wide range of dependent and independent

parameters are monitored.

The ECCS instrumentation actuates core spray (CS), low pressure coolant injection (LPCI), high pressure coolant injection (HPCI), Automatic Depressurization System (ADS),

and the diesel generators (DGs). The equipment involved with each of these systems is described in the Bases for LC0 3.5.1, "ECCS -Operating. "

Core Sorav System The CS System may be initiated by automatic means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low Low (Level 1) or Drywell Pressure-High with a Reactor Pressure-Low permissive. The reactor vessel water level and the reactor pressure variables are monitored by four redundant transmitters, which are, in turn, connected to four pressure compensation instruments. The drywell pressure variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the pressure compensation instruments and the trip units are connected to relays which send signals to two trip systems, with each trip. system arranged in a one-out-of-two taken twice logic (each trip unit sends a signal to both trip systems.) Each trip system initiates two of the four CS pumps.

Upon receipt of an initiation signal, if normal AC power is available, CS pumps A and C start after a time delay of approximately 13 seconds and CS pumps B and D start after a time delay of approximately 23 seconds. If normal AC power is not available, the four CS pumps start simultaneously after a time delay of approximately 6 seconds after the respective DG is ready to load.

(continued) j PBAPS UNIT 2 B 3.3-102 Revision No.

ECCS Instrumentation B 3.3.5.1 ,

BASES BACKGROUND Core Sorav System (continued)

The CS test line isolation valve, which is also a primary containment isolation valve (PCIV), is closed on a CS initiation signal to allow full system flow assumed in the accident analyses and maintain primary containment isolated in the event CS is not operating.

The CS pump discharge flow is monitored by a differential pressure indicating switch. When the pump is running and discharge flow is low enougl so that pump overheating may occur, the minimum flow return line valve is opened. The valve is automatically closed if flow is above the minimum flow setpoint to allow the full system flow assumed in the accident analysis.

The CS System also monitors the pressure in the reactor to ensure that, before the injection valves open, the reactor pressure has fallen to a value below the CS System's maximum design pressure. The variable is monitored by four redundant transmitters, which are, in turn, connected to four pressure compensation instruments. The outputs of the pressure compensation instruments are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

Low Pressure Coolant In.iection System The LPCI is an operating mode of the Residual Heat Removal (RHR) System, with two LPCI subsystems. The LPCI subsystems may be initiated by automatic means. Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low Low (Level 1); Drywell Pressure-High with a Reactor Pressure-Low (Injection Permissive). The drywell pressure variable is monitored by four redundant transmitters, which, in turn, are connected to four trip units. The reactor vessel water level and the reactor pressure variables are monitored by four redundant transmitters, which are, in turn, connected to four pressure compensation instruments.

The outputs of the trip units and pressure compensation instruments are connected to relays which send signals to two trip systems, with each trip system arranged in a one-out-of-two taken twice logic (each trip unit sends a signal to both trip systems). Each trip system can initiate all four LPCI pumps.

(continued) l PBAPS UNIT 2 B 3.3-103 Revision No.

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Low Pressure Coolant In.iection System (continued)

Upon receipt of an initiation signal if normal AC power is available, the LPCI A and B pumps start after a delay of approximately 2 seconds. The LPCI C and D pumps are started after a delay of approximately 8 seconds. If normal AC power is not available, the four LPCI pumps start simultaneously with no delay as soon as the standby power source is available.

Each LPCI subsystem's discharge flow is monitored by a differential pressure indicating switch. Wnen a pump is running and discharge flow is low enough so that pump overheating may occur, the respective minimum flow return line valve is opened. If flow is above the minimum flow setpoint, the valve is automatically closed to allow the full system flow assumed in the analyses.

The RHR test line suppression pool cooling isolation valve, suppression pool spray isolation valves, and containment spray isolation valves (which are also PCIVs) are also closed on a LPCI initiation signal to allow the full system flow assumed in the accident analyses and maintain primary containment isolated in the event LPCI is not operating.

The LPCI System monitors the pressure in the reactor to ensure that, before an injection valve opens, the reactor pressure has fallen to a value below the LPCI System's maximum design pressure. The variable is monitored by four redundant transmitters, which are, in turn, connected to four pressure compensation instruments. The outputs of the pressure compensation instruments are connected to relays whose contacts are arranged in a one-cat-of-two taken twice logic. Additionally, instruments arr. provided to close the recirculation pump discharge valies to ensure that LPCI flow does not bypass the core when it injects into the recirculation lines. The variable is monit.ored by four redundant transmitters, which are, in turn, connected to four pressure compensation instruments. The outputs of the pressure compensation instruments are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic.

(continued)

PBAPS UNIT 2 B 3.3-104 Revision No.

ECCS Instrum ntation B 3.3.5.1 BASES BACKGROUND Low Pressure Coolant Iniection System (continued)

Low reactor water level in the shroud is detected by two additional instruments. When the level is greater than the low level setpoint LPCI may no longer be required, therefore other modes of RHR (e.g., suppression pool cooling) are allowed. Manual overrides for the isolations below the low level setpoint are provided.

Hiah Pressure Coolant In.iection System The HPCI System may be initiated by automatic means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low (Level 2) or Drywell Pressure-High.

The reactor vessel water level variable is monitored by four redundant transmitters, which are, in turn, connected to four pressure compensation instruments. The drywell pressure variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the pressure compensation instruments and the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic for each Function.

The HPCI pump discharge flow is monitored by a flow switch.

When the pump is running and discharge flow is low enough so that pump overheating may occur, the minimum flow return line valve is opened. The valve is automatically closed if flow is above the minimum flow setpoint to allow the full system flow assumed in the safety analysis.

The HPCI test line isolation valve (which is also a PCIV) is closed upon receipt of a HPCI initiation signal to allow the full system flow assumed in the accident analysis and maintain primary containment isolated in the event HPCI is not operating.

The HPCI System also monitors the water levels in the condensate storage tank (CST) and the suppression pool because these are the two sources of water for HPCI operation. Reactor grade water in the CST is the nornal source. Upon receipt of a HPCI initiation signal, the CST (continued)

PBAPS UNIT 2 8 3.3-105 Revision No.

I L ECCS Instrumentation B 3.3.5.1 i

BASES '

i

' BACKGROUND Hiah Pressure Coolant Iniection System (continued) t suction valve is automatically signaled to open (it is . i normally in the open position) unless both suppression pool suction valves are open.. . If the water level in the CST falls below a preselected level, first the suppression pool ;

suction valves automatically open, and then the CST suction ,

valve automatically closes. Two level switches are used to '

detect low water level in the CST. Either switch can cause the. suppression pool suction valves to open and the CST suction valve to close. The suppression pool suction valves also automtically open and the CST suction valve closes if high watt: :avel is detected in the suppression pool. To prevent k . q suction to the pump, the suction valves are L inte.rlocked so that one suction path must be open before the

[ other automatically closes.

The HPCI provides makeup water to the reactor until the i reactor vessel water level reaches the Reactor Vessel Water r Level-High (Level 8) trip, at which time the HPCI turbine '

trips, which causes the turbine's stop valve and the control valves to close. The logic is two-out-of-two to provide l .high reliability of the HPCI System. The HPCI System l L automatically restarts if a Reactor Vessel Water Level-Low ]

l Low (Level 2) signal is subsequently received.

i j Automatic ~ Deoressurization System l The ADS may be initiated by automatic means. Automatic i initiation occurs when signals indicating Reactor Vessel L Water Level-Low Low Low (Level 1); Drywell Pressure-High L or ADS Bypass Low Water Level Actuation Timer; Reactor

, Vessel Water Confirmatory Level-Low (Level 4); and CS or

! LPCI Pump Discharge Pressure-High are all present and the L ADS Initiation Timer has timed out. There are two i transmitters each for Reactor Vessel Water Level-Low Low l

Low (Level 1) and Drywell Pressure-High, and one transmitter for Reactor Vessel Water Confirmatory Level-Low (Level 4) in each of the'two ADS trip systems. Each of these transmitters connects to a trip unit, which then I

drives a relay whose contacts form the initiation logic.

Each ADS trip system 4 cludes a time delay between satisfying the initiation logic and the actuation of the ADS ;

valves. The ADS Initiation Timer time delay setpoint chosen I is long enough that the HPCI has sufficient operating time ;

e i

(contirued) j i

PBAPS UNIT 2 B 3.3-106 Revision No.

I

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Automatic Deoressurization System (continued) to recover to a level above Level 1, yet not so long that the LPCI and CS Systems are unable to adequately cool the fuel if the HPCI fails to maintain that level. An alarm in the control room is annunciated when either of the timers is timing. Resetting the ADS initiation signals resets the ADS Initiation Timers.

The ADS also monitors the discharge pressures of the four LPCI pumps and the four CS pumps. Each ADS trip system includes two discharge pressure permissive switches from all four LPCI pumps and one discharge pressure permissive switch from all four CS pumps. The signals are used as a permissive for ADS actuation, indicating that there is a source of core coolant available once the ADS has depressurized the vessel. Two CS pumps in proper combination (C or D and A or B) or any one of the four LPCI pumps is sufficient to permit automatic depressurization.

The ADS logic in each trip system is arranged in two

[

strings. Each string has a contact from each of the

following variables: Reactor Vessel Water Level-Low Low I Low (Level 1); Drywell Pressure-High; Low Water Level Actuation Timer; and Reactor Vessel Water Level-Low Low Low (Level 1) Permissive. One of the two strings in each trip #

system must also have a Reactor Vessel Water Confirmatory Level-Low (Level 4). After the contacts for the initiation

signal from' either drywell pressure or reactor vessel level l (and the timer for rehetor vessel level timing out) close, l

the following must be present to initiate an ADS trip system: all other contacts in both logic strings must close, the ADS initiation timer must time out, and a CS or LPCI pump discharge pressure signal must be present. Either the A or B trip system will cause all the ADS relief valves to open. Once the Drywell Pressure-High signal, the ADS l Low Water Level Actuation Timer, or the ADS initiation l signal is present, it is individually sealed in until l

manually reset.

Manual inhibit switches are provided in the control room for the ADS; however, their function is not required for ADS OPERABILITY (provided ADS is not inhibited when required to be OPERABLE).

(continued)

PBAPS UNIT 2 B 3.3-107 Revision No.

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND- Diesel Generators (continued)

The DCs may be initiated by automatic means. Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low Low (Level 1) or Drywell Pressure-High. The DGs are also initiated upon loss of voltage signals. (Refer '

to the Bases for LC0 3.3.8.1, " Loss of Power (LOP)

Instrumentation," for a discussion of these signals.) The reactor vessel water level variable is monitored by four redundant transmitters, which are, in turn, connected to four pressure compensation instruments. The drywell '

pressure variable is monitored by four redundant transmitters, which are, in turn, connected to four trip units. The outputs of the four pressure compensation instruments and the trip units are connected to relays which send signals to two trip systems, with each trip system arranged in a one-out-of-two taken twice logic (each trip unit sends a signal to both trip systems). The A trip system initiates all four DGs and the B trip system initiates three of the four DGs. The DGs receive their initiation signals from the CS System initiation logic. The DGs can also be started manually from the control room and locally from the associated DG room. Upon receipt of a loss of coolant accident (LOCA) initiation signal, each DG is automatically started, is ready to load in approximately 10 seconds, and will run in standby conditions (rated voltage and speed, with the DG output breaker open). The DGs will only energize their respective Engineered Safety Feature buses if a loss of offsite power occurs. (Referto Bases for LCO 3.3.8.1.)

APPLICABLE The actions of the ECCS are explicitly assumed in the safety SAFETY ANALYSES, analyses of References 1, 2, and 3. The ECCS is initiated LCO, and to preserve the integrity of the fuel cladding by limiting APPLICABILITY the post LOCA peak cladding temperature to less than the 10 CFR 50.46 limits.

ECCS instrumentation satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1. Each Function must have a required number of OPERABLE channels, (continued)

PBAPS UNIT 2 B 3.3-108 Revision No.

,. .. ~ _- - - - - - . . . - . - - . . _ _ - - . - - . - - - - . _

ECCS Instrumentation B 3.3.5.1 '

BASES l l

l APPLICABLE with their setpoints within the specified Allowable SAFETY ANALYSES Values, where. appropriate The actual setpoint is l LCO, and calibrated consistent with applicable setpoint methodology APPLICABILITY assumptions. Table 3.3.5.1-1, footnote (b), is added to )

(continued) show that certain ECCS instrumentation Functions are also required to be OPERABLE to perform DG initiation. !

Allowable Values are specified for each ECCS Function 4

specified in the Table. Trip setpoints are specified in -

the setpoint calculations. The trip setpoints are selected to ensure that the settings do not exceed the Allowable :

Value between CHANNEL CALIBRATIONS. Operation with a trip i setting less conservative than the trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required .

Allowable Value. Trip setpoints are those predetermined i values of output at which an action should take place. The setpoints are compared to the actual process parameter- ;

(e.g., reactor vessel water level), and when the measured )

output'value of the process parameter exceeds the setpoint, ;

the associated device (e.g., trip unit) changes state. The analytic or design limits are derived from the limiting ;

values of the process parameters obtained from the safety j analysis or other appropriate documents. The Allowable-Values are derived from the analytic or design limits, i corrected for calibration, process, and instrument errors. ;

The trip setpoints are determined from analytical or design l limits, corrected for' calibration, process, and instrument ,

errors, as well as, instrument drift. In selected cases, 1 the Allowable V& lues and trip setpoints are determined from engineering judgement or historically accepted practice relative to the intended functions of the channel. The trip setpoints determined in this manner provide adequate protection by assuming instrument and process uncertainties expected for the environments during the operating time of 4 -

the associated channels are accounted for. For the Core Spray and LPCI Pump Start-Time Delay Relays, adequate margins for applicable setpoint methodologies are incorporated into the Allowable Values and actual setpoints.

In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions that may require ECCS (or DG) initiation to mitigate the consequences of a design basis transient or accident. To ensure reliable ECCS and DG function, a combination of Functions is required i to provide primary and secondary initiation signals. l (continued) 4 PBAPS UNIT 2' B 3.3-109 Revision No.

1

- .. . - - _ - - ~ - - . ~ ~. - .-

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE The specific Applicable Safety Analyses, LCO, and SAFETY ANALYSES, Appu cability discussions are listed below on a Function by LCO, and Function basis.

APPLICABILITY (continued)

Core Sorav and low Pressure Coolant in.iection Systems 1.a. 2.a. Reactor Vessel Water level-Low Low low (Level 1)

Low reactor pressure vessel (RPV) water level idicates that the capability to cool the fuel may be threatenei Should RPV water level decrease too far, fuel damage could result.

The low pressure ECCS and associated DGs are initiated at Reactor Vessel Water level-Low Low Low (Level 1) to ensure that core spray and flooding functions are available to prevent or minimize fuel damage. The DGs are initiated from Function 1.a signals. This Function, in conjunction with a Reactor Pressure-Low (Injection Permissive) sighal, also initiates the closure of the Recirculation Discharge Valves to ensure the LPCI subsystems inject into the proper RPV location. The Reactor Vessel Water Level-Low Low Low (Level 1) is one of the Functions assumed to be OPERABLE and capable of initiating the ECCS during the transients analyzed in References 1 and 3. In addition, the Reactor Vessel Water Level-Low Low Low (Level 1) Function is directly assumed in the analysis of the recirculation line break (Ref. 4) and the control rod drop accident (CRDA) analysis. The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS),

ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level-Low Low Low (Level 1) signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-Low Low Low (Level 1)

Allowable Value is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling.

Four channels of Reactor Vessel Water Level-Low Low Low (Level 1) Function are only required to be OPERABLE when the ECCS or DG(s) are required to be OPERABLE to ensure that no

single instrument failure can preclude ECCS and DG (continued) i l PBAPS UNIT 2 B 3.3-110 Revision No.

l l

ECCS Instrumentation I B 3.3.5.1 BASES APPLICABLE 1.a. 2.a. Reactor Vessel Water level-low low low (Level 1) l SAFETY ANALYSES, (continued) l LCO, and i APPLIN BILITY initiation. Refer to LC0 3.5.1 and LC0 3.5.2, "ECCS- i l

Shutdown," for Applicability Bases for the low pressure ECCS subsystems; LC0 3.8.1, "AC Sources-0perating"; and i LC0 3.8.2, "AC Sources-Shutdown," for Applicability Bases i for the DGs. !

1.b. 2.b. Drywell Pressure-Hiah High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB). The low pressure ECCS and associated DGs are initiated upon receipt of the i Drywell Pressure-High Function with a Reactor Pressure-Low i (Injection Permissive) in order to minimize the possibility !

of fuel damage. The DGs are initiated from Function 1.b 1 signals. This function also initiates the closure of the-recirculation discharge valves to ensure the LPCI subsystems inject into the proper RPV location. The Drywell ,

Pressure-High Function with a Reactor Pressure-Low ;

(Injection Permissive), along with the Reactor Water i Level-Low Low Low (Level 1) Function, is directly assumed ;

in the analysis of the recirculation line break (Ref. 4). ;

The core cooling function of the ECCS, along with the scram l action of the RPS, ensures that the fuel peak cladding l temperature remains below the limits of 10 CFR 50.46.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.

The Drywell Pressure-High Function is required to be OPERABLE when the ECCS or DG is required to be OPERABLE in conjunction with times when the primary containment is required to be OPERABLE. Thus, four channels of the CS and LPCI Drywell Pressure-High Function are required to be OPERABLE in MODES 1, 2, and 3 to ensure that no single instrument failure can preclude ECCS and DG initittion. In MODES 4 and 5, the Drywell Pressure-High Function is not !

required, since there is insufficient energy in the reactor i to pressurize the primary containment to Drywell Pressure- l High setpoint. Refer to LCO 3.5.1 for Applicability Bases l for the low pressure ECCS subsystems and to LC0 3.8.1 for !

Applicability Bases for the DGs.

(continued)

PBAPS UNIT 2 B 3.3-111 Revision No. !

I

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.c. 2.c. Reactor Pressure-low (iniection Permissive)

SAFETY ANALYSES, LCO, and Low reactor pressure signals are used as permissives for the APPLICABILITY low pressure ECCS subsystems. This ensures that, prior to (continued) opening the injection valves of the low pressure ECCS subsystems or initiating the low pressure ECCS subsystems on a Drywell Pressure-High signal, the reactor pressure has fallen to a value below these subsystems' maximum design pressure and a break inside the RCPB has occurred respectively. This Function also provides permissive for the closure of the recirculation discharge valves to ensure the LPCI subsystems inject into the proper RPV location.

The Reactor Pressure-Low is one of the Functions assumed to be OPERABLE and capable of permitting initiation of the ECCS during the transients analyzed in References 1 and 3. In addition, the Reactor Pressure-Low Function is directly assumed in the analysis of the recirculation line break (Ref. 4). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

The Reactor Pressure-Low signals are initiated from four pressure transmitters that sense the reactor dome pressure.

The Allowable Value is low enough to prevent overpressuring the equipment in the low pressure ECCS, but high enough to ensure that the ECCS injection prevents the fuel peak i cladding temperature from exceeding the limits of I 10 CFR 50.46. I Four channels of Reactor Pressure-Low Function are only ;

required to be OPERABLE when the ECCS is required to be OPERABLE to ensure that no single instrument failure can preclude ECCS initiation. Refer to LC0 3.5.1 and LC0 3.5.2 ,

for Applicability Bases for the low pressure ECCS subsystems.

1.d. 2.0. Core Sorav and Low Pressure Coolant In.iection Pumo Discharae Flow-low (Bvoass)

The minimum flow instruments are provided to protect the associated low pressure ECCS pump from overheating when the pump is operating and the associated injection valve is not fully open. The minimum flow line valve is opened when low flow is sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump. The LPCI and (continued)

PBAPS UNIT 2 B 3.3-112 Revision No.

ECCS Instrumentation B 3.3.5.1 BASES ,

APPLICABLE 1.d. 2 c. Core Sorav and Low Pressure. Coolant Iniection SAFETY ANALYSES, Pumo Discharae Flow-low (Byoass) (c0ntinued)

LCO, and APPLICABILITY CS Pump Discharge Flow-Low Functions are assumed to be OPERABLE and capable of closing the minimum flow valves to ensure that the low pressure ECCS flows assumed during the transients and accidents analyzed in References 1, 2, and 3 are met. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

One differential pressure switch per ECCS pump is used to detect the associated subsystems' flow rates. The logic is arranged such that each switch causes its associated minimum flow valve to open. The logic will close the minimum flow valve once the closure setpoint is exceeded. The LPCI minimum flow valves are time delayed such that the valves will not open for 10 seconds after the switches detect low flow. The time delay is provided to limit reactor vessel inventory loss during the startup of the RHR shutdown cooling mode. The Pump Discharge Flow-Low Allowable Values are high enough to ensure that the pump flow rate is sufficient to protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to allow full flow into the core.

Each channel of Pump Discharge Flow-Low Function (four CS channels and four LPCI channels) is only required to be OPERABLE when the associated ECCS is required to be OPERABLE to ensure that no single instrument failure can preclude the ECCS function. Refer.to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure ECCS subsystems.

l.e. 1.f. Core Sorav Pumo Start-Time Delav Relay The purpose of this time delay is to stagger the start of the CS pumps that are in each of Divisions I and II to prevent overloading the power source. This Function is necessary when power is being supplied from the offsite sources or the standby power sources (DG). The CS Pump Start-Time Delay Relays are assumed to be OPERABLE in the accident and transient analyses requiring ECCS initiation.

That is, the analyses assume that the pumps will initiate when required and excess loading will not cause failure of the power sources.

(continued)

PBAPS UNIT 2 B 3.3-113 Revision No.

.-. - _ ~ . =. - - - - - .

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.e. 1.f. Core Sorav Pumo Start-Time Delav Relav SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY There are eight Cnre Spray Pump Start-Time Delay Relays, two in each of the CS pump start logic circuits (one for when offsite power is available and one for when offsite power is not available). One of each type of time delay relay is dedicated to a single pump start logic, such that a single failure of a Core Spray Pump Start-Time Delay Relay will not result in the failure of more than one CS pump. In this condition, three of the four CS pumps will remain OPERABLE; thus, the single failure criterion is met (i.e.,

loss of one instrument does not preclude ECCS initiation).

The Allowable Value for the Core Spray Pump Start-Time Delay Relays is chosen to be long enough so that the power source will not be overloaded and short enough so that ECCS operation is not degraded. ;

Each channel of Core Spray Pump Start-Time Delay Relay Function is required to be OPERABLE only when the associated CS subsystem is required to be OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the CS subsystems.

l 2.d. Reactor Pressure-low Low (Recirculation Discharae Valve Permissive) l Low reactor pressure signals are used as permissives for l recirculation discharge valve closure. This ensures that l l

the LPCI subsystems inject into the proper RPV location assumed in the safety analysis. The Reactor Pressure-Low Low is one of the Functions assumed to be OPERABLE and !

capable of closing the valve during the transients analyzed i l in References 1 and 3. The core cooling function of the l l ECCS, along with the scram action of the RPS, ensures that l the fuel peak cladding temperature remains below the limits

! of 10 CFR 50.46. The Reactor Pressure-Low Low Function is l directly assumed in the analysis of the rec.irculation line break (Ref. 4).

[

The Reactor Pressure-Low Low signals are initiated from four pressure transmitters that sense the reactor pressure.

The Allowable Value is chosen to ensure that the valves close prior to commencement of LPCI injection flow into the core, as assumed in the safety analysis.

' (continued)

PBAPS UNIT 2 B 3.3-114 Revision No.

i l

ECCS Instrumentation i B 3.3.5.1 BASES 1

l APPLICABLE 2.d. Reactor Pressure-Low Low (Recirculation Discharae l SAFETY ANALYSES, Valve Permissive) (continued)

LCO, ar.d APPLICABILITY Four channels of the Reactor Pressure-Low Low Function are only required to be OPERABLE in MODES 1, 2, and 3 with the associated recirculation pump discharge valve open. With the valve (s) closed, the function of the instrementation has been performed; thus, the Function is not required. In MODES 4 and 5, the loop injection location is not critical since LPCI injection through the recirculation loup in either direction will still ensure that LPCI flow reaches the core (i.e., there is no significant reactor back pressure).

2.e. Reactor Vessel Shroud Level-level 0 The Reactor Vessel Shroud Level--Level 0 Function is provided as a permissive to allow the RHR System to be '

manually aligned from the LPCI mode to the suppression pool !

cooling / spray or drywell spray modes. The reactor vessel l shroud level permissive ensures that water in the vessel is approximately two thirds core height before the manual transfer is allowed. This ensures that LPCI is available to prevent or minimize fuel damage. This function may be overridden during accident conditions as allowed by plant procedures. Reactor Vessel Shroud Level-Level 0 Function i is implicitly assumed in the analysis of the recirculation i line break (Ref. 4) since the analysis assumes that no LPCI flow diversion occurs when reactor water level is below Level 0.

Reactor Vessel Shroud Level-Level 0 signals are initiated !

from two level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Shroud Level-Level 0 Allowable Value is chosen to allow the low pressure core flooding systems to activate and provide adequate cooling before allowing a manual transfer.

(continued)

'PBAPS UNIT 2 B 3.3-115 Revision No.

l ECCS Instrumentation l B 3.3.5.1 i BASES i

APPLICABLE 2.e. Reactor Vessel Shroud level-Level 0 (continued)

SAFETY ANALYSES, LCO, and Two channels of the Reactor Vessel Shroud Level-Level 0 APPLICABILITY Function are only required to be OPERABLE in MODES 1, 2, and 3. In MODES 4 and 5, the specified initiation time of the LPCI subsystems is not assumed, and other administrative controls are adequate to control the valves associated with this Function (since the systems that the valves are opened for are not required to be OPERABLE in MODES 4 and 5 and are normally not used).

2.f. Low Pressure Coolant In.iection Pumo Start-Time Delav l Relav The purpose of this time delay is to stagger the start of the LPCI pumps that are in each of Divisions I and II, to prevent overloading the power source. This Function is only i necessary when power is being supplied from offsite sources.

l The LPCI pumps start simultaneously with no time delay as soon as the standby source is available. The LPCI Pump Start -Time Delay Relays are assumed to be OPERABLE in the accident and transient analyses requiring ECCS initiation.

That is, the analyses assume that the pumps will initiate when required and excess loading will not cause failure of the power sources.

There are eight LPCI Pump Start-Time Delay Relays, two in each of the RHR pump start logic circuits. Two time delay relays are dedicated to a single pump start logic. Both timers in the RHR pump start logic would have to fail to prevent an RHR pump from starting within the required time; therefore, the low pressure ECCS pumps will remain OPERABLE; thus, the single failure criterion is met (i.e., loss of one instrument does not preclude ECCS initiation). The Allowable Values for the LPCI Pump Start-Time Delay Relays are chosen to be long enough so that most of the starting transient of the first pump is complete bef. ore starting the second pump on the same 4 kV emergency bus and short enough so that ECCS operation is not degraded.

Each channel of LPCI Pump Start-Time Delay Relay Function )

is required to be OPERABLE only when the associated LPCI i subsystem is required to be OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the LPCI subsystems.

(continued) l PBAPS UNIT 2 B 3.3-116 Revision No.

l l

ECCS Instrumentation i B 3.3.5.1 BASES i 1

APPLICABLE Hioh Pressure' Coolant Iniection-(HPCI) System 1 SAFETY ANALYSES,. ;

LCO, and 3.a. Reactor Vessel Water level-Low Low (Level 2) I APPLICABILITY .

i (continued) Low RPV water level indicates that the capability to cool 1'

-the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. . Therefore, the HPCI -l System is initiated at Level 2 to maintain level above the ,

top of the active fuel. The Reactor Vessel Water Level-Low . :

Low (Level 2) is one of the Functions' assumed to be OPERABLE.

and capable of initiating HPCI during the transients -l analyzed in References I and 3. Additionally, the Reactor l Vessel Water Level-Low Low (Level 2) Function associated J with HPCI is credited as a backup to the Drywell Pressure-High function for initiating HPCI in the analysis ;

of the recirculation line break. The core cooling function i of the ECCS, along with the scram action of the RPS, ensures !

that the fuel ~ peak cladding temperature remains below the l limits of 10 CFR 50.46. I Reactor Vessel Water Level-Low Low (Level 2) signals are initiated from four level transmitters that sense the >

, difference between'the pressure due to a. constant column of l water (reference leg) and the pressure due to the actual i water level (variable leg) in the vessel.

],

-The Reactor. Vessel Water level-Low Low (Level 2)- Allowable - l Value is high enough such that for complete loss of '

feedwater flow, the Reactor Core Isolation Cooling (RCIC)

' System flow with HPCI assumed to fail will be sufficient.to avoid initiation of low pressure ECCS at Reactor Vessel Water Level-Low Low Low (Level 1). i

~

Four channels of Reactor Vessel Water Level-Low Low (Level 2) Function are required to be OPERABLE only when HPCI is required to be OPERABLE to ensure that no single instrument failure can preclude HPCI initia. tion. Refer to LCO 3.5.1 for HPCI Applicability Bases.

3.b. Drvwell Pressure-Hiah High pressure in the drywell could indicate a break in the RCPB. The HPCI System is initiated upon receipt of the Drywell Pressure-High Function in order to minimize the possibility of fuel damage. The Drywell Pressure-High Function is directly. assumed in the analysis of the (continued)

PBAPS UNIT 2 B 3.3-117 Revision No.

, ECCS Instrumentation )

B 3.3.5.1 ,

t BASES- l APPLICABLE 3.b. Drywell Pressure-Hiah (continued)

SAFETY ANALYSES,. 3 LCO, and recirculation line break (Ref. 4). The core. cooling l APPLICABILITY function of the ECCS, along with.the scram action of the t RPS, ensures that the fuel peak cladding temperature remains !

below the limits of 10 CFR 50.46. j High drywell pressure signals are initiated from four !

pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible to be indicative of a LOCA inside primary containment. l 1

.Four channels of the Drywell Pressure-High Function are :

required to be OPERABLE when HPCI is required to be OPERABLE to ensure that no single instrument failure can preclude -

HPCI initiation. Refer to LCO 3.5.1 for the Applicability a Bases for the HPCI System. ]

3.c. Reactor Vessel Water level-Hiah (Level 8) )

High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal is used to trip the HPCI turbine' to prevent overflow into the main steam lines (MSLs). The Reactor Vessel Water Level-High (Level 8) Function is assumed to trip the HPCI turbine in the feedwater controller failure transient analysis if HPCI is initiated.

Reactor Vessel Water Level-High (Level 8) signals for HPCI are initiated from two level transmitters from the wide range water level measurement instrumentation. Both Level 8 signals are required in order to trip the HPCI turbine.

This ensures that no single instrument failure can preclude HPCI initiation. The Reactor Vessel Water Level-High (Level 8) Allowable Value is chosen to prevent flow from the HPCI System from overflowing into the MSLs.

Two channels of Reactor Vessel Water Level-High (Level 8)

Function are required to be OPERABLE only when HPCI is required to be OPERABLE. Refer to LC0 3.5.1 and LCO 3.5.2 for HPCI Applicability Bases.

(continued)

PBAPS UNIT 2 B 3.3-118 Revision No.

l ECCS Instrumentation i B 3.3.5.1 l l

BASES ,

I APPLICABLE 3.d. Condensate Storaae Tank level-Low SAFETY ANALYSES, LCO, and Low level in the CST indicates the unavailability of an ;

APPLICABILITY adequate supply of makeup water from this normal source. !

(continued) Normally the-suction valves between HPCI and the CST are open and, upon receiving a HPCI initiation signal, water for ,

HPCI injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, 4 first the suppression pool suction valves automatically I open, and then the CST suction valve automatically closes.

This ensures that an adequate supply of makeup water is available to the HPCI pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valves must be open before the CST suction valve automatically closes. The Function is implicitly assumed in the accident and transient analyses (which take credit for HPCI) since the analyses assume that the HPCI suction source is the suppression pool.

Condensate Storage Tank Level-Low signals are initiated from two level switches. The logic is arranged such that either level switch can cause the suppression pool suction valves to open and the CST suction valve to close. The Condensate Storage Tank Level-Low Function Allowable Value is high enough to ensure adequate pump suction head while j water is being taken from the CST. '

Two channels of the Condensate Storage Tank Level-Low Function are required to be OPERABLE only when HPCI is ;

required to be OPERABLE to ensure that no single instrument failure can preclude HPCI swap to suppression pool source.

Refer to LC0 3.5.1 for HPCI Applicability Bases.

3.e. Suporession Pool Water level-Hiah Excessively high suppression pool water could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the safety / relief valves. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of HPCI from the CST to the suppression pool to eliminate the possibility of HPCI continuing to provide additional water from a source outside containment. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valves r.ust

! be open before the CST suction valve automatically closes.

l l (continued)

PBAPS UNIT 2 B 3.3-119 Revision No.

l

ECCS Instrumentation B 3.3.5.1 l'

BASES l l r

APPLICABLE 3.e. Suooression Pool Water level-Hiah (continued)-

SAFETY ANALYSES, ,

LCO, and This function is implicitly assumed in the accident and ;

- APPLICABILITY transient analyses (which take credit for HPCI) since the !

analyses assume that the HPCI suction source is the suppression pool. i l Suppression Pool Water Level-High signals are initiated ,

! from two level switches. The logic is arranged such that !

! either switch can cause the suppression pool suction valves ,

L to open and the CST suction valve to close. The Allowable :

L Value for the Suppression Pool Water Level-High Function is l

. chosen to ensure that HPCI will be aligned for suction from ,

[ the suppression pool to prevent'HPCI from contributing to ,

j any further increase in the suppression pool level. i l-Two channels of Suppression Pool Water Level-High Function 1 are required to be 0PERABLE only when HPCI is required to be

~

l OPERABLE to ensure that no single instrument failure can l' preclude HPCI swap to suppression pool source. Refer to LCO 3.5.1 for HPCI Applicability Bases.

i 3.f. Hioh Pressure Coolant in.iection Pumo Discharae !

Flow-low (Bvoass)

( The minimum flow instrument is provided to protect the HPCI i pump from overheating when the pump is operating at reduced flow. The minimum flow line valve is opened when low flow is sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump. The High )

Pressure Coolant Injection Pump Discharge Flow-Low Function !

is assumed to be OPERABLE and capable of closing the minimum l flow valve to ensure that the ECCS flow assumed during the transients analyzed in Reference 4 is met. The core cooling function of the ECCS, along with the scram action of the L RPS, ensures that the fuel peak cladding temperature remains

below the limits of 10 CFR 50.46.

One flow switch is used to detect the HPCI System's flow

l. rate. The logic is arranged such that the transmitter

!- causes the minimum flow valve to open. The logic will close the minimum flow valve once the closure setpoint is

' exceeded.

(continued) 8 i

PBAPS UNIT 2 B 3.3-120 Revision No.

l

i

' l ECCS Instrumentation i B 3.3.5.1 !

BASES l

i APPLICABLE 3.f. Hiah Pressure Coolint iniection Pumo Discharae I SAFETY ANALYSES, Flow-low (Byoass) (continued)

LCO, and '

APPLICABILITY The High Pressure Coolant Injection Pump Discharge Flow-Low l Allowable Value is high enough to ensure that pump flow rate l is sufficient to protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to I allow full flow into the core.

One channel is required to be OPERABLE when the HPCI is l required to be OPERABLE. Refer to LCO 3.5.1 for HPCI Applicability Bases.

Automatic Deoressurization System 4.a. 5.a. Reactor Vessel Water level-low low low (Level.1) ;

Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, ADS receives !

one of the signals necessary for initiation from this Function. The Reactor Vessel Water Level-Low Low Low (Level 1) is one of the Functions assumed to be OPERABLE and I capable of initiating the ADS during the accident analyzed i in Reference 4. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of i 10 CFR 50.46.

1 Reactor Vessel Water Level-Low Low Low (Level 1) signals i are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low (Level 1) Function are required to be OPERABLE only when ADS i.s required to be OPERABLE to ensure that no single instrument failure can !

preclude ADS initiation. Two channels input to ADS trip l system A, while the other two channels input to ADS trip i system B. Refer to LC0 3.5.1 for ADS Applicability Bases.

The Reactor Vessel Water Level-Low Low Low (Level 1)

Allowable Value is chosen to allow time for the low pressure core flooding systems to initiate and provide adequate I

cooling. ,

(continued)

PBAPS UNIT 2 B 3.3-121 Revision No.

l

. - . . ~ - - - .. - _ _ - - _ . . - - - .. . . . . -

ECCS Instrumentation B 3.3.5.1 BASES t APPLICABLE 4.b. 5.b. Drywell Pressure-Hiah SAFETY ANALYSES, LCO, and High pressure in the drywell could indicate a break in the '

APPLICABILITY RCPB. Therefore, ADS receives one of the signals necessary (continued) for initiation from this Function in order to minimize the '

possibility of fuel damage. The Drywell Pressure-High is assumed to be OPERABLE and capable of initiating the ADS during the accidents analyzed in Reference 4. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature :

remains below the limits of 10 CFR 50.46. ;

Drywell Pressure-High signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.

Four channels of Drywell Pressure-High Function are only required to be OPERABLE when ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. Two channels input to ADS trip system A, while the other two channels input to ADS trip system B. Refer to LC0 3.5.1 for ADS Applicability Bases.

4.c. 5.c. Automatic Deoressurization System Initiation ILAC The purpose of the Automatic Depressurization System ,

Initiation Timer is to delay depressurization of the reactor vessel to allow the HPCI System time to maintain reactor vessel water level. Since the rapid depressurization caused by ADS operation is one of the most severe transients on the reactor vessel, its occurrence should be limited. By delaying initiation of the ADS Function, the operator is given the chance to monitor the success or failure of the HPCI System to maintain water level, and then to decide whether or not to allow ADS to initiate, to delay initiation l further by recycling the timer, or to inhibit initiation permanently. The Automatic Depressurization System

! Initiation Timer Function is assumed to be OPERABLE for the accident analysis of Reference 4 that requires ECCS initiation and assumes failure of the HPCI System.

(continued)

PBAPS UNIT 2 B 3.3-122 Revision No.

4 i

~ _ - _ _ _ _ . _ _ _ _ . . , ._ . _ _ . _ _ _ _ . . _ _ _ _

ECCS Instrumentation ,

B 3.3.5.1 l BASES APPLICABLE 4.c. 5.c. Automatic Deoressurization System Initiation l

SAFETY ANALYSES, Timer (continued)' i LCO, and ;

APPLICABILITY There are two Automatic Depressurization System Initiation l Timer relays, one in each of the two ADS trip systems. The Allowable Value for the Automatic Depressurization System Initiation Timer is chosen so that there is still time after depressurization-for the low pressure ECCS subsystems to provide adequate core cooling.

Two channels of the Automatic Depressurization System Initiation Timer Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no 4

single instrument failure can preclude ADS initiation. One channel inputs to ADS trip system A, while the other channel

' inputs to ADS trip system B. Refer to LC0 3.5.1 for ADS Applicability Bases.

4.d. 5.d. Reactor Vessel Water level- low low low (level 1) (Permissive)

Low reactor water level signals are used as permissives in the ADS trip systems. This ensures after a high drywell pressure signal or a low reactor water level signal (Level 1) is received and the timer times out that a low reactor water level (Level 1), signal is present to allow the ADS initiation (after a confirmatory Level 4 signal, see

. Bases for Functions 4.e, 5.e, Reactor' Vessel Water Confirmatory Level-Low (Level 4).

Reactor Vessel Water Level-Low Low Low (Level 1), signals are initiated from four level transmitters that sense the i difference between the pressure due to a constant column of water (reference leg) and the pressure doe to the actual water level (variable leg) in the vessel. The Reactor i Vessel Water Level-Low Low Low (Level 1) Allowable Value is !

chosen to allow time for the low pressure core flooding system to initiate and provide adequate cooling.

Four channels of the Reactor Vessel Water Level-Low Low Low (Level 1) Function are required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. Two channels input to ADS trip system A while the other two channels input to ADS trip system B. Refer to '

Lr0 3.5.1 for ADS Applicability Bases.

(continuegl PBAPS UNIT 2 B 3.3-123 Revision No.

ECCS Instrumentation ]

B 3.3.5.1 {

BASES APPLICABLE 4.e. 5.e. Reactor Vessel Water Confirmatory Level-Low l

-SAFETY ANALYSES, (Level 4) '

LCO, and :

APPLICABILITY The Reactor Vessel Water Confirmatory Level-Low (Level 4) ;

(continued) Function is used by the ADS only as a confirmatory low water level Signal. ADS receives one of the signals necessary for '

initir. tion.from Reactor Vessel Water Level-Low Low Low i (Leve? 1) signals. In order to prevent spurious initiation of the ADS due to spurious Level 1 signals, a Level 4 signal must also be received before ADS initiation commences. l l

4 Reactor Vessel Water Confirmatory Level-Low (Level 4) !

signals are initiated.from two level transmitters that sense !

the difference between the pressure due to a constant column !

of water (reference leg) and the pressure due to the actual ;

water level (variable leg) in the vessel. The Allowable t Value for Reactor Vessel Water Confirmatory Level-Low (Level 4) is selected to be above.the RPS Level 3 scram Allowable Value for convenience. ;

Two channels of Reactor Vessel Water Confirmatory Level-Low l (Level 4) Function are only required to be OPERABLE when the l ADS is required to be OPERABLE to ensure that no single l instrument failure can preclude ADS initiation. One channel ;

inputs to ADS trip system A, while the other channel inputs i to ADS trip system B. Refer to LC0 3.5.1 for ADS :

Applicability Bases. ;

4 f. 4.a. 5.f. 5.a.

. Core Sorav and low Pressure Coolant i Iniection Pumo Discharae Pressure-Hiah [

The Pump Discharge Pressure-High signals from the CS and i LPCI pumps are used as permissives for ADS initiation, indicating that there is.a source of low pressure cooling water available once the ADS has depressurized the vessel. ,

Pump Discharge Pressure-High is one of the Functions assumed to be OPERABLE and. capable of permitting ADS initiation during the events analyzed in Reference 4 with an assumed HPCI failure. For these events the ADS depressurizes the reactor vessel so that the low pressure ECCS can perform the core cooling functions. This core ,

cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. l 1r (continued) F i

4

i PBAPS UNIT 2 B 3.3-124 Revision No.

ECCS Instrumentation l B 3.3.5.1 '

BASES APPLICABLE 4. f. 4.0. 5.f. 5.a. Core Sorav and Low Pressure Coolant !

SAFETY ANALYSES, Iniection Pumo Discharae Pressure-Hiah (continued)

LCO, and APPLICABILITY Pump discharge pressure signals are initiated from twelve pressure transmitters, two on the discharge side of each of j the four LPCI pumps and one on the discharge side of each CS :

pump. There are two ADS low pressure ECCS pump permissives 1 in each trip system. Each of the permissives receives inputs from all four LPCI pumps (different signals for each permissive) and two CS pumps, one from each subsystem (different pumps for each permissive). In order to generate an ADS permissive in one trip system, it is necessary that only one LPCI pump or two CS pumps in proper combination (C or D and A or B) indicate the high discharge pressure condition in each of the two permissives. The Pump Discharge Pressure-High Allowable Value is less than the ;

pump discharge pressure when the pump is operating in a full i flow mode and high enough to avoid any condition that ;

results in a discharge pressure permissive when the CS and )

LPCI pumps are aligned for injection and the pumps are not i running. The actual operating point of this function is not ;

assumed in any transient or accident analysis. However, I this Function is indirectly assumed to operate (in Reference

4) to provide the ADS permissive to depressurize the RCS to allow the ECCS low pressure systems to operate.

Twelve channels of Core Spray and Low Pressure Coolant Injection Pump Discharge Pressure-High Function are only required to be OPERABLE when the ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. Four CS channels associated with CS pumps A through 0 and eight LPCI channels associated with LPCI pumps A through D are required for both trip systems.

Refer to LC0 3.5.1 for ADS Applicability Bases.

4.h. 5.h. Automatic Deoressurization System low Water level Actuation Timer One of the signals required for ADS initiation is Drywell Pressure-High. However, if the event requiring ADS initiation occurs outside the drywell (e.g., main steam line break outside containment), a high drywell pressure signal may never be present. Therefore, the Automatic Depressurization System Low Water Level Actuation Timer is used to bypass the Drywell Pressure-High FunctSn after a (continued)

PBAPS UNIT 2 B 3.3-125 Revision No.

L -

g ECCS Instrumentation B 3.3.5.1 l l

l l BASES l l

l APPLICABLE - 4.h. 5.h. Automatic Deoressurization System low Water Level !

SAFETY ANALYSES, actuation Timer -(continued)

L LCO, and APPLICABILITY certain time period has elapsed. Operation of the Automatic !

l Depressurization System Low Water Level Actuation Timer l l Function is assumed in the accident analysis of Reference 4 :

l that requires ECCS initiation and assumes failure of the !

HPCI system. j

.- There are four Automatic Depressurization System Low Water !

l Level Actuation Timer relays, two in each of the two ADS i l trip systems. The Allowable Value for the Automatic i l Depressurization System Low Water Level Actuation Timer is chosen to ensure that there is still time after depressurization for the low pressure ECCS subsystems to provide adequate core cooling. ;

l-Four channels of the Automatic Depressurization System Low !

Water Level Actuation Timer Function are only required to be l OPERABLE when the ADS is required to be OPERABLE to ensure ,

that no single instrument failure can preclude ADS )

initiation. Refer to LC0 3.5.1 for ADS Applicability Bases.

ACTIONS A Note has been provided to modify the ACTIONS related to ECCS instrumentation channels. Section 1.3, Completion ;

Times, specifies that once a Condition has been entered, I l subsequent divisions, subsystems, components, or variables !

expressed in the Condition. discovered to be inoperable or-not within limits will not result in separate entry into the ,

Condition. Section 1.3 also specifies that Required Actions !

, of the Condition continue to apply for each additional ;

failure, with Completion Times based on initial entry into -

the Condition. However, the Required Actions for inoperable ECCS instrumentation channels provide appropriate compensatory measures for separate inoperable Condition L

entry for each inoperable ECCS instrumentation channel.

Ad i

Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.1-1. The applicable Condition referenced in the table is Function dependent. <

Each time a channel.is discovered inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

(continued)

PBAPS UNIT 2 B 3.3-126 Revision No.

l' ;

L

ECCS Instrumentation B 3.3.5.1 BASES- i l

l

' ACTIONS B.I. B.2. and B.3 l (continued) l Required Actions B.1 and B.2 are intended to ensure that I appropriate actions are taken if multiple, inoperable, i

< untripped channels within the same Function result in j L redundant automatic initiation capability being lost for the 4 L feature (s). Required Action B.1 features would be those

-that are initiated by Functions 1.a, 1.b, 2.a, and 2.b ,

(e.g., low pressure ECCS). The Required Action B.2 system !

would be HPCI. For Required Action B.1, redundant automatic initiation capability is lost if (a) two or more Function 1.a channels are inoperable and untripped such that I both trip systems lose initiation capability, (b) two or i more Function 2.a channels are inoperable and untripped such ,

i that both trip' systems lose initiation capability, (c) two 1 or more Function 1.b channels are inoperable and untripped ]

such that both trip systems lose initiation capability, or ;

l- (d) two or more Function 2.b channels are inoperable and {

l untripped such that both trip systems lose initiation l capability. For low pressure ECCS, since each inoperable i L channel would have Required Action B.1 applied separately j (refer to ACTIONS Note), each inoperable channel would only !

L require the affected portion of the associated system of low i pressure ECCS and'DGs to be declared inoperable. However, L

since channels in both associated low pressure ECCS subsystems (e.g., both CS subsystems) are inoperable and )

untripped, and the Completion Times started concurrently for ,

the channels in both subsystems, this results in the 1 affected portions in the associated low pressure ECCS and ,

l DGs being concurrently declared inoperable.

For Required' Action B.2, redundant automatic HPCI initiation capability is lost if two or more Function 3.a or two Function 3.b channels are inoperable and untripped such that l- the trip system loses initiation capability. In this L situation (loss of redundant automatic initiation

capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.3 is

! not appropriate and the HPCI System must be declared l inoperable within I hour. As noted (Note 1 to Required l Action B.1), Required Action B.1 is only applicable in MODES 1, 2, and 3. In MODES 4 and 5, the specific initiation time of the low pressure ECCS is not assumed and the probability of a LOCA is lower. Thus, a total loss of L (continued) i 4

PBAPS UNIT 2 B 3.3-127 Revision No.

l i

i I

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1. B.2. and B.3' (continued) initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action B.3) is' allowed during MODES 4 and 5. .There is no similar Note provided for Required Action B.2 since HPCI instrumentation is not required in MODES 4 and 5; thus, a Note is not necessary.

Notes' are~ also provided (Note 2 to Required Action B.1 and the Note to Required Action B.2) to delineate which Required Action is applicable for each Function'that requires entry into Condition B if an associated channel ~ is inoperable.

This ensures that the proper loss of initiation capability check is performed. Required Action B.1 (the Required Action for certain inoperable channels in the low pressure ECCS subsystems) is not applicable to Function 2.e, since.

this Function provides backup to administrative controls ensuring that operators do not divert LPCI flow from injecting into the core when needed. Thus, a total ' loss of Function 2.e capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed, since the LPCI subsystems remain capable of performira their intended function.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal

" time zero" for beginning the allowed outage time " clock."

For Required Action B.1, the Completion Time only begins upon discovery that a redundant feature in the same system i (e.g., both CS . subsystems) cannot be automatically initiated l due to inoperable, untripped channels within the same Function as described in the paragraph above. For Required' Action B.2, the Completion Time only begins upon discovery that the HPCI System cannot be' automatically initiated due ;

to two inoperable, untripped channels for the associated j Function in the same trip system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion ;

Time from discovery of loss of initiation capability is acceptable because it minimizes risk while' allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an ,

allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to 1 I

be' acceptable (Ref. 5) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the (continued)

PBAPS UNIT 2 8 3.3-128 Revision No.

__~ -

l l

ECCS Instrumentation B 3.3.5.1

' BASES

. ACTIONS B.1. B.2. and B.3 (continued) allowable out of service time, the channel must be placed in the tripped condition per Required Action B.3. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition H must be entered and its Required Action taken.

C.1 and C.2 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Function result in redundant automatic initiation capability being lost for the feature (s). Required Action C.1 features would be those that are initiated by Functions 1.c, 1.e, 1.f, 2.c, 2.d, and 2.f (i.e., low pressure ECCS). Redundant automatic initiation capability is lost if either (a) two or more Function 1.c channels are inoperable in the same trip system such that the trip system loses initiation capability, (b)..two or more Function 1.e channels are inoperable affecting CS pumps in different-subsystems, (c) two or more Function 1.f channels are inoperable affecting CS pumps in different subsystems, (d) two or more Function 2.c channels are inoperable in the same trip system such that the trip system loses initiation capability, (e) two or more. Function'2.d channels are inoperable in the same trip system such that the trip system loses-initiation capability, or (f) three or more Function 2.f channels are inoperable. In this situation (loss of redundant automatic initiation capability), the.

24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action C.2 is not appropriate and the feature (s) associated with the inoperable channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Since each inoperable channel would have Required Action C.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated system to be declared inoperable. However, since channels for both low pressure ECCS subsystems are inoperable (e.g.,

both CS subsystems), and the Completion Time' started concurrently for the channels in both subsyst. ins, this results in the affected portions in both subsystems being (continued)

PBAPS UNIT 2. B 3.3-129 Revision No.

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS C.1 and C.2 (continued) concurrently declared inoperable. For Functions 1.c, 1.e, 1.f, 2.c, 2.d, and 2.f, the affected portions are the associated low pressure ECCS pumps. As noted (Note 1),

Required Action C.1 is only applicable in MODES 1, 2, and 3.

In H0 DES 4 and 5, the specific initiation time of the ECCS is not assumed and the probability of a LOCA is lower.

Thus, a total loss of automatic initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action C.2) is allowed during MODES 4 and 5.

Note 2 states that Required Action C.1 is only applicable for Functions 1.c,1.e,1.f, 2.c, 2.d, and 2.f. Required Action C.1 is not applicable to Function 3.c (which also requires entry into this Condition if a channel in this Function is inoperable), sirce the loss of one channel results in a loss of +he r .tet ton (two-out-of-two logic).

This loss was conside d duri.ig the development of Reference 5 and consiv.M scceptable for the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed by Required Action C.2.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal

" time zero" for beginning the allowed outage time " clock."

For Required Action C.1, the Completion Time only begins upon discovery that the same feature in both subsystems (e.g., both CS subsystems) cannot be automatically initiated due to inoperable channels within the same Function as described in the paragraph above. The I hour Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of th.e ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 5) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition H must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would either cause the initiation or it would not necessarily result in a safe state for the channel in all events.

(continued)

PBAPS UNIT 2 B 3.3-130 Revision No.

ECCS Instrumentation !

B 3.3.5.1 BASES ACTIONS D.1. D.2.1. and 0.2.2 (continued)

Required Action D.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic component initiation capability for the HPCI System. Automatic component initiation capability is lost if two Function 3.d channels or two Function 3.e channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Actions D.2.1 and D.2.2 is not appropriate and the HPCI System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of HPCI initiation capability. As noted, Required Action D.1 is only applicable if the HPCI pump suction is not aligned to the suppression pool, since, if aligned, the Function is already performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal

" time zero" for beginning the allowed outage time " clock."

For Required Action D.1, the Completion Time only begins upon discovery that the HPCI System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 5) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1 or the suction source must be aligned to the suppr~ession pool per Required Action 0.2.2. Placing the inoperable channel in trip performs the intended function of the channel (shifting the suction source to the suppression pool). Performance of either of these two Required Actions will allow operation to continue. If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the HPCI System (continued)

PBAPS UNIT 2 B 3.3-131 Revision No, l - -

i ECCS instrumentation B 3.3.5.1 BASES ACTIONS D.1. D.2.1. and D.2.2 (continued) piping remains filled with water. Alternately, if it is not desired to perform Required Actions D.2.1 and D.2.2 (e.g.,

as in the case where shifting the suction source could drain down the HPCI suction piping), Condition H must be entered and its Required Action taken.

E.1 and E.2 Required Action E.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the Core Spray and Low Pressure Coolant Injection Pump, Discharge Flow - Low (Bypass) Functions result in redundant automatic initiation capability being lost for the feature (s). For Required Action E.1, the features would be those that are initiated by Functions 1.d and 2.g (e.g., low pressure ECCS). Redundant automatic initiation capability.

is lost if (a) two or more Function 1.d channels are inoperable affecting CS pumps in different subsystems or (b) three or more Function 2.g channels are inoperable.

Since each inoperable channel would have Required Action E.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected low pressure ECCS pump to be declared inoperable. However, since channels for more than one low pressure ECCS pump are inoperable, and the Completion Times started concurrently for the channels of the low pressure ECCS pumps, this results in the affected low pressure ECCS pumps being concurrently declared inoperable.

In this situation (loss of redundant automatic initiation capability), the 7 day allowance of Required Action E.2 is not appropriate and the subsystem associated with each inoperable channel must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . As noted (Note 1 to Required Action E.1), Required Action E.1 is only applicable in MODES 1, 2, and 3. In MODES 4 and 5, the specific initiation time of the ECCS is not assumed and the probability of a LOCA is lower. Thus, a total loss of initiation capability for 7 days (as allowed by Required Action E.2) is allowed during MODES 4 and 5. A Note is also provided (Note 2 to Required Action E.1) to delineate that Required Action E.1 is only applicable to low (continued)

PBAPS UNIT 2 B 3.3-132 Revision No.

i ECCS instrumentation B 3.3.5.1 BASES ACTIONS E.1 and E.2 (continued) pressure ECCS Functions. Required Action E.1 is not !

applicable to HPCI Function 3.f since the loss of one channel results in a loss of function (one-out-of-one i logic). This loss was considered during the development of ;

Reference 5 and considered acceptable for the 7 days allowed i by Required Action E.2. !

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This <

Completion Time also allows for an exception to the normal

" time zero" for beginning the allowed outage time " clock."

For Required Action E.1, the Completion Time only begins upon discovery that a redundant feature in the same system (e.g., both CS subsystems) cannot be automatically initiated l due to inoperable channels within the same Function as '

described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

If the instrumentation that controls the pump minimum flow valve is inoperable, such that the valve will not automatically open, extended pump operation with no injection path available could lead to pump overheating and failure. If there were a failure of the instrumentation, such that the valve would not automatically close, a portion of the pump flow could be diverted from the reactor vessel injection path, causing insufficient core cooling. These consequences can be averted by the operator's manual control of the valve, which would be adequate to maintain ECCS pump protection and required flow. Furthermore, other ECCS pumps would be sufficient to complete the assumed safety function if no additional single failure were to occur. The 7 day 1 Completion Time of Required Action E.2 to r.estore the l inoperable channel to OPERABLE status is reasonable based on i the remaining capability of the associated ECCS subsystems, the redundancy available in the ECCS design, and the low probability of a DBA occurring during the allowed out of service time. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition H must be entered and its Required Action taken.

The Requi*ed Actions do not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.

(continued)

PBAPS UNIT 2 B 3.3-133 Revision No.

ECCS Instrumentation l B 3.3.5.1 ;

-- l BASES !

I ACTIONS F.1 and F.2 I (continued) .

l Required Action F.1.is intended to ensure that appropriate 1 actions are taken if multiple, inoperable,- untripped channels.within similar ADS trip system A and B Functions ,

result in redundant automatic initiation capability being i lost for the ADS. Redundant automatic initiation capability 1 is lost if either (a) one or more Function 4.a channel and ;

one or more Function 5.a channel are inoperable and 1 untripped, (b) one or more Function .4.b channel and one'or 1 more Function 5.b channel are inoperable and untripped, j (c) one or.more Function 4.d channel-and one or more j Function 5.d channel are inoperable and untripped, or (d) ,

one Function 4.e channel and one Function 5.e channel are j inoperable and untripped. '

In this situation (loss of automatic initiation capability), ;

the 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 day allowance, as applicable, of Required i Action F.2 is not appropriate and all ADS valves must be !

declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of j ADS initiation capability. '

The Complei. ion Time is intended to allow the operator time i to evaluate and repair any discovered inoperabilities. This .

Completion Time also allows for an exception to the normal

" time zero" for beginning the allowed outage time " clock." l For Required Action F.1, the Completion Time only begins :

upon' discovery that the ADS cannot be automatically ,

initiated due to inoperable, untripped channels within i similar ADS trip system Functions as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery -

of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or :

tripping of channels. !

Because of the diversity of sensors available to provide ;

initiation signals and the redundancy of the ECCS design, an t allowable out of service time of 8 days has been shown to be '

acceptable (Ref. 5) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are OPERABLE. If either HPCI or RCIC is inoperable, the time is i shortened to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months . If the status of HPCI or RCIC i

- changes such that the Completion Time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability. However, the tote.1 time for an inoperable, untripped channel cannot exceed 8 days. If the status of

(continued)

PBAPS UNIT 2 B 3.3-134 Revision No.

-r , e *,,- %-y--we -- +-,w

ECCS Instrumentation I B 3.3.5.1

i i

BASES '

ACTIONS- . F.1 and F.2 (continued) i HPCI or RCIC changes such that the Completion Time changes from.96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the " time zero" for beginning the 8 day " clock" begins upon discovery of the inoperable, untripped channel. If.the inoperable channel cannot be :

restored to OPERABLE status within the allowable out of '

- service time, the channel must be placed in the tripped condition per Required Action F.2. Placing the inoperable .

channel in trip would conservatively compensate for the !

inoperability, restore capability to accommodate a single :

failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in !

the case where placing the inoperable channel in trip would ,

result in an initiation), Condition H must be entered and its Required Action taken.

l l

G.1 and G.2 i Required Action G.1 is intended to ensure that appropriate ,

actions are taken if multiple, inoperable channels within j similar ADS trip system Functions result in automatic l initiation capability being lost for the ADS. Automatic initiation capability is lost if either (a) one Function 4.c channel and one Function 5.c channel are inoperable, (b) a ;

combination of Function 4.f, 4.g, 5.f, and 5.g channels are ;

inoperable such that channels associated with five or more l low pressure ECLS pumps are inoperable, or (c) one or more Function 4.h channels and one or more Function 5.h channels are inoperable.

In this situation (loss of automatic initiation capability),

the 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 day allowance, as applicable, of Required Action G.2 is not appropri ee, and all ADS valves must be declared inoperable within I hour after discovery of loss of ADS initiation capability. Toe Note to Required Action G.1 states that Required Action G.1 is only applicable for Functions 4.c, 4.f, 4.g, 4.h, 5.c, 5.f, 5.g, and 5.h.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This i Completion Time also allows for an exception to the normal !

" time zero" for beginning the allowed outage time " clock."

For Required Action G.1, the Completion Time only begirs (continued) i l

PBAPS UNIT 2 B 3.3-135 Revision No.

.e m . - + + --m.e.., ,e ---w- ar..*

M ECCS Instrumentation B 3.3.5.1 .

BASES ACTIONS G.1 and G.2 (continued) upon discovery that the ADS cannot be automatically '

initiated due to inoperable channels within similar ADS trip system Functions as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptahle because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an i allowable out.of service time of 8 days has been shown to be acceptable (Ref. 5) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are ;

OPERABLE (Required Action G.2). If either HPCI or RCIC is inoperable, the time shortens to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months . If the status of HPCI or RCIC changes such that the Completion Time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability. However, the total time for an inoperable channel cannot exceed 8 days. If the status ;

of HPCI or RCIC changes such that the Completion Time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the " time zero" for beginning the 8 day " clock" begins upon discovery of the !

inoperable channel. If the inoperable channel cannot be l restored to OPERABLE status within the allowable out of l service time, Condition H must be entered and its Required i Action taken. The Required Actions do not allow placing the I channel in trip since this action would not necessarily I result in a safe state for the channel in all events.

lid With any Required Action and associated Completion Time not met, the associated feature (s) may be incapable of performing the intended function, and the supported feature (s) associated with inoperable untripped channels must be declared inoperable immediately.

(continued) i 4

PBAPS UNIT 2' B 3.3-136 Revision No.

ECCS Instrumentation !

B 3.3.5.1 ,

BASES (continued)

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each ECCS l REQUIREMENTS instrumentation Function are found in the SRs column of i Table 3.3.5.1-1. :

The Surveillences are modified by a Note to indicate that t when a channel is placed in an inoperable status solely for !

performance of required Surveillances, entry into associated t Conditions and Required Actions may be delayed for up to ;

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months as follows: (a) for Functions 3.c and 3.f; and .

(b) for Functions other than 3.c and 3.f provided the l

. associated Function or the redundant Function maintains ECCS !

initiation capability. Upon completion of the Surveillance, i

or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition ,

entered and Requireri Actions taken. This Note is based on ;

- the reliability analysis (Ref. 5) assumption of the average l

!. time required to perform channel surveillance. That !

analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does r not significantly reduce the probability that the ECCS will ,

initiate when necessary. i SR 3.3.5.1.1 i Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A ,

CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other ,

channels. It is based on the assumption that instrument channels monitoring the same parameter should read ;

approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK guarantees that undetected outright channel failure is limited to ;

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; thus, it is key to verifying the instrumentation '

continues to operate properly between each CHANNEL CALIBRATION. !

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

(continued) l PBAPS UNIT 2 8 3.3-137 Revision No.

T yfet7y y -r e+y-y-+- *w 4+ ,e-g- y et+= 3--P -- - "

l ECCS Instrumentation ;

B 3.3.5.1 . j BASES. '

SURVEILLANCE SR 3.3.5.1.1 .(continued)-

REQUIREMENTS f

The Frequency is based upon operating experience that i demonstrates channel failure is rare. The CHANNEL CHECK i

-supplements less formal, but more frequent, checks of i channels during normal operational use of the displays I associated with the channels required by the LCO. ;

SR 3.3.5.1.2

^

1 A CHANNEL FUNCTIONAL TEST is performed on each required '

channel to ensure that the entire channel will perform the '

intended function. Any setpoint adjustment shall' be 1 consistent with the assumptions of the current plant I specific setpoint methodology.

The Frequency of 92 days is based on the reliability analyses of Reference 5.

SR 3.3.5.1.3 and SR 3.3.5.1.4 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This' test verifies the channel responds to the measured parameter within the necessary

. range and accuracy. . CHANNEL CALIBRATION leaves the channel' adjusted to account for instrument drifts between successive calibrations, consistent with the assumptions of the current plant specific setpoint methodology.

The. 92 day Frequency of SR 3.3.5.1.3 -is conservathe with respect to the magnitude of equipment drift assumed in the setpoint analysis.

The Frequency of SR 3.3.5.1.4 is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

(continued) I i

I l

1 l

PBAPS UNIT 2 B 3.3-138 Revision No.

1 1

1 ECCS fnstrumentation B 3.3.5.1 -

BASES

)

l SURVEILLANCE SR 3.3.5.1.5 '

REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the '

OPERABILITY of the required initiation. logic for a specific channel. The system functional testing performed in.

LCO 3.5.1, LCO 3.5.2, LCO 3.8.1, and LC0 3.8.2 overlaps this Surveillance to complete testing of the assumed safety function.

While this Surveillance can be performed with the reactor at power for some of the Functions, operating experience has shown that these components will pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was found to be acceptable from a reliability l standpoint. ;

REFERENCES 1. UFSAR, Section 6.5. I 1

2. UFSAR, Section 7.4.

3. UFSAR, Chapter 14.

4. NEDC-32163-P, " Peach Bottom Atomic Power Station Units 2 and 3, SAFER /GESTR-LOCA, Loss-of-Coolant Accident Analysis," January 1993.

I'

5. NEDC-30936-P-A, "BWR Owners'_ Group Technical Specification Improvement Analyses for ECCS Actuation Instrumentation, Part 2," December 1988.

I 1

i PBAPS UNIT 2 B 3.3-139 Revision No.

l RCIC System Instrumentation ;

B 3.3.5.2 ,

i B 3.3 INSTRUMENTATION i

B 3.3.5.2 Reactor Core Isolation Cooling (RCIC) System Instrumentation l

-BASES

. BACKGROUND The purpose of the RCIC System instrumentation is to )

initiate actions to ensure adequate core cooling when the i reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feeduater System is insufficient or unavailable, such that RCIC System initiation occurs and maintains sufficient reactor water level such that an initiation of the low pressure Emergency Core Cooling Systems (ECCS) pumps does not occur. A more complete discussion of RCIC System operation is provided in the Bases of LCO 3.5.3, "RCIC System."

The RCIC System may be initiated by automatic means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low (Level 2). The variable is monitored by four transmitters that are connected to four pressure compensation instruments. The outputs of the pressure compensation instruments are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic arrangement. Once initiated, the RCIC logic seals:in and can be' reset by the operator only when the reactor vessel water level signals have cleared.

The RCIC test line isolation valve is closed on a RCIC initiation signal to allow full system flow and maintain j primary containment isolated in the event _RCIC is not i operating.

The RCIC System also monitors the water level in the I condensate storage tank (CST) since this is the initial !

source of water for RCIC operation. Reactor grade water in i the CST is the normal source. Upon receipt of a RCIC l initiation signal, the CST suction valve is automatically '

signaled to open (it is normally in the open position) unless the pump suction from the suppression pool valves is open. If the water level in the CST falls below a preselected -level, first the suppression pool suction valves automatically open, and then the CST suction valve automatically closes. Two level switches are used to detect i low water level'in the CST. Either switch can cause the suppression pool suction valves to open. The opening of the (continued)

PBAPS UNIT 2 B 3.3-140 Revision No.

i i

RCIC System Instrumentation l B 3.3.5.2 : l 1

l BASES l

.),

BACKGROUND suppression pool suction valves causes the CST suction valve (continued) to close. This prevents losing suction to the pump when )

automatically transferring suction from the CST to the ;

suppression pool on low CST level. '

The RCIC System provides makeup water to the reactor until l the reactor vessel water level reaches the high water level ;

(Level 8) satting (two-out-of-two logic), at which time the ,

RCIC steam supply valve closes. The RCIC System restarts.if :

vessel level again drops to the low level initiation point ,

(Level 2). l APPLICABLE The function of the RCIC System is to respond to transient SAFETY. ANALYSES, events by producing makeup coolant to the reactor. The RCIC 1 LCO, and System is not an Engineered Safeguard System and no credit '

APPLICABILITY is taken in the safety analyses for RCIC System operation.

Based on its contribution to the reduction of overall plant I risk, however, the system, and therefore its instrumentation i meets Criterion 4 of NRC Policy Statement.

.The OPERABILITY of the RCIC System instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in 1 Table 3.3.5.2-1. Each Function must have a required number '

of OPERABLE channels with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setting is not within its I required Allowable Value. The actual setpoint is calibrated '

consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each RCIC System instrumentation Function specified in the Table. Trip setpoints are specified in the setpoint calculations. The setpoints.are selected to ensure that the settings do not exceed the Allowable Value between CHANNEL CALIBRATIONS.

Operation with a trip setting less conservative than the trip setpoint, but within its~ Allowable Value, is acceptable. Each Allowable Value specified accounts for instrument uncertainties appropriate to the function. These uncertainties are described in the setpoint methodology. j l (continued)

V .

I i

PBAPS UNIT 2 B 3.3-141 Revision No.

l

,_ ~ ~- e += = '

RCIC System Instrumentation B 3.3.5.2 .

L :

i BASES I

APPLICABLE The individual Functions are required to be OPERABLE in ;

SAFETY ANALYSES, MODE 1,'and in MODES 2 and 3 with reactor steam dome ;

~LCO, and pressure > 150 psig since this is when RCIC is required to ,

APPLICABILITY be OPERABLE. (Refer to LCO 3.5.3 for Applicability Bases j (continued) for the RCIC System.)

The specific Applicable Safety Analyses, LCO, and ;

Applicability discussions are listed below on a Function by ;

Function basis.

l.

1. Reactor Vessel Water Level-low Low (Level 2)

-Low reactor pressure vessel (RPV) water level indicates that normal feedwater flow is insufficient to maintain reactor vessel water level and that the capability to cool the fuel !

may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the RCIC System is '

initiated at Level 2 to assist in maintaining water level above the top of the active fuel.

Reactor Vessel Water Level-Low Low (Level 2) signals are !

initiated from four level transmitters that sense the :

difference between the pressure due to a constant column of !

water (reference leg) and the pressure due to the actual

water level (variable leg) in the vessel.

The Reactor' Vessel Water Level-Low Low (Level 2) Allowable Value is set high enough such that for complete loss of feedwater flow, the'RCIC System flow with high pressure coolant injection assumed to fail will be sufficient to l avoid initiation of low pressure ECCS at Level 1.

Four channels of Reactor Vessel Water Level-Low Low (Level 2) Function are available and are required to be OPERABLE when RCIC.is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation.

Refer to LCO 3.5.3 for RCIC Applicability Bases.

(continued) l-I' l

i PBAPS UNIT 2 B 3.3-142 Revision No.

]

i i, . - , _ _ - , _

RCIC System Instrumentation l B 3.3.5.2 l BASES i

I l- APPLICABLE 2. Reactor Vessel Water Level-Hiah (Level 8) !

' SAFETY. ANALYSES, l

LCO, and High RPV water level indicates that sufficient cooling water l l APPLICABILITY inventory exists in the reactor vessel such that there is no l

,' (continued) danger to the fuel. Therefore, the Level 8 signal is used l to close the RCIC steam supply valve to prevent overflow j

into the main steam lines (MSLs).

I Reactor Vessel Water Level-High (Level 8) signals for RCIC are initiated from four level . transmitters,. which sense the i

difference between the pressure due to a constant column of i

, water (reference leg) and the pressure due to the actual '

i. water level (variable leg) in the vessel. These four level I

transmitters are connected to two pressure compensation ,

i instruments (channels). i L The Reactor Vessel Water Level-High (Level 8) Allowable r

Value'is high enough to preclude isolating the injection l l valve of the RCIC during normal operation, yet low enough to .

L trip the RCIC System prior to water overflowing into the 4 l MSLs.

l Two channels of Reactor Vessel Water Level-High (Level 8) l Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single

< instrument failure can preclude RCIC initiation. Refer to ,

l LCO 3.5.3 for RCIC Applicability Bases.

3. Condensate Storaae Tank level-Low l

Low level in the CST indicates the unavailability of an L adequate supply of makeup water from this normal source.

l. Normally, the suction valve between the RCIC pump and the CST is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the CST.

However, if the water level in the CST falls below a preselected level, first the suppression pool suction valves automatically open, and then the CST suction valve l- automatically closes. This ensures that an adequate supply of makeup water is available to the RCIC pump. To prevent losing suction to the pump, the suction valves are interlocked so that-the suppression pool suction valves must be 'open before the CST suction valve automatically closes.

(continued) i 1

PBAPS UNIT 2 B 3.3-143 Revision No. i I

I

RCIC System Instrumentation B 3.3.5.2 ,

BASES APPLICABLE 3. Condensate Storace Tank Level-low (continued)

SAFETY ANALYSES, LCO, and Two level switches are used to detect low water level in the APPLICABILITY CST. The Condensate Storage Tank Level-Low Function Allowable Value is set high enough to ensure adequate pump suction head while water is being taken from the CST.

Two channels of the CST l.evel-Low Function are available and are required to be CPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude.RCIC swap to suppression pool source. Refer to LC0 3.5.3 for RCIC Applicability Bases.

ACTIONS A Note has been provided to modify the ACTIONS related to RCIC System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RCIC System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RCIC System instrumentation channel.

A_d Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.2-1. The applicable Condition referenced in the Table is Function dependent.

Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

(continued)

PBAPS UNIT 2 B 3.3-144 Revision No.

RCIC System Instrumentation B 3.3.5.2 BASES ACTIONS B.1 and 8.2 (continued)

Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the RCIC System. In this case, automatic initiation capability is lost if two Function 1 channels in the same trip system are inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of RCIC initiation capability.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal

" time zero" for beginning the allowed outage time " clock."

For Required Action B.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically initiated due to two or more inoperable, untripped Reactor Vessel Water Level-Low Low (Level 2) channels such that the trip system loses initiation capability. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while l allowing time for restoration or tripping of channels. l Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. I) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.2. Placing the inoperable channel in trip would conservat.ively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

l Alternately, if it is not desired to place the channel in l trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition E must be entered and its Required Action taken.

, (continued)

PBAPS UNIT 2 B 3.3-145 Revis.on No.

RCIC System Instrum ntation B 3.3.5.2 BASES ACTIONS U (continued)

A risk based analysis was performed and determined that an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (Ref.1) is l acceptable to permit ' restoration of any inoperable channel to OPERABLE status (Required Action C.1). A Required Action (similar to Required Action B.1) limiting the all wable out of service time, if a loss of automatic RCIC initiation capability exists, is not required. This Condition applies to the Reactor Vessel Water Level-High (Level 8) Function whose logic is arranged such that any inoperable channel will result in.a loss of automatic RCIC initiation capability (closure of the RCIC steam supply-valve). As stated above, this loss of automatic RCIC initiation capability was analyzed and determined to be acceptable.

' The Required Action does not allow placing a channel in trip since this action would not necessarily result in a safe state for the channel in all events.

D.1. D.2.1. and 0.2.2 Required Action D.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in automatic component initiation capability being lost for the feature (s). For Required Action D.1, the RCIC System is the only associated feature. In this case, automatic initiation capability is lost if two Function 3 channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Actions D.2.1 and D.2.2 is only appropriate after Action D.1 has been

. performed. Action D.1 requires that the RCIC System be declared inoperable within I hour from discovery of loss of RCIC initiation capability. As noted, Required Action D.1 is only applicable if the RCIC pump suction is not aligned to the suppression pool since, if aligned,' the Function is i already performed. j (continued)

~PBAPS UNIT 2 B 3.3-146 Revision No.

RCIC System Instrumentation B 3.3.5.2 i

BASES ,

ACTIONS- D.I. D.2.1. and D.2.2 (continued)

The Completion Time is intended to allow the operator time !

to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal i

" time zero" for beginning the allowed outage time " clock." l

'For Required Action D.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically aligned to the suppression pool due to two. inoperable, untripped channels in the same Function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because the RCIC System is not assumed in any accident or-transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref.1) to permit restoration of any inoperable channel to OPERABLE status.

If the inoperable channel cannot be restored to OPERABLE l status within the allowable out of service time, the channel '

must be placed in the tripped condition per Required Action D.2.1, which performs the intended function of the channel. Alternatively, Required Action D.2.2 allows the manual alignment of the RCIC suction to the suppression !

pool, which also performs the intended function. If _

Required Action D.2.1.or D.2.2 is performed,-measures should be taken to ensure that the RCIC System piping remains filled with water. :If it is not desired to perform Required Actions D.2.1 and D.2.2 (e.g., as in the case where shifting the suction source could drain down the RCIC suction piping), Condition E must be entered and its Required Action taken.

L.1 With any Required Action and associated Completion Time not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

(continued) l.

[

o

.PBAPS UNIT 2- B 3.3-147 Revision No.

, - - ~ _ _ ,

RCIC System Instrumentation B 3.3.5.2 1

BASES (continued) l l

SDRVEILLANCE -As noted in the beginning of the SRs, the SRs for each RCIC REQUIREMENTS System instrumentation Function are found in the SRs column ;

of Table 3.3.5.2-1. l The Surveillances are modified by a Note to indicate that i when a channel is placed in an inoperable status solely for i performance of required Surveillances, entry into associated 1 Conditions and Required Actions may be delayed as follows-f (a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for-Function 2 and (b) for up to )

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for functions 1 and 3, provided the associated '!

Function maintains trip capability. Upon completion of the ;

Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the j channel must be returned to OPERABLE status or the :

applicable Condition entered and Required Actions taken. :

This Note is based on the reliability analysis (Ref.1) _ i assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RCIC will initiate when necessary. I SR 3.3.5.2.1 h

Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures !

that a gross failure of instrumentation has not occurred. A !

CHANNEL CHECK is normally a comparison of the parameter ;

indicated on one channel to a parameter on other similar ,

channels. It is based on the assumption that instrument channels monitoring the same parameter should read ;

approximately the same value. Significant deviations i between the instrument channels could be an indication of l excessive instrument drift in one of the channels or !

something even more serious. A CHANNEL CHECK will detect '

gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

(continued)

PBAPS UNIT 2 B 3.3-148 Revision No.

l l

l- .l L

l RCIC System Instrumentation B 3.3.5.2 ,

BASES

~ l l

l

' SURVEILLANCE SR 3.3.5.2.1 (continued)

REQUIREMENTS I o

The Frequency is based upon operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.5.2.2 )

A CHANNEL FUNCTIONAL. TEST is. performed on each required channel to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency'of 92 days is based on the reliability analysis of Reference 1.

l SR 3 3.5.2.3 l

l~ A CHANNEL CALIBRATION.is a complete check of the instrument loop and the sensor. This test' verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves;the channel adjusted to* account for instrument drifts between successive calibrations, consistent with the plant specific setpoint L methodology.

The Frequency of SR 3.3.5.2.3 is based upon the assumption

.of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

l l

SR 3.3.5.2.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.3 overlaps this Surveillance to provide complete testing of the safety function. i

i. (continued) i 4-

-PBAPS UNIT 2 B 3.3-149 Revision No. .

l- ,

l-

> w~.-

RCIC System Instrumentation B 3.3.5.2 ,

BASES SURVEILLANCE SR 3.3.5.2.4 (continued)

REQUIREMENTS While this Surveillance can be performed with the reactor at power for some of the Functions, operating experience has shown that these components will pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was found to be acceptable from a reliability standpoint.

REFERENCES 1. GENE-770-06-2, " Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected lastrumentation Technical Specifications," February 1991.

l l

i PBAPS UNIT 2 B 3.3-150 Revision No.

t l

! l Primary Containment isolation Instrumentation B 3.3.6.1

)

i 1

B 3.3 INSTRUMENTATION I B 3.3.6.1 Primary Containment Isolation Instrumentation j l

BASES BACKGROUND The primary containment isolation instrumentation I automatically initiates closure of appropriate primary containment isolation valves (PCIVs). The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs). Primary l containment isolation within the time limits specified for '

those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.

The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary (RCPB) isolation. Most channels include electronic l equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a primary containment isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logics are (a) reactor vessel water level, (b) reactor pressure, (c) main steam l line (MSL) flow measurement, (d) main steam line radiation, l (e) main steam line pressure, (f) drywell pressure, (g) high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) steam line flow, (h) HPCI and RCIC steam line pressure, (i) reactor water cleanup (RWCU) flow, (j) Standby Liquid Control (SLC) System initiation, (k) area ambient temperatures, (1) reactor building ventilation and refueling floor ventilation exhaust radiation, and (m) main stack radiation. Redundant sensor input signals from each parameter are provided for initiation of isolation.

Primary containment isolation instrumentation has inputs to the trip logic of the isolation functions listed below.

(continued) l 4

PBAoS UNIT 2 B 3.3-151 Revision No.

i

Primary Containment Isolation instrumentation 8 3.3.6.1 ,

BASES i

4 BACKGROUND 1. Main Steam Line Isolation (continued)

Most MSL Isolation Functions receive inputs from four channels. The outputs from these channels are combined in a one-out-of-two taken twice logic to initiate isolation of ,

the Group I isolation valves (MSIVs and MSL drains, MSL !

sample lines, and recirculation loop sample line valves). '

To initiate a Group I isolation, both trip systems must be tripped.

The exceptions to this arrangement are the Main Steam Line Flow-High Function and Main Steam Tunnel Temperature-High Functions. The Main Steam Line Flow-High Function uses 16 flow channels, four for each steam line. One channel-from each steam line inputs to one of the four trip strings.

Two trip strings make up each trip system and both trip systems must trip to cause an MSL isolation. Each trip string has four inpets (one per MSL), any one of which will ;

trip the trip string. The trip systems are arranged in a i one-out-of-two taken twice logic. This is effectively a one-out-of-eight taken twice logic arrangement to initiate a Group I isolation. The Main Steam Tunnel Temperature-High Function receives input from 16 channels. The logic is arranged similar to the Main Steam Line Flow-High Function except that high temperature on any channel is not related to a specific MSL. j

2. Primary Containment Isolation Most Primary Containment Isolation Functions receive inputs from four channels. The outputs from these channels are arranged in a one-out-of-two taken twice logic. Isolation of inboard and outboard primary containment istnation valves occurs when both trip systems are in trip.

The excaption to this arrangement is the Main Stack Monitor Radiation-High Function. This Function has two channels, whose outputs are arranged in two trip systems which use a one-out-of-one logic. Each trip system isolates one valve per associated penetration. The Main Stack Monitor Radiation-High Function will isolate vent and purge valves greater th~an two inches in diameter during containment purging (Ref. 2).

The valves isolated by each of the Primary Containment Isolation Functions are listed in Reference 1.

___ (continued)

PBAPS UNIT 2 B 3.3-152 Revision No.

)

Primary Containment Isolation Instrumentation B 3.3.6.1 '

l BASES BACKGROUND 3. 4. Hiah Pressure Coolant In.iection System Isolation and I (continued) Reactor Core Isolation Coolina System Isolation The Steam Line Flow-High Functions that isolate HPCI and RCIC receive input from two channels, with each channel comprising one trip system using a one-out-of-one logic.

Each of the two trip systems in each isolation group (HPCI and RCIC) is connected to the two valves on each associated penetration. Each HPCI and RCIC Steam Line Flow-High channel has a time delay relay to prevent isolation due to flow transients during startup.

The HPCI and RCIC Isolation Functions for Drywell Pressure-High and Steam Supply Line Pressure-Low receive inputs from four channels. The outputs from these channels are combined in a one-out-of-two taken twice logic to initiate isolation of the associated valves. l The HPCI and RCIC Compartment and Steam Line Area Temperature-High Functions receive input from 16 channels.

The logic is similar to the Main Steam Tunnel Temperature-High Function. l The HPCI and RCIC Steam Line Flow-High Functions, Steam Supply Line Pressure-Low Functions, and Compartment and Steam Line Area Temperature-High Functions isolate the associated steam supply and turbine exhaust valves and pump suction valves. The HPCI and RCIC Drywell Pressure-High Functions isolate the HPCI and hCIC test return line valves.

The HPCI and RCIC Drywell Pressure-High Functions, in conjunction with the Steam Supply Line Pressure-Low Functions, isolate the HPCI and RCIC turbine exhaust vacuum relief valves.

5. Reactor Water Cleanuo System Isolation The Reactor Vessel Water Level-Low (Level 3) Isolation Function receives input from four reactor vessel water level channels. The outputs from the reactor vessel water level channels are connected into a one-out-of-two taken twice logic which isolates both the inboard and outboard isolation valves. The RWCU Flow-High Function receives input from two channels, with each channel in one trip system using a one-out-of-one logic, with one channel tripping the inboard valve and one channel tripping the outboard valves. The SLC (continued)

PBAPS UNIT 2 B 3.3-153 Revision No.

l Primary Containment Isolation Instrumentation B 3.3.6.1 .

BASES BACKGROUND 5. Reactor Water Cleanuo System Isolation- (continued) l System Isolation Function receives input from two channels i with each channel in one trip system using a one-out-of-one logic. When either SLC pump.is started remotely, one channel trips the inboard isolation valve and one channel isolates the outboard isolation valves.

The RWCU. Isolation Function isolates the inboard and outboard RWCU pump suction penetration and the outboard

. valve at the RWCU connection to reactor feedwater.

6. Shutdown Coolina System Isolation The Reactor Vessel Water Level-Low (Level 3) Function

receives input from four reactor vessel water level' channels. The outputs from the channels are connected to a one-out-of-two taken twice logic, which isolates both valves I on the RHR. shutdown cooling pump suction penetration.- The 1 Reactor Pressure-High Function receives input from two channels, with each channel in one-trip system using a one-out-of-one logic. Each trip system is connected to both valves on the RHR shutdown cooling pump suction penetration.

7. Feedw'ater Recirculation Isolation The Reactor Pressure-High Function receives _ inputs from four channels. The outputs from the four channels are connected into ~a one-out-of-two taken twice logic which isolates the feedwater recirculation valves.

APPLICABLE The isolation signals generated by the primary containment SAFETY ANALYSES, isolation instrumentation are implicitly assumed in the LCO, and safety analyses of References 1 and 3 to initiate closure APPLICABILITY of valves to limit offsite doses. Refer to LCO 3.6.1.3,

" Primary Containment Isolation Valves (PCIVs)," Applicable Safety Analyses Bases for more detail of the safety analyses.

Primary containment isolation instrumentation satisfies !

Criterion 3 of the NRC Policy Statement. Certain instrumentation' Functions are retained for other reasons and '

are described below in the individual Functions discussion.

(continued)

PBAPS UNIT 2 B 3.3-154 Revision No.

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES:

APPLICABLE The OPERABILITY of the primary containment instrumentation !

SAFETY ANALYSES, is dependent on the OPERABILITY of the individual !

LCO, and instrumentation channel Functions specified in APPLICABILITY. . Table-3.3.6.1-1. Each Function must have a required number '

(continued) of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate.- A chrnnel-is inoperable if its actual trip setting is not within its !

required Allowable Value. The actual setpoint is calibrated !

consistent with applicable setpoint methodology assumptions. l Allowable Values, where applicable, are specified for each !

Primary Containment Isolation Function specified in the !

Table. Trip setpoints are specified in the setpoint !

calculations. The trip setpoints are selected.to ensure !

that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. , Operation with a trip setting less :'

conservative than the trip setpoint, but within its Allowable Value, is acceptab:e. Trip setpoints are those predetermined values of output at which an action should i

take place. The setpoints are compared to the actual- ;

process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter

- exceeds the setpoint, the associated device _(e.g., trip unit). changes state. The analytic or design limits are !

derived from the limiting values of the process parameters '

obtained from the safety analysis or other appropriate documents. The Allowable Values are derived from the analytic or design limits, corrected for calibration, I

. process, and instrument errors. The trip setpoints are l determined from analytical or design limits, corrected for calibration, process, and instrument errors, as well as, instrument drift. In selected cases, the Allowable Values and trip.setpoints are determined by engineering judgement or historically accepted practice relative to the intended L

function of the channel. The trip setpoints determined in this manner. provide adequate protection by assuring instrument and process uncertainties expected for the L.- environments during the operating time of the associated j L channels are accounted for. 1 l Certain Emergency Core Cooling Systems (ECCS) and RCIC

valves- (e.g., minimum flow) also serve-the dual function of l automatic PCIVs. The signals that isolate these valves are

, also associated with the automatic initiation of the ECCS L

(continued) i PBAPS UNIT 2 B 3.3-155- Revision No. I

~

-erLa.i-7 u -4 P--.--.A e '- - -

r*-P--'* *Y '+8* P " "'-'"-TF-

Primary Containment Isolation Instrumentation B 3.3.6.1 ;

~

BASES i

. APPLICABLE and RCIC. The instrumentation requirements and ACTIONS SAFETY ANALYSES, associated with these signals are addressed in LCO 3.3.5.1, LCO, and " Emergency Core Cooling Systems (ECCS) Instrumentation," and APPLICABILITY LC0 3.3.5.2, " Reactor Core Isolation Cooling (RCIC) System (continued) Instrumentation," and are not included in this LCO.

In general, the individual Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability fe.- LC0 3.6.1.1, " Primary Containment."

Functions that have different Applicabilities are discussed

, below in the individual Functions discussion.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Main Steam Line Isolation 1.a. Reactor Vessel Water level-low low low (Level 1)

Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be thraatened. Should RPV water level decrease too far, fuel dan.oge could result.

Therefore, isolation of the MSIVs and other interfaces with the reactor vessel occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level-Low Low Low (Level 1) Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals.

The Reactor Vessel Water Level-Low Low Low (Level 1)

Function associated with isolation is assumed in the analysis of the recirculation line break (Ref. 1). The isolation of the MSLs on Level 1 supports actions to ensure that offsite dose limits are not exceeded for a DBA.

Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water.(reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low (Level 1) Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

(continued)

PBAPS UNIT 2 B 3.3-156 Revision No.

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.a. Reactor Vessel Water level-Low low low (level 1)

SAFETY ANALYSES, (continued)

LCO, and.

-APPLICABILITY The Reactor Vessel Water Level-Low Low Low (Level 1)

Allowable value is chosen to be the same as the ECCS Level 1 Allowable Value-(LCO 3.3.5.1) to ensure that the MSLs isolate on a potential loss of coolant accident (LOCA) to prevent offsite doses from exceeding 10 CFR 100 limits.

This function isolates MSIVs, MSL drains, MSL sample lines and recirculation loop sample line valves.

1.b. Main Steam line Pressure-Low low MSL pressure indicates that there may be a problem with the turbine pressure regulation, which could result in a low reactor vessel water level condition and the RPV cooling down more than 100*F/hr if the pressure loss is allowed to continue. The Main Steam Line Pressure-Low Function is directly assumed in the analysis of the pressure regulator failure (Ref. 3). For this event, the closure of.the MSIVs ensures that the RPV temperature change limit (100*F/hr) is not reached. In. addition, this function supports actions to ensure that Safety Limit 2.1.1.1 is not exceeded. (This Function closes the MSIVs prior to pressure decreasing below 785 psig, which results in a scram due to MSIV closure, thus reducing reactor power to < 25% RTP.)

The MSL low pressure signals are initiated from four transmitters that are connected to the MSL header. The transmitters are arranged such that, even though physically separated from each other, each transmitter is able to detect low MSL pressure. Four channels of Main Steam Line Pressure-Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be high enough to prevent excessive RPV depressurization.

The Main Steam Line Pressure-Low Function is only required to be OPERABLE in MODE I since this is when the assumed transient can occur (Ref._1).

This Function isolates MSIVs, MSL drains, MSL sample lines and recirculation loop sample line valves.

(continued)

PBAPS UNIT 2 B 3.3-157 Revision No.

u

{

L .. ..

Primary Containment Isolation Instrumentation l B 3.3.6.1 BASES APPLICABLE 1.c. Main Steam Line Flow-Hiah SAFETY ANALYSES, LCO, and Main Steam Line Flow-High is provided to detect a break of APPLICABILITY the MSL and to initiate closure of the MSIVs. If the steam (continued) were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover. If the RPV water level decreases too far, fuel damage could occur. Therefore, the isolation is initiated on high flow to prevent or minimize core damage. The Main Steam Line Flow-High Function is directly assumed in the analysis of the main steam line break (MSLB) (Ref. 3). The isolation action, along with the scram function of the Reactor

. Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46 and offsite doses do not exceed the 10 CFR 100 limits.

The MSL flow signals are initiated from 16 transmitters that are connected to the four MSLs. The transmitters are arranged such that, even though physically separated from each other, all four connected to one MSL would be able to detect i.he high flow. Four channels of Main Steam Line Flow- High Function for each MSL (two channels per trip system) are available and are required to be OPERABLE so that no single instrument failure will preclude detecting a break in any individual MSL.

The Allowable Value is chosen to ensure that offsite dose limits are not exceeded due to the break.

This function isolates MSIVs, MSL drains, MSL sample lines and recirculation loop sample line valves.

1.d. Main Steam Line-Hiah Radiation The Main Steam Line-High Radiation function is provided to detect gross release of fission products from the fuel and to initiate closure of the MSIVs. The trip setting is set lov enough so that a high radiation trip results from a design basis rod drop accident and high enough above background radiation levels in the vicinity of the main steam lines so that spurious trips at rated power are avoided. The Main Steam Line-High Radiation function is directly assumed in the analysis of the control rod drop accident (Ref. 3).

(continued)

PBAPS UNIT 2 B 3.3-158 Revision No.

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 1.d. Main Steam Line-Hich Radiation (continued)

SAFETY ANALYSES, LCO, and The Main Steam Line-High Radiation signals are initiated APPLICABILITY from four gamma sensitive instruments. Four channels are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value is chosen to ensure that offsite dose limits are not exceeded.

This Function isolates MSIVs, MSL drains, MSL sample lines and recirculation loop sample line valves.

l.e. Main Steam Tunnel Temperature-Hich The Main Steam Tunnel Temperature Function is provided to detect a break in a main steam line and provides diversity to the high flow instrumentation.

Main Steam Tunnel Temperature signals are initiated from resistance temperature detectors (RTDs) located along the main steam line between the drywell wall and the turbine.

Sixteen channels of Main Steam Tunnel Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value is chosen to detect a leak equivalent to between 1% and 10% rated steam flow.

This Function isolates MSIVs, MSL drains, MSL sample lines and recirculation loop sample line valves.

Primary Containment Isolation 2.a. Reactor Vessel Water level-Low (Level 3)

Low RPV water level indicates that the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products. The isolation of the primary containment on Level 3 supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded.

(continued)

PBAPS UNIT 2 B 3.3-159 Revision No.

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.a. Reactor Vessel Water level-Low (Level 3) (continued)

SAFETY ANALYSES, LCO, and The Reactor Vessel Water Level-Low (Level 3) Function APPLICABILITY associated with isolation is implicitly assumed in the UFSAR analysis as these leakage paths are assumed to be isolated post LOCA.

Reactor Vessel Water Level-Low (Level 3) signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low (Level 3) Function are available and are required to be OPERABLE to ensure that no single instrument failure can prer.lude the isolation function.

The Reactor Vessel Water Level-Low (Level 3) Allowable Value was chosen to be the same as the RPS Level 3 scram Allowable Value (LC0 3.3.1.1), since isolation of these valves is not critichl to orderly plant shutdown.

This function isolates the Group II(A) valves listed in Reference I with the exception of RWCU isolation valves and RHR shutdown cooling pump suction valves which are addressed in Functions 5.c and 6.b, respectively.

2.b. Drywell Pressure-Hiah High drywell pressure can indicate a break in the RCPB inside the primary containment. The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded. The Drywell Pressure--High Function, associated with isolation of the primary containment, is implicitly assumed in the UFSAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Four channels of Drywell Pressure-High are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

(continued)

PBAPS UNIT 2 B 3.3-160 Revision No.

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES-APPLICABLE 2.b. Drvwell Pressure-Hich' (continued)

SAFETY ANALYSES, LCO, and ' The Allowable Value was selected to be the same as the ECCS APPLICABILITY Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primtey containment.

This Function isolates the Group II(B) valves listed in Reference 1.

2.c. Main Stack Monitor Radiation-Hiah Main stack monitor radiation is an indication that the release of radioactive material may exceed established limits. Therefore, when Main Stack Monitor Radiation-High i is detected when there is flow through the Standby Gas !

Treatment System, an isolation of primary containment purge l supply and exhaust penetrations is initiated to limit the ;

release of fission produ:ts. However, this function is not i assumed in any accident or transient analysis in the UFSAR i because other leakage paths (e.g., MSIVs) are more limiting.

The drywell radiation signals are initiated from radiation )

detectors that isokinetically sample the main stack ;

utilizing' sample pumps. Two channels of Main Stack ,

Radiation-High Function are available and are required to i be OPERABLE to ensure that no single instrument failure can ,

2 preclude the isolation function.

I The Allowable Value is set below the maximum allowable release limit in accordance with the Offsite Dose Calculation Manual (ODCM). l This Function isolates the containment vent and purge valves and other Group III(E) valves listed in Reference 1.

2.d. 2.e. Reactor Buildina Ventilation and Refuelina Floor Ventilation Exhaust Radiation-Hiah High secondary containment exhaust radiation is an indication of possible gross failure of the fuel cladding.

The release may have originated from the primary containment due to a break in the RCPB. When Reactor Building or Refueling Floor Ventilation Exhaust Radiation-High is detected, the affected ventilation pathway and primary (continued)

PBAPS UNIT 2 B 3.3-161 Revision No.

._ __ j

Primary Containment Isolation Instrumentation B 3.3.6.1 !

l BASES APPLICABLE 2.d. 2.e. Reactor Buildina Ventilation and Refuelina Floor SAFETY ANALYSES, Ventilation Exhaust Radiation-Hiah (continued)

LCO, and APPLICABILITY containment purge supply and exhaust valves are isolated to limit the release of fission products. Additionally, Ventilation Exhaust Radiation-High Function initiates Standby Gas Treatment System.

The Ventilation Exhaust Radiation-High signals are ,

initiated from radiation detectors that are located on the '

ventilation exhaust piping coming from the reactor building and the refueling floor zones, respectively. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel. Four channels of Reactor Building Ventilation Exhaust-High Function and four channels of Refueling Floor Ventilation Exhaust-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding during a refueling accident.

These Functions isolate the Group III(C) and III(D) valves i listed in Reference 1. '

Hiah Pressure Coolant Iniection and Reactor Core Isolation i Coolina Systems Isolation 3.a. 3.b. 4.a. 4.b. HPCI and RCIC Steam Line Flow-Hiah and Time Delav Relays Steam Line Flow-High Functions are provided to detect a break of the RCIC or HPCI steam lines and initiate closure of the steam line isolation valves of the appropriate system. If the steam is allowed to continue flowing out of the break, the reactor will depressurize and the core can uncover. Therefore, the isolations are initiated on high flow to prevent or minimize core damage. The isolation action, along with the scram function of the RPS, ensures that the fuel peak cladding temperature remains below the

limits of 10 CFR 50.46. Specific credit for these Functions j is not assumed in any UFSAR accident analyses since the i

(continued)

PBAPS UNIT 2 B 3.3-162 Revision No.

I Primary Containment Isolation Instrumentation B 3.3.6.1 )

i BASES APPLICABLE 3.a. 3.b. 4.a. 4.b. HPCI and RCIC Steam Line Flow-Hiah SAFETY ANALYSES, and Time Delav Relays (continued) l LCO, and l APPLICABII.ITY. bounding analysis is performed for large breaks such as l recirculation and MSL breaks. However, these instruments !

prevent the RCIC or HPCI steam line breaks from becoming ,

bounding. l i

The HPCI and RCIC Steam Line Flow-High signals are initiated from transmitters (two for HPCI and two for RCIC) that are connected to the system steam lines. A time delay 1 is provided to prevent isolation due to high flow transients j during startup with one Time Delay Relay channel associated l with each Steam Line Flow-High channel. Two channels of j both HPCI and RCIC Steam Line Flow-High Functions and the i associated Time Delay Relays are available and are required to be OPERABLE to ensure that no single instrument failure !

can preclude the isolation function.

l The Allowable Values for Steam Line Flow-High Function and !

associated Time Delay Relay Function are chosen to be low l enough to ensure that the trip occurs to maintain the MSLB event as the bounding event.

These Functions isolate the associated HPCI and RCIC steam supply and turbine exhaust valves and pump suction valves.

3.c. 4.c. HPCI and RCIC Steam Sucolv line Pressure-tow Low MSL pressure indicates that the pressure of the steam in the HPCI or RCIC turbine may be too low to continue i operation of the associated system's turbine. These l isolations prevent radioactive gases and steam from escaping through the pump shaft seals into the reactor building but are primarily for equipment protection and are also assumed for long term containment isolation. However, they also provide a diverse signal to indicate a possible system break. These instruments are included in Technical Specifications (TS) because of the potential for risk due to possible failure of the instruments preventing HPCI and RCIC

initiations (Ref. 4).

The HPCI and RCIC Steam Supply Line Pressure-Low signals are initiated from transmitters (four for HPCI and four for RCIC) that are connected to the system steam line. Four (continued)

PBAPS UNIT 2 B 3.3-163 Revision No.

Primary Containment Isolation Instrumentation B 3.3.6.1 )

. 1 BASES APPLICABLE 3.c. 4.c. HPCI and RCIC Steam Sucolv Line Pressure-Low SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY channels of both HPCI and RCIC Steam Supply Line Pressure-Low Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are selected to be high enough to prevent damage to the system's turbine.

These Functions isolate the associated HPCI and RCIC steam supply and turbine exhaust valves and pump suction valves.

3.d. 4.d. Drywell Pressure-Hioh (Vacuum Breakers)

High drywell pressure can indicate a break in the RCPB. The HPCI and RCIC isolation of the tur,. :,e exhaust vacuum breakers is provided to prevent communication with the ,

drywell when high drywell pressure exists. The HPCI and '

RCIC turbine exhaust vacuum breaker isolation occurs following a permissive from the associated Steam Supply :.ine Pressure-Low Function which indicates that the system is no longer required or capable of performing coolant injection.

The isolation of the HPCI and RCIC turbine exhaust vacuum breakers by Drywell Pressure-High is indirectly assumed in the UFSAR accident analysis because the turbine exhaust leakage path is not assumed to contribute to offsite doses.

High drywell pressure signals are initiated from pressure l transmitters that sense the pressure in'the drywell. Four I channels for both HPCI and RCIC Drywell Pressure-High ;

(Vacuum Breakers) Functions are available and are required l to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be the. same as the ECCS Drywell Pressure-High Allowable Value (LCO 3.3.5.1), since this is indicative of a LOCA inside primary containment.

This function isolates the associated HPCI and RCIC vacuum ;

relief valves and test return line valves. j (continued) l l

1 PBAPS UNIT 2 B 3.3-164 Revision No.

I

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 3.e. 4.e. HPCI and RCIC Comoartment and Steam line Area SAFETY-ANALYSES, Temoerature- Hiah LCO, and APPLICABILITY HPCI and RCIC Compartment and Steam Line Area temperatures (continued) are provided to detect a leak from the associated system steam piping. The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumentation. If the small leak is allowed to continue without isolation, offsite dose limits may be reached.

These Functions are not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.

HPCI and RCIC Compartment and Steam Line Area Temperature-High signals are initiated from resistance temperature detectors (RTDs) that are appropriately located to protect the system that is being monitored. The HPCI and RCIC Compartment and Steam Line Area Temperature-High Functions each use 16 temperature channels. Sixteen channels for each HPCI and RCIC Steam Tunnel Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are set low enough to detect a leak.

These Functions isolate the associated HPCI and RCIC steam supply and turbine exhaust valves and pump suction valves.

Reactor Water Cleanuo (RWCU) System Isolation 5.a. RWCU Flow-Hiah The high flow signal is provided to detect a break in the RWCU System. Should the reactor coolant continue to flow out of the break, offsite dose limits may be exceeded.

Therefore, isolation of the RWCU System is initiated when high RWCU flow is sensed to prevent exceeding offsite doses.

This Function is not assumed in any UFSAR transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.

(continued)

PBAPS UNIT 2 B 3.3-165 Revision No.

Primary Containment Isolation Instrumentation B 3.3.6.1 ,

BASES APPLICABLE 5.a. RWCU Flow-Hiah (continued)

SAFETY ANALYSES, LCO, and The high RWCU flow signals are initiated from transmitters APPLICABILITY that are connected to the pump suction line of the RWCU System. Two channels of RWCU Flow-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The RWCU Flow-High Allowable Value ensures that a break of ,

the RWCU piping is detected.

This Function isolates the inboard and outboard RWCU pump suction penetration and the outboard valve at the RWCU connection to reactor feedwater.

5.b. Standby liauid Control (SLC) System Initiation The isolation of the RWCU System is required when the SLC System has been initiated to prevent dilution and removal of the boron solution by the RWCU System (Ref. 5). SLC System initiation signals are initiated from the remote SLC System start switch.

There is no Allowable Value associated with this Function since the channels are mechanically actuated based solely on the position of the SLC System initiation switch.

Two channels of the SLC System Initiation Function are available and are required to be OPERABLE only in MODES 1 and 2, since these are the only MODES where the reactor can be critical, and these MODES are consistent with the Applicability for the SLC System (LC0 3.1.7).

This Function isolates the inboard and outboard RWCU pump suction penetration and the outboard valve at the RWCU connection to reactor feedwater.

5.c. Reactor Vessel Water level-Low (Level 3)

Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some interfaces with the reactor vessel occurs to isolate the potential sources of a break. The isolation of the RWCU System on Level 3 supports actions to ensure that the fuel (continued)

PBAPS UNIT 2 B 3.3-166 Revision No.

i Primary Containment Isolation Instrumentation B 3.3.6.1 1

BASES APPLICABLE 5.c. Reactor Vessel Water level-low (level 3) (coritinued)

SAFETY ANALYSES, LCO, and peak cladding temperature remains below the limits of j APPLICABILITY 10 CFR 50.46. The Reactor Vessel Water Level-Low (Level 3) 1 Function associated with RWCU isolation is not directly !

assumed in the UFSAR safety analyses because the RWCU System j line break is bounded by breaks of larger systems 1 (recirculation and MSL breaks are more limiting). j l

Reactor Vessel Water Level-Low (Level 3) signals are l initiated from four level transmitters that sense the ;

difference between the pressure due to a constant column of j water (reference leg) and the pressure due to the actual !

water level (variable leg) in the vessel. Four channels of '

Reactor Vessel Water Level-Low (Level 3) Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low (Level 3) Allowable Value was chosen to be the same as the RPS Reactor Vessel i Water Level-Low (Level 3) Allowable Value (LC0 3.3.1.1), I since the capability to cool the fuel may be threatened. ;

1 This Function isolates the inboard and outboard RWCU suction j penetration and the outboard valve at the RWCU connection to reactor feedwater.

Shutdown Coolina System Isolation 6.a. Reactor Pressure-Hiah The Reactor Pressure-High Function is provided to isolate i the shutdown cooling portion of the Residual Heat Removal !

(RHR) System. This function is provided only for equipment protection to prevent an intersystem LOCA scenario, and credit for the Function is not assumed in the accident or transient analysis in the UFSAR.

The Reactor Pressure-High signals are initiated from two switches that are connected to different taps on the RPV.

Two channels of Reactor Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Function is only required to be OPERABLE in (continued)

PBAPS UNIT 2 B 3.3-167 Revision No.

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 6.a. Reactor Pressure-Hioh (continued)

SAFETY ANALYSES, LCO, and MODES 1, 2, and 3, since these are the only MODES in which APPLICABILITY the reactor can be pressurized; thus, equipment protection is needed. The Allowable Value was chosen to be low enough to protect the system equipment from overpressurization.

This Function isolates both RHR shutdown cooling pump suction valves.

6.b. Reactor Vessel Water level-low (level 3)

Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some reactor vessel interfaces occurs to begin isolating the potential sources of a break. The Reactor Vessel Water Level-Low (Level 3) Function associated with RHR Shutdown Cooling System isolation is not directly assumed in safety analyses because a break of the RHR Shutdown Cooling System is bounded by breaks of the recirculation and MSL. The RHR Shutdown Cooling System isolation on Level 3 supports actions to ensure that the RPV water level does not drop below the top of'the' active fuel during a vessel draindown event caused by a leak (e.g., pipe break or inadvertent valve opening) in the RHR Shutdown Cooling System.

Reactor Vessel Water Level-Low (Level 3) signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels (two channels per trip system) of the Reactor Vessel Water Level-Low (Level 3) Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. As noted (footnote (a) to Table 3.3.6.1-1), only one channel per trip system (with an isolation signal available to one shutdown cooling pump suction isolation valve) of the Reactor Vessel Water Level-Low (Level 3) Function are required to be OPERABLE in MODES 4 and 5, provided the RHR Shutdown Cooling System integrity is maintained. System integrity is maintained provided the piping is intact and no maintenance is being performed that has the potential for draining the reactor vessel through the syetem.

(continued)

PBAPS UNIT 2 B 3.3-168 Revision No.

s Primary Containment isolation Instrumentation B 3.3.6.1 >

BASES r

APPLICABLE 6.b. Reactor Vessel Water Level-Low (Level 3) (continued) j SAFETY ANALYSES, LCO, and The Reactor ~ Vessel Water Level-Low (Level 3) Allowable APPLICABILITY Value was chosen to be the same as the RPS Reactor Vessel Water Level-Low (Level 3) Allowable Value (LCO 3.3.1.1),

since the capability to cool the fuel may be threatened. ,

The Reactor Vessel Water Level-Low (Level 3) Function is 1 only required to be OPERABLE in MODES 3, 4, and 5 to prevent this ' potential flow path from lowering the reactor vessel level to the top of the fuel. In MODES 1 and 2, another isolation (i.e., Reactor Pressure-High) and administrative controls ensure that this flow path remains isolated.to 4 prevent unexpected loss of inventory via this flow path. ;

This function isolates both RHR shutdown cooling pump suction valves.

t Feedwater Recirculation Isolation l 7.a. Reactor Pressure-Hiah i The Reactor Pressure-Hif* Function is provided to isolate the feedwater recirculation line. This interlock is provided only for equipment protection to prevent an ;

intersystem LOCA scenario, and credit for the interlock is not assumed in the accident or transient analysis in the UFSAR.

The Reactor Pressure-High signals are initiated from four transmitters that are connected to different taps on the RPV. Four channels of Reactor Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Function is only required to be OPERABLE in MODES 1,- 2, and 3, since these are the only MODES in which the reactor can be pressurized; thus, equipment protection is needed. The Allowable Value was chosen to be low enough to protect the system equipment from overpressurization.

This function isolates the feedwater recirculation valves.

(continued) )

l l

i i

PBAPS UNIT 2 B 3.3-169 Revision No.

Primary Containment Isolation Instrumentation B 3.3.6.1 ,

BASES (continued)

ACTIONS A Note has been provided to modify the ACTIONS related to primary containment isolation instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not'within limits, will not result in separate entry into the Condition.

Section 1.3 also spccifies tSat Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Rtquired Actions for inoperable primary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable primary containment isolation instrumentation channel.

hLd Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Functions 1.d, 2.a, and 2.b and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Functions 1.d, 2.a, and 2.b has been shown to be 1

acceptable (Refs. 6 and 7) to permit restoration of any inoperable channel to OPERABLE status. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.I. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation),

Condition C must be entered and its Required Action taken.

(continued)

PBAPS UNIT 2 B 3.3-170 Revision No.

Primary Containment Isolation Instrumentation .

B 3.3.6.1 .

BASES L ;

I-ACTIONS B.d !

(continued) , _

i Required Action B.1 is intended to ensure that appropriate ;

actions are taken if multiple, inoperable, untripped :

channels within the same function. result in' redundant !

l isolation capability being lost for the associated ;

l penetration flow path (s). For those MSL, Primary l Containment, HPCI, RCIC, RWCU, SDC, and Feedwater- t Recirculation Isolation Functions, where actuation of both :

L trip systems is needed to isolate a penetration, the j l Functions are considered to be maintaining isolation ;

I. capability when sufficient channels are OPERABLE or in trip i (or the associated trip system in trip), such that both trip systems will generate a trip signal from the given Function '

on a valid signal. For those Primary Containment, HPCI, :

RCIC, RWCU, and SDC isolation functions, where actuation of s u . one trip system is needed to isolate a penetration, the l Functions are considered to be maintaining isolation '

capability when sufficient hannels are'0PERABLE or in trip, !

such that one trip system will generate a trip signal from ;

the given function on a valid signal. This ensures that at .

l least one of the PCIVs in the associated penetration flow ;

path can receive an isolation signal from the given l Function. For all _ Functions except 1.c,1.e, 2.c, 3.a. 3.b, !

3.e, 4.a 4.b, 4~e, 5.a, 5.b, and 6.a this would require both trip systems to have one channel OPERABLE or in trip. ;

l- For Function 1.c, this would require both trip systems to have one channel, associated with each MSL, OPERABLE or in i trip. For Functions 1.e, 3.e and 4.e, each Function l l- consists of channels that monitor several locations within a i l

given area (e.g., different locations within the main steam I tunnel area).- Therefore, this would require both trip systems to have one channel per location OPERABLE or in trip. For Functions 2.c, 3.a, 3.b, 4.a, 4.b, 5.a, and 6.a, this would require one trip system to have one channel OPERABLE or in trip.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

(continued)

J l

l PBAPS UNIT 2 B 3.3-171 Revision No.

l J

-, . ,-- -~

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS L.1 (continued)

Entry into Condition B and Required Action B.1 may be necessary to avoid an MSL isolation transient when recovering from a temporary loss of ventilation in the main steam line tunnel area. As allowed by LC0 3.0.2 (and discussed in the Bases of LCO 3.0.2), the plant may intentionally enter this Condition to avoid an MSL isolation transient during the restoration of ventilation flow, and then raise the setpoints for the Main Steam Tunnel Temperature-High Function to 250*F causing all channels of Main Steam Tunnel Temperature-High Function to be inoperable. However, during the period that multiple Main Steam Tunnel Temperature-High Function channels are inoperable due to this intentional action, an additional compensatory measure is deemed necessary and shall be taken:

an operator shall observe control room indications of the duct temperature so the main steam line isolation valves may be promptly closed in the event of a rapid increase in MSL tunnel temperature indicative of a steam line break, fu.1 Required Action C.1 directs entry into the appropriate Condition referenced in Table 3.3.6.1-1. The applicable Condition specified in Table 3.3.6.1-1 is Function and. MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A or B and the associated Completion Time has expired, Condition C will be entered for that channel and provides for transfer to the appropriate subseo.usnt Condition.

D.1. D.2.1. and D.2.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months (Required Actions D.2.1 and D.2.2). Alternately, the associated MSLs may be isolated (Re.;uired Action D.1),

(continuedl PBAPS UNIT 2 B 3.3-172 Revision No.

Primary Containment Isolation lnstrumentation B 3.3.6.1 ,

BASES ACTIONS D.1. D.2.1. and D.2.2 (continued) and, if allowed (i.e., plant safety analysis allows operation with an MSL isolated), operation with that MSL isolated may continue. Isolating the affected MSL accomplishes the safety function of the inoperable channel.

The Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Ed If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LC0 does not apply. This is done by placing the plant in at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed. Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 2 from full power conditions in an orderly manner and without challenging !

plant systems.

Ed If the channel is not restored to OPERABLE status or placed 1 in trip'within the allowed Completion Time, plant operations !

may continue if the affected penetration flow path (s) is isolated. Isolating the affected penetration flow path (s) accomplishes the safety function of the inoperable channels.

Alternately, if it is not desired to isolate the affected penetration flow path (s) (e.g., as in the case where isolating the penetration flow path (s) could result in a reactor scram), Condition G must be entered and its Required Actions taken. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing sufficient time for plant operations personnel to isolate the affected penetration flow path (s).

(continued) J L PBAPS UNIT 2 .B 3.3-173 Revision No.

I

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES ACTIONS E,1 and G.2 (continued)

If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, or the Required Action of Condition F is not met and the associated Completion Time has expired, the plant must be placed in a MODE or other specified condition in which the LC0 does not apply. This is done by placing the plant in at least MODE S within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

H.1 and H.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated SLC subsystem (s) is declared inoperable or the RWCU System is isolated.

Since this Function is required to ensure that '

the SLC System performs its intended function, sufficient !

remedial measures are provided by declaring the associated !

SLC subsystems inoperable or isolating the RWCU System. {

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing sufficient time for personnel to isolate the RWCU System.

1.1 and I.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path should be closed. However, if the shutdown cooling function is needed to provide core cooling, these Required Actions allow the penetration flow path to remain unisolated provided action is immediately initiated to restore the channel to OPERABLE status or to isolate the RHR Shutdown Cooling System (i.e., provide alternate decay heat removal capabilities so the penetration flow path can be isolated). Actions must continue until the channel is restored to OPERABLE status or the RHR Shutdown Cooling System is isolated.

(continued)

PBAPS UNIT 2 B 3.3-174 Revision No.

Primary Containment Isolation Instrumentation B 3.3.6.1 BASES (continued)

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each REQUIREMENTS Primary Containment Isolation instrumentation Function are found in the SRs column of Table 3.3.6.1-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition !

entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 6 and 7) assumption of the average time required to perform channel surveillance. That i analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does -

not significantly reduce the probability that the PCIVs will isolate the penetration flow path (s) when necessary.

SR 3.3.6.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

(continued)

PBAPS UNIT 2 B 3.3-175 Revision No.

-. . - - . . . _ - - - - - - . . . . - - . - - - - . - . . - . . . . - ~ . . -

Primary Containment Isolation Instrumentation B 3.3.6.1

- BASES i - SURVEILLANCE SR 3.3.6.1.2-

. REQUIREMENTS (continued). A CHANNEL FUNCTIONAL TEST is performed on each required

channel to ensure that the entire channel will perform the !

L intended function. Any setpoint adjustment shall' be ;

consistent with the assumptions of the current plant l specific setpoint methodology. For Function 1.e, 3.e, and i.

4.e channels, verification that trip settings are less than ,

or equal to the specified Allowable Value during the CHANNEL '

l: FUNCTIONAL TEST is not required since the installed L indication instrumentation does not provide accurate' ;

L indication of the trip setting. This is considered I acceptable since the magnitude of drift assumed in the t i setpoint calculation is based on a 24 month calibration j interval.

The 92 day Frequency of SR 3.3.6.1.2 is based on the [

reliability analysis described in Reference 7. !

SR 3.3.6.1.3. SR 3.3.6.1.4. SR 3.3.6.1.5. and SR 3.3.6.1.6 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel :

responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive >

calibrations, consistent with the assumptions of the current setpoint methodology. SR 3.3.6.1.6, however, is only a calibration of the radiation detectors using a standard radiation source.

As noted for SR 3.3.6.1.3, the main steam line radiation !

detectors (Function 1.d) are excluded from CHANNEL ,

CALIBRATION due to ALARA reasons (when the plant is l operating, the radiation detectors are generally in a high ,

l radiation area; the steam tunnel). This exclusion is i

acceptable because the radiation detectors are passive

! devices, with minimal drift. The radiation detectors are

{ calibrated in accordance with SR 3.3.6.1.6 on a 24 month Frequency. ;

1

_ (continuad) 4 PBAPS UNIT 2: B 3.3-176 Revision No.

Primary Containment Isolation instrumentation B 3.3.6.1 ,

-BASES SURVEILLANCE SR 3.3.6.1,3. SR 3.3.6.1.4. SR 3.3.6.1.5. and REQUIREMENTS SR 3.3.6.1.6 (continued)

The 92 day Frequency of SR 3.3.6.1.3 is conservative with respect to the magnitude of equipment drift assumed in the setpoint analysis. The Frequency of SR 3.3.6.1.4 is based on the assumption of an 18 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. The Frequencies of SR 3.3.6.1.5 and SR 3.3.6.1.6 are based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.6.1.7 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing performed on PCIVs in LCO 3.6.1.3 overlaps this Surveillance to provide complete testing of the assumed safety function.

While this Surveillance can be performed with the reactor at power for some of the Functions, operating experience has shown these components will pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was found to be acceptable from a reliability standpoint.

REFERENCES 1. UFSAR, Section 7.3.

2. NRC Safety Evaluation Report for Amendment Numbers 156 and 158 to Facility Operating License Numbers DPR-44 and DPR-56, Peach Bottom Atomic Power Station, Unit Nos. 2 and 3, September 7, 1990.

3. UFSAR, Chapter 14.

4. NED0-31466, " Technical Specification Screening Criteria Application and Risk Assessment," November 1987.

5. UFSAR, Section 4.9.3.

(continued)

PBAPS UNIT 2 B 3.3-177 Revision No.

i Primary Containment Isolation Instrumentation. !

B 3.3.6.1 ,

BASES I

6. NEDC-31677P-A, " Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation,"

July 1990.

7. NEDC-30851P-A Supplement 2, " Technical Specifications .

Improvement Analysis for BWR Isolation Instrumentation -

Common to RPS and ECCS Instrumentation," March 1989.

i

l i

I j

l I

I l

i 4

)

l PBAPS UNIT 2 B 3.3-178 Revision No.

l Secondary Containment Isolation Instrumentation B 3.3.6.2 ,

B 3.3 INSTRUMENTAlION l B 3.3.6.2 Secondary Containment Isolation Instrumentation l

BASES l

1 BACKGROUND The secondary containment isolation instrumentation automatically initiates closure of appropriate secondary containment isolation valves (SCIVs) and starts the Standby l Gas Treatment (SGT) System. The function of these systems, 1 in combination with other accident mitigation systems, is to l limit fission product release during and following i postulated Design Basis Accidents (DBAs) (Ref. 1). l Secondary containment isolation and establishment of vacuum with the SGT System within the required time limits ensures that fission products that leak from primary containment following a DBA, or are released outside primary containment, or are released during certain operations when ,

primary containment is not required to be OPERABLE are 1 maintained within applicable limits.

The isolation instrumentation includes the sensors, relays, and switches that are net.essary to cause initiation of secondary containment isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a secondary containment isolation signal i to the isolation logic. Functional diversity.is provided by l monitoring a wide range of independent parameters. The input parameters to the isolation logic are (1) reactor vessel water level, (2) drywell pressure, (3) reactor building ventilation exhaust high radiation, and (4) refueling floor ventilation exhaust high radiation.

Redundant sensor input signals from each parameter are provided for initiation of isolation.

l The outputs of the channels are arranged in a one-out-of-two i taken twice logic. Automatic isolation valves (dampers) '

isolate and SGT subsystems start when both trip systems are in trip. Operation of both trip systems is required to isolate the secondary containment and provide for the necessary filtration of fission products.

(continued)

PBAPS UNIT 2 B 3.3-179 Revision No.

- ._ _. _ .- _ m. - _ _ . _ ~ . - - ___ .__ _ _ . _ _ _

i i

Secondary Containment Isolation Instrumentation -

B 3.3.6.2- , l

' BASES--(continued)

APPLICABLE The isolation signals generated by the secondary containment !

SAFETY ANALYSES, isolation instrumentation are implicitly assumed in the !

LCO, and safety analyses of References 1 and 2 to initiate closure i APPLICABILITY of valves and start the SGT System to limit offsite doses.. !

i Refer to.LCO 3.6.4.2, " Secondary Containment Isolation Valves-(SCIVs)," and LCO 3.6.4.3, " Standby Gas Treatment i (SGT) System," Applicable Safety Analyses Bases for more detail of the safety analyses.

The secondary containment isolation instrumentation satisfies Criterion 3 of the NRC Policy Statement. :Certain instrumentation Functions are retained for other reasons and ,

are described below in the individual Functions discussion.

The OPERABILITY of the secondary containment isolation- l instrumentation is dependent on the OPERABILITY of the i individual instrumentation channel Functions. 'Each Function !

must have the required number of OPERABLE channels with l their setpoints set within the specified Allowable Values, 4 as shown in Table 3.3.6.2-1. The actual setpoint is

,. calibrated consistent with applicable setpoint methodology-l assumptions. A channel is inoperable if its actual trip setting is not within its required Allowable Value.

Allowable Values are specified for each Function specified l l in the Table. Trip setpoints are specified in the setpoint calculations. The trip setpoints are selected to ensure-that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setting less conservative than the trip setpoint, but within'its Allowable Value, is acceptable.

l Trip setpoints are those predetermined values of output at which an action should take place. The.setpoints are compared to the actual process parameter (e.g., reactor l

vessel water level), and when the measured output value of !

the process parameter exceeds the setpoint, the associated !

l device (e.g., trip unit) changes state. The analytic or ;

design limits are derived from the limiting values of the :

process parameters obtained from the safety analysis or i i other appropriate documents. The' Allowable Values are L derived from the analytic or design limits, corrected for l calibration,-process, and instrument errors. The trip

setpoints are then determined from analytical or design 4 . limits' corrected for calibration, process, and instrument

(continued) i PBAPS UNIT 2 B 3.3-180 Revision No.

i

l l~

Secondary Containment Isolation Instrumentation ,

B 3.3.6.2 ,

l BASES I

l APPLICABLE errors, as well as, instrument drift. In selected cases, ;

. SAFETY ANALYSES, the Allowable Values and trip setpoints are determined by :

LCO, and. engineering judgement or historically accepted practice '

APPLICABILITY relative to the intended function of the channel. The l

(continued) trip setpoints determined in this manner provide' adequate protection by assuring instrument and process uncertainties '

l expected for the environments during the operating time of ,

t the associated channels are accounted for. ;

o In general, the individual Functions are required to be

OPERABLE in the MODES or other specified conditions when i SCIVs and the SGT System are required.

l The specific Applicable Safety Analyses, LCO, and 4 Applicability discussions are listed below on a Function by l

Function basis. '

l i

1. Reactor Vessel Water level-Low (Level' 3) '

Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should i RPV water level decrease too far, fuel damage could result. i i An isolation of the secondary containment and actuation of !

the SGT System are initiated in order to minimize the-potential of an offsite dose release. The Reactor Vessel !

Water Level-Low (Level 3) Function is one of the Functions assumed to be OPERABLE. and capable of providing isolation i and initiation signals. The isolation and initiation

- systems on Reactor Vessel Water Level-Lcw (Level 3) support actions to ensure that any offsite releases are within the limits calculated in the safety analysis.

1 Reactor Vessel Water Level-Low (Level 3) signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water i (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of ,

Reactor Vessel Water Level-Low (Level 3) Function are '

available and are required to be OPERABLE in MODES 1, 2, and 3 to ensure that no single instrument failure can preclude the isolation function.

l- (continued)

i. i

?

I

.PBAPS UNIT-2 B 3.3-181 Revision No.

-~ --,r. , n -n.

Secondary Containment Isolation Instrumentation i B 3.3.6.2 i

~

l BASES l

l APPLICABLE 1. Reactor Vessel Water level-Low (Level 3) (continued) I SAFETY ANALYSES, i LCO, and The Reactor Vessel Water Level-Low (Level 3) Allowable i APPLICABILITY Value was chosen to be the same as the RPS Level 3 scram l Allowable Value (LCO 3.3.1.1), since isolation of these valves and SGT System start are not critical to orderly :

plant shutdown. I The Reactor Vessel Water Level-Low (Level 3) Function is ;

required to be OPERABLE in MODES 1, 2, and 3 where :

considerable energy exists in the Reactor Coolant System (RCS); thus, there is a probability of pipe breaks resulting I in significant reletses of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these ,

events are low due to the RCS pressure and temperature i limitations of these MODES; thus, this Function is not required. In addition, the Function is also required to be .

OPERABLE during operations with a potential for draining the )

reactor vessel (0PDRVs) because the capability of isolating i potential sources of leakage must be provided to ensure that offsite dose limits are not exceeded if core damage occurs. !

l

2. Drywell Pressure-Hiah High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB). An isolation of the l secondary containment and actuation of the SGT System are l initiated in order to minimize the potential of an offsite dose release. The isolation on high drywell pressure supports actions to ensure that any offsite releases are within the limits calculated in the safet.v analysis. The Drywell Pressure-High Function associated with isolation is not assumed in any UFSAR accident or transient analyses but will provide an isolation and initiation signal. It is retained for the overall redundancy and diversity of the .

secondary containment isolation instrumentation as required l by the NRC approved licensing basis. !

(continued) 4 PBAPS UNIT 2 B 3.3-182 Revision No.

Secondary Containment Isolation Instrumentation l B 3.3.6.2 l I

BASES APPLICABLE 2. Drywell Pressure-Hiah (continued)

SAFETY ANALYSES, I LCO, and High drywell pressure signals are initiated from pressure I APPLICABILITY transmitters that sense the pressure in the drywell. Four !

channels of Drywell Pressure-High Functions are available !

and are required to be OPERABLE to ensure that no single l instrument failure can preclude performance of the isolation i function.

The Allowable Value was chosen to be the same as the ECCS !

Drywell Pressure-High Function Allowable Value (LCO 3.3.5.1) since this is indicative of a loss of coolant accident (LOCA).

The Drywell Pressure-High Function is required to be i OPERABLE in MODES 1, 2, and 3 where considerable energy l exists in the RCS; thus, there is a probability of pipe '

breaks resulting in significant releases of radioactive steam and gas. This Function is not required in MODES 4 and 5 because the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES.

3. 4. Reactor Buildina Ventilation and Refuelina Floor Ventilation Exhaust Radiation-Hiah High secondary containment exhaust radiation is an indication of possible gross failure of the fuel cladding.

The release may have originated from the primary containment due to a break in the RCPB or during refueling due to a fuel '

handling accident. When Ventilation Exhaust Radiation-High is detected, secondary containment isolation and actuation of the SGT System are initiated to limit the release of fission products as assumed in the UFSAR safety analyses (Ref. 4).

The Ventilation Exhaust Radiation-High signals are initiated from radiation detectors that are located on the ventilation exhaust piping coming from the reactor building and the refueling floor zones, respectively. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel. Four (continued)

PBAPS UNIT 2 B 3.3-183 Revision No.

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 3. 4. Reactor Buildina Ventilation and Refuelina Floor

. SAFETY ANALYSES, Ventilation Exhaust Radiation-Hiah (continued)

LCO, and APPLICABILITY channels of Reactor Building Ventilation Exhaust Radiation-High Function and four channels.of Refueling F.loor Ventilation Exhaust Radiation-High Function are available and are required to be OPERABLE to ensure that no single. instrument failure can preclude the isolation function.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding.

The Reactor Building Ventilation and Refueling Floor Ventilation Exhaust Radiation-High Functions are required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists; thus, there is a probability of pipe breaks resulting in significant releases of radioactive' steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and. temperature limitations of these MODES; thus, these Functions are not required. In addition, the Functions are also required to be OPERABLE during CORE ALTERATIONS, OPDRVs,'and movement of irradiated fuel assemblies in the secondary containment, because the capability of detecting radiation releases due to fuel failures (due to fuel uncovery or dropped fuel assemblies) must be provided to ensure that offsite dose limits are not exceeded.

ACTIONS A Note has been provided to modify the ACTIONS related to secondary containment isolation instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the. Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable secondary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate CoMition entry for each inoperable secondary containment isolation instrumentation channel.

(continued)

l. PBAPS UNIT 2- B 3.3-184 Revision No.

l

r - .

Secondary Containment Isolation Instrumentation-B 3.3.6.2

' BASES ACTIONS M (continued)'

Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service. time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for Functions 1 and 2, and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Functions 1 and 2, has been.shown to~oe acceptable (Refs. 5 and 6) to permit restoration of any inoperable channel to OPERABLE status. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required

-Action B.1 Bases). If the inoperable channel cannot.be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.i. Placing the inoperable -

channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. . Alternately, if it is not desired to place the channel in trip (e.g., as in

~ the case where. placing the inoperable channel in trip would result in an isolation), Condition C must be entered and its Required Actions taken.

M Required Action B.1 is intended to ensure that appropriate actions-are taken if multiple, inoperable, untripped channels within the same' Function reselt in a complete loss of isolation capability.for the associated penetration flow path (s) or a complete loss of automatic initiation.

capability for the SGT System. A Function is considered to be maintaining secondary contait.aent-isolation capability when sufficient channels are OPERABLE or in trip, such that both trip . systems will generate a trip signal- from the given Function on a valid signal. This ensures that at least one of the two SCIVs in the associated penetration flow path and at least one SGT subsystem can be initiated on an isolation signal ~from the given Function. For Functions 1, 2, 3, and 4, this would require both trip systems to have one channel OPERABLE or in trip.

(continued)

l. PBAPS' UNIT 2 B 3.3-185 Revision No.

. Secondary Containment Isolation Instrumentation B.3.3.6.2 BASES' ACTIONS jk]. (continued)

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

C.1.1. C.l.2. C.2.1. and C.2.2 If any Required Action and associated Completion Time of Condition A or B are not met, the ability to isolate the secondary containment and start the SGT System cannot be ensured. Therefore, further actions must be performed to ensure the ability to maintain the secondary containment function. Isolating the associated secondary containment penetration flow path (s) and starting the associated SGT subsystem (Required Actions C.1.1 and C.2.1) performs the intended function of the instrumentation and allows operation to continue.

Alternately, declaring the associated SCIVs or SGT subsystem (s) inoperable (Required Actions C.1.2 and C.2.2) is also acceptable since the Required Actions of the respective LCOs (LC0 3.6.4.2 and LC0 3.6.4.3) provide appropriate actions for the inoperable components.

One hour is sufficient for plant operations personnel to establish required plant conditions or to declare the associated components inoperable without unnecessarily challenging plant systems.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each REQUIREMENTS Secondary Containment Isolation instrumentation Function are located in the SRs column of Table 3.3.6.2-1.

(continued)

PBAPS UNIT 2 B 3.3-186 Revision No.

t . . . . .._. . .

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for (continued) performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains secondary containment isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

This Note is based on the reliability analysis (Refs. 5 and 6) assumption that of the average time required to perform channel surveillance. That analysis demonstrated the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the SCIVs will isolate the associated penetration flow paths and that the SGT System will initiate when necessary.

SR 3.3.6.2.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with channels required by the LCO.

(continued)

PBAPS UNIT 2 B 3.3-187 Revision No.

l .. _ _ _ _ _ _

__.- . - _ .._ _ _ _ . _ . _ . . - ~ _ _ _ . _ _ . _ . . _ . _ ~ . _ ~ . _ _ _ . _ __

i Secondary Containment-Isolation Instrumentation B 3.3.6.2 , !

l

. BASES '

i SURVEILLANCE. SR 3.3.6.2.2 !

REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended func'. ion. Any setpoint adjustment shall be '

consistent with the assumptions of the current plant i specific setpoint methodology. The Frequency of 92 days for SR 3.3.6.2.2 is based on the reliability analysis of References 5 and 6. .

SR 3.3.6.2.3 and SR 3.3.6.2.4 $

A CHANNEL CALIBRATION is a complete check of the instrument !

loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary-range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations, consistent with the current plant specific setpoint methodology. -i The Frequencies of SR 3.3.6.2.3 and SR 3.3.6.2.4 are based on the assumption of the magnitude of equipment drift in the !

setpoint analysis.

SR 3.3.6.2.5 i

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing performed on SCIVs l and the SGT System in LC0 3.6.4.2 and LCO 3.6.4.3, t

respectively, overlaps this Surveillance to provide complete testing of the assumed safety function.

While this Surveillance can be performed with the reactor at power'for some of the Functions, operating experience has shown that these components will pass the Surveillance when !

t. performed at the 24 month Frequency. Therefore, the Frequency was found to be acceptable from a reliability standpoint.

(continued) :

1 PBAPS UNIT 2 B 3.3-188 Revision No.

v

. _ , , . , . . , .r . _ - _ _ _ . . .

3 I

Secondary Containment Isolation Instrumentation r B 3.3.6.2 , i BASES (continued) i REFERENCES 1. UFSAR, Section 14.6.

2. UFSAR, Chapter 14.

3. UFSAR; Section 14.6.5.

4. UFSAR, Sections 14.6.3 and 14.6.4.

5. ' NEDC-31677P-A, " Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation,"

July 1990.

6. NEDC-30851P-A Supplement 2, " Technical Specifications Improvement Analysis-for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation," March 1989.

PBAPS UNIT 2- B 3.3-189 Revision No.

MCREV System Instrumentation B 3.3.7.1 .

B 3.3 INSTRUMENTATION B 3.3.7.1 Main Control Room Emergency Ventilation (MCREV) System Instrumentation BASES BACKGROUND The MCREV System is designed to provide a radiologically controlled environment to ensure the habitability of the control room for the safety of control room operators under all plant conditions. Two independent MCREV subsystems are each capable of fulfilling the stated safety function. The instrumentation and controls for the MCREV System automatically initiate action to pressurize the main control room (MCR) to minimize the consequences of radioactive material in the control room environment.

In the event of a Control Room Air Intake Radiation-High signal, the MCREV System is automatically started in the pressurization mode. The outside air from the normal ventilation intake is then passed through one of the charcoal filter subsystems. Su'#icient outside air is drawn in through the normal ventila' intake to maintain the MCR slightly pressurized with resp to the turbine building.

The MCREV System instrumentation has two trip systems with two Control Room Air Intake Radiation-High channels in each trip system. The outputs of the Control Room Air Intake Radiation-High channels are arranged in two trip systems, which use a one-out-of-two logic. The tripping of both trip systems will initiate both MCREV subsystems. The channels include electronic equipment (e.g., trip units) that

! compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a MCREV System initiation signal to the initiation logic.

APPLICABLE The ability of the MCREV System to maintain the habitability l SAFETY ANALYSES, of the MCR is explicitly assumed for certain accidents as l LCO, and discussed in the UFSAR safety analyses (Refs. I, 2, and 3).

l APPLICABILITY MCREV System operation ensures that the radiation exposure of control room personnel, through the duration of any one of the postulated accidents, does not exceed acceptable limits.

(continued)

PBAPS UNIT 2 B 3.3-190 Revision No.

, i j

MCREY System Instrumentation B 3.3.7.1 ,

BASES APPLICABLE MCREV System instrumentation satisfies Criterion 3 of the SAFETY ANALYSES, NRC Policy Statement.

LCO, and APPLICABILITY The OPERABILITY of the MCREV System instrumentation is (continued) dependent upon the OPERABILITY of the Control Room Air Intake Radiation-High instrumentation channel Function.

The Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setting is not within its required Allowable Value. The actual setpoint is. calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for the MCREV System Control Roon Air Intake Radiation-High Function. Trip setpoints are specified in the setpoint calculations. The trip setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. Operation with a trip setting less !

conservative than the trip setpoint, but within its Allowable Value, is acceptable. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., control room air intake radiation),

and when the measured output value of the process parameter exceeds the setpoint, the associated device changes state.

The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis.

The Allowable Values are derived from the analytic limits, .

corrected for calibration, process, and instrument errors. l The trip setpoints are determined from analytical or design i limits, corrected for calibration, process, and instrument I errors, as well as, instrument drift. The trip setpoints derived in this manner provide adequate protection by ensuring instrument and process uncertainties expected for i the environments during the operating time.of the associated l channels are accounted for.

The control room air intake radiation monitors measure radiation levels in the fresh air supply plenum. A high radiation level may pose a threat to MCR personnel; thus, automatically initiating the MCREV System.

(continued)

PBAPS UNIT 2 B 3.3-191 Revision No.

l MCREV System Instrumentation .

l B 3.3.7.1 BASES APPLICABLE The Control Room Air Intake Radiation-High. Function SAFETY ANALYSES, consists of four independent monitors. Two channels of LCO, and Control Room Air Intake Radiation-High per trip system are APPLICABILITY available and are required to be OPERABLE to ensure that no (continued) single instrument failure can preclude MCREV System initiation. The Allowable Value was selected to ensure protection of the control room personnel.

The Control Room Air Intake Radiation-High Function is required to be OPERABLE in MODES 1, 2, and 3 and during CORE ALTERATIONS, OPDRVs, and movement of irradiated fuel assemblies in the secondary containment, to ensure that control room personnel are protected during a LOCA, fuel handling event, or vessel draindown event. During MODES 4 and 5, when these specified conditions are not in progress (e.g., CORE ALTERATIONS), the probability of a LOCA or fuel damage is low; thus, the Function is not required.

ACTIONS A Note has been provided to modify the ACTIONS related to ,

MCREV System instrumentation channels. Section 1.3, !

Completion Times, specifies that once a Condition has been l entered, subsequent divisions, subsystems, components, or '

variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each ,

additional failure, with Completion Times based on initial i entry into the Condition. However, the Required Actions for i inoperable MCREV System instrumentation channels provide l appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable MCREV System instrumentation channel.

A.1 and A.2 Because of the redundancy of sensors available to provide initiation signals and the redundancy of the MCREV System design, an allowable out of service time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months has been shown to be acceptable (Ref. 4), to permit restoration of any inoperable channel to OPERABLE status. However, this out of service time is only acceptable provided the Control Room Air Intake Radiation-High function is still maintaining MCREV System initiation capability. The i Function is considered to be maintaining MCREV System (continued)

PBAPS UNIT 2 B 3.3-192 Revision No.

I

l MCREV System Instrumentation B 3.3.7.1 .

BASES !

ACTIONS A.1 and A.2 (continued) initiation capability when sufficient channels are OPERABLE or in trip such that the two trip systems will generate an initiation signal from the given Function on a valid signal. !

For the Control Room Air Intake Radiation-High Function, i this would require the two trip systems to have one channel

{

per trip system OPERABLE or in trip. In this situation !

(loss of MCREV System initiation capability), the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months '

allowance of Required Action A.2 is not appropriate. If the Frnction is not maintaining MCREV System initiation ,

capability, the MCREV System must be declared inoperable !

within I hour of discovery of the loss of MCREV System initiation capability in both trip systems.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time (A.1) is acceptable because it minimizes risk while allowing time for restoring or tripping ;

of channels. ,

If'the inoperable channel cannot be restored to OPERABLE l status within the allowable out of service time, the channel !

must be placed in the tripped condition per Required Action A.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow i operation to continue. Alternately, if it is not desired to '

place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an ,

initiation), Condition B must be entered and its Required !

Action taken.

B.1 and B.2 With any Required Action and associated Completion Time not met, the associated MCREV subsystem (s) must be placed in operation per Required Action B.1 to ensure that control room personnel will be protected in the event of a Design Basis Accident. The method used to place the MCREV subsystem (s) in operation must provide for automatically re-initiating the subsystem (s) upon restoration of power following a loss of power to the MCREV subsystem (s).

Alternately, if it is not desired to start the subsystem (s),

the MCREV subsystem (s) associated with inoperable, untripped (continued)

I PBAPS UNIT 2 B 3.3-193 Revision No.

MCREV System Instrumentation l B 3.3.7.1 l BASES j ACTIONS B.1 and B.2 (continued) ,

l channels must be declared inoperable within I hour. Since )

each trip system can. affect both MCREV subsystems, Required '

Actions B.1 and B.2 can be performed independently on each '

MCREV subsystem. That is, one MCREV subsystem can be placed l in operation (Required Action B.1) while the other MCREV l subsystem can be declared inoperable (Required Action B.2). l The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is intended to allow the operator l time to place the MCREV subsystem (s) in operation. The i I hour Completion Time is acceptable because it minimizes risk while allowing time for placing the associated MCREV subsystem (s) in operation, or for entering the applicable j Conditions and Required Actions for the inoperable MCREV subsystem (s).

SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided tne associated Function maintains MCREV System initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the i channel must be returned to OPERABLE status or the i applicable Condition entered and Required Actions taken.

This Note is based on the reliability analysis (Ref. 4) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the MCREV System will initiate when necessary.

SR 3.3.7.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures l that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter !

indicated on one channel to a similar parameter on other i channels. .It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect (continued)

PBAPS UNIT 2 B 3.3-194 Revision No.

f MCREV System Instrumentation B 3.3.7.1 BASES l

SURVEILLANCE- SR 3.3.7.1.1 (continued)

REQUIREMENTS

. gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each ,

CHANNEL CALIBRATION. :

Agreement criteria are determined by the plant staff, based l on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the i instrument has drifted outside its limit.

The Frequency is based upon operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with channels required by the LCO.

SR 3.3.7.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of 92 days is based on the reliability analyses of Reference 4.

SR 3.3.7.1.3 l A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary i range and accuracy. CHANNEL CALIBRATION leaves the channel ,

adjusted to account for instrument drifts between successive calibrations, consistent with the assumptions of the plant specific setpoint methodology.

The Frequency is based upon the assumption of an 18 month calibration interval in the determination of the magnitude of the equipment drift in the setpoint analysis.

l (continued)

PBAPS UNIT 2- B 3.3-195 Revision No.

)

MCREV System Instrumentation B 3.3.7.1 .

BASES

. SURVEILLANCE SR 3.3.7.1.4 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for-a specific ,

channel. The-system functional testing performed in l LCO 3.7.4, " Main Control Room Emergency Ventilation (MCREV)

System," overlaps this Surveillance to provide complete testing of the assumed safety function.

While this Surveillance can be performed with the reactor at I

power, operating experience has shown these components will pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was found to be .i' acceptable from a reliability standpoint.

REFERENCES '1. UFSAR, Section 10.13.

2.. UFSAR, Section 12.3.4.

3. UFSAR, Section 14.9.1.5.

4. GENE-770-06-1, " Bases for-Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected i

Instrumentation Technical Specifications,"

February'1991.

l l

l l l

l i.,

i ,

1 3

):

I PBAPS UNIT 2 B 3.3-196 Revision No.

1-

LOP Instrumentation B 3.3.8.1 B 3.3 INSTRUMENTATION B 3.3.8.1 Loss of Power (LOP)_ Instrumentation BASES BACKGROUND Successful operation of the required safety functions of the Emergency Core Cooling Systems (ECCS) is dependent upon the availability of adequate power for energizing various components such as pump motors, motor operated valves, and the associated control components. The LOP instrumentation monitors the 4 kV emergency buses voltage. Offsite power is the preferred source of power for the 4 kV emergency buses.

If the LOP instrumentation detects that voltage levels are too low, the buses are disconnected from the offsite power sources and connected to the onsite diesel generator (DG) power sources.

Each Unit 2 4 kV emergency bus has its own independent LOP instrumentation and associated trip logic. The voltage for each bus is monitored at five levels, which can be considered as two different undervoltage Functions: one level of loss of voltage and four levels of degraded voltage. The Functions cause various bus transfers and disconnects. The degraded voltage Function is monitored by l four undervoltage relays per source and the loss of voltage !

Function is monitored by one undervoltage relay for each emergency bus. The degraded voltage outputs and the loss of voltage outputs are arranged in a one-out-of-one trip logic ;

configuration. Each channel consists of four protective i relays that compare offsite source voltages with pre-established setpoints. When the sensed voltage is below the setpoint for a degraded voltage channel, the preferred offsite source breaker to the 4 kV emergency bus is tripped and autotransfer to the alternate offsite source is initiated. If the alternate source does not provide '

adequate voltage to the bus as sensed by its degraded grid relays, a diesel generator start signal is. initiated. '

A description of the Unit 3 LOP instrumentation is provided in the Bases for Unit 3 LCO 3.3.8.1. i (continued)

PBAPS UNIT 2- B 3.3-197 Revision No.

LOP Instrumentation B 3.3.8.1 BASES (continued)

APPLICABLE The LOP instrumentation is required for Engineered Safety SAFETY ANALYSES, Features to function in any accident with a loss of offsite LCO, and power. The required channels of LOP instrumentation ensure APPLICABILITY that the ECCS and other assumed systems powered from the DGs, provide plant protection in the event of any of the Reference 1 (UFSAR) analyzed accidents in which a loss of offsite power is assumed. The first level is loss of voltage. This loss of voltage level detects and disconnects the Class 1E buses from the offsite powcr source upon a total loss of voltage. The second level of undervoltage protection is provided by the four levels of degraded grid voltage relays which are set to detect a sustained low l voltage condition. These degraded grid relays disconnect '

the Class 1E buses from the offsite power source if the degraded voltage condition exists for a time interval which could prevent the Class 1E equipment from achieving its I safety function. The degraded grid relays also prevent the Class 1E equipment from sustaining damage from prolonged operation at reduced voltage. The combination of the loss of voltage relaying and the degraded grid relaying provides l protection to the Class IE distribution system for all l credible conditions of voltage collapse or sustained voltage '

degradation. The initiation of the DGs on loss of offsite power, and subsequent initiation of the ECCS, ensure that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Accident analyses credit the loading of the DG based on tiie loss of offsite power during a loss of coolant accident.

The diesel starting and loading times have been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power.

The LOP instrumentation satisfies Criterion 3 of the NRC Policy Statement.

The OPERABILITY of the LOP instrumentation is dependent upon the OPERABILITY of the individual instrumentation relay channel Functions specified in Table 3.3.8.1-1. Each Function must have a required number of OPERABLE channels per 4 kV emergency bus, with their setpoints within the specified Allowable Values except the bus undervoltage relay which does not have an Allowable Value. A degraded voltage channel is inoperable if its actual trip setroint is not within its required Allowable Value. The actual setpoint is (continued)

PBAPS UNIT 2 B 3.3-198 Revision No.

_ - _ _ _ - - _ _ _ _ . _ _ . ~ _ .-

i 1

LOP Instrumentation l B 3.3.8.1 i i

1 BASES APPLICABLE calibrated consistent with applicable setpoint methodology ,

SAFETY ANALYSES, assumptions. The loss of voltage channel is inoperable if '

LCO, and it will not start the diesel on a loss of power to a 4 kV APPLICABILITY emergency bus.

(continued)

The Allowable Values are specified for each applicable l Function in the Table 3.3.8.1-1. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint within the Allowable.Value, is ,

acceptable. Trip setpoints are those predetermined values i of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., voltage), and when the measured output value of the process parameter exceeds the setpoint, the protective relay output changes state. The Allowable Values were set equal to the limiting values determined by the voltage regulation calculation. The setpoints were corrected to account for relay accuracy, test equipment accuracy, and potential transformer burden, using a square root of the sum of the squares methodology. The setpoint assumes a nominal 35/1 potential transformer ratio.

The specific Applicable Safety Analyses, LCO, and Applicability discussions for Unit 2 LOP instrumentation are listed below on a Function by Function basis. I In addition, since some equipment required by Unit 2 is l powered from Unit 3 sources, the Unit 3 LOP instrume:4tation l supporting the required sources must also be OPERABLE. The OPERABILITY requirements for the Unit 3 LOP instrumentation is the same as described in this section, except Function 4 (4 kV Emergency Bus Undervoltage, Degraded Voltage LOCA) is not required to be OPERABLE, since this Function is related to a LOCA on Unit 3 only. The Unit 3 instrumentation is listed in Unit 3 Table 3.3.8.1-1.

1. 4 kV Emeraency Bus Undervoltaae (Loss of Voltaae)

When both offsite sources are lost, a loss of voltage condition on a 4 kV emergency bus indicates that the respective emergency bus is unable to supply sufficient power for proper operation of the applicable equipment.

Therefore, the power supply to the bus is transferred from l offsite power to DG power. This ensures that adequate power ,

will be available to the required equipment.

(continued)

PBAPS UNIT 2 B 3.3-199 Revision No.

LOP Instrumentation !

B 3.3.8.1 BASES APPLICABLE 1. 4 kV Emeraency Bus Undervoltaae (Loss of Voltaae)

SAFETY ANALYSIS, (continued)

LCO, and APPI '" ABILITY The single channel of 4 kV Emergency Bus Undervoltage (Loss of Voltage) Function per associated emergency bus is only required to be OPERABLE when the associated DG and offsite circuit are required to be OPERABLE. This ensures no single instrument failure can preclude the start of three of four DGs. (One channel inputs to each of the four DGs.) Refer to LC0 3.8.1, "AC Sources-Operating," and 3.8.2, "AC Sources-Shutdown," for Applicability Bases for the DGs.

2. 3. 4. 5. 4kV Emeraency Bus Undervoltaae (Dearaded !

Voltaael A degraded voltage condition on a 4 kV emergency bus indicates that, while offsite power may not be completely lost to the respective emergency bus, available power may be insufficient for starting large ECCS motors without risking damage to the motors that could disable the ECCS function.

Therefore, power to the bus is transferred from offsite l power to onsite DG power when there is insufficient offsite !

power to the bus. This transfer will occur only if the voltage of the preferred and alternate power sources drop below the Degraded Voltage Function Allowahle Values (degraded voltage with a time delay) and the source breakers trip which causes the bus undervoltage relay to initiate the DG. This ensures that adequate power will be available to the required equipment.

Four Functions are provided to monitor degraded voltage at fou'r different levels. These Functions are the Degraded Voltage Non-LOCA, Degraded Voltage LOCA, Degraded Voltage High Setting, and Degraded Voltage Low Setting. These relays monitor the following voltage levels with the following time delays: the Function 2 relay, 60% in approximately 2 seconds when source voltage is reduced abruptly to zero volts (inverse time delay); the Function 3 relay, 87% in approximately 30 seconds when source voltage is reduced abruptly to 84 volts (inverse time delay); the Function 4 relay, 89% in approximately 10 seconds; and the Function 5 relay, 98% in approximately 60 seconds. The Function 2 and 3 relays are inverse time delay relays.

These relays operate along a repeatable characteristic curve. With relay operation being inverse with time, for (continue ().

PBAPS UNIT 2 B 3.3-200 Revision No.

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE 2. 3. 4. 5. 4 kV Emeraency Bus Undervoltaae (Dearaded SAFETY ANALYSES, Voltaae) (continued)

LCO, and APPLICABILITY an abrupt reduction in voltacc the relay operating time will be short; conversely, for a slight rer.uction in voltage, the operating time delay will be long.

The Degraded Voltage LOCA Function preserves the assumptions of the LOCA analysis and the combine 1 Functions of the other relays preserves the assumptions of the accident sequence ,

analysis in the UFSAR. The Degraded Voltage Non-LOCA l Function provides assurance that equipment powered from the 4kV emergency buses is not damaged by degraded voltage that might occur under other than LOCA conditions. This degraded grid non-LOCA relay has an associated 60 second timer. This timer allows for offsite source transformer load tap changer operation. Degraded voltage conditions can be mitigated by tap changer operations and other manual actions. The 60 second timer provides the time for these actions to take l

place. l The degraded grid voltage Allowable Values are low enough to prevent inadvertent power supply transfer, but high enough to ensure that sufficient power is available to the required equipment. The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that sufficient power is available to the required equipment.

Two channels (one channel per source) of 4 kV Emergency Bus Degraded Voltage (Functions 2, 3, 4, and 5) per associated bus are required to be OPERABLE when the associated DG and offsite circuit are required to be OPERABLE. This ensures no single instrument failure can preclude the start of three of four DGs (each logic inputs to each of the four DGs). Refer to LC0 3.8.1 and LC0 3.8.2 for Applicability Bases for the DGs.

ACTIONS A Note has been provided (Note 1) to modify the ACTIONS related to LOP instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been en.tered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial (continued)

PBAPS UNIT 2 B 3.3-201 Revision No.

LOP Instrumentation B 3.3.8.1 BASES ACTIONS entry into the Condition. However, the Required Actions for !'

(continued) inoperable LOP instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable LOP instrumentation channel.

L Ad Pursuant to LCO 3.0.6, the AC Sources-Operating. ACTIONS would not have to be entered even if the LOP instrumentation L inoperability resulted in an inoperable offsite circuit.

Therefore, the Required Action of Condition A is modified by a Note to indicate that when performance of a Required Action results in the inoperability of an offsite circuit, Actions for LC0 3.8.1, "AC Sources-Operating," must be immediately entered. A Unit 2 offsite circuit is considered

! to be inoperable if it is not supplying or not capable of supplying (due to loss of autotransfer capability) at least three Unit 2 4 kV emergency buses when the-other offsite ;

!. circuit is providing power or capable of supplying power to 1 all four Unit 2 4 kV emergency buses. A Unit 2 offsite circuit is also considered to be inoperable if the Unit 2 !

l 4 kV emergency buses being powered or capable of being

powered from the two offsite circuits are all the same when

! at least one of the two circuits does not provide power or is not capable of supplying power to all four Unit 2 4 kV emergency buses. Inoperability of a Unit 3 offsite circuit

, is the same as described for a Unit 2 offsite circuit, l except that the circuit path is to the Unit 3 4 kV emergency l buses required to be OPERABLE by LCO 3.8.7, " Distribution )

Systems -Operating. " The Note allows Condition A to provide L

requirements for the loss of a LOP instrumentation channel without regard to whether an offsite circuit is rendered inoperable. LC0 3.8.1 provides appropriate restriction for l an inoperable offsite circuit.

Required Action A.1 is applicable when one 4 kV emergency bus has one or two required Function 3 (Degraded Voltage High Setting) channels inoperable or when one 4 kV emergency bus has one or two required Function 5 (Degraded Voltage

! Non-LOCA) channels inoperable. In this Condition, the affected Function may not be capable of performing its l intended function automatically for these buses. However,

! the operators would still receive indication'in the control l room of a degraded voltage condition on the unaffected buses j and a manual transfer of the affected bus power supply to p

(continued)

1. PBAPS UNIT 2- B 3.3-202 Revision No.

l

LOP Instrumentation B 3.3.8.1 BASES ACTIONS ~ ~ 8.J (continued)-

the alternate source could be made without damaging plant equipment. Therefore, Required Action A.1 allows 14 days to restore the inoperable channel (s) to OPERABLE status or place the inoperable channel (s).in trip. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore design trip capability to the LOP instrumentation, and allow operation to continue.

Alternatively, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip.

would result in DG initiation), Condition D must be entered and its Required Action taken.

The 14 day Completion Time is intended to allow time to-restore'the channel (s) to OPERABLE status. The Completion Time takes into consideration the diversity of the Degraded Voltage Functions, the capabilities of the remaining OPERABLE LOP Instrumentation Functions on the affected 4 kV emergency bus and on the other 4 kV emergency buses (only l one 4 kV emergency bus is affected by the inoperable channels), the fact that the Degraded Voltage High Setting and Degraded Voltage Non-LOCA Functions provide only a marginal increase in the protection provided by the voltage monitoring scheme, the low probability of the grid operating in the voltage band protected by these Functions, and the ability of the operators to~ perform the Functions manually.

L.1 Pursuant to LCO 3.0.6, the AC Sources-0perating ACTIONS would not have to be entered even if the LOP instrumentation inoperability resulted in an inoperable offsite circuit.

Therefore, the Required-Action.of Condition B is modified by a Note to indicate that when performance of a Required Action results in the inoperability of an offsite circuit, Actions for LCO 3.8.1, "AC Sources-Operating," must be immediately entered. A Unit 2 offsite circuit is considered to be inoperable if it is not supplying or not capable of supplying (due to loss of autotransfer capability) at least three Unit 2 4'kV emergency buses when the other offsite circuit is providing. power or capable of supplying power to all four Unit 2 4 kV emergency buses. A Unit 2 offsite i circuit.is also considered to be inoperable if the Unit 2 i 4 kV emergency buses being powered or capable of being powered from the two offsite circuits are all the same when ,

at least one of the two circuits does not provide power or i (continued)

PBAPS UNIT 2~ B 3.3-203 Revision No.

LOP Instrumentation B 3.3.8.1 BASES ACTIONS RJ (continued) '

I is not capable of supplying power to all four Unit 2 4'kV )

emergency buses. Inoperability of a Unit 3 offsite circuit is the same as described for a Unit 2 offsite circuit, except that the circuit path is to the Unit 3 4 kV emergency buses required to be OPERABLE by LC0 3.8.7, " Distribution Systems - Operating." This allows Condition B to provide requirements for the loss of a LOP instrumentation channel without regard to whether an offsite circuit is rendered inoperable. LCO 3.8.1 provides appropriate restriction for l an inoperable offsite circuit.

Required Action B.1 is applicable when two 4 kV emergency buses have one required Function 3 (Degraded Voltage High Setting) channel inoperable, or when two 4 kV emergency buses have one required Function 5 (Degraded Voltage Non-LOCA) channel inoperable, or when one 4 kV emergency bus has one required Function 3 channel inoperable and a different i 4 kV emergency bus has one required Function 5 channel inoperable. In this Condition, the affected Function may i not be capable of performing its intended function automatically.for these buses. However, the operators would still receive indication in the control room of a degraded l voltage condition on the unaffected buses and a manual 1 transfer of the affected bus power supply to the alternate source could be made without damaging plant equipment.

Therefore, Required Action B.1 allows 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to restore the inoperable channels to OPERABLE status or place the inoperable channels in trip. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore design trip capability to the LOP instrumentation, and allow operation to continue.

Alternatively, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in DG initiation), Condition D must be entered and its Required Action taken.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is intended to allow time to restore the channel (s) to OPERABLE status. The Completion Time takes into consideration the diversity of the Degraded Voltage Functions, the capabilities of the remaining 0PERABLE LOP Instrumentation Functions on the affected 4 kV emergency buses and on the other 4 kV emergency buses (only two 4 kV emergency buses are affectad by the inoperable channels), the fact that the Degraded Voltage High Setting and Degraded Voltage Non-LOCA Functions provide only a (continued)

PBAPS UNIT 2 B 3.3-204 Revision No.

o.-.w_a~- ~na.,_ .--.o- _ -m a.

l l

LOP. Instrumentation i B 3.3.8.1 i BASES ACTIONS R J (continued) marginal increase in the protection provided by the voltage monitoring scheme, the low probability of the grid operating :

in the voltage band protected by these Functions, and the !

ability of the operators to perform the Functions manually.

Pursuant to LCO 3.0.6, the AC Sources-Operating ACTIONS.

would not have to be entered even if the LOP Instrumentation :

inoperability resulted in an inoperable offsite circuit. '

Therefore, the Required Action of Condition C is modified by I a Note to indicate that when performance of the Required :

Action results in the inoperability of an offsite circuit, i Actions for LC0 3.8.1, "AC Sources-0perating," must be i immediately entered. A Unit 2 offsite circuit is '

considered to be inoperable if it is not supplying or not capable of supplying-(due to loss of autotransfer capability) at least three Unit 2 4 kV emergency buses when the other offsite circuit is providing power or capable of i supplying power to all four Unit 2 4 kV emergency buses. A i

. Unit 2 offsite circuit is also considered to be inoperable i if the Unit 2 4 kV emergency buses being powered or capable i of being powered from the two offsite circuits are all the !

same when at least one of the two circuits does not provide power or is not capable of supplying power to all four Unit 2 4 kV emergency buses. Inoperability of a Unit 3 offsite circuit is the same as described for a Unit 2 offsite circuit, except that the circuit path is to the Unit 3 4 kV emergency buses required to be OPERABLE by LC0 3.8.7, " Distribution Systems - Operating." The Note allows Condition C to provide requirements for the loss of a LOP instrumentation channel without regard to whether an offsite circuit is rendered inoperable. LC0 3.8.1 provides appropriate restriction-for an inoperable offsite circuit.

Required Action C.1 is applicable when one or more 4 kV ,

emergency buses have one or more required Function 1, 2, or i 4 (the loss of Voltage, the Degraded Voltage Low Setting, and the Degraded Voltage LOCA Functions, respectively) channels inoperable, or when one 4 kV emergency bus has one ,

required Function 3-(Degraded Voltage High Setting) channel i and one required Function 5 (Degraded Voltage Non-LOCA) i channel inoperable, or when any combination of three or mere required Function 3 anG Function 5 channels are inoperable. ;

In this Condition, the affected Function may not be capable (continued)

PBAPS UNIT 2 B 3.3-205 Revision No.

i LOP Instrumentation l' B 3.3.8.1

. BASES ACTIONS M (continued) of performing the intended function and the potential consequences associated with the inoperable channel (s)a're greater than those resulting from condition A or Condition B. Therefore, only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must-be placed in the tripped condition per Required Action C.1.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore design trip capability'to the LOP instrumentation, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in_a DG initiation),

Condition D must be entered and its Required Action taken.

The Completion Time is based on the potential consequences associated with the inoperable channel (s)-and_is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The I hour Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

M

~ If any Required Action and associated Completion Time are not met, the associated Function is not capable of performing the intended function. Therefore, the associated DG(s) is declared inoperable immediately. This requires i

entry into applicable Conditions and Required Actions of LCO 3.8.1 and LC0 3.8.2, which provide appropriate actions for the inoperable DG(s). 1 SURVEILLANCE ' As noted at the beginning of the SRs, the SRs for each REQUIREMENTS Unit 2 LOP instrumentation Function are located in the SRs column of Table 3.3.8.1-1. SR 3.3.8.1.5 is applicable only ,

. to the Unit 3 LOP instrumentation. s The Surveillance ~are also modified by a Note to indicate

, that when a channel is placed in an inoperable status solely

- for performance of required Surveillance, entry into .

associated Conditions and Required Actions may be delayed

for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided: (a) for Function 1, the j associated Function maintains initiation capability for (continued)

PBAPS UNIT 2- B 3.3-206- Revision No.

+ - < y - - - - -

LOP Instrumentation B 3.3.8.1 .

BASES SURVEILLANCE. .

three DGs; and (b) for. Functions 2, 3, 4, 5, the associated REQUIREMENTS (continued) Function maintains.undervoltage transfer capability for three 4 kV emergency buses. The loss of function for one DG or undervoltage transfer capability for the 4 kV emergency bus for this short period is appropriate since only three of 1 four DGs are required to start within the required times and because there is no appreciable impact on risk. Also, upon completion of the Surveillance, or expiration of the 2. hour allowance, the channel must be. returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

SR 3.~3.8.1.1 and SR 3.3.8.1.3 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the 1 intended function. Any setpoint adjustment shall be '

consistent with the assumptions of the current plant specific setpoint methodology. i The Frequency of 31 days is based on operating experience l with regard to channel OPERABILITY and drift, which l demonstrates that failure of more than one degraded voltage channel of a given Function in any 31 day interval is a rare event. The Frequency of 24 months is based on operating experience with regard to channel 0PERABILITY and drift, :

which demonstrates that failure of the loss of voltage {

. channel in any 24 month interval is a rare event. i SR 3.3.8.1.2 A CHANNEL CALIBRATION is a complete check of the relay circuitry and associated time delay relays. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations,

.. consistent with the' assumptions of the current plant specific setpoint methodology.

Th'e 18 month Frequency for the degraded voltage Functions is based upon the assumption of the magnitude of equipment drift'in the setpoint analysis.

l l~ (continued) 1 1

L PBAPS UNIT 2: B 3.3-207 Revision No.

L

. . . . - - _ . - . -. - - ~_ _ - . - . - . - - . -... - . - - . - - _ - _ . -

LOP Instrumentation i B 3.3.8.1 -

BASES' SURVEILLANCE SR -3.3.8.1.4 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of -the required actuation logic for. a specific channel. The system functional testing performed in ,

' LCO 3.8.1 and LC0 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety functions.

The 24 month Frequency.is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. .

SR 3.3.8.1.5' '

With the exception of this Surveillance, all other Surveillances of this Specification (SR 3.3.8.1.1 through SR 3.3.8.1.4) are applied only to the Unit 2 LOP instrumentation. This Surveillance is provided to direct that the appropriate Surveillance for the required Unit 3 LOP instrumentation are governed by the Unit 3 Technical :

Specifications. Performance of the applicable Unit 3 !

Surveillances will satisfy Unit 3 requirements, as well as !

satisfying this Unit 2 Surveillance Requirement.

The Frequency required by the applicable Unit 3 SR also governs performance of that SR for Unit 2.

REFERENCES -1. UFSAR, Chapter 14.

l i

[

t

' PBAPS UNIT 2 B 3.3-208 Revision No.

_-s.

RPS Electric Power Monitoring I B 3.3.8.2 i

B 3.3 INSTRUMENTATION i

B 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring i

BASES BACKGROUND RPS Electric Power Monitoring System is provided to isolate the RPS bus from the motor generator (MG) set or an i alternate power supply in the event of overvoltage, undervoltage, or underfrequency. This system protects the loads connected to the RPS bus against unacceptable voltage and frequency conditions (Ref. 1) and forms an important part of the primary success path of the essential safety circuits. Some of the essential equipment powered from the RPS buses includes the RPS logic and scram solenoids.

RPS electric power monitoring assembly will detect any abnormal high or low voltage or low frequency condition in the outputs of the two MG sets or the alternate power supply and will de-energize its respective RPS bus, thereby causing all safety functions normally powered by this bus to de-energize.

In the event of failure of an RPS Electric Power Monitoring System (e.g., both in series electric power monitoring assemblies), the RPS loads may experience significant effects from the unregulated power supply. Deviation from the nominal conditions can potentially cause damage to the scram solenoids and other Class lE devices.

In the event of a low voltage condition, the scram solenoids can chatter and potentially lose their pneumatic control capability, resulting in a loss of primary scram action.

In the event of an overvoltage condition, the RPS logic relays and scram solenoids may experience a voltage higher than their design voltage. If the overvoltage condition persists for an extended time period, it may cause equipment degradation and the loss of plant safety function.

Two redundant Class 1E circuit breakers are connected in series between each RPS bus and its MG set, and between each l RPS bus and its alternate power supply if in service. Each of these circuit breakers has an associated independent set (continued)

PBAPS UNIT 2 B 3.3-209 Revision No.

l

1 RPS Electric Power Monitoring B 3.3.8.2 :

BASES' BACKGROUND. of Class lE overvoltage, undervoltage, underfrequency l (continued) relays, time delay relays (MG sets only), and sensing logic. '

Together, a circuit breaker, its associated relays, and l sensing logic constitute an electric power monitoring 1 assembly. If the output of the MG set or alternate power l supply exceeds predetermined limits of overvoltage, l undervoltage, or underfrequency, a trip coil driven by this logic circuitry opens the circuit breaker, which removes the associated power supply from service.

APPLICABLE ..

The RPS electric power monitoring is necessary to meet the SAFETY ANALYSES assumptions of the safety analyses by ensuring that the equipment powered from the RPS buses can perform its intended function. RPS electric power monitoring provides ,

protection to the RPS components that receive power from the !

RPS buses, by_ acting to disconnect the RPS from the power supply under specified conditions that could damage the RPS equipment.

RPS electric power monitoring satisfies Criterion 3 of the NRC Policy Statement.

LCO The OPERABILITY of each RPS electric power monitoring assembly is dependent on the OPERABILITY of the overvoltage, undervoltage, and underfrequency logic, as well as the OPERABILITY of the associated circuit breaker. Two electric power monitoring assemblies are required to be OPERABLE for ,

each inservice power supply. This provides redundant protection against any abnormal voltage or frequency conditions to ensure that no single RPS electric power monitoring assembly failure can preclude the function of RPS companents. Each inservice electric power monitoring assembly's trip logic setpoints are required to be within the specified Allowable Value. The actual-setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each RPS electric power monitoring assembly trip logic (refer to SR 3.3.8.2.2).

Trip setpoints are specified in design documents. The trip setpoints are selected based on engineering judgement and operational experience tc ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS.

Operation with a trip setting less conservative than the trip setpoint, but within its Allowable Value, is (continued)

PBAPS UNIT 2 8 3.3-210 Revision No.

. _. .- ~ - -.- .. _ - . - - - - . - _ - - .- . . . . - _ - - - . . . .

RPS Electric Power Monitoring B 3.3.8.2 BASES I

LCO acceptable. A channel is inoperable if its actual trip l (continued) setting is not within its required Allowable Value. Trip '

setpoints are those predetermined values of output at which l an action should take place. The setpoints are compared to

! the actual. process parameter (e.g., overvoltage), and when the measured output value of the process parameter exceeds .

the setpoint, the associated device changes state.

l

The overvoltage Allowable Values for the RPS electrical l' power' monitoring assembly trip logic are derived from vendor !

specified voltage requirements.

l The underfrequency Allowable Values for the RPS electrical l power monitoring assembly trip logic are based on tests l l performed at Peach Bottom which concluded that the lowest l L frequency which would be reached was 54.4 Hz in 7.5 to 11.0 3 seconds depending load. Bench tests were also performed on RPS components (HFA relays, scram contactors, and scram solenoid valves) under conditions more severe than those expected in the plant (53 Hz during 11.0~and 15.0 second intervals). Examination of these components concluded that the components functioned correctly under these conditions.

The undervoltage Allowable Values for the RPS electrical power monitoring assembly trip logic were confirmed to be acceptable through testing. Testing has shown the scram pilot solenoid valves can be subjected to voltages below 95 volts with no degradation in their ability to perform their safety function.- It was concluded the RPS logic relays and scram contactors will not be adversely affected by voltage below 95 volts since these components will dropout under these voltage conditions thereby satisfying their safety function.

APPLICABILITY The operation of the RPS electric power monitoring assemblies is essential to disconnect the RPS components from the MG set or alternate power supply during abnormal voltage or frequency conditions. Since the degradation of a 1 nonclass IE source supplying power to the RPS bus can occur as a result of any random single failure, the OPERABILITY of the RPS electric power monitoring assemblies is required when the RPS components are required to be OPERABLE. 'This ,

results in the RPS Electric Power Monitoring System 4 OPERABILITY being required in MODES 1 and 2; anci in MODES 3, 4, and 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies.

(continued)

PBAPS UNIT 2 B 3.3-211 Revision No.

l RPS Electric Power Monitoring B 3.3.8.2 -

BASES (continued)

ACTIONS 8.d

=

If one RPS electric power monitoring assembly for an inserv. ice power supply-(MG set or alternate) is inoperable, or one RPS electric power monitoring assembly on each inservice power supply is inoperable, the OPERABLE assembly will still provide protection to the RPS components under degraded voltage or frequency conditions. However, the reliability and redundancy of the RPS Electric Power Monitoring System is reduced, and only a limited time (72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ) is allowed to restore the inoperable assembly to OPERABLE status. If the inoperable assembly cannot be restored to OPERABLE status, the associated power supply (s) must be removed from service (Required Action A.1). This places the RPS bus in a safe condition. An alternate power supply with~0PERABLE powering monitoring assemblies may then be used to power the RPS bus.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Completion Time takes into account the remaining OPERABLE electric power monitoring assembly and the low probability of an event requiring RPS electric power monitoring protection occurring during this period. It allows time for plant operations personnel to take corrective actions or to place the plant in the required condition in an orderly manner and without challenging plant systems.

Alternately, if it is not desired to remove the power supply from service (e.g., as in the case where removing the power supply (s) from service would result in a scram or isolation), Condition C or D, as applicable, must be entered and its Required Actions taken.

H.d If both power monitoring assemblies for an inservice power supply (MG set or alternate) are inoperable or both power monitoring assemblies in each inservice power supply are inoperable, the system protective function is lost. In this condition, I hour is allowed to restore one assembly to OPERABLE status for each inservice power supply. If one inoperable assembly for each inservice power supply cannot be restored to OPERABLE status, the asw::iated power supply (s) must be removed from service within I hour (Required Action B.1). An alternate power supply with OPERABLE assemblies may then be used to power one RPS bus.

p (continued)

I PBAPS UNIT 2 B 3.3-212 Revision No.

RPS Electric Power Monitoring B 3.3.8.2 BASES ACTIONS M (continued)

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is sufficient for the plant operations personnel to take corrective actions and is acceptable because it minimizes risk while allowing time for restoration or removal from service of the electric power monitoring assemblies.

Alternately, if it is not desired to remove the power supply (s) from service (e.g., as in the case where removing the power supply (s) from service would result in a scram or isolation), Condition C or D, as applicable, must be entered and its Required Actions taken.

C.1 and C.2 If any Required Action and associated Completion Time of Condition A or 8 are not met in MODE 1 or 2, a plant shutdown must be performed. This places the plant in a condition where minimal equipment, powered through the inoperable RPS electric power monitoring assembly (s), is required and ensures that the safety function of the RPS (e.g., scram of control rods) is not required. The plant shutdown is accomplished by placing the plant in MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

M If any Required Action and associated Completion Time of Condition A or B are not met in MODE 3, 4, or 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, the operator must immediately initiate action to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Required Action D.1 results in the least reactive condition for the reactor core and ensures that the safety function of the RPS (e.g., scram of control rods) is not required.

(continued)

PBAPS UNIT 2- B 3.3-213 Revision No.

RPS Electric Power Monitoring B 3.3.8.2 -

BASES (continued)

. SURVEILLANCE SR 3.3.8.2.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed on each overvoltage, undervoltage, and underfrequency channel to ensure that the f entire channel will perform the intended function. Any setpoint adjustment shall be consistent with design documents.

As noted in the Surveillance, the CHANNEL FUNCTIONAL TEST is only required to be performed while the. plant is in a condition in which the loss of the RPS bus will not jeopardize steady state power operation (the design of the system is such that the power source must be removed from service to conduct the Surveillance). As such, this Surveillance is required to be performed when the unit is in MODE 4 for a 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and the test has.not been performed in the previous 184 days. This Surveillance must be performed prior to entering MODE 2 or 3 from MODE 4 if a performance is required. The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is intended to indicate an outage of sufficient duration to allow for scheduling and proper performance of the Surveillance.

The 184 day Frequency and the Note in the Surveillance are based on guidance provided in Generic Letter 91-09 (Ref. 2).

SR 3.3.8.2.2 and SR 3.3.8.2.3 CHANNEL CALIBRATION is a complete check of the relay circuitry and applicable time delay relays. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted between successive calibrations consistent with the plant design documents.

The Frequency is based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.8.2.4 Performance of a system functional test demonstrates that, with a required system actuation (simulated or actual) signal, the logic of the system will automatically trip open the associated power monitoring assembly. Only one signal (continued)

PBAPS UNIT'2 B 3.3-214 Revision No.

RPS Electric Power Monitoring B 3.3.8.2 .

BASES SURVEILLANCE SR 3.3.8.2.4 (continued)

REQUIREMENTS per power monitoring assembly is required to be tested.

This Surveillance overlaps with the CHANNEL CALIBRATION to provide complete testing of the safety function. The system functional test of the Class IE circuit breakers is included as part of this test to provide complete testing of the safety function. If the breakers are incapable of operating, the associated electric power monitoring assembly would be inoperable.

The 24 month Frequency is based on the need to perform tnis Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components will pass the Surveillance when performed at the 24 month Frequency.

REFERENCES 1. UFSAR, Section 7.2.3.2.

2. NRC Generic Letter 91-09, " Modification of Surveillance Interval for the Electrical Protective Assemblies in Power Supplies for the Reactor Protection System."

(

PBAPS UNIT 2 B 3.3-215 Revision No.

1

_ _ _ _ _ _ _

ML20151T042

Text

Navigation menu

Search