ML16280A229: Difference between revisions

From kanterella
Jump to navigation Jump to search
← Older edit
VisualWikitext
Created page by program invented by StriderTol
StriderTol Bot change
 
(2 intermediate revisions by the same user not shown)
Line 2: Line 2:
| number = ML16280A229
| number = ML16280A229
| issue date = 09/19/2016
| issue date = 09/19/2016
| title = Indian Point 2 Improved Technical Specifications Bases
| title = Improved Technical Specifications Bases
| author name =  
| author name =  
| author affiliation = Entergy Nuclear Operations, Inc
| author affiliation = Entergy Nuclear Operations, Inc
Line 17: Line 17:


=Text=
=Text=
{{#Wiki_filter:Indian Point 2 Improved Technical Specifications Bases TECHNICAL SPECIFICATION BASESLIST OF EFFECTIVE SECTIONSBASESSECTION REVNUMBEROF PAGESISSUEDATE TOC 2 304/11/200 7B 2.0  SAFETY LIMITSB 2.1.10311/3/2003B 2.1.20311/3/2003B 3.0 LCO AND SR APPLICABILITYB 3.011811/07/200 6B 3.1 REACTIVITY CONTROL SYSTEMSB 3.1.11512/13/200 4B 3.1.20611/3/2003B 3.1.30611/3/2003 B 3.1.4 01111/3/2003 B 3.1.5 0411/3/2003B 3.1.61 512/10/2003B 3.1.70711/3/2003B 3.1.80611/3/2003B 3.2 POWER DISTRIBUTION LIMITSB 3.2.11601/15/20 14B 3.2.22601/15/201 4B 3.2.30811/3/2003B 3.2.40611/3/2003B 3.3 INSTRUMENTATIONB 3.3.155510/05/200 7B 3.3.243907/31/2014B 3.3.34 1812/20/2012B 3.3.43711/07/200 6B 3.3.521008/21/200 9B 3.3.61912/13/200 4B 3.3.72607/31/201 4B 3.4 REACTOR COOLANT SYSTEMB 3.4.11 411/22/2004B 3.4.20311/3/2003B 3.4.32703/05/20 14B 3.4.41304/11/2007B 3.4.51604/11/2007B 3.4.61504/11/2007B 3.4.72604/11/2007B 3.4.80411/3/2003B 3.4.92504/13/200 6B 3.4.101405/17/2012B 3.4.111705/17/201 2B 3.4.1231407/31/20 14B 3.4.135710/03/2014B 3.4.142 807/31/2014B 3.4.154 707/31/2014B 3.4.163507/31/2008B 3.4.171708/27/20 15B 3.5 ECCSB 3.5.10711/3/2003B 3.5.25 1205/17/2012B 3.5.31 407/31/2014BASESSECTION REVNUMBEROF PAGESISSUEDATEB 3.5.43807/31/2014B 3.6 CONTAINMENT SYSTEMSB 3.6.11412/13/2004B 3.6.22809/16/2005B 3.6.321412/13/2004B 3.6.42308/21/2014B 3.6.53408/21/201 4B 3.6.651208/21/201 4B 3.6.73 307/31/2014B 3.6.81108/10/200 5B 3.6.90611/3/2003B 3.6.1031011/07/200 6B 3.7 PLANT SYSTEMSB 3.7.12 605/17/2012B 3.7.21 805/17/2012B 3.7.35705/17/2012B 3.7.41512/13/2004B 3.7.55912/20/2012B 3.7.61 310/04/2010B 3.7.73 607/31/2014B 3.7.82 707/31/2014B 3.7.91 307/31/2014B 3.7.107 1107/31/2014B 3.7.111312/13/2004B 3.7.122 407/31/2014B 3.7.134 1107/31/2014B 3.7.141312/13/2004B 3.8 ELECTRICAL POWER SYSTEMSB 3.8.17 3007/31/2014B 3.8.22810/05/200 7B 3.8.34 1202/04/2011B 3.8.441008/21/20 14B 3.8.52 508/21/2014B 3.8.61803/24/20 10B 3.8.72 607/31/2014B 3.8.81412/13/2004B 3.8.93 1007/31/2014B 3.8.101412/13/2004B 3.9 REFUELING OPERATIONSB3.9.11407/06/200 6B 3.9.22403/29/20 10B 3.9.31612/21/200 5B 3.9.42405/16/200 7B 3.9.52405/16/200 7B 3.9.61312/13/2004INDIAN POINT 2 Page 1 of 14Revision 50 TECHNICAL SPECIFICATION BASESLIST OF EFFECTIVE SECTIONSApp CBASESSECTION REVNUMBER OF PAGESIssue DateTOC0107/30/2012B 3.0 LCO AND SR APPLICABILITYB 3.00707/30/2012B 3.1 INTER-UNIT  FUEL TRANSFERB 3.1.10407/30/2012B 3.1.20507/30/2012B 3.1.30207/30/2012B 3.1.40307/30/2012B 3.1.50407/30/2012INDIAN POINT 2 Page 2 of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORY REVISION HISTORY FOR BASES AFFECTEDSECTIONS REV EFFECTIVEDATEDESCRIPTIONALL 0 11/3/2003Initial issue of Bases derived from NUREG-1431, in conjunction with Technical Specification Amendment 238 for conversion of 'Current Technical Specifications' to 'Improved Technical Specifications'.BASES UPDATE PACKAGE 01-12102003B 3.1.6 B 3.3.1 B 3.3.2 B 3.3.4 B 3.4.15 B 3.4.16 B 3.5.2 B 3.6.3B 3.6.6B 3.6.10 B 3.7.7 1 12/10/2003Various wording clarifications based on Licensed Operator feedback during trial run of ITS.BASES UPDATE PACKAGE 02-03042004B 3.8.9 1 03/04/2004Remove 'MCC 210' from Table B 3.8.9-1, per 50.59 screenBASES UPDATE PACKAGE 03-08092004B 3.3.1 2 08/09/2004Clarification of testing in bypass, per 50.59 screen.B 3.3.5 1 08/09/2004Clarify requirements for performing a Trip Actuating Device Operational Test (TADOT) on the 480Volt SBO, degraded grid and undervoltage relays, per 50.59 screen.B 3.7.10 1 08/09/2004CRVS Fan terminology correction, per 50.59 screen.B 3.8.7 1 08/09/2004Clarification of inverter operability with frequency out-of-range, per 50.59 screen.B 3.8.9 2 08/09/2004Update Table 3.8.9-1 for safeguards MCC's, per 50.59 screen.B 3.9.4B 3.9.5 1 1 08/09/2004 08/09/2004Installation of a roll-up door on the Containment Equipment Hatch, per 50.59 Evaluation 04-0732-MD RE.INDIAN POINT 2 Page 3 of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORY REVISION HISTORY FOR BASES AFFECTEDSECTIONS REV EFFECTIVEDATEDESCRIPTIONBASES UPDATE PACKAGE 04-10222004B 3.4.71 10/22/2004Clarification on SG coupled to remove residual heat to provide additional operating flexibility while remaining consistent with the guidance of IN 95-35, per 50.59screen.BASES UPDATE PACKAGE 05-11222004B 3.3.2B 3.4.1B 3.4.9 B 3.5.4 2 1 11/22/2004 11/22/2004Stretch Power Uprate (3.26%) from 3114.4 MWth to 3216 MWth.BASES UPDATE PACKAGE 06-12132004B3.1.1 B 3.2.2B 3.3.1B 3.3.2B 3.3.6B 3.3.7 B 3.4.13B 3.4.16B 3.6.1B 3.6.2B 3.6.3 B 3.6.4B 3.6.7 B 3.7.3 B 3.7.4 B 3.7.5B 3.7.7 B 3.7.8 1 3 1 2 1 2 1 2 1 12/13/2004Stretch Power Uprate (3.26%) from 3114.4 MWth to 3216 MWth.INDIAN POINT 2 Page 4 of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORY AFFECTEDSECTIONS REV EFFECTIVEDATEDESCRIPTIONB 3.7.10B 3.7.11B 3.7.14 B 3.8.2B 3.8.5B 3.8.8 B 3.8.10 B 3.9.6 2 1 12/13/2004Continued from previous page Stretch Power Uprate (3.26%) from 3114.4 MWth to 3216 MWth.BASES UPDATE PACKAGE 07-02252005B3.3.1B 3.7.5 4 2 02/25/2005Clarification onthe frequency of Surveillance Requirement 3.3.1.8 to perform a Channel Operational Test (COT) (CR-IP2-2004-04344). Clarification on Surveillance Requirement 3.7.5.3 as it relates to plant condition/frequency of performance of Auxiliary Feedwater Pump full flow testing.BASES UPDATE PACKAGE 08-06102005B 3.5.22 06/10/2005Change the Hot Leg Switchover time from 24 hours to 6.5 hours (as per the latest Westinghouse Power Uprate analyses).BASES UPDATE PACKAGE 09-08102005 TOCB 3.3.3 B 3.3.4 B 3.4.13 B 3.6.8 B 3.7.10 1 1 2
{{#Wiki_filter:}}
2 1
3 08/10/2005TOC, B 3.3.3, B 3.6.8 - Removal of Hydrogen Recombiners from the bases as per Technical Specification Amendment 243.B 3.3.4 - add the circuit breaker and transfer switch designators to the 21 and 22 RHR pump sections.B 3.4.13 - Reference correction -editorial.
B 3.7.10 - Add reference that if the primary coolant source of containment is in question, refer to ITS 5.5.2.BASES UPDATE PACKAGE 10-09162005B 3.6.21 09/16/2005Clarification to reflect the approved TS 5.5.14 which states that the testing program shall be in accordance with RG 1.163.INDIAN POINT 2 Page 5 of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORY AFFECTEDSECTIONS REV EFFECTIVEDATEDESCRIPTIONB 3.6.101 09/16/2005Continued from previous pageUpdate LCO and Condition B to clarify required actions consistent with FSAR.BASES UPDATE PACKAGE 11-11042005B 3.8.11 11/04/2005Include operability criteria for 138 kV and 13.8 kV offsite circuits. BASES UPDATE PACKAGE 12-11102005B 3.7.32 11/10/2005Assess low flow FBVsand low flow FIVs being opened while at power and the single failure of either valve for MSLB (as per 50.59 Evaluation IP2-05-026384). This supplements the SPU analysis.BASES UPDATE PACKAGE 13-12212005B 3.8.1B 3.9.3 2 1 12/21/2005B 3.8.1 - Allow for the performance of offsite power verifications up to 8 hours prior to a planned equipment outage. Clarify the 22 EDG starting air motor redundancy limitations. Provide for establishing EDG operability on one air start motor when one of the redundant air start motors is inoperable and to provide for a staggered surveillance of operable air start motors.B 3.9.3 - Reflect the revised fuel decay time assumption used in the updated fuel handling accident analysis performed for the IP2 Stretch Power Uprate Project.BASES UPDATE PACKAGE 14-02272006B 3.7.33 02/27/2006Reflect the current design of main FW isolation based on cited documents and made to provide operations with clarification (EVL-IP2-05-026384, Analysis CN-CRA 20 (SPU MSLB)INDIAN POINT 2 Page 6 of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORY AFFECTEDSECTIONS REV EFFECTIVEDATEDESCRIPTIONBASES UPDATE PACKAGE 15-04132006B 3.4.9B 3.7.3 2 4 04/13/2006B 3.4.9 - Relaxation of the pressurizer water level limit in Mode 3.B 3.7.3 - Clarification  on electronic valve closure delay assumptions, per 50.59 Evaluation EVL-IP2-05-26384, Rev. 1BASES UPDATE PACKAGE 16-07062006B 3.9.1B 3.9.2 1 1 07/06/2006B 3.9.1 - Clarification on effective method for ensuring shutdown margin.B 3.9.2 - Editorial change to make the bases consistent with TS 3.3.1.BASES UPDATE PACKAGE 17-08152006B 3.3.3B 3.4.15 2 2 08/15/2006B 3.3.3 -Reflect deletion of LT-940 from the TS LCO 3.3.3 (Amendment 249).B 3.4.15 - Remove LT-3303(Sump Mod - 2R17)BASES UPDATE PACKAGE 18-11072006B 3.0B 3.3.4 B 3.6.10 1 3 3 11/07/2006B 3.0 - Reflect allowing a delay time for entering a supported system TS when the inoperability is due solely to an inoperable snubber, if risk is assessed and managed. Limiting Condition of Operation 3.0.8 is added to provide this allowance and define the requirements and limitations of its use.(Amendment 245)B 3.3.4 - Addition of indicators LI-459A and LI-459B toprovide additional Remote Shutdown Instrumentation flexibility.B 3.6.10 - Revise editorial error on B 3.6.10-2to make consistent with page B 3.6.10-9. INDIAN POINT 2 Page 7 of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORYBASES UPDATE PACKAGE 19-02162007B  3.7.12B. 3.7.13 B 3.8.5 1 1 2 02/16/2007B 3.7.12 & B 3.7.13 -Reflect that the validity of the criticality and boron dilution analysis can be extended through end of current license based upon Badger Testing in 2003 and 2006 and Racklife code projections.B 3.8.5 - Clarify LCO bases regarding allowance to cross-connect DC subsystems with the plant in Modes 5 and 6 (CR-IP2-2006-02339).BASES UPDATE PACKAGE 20-04112007 TOCB 3.4.4B 3.4.5 B 3.4.6 B 3.4.7 B 3.4.13 B 3.4.17 B 3.7.5 B 3.8.3 2 1 1
1 2
3 0
3 1 04/11/07TOC, B 3.4.4, B 3.4.5, B 3.4.6, B 3.4.7, B 3.4.13,andB 3.4.17 - Implement TS Amendment 251 related to steam generator tube integrity. B 3.7.5 - Clarify the relationship between the AFW system and a design basis SBLOCA.B 3.8.3 - Revise the wording regarding EDG operating time capability, associated loading and unusable fuel volume to be consistent with UFSAR Section 8.2.3.2BASES UPDATE PACKAGE 21-05162007B 3.9.4B 3.9.5 2 2 05/16/2007Remove use of the roll-up door as a Containment closure device subsequent to loss of RHR cooling in Mode 6.BASES UPDATE PACKAGE 22-08082007B 3.3.33 08/08/2007Identify the TS for functions 5 and 6 as non-conservative and to send the reader to TRM 3.3.K.INDIAN POINT 2 Page 8 of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORYBASES UPDATE PACKAGE 23-10052007B 3.3.1B 3.8.2 5 2 10/05/2007B 3.3.1 - The TS and bases currently allow a normal shutdown without the SR testing by reducing power below the modes of applicability for SR 3.3.1.8. Clarify that testing is not required if such testing was done within the prior 184 days, even if a mode of applicability was still met.B 3.8.2 - Clarify LCO with regard to the required power sources for modes 5 and 6.BASES UPDATE PACKAGE 24-12142007B 3.7.104 12/14/2007List CCRA1 supplying Train B and CCRA2 supplying Train A.BASES UPDATE PACKAGE 25-04112008B 3.6.6B 3.6.7 2 2 04/11/2008B 3.6.6 and B 3.6.7 - Replacement of thetrisodium phosphate buffer by sodium tetraborate(Amendment 253)BASES UPDATE PACKAGE 26-07012008B 3.4.163 07/31/2008Implement the Bases pages of TSTF 490 for dose equivalent iodine (Amendment 254)BASES UPDATE PACKAGE 27-09162008B 3.8.1B 3.8.3 3 2 09/16/2008Reflect installation of Appendix R Diesel and GT removal.BASES UPDATE PACKAGE 28-11172008B 3.5.23 11/17/2008Reflect Amendment 256 approving failure analysis of ECCS valvesBASES UPDATE PACKAGE 29-01202009B 3.4.15B 3.7.10 3 5 01/20/2009Delete VC sump level instruments LT-3304 and LT-941as acceptable RCS leakage detection instrumentsImplement the Bases pages of TSTF 488 for Control Room Envelope Habitability (Amendment 258)INDIAN POINT 2 Page 9 of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORYBASES UPDATE PACKAGE 30-05212009B 3.8.14 05/21/2009Reflect TS Amendment 259(Emergency Diesel Generator Surveillance Test) implementation.BASES UPDATE PACKAGE 31-07282009B 3.5.24 07/28/2009Reflect TS Amendment 257 (Passive Failure Analysis) BASES UPDATE PACKAGE 32-08212009B 3.3.52 08/21/2009Reflect TS Amendment 247 (TADOT)BASES UPDATE PACKAGE 33-09082009B 3.4.3B 3.4.12 1 1 09/08/2009Reflect TS Amendment 262 (Pressure/Temperature Curves)BASES UPDATE PACKAGE 34-10162009B 3.6.51 10/16/2009Clarify the initial containment temperature assumed in the LOCA analysis of record for peak cladding temperature.BASES UPDATE PACKAGE 35-02052010B 3.6.5B 3.8.1B 3.8.4 2 5 1 02/10/2010B 3.6.5 - Clarify that environmental qualification (EQ) temperature inside containment is based on LOCA, and to be consistent with EQ files and IP2 UFSAR.B 3.8.1 - Correct inaccuracies in SR 3.8.1.2 and 3.8.1.3 (CR-IP2-2009-04257).B 3.8.4 - Correct DC transfer switch inaccuracies (CR-IP2-2009-02259).BASES UPDATE PACKAGE 36-03242010B 3.8.4B 3.8.6 2 1 03/24/2010Correct the minimum battery capacity to > 85% and change expected battery life from "approximately 20 years" to "approximately 18 years" as per TS Amendment 264.BASES UPDATE PACKAGE 37-03292010B 3.9.22 03/29/2010Allow use of N-33 Appendix R / Alternate safe shutdown source range when SR power and CR readout added.INDIAN POINT 2 Page 10of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORYBASES UPDATE PACKAGE 38-07142010B 3.7.106 07/14/2010Delete procedure reference to ENN-DC-197 since it is no longer an active procedure.BASES UPDATE PACKAGE 39-10042010B 3.7.1B 3.7.6 B 3.8.3 1 1
3 10/04/2010 10/04/2010 10/04/2010Revise the LCO Bases to indicate transients occur at 102% RTP rather than 100.6% RTPRevise the LCO Bases to indicate transients occur at 102% RTP rather than 100.6% RTPClarify that to meet LCO air start motor must have 250 psig rather than 4 starts.BASES UPDATE PACKAGE 40-02042011B 3.8.34 02/04/2011Revise the Bases to indicates air receiver pressures are analytical limitsBASES UPDATE PACKAGE 41-05172012B 3.4.10B 3.4.11 B 3.4.14 B 3.5.2 B 3.6.6 B 3.7.1 B 3.7.2 B 3.7.3 B 3.7.5 B 3.8.1 1 1
1 5 3 2 1
5 4
6 Revise the Bases to reflect Amendment 267 For ASME Revise the Bases to reflect Amendment 267 For ASME Revise the Bases to reflect Amendment 267 For ASME Revise the Bases to reflect Amendment 267 For ASME Revise the Bases to reflect Amendment 267 For ASME Revise the Bases to reflect Amendment 267 For ASME Revise the Bases to reflect Amendment 267 For ASME Revise the Bases to reflect Amendment 267 For ASMERevise the Bases to reflect Amendment 267 For ASMERevise the Bases to reflect Amendment 267 For ASMEINDIAN POINT 2 Page 11of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORYBASES UPDATE PACKAGE 42-07302012B 3.7.13Appendix C Technical Specification Bases 2 0 07/30/2012 07/30/2012Inter-Unit SpentFuel Transfer - Revised Appendix A Technical Specifications and associatedbasesto reflect Amendment268Inter-UnitSpent Fuel Transfer - AddedAppendix C and associatedbasesto reflect Amendment268BASES UPDATE PACKAGE 43-12202012B 3.3.3B 3.7.5 B 3.7.13 4 5
3 12/20/2012 12/20/2012 12/20/2012Bases change to reflect Amendment 270 sump level indication changesBases changes to clarify AFW pump requirments for less than 100% capacity.Bases change to clarify Badger testing requirements.BASES UPDATE PACKAGE 44 - 12202013B 3.5.42 12/20/2013Bases change to allow RWST valves that isolate non-seismic piping to be opened under administrative control for filtration until the end of RO 22(Amendment 273). BASESUPDATE PACKAGE 45 - 01152014B 3.2.1 B 3.2.2 1 2 01/15/2014 01/15/2014Bases change to clarify that the FQ(Z) measurement uncertainty of 5%is based on 75% availablethimbles. Bases change toclarify that the F N Hmeasurement uncertainty of 4% is based on 75% available thimbles.BASES UPDATE PACKAGE 46 - 03052014B 3.4.3B 3.4.12 2 2 03/05/2014 03/05/2014Bases change to reflect Amendment 274 for 48 EFPY P-T and LTOP limits. Bases change to reflect Amendment 274 for 48 EFPY P-T and LTOP limits.INDIAN POINT 2 Page 12of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORYBASES UPDATE PACKAGE 47 - 07312014B 3.3.2 B 3.3.7 B 3.4.12 B 3.4.13 B 3.4.14 B 3.4.15 B 3.5.3 B 3.5.4 B 3.6.6 B 3.6.7 B 3.7.7 B 3.7.8 B 3.7.9 B 3.7.10 B 3.7.12 B 3.7.13 B 3.8.1 B 3.8.4 B 3.8.7 B 3.8.9 4 2
3 4
2 4
1 3
4 3
3 2
1 7
2 4
7 3
2 3 7/31/20147/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014 7/31/2014Change End State from Mode 5 to Mode 4 Change End State from Mode5 to Mode 4 Clarify single failure for SR 3.4.12.1,2,3 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4Credit for Boraflex Monitoring ProgramCredit for Boraflex Monitoring Program Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4 Change End State from Mode 5 to Mode 4BASES UPDATE PACKAGE 48 - 08212014B 3.6.4 B 3.6.5 2 3 7/21/2014 7/21/2014TS Amend 276 to use 4 FCU TS Amend 276 to use 4 FCUINDIAN POINT 2 Page 13of 14Revision 50 TECHNICAL SPECIFICATION BASESREVISION HISTORYB 3.6.6B 3.8.4 5 4 7/21/2014 7/21/2014TS Amend 276 to use 4 FCU Editorial ChangesBASES UPDATE PACKAGE 49 - 10032014B 3.4.13 5 10/3/2014TS Amendment 177 SG allowable leakage reduced to 85 gallons per day per SGBASES UPDATE PACKAGE 50 - 8272015B 3.4.171 8/27/2015TS Amendment 281 SG Inspection frequencies and tube sample selectionINDIAN POINT 2 Page 14of 14Revision 50 Facility Operating License No. DPR-26 Appendix A - Technical Specifications TABLE OF CONTENTS INDIAN POINT 2 i Revision 2 B.2.0SAFETY LIMITS (SLs) B.2.1.1 Reactor Core SLs B.2.1.2 Reactor Coolant System Pressure SL B.3.0LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY B.3.0SURVEILLANCE REQUIREMENT (SR) APPLICABILITY B.3.1 REACTIVITY CONTROL SYSTEMS B.3.1.1 SHUTDOWN MARGIN (SDM) B.3.1.2 Core Reactivity B.3.1.3 Moderator Temperature Coefficient (MTC) B.3.1.4 Rod Group Alignment Limits B.3.1.5 Shutdown Bank Insertion Limits B.3.1.6 Control Bank Insertion Limits B.3.1.7 Rod Position Indication B.3.1.8 PHYSICS TESTS Exceptions - MODE 2 B.3.2 POWER DISTRIBUTION LIMITS B.3.2.1 Heat Flux Hot Channel Factor (F Q (Z))B.3.2.2 Nuclear Enthalpy Rise Hot Channel Factor (F N H)B.3.2.3 AXIAL FLUX DIFFERENCE (AFD) (Constant Axial Offset Control (CAOC) Methodology) B.3.2.4 QUADRANT POWER TILT RATIO (QPTR) B.3.3 INSTRUMENTATION B.3.3.1 Reactor Protection System (RPS) Instrumentation B.3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation B.3.3.3 Post Accident Monitoring (PAM) Instrumentation B.3.3.4 Remote Shutdown B.3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation B.3.3.6 Containment Purge System and Pressure Relief Line Isolation InstrumentationB.3.3.7 Control Room Ventilation System (CRVS) Actuation Instrumentation B.3.4 REACTOR COOLANT SYSTEM  (RCS)
B.3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits B.3.4.2 RCS Minimum Temperature for Criticality B.3.4.3 RCS Pressure and Temperature (P/T) Limits B.3.4.4 RCS Loops - MODES 1 and 2 B.3.4.5 RCS Loops - MODE 3 B.3.4.6 RCS Loops - MODE 4 B.3.4.7 RCS Loops - MODE 5, Loops Filled B.3.4.8 RCS Loops - MODE 5, Loops Not Filled B.3.4.9 Pressurizer Facility Operating License No. DPR-26 Appendix A - Technical Specifications TABLE OF CONTENTS INDIAN POINT 2 ii Revision 2 B.3.4.10 Pressurizer Safety Valves B.3.4.11 Pressurizer Power Operated Relief Valves (PORVs) B.3.4.12 Low Temperature Overpressure Protection (LTOP)
B.3.4.13 RCS Operational LEAKAGE B.3.4.14 RCS Pressure Isolation Valve (PIV) Leakage B.3.4.15 RCS Leakage Detection Instrumentation B.3.4.16 B.3.4.17RCS Specific Activity Steam Generator (SG) Tube Integrity B.3.5 EMERGENCY CORE COOLING SYSTEM (ECCS)
B.3.5.1 Accumulators B.3.5.2 ECCS - Operating B.3.5.3 ECCS - Shutdown B.3.5.4 Refueling Water Storage Tank (RWST) B.3.6 CONTAINMENT SYSTEMS B.3.6.1 Containment B.3.6.2 Containment Air Locks B.3.6.3 Containment Isolation Valves B.3.6.4 Containment Pressure B.3.6.5 Containment Air Temperature B.3.6.6 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB.3.6.7 Recirculation pH Control System B.3.6.8 Not Used B.3.6.9 Isolation Valve Seal Water (IVSW) System B.3.6.10 Weld Channel and Penetration Pressurization System (WC&PPS) B.3.7 PLANT SYSTEMS B.3.7.1 Main Steam Safety Valves (MSSVs) B.3.7.2 Main Steam Isolation Valves (MSIVs) and Main Steam Check Valves (MSCVs)B.3.7.3 Main Feedwater Isolation B.3.7.4 Atmospheric Dump Valves (ADVs) B.3.7.5 Auxiliary Feedwater (AFW) System B.3.7.6 Condensate Storage Tank (CST) B.3.7.7 Component Cooling Water (CCW) System B.3.7.8 Service Water System (SWS) B.3.7.9 Ultimate Heat Sink (UHS) B.3.7.10 Control Room Ventilation System (CRVS)
B.3.7.11 Spent Fuel Pit Water Level B.3.7.12 Spent Fuel Pit Boron Concentration B.3.7.13 Spent Fuel Pit Storage B.3.7.14 Secondary Specific Activity Facility Operating License No. DPR-26 Appendix A - Technical Specifications TABLE OF CONTENTS INDIAN POINT 2 iii Revision 2 B.3.8 ELECTRICAL POWER SYSTEMS B.3.8.1 AC Sources - Operating B.3.8.2 AC Sources - Shutdown B.3.8.3 Diesel Fuel Oil and Starting Air B.3.8.4 DC Sources - Operating B.3.8.5 DC Sources - Shutdown B.3.8.6 Battery Parameters B.3.8.7 Inverters - Operating B.3.8.8 Inverters - Shutdown B.3.8.9 Distribution Systems - Operating B.3.8.10 Distribution Systems - Shutdown B.3.9 REFUELING OPERATIONS B.3.9.1 Boron Concentration B.3.9.2 Nuclear Instrumentation B.3.9.3 Containment Penetrations B.3.9.4 Residual Heat Removal (RHR) and Coolant Circulation - High Water LevelB.3.9.5 Residual Heat Removal (RHR) and Coolant Circulation - Low Water LevelB.3.9.6 Refueling Cavity Water Level Reactor Core SLs B 2.1.1    INDIAN POINT 2 B 2.1.1 - 1 Revision 0 B 2.0  SAFETY LIMITS (SLs) B 2.1.1 Reactor Core SLs BASES BACKGROUND GDC 10 (Ref. 1) requires that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs). This is accomplished by having a departure from nucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that DNB will not occur and by requiring that fuel centerline temperature stays below the melting temperature.
 
The restrictions of this SL prevent overheating of the fuel and cladding, as well as possible cladding perforation, that would result in the release of fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate (LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime, where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature.
 
Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel is high enough to cause the fuel centerline temperature to reach the melting point of the fuel. Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the point of failure, allowing an uncontrolled release of activity to the reactor coolant.
 
Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature because of the onset of DNB and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.
 
The proper functioning of the Reactor Protection System (RPS) and steam generator safety valves prevents violation of the reactor core SLs.
APPLICABLE SAFETY ANALYSES  The fuel cladding must not sustain damage as a result of normal operation and AOOs. The reactor core SLs are established to preclude violation of the following fuel design criteria:
Reactor Core SLs B 2.1.1 BASES APPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2 B 2.1.1 - 2 Revision 0
: a. There must be at least 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB and
: b. The hot fuel pellet in the core must not experience centerline fuel melting.
The Reactor Protection System allowable value, in combination with all the LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System (RCS) temperature, pressure, RCS Flow, I, and THERMAL POWER level that would result in a departure from nucleate boiling ratio (DNBR) of less than the DNBR limit and preclude the existence of flow instabilities.
 
Automatic enforcement of these reactor core SLs is provided by the appropriate operation of the RPS and the steam generator safety valves.
 
The SLs represent a design requirement for establishing the RPS trip setpoints identified previously. LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits," or the assumed initial conditions of the safety analyses (as indicated in the UFSAR, Ref. 2) provide more restrictive limits to ensure that the SLs are not exceeded.
SAFETY LIMITS The figure provided in the COLR shows the loci of points of THERMAL POWER, RCS pressure, and average temperature for which the minimum DNBR is not less than the safety analyses limit, that fuel centerline temperature remains below melting, that the average enthalpy in the hot leg is less than or equal to the enthalpy of saturated liquid, or that the exit quality is within the limits defined by the DNBR correlation. 
 
The reactor core SLs are established to preclude violation of the following fuel design criteria:
: a. There must be at least a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB and
: b. There must be at least a 95% probability at a 95% confidence level that the hot fuel pellet in the core does not experience centerline fuel melting.
Reactor Core SLs B 2.1.1 BASES SAFETY LIMITS  (continued)
INDIAN POINT 2 B 2.1.1 - 3 Revision 0 The reactor core SLs are used to define the various RPS functions such that the above criteria are satisfied during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs). To ensure that he RPS precludes the violation of the above criteria, additional criteria are applied to the Overtemperature and Overpower T reactor trip functions. That is, it must be demonstrated that the average enthalpy in the hot leg is less than or equal to the saturation enthalpy and the core exit quality is within the limits defined by the DNBR correlation. Appropriate functioning of the RPS ensures that for variations in the THERMAL POWER, RCS Pressure, RCS average temperature, RCS flow rate, and I that the reactor core SLs will be satisfied during steady state operation, normal operational transients, and AOOs.
APPLICABILITY SL 2.1.1 only applies in MODES 1 and 2 because these are the only MODES in which the reactor is critical. Automatic protection functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The steam generator safety valves or automatic protection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate a reactor trip function, which forces the unit into MODE 3. Setpoints for the reactor trip functions are specified in LCO 3.3.1, "Reactor Protection System (RPS) Instrumentation."  In MODES 3, 4, 5, and 6, Applicability is not required since the reactor is not generating significant THERMAL POWER.
SAFETY LIMIT VIOLATIONS The following SL violation responses are applicable to the reactor core SLs.
If SL 2.1.1 is violated, the requirement to go to MODE 3 places the unit in a MODE in which this SL is not applicable.
 
The allowed Completion Time of 1 hour recognizes the importance of bringing the unit to a MODE of operation where this SL is not applicable, and reduces the probability of fuel damage. REFERENCES 1. 10 CFR 50, Appendix A, GDC 10.
: 2. UFSAR, Section 3.2.
RCS Pressure SL B 2.1.2    INDIAN POINT 2 B 2.1.2 - 1 Revision 0 B 2.0  SAFETY LIMITS (SLs) B 2.1.2 Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND The SL on RCS pressure protects the integrity of the RCS against overpressurization. In the event of fuel cladding failure, fission products are released into the reactor coolant. The RCS then serves as the primary barrier in preventing the release of fission products into the atmosphere. By establishing an upper limit on RCS pressure, the continued integrity of the RCS is ensured. According to 10 CFR 50, Appendix A, GDC 14, "Reactor Coolant Pressure Boundary," and GDC 15, "Reactor Coolant System Design" (Ref. 1), the reactor coolant pressure boundary (RCPB) design conditions are not to be exceeded during normal operation and anticipated operational occurrences (AOOs). Also, in accordance with GDC 28, "Reactivity Limits" (Ref. 1), reactivity accidents, including rod ejection, do not result in damage to the RCPB greater than limited local yielding.
 
The design pressure of the RCS is 2485 psig. During normal operation and AOOs, RCS pressure is limited from exceeding the design pressure by more than 10%, in accordance with Section III of the ASME Code (Ref. 2). To ensure system integrity, all RCS components are hydrostatically tested at 125% of design pressure, according to the ASME Code requirements prior to initial operation when there is no fuel in the core. Following inception of unit operation, RCS components shall be pressure tested, in accordance with the requirements of ASME Code, Section XI (Ref. 3).
 
Overpressurization of the RCS could result in a breach of the RCPB. If such a breach occurs in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere, raising concerns relative to limits on radioactive releases specified in 10 CFR 50.67, "Accident Source Term" (Ref. 4).
APPLICABLE SAFETY ANALYSES The RCS pressurizer safety valves, the main steam safety valves (MSSVs),
and the reactor high pressure trip have settings established to ensure that the RCS pressure SL will not be exceeded.
 
The RCS pressurizer safety valves are sized to prevent system pressure from exceeding the design pressure by more than 10%, as specified in Section III of the ASME Code for Nuclear Power Plant Components (Ref. 2).
The transient that establishes the required relief capacity, and hence valve size requirements and lift settings, is a complete loss of external load without a direct reactor trip. During the transient, no control actions are assumed, RCS Pressure SL B 2.1.2 BASES APPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 2.1.2 - 2 Revision 0 except that the safety valves on the secondary plant are assumed to open when the steam pressure reaches the secondary plant safety valve settings, and nominal feedwater supply is maintained.
 
The Reactor Protection System allowable values, together with the settings of the MSSVs, provide pressure protection for normal operation and AOOs.
The reactor high pressure allowable value is specifically set to provide protection against overpressurization (Ref. 5). The safety analyses for both the high pressure trip and the RCS pressurizer safety valves are performed using conservative assumptions relative to pressure control devices.
 
More specifically, no credit is taken for operation of any of the following:
: a. Pressurizer power operated relief valves (PORVs),
: b. Atmospheric Dump Valves (ADVs),
: c. Steam Dump System,
: d. Rod Control System,
: e. Pressurizer Level Control System, or
: f. Pressurizer spray valve.
 
SAFETY LIMITS The maximum transient pressure allowed in the RCS pressure vessel under the ASME Code, Section III, is 110% of design pressure. The maximum transient pressure allowed in the RCS piping, valves, and fittings under USAS, Section B31.1 (Ref. 6) is 120% of design pressure. The most limiting of these two allowances is the 110% of design pressure; therefore, the SL on maximum allowable RCS pressure is 2735 psig.
APPLICABILITY SL 2.1.2 applies in MODES 1, 2, 3, 4, and 5 and in MODE 6 when the reactor vessel head is on because this SL could be approached or exceeded in these MODES due to overpressurization events. The SL is not applicable in MODE 6 because when the reactor vessel head is removed the RCS can not be pressurized.
 
RCS Pressure SL B 2.1.2 BASES INDIAN POINT 2 B 2.1.2 - 3 Revision 0 SAFETY LIMIT VIOLATIONS If the RCS pressure SL is violated when the reactor is in MODE 1 or 2, the requirement is to restore compliance and be in MODE 3 within 1 hour.
 
Exceeding the RCS pressure SL may cause immediate RCS failure and create a potential for radioactive releases in excess of 10 CFR 50.67, "Accident Source Term," limits (Ref. 4).
 
The allowable Completion Time of 1 hour recognizes the importance of reducing power level to a MODE of operation where the potential for challenges to safety systems is minimized.
 
If the RCS pressure SL is exceeded in MODE 3, 4, 5 or 6, RCS pressure must be restored to within the SL value within 5 minutes. Exceeding the RCS pressure SL in MODE 3, 4, 5 or 6 is more severe than exceeding this SL in MODE 1 or 2, since the reactor vessel temperature may be lower and the vessel material, consequently, less ductile. As such, pressure must be reduced to less than the SL within 5 minutes. The action does not require reducing MODES, since this would require reducing temperature, which would compound the problem by adding thermal gradient stresses to the existing pressure stress. REFERENCES 1. 10 CFR 50, Appendix A, GDC 14, GDC 15, and GDC 28.
: 2. ASME, Boiler and Pressure Vessel Code, Section III, Article NB-7000.
: 3. ASME, Boiler and Pressure Vessel Code, Section XI, Article IWX-5000.
: 4. 10 CFR 50.67.
: 5. UFSAR, Section 7.2.
: 6. USAS B31.1, Standard Code for Pressure Piping, American Society of Mechanical Engineers, 1967.
 
LCO Applicability B 3.0 INDIAN POINT 2 B 3.0 - 1 Revision 1 B 3.0  LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASESLCOsLCO 3.0.1 through LCO 3.0.8 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated. LCO  3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification). LCO  3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered. The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that: a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification and b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified. There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. If this type of Required Action is not completed within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in which the Specification is not applicable.  (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.)  The second type of Required Action specifies the remedial measures that permit continued operation of the unit that is not further restricted by the Completion Time. In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation.
LCO  Applicability B 3.0 BASESLCO  3.0.2  (continued) INDIAN POINT 2 B 3.0 - 2 Revision 1 Completing the Required Actions is not required when an LCO is met or is no longer applicable, unless otherwise stated in the individual Specifications. The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Conditions no longer exist. The individual LCO's ACTIONS specify the Required Actions where this is the case. An example of this is in LCO 3.4.3, "RCS Pressure and Temperature (P/T)
Limits."The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The reasons for intentionally relying on the ACTIONS include, but are not limited to, performance of Surveillances, preventive maintenance, corrective maintenance, or investigation of operational problems. Entering ACTIONS for these reasons must be done in a manner that does not compromise safety. Intentional entry into ACTIONS should not be made for operational convenience. Additionally, if intentional entry into ACTIONS would result in redundant equipment being inoperable, alternatives should be used instead.
Doing so limits the time both subsystems/trains of a safety function are inoperable and limits the time conditions exist which may result in LCO 3.0.3 being entered. Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed. When a change in MODE or other specified condition is required to comply with Required Actions, the unit may enter a MODE or other specified condition in which another Specification becomes applicable. In this case, the Completion Times of the associated Required Actions would apply from the point in time that the new Specification becomes applicable, and the ACTIONS Condition(s) are entered. LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met and either: a. An associated Required Action and Completion Time is not met and no other Condition applies or LCO  Applicability B 3.0 BASESLCO  3.0.3  (continued) INDIAN POINT 2 B 3.0 - 3 Revision 1 b. The condition of the unit is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately. This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its ACTIONS.
It is not intended to be used as an operational convenience that permits routine voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable. Upon entering LCO 3.0.3, 1 hour is allowed to prepare for an orderly shutdown before initiating a change in unit operation. This includes time to permit the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit, assuming that only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the Reactor Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times. A unit shutdown required in accordance with LCO 3.0.3 may be terminated and LCO 3.0.3 exited if any of the following occurs: a. The LCO is now met,
: b. A Condition exists for which the Required Actions have now been performed, or c. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.
LCO  Applicability B 3.0 BASESLCO  3.0.3  (continued) INDIAN POINT 2 B 3.0 - 4 Revision 1 The time limits of LCO 3.0.3 allow 37 hours for the unit to be in MODE 5 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE applies. If a lower MODE is reached in less time than allowed, however, the total allowable time to reach MODE 5, or other applicable MODE, is not reduced.For example, if MODE 3 is reached in 2 hours, then the time allowed for reaching MODE 4 is the next 11 hours, because the total time for reaching MODE 4 is not reduced from the allowable limit of 13 hours. Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed. In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 5 and 6 because the unit is already in the most restrictive Condition required by LCO 3.0.3. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken. Exceptions to LCO 3.0.3 are provided in instances where requiring a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in LCO 3.7.11, "Spent Fuel Pit Water Level."  LCO 3.7.11 has an Applicability of "During movement of irradiated fuel assemblies in the spent fuel pit."  Therefore, this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.11 are not met while in MODE 1, 2, or 3, there is no safety benefit to be gained by placing the unit in a shutdown condition. The Required Action of LCO 3.7.11 of "Suspend movement of irradiated fuel assemblies in the spent fuel pit" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3.
These exceptions are addressed in the individual Specifications. LCO  3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a MODE or other specified condition stated in that Applicability (e.g.,
the Applicability desired to be entered) when unit conditions are such that the requirements of the LCO would not be met, in accordance with LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.
LCO  Applicability B 3.0 BASESLCO  3.0.4  (continued) INDIAN POINT 2 B 3.0 - 5 Revision 1 LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be entered permit continued operation in the MODE or other specified condition in the Applicability for an unlimited period of time. Compliance with Required Actions that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change. Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made in accordance with the provisions of the Required Actions. LCO 3.0.4.b allows entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, if appropriate. The risk assessment may use quantitative, qualitative, or blended approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4),
which requires that risk impacts of maintenance activities to be assessed and managed. The risk assessment, for the purposes of LCO 3.0.4 (b),
must take into account all inoperable Technical Specification equipment regardless of whether the equipment is included in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk assessments will be conducted using the procedures and guidance endorsed by Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants."  Regulatory Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to plan and conduct other activities in a manner that controls overall risk, increased risk awareness by shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable. Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability.
LCO  Applicability B 3.0 BASESLCO  3.0.4  (continued) INDIAN POINT 2 B 3.0 - 6 Revision 1 LCO 3.0.4.b may be used with single, or multiple systems and components unavailable. NUMARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components.The results of the risk assessment shall be considered in determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented. The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the Completion Time. Since this is allowable, and since in general the risk impact in that particular MODE bounds the risk of transitioning into and through the applicable MODES or other specified conditions in the Applicability of the LCO, the use of the LCO 3.0.4.b allowance should be generally acceptable, as long as the risk is assessed and managed as stated above. However, there is a small subset of systems and components that have been determined to be more important to risk and use of the LCO 3.0.4.b allowance is prohibited. The LCOs governing these system and components contain Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not applicable. LCO 3.0.4.c allows entry into a MODE or other specified condition in the Applicability with the LCO not met based on a Note in the Specification which states LCO 3.0.4.c is applicable. These specific allowances permit entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time and a risk assessment has not been performed. This allowance may apply to all the ACTIONS or to a specific Required Action of a Specification. The risk assessments performed to justify the use of LCO 3.0.4.b usually only consider systems and components. For this reason, LCO 3.0.4.c is typically applied to Specifications which describe values and parameters (e.g., RCS specific Activity), and may be applied to other Specifications based on NRC plant-specific approval. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.
LCO  Applicability B 3.0 BASESLCO  3.0.4  (continued) INDIAN POINT 2 B 3.0 - 7 Revision 1 The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5. Upon entry into a MODE or other specified condition in the Applicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the applicable Conditions and Required Actions until the Condition is resolved, until the LCO is met, or until the unit is not within the Applicability of the Technical Specification.Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for any Surveillances that have not been performed on inoperable equipment. However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO. LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate either: a. The OPERABILITY of the equipment being returned to service or
: b. The OPERABILITY of other equipment.
The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the required testing to demonstrate OPERABILITY. This Specification does not provide time to perform any other preventive or corrective maintenance.
LCO  Applicability B 3.0 BASESLCO  3.0.5  (continued) INDIAN POINT 2 B 3.0 - 8 Revision 1 An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the required testing. An example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of required testing on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system. LCO  3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the unit is maintained in a safe condition are specified in the support system LCO's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions. When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability.
However, it is not necessary to enter into the supported systems' Conditions and Required Actions unless directed to do so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCOs' Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the unit is maintained in a safe condition in the support system's Required Actions.
LCO  Applicability B 3.0 BASESLCO  3.0.6  (continued) INDIAN POINT 2 B 3.0 - 9 Revision 1 However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system. This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2. Technical Specification 5.5.13, "Safety Function Determination Program (SFDP)," ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6. Cross train checks to identify a loss of safety function for those support systems that support multiple and redundant safety systems are required.
The cross train check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained. A loss of safety function may exist when a support system is inoperable, and: a. A required system redundant to system(s) supported by the inoperable support system is also inoperable,b. A required system redundant to system(s) in turn supported by the inoperable supported system is also inoperable, or c. A required system redundant to support system(s) for the supported systems (a) and (b) above is also inoperable. If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.
LCO  Applicability B 3.0 BASESLCO  3.0.6  (continued) INDIAN POINT 2 B 3.0 - 10 Revision 1 This loss of safety function does not require the assumption of additional single failures or loss of offsite power. Since operations is being restricted in accordance with the ACTIONS of the support system, any resulting temporary loss of redundancy or single failure protection is taken into account. Similarly, the ACTIONS for inoperable offsite circuit(s) and inoperable diesel generator(s) provide the necessary restriction for cross train inoperabilities. This explicit cross train verification for inoperable AC electrical power sources also acknowledges that supported system(s) are not declared inoperable solely as a result of inoperability of a normal or emergency electrical power source (refer to the definition of OPERABILITY). When a loss of safety function is determined to exist, and the SFDP requires entry into the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists, consideration must be given to the specific type of function affected. Where a loss of function is solely due to a single Technical Specification support system (e.g., loss of automatic start due to inoperable instrumentation, or loss of pump suction source due to low tank level) the appropriate LCO is the LCO for the support system. The ACTIONS for a support system LCO adequately addresses the inoperabilities of that system without reliance on entering its supported system LCO. When the loss of function is the result of multiple support systems, the appropriate LCO is the LCO for the supported system. LCO  3.0.7 There are certain special tests and operations required to be performed at various times over the life of the unit. These special tests and operations are necessary to demonstrate select unit performance characteristics, to perform special maintenance activities, and to perform special evolutions.
Test Exception LCO 3.1.8 allows specified Technical Specification (TS) requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS. Unless otherwise specified, all the other TS requirements remain unchanged. This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect.
LCO  Applicability B 3.0 BASESLCO  3.0.7  (continued) INDIAN POINT 2 B 3.0 - 11 Revision 1 The Applicability of a Test Exception LCO represents a condition not necessarily in compliance with the normal requirements of the TS.
Compliance with Test Exception LCOs is optional. A special operation may be performed either under the provisions of the appropriate Test Exception LCO or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the Test Exception LCO, the requirements of the Test Exception LCO shall be followed. LCO 3.0.8 LCO 3.0.8 establishes conditions under which systems are considered to remain capable of performing their intended safety function when associated snubbers are not capable of providing their associated support function(s). This LCO states that the supported system is not considered to be inoperable solely due to one or more snubbers not capable of performing their associated support function(s). This is appropriate because a limited length of time is allowed for maintenance, testing, or repair of one or more snubbers not capable of performing their associated support function(s) and appropriate compensatory measures are specified in the snubber requirements, which are located outside of the Technical Specifications (TS) under licensee control. The snubber requirements do not meet the criteria in 10 CFR 50.36(c)(2)(ii), and, as such, are appropriate for control by the licensee.If the allowed time expires and the snubber(s) are unable to perform their associated support function(s), the affected supported system's LCO(s) must be declared not met and the Conditions and Required Actions entered in accordance with LCO 3.0.2. LCO 3.0.8.a applies when one or more snubbers are not capable of providing their associated support function(s) to a single train or subsystem of a multiple train or subsystem supported system or to a single train or subsystem supported system. LCO 3.0.8.a allows 72 hours to restore the snubber(s) before declaring the supported system inoperable. The 72 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function and due to the availability of the redundant train of the supported system.
LCO  Applicability B 3.0 BASESLCO  3.0.8  (continued) INDIAN POINT 2 B 3.0 - 12 Revision 1 LCO 3.0.8.b applies when one or more snubbers are not capable of providing their associated support function(s) to more than one train or subsystem of a multiple train or subsystem supported system. LCO 3.0.8.b allows 12 hours to restore the snubber(s) before declaring the supported system inoperable. The 12 hour Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function. LCO 3.0.8 requires that risk be assessed and managed. Industry and NRC guidance on the implementation of 10 CFR 50.65(a)(4) (the Maintenance Rule) does not address seismic risk. However, use of LCO 3.0.8 should be considered with respect to other plant maintenance activities, and integrated into the existing Maintenance Rule process to the extent possible so that maintenance on any unaffected train or subsystem is properly controlled, and emergent issues are properly addressed. The risk assessment need not be quantified, but may be a qualitative awareness of the vulnerability of systems and components when one or more snubbers are not able to perform their associated support function.
SR  Applicability B 3.0 INDIAN POINT 2 B 3.0 - 13 Revision 1 B 3.0  SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SRsSR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated. SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO.Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:a. The systems or components are known to be inoperable, although still meeting the SRs; or b. The requirements of the Surveillance(s) are known not to be met between required Surveillance performances. Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a test exception are only applicable when the test exception is used as an allowable exception to the requirements of a Specification. Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given SR. In this case, the unplanned event may be credited as fulfilling the performance of the SR. This allowance includes those SRs whose performance is normally precluded in a given MODE or other specified condition.
SR Applicability B 3.0 BASESSR  3.0.1  (continued) INDIAN POINT 2 B 3.0 - 14 Revision 1 Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status. Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed. Some examples of this process are:
: a. Auxiliary feedwater (AFW) pump turbine maintenance during refueling that requires testing at steam pressures > 800 psi. However, if other appropriate testing is satisfactorily completed, the AFW System can be considered OPERABLE. This allows startup and other necessary testing to proceed until the plant reaches the steam pressure required to perform the testing.b. High pressure safety injection (HPI) maintenance during shutdown that requires system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with HPI considered OPERABLE. This allows operation to reach the specified pressure to complete the necessary post maintenance testing. SR  3.0.2 SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a "once per . . ."
interval.
SR  Applicability B 3.0 BASESSR  3.0.2  (continued) INDIAN POINT 2 B 3.0 - 15 Revision 1 SR 3.0.2 permits a 25% extension of the interval specified in the Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25%
extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications. The requirements of regulations take precedence over the TS. An example of where SR 3.0.2 does not apply is in the Containment Leakage Rate Testing Program. This program establishes testing requirements and Frequencies in accordance with the requirements of regulations. The TS cannot in and of themselves extend a test interval specified in the regulations. As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per ..." basis. The 25% extension applies to each performance after the initial performance.
The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25%
extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner. The provisions of SR 3.0.2 are not intended to be used repeatedly merely as an operational convenience to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified. SR  3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified Frequency. A delay period of up to 24 hours or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met.
SR  Applicability B 3.0 BASESSR  3.0.3  (continued) INDIAN POINT 2 B 3.0 - 16 Revision 1 This delay period provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with Required Actions or other remedial measures that might preclude completion of the Surveillance. The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements. When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.
SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions. Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals. While up to 24 hours or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance.
This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants."  This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk SR  Applicability B 3.0 BASESSR  3.0.3  (continued) INDIAN POINT 2 B 3.0 - 17 Revision 1 management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the Corrective Action Program. If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance. Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1. SR  3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability. This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.A provision is included to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4.
SR  Applicability B 3.0 BASESSR  3.0.4  (continued) INDIAN POINT 2 B 3.0 - 18 Revision 1 However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability. However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes. SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3. The provisions of SR 3.0.4 shall not prevent entry into MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2, MODE 2 to MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5. The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO's Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met. Alternately, the Surveillance may be stated in the form of a Note, as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.
SDMB 3.1.1 INDIAN POINT 2 B 3.1.1 - 1 Revision 1 B 3.1  REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM) BASESBACKGROUND According to GDC 26 (Ref. 1), the reactivity control systems must be redundant and capable of holding the reactor core subcritical when shut down under cold conditions. Maintenance of the SDM ensures that postulated reactivity events will not damage the fuel. SDM requirements provide sufficient reactivity margin to ensure that acceptable fuel design limits will not be exceeded for normal shutdown and anticipated operational occurrences (AOOs). As such, the SDM defines the degree of subcriticality that would be obtained immediately following the insertion or scram of all shutdown and control rods, assuming that the single rod cluster assembly of highest reactivity worth is fully withdrawn. The system design requires that two independent reactivity control systems be provided, and that one of these systems be capable of maintaining the core subcritical under cold conditions. These requirements are provided by the use of movable control assemblies and soluble boric acid in the Reactor Coolant System (RCS). The Control Rod System can compensate for the reactivity effects of the fuel and water temperature changes accompanying power level changes over the range from full load to no load. In addition, the Control Rod System, together with the boration system, provides the SDM during power operation and is capable of making the core subcritical rapidly enough to prevent exceeding acceptable fuel damage limits, assuming that the rod of highest reactivity worth remains fully withdrawn. The soluble boron system can compensate for fuel depletion during operation and all xenon burnout reactivity changes and maintain the reactor subcritical under cold conditions. During power operation, SDM control is ensured by operating with the shutdown banks within the limits of LCO 3.1.5, "Shutdown Bank Insertion Limits," and the control banks within the limits of LCO 3.1.6, "Control Bank Insertion Limits."  When the unit is in the shutdown and refueling modes, the SDM requirements are met by means of adjustments to the RCS boron concentration.
SDMB 3.1.1 BASESINDIAN POINT 2 B 3.1.1 - 2 Revision 1 APPLICABLESAFETY ANALYSESThe minimum required SDM is assumed as an initial condition in safety analyses. The safety analysis (Ref. 2) establishes an SDM that ensures specified acceptable fuel design limits are not exceeded for normal operation and AOOs, with the assumption of the highest worth rod stuck out on scram.
For MODE 5, the primary safety analysis that relies on the SDM limits is the boron dilution analysis. The acceptance criteria for the SDM requirements are that specified acceptable fuel design limits are maintained. This is done by ensuring that: a. The reactor can be made subcritical from all operating conditions, transients, and Design Basis Events, b. The reactivity transients associated with postulated accident conditions are controllable within acceptable limits (departure from nucleate boiling ratio (DNBR), fuel centerline temperature limits for AOOs, and energy deposition of  200 cal/gm for irradiated or non-irradiated fuel  to satisfy requirements for the rod ejection accident), and c. The reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the shutdown condition. The most limiting accident for the SDM requirements is based on a main steam line break (MSLB), as described in the accident analysis (Ref. 2).
The increased steam flow resulting from a pipe break in the main steam system causes an increased energy removal from the affected steam generator (SG), and consequently the RCS. This results in a reduction of the reactor coolant temperature. The resultant coolant shrinkage causes a reduction in pressure. In the presence of a negative moderator temperature coefficient, this cooldown causes an increase in core reactivity. As RCS temperature decreases, the severity of an MSLB decreases until the MODE 5 value is reached. The most limiting MSLB, with respect to potential fuel damage before a reactor trip occurs, is a guillotine break of a main steam line inside containment initiated at the end of core life. The positive reactivity addition from the moderator temperature decrease will terminate when the affected SG boils dry, thus terminating RCS heat removal and cooldown. Following the MSLB, a post trip return to power may occur; however, no fuel damage occurs as a result of the post trip return to power, and THERMAL POWER does not violate the Safety Limit (SL) requirement of SL 2.1.1. In addition to the limiting MSLB transient, the SDM requirement must also protect against:
SDMB 3.1.1 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.1.1 - 3 Revision 1 a. Inadvertent boron dilution, b. An uncontrolled rod withdrawal from subcritical or low power condition,
: c. Startup of an inactive reactor coolant pump (RCP), and
: d. Rod ejection.
Each of these events is discussed below.
In the boron dilution analysis, the required SDM defines the reactivity difference between an initial subcritical boron concentration and the corresponding critical boron concentration. These values, in conjunction with the configuration of the RCS and the assumed dilution flow rate, directly affect the results of the analysis. This event is most limiting at the beginning of core life, when critical boron concentrations are highest. Depending on the system initial conditions and reactivity insertion rate, the uncontrolled rod withdrawal transient is terminated by either a high source range, intermediate range, power range-low, or power range-high trip. In all cases, power level, RCS pressure, linear heat rate, and the DNBR do not exceed allowable limits. The startup of an inactive RCP will not result in a "cold water" criticality, even if the maximum difference in temperature exists between the SG and the core. The maximum positive reactivity addition that can occur due to an inadvertent RCP start is less than half the minimum required SDM. Startup of an idle RCP cannot, therefore, produce a return to power from the hot standby condition.The ejection of a control rod rapidly adds reactivity to the reactor core, causing both the core power level and heat flux to increase with corresponding increases in reactor coolant temperatures and pressure. The ejection of a rod also produces a time dependent redistribution of core power.SDM satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Even though it is not directly observed from the control room, SDM is considered an initial condition process variable because it is periodically monitored to ensure that the unit is operating within the bounds of accident analysis assumptions.
SDMB 3.1.1 BASESINDIAN POINT 2 B 3.1.1 - 4 Revision 1 LCO SDM is a core design condition that can be ensured during operation through control rod positioning (control and shutdown banks) and through the soluble boron concentration. The MSLB (Ref. 2) and the boron dilution (Ref. 2) accidents are the most limiting analyses that establish the SDM value of the LCO. For MSLB accidents, if the LCO is violated, there is a potential to exceed the DNBR limit and to exceed 10 CFR 50.67, "Alternate Source Term," limits (Ref. 3).
For the boron dilution accident, if the LCO is violated, the minimum required time assumed for operator action to terminate dilution may no longer be applicable.APPLICABILITY In MODE 2 with k eff < 1.0 and in MODES 3, 4, and 5, the SDM requirements are applicable to provide sufficient negative reactivity to meet the assumptions of the safety analyses discussed above. In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, "Boron Concentration."  In MODES 1 and 2, SDM is ensured by complying with LCO 3.1.5, "Shutdown Bank Insertion Limits," and LCO 3.1.6, "Control Bank Insertion Limits." ACTIONS A.1If the SDM requirements are not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that boration will be continued until the SDM requirements are met. In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied.
Since it is imperative to raise the boron concentration of the RCS as soon as possible, the boron concentration should be a highly concentrated solution, such as that normally found in the boric acid storage tank, or the refueling water storage tank. The operator should borate with the best source available for the plant conditions. SURVEILLANCE SR  3.1.1.1 REQUIREMENTSIn MODES 1 and 2 with K eff 1.0, SDM is verified by observing that the requirements of LCO 3.1.5 and LCO 3.1.6 are met. In the event that a rod is known to be untrippable, however, SDM verification must account for the worth of the untrippable rod as well as another rod of maximum worth.
SDMB 3.1.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.1.1 - 5 Revision 1 In MODES 3, 4, and 5, the SDM is verified by performing a reactivity balance calculation, considering the listed reactivity effects: a. RCS boron concentration,
: b. Control rod position,
: c. RCS average temperature,
: d. Fuel burnup based on gross thermal energy generation,
: e. Xenon concentration,
: f. Samarium concentration, and
: g. Isothermal temperature coefficient (ITC).
Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical, and the fuel temperature will be changing at the same rate as the RCS. The Frequency of 24 hours is based on the generally slow change in required boron concentration and the low probability of an accident occurring without the required SDM. This allows time for the operator to collect the required data, which includes performing a boron concentration analysis, and complete the calculation. REFERENCES 1. 10 CFR 50, Appendix A. 2. UFSAR, Chapter 14. 3. 10 CFR 50.67.
Core Reactivity B 3.1.2    INDIAN POINT 2 B 3.1.2 - 1 Revision 0 B 3.1  REACTIVITY CONTROL SYSTEMS B 3.1.2 Core Reactivity BASES BACKGROUND According to GDC 26, GDC 28, and GDC 29 (Ref. 1), reactivity shall be controllable, such that subcriticality is maintained under cold conditions, and acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences. Therefore, reactivity balance is used as a measure of the predicted versus measured core reactivity during power operation. The periodic confirmation of core reactivity is necessary to ensure that Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity difference could be the result of unanticipated changes in fuel, control rod worth, or operation at conditions not consistent with those assumed in the predictions of core reactivity, and could potentially result in a loss of SDM or violation of acceptable fuel design limits.
Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought safely to cold, subcritical conditions.
 
When the reactor core is critical or in normal power operation, a reactivity balance exists and the net reactivity is zero. A comparison of predicted and measured reactivity is convenient under such a balance, since parameters are being maintained relatively stable under steady state power conditions.
The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons, such as burnable absorbers producing zero net reactivity. Excess reactivity can be inferred from the boron letdown curve (or critical boron curve), which provides an indication of the soluble boron concentration in the Reactor Coolant System (RCS) versus cycle burnup. Periodic measurement of the RCS boron concentration for comparison with the predicted value with other variables fixed (such as rod height, temperature, pressure, and power), provides a convenient method of ensuring that core reactivity is within design expectations and that the calculational models used to generate the safety analysis are adequate.
 
In order to achieve the required fuel cycle energy output, the uranium enrichment, in the new fuel loading and in the fuel remaining from the previous cycle, provides excess positive reactivity beyond that required to sustain steady state operation throughout the cycle. When the reactor is Core Reactivity B 3.1.2  BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.1.2 - 2 Revision 0 critical at RTP and moderator temperature, the excess positive reactivity is compensated by burnable absorbers (if any), control rods, whatever neutron poisons (mainly xenon and samarium) are present in the fuel, and the RCS boron concentration.
 
When the core is producing THERMAL POWER, the fuel is being depleted and excess reactivity is decreasing. As the fuel depletes, the RCS boron concentration is reduced to decrease negative reactivity and maintain constant THERMAL POWER. The boron letdown curve is based on steady state operation at RTP. Therefore, deviations from the predicted boron letdown curve may indicate deficiencies in the design analysis, deficiencies in the calculational models, or abnormal core conditions, and must be evaluated. APPLICABLE SAFETY ANALYSES The acceptance criteria for core reactivity are that the reactivity balance limit ensures plant operation is maintained within the assumptions of the safety analyses.
 
Accurate prediction of core reactivity is either an explicit or implicit assumption in the accident analysis evaluations. Every accident evaluation (Ref. 2) is, therefore, dependent upon accurate evaluation of core reactivity.
In particular, SDM and reactivity transients, such as control rod withdrawal accidents or rod ejection accidents, are very sensitive to accurate prediction of core reactivity. These accident analysis evaluations rely on computer codes that have been qualified against available test data, operating plant data, and analytical benchmarks. Monitoring reactivity balance additionally ensures that the nuclear methods provide an accurate representation of the core reactivity.
 
Design calculations and safety analyses are performed for each fuel cycle for the purpose of predetermining reactivity behavior and the RCS boron concentration requirements for reactivity control during fuel depletion.
 
The comparison between measured and predicted initial core reactivity provides normalization for the calculational models used to predict core reactivity. If the measured and predicted RCS boron concentrations for identical core conditions at beginning of cycle (BOC) do not agree, then the assumptions used in the reload cycle design analysis or the calculational models used to predict soluble boron requirements may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured boron Core Reactivity B 3.1.2  BASES APPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.1.2 - 3 Revision 0 concentration. Thereafter, any significant deviations in the measured boron concentration from the predicted boron letdown curve that develop during fuel depletion may be an indication that the calculational model is not adequate for core burnups beyond BOC, or that an unexpected change in core conditions has occurred.
 
The normalization of predicted RCS boron concentration to the measured value is typically performed after reaching RTP following startup from a refueling outage, with the control rods in their normal positions for power operation. The normalization is performed at BOC conditions, so that core reactivity relative to predicted values can be continually monitored and evaluated as core conditions change during the cycle.
 
Core reactivity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). LCO Long term core reactivity behavior is a result of the core physics design and cannot be easily controlled once the core design is fixed. During operation, therefore, the LCO can only be ensured through measurement and tracking, and appropriate actions taken as necessary. Large differences between actual and predicted core reactivity may indicate that the assumptions of the DBA and transient analyses are no longer valid, or that the uncertainties in the Nuclear Design Methodology are larger than expected. A limit on the reactivity balance of 1% k/k has been established based on engineering judgment. A 1% deviation in reactivity from that predicted is larger than expected for normal operation and should therefore be evaluated.
 
When measured core reactivity is within 1% k/k of the predicted value at steady state thermal conditions, the core is considered to be operating within acceptable design limits. Since deviations from the limit are normally detected by comparing predicted and measured steady state RCS critical boron concentrations, the difference between measured and predicted values would be approximately 100 ppm (depending on the boron worth) before the limit is reached. These values are well within the uncertainty limits for analysis of boron concentration samples, so that spurious violations of the limit due to uncertainty in measuring the RCS boron concentration are unlikely.
APPLICABILITY The limits on core reactivity must be maintained during MODES 1 and 2 because a reactivity balance must exist when the reactor is critical or producing THERMAL POWER. As the fuel depletes, core conditions are Core Reactivity B 3.1.2  BASES APPLICABILITY  (continued) INDIAN POINT 2 B 3.1.2 - 4 Revision 0 changing, and confirmation of the reactivity balance ensures the core is operating as designed. This Specification does not apply in MODES 3, 4, and 5 because the reactor is shut down and the reactivity balance is not changing.
 
In MODE 6, fuel loading results in a continually changing core reactivity.
Boron concentration requirements (LCO 3.9.1, "Boron Concentration")
ensure that fuel movements are performed within the bounds of the safety analysis. An SDM demonstration is required during the first startup following operations that could have altered core reactivity (e.g., fuel movement, control rod replacement, control rod shuffling).
ACTIONS A.1 and A.2
 
Should an anomaly develop between measured and predicted core reactivity, an evaluation of the core design and safety analysis must be performed. Core conditions are evaluated to determine their consistency with input to design calculations. Measured core and process parameters are evaluated to determine that they are within the bounds of the safety analysis, and safety analysis calculational models are reviewed to verify that they are adequate for representation of the core conditions. The required Completion Time of 7 days is based on the low probability of a DBA occurring during this period, and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.
 
Following evaluations of the core design and safety analysis, the cause of the reactivity anomaly may be resolved. If the cause of the reactivity anomaly is a mismatch in core conditions at the time of RCS boron concentration sampling, then a recalculation of the RCS boron concentration requirements may be performed to demonstrate that core reactivity is behaving as expected. If an unexpected physical change in the condition of the core has occurred, it must be evaluated and corrected, if possible. If the cause of the reactivity anomaly is in the calculation technique, then the calculational models must be revised to provide more accurate predictions. If any of these results are demonstrated, and it is concluded that the reactor core is acceptable for continued operation, then the boron letdown curve may be renormalized and power operation may continue. If operational restriction or additional SRs are necessary to ensure the reactor core is acceptable for continued operation, then they must be defined.
Core Reactivity B 3.1.2  BASES ACTIONS  (continued) INDIAN POINT 2 B 3.1.2 - 5 Revision 0 The required Completion Time of 7 days is adequate for preparing whatever operating restrictions or Surveillances that may be required to allow continued reactor operation.
 
B.1 If the core reactivity cannot be restored to within the 1% k/k limit, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours. If the SDM for MODE 3 is not met, then the boration required by the Required Actions for LCO 3.1.1 would occur. The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR  3.1.2.1 REQUIREMENTS Core reactivity is verified by periodic comparisons of measured and predicted RCS boron concentrations. The comparison is made, considering that other core conditions are fixed or stable, including control rod position, moderator temperature, fuel temperature, fuel depletion, xenon concentration, and samarium concentration.
 
This Surveillance must be performed prior to entering MODE 1 following each refueling as an initial check on core conditions and design calculations at BOC. This Surveillance is performed again within the initial 60 effective full power days (EFPD) after entering MODE 1 following each refueling in order to adjust (normalize) the predicted reactivity values to the measured core reactivity. This SR is then required to be performed every 31 EFPD after the performance used for normalization. This Frequency is acceptable because of the slow rate of core changes due to fuel depletion and because of the presence of other indicators (QPTR, AFD, etc.) that provide prompt indication of an anomaly. The SR is modified by a Note. The Note indicates that the normalization of predicted core reactivity to the measured value, if performed, must take place within the first 60 EFPD after each fuel loading.
This allows sufficient time for core conditions to reach steady state, but prevents operation for a large fraction of the fuel cycle without establishing a benchmark for the design calculations.
 
Core Reactivity B 3.1.2  BASES  INDIAN POINT 2 B 3.1.2 - 6 Revision 0 REFERENCES 1. 10 CFR 50, Appendix A.
: 2. UFSAR, Chapter 14.
MTC B 3.1.3    INDIAN POINT 2 B 3.1.3 - 1 Revision 0 B 3.1  REACTIVITY CONTROL SYSTEMS B 3.1.3 Moderator Temperature Coefficient (MTC) BASES BACKGROUND According to GDC 11 (Ref. 1), the reactor core and its interaction with the Reactor Coolant System (RCS) must be designed for inherently stable power operation, even in the possible event of an accident. In particular, the net reactivity feedback in the system must compensate for any unintended reactivity increases.
 
The MTC relates a change in core reactivity to a change in reactor coolant temperature (a positive MTC means that reactivity increases with increasing moderator temperature; conversely, a negative MTC means that reactivity decreases with increasing moderator temperature). The reactor is designed to operate with a negative MTC over the largest possible range of fuel cycle operation. Therefore, a coolant temperature increase will cause a reactivity decrease, so that the coolant temperature tends to return toward its initial value. Reactivity increases that cause a coolant temperature increase will thus be self limiting, and stable power operation will result.
 
MTC values are predicted at selected burnups during the safety evaluation analysis and are confirmed to be acceptable by measurements. Both initial and reload cores are designed so that the beginning of cycle (BOC) MTC is less than zero when THERMAL POWER is at RTP. The actual value of the MTC is dependent on core characteristics, such as fuel loading and reactor coolant soluble boron concentration. The core design may require additional fixed distributed poisons to yield an MTC at BOC within the range analyzed in the plant accident analysis. The end of cycle (EOC) MTC is also limited by the requirements of the accident analysis. Fuel cycles that are designed to achieve high burnups or that have changes to other characteristics are evaluated to ensure that the MTC does not exceed the EOC limit.
 
The limitations on MTC are provided to ensure that the value of this coefficient remains within the limiting conditions assumed in the FSAR accident and transient analyses.
 
If the LCO limits are not met, the unit response during transients may not be as predicted. The core could violate criteria that prohibit a return to criticality, or the departure from nucleate boiling ratio criteria of the approved correlation may be violated, which could lead to a loss of the fuel cladding integrity.
MTC B 3.1.3  BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.1.3 - 2 Revision 0 The SRs for measurement of the MTC at the beginning and near the end of the fuel cycle are adequate to confirm that the MTC remains within its limits, since this coefficient changes slowly, due principally to the reduction in RCS boron concentration associated with fuel burnup.
APPLICABLE SAFETY ANALYSES The acceptance criteria for the specified MTC are:
: a. The MTC values must remain within the bounds of those used in the accident analysis (Ref. 2) and
: b. The MTC must be such that inherently stable power operations result during normal operation and accidents, such as overheating and overcooling events.
 
The UFSAR, Chapter 14 (Ref. 2), contains analyses of accidents that result in both overheating and overcooling of the reactor core. MTC is one of the controlling parameters for core reactivity in these accidents. Both the most positive value and most negative value of the MTC are important to safety, and both values must be bounded. Values used in the analyses consider worst case conditions to ensure that the accident results are bounding (Ref. 3).
 
The consequences of accidents that cause core overheating must be evaluated when the MTC is most positive. Such accidents include the rod withdrawal transient from either zero power (Ref. 2) or RTP, loss of main feedwater flow, and loss of forced reactor coolant flow. The consequences of accidents that cause core overcooling must be evaluated when the MTC is most negative. Such accidents include sudden feedwater flow increase and sudden decrease in feedwater temperature.
 
In order to ensure a bounding accident analysis, the MTC is assumed to be its most limiting value for the analysis conditions appropriate to each accident. The bounding value is determined by considering rodded and unrodded conditions, whether the reactor is at full or zero power, and whether it is the BOC or EOC life. The most conservative combination appropriate to the accident is then used for the analysis (Ref. 2).
 
MTC values are bounded in reload safety evaluations assuming steady state conditions at BOC and EOC. An EOC measurement is conducted at conditions when the RCS boron concentration reaches approximately 300 ppm. The measured value may be extrapolated to project the EOC value, in order to confirm reload design predictions.
MTC B 3.1.3  BASES APPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.1.3 - 3 Revision 0 MTC satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Even though it is not directly observed and controlled from the control room, MTC is considered an initial condition process variable because of its dependence on boron concentration. LCO LCO 3.1.3 requires the MTC to be within specified limits of the COLR to ensure that the core operates within the assumptions of the accident analysis. During the reload core safety evaluation, the MTC is analyzed to determine that its values remain within the bounds of the original accident analysis during operation.
 
Assumptions made in safety analyses require that the MTC be less positive than a given upper bound and more positive than a given lower bound. The MTC is most positive at BOC; this upper bound must not be exceeded. This maximum upper limit occurs at BOC, all rods out (ARO), hot zero power conditions. At EOC the MTC takes on its most negative value, when the lower bound becomes important. This LCO exists to ensure that both the upper and lower bounds are not exceeded.
 
During operation, therefore, the conditions of the LCO can only be ensured through measurement. The Surveillance checks at BOC and EOC on MTC provide confirmation that the MTC is behaving as anticipated so that the acceptance criteria are met.
 
The LCO establishes a maximum positive value that cannot be exceeded.
The BOC positive limit and the EOC negative limit are established in the COLR to allow specifying limits for each particular cycle. This permits the unit to take advantage of improved fuel management and changes in unit operating schedule. APPLICABILITY Technical Specifications place both LCO and SR values on MTC, based on the safety analysis assumptions described above.
 
In MODE 1, the limits on MTC must be maintained to ensure that any accident initiated from THERMAL POWER operation will not violate the design assumptions of the accident analysis. In MODE 2 with the reactor critical, the upper limit must also be maintained to ensure that startup and subcritical accidents (such as the uncontrolled control rod assembly or group withdrawal) will not violate the assumptions of the accident analysis.
MTC B 3.1.3  BASES APPLICABILITY  (continued) INDIAN POINT 2 B 3.1.3 - 4 Revision 0 The lower MTC limit must be maintained in MODES 2 and 3, in addition to MODE 1, to ensure that cooldown accidents will not violate the assumptions of the accident analysis. In MODES 4, 5, and 6, this LCO is not applicable, since no Design Basis Accidents using the MTC as an analysis assumption are initiated from these MODES. ACTIONS A.1
 
If the BOC MTC limit is violated (i.e., MTC is positive or less negative than required by the COLR), administrative withdrawal limits for control banks must be established to maintain the MTC within its limits. The MTC becomes more negative with control bank insertion and decreased boron concentration. A Completion Time of 24 hours provides enough time for evaluating the MTC measurement and computing the required bank withdrawal limits.
 
As cycle burnup is increased, the RCS boron concentration will be reduced.
The reduced boron concentration causes the MTC to become more negative. Using physics calculations, the time in cycle life at which the calculated MTC will meet the LCO requirement can be determined. At this point in core life Condition A no longer exists. The unit is no longer in the Required Action, so the administrative withdrawal limits are no longer in effect.
 
B.1 If the required administrative withdrawal limits at BOC are not established within 24 hours, the unit must be brought to MODE 2 with k eff < 1.0 to prevent operation with an MTC that is more positive than that assumed in safety analyses.
 
The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
 
C.1 Exceeding the EOC MTC limit means that the safety analysis assumptions for the EOC accidents that use a bounding negative MTC value may be invalid. If the EOC MTC limit is exceeded (i.e., MTC is more negative than permitted by COLR), the plant must be brought to a MODE or condition in MTC B 3.1.3  BASES ACTIONS  (continued) INDIAN POINT 2 B 3.1.3 - 5 Revision 0 which the LCO requirements are not applicable. To achieve this status, the unit must be brought to at least MODE 4 within 12 hours.
 
The allowed Completion Time is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR  3.1.3.1 REQUIREMENTS This SR requires measurement of the MTC at BOC prior to entering MODE 1 in order to demonstrate compliance with the most positive MTC LCO.
Meeting the limit prior to entering MODE 1 ensures that the limit will also be met at higher power levels.
 
The BOC MTC value for ARO will be inferred from isothermal temperature coefficient measurements obtained during the physics tests after refueling.
The ARO value can be directly compared to the BOC MTC limit of the LCO.
If required, measurement results and predicted design values can be used to establish administrative withdrawal limits for control banks.
 
SR  3.1.3.2
 
The LCO requires that the MTC be less negative than the specified value for EOC full power conditions. This measurement may be performed at any THERMAL POWER, but its results must be extrapolated to the conditions of RTP and all banks withdrawn in order to make a proper comparison with the LCO value. Because the RTP MTC value will gradually become more negative with further core depletion and boron concentration reduction, a 300 ppm SR value of MTC should necessarily be less negative than the EOC LCO limit. The 300 ppm SR value is sufficiently less negative than the EOC LCO limit value to ensure that the LCO limit will be met when the 300 ppm Surveillance criterion is met.
 
SR 3.1.3.2 is modified by three Notes that includes the following requirements:
: a. The SR is not required to be performed until 7 effective full power days (EFPDs) after reaching the equivalent of an equilibrium RTP all rods out (ARO) boron concentration of 300 ppm.
MTC B 3.1.3  BASES SURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.1.3 - 6 Revision 0
: b. If the 300 ppm Surveillance limit is exceeded, it is possible that the EOC limit on MTC could be reached before the planned EOC.
Because the MTC changes slowly with core depletion, the Frequency of 14 effective full power days is sufficient to avoid exceeding the EOC limit. c. The Surveillance limit for RTP boron concentration of 60 ppm is conservative. If the measured MTC at 60 ppm is more positive than the 60 ppm Surveillance limit, the EOC limit will not be exceeded because of the gradual manner in which MTC changes with core burnup. REFERENCES 1. 10 CFR 50, Appendix A.
: 2. UFSAR, Chapter 14.
: 3. WCAP 9273-NP-A, "Westinghouse Reload Safety Evaluation Methodology," July 1985.
 
Rod Group Alignment Limits B 3.1.4 INDIAN POINT 2 B 3.1.4 - 1 Revision 0 B 3.1  REACTIVITY CONTROL SYSTEMS B 3.1.4 Rod Group Alignment Limits BASESBACKGROUND The OPERABILITY (trippability) of the shutdown and control rods is an initial assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment is an initial assumption in the safety analysis that directly affects core power distributions and assumptions of available SDM.The applicable criteria for these reactivity and power distribution design requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design,"
GDC 26, "Reactivity Control System Redundancy and Capability" (Ref. 1),
and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plants" (Ref. 2). Mechanical or electrical failures may cause a control or shutdown rod to become inoperable or to become misaligned from its group. Rod inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown. Therefore, rod alignment and OPERABILITY are related to core operation in design power peaking limits and the core design requirement of a minimum SDM. Limits on rod alignment have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved. Rod cluster control assemblies (RCCAs), or rods, are moved by their control rod drive mechanisms (CRDMs). Each CRDM moves its RCCA one step (approximately 5/8 inch) at a time, but at varying rates (steps per minute) depending on the signal output from the Rod Control System. The RCCAs are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously. If a bank of RCCAs consists of two groups, the groups are moved in a staggered fashion, but always within one step of each other. IP2 has four control banks and four shutdown banks.
Rod Group Alignment Limits B 3.1.4  BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.1.4 - 2 Revision 0 The shutdown banks are maintained either in the fully inserted or fully withdrawn position. The control banks are moved in an overlap pattern, using the following withdrawal sequence:  When control bank A reaches a predetermined height in the core, control bank B begins to move out with control bank A. Control bank A stops at the position of maximum withdrawal, and control bank B continues to move out. When control bank B reaches a predetermined height, control bank C begins to move out with control bank B. This sequence continues until control banks A, B, and C are at the fully withdrawn position, and control bank D is approximately halfway withdrawn. The insertion sequence is the opposite of the withdrawal sequence. The control rods are arranged in a radially symmetric pattern, so that control bank motion does not introduce radial asymmetries in the core power distributions.
 
The axial position of shutdown rods and control rods is indicated by two separate and independent systems, which are the Bank Demand Position Indication System (commonly called group step counters) and the Individual Rod Position Indication (IRPI) System.
 
The Bank Demand Position Indication System counts the pulses from the rod control system that moves the rods. There is one step counter for each group of rods. Individual rods in a group all receive the same signal to move and should, therefore, all be at the same position indicated by the group step counter for that group. The Bank Demand Position Indication System is considered highly precise ( 1 step or inch). If a rod does not move one step for each demand pulse, the step counter will still count the pulse and incorrectly reflect the position of the rod.
 
The IRPI System provides an accurate indication of actual rod position, but at a lower precision than the step counters. This system is based on inductive analog signals from an electrical coil stack located above the stepping mechanisms of the control rod magnetic jacks, external to the pressure housing, but concentric with the rod travel. When the associated control rod is at the bottom of the core, the magnetic coupling between the primary and secondary coil winding of the detector is small and there is a small voltage induced in the secondary. As the control rod is raised by the magnetic jacks, the relatively high permeability of the lift rod causes an increase in magnetic coupling. Thus, an analog signal proportional to rod position is obtained. Direct, continuous readout of every control rod is presented to the operator on individual indicators (Ref. 3).
Rod Group Alignment Limits B 3.1.4  BASES INDIAN POINT 2 B 3.1.4 - 3 Revision 0 APPLICABLE SAFETY ANALYSES Control rod misalignment accidents are analyzed in the safety analysis (References 4 and 5). The acceptance criteria for addressing control rod inoperability or misalignment are that:
: a. There be no violations of:
: 1. Specified acceptable fuel design limits or
: 2. Reactor Coolant System (RCS) pressure boundary integrity and
: b. The core remains subcritical after accident transients.
 
Two types of misalignment are distinguished. During movement of a control rod group, one rod may stop moving, while the other rods in the group continue. This condition may cause excessive power peaking. The second type of misalignment occurs if one rod fails to insert upon a reactor trip and remains stuck fully withdrawn. This condition requires an evaluation to determine that sufficient reactivity worth is held in the control rods to meet the SDM requirement, with the maximum worth rod stuck fully withdrawn.
 
Two types of analysis are performed in regard to static rod misalignment (Ref. 5). With control banks at their insertion limits, one type of analysis considers the case when any one rod is completely inserted into the core.
The second type of analysis considers the case of a completely withdrawn single rod from a bank inserted to its insertion limit. Satisfying limits on departure from nucleate boiling ratio in both of these cases bounds the situation when a rod is misaligned.
 
When reactor power is > 85% RTP, an indicated misalignment of  12 steps
( 7.5 inches) between individual rod positions and the group step counter demand position will not cause the power peaking factor limits to be exceeded. This limit assumes a maximum IRPI instrument error of 12 steps
( 7.5 inches) allowing for an actual misalignment of  24 steps ( 15 inches). However, when the group step counter demand position is > 209 steps, it is acceptable for the IRPI to indicate misalignment greater than + 12 steps (i.e., may be up to + 16 steps) as specified in Table 3.1.4-1 without accounting for peaking factor margin. This is acceptable because the top of active fuel (TAF) is at 221 steps. With group step counter demand position > 209 steps and IRPI deviation > + 12 steps, the IRPI determined rod position is above the top of active fuel where it will not result in increased peaking factors for increased misalignments. Similarly, allowable negative deviation limits may increase by 1 step for every step of group step counter demand position over the top of active fuel as specified in Table 3.1.4-1. These rod misalignment limits were justified in Reference 5 and approved in Reference 6.
Rod Group Alignment Limits B 3.1.4  BASES APPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.1.4 - 4 Revision 0
 
When reactor power is  85% RTP, an indicated misalignment of  24 steps
( 15 inches) between individual rod (i.e., IRPI) positions and the group step counter demand position will not cause the power peaking factor limits to be exceeded. This limit assumes a maximum instrument error of  12 steps
( 7.5 inches) allowing for an actual misalignment of  36 steps
( 22.5 inches). These rod misalignment limits were justified in Reference 5 and approved in Reference 6.
As explained in Reference 5, the rod alignment limit analyses were performed using two distinct models of the IP2 core. These models addressed large variations in cycle length, number of feed assemblies, fuel enrichments and burnable poisons and are expected to bound any current or future fuel management strategies. Therefore, the results of the rod misalignment analyses are considered to be cycle independent.
 
Another type of misalignment occurs if one RCCA fails to insert upon a reactor trip and remains stuck fully withdrawn. This condition is assumed in the evaluation to determine that the required SDM is met with the maximum worth RCCA also fully withdrawn (Ref. 5).
 
The Required Actions in this LCO ensure that either deviations from the alignment limits will be corrected or that THERMAL POWER will be adjusted so that excessive local linear heat rates (LHRs) will not occur, and that the requirements on SDM and ejected rod worth are preserved.
 
Continued operation of the reactor with a misaligned control rod is allowed if the heat flux hot channel factor (F Q(Z)) and the nuclear enthalpy hot channel factor (F N H) are  verified to be within their limits in the COLR and the safety analysis is verified to remain valid. When a control rod is misaligned, the assumptions that are used to determine the rod insertion limits, AFD limits, and quadrant power tilt limits are not preserved. Therefore, the limits may not preserve the design peaking factors, and F Q(Z) and F N H must be verified directly by incore mapping. Bases Section 3.2 (Power Distribution Limits) contains more complete discussions of the relation of F Q(Z) and F N H to the operating limits.
 
Shutdown and control rod OPERABILITY and alignment are directly related to power distributions and SDM, which are initial conditions assumed in safety analyses. Therefore they satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
Rod Group Alignment Limits B 3.1.4  BASES  INDIAN POINT 2 B 3.1.4 - 5 Revision 0 LCO The limits on shutdown or control rod alignments ensure that the assumptions in the safety analysis will remain valid. The requirements on control rod OPERABILITY ensure that upon reactor trip, the assumed reactivity will be available and will be inserted. The control rod OPERABILITY requirements (i.e., trippability) are separate from the alignment requirements, which ensure that the RCCAs and banks maintain the correct power distribution and rod alignment. The rod OPERABILITY requirement is satisfied provided the rod will fully insert in the required rod drop time assumed in the safety analysis. Rod control malfunctions that result in the inability to move a rod (e.g., rod lift coil failures), but that do not impact trippability, do not result in rod inoperability.
 
To ensure that individual rods are properly aligned with their associated group step counter demand position, the following limits are placed on individual rod positions: 
: a. When THERMAL POWER is > 85% RTP, the difference between each individual indicated rod position and its group step counter demand position shall be within the limits specified in Table 3.1.4-1 for the group step counter demand position; and 
: b. When THERMAL POWER is  85% RTP, the difference between each individual indicated rod position and its group step counter demand position shall be  24 steps.
Control rod misalignment is the IRPI Rod Position minus Group Step Counter Demand Position.
Failure to meet the requirements of this LCO may produce unacceptable power peaking factors and LHRs, or unacceptable SDMs, all of which may constitute initial conditions inconsistent with the safety analysis.
APPLICABILITY The requirements on RCCA OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which neutron (or fission) power is generated, and the OPERABILITY (i.e., trippability and rod insertion speed) and alignment of rods have the potential to affect the safety of the plant. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the control rods are bottomed and the reactor is shut down and not producing fission power. In the shutdown MODES, the OPERABILITY of the shutdown and control rods has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration Rod Group Alignment Limits B 3.1.4  BASES APPLICABILITY  (continued) INDIAN POINT 2 B 3.1.4 - 6 Revision 0 of the RCS. See LCO 3.1.1, "SHUTDOWN MARGIN," for SDM in MODES 3, 4, and 5 and LCO 3.9.1, "Boron Concentration," for boron concentration requirements during refueling.
ACTIONS A.1.1 and A.1.2 When one or more rods are inoperable (i.e. untrippable), there is a possibility that the required SDM may be adversely affected. Under these conditions, it is important to determine the SDM, and if it is less than the required value, initiate boration until the required SDM is recovered. The Completion Time of 1 hour is adequate for determining SDM and, if necessary, for initiating emergency boration and restoring SDM.
 
In this situation, SDM verification must include the worth of the untrippable rod, as well as a rod of maximum worth.
 
A.2 If the inoperable rod(s) cannot be restored to OPERABLE status, the plant must be brought to a MODE or condition in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours.
 
The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
 
B.1 When a rod becomes misaligned, it can usually be moved and is still trippable. If the rod can be realigned within the Completion Time of 1 hour, local xenon redistribution during this short interval will not be significant, and operation may proceed without further restriction.
 
Alternately, a power reduction to  85% RTP will result in the LCO being met if IRPIs associated with all groups indicate within  24 steps ( 15 inches) of the group step counter demand position. If LCO 3.1.4.b is met when  85% RTP, realigning RCCAs to within the limits of LCO 3.1.4.a is required only as a condition for increasing power to > 85% RTP.
Rod Group Alignment Limits B 3.1.4 BASES ACTIONS  (continued) INDIAN POINT 2 B 3.1.4 - 7 Revision 0 An alternative to realigning a single misaligned RCCA to the group average position is to align the remainder of the group to the position of the misaligned RCCA. However, this must be done without violating the bank sequence, overlap, and insertion limits specified in LCO 3.1.5, "Shutdown Bank Insertion Limits," and LCO 3.1.6, "Control Bank Insertion Limits."  The Completion Time of 1 hour gives the operator sufficient time to adjust the rod positions in an orderly manner.
 
B.2.1.1 and B.2.1.2
 
With a misaligned rod, SDM must be verified to be within limit or boration must be initiated to restore SDM to within limit.
 
Power operation may continue with one RCCA trippable but misaligned, provided that SDM is verified within 1 hour. The Completion Time of 1 hour represents the time necessary for determining the actual unit SDM and, if necessary, aligning and starting the necessary systems and components to initiate boration.
 
B.2.2, B.2.3, B.2.4, B.2.5, and B.2.6
 
For continued operation with a misaligned rod, RTP must be reduced, SDM must periodically be verified within limits, hot channel factors (F Q(Z) and F N H) must be verified within limits, and the safety analyses must be re-evaluated to confirm continued operation is permissible.
 
Reduction of power to 75% RTP ensures that local LHR increases due to a misaligned RCCA will not cause the core design criteria to be exceeded. The Completion Time of 2 hours gives the operator sufficient time to accomplish an orderly power reduction without challenging the Reactor Protection System.
 
When a rod is known to be misaligned, there is a potential to impact the SDM. Since the core conditions can change with time, periodic verification of SDM is required. A Frequency of 12 hours is sufficient to ensure this requirement continues to be met.
 
Verifying that F Q(Z), as approximated by F C Q(Z) and F W Q(Z), and F N H are within the required limits ensures that current operation at 75% RTP with a rod misaligned is not resulting in power distributions that may invalidate safety analysis assumptions at full power. The Completion Time of 72 hours allows sufficient time to obtain flux maps of the core power distribution using the incore flux mapping system and to calculate F Q(Z) and F N H.
Rod Group Alignment Limits B 3.1.4 BASES ACTIONS  (continued) INDIAN POINT 2 B 3.1.4 - 8 Revision 0 Once current conditions have been verified acceptable, time is available to perform evaluations of accident analysis to determine that core limits will not be exceeded during a Design Basis Event for the duration of operation under these conditions. The accident analyses presented in Reference 5 that may be adversely affected will be evaluated to ensure that the analysis results remain valid for the duration of continued operation under these conditions.
A Completion Time of 5 days is sufficient time to obtain the required input data and to perform the analysis.
 
C.1 When Required Actions cannot be completed within their Completion Time, the unit must be brought to a MODE or Condition in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours, which obviates concerns about the development of undesirable xenon or power distributions. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging the plant systems.
 
D.1.1 and D.1.2
 
More than one control rod becoming misaligned from its group average position is not expected, and has the potential to reduce SDM. Therefore, SDM must be evaluated. One hour allows the operator adequate time to determine SDM. Restoration of the required SDM, if necessary, requires increasing the RCS boron concentration to provide negative reactivity, as described in the Bases for LCO 3.1.1. The required Completion Time of 1 hour for initiating boration is reasonable, based on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to complete the action. This allows the operator sufficient time to align the required valves and start the boric acid pumps.
Boration will continue until the required SDM is restored.
 
A power reduction to  85% RTP will result in the LCO being met if IRPIs associated with all groups indicate within  24 steps ( 15 inches) of the group step counter demand position. If LCO 3.1.4.b is met when  85% RTP, realigning RCCAs to within the limits of LCO 3.1.4.a is required only as a condition for increasing power to > 85% RTP.
Rod Group Alignment Limits B 3.1.4 BASES ACTIONS  (continued) INDIAN POINT 2 B 3.1.4 - 9 Revision 0 D.2 If more than one rod is found to be misaligned or becomes misaligned because of bank movement, the unit conditions fall outside of the accident analysis assumptions. Since automatic bank sequencing would continue to cause misalignment, the unit must be brought to a MODE or Condition in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours.
 
The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE SR  3.1.4.1 REQUIREMENTS Verification that individual rod positions are within alignment limits at a Frequency of 12 hours provides a history that allows the operator to detect a rod that is beginning to deviate from its expected position. Rod position may be verified using normal indication, direct readings using a digital volt meter, or the plant computer. The specified Frequency takes into account other rod position information that is continuously available to the operator in the control room, so that during actual rod motion, deviations can immediately be detected.
 
This SR is modified by a Note that explains the SR is not required to be met for an individual control rod until 1 hour after completion of movement of that rod. This allowance is needed because it provides time for thermal stabilization of rod position instrumentation. This allowance is acceptable because individual rod position indicators may not accurately reflect control rod position prior to thermal stabilization and there is a presumption that individual control rods will move with their group (Ref. 6). 
 
SR  3.1.4.2
 
Verifying each control rod is OPERABLE would require that each rod be tripped. However, in MODES 1 and 2, tripping each control rod would result in radial or axial power tilts, or oscillations. Exercising each individual control rod every 92 days provides increased confidence that all rods continue to be OPERABLE without exceeding the alignment limit, even if they are not regularly tripped. Moving each control rod by 10 steps in one direction will not cause radial or axial power tilts, or oscillations, to occur.
Rod Group Alignment Limits B 3.1.4 BASES SURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.1.4 - 10 Revision 0 This SR requires that control rods be inserted or withdrawn by at least 10 steps which is sufficient to ensure that rod movement can be confirmed by individual rod position indicators. The 92 day Frequency takes into consideration other information available to the operator in the control room and SR 3.1.4.1, which is performed more frequently and adds to the determination of OPERABILITY of the rods. Between required performances of SR 3.1.4.2 (determination of control rod OPERABILITY by movement), if a control rod(s) is discovered to be immovable, but remains trippable the control rod(s) is considered to be OPERABLE. At any time, if a control rod(s) is immovable, a determination of the trippability (OPERABILITY) of the control rod(s) must be made, and appropriate action taken.
 
SR  3.1.4.3
 
Verification of rod drop times allows the operator to determine that the maximum rod drop time permitted is consistent with the assumed rod drop time used in the safety analysis. Measuring rod drop times prior to reactor criticality, after reactor vessel head removal, ensures that the reactor internals and rod drive mechanism will not interfere with rod motion or rod drop time, and that no degradation in these systems has occurred that would adversely affect control rod motion or drop time. This testing is performed with all RCPs operating and the average moderator temperature  500F to simulate a reactor trip under actual conditions.
 
This Surveillance is performed during a plant outage, due to the plant conditions needed to perform the SR and the potential for an unplanned plant transient if the Surveillance was performed with the reactor at power.
REFERENCES 1. 10 CFR 50, Appendix A.
: 2. 10 CFR 50.46.
: 3. UFSAR, Section 7.3.
: 4. UFSAR, Appendix 3.B.3.
: 5. WCAP-15902, Conditional Extension of the Rod Misalignment Technical Specification for Indian Point Unit 2.
Rod Group Alignment Limits B 3.1.4 BASES REFERENCES  (continued) INDIAN POINT 2 B 3.1.4 - 11 Revision 0
: 6. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 234 to Facility Operating License No.
DPR-26, October 12, 2002.
 
Shutdown Bank Insertion Limits B 3.1.5  INDIAN POINT 2 B 3.1.5 - 1 Revision 0 B 3.1  REACTIVITY CONTROL SYSTEMS B 3.1.5 Shutdown Bank Insertion Limits BASES BACKGROUND The insertion limits of the shutdown and control banks are initial assumptions in all safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions and assumptions of available ejected rod worth, SDM and initial reactivity insertion rate.
 
The applicable criteria for these reactivity and power distribution design requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design,"
GDC 26, "Reactivity Control System Redundancy and Protection," GDC 28, "Reactivity Limits" (Ref. 1), and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors" (Ref. 2). Limits on control rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
 
The rod cluster control assemblies (RCCAs) are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously. A bank of RCCAs consists of two groups that are moved in a staggered fashion, but always within one step of each other. IP2 has four control banks and four shutdown banks. See LCO 3.1.4, "Rod Group Alignment Limits," for control and shutdown rod OPERABILITY and alignment requirements, and LCO 3.1.7, "Rod Position Indication," for position indication requirements.
 
The control banks are used for precise reactivity control of the reactor. The positions of the control banks are normally automatically controlled by the Rod Control System, but they can also be manually controlled. They are capable of adding negative reactivity very quickly (compared to borating).
The control banks must be maintained above designed insertion limits and are typically near the fully withdrawn position during normal full power operations.
 
Hence, they are not capable of adding a large amount of positive reactivity.
Boration or dilution of the Reactor Coolant System (RCS) compensates for the reactivity changes associated with large changes in RCS temperature, Shutdown Bank Insertion Limits B 3.1.5  BASES BACKGROUND  (continued)
INDIAN POINT 2 B 3.1.5 - 2 Revision 0 power and fuel depletion. The design calculations are performed with the assumption that the shutdown banks are withdrawn first. The shutdown banks can be fully withdrawn without the core going critical. This provides available negative reactivity in the event of boration errors. The shutdown banks are controlled manually by the control room operator. During normal unit operation, the shutdown banks are either fully withdrawn or fully inserted. The shutdown banks must be completely withdrawn from the core, prior to withdrawing any control banks during an approach to criticality. The shutdown banks are then left in this position until the reactor is shut down.
They affect core power and burnup distribution, and add negative reactivity to shut down the reactor upon receipt of a reactor trip signal.
APPLICABLE SAFETY ANALYSES On a reactor trip, all RCCAs (shutdown banks and control banks), except the most reactive RCCA, are assumed to insert into the core. The shutdown banks shall be at or above their insertion limits and available to insert the maximum amount of negative reactivity on a reactor trip signal. The control banks may be partially inserted in the core, as allowed by LCO 3.1.6, "Control Bank Insertion Limits."  The shutdown bank and control bank insertion limits are established to ensure that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM (see LCO 3.1.1, "SHUTDOWN MARGIN") following a reactor trip from full power. The combination of control banks and shutdown banks (less the most reactive RCCA, which is assumed to be fully withdrawn) is sufficient to take the reactor from full power conditions at rated temperature to zero power, and to maintain the required SDM at rated no load temperature (Ref. 3). The shutdown bank insertion limit also limits the reactivity worth of an ejected shutdown rod.
 
The acceptance criteria for addressing shutdown and control rod bank insertion limits and inoperability or misalignment is that:
: a. There be no violations of:
: 1. Specified acceptable fuel design limits or
: 2. RCS pressure boundary integrity and
: b. The core remains subcritical after accident transients.
 
As such, the shutdown bank insertion limits affect safety analysis involving core reactivity and SDM (Ref. 3).
Shutdown Bank Insertion Limits B 3.1.5  BASES APPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2 B 3.1.5 - 3 Revision 0 The shutdown bank insertion limits preserve an initial condition assumed in the safety analyses and, as such, satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO The shutdown banks must be within their insertion limits any time the reactor is critical or approaching criticality. This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip.
 
The shutdown bank insertion limits are defined in the COLR. APPLICABILITY The shutdown banks must be within their insertion limits, with the reactor in MODES 1 and 2. This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip. The shutdown banks do not have to be within their insertion limits in MODE 3, unless an approach to criticality is being made. In MODE 3, 4, 5, or 6, the shutdown banks are fully inserted in the core and contribute to the SDM. Refer to LCO 3.1.1 for SDM requirements in MODES 3, 4, and 5. LCO 3.9.1, "Boron Concentration," ensures adequate SDM in MODE 6.
 
The Applicability requirements have been modified by a Note indicating the LCO requirement is suspended during SR 3.1.4.2. This SR verifies the freedom of the rods to move, and requires the shutdown bank to move below the LCO limits, which would normally violate the LCO. ACTIONS A.1.1, A.1.2 and A.2
 
When one or more shutdown banks is not within insertion limits, 2 hours is allowed to restore the shutdown banks to within the insertion limits. This is necessary because the available SDM may be significantly reduced, with one or more of the shutdown banks not within their insertion limits. Also, verification of SDM or initiation of boration within 1 hour is required, since the SDM in MODES 1 and 2 is ensured by adhering to the control and shutdown bank insertion limits (see LCO 3.1.1). If shutdown banks are not within their insertion limits, then SDM will be verified by performing a reactivity balance calculation, considering the effects listed in the Bases for SR 3.1.1.1.
Shutdown Bank Insertion Limits B 3.1.5  BASES ACTIONS  (continued)
INDIAN POINT 2 B 3.1.5 - 4 Revision 0 The allowed Completion Time of 2 hours provides an acceptable time for evaluating and repairing minor problems without allowing the plant to remain in an unacceptable condition for an extended period of time. B.1  If the shutdown banks cannot be restored to within their insertion limits within 2 hours, the unit must be brought to a MODE where the LCO is not applicable. The allowed Completion Time of 6 hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
SURVEILLANCE SR  3.1.5.1 REQUIREMENTS Verification that the shutdown banks are within their insertion limits prior to an approach to criticality ensures that when the reactor is critical, or being taken critical, the shutdown banks will be available to shut down the reactor, and the required SDM will be maintained following a reactor trip. This SR and Frequency ensure that the shutdown banks are withdrawn before the control banks are withdrawn during a unit startup.
 
Since the shutdown banks are positioned manually by the control room operator, a verification of shutdown bank position at a Frequency of 12 hours, after the reactor is taken critical, is adequate to ensure that they are within their insertion limits. Also, the 12 hour Frequency takes into account other information available in the control room for the purpose of monitoring the status of shutdown rods.
REFERENCES 1. 10 CFR 50, Appendix A.
: 2. 10 CFR 50.46.
: 3. UFSAR, Chapter 14.
Control Bank Insertion LimitsB 3.1.6INDIAN POINT 2B 3.1.6 -1Revision1B 3.1  REACTIVITY CONTROL SYSTEMSB 3.1.6Control Bank Insertion LimitsBASESBACKGROUNDThe insertion limits of the shutdown and control rods are initial assumptions in all safety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect core power and fuel burnup distributions and assumptions of available SDM, and initial reactivity insertion rate.The applicable criteria for these reactivity and power distribution design requirements are 10CFR50, AppendixA, GDC10, "Reactor Design," GDC26,"Reactivity Control System Redundancy and Protection," GDC 28, "Reactivity Limits" (Ref.1), and 10CFR50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors" (Ref.2). Limits on control rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.The rod cluster control assemblies (RCCAs) are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control. A group consists of two or more RCCAs that are electrically paralleled to step simultaneously. A bank of RCCAs consists of two groups that are moved in a staggered fashion, but always within one step of each other. IP2 has four control banks and four shutdown banks.
See LCO3.1.4, "Rod Group Alignment Limits," for control and shutdown rod OPERABILITY and alignment requirements, and LCO3.1.7, "Rod Position Indication," for position indication requirements.The control bank insertion limits are specified in the COLR. The control banks are required to be at or above the insertion limit lines. The COLR also indicates how the control banks are moved in an overlap pattern. Overlap is the distance traveled together by two control banks. The predetermined position of control bankC, at which control bankD will begin to move with bankC on a withdrawal and the fully withdrawn position is defined in the COLR.The control banks are used for precise reactivity control of the reactor. The positions of the control banks are normally controlled automatically by the Rod Control System, but can also be manually controlled. They are capable of adding reactivity very quickly (compared to borating or diluting).
Control Bank Insertion LimitsB 3.1.6BASESBACKGROUND  (continued)INDIAN POINT 2B 3.1.6 -2Revision1The power density at any point in the core must be limited, so that the fuel design criteria are maintained. Together, LCO3.1.4, LCO3.1.5, "Shutdown Bank Insertion Limits," LCO3.1.6, LCO3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," provide limits on control component operation and on monitored process variables, which ensure that the core operates within the fuel design criteria.The shutdown and control bank insertion and alignment limits, AFD, and QPTR are process variables that together characterize and control the three dimensional power distribution of the reactor core. Additionally, the control bank insertion limits control the reactivity that could be added in the event of a rod ejection accident, and the shutdown and control bank insertion limits ensure the required SDM is maintained.Operation within the subject LCOlimits will prevent fuel cladding failures that would breach the primary fission product barrier and release fission products to the reactor coolant in the event of a loss of coolant accident (LOCA), loss of flow, ejected rod, or other accident requiring termination by a Reactor Protection System (RPS) trip function.APPLICABLE SAFETYANALYSESThe shutdown and control bank insertion limits, AFD, and QPTR LCOs are required to prevent power distributions that could result in fuel cladding failures in the event of a LOCA, loss of flow, ejected rod, or other accidents requiring termination by an RPS trip function.The acceptance criteria for addressing shutdown and control bank insertion limits and inoperability or misalignment are that:
a.There be no violations of:1.Specified acceptable fuel design limits or2.Reactor Coolant System pressure boundary integrity and b.The core remains subcritical after accident transients.As such, the shutdown and control bank insertion limits affect safety analysis involving core reactivity and power distributions (Ref.3).
Control Bank Insertion LimitsB 3.1.6BASESAPPLICABLE SAFETY ANALYSES  (continued)INDIAN POINT 2B 3.1.6 -3Revision1The SDM requirement is ensured by limiting the control and shutdown bank insertion limits so that allowable inserted worth of the RCCAs is such that sufficient reactivity is available in the rods to shut down the reactor to hot zero power with a reactivity margin that assumes the maximum worth RCCA remains fully withdrawn upon trip (Ref.3).Operation at the insertion limits or AFD limits may approach the maximum allowable linear heat generation rate or peaking factor with the allowed QPTR present. Operation at the insertion limit may also indicate the maximum ejected RCCA worth could be equal to the limiting value in fuel cycles that have sufficiently high ejected RCCA worths.The control and shutdown bank insertion limits ensure that safety analyses assumptions for SDM, ejected rod worth, and power distribution peaking factors are preserved (Ref.3).The insertion limits satisfy Criterion2 of 10CFR50.36(c)(2)(ii), in that they are initial conditions assumed in the safety analysis.LCOThe limits on control banks sequence, overlap, and physical insertion, as defined in the COLR, must be maintained because they serve the function of preserving power distribution, ensuring that the SDM is maintained, ensuring that ejected rod worth is maintained, and ensuring adequate negative reactivity insertion is available on trip. The overlap between control banks provides more uniform rates of reactivity insertion and withdrawal and is imposed to maintain acceptable power peaking during control bank motion.APPLICABILITYThe control bank sequence, overlap, and physical insertion limits shall be maintained with the reactor in MODE1and MODE2 with k eff1.0. These limits must be maintained, since they preserve the assumed power distribution, ejected rod worth, SDM, and reactivity rate insertion assumptions. Applicability in MODES3, 4, and5 is not required, since neither the power distribution nor ejected rod worth assumptions would be exceeded in these MODES.The applicability requirements have been modified by a Note indicating the LCOrequirements are suspended during the performance of SR3.1.4.2. This SRverifies the freedom of the rods to move, and requires the control bank to move below the LCOlimits, which would violate the LCO.
Control Bank Insertion LimitsB 3.1.6BASESINDIAN POINT 2B 3.1.6 -4Revision1ACTIONSA.1.1, A.1.2, A.2, B.1.1, B.1.2, and B.2When the control banks are outside the acceptable insertion limits, they must be restored to within those limits. This restoration can occur in two ways:
a.Reducing power to be consistent with rod position or b.Moving rods to be consistent with power.Also, verification of SDM or initiation of boration to regain SDM is required within 1hour, since the SDM in MODES1 and2 normally ensured by adhering to the control and shutdown bank insertion limits (see LCO3.1.1, "SHUTDOWN MARGIN") has been upset. If control banks are not within their insertion limits, then SDM will be verified by performing a reactivity balance calculation, considering the effects listed in the BASES for SR3.1.1.1.Similarly, if the control banks are found to be out of sequence or in the wrong overlap configuration, they must be restored to meet the limits.Operation beyond the LCOlimits is allowed for a short time period in order to take conservative action because the simultaneous occurrence of either a LOCA, loss of flow accident, ejected rod accident, or other accident during this short time period, together with an inadequate power distribution or reactivity capability, has an acceptably low probability.The allowed Completion Time of 2hours for restoring the banks to within the insertion, sequence, and overlaps limits provides an acceptable time for evaluating and repairing minor problems without allowing the plant to remain in an unacceptable condition for an extended period of time.
C.1If Required ActionsA.1 andA.2, orB.1 andB.2 cannot be completed within the associated Completion Times, the plant must be brought to MODE 2 with k eff<1.0, where the LCOis not applicable. The allowed Completion Time of 6hours is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.
Control Bank Insertion LimitsB 3.1.6BASESINDIAN POINT 2B 3.1.6 -5Revision1 SURVEILLANCESR3.1.6.1REQUIREMENTSThis Surveillance is required to ensure that the reactor does not achieve criticality with the control banks below their insertion limits.The estimated critical position (ECP) depends upon a number of factors, one of which is xenon concentration. If the ECP was calculated for a time different from when criticality occurs, xenon concentration could change to make the ECP substantially in error. Conversely, determining the ECP immediately beforecriticality could be an unnecessary burden. There are a number of unit parameters requiring operator attention at that point. Verifying the ECP calculation within 4hours prior to criticality avoids a large error from changes in xenon concentration, but allows the operator some flexibility to schedule the ECP calculation with other startup activities.SR3.1.6.2Verification of the control bank insertion limits at a Frequency of 12hours is sufficient to detect control banks that may be approaching the insertion limits since, normally, very little rod motion occurs in 12hours.SR3.1.6.3When control banks are maintained within their insertion limits as checked by SR3.1.6.2 above, it is unlikely that their sequence and overlap will not be in accordance with requirements provided in the COLR. A Frequency of 12hoursis consistent with the insertion limit check above in SR3.1.6.2.REFERENCES1.10CFR50, AppendixA.2.10CFR50.46.
3.UFSAR, Chapter14.
Rod Position Indication B 3.1.7    INDIAN POINT 2 B 3.1.7 - 1 Revision 0 B 3.1  REACTIVITY CONTROL SYSTEMS B 3.1.7 Rod Position Indication BASES BACKGROUND According to GDC 13 (Ref. 1), instrumentation to monitor variables and systems over their operating ranges during normal operation, anticipated operational occurrences, and accident conditions must be OPERABLE.
LCO 3.1.7 is required to ensure OPERABILITY of the control rod position indicators to determine control rod positions and thereby ensure compliance with the control rod alignment and insertion limits.
 
The OPERABILITY, including position indication, of the shutdown and control rods is an initial assumption in all safety analyses that assume rod insertion upon reactor trip. Maximum rod misalignment is an initial assumption in the safety analysis that directly affects core power distributions and assumptions of available SDM. Rod position indication is required to assess OPERABILITY and misalignment.
 
Mechanical or electrical failures may cause a control rod to become inoperable or to become misaligned from its group. Control rod inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available rod worth for reactor shutdown. Therefore, control rod alignment and OPERABILITY are related to core operation in design power peaking limits and the core design requirement of a minimum SDM.
 
Limits on control rod alignment and OPERABILITY have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.
 
Rod cluster control assemblies (RCCAs), or rods, are moved out of the core (up or withdrawn) or into the core (down or inserted) by their control rod drive mechanisms. The RCCAs are divided among control banks and shutdown banks. Each bank may be further subdivided into two groups to provide for precise reactivity control.
 
The axial position of shutdown rods and control rods are determined by two separate and independent systems:  the Bank Demand Position Indication System (commonly called group step counters) and the Individual Rod Position Indication (IRPI) System.
Rod Position Indication B 3.1.7  BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.1.7 - 2 Revision 0 The Bank Demand Position Indication System counts the pulses from the Rod Control System that move the rods. There is one step counter for each group of rods. Individual rods in a group all receive the same signal to move and should, therefore, all be at the same position indicated by the group step counter for that group. The Bank Demand Position Indication System is considered highly precise ( 1 step or inch). If a rod does not move one step for each demand pulse, the step counter will still count the pulse and incorrectly reflect the position of the rod.
 
The IRPI System provides an accurate indication of actual control rod position, but at a lower precision than the step counters. This system is based on inductive analog signals from a series of coils spaced along a hollow tube with a center to center distance of 3.75 inches, which is 6 steps.
Therefore, the normal indication accuracy of the IRPI System is  6 steps ( 3.75 inches), and the maximum uncertainty is  12 steps ( 7.5 inches). With an indicated deviation of 12 steps between the group step counter and IRPI, the maximum deviation between actual rod position and the demand position could be 24 steps (15 inches).
 
APPLICABLE SAFETY ANALYSES  Control and shutdown rod position accuracy is essential during power operation. Power peaking, ejected rod worth, or SDM limits may be violated in the event of a Design Basis Accident (Ref. 2), with control or shutdown rods operating outside their limits undetected. Therefore, the acceptance criteria for rod position indication is that rod positions must be known with sufficient accuracy in order to verify the core is operating within the group sequence, overlap, design peaking limits, ejected rod worth, and with minimum SDM (LCO 3.1.5, "Shutdown Bank Insertion Limits," and LCO 3.1.6, "Control Bank Insertion Limits"). The rod positions must also be known in order to verify the alignment limits are preserved (LCO 3.1.4, "Rod Group Alignment Limits"). Control rod positions are continuously monitored to provide operators with information that ensures the plant is operating within the bounds of the accident analysis assumptions.
 
The control rod position indicator channels satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). The control rod position indicators monitor control rod position, which is an initial condition of the accident.
Rod Position Indication B 3.1.7  BASES  INDIAN POINT 2 B 3.1.7 - 3 Revision 0 LCO LCO 3.1.7 specifies that one IRPI System and one Bank Demand Position Indication System be OPERABLE for each control rod. For the control rod position indicators to be OPERABLE requires meeting the SR of the LCO and the following:
: a. The IRPI System indicates within a specified limit of the group step counter demand position as required by LCO 3.1.4, "Rod Group Alignment Limits," 
: b. For the IRPI System there are no failed coils, and
: c. The Bank Demand Indication System has been calibrated either in the fully inserted position or to the IRPI System.
 
The 12 step agreement limit between the Bank Demand Position Indication System and the IRPI System indicates that the Bank Demand Position Indication System is adequately calibrated, and can be used for indication of the measurement of control rod bank position.
 
An IRPI channel is OPERABLE if individual rod position can be determined using normal indication, direct readings using a digital volt meter, or the plant computer.
 
A deviation of less than the allowable limit, given in LCO 3.1.4, in position indication for a single control rod, ensures high confidence that the position uncertainty of the corresponding control rod group is within the assumed values used in the analysis (that specified control rod group insertion limits).
 
These requirements ensure that control rod position indication during power operation and PHYSICS TESTS is accurate, and that design assumptions are not challenged.
 
OPERABILITY of the position indicator channels ensures that inoperable, misaligned, or mispositioned control rods can be detected. Therefore, power peaking, ejected rod worth, and SDM can be controlled within acceptable limits. APPLICABILITY The requirements on the IRPI and step counters are only applicable in MODES 1 and 2 (consistent with LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6), because these are the only MODES in which power is generated, and the OPERABILITY and alignment of rods have the potential to affect the safety Rod Position Indication B 3.1.7  BASES APPLICABILITY  (continued) INDIAN POINT 2 B 3.1.7 - 4 Revision 0 of the plant. In the shutdown MODES, the OPERABILITY of the shutdown and control banks has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the Reactor Coolant System. ACTIONS The ACTIONS Table is modified by a Note indicating that a separate Condition entry is allowed for each inoperable rod position indicator and each demand position indicator. This is acceptable because the Required Actions for each Condition provide appropriate compensatory actions for each inoperable position indicator.
 
A.1 When one IRPI channel per group fails, the position of the rod may still be determined indirectly by use of the movable incore detectors. Based on experience, normal power operation does not require excessive movement of banks. If a bank has been significantly moved, the Required Action of C.1 or C.2 below is required. Therefore, verification of RCCA position within the Completion Time of 12 hours is adequate for allowing continued full power operation, since the probability of simultaneously having a rod significantly out of position and an event sensitive to that rod position is small.
 
A.2 Reduction of THERMAL POWER to  50% RTP puts the core into a condition where rod position is not significantly affecting core peaking factors (Ref. 2).
 
The allowed Completion Time of 12 hours is reasonable, based on operating experience, for reducing power to  50% RTP from full power conditions without challenging plant systems and allowing for rod position determination by Required Action A.1 above.
 
B.1, B.2, B.3, and B.4
 
When more than one IRPI per group fail, additional actions are necessary to ensure that acceptable power distribution limits are maintained, minimum SDM is maintained, and the potential effects of rod misalignment on associated accident analyses are limited. Placing the Rod Control System in manual assures unplanned rod motion will not occur. Together with the indirect position determination available via movable incore detectors, these Rod Position Indication B 3.1.7  BASES ACTIONS  (continued) INDIAN POINT 2 B 3.1.7 - 5 Revision 0 actions will minimize the potential for rod misalignment. The immediate Completion Time for placing the Rod Control System in manual reflects the urgency with which unplanned rod motion must be prevented while in this Condition.
 
Monitoring and recording reactor coolant T avg help assure that significant changes in power distribution and SDM are avoided. The once per hour Completion Time is acceptable because only minor fluctuations in RCS temperature are expected at steady state plant operating conditions.
 
The position of the rods may be determined indirectly by use of the movable incore detectors. Verification of control rod position once per 12 hours is adequate for allowing continued full power operation for a limited, 24 hour period, since the probability of simultaneously having a rod significantly out of position and an event sensitive to that rod position is small. The 24 hour Completion Time provides sufficient time to troubleshoot and restore the IRPI system to operation while avoiding the plant challenges associated with the shutdown without full rod position indication.
 
Based on operating experience, normal power operation does not require excessive rod movement. If one or more rods has been significantly moved, the Required Action of C.1 and C.2 below is required.
 
C.1 and C.2
 
These Required Actions clarify that when one or more rods with inoperable position indicators have been moved in excess of 24 steps (15 inches) in one direction since the position was last determined, the Required Actions of A.1 and A.2, or B.1, as applicable are still appropriate but must be initiated promptly under Required Action C.1 to begin verifying that these rods are still properly positioned, relative to their group positions.
 
If, within 4 hours, the rod positions have not been determined, THERMAL POWER must be reduced to  50% RTP within 8 hours to avoid undesirable power distributions that could result from continued operation at > 50% RTP, if one or more rods are misaligned by more than 24 steps (15 inches). The allowed Completion Time of 4 hours provides an acceptable period of time to verify the rod positions.
Rod Position Indication B 3.1.7  BASES ACTIONS  (continued) INDIAN POINT 2 B 3.1.7 - 6 Revision 0 D.1.1 and D.1.2
 
With one demand position indicator per bank inoperable (i.e., demand position for a group cannot be determined), the rod positions can be determined by the IRPI System. Since normal power operation does not require excessive movement of rods, verification by administrative means that the rod position indicators are OPERABLE and the most withdrawn rod and the least withdrawn rod are  12 steps apart within the allowed Completion Time of once every 8 hours is adequate.
 
D.2 Reduction of THERMAL POWER to  50% RTP puts the core into a condition where rod position is not significantly affecting core peaking factor limits (Ref. 3). The allowed Completion Time of 8 hours provides an acceptable period of time to verify the rod positions per Required Actions C.1.1 and C.1.2 or reduce power to  50% RTP.
 
E.1 If the Required Actions cannot be completed within the associated Completion Time, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours. The allowed Completion Time is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR  3.1.7.1 REQUIREMENTS Verification that the IRPI agrees with the demand position within 12 steps ensures that the IRPI is operating correctly.
This surveillance is performed prior to reactor criticality after each removal of the reactor head, as there is the potential for unnecessary plant transients if the SR were performed with the reactor at power.
 
Rod Position Indication B 3.1.7  BASES  INDIAN POINT 2 B 3.1.7 - 7 Revision 0 REFERENCES 1. 10 CFR 50, Appendix A.
: 2. UFSAR, Chapter 14.
: 3. WCAP-15902, Conditional Extension of the Rod Misalignment Technical Specification for Indian Point Unit 2.
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8    INDIAN POINT 2 B 3.1.8 - 1 Revision 0 B 3.1  REACTIVITY CONTROL SYSTEMS B 3.1.8 PHYSICS TESTS Exceptions - MODE 2 BASES BACKGROUND The primary purpose of the MODE 2 PHYSICS TESTS exceptions is to permit relaxations of existing LCOs to allow certain PHYSICS TESTS to be performed.
 
Section XI of 10 CFR 50, Appendix B (Ref. 1), requires that a test program be established to ensure that structures, systems, and components will perform satisfactorily in service. All functions necessary to ensure that the specified design conditions are not exceeded during normal operation and anticipated operational occurrences must be tested. This testing is an integral part of the design, construction, and operation of the plant.
Requirements for notification of the NRC, for the purpose of conducting tests and experiments, are specified in 10 CFR 50.59 (Ref. 2).
 
The key objectives of a test program are to (Ref. 3):
: a. Ensure that the facility has been adequately designed,
: b. Validate the analytical models used in the design and analysis,
: c. Verify the assumptions used to predict unit response, and
: d. Ensure that installation of equipment in the facility has been accomplished in accordance with the design.
 
To accomplish these objectives, testing is performed prior to initial criticality, during startup, during low power operations, during power ascension, at high power, and after each refueling. The PHYSICS TESTS requirements for reload fuel cycles ensure that the operating characteristics of the core are consistent with the design predictions and that the core can be operated as designed (Ref. 4).
 
PHYSICS TESTS procedures are written and approved in accordance with established formats. The procedures include all information necessary to permit a detailed execution of the testing required to ensure that the design intent is met. PHYSICS TESTS are performed in accordance with these procedures and test results are approved prior to continued power escalation and long term power operation.
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8  BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.1.8 - 2 Revision 0 The PHYSICS TESTS required for reload fuel cycles (Ref. 4) in MODE 2 are listed in UFSAR, Section 13.6 (Ref. 7). APPLICABLE SAFETY ANALYSES  The fuel is protected by LCOs that preserve the initial conditions of the core assumed during the safety analyses. The methods for development of the LCOs that are excepted by this LCO are described in the Westinghouse Reload Safety Evaluation Methodology Report (Ref. 5). The above mentioned PHYSICS TESTS, and other tests that may be required to calibrate nuclear instrumentation or to diagnose operational problems, may require the operating control or process variables to deviate from their LCO limitations.
 
The UFSAR defines requirements for initial testing of the facility, including PHYSICS TESTS. UFSAR, Section 13.6 (Ref. 7) provides a summary of the zero, low power, and power tests. Requirements for reload fuel cycle PHYSICS TESTS are defined in ANSI/ANS-19.6.1-1985 (Ref. 4). Although these PHYSICS TESTS are generally accomplished within the limits for all LCOs, conditions may occur when one or more LCOs must be suspended to make completion of PHYSICS TESTS possible or practical. This is acceptable as long as the fuel design criteria are not violated. When one or more of the requirements specified in LCO 3.1.3, "Moderator Temperature Coefficient (MTC)," LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, and LCO 3.4.2 are suspended for PHYSICS TESTS, the fuel design criteria are preserved as long as the power level is limited to < 5% RTP, the reactor coolant temperature is kept  541F, and SDM is within the limits provided in the COLR for low power physics tests.
 
The PHYSICS TESTS include measurement of core nuclear parameters or the exercise of control components that affect process variables. Among the process variables involved are AFD and QPTR, which represent initial conditions of the unit safety analyses. Also involved are the movable control components (control and shutdown banks), which are required to shut down the reactor. The limits for these variables are specified for each fuel cycle in the COLR.
 
As described in LCO 3.0.7, compliance with Test Exception LCOs is optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test Exception LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8  BASES APPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.1.8 - 3 Revision 0 Reference 6 allows special test exceptions (STEs) to be included as part of the LCO that they affect. It was decided, however, to retain this STE as a separate LCO because it was less cumbersome and provided additional
 
clarity. LCO This LCO allows the reactor parameters of MTC and minimum temperature for criticality to be outside their specified limits. In addition, it allows selected control and shutdown rods to be positioned outside of their specified alignment and insertion limits. Operation beyond specified limits is permitted for the purpose of performing PHYSICS TESTS and poses no threat to fuel integrity, provided the SRs are met.
 
The requirements of LCO 3.1.3, LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, and LCO 3.4.2 may be suspended during the performance of PHYSICS TESTS provided:
: a. RCS lowest loop average temperature is  541F, 
: b. SDM is within the limits provided in the COLR, and 
: c. THERMAL POWER is < 5% RTP.
APPLICABILITY This LCO is applicable when performing low power PHYSICS TESTS. The Applicability is stated as "During PHYSICS TESTS initiated in MODE 2" to ensure that the 5% RPT maximum power level is not exceeded. Should the THERMAL POWER EXCEED 5% RPT, and consequently the unit enters MODE 1, this Applicability statement prevents exiting this Specification and its Required Actions.
ACTIONS A.1 and A.2
 
If the SDM requirement is not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. The operator should begin boration with the best source available for the plant conditions. Boration will be continued until SDM is within limit.
 
Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification.
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8  BASES ACTIONS  (continued) INDIAN POINT 2 B 3.1.8 - 4 Revision 0 B.1 When THERMAL POWER is > 5% RTP, the only acceptable action is to open the reactor trip breakers (RTBs) to prevent operation of the reactor beyond its design limits. Immediately opening the RTBs will shut down the reactor and prevent operation of the reactor outside of its design limits.
 
C.1 When the RCS lowest T avg is < 541F, the appropriate action is to restore T avg to within its specified limit. The allowed Completion Time of 15 minutes provides time for restoring T avg to within limits without allowing the plant to remain in an unacceptable condition for an extended period of time.
Operation with the reactor critical and with temperature below 541F could violate the assumptions for accidents analyzed in the safety analyses.
 
D.1 If the Required Actions cannot be completed within the associated Completion Time, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within an additional 15 minutes. The Completion Time of 15 additional minutes is reasonable, based on operating experience, for reaching MODE 3 in an orderly manner and without challenging plant systems. SURVEILLANCE SR  3.1.8.1 REQUIREMENTS The power range and intermediate range neutron detectors must be verified to be OPERABLE in MODE 2 by LCO 3.3.1, "Reactor Protection System (RPS) Instrumentation."  A CHANNEL OPERATIONAL TEST is performed on each power range and intermediate range channel prior to initiation of the PHYSICS TESTS. This will ensure that the RPS is properly aligned to provide the required degree of core protection during the performance of the PHYSICS TESTS.
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8  BASES SURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.1.8 - 5 Revision 0 SR  3.1.8.2
 
Verification that the RCS lowest loop T avg is  541F will ensure that the unit is not operating in a condition that could invalidate the safety analyses.
Verification of the RCS temperature at a Frequency of 30 minutes during the performance of the PHYSICS TESTS will ensure that the initial conditions of the safety analyses are not violated.
 
SR  3.1.8.3
 
Verification that the THERMAL POWER is < 5% RTP will ensure that the plant is not operating in a condition that could invalidate the safety analyses.
Verification of the THERMAL POWER at a Frequency of 30 minutes during the performance of the PHYSICS TESTS will ensure that the initial conditions of the safety analyses are not violated.
 
SR  3.1.8.4
 
The SDM is verified by performing a reactivity balance calculation, considering the following reactivity effects:
: a. RCS boron concentration,
: b. Control bank position,
: c. RCS average temperature,
: d. Fuel burnup based on gross thermal energy generation,
: e. Xenon concentration,
: f. Samarium concentration
: g. Isothermal temperature coefficient (ITC), when below the point of adding heat (POAH), 
: h. Moderator Defect, when above the POAH, and
: i. Doppler Defect, when above the POAH.
PHYSICS TESTS Exceptions - MODE 2 B 3.1.8  BASES SURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.1.8 - 6 Revision 0 Using the ITC accounts for Doppler reactivity in this calculation when the reactor is subcritical or critical but below the POAH, and the fuel temperature will be changing at the same rate as the RCS.
 
The Frequency of 24 hours is based on the generally slow change in required boron concentration and on the low probability of an accident occurring without the required SDM. REFERENCES 1. 10 CFR 50, Appendix B, Section XI.
: 2. 10 CFR 50.59.
: 3. Regulatory Guide 1.68, Revision 2, August, 1978.
: 4. ANSI/ANS-19.6.1-1985, December 13, 1985.
: 5. WCAP-9273-NP-A, "Westinghouse Reload Safety Evaluation Methodology Report," July 1985.
: 6. WCAP-11618, including Addendum 1, April 1989.
: 7. UFSAR, Section 13.6.
F Q (Z)B 3.2.1 INDIAN POINT 2B 3.2.1 - 1 Revision 1B 3.2  POWER DISTRIBUTION LIMITSB 3.2.1Heat Flux Hot Channel Factor (F Q (Z))BASESBACKGROUNDThe purpose of the limits on the values of F Q(Z) is to limit the local(i.e., pellet) peak power density. The value of F Q(Z) varies along the axialheight (Z) of the core.
 
F Q(Z) is defined as the maximum local fuel rod linear power density divided bythe average fuel rod linear power density, assuming nominal fuel pellet andfuel rod dimensions. Therefore, F Q(Z) is a measure of the peak fuel pelletpower within the reactor core.During power operation, the global power distribution is limited by LCO 3.2.3,"AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," which are directly and continuously measured process variables. These LCOs, along with LCO 3.1.6, "Control Bank Insertion Limits," maintain the core limits on power distributions on a continuous basis.
F Q(Z) varies with fuel loading patterns, control bank insertion, fuel burnup,and changes in axial power distribution.
 
F Q(Z) is measured periodically using the incore detector system. Thesemeasurements are generally taken with the core at or near equilibriumconditions. Using the measured three dimensional power distributions, it is possible to derive a measured value for F Q(Z). However, because this valuerepresents an equilibrium condition, it does not include the variations in the value of F Q(Z) which are present during nonequilibrium situations.Core monitoring and control under non-equilibrium conditions are accomplished by operating the core within the limits of the appropriate LCOs, including the limits on AFD, QPTR, and control rod insertion.APPLICABLE
 
SAFETY ANALYSESThis LCO precludes core power distributions that violate the following fuel design criteria:a. During a large break loss of coolant accident (LOCA), the peak claddingtemperature must not exceed 2200F (Ref. 1),
F Q (Z)B 3.2.1 BASESAPPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2B 3.2.1 - 2 Revision 1b. During a loss of forced reactor coolant flow accident, there must be atleast 95% probability at the 95% confidence level (the 95/95 DNBcriterion) that the hot fuel rod in the core does not experience a departure from nucleate boiling (DNB) condition,c. During an ejected rod accident, the energy deposition to the fuel mustnot exceed 200 cal/gm (Ref. 2), andd. The control rods must be capable of shutting down the reactor with aminimum required SDM with the highest worth control rod stuck fully withdrawn (Ref. 3).Limits on F Q(Z) ensure that the value of the initial total peaking factorassumed in the accident analyses remains valid. Other criteria must also be met (e.g., maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long term cooling). However, the peak cladding temperature is typically most limiting.
F Q(Z) limits assumed in the LOCA analysis are typically limiting relative to(i.e., lower than) the F Q(Z) limit assumed in safety analyses for otherpostulated accidents. Therefore, this LCO provides conservative limits forother postulated accidents F Q(Z) satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCOThe Heat Flux Hot Channel Factor, F Q(Z), shall be limited by the followingrelationships:
F Q (Z) ( FQ/P ) K(Z)where: FQ is the F Q(Z) limit at RTP provided in the COLR,K(Z) is the normalized F Q(Z) as a function of core height provided in the COLR, and P = THERMAL POWER/RTPThe actual values of FQ and K(Z) are given in the COLR.
F Q (Z)B 3.2.1 BASES LCO  (continued)
INDIAN POINT 2B 3.2.1 - 3 Revision 1 An F Q(Z) evaluation requires obtaining an incore flux map in MODE 1. Fromthe incore flux map results we obtain the measured value (F M Q (Z)) of F Q (Z). Then, F Q (Z) = F M Q (Z) (1.03) (1.05) = F M
Q (Z) (1.0815)where 1.0815 is a factor that accounts for fuel manufacturing tolerances of3% and flux map measurement uncertainty of 5% (75% available thimbles).
 
F Q(Z) is calculated at equilibrium conditions.
The F Q(Z) limits define limiting values for core power peaking that precludespeak cladding temperatures exceeding 2200F during either a large or smallbreak LOCA.This LCO requires operation within the bounds assumed in the safetyanalyses. Calculations are performed in the core design process to confirm that the core can be controlled in such a manner during operation that it can stay within the LOCA F Q(Z) limits. If F Q(Z) cannot be maintained within theLCO limits, reduction of the core power is required.Violating the LCO limits for F Q(Z) produces unacceptable consequences if adesign basis event occurs while F Q(Z) is outside its specified limits.APPLICABILITY The F Q(Z) limits must be maintained in MODE 1 to prevent core powerdistributions from exceeding the limits assumed in the safetyanalyses. Applicability in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the reactor coolant to require a limit on the distribution of core
 
power.ACTIONS A.1Reducing THERMAL POWER by 1% RTP for each 1% by which F Q (Z)exceeds its limit, maintains an acceptable absolute power density. F Q(Z) is F M Q(Z) multiplied by a factor accounting for manufacturing tolerances andmeasurement uncertainties. F M
Q(Z) is the measured value of F Q(Z). TheCompletion Time of 15 minutes provides an acceptable time to reduce powerin an orderly manner and without allowing the plant to remain in an unacceptable condition for an extended period of time.
F Q (Z)B 3.2.1 BASESACTIONS  (continued)
INDIAN POINT 2B 3.2.1 - 4 Revision 1 A.2A reduction of the Power Range Neutron Flux - High trip setpoints by 1% foreach 1% by which F Q(Z) exceeds its limit, is a conservative action forprotection against the consequences of severe transients with unanalyzedpower distributions. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period and the preceding prompt reduction in THERMAL POWER in accordance with Required Action A.1.
A.3Reduction in the OverpowerT trip setpoints (value of K
: 4) by 1% for each1% by which F Q(Z) exceeds its limit, is a conservative action for protectionagainst the consequences of severe transients with unanalyzed powerdistributions. The Completion Time of 72 hours is sufficient considering the small likelihood of a severe transient in this time period, and the preceding prompt reduction in THERMAL POWER in accordance with Required Action A.1.
A.4Verification that F Q(Z) has been restored to within its limit, by performingSR 3.2.1.1 prior to increasing THERMAL POWER above the limit imposed byRequired Action A.1, ensures that core conditions during operation at higher power levels and future operation are consistent with safety analyses assumptions.Condition A is modified by a Note that requires Required Action A.4 to beperformed whenever the Condition is entered. This ensures that SR 3.2.1.1 will be performed prior to increasing THERMAL POWER above the limit of Required Action A.1, even when Condition A is exited prior to performing Required Action A.4. Performance of SR 3.2.1.1 is necessary to assure
 
F Q(Z) is properly evaluated prior to increasing THERMAL POWER.
F Q (Z)B 3.2.1 BASESACTIONS  (continued)
INDIAN POINT 2B 3.2.1 - 5 Revision 1 B.1If Required Actions A.1 through A.4 are not met within their associatedCompletion Times, the plant must be placed in a MODE or Condition in which the LCO requirements are not applicable. This is done by placing the plant in at least MODE 2 within 6 hours.This allowed Completion Time is reasonable based on operating experienceregarding the amount of time it takes to reach MODE 2 from full power operation in an orderly manner and without challenging plant systems.SURVEILLANCE REQUIREMENTSSR 3.2.1.1 is modified by a Note. The Note applies during the first power ascension after a refueling. It states that THERMAL POWER may be increased until an equilibrium power level has been achieved at which a power distribution map can be obtained. This allowance is modified by aFrequency condition that requires verification that F Q(Z) is within specifiedlimits after a power rise of more than 10% RTP over the THERMAL POWERat which it was last verified to be within specified limits. Because F Q(Z) couldnot have previously been measured in this reload core, there is a second Frequency condition, applicable only for reload cores, that requires determination of these parameters before exceeding 75% RTP. This ensures that some determination of F Q(Z) is made at a lower power level at whichadequate margin is available before going to 100% RTP. Also, this Frequency condition, together with the Frequency condition requiring verification of F Q(Z) following a power increase of more than 10%, ensuresperformance as soon as RTP (or any other level for extended operation) is achieved. In the absence of these Frequency conditions, it is possible to increase power to RTP and operate for 31 days without verification of
 
F Q(Z). The Frequency condition is not intended to require verification of F Q (Z)after every 10% increase in power level above the last verification. It only requires verification after a power level is achieved for extended operation that is 10% higher than that power at which F Q(Z) was last measured.SR  3.2.1.1Verification that F Q(Z) is within its specified limits involves increasing F M Q (Z) toallow for manufacturing tolerance and measurement uncertainties in order to obtain F Q(Z). Specifically, F M Q(Z) is the measured value of F Q (Z) obtained fromincore flux map results and F Q(Z) = F M Q (Z) 1.0815. F Q(Z) is then compared toits specified limits.
F Q (Z)B 3.2.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.2.1 - 6 Revision 1The limit with which F Q(Z) is compared varies inversely with power above50% RTP and directly with a function called K(Z) provided in the COLR.Performing this Surveillance in MODE 1 prior to exceeding 75% RTP ensures that the F Q(Z) limit is met when RTP is achieved, because the highestpeaking factors generally decrease as core average power level is increased.If THERMAL POWER has been increased by 10% RTP since the lastdetermination of F Q(Z), another evaluation of this factor is required 12 hoursafter achieving equilibrium conditions at this higher power level (to ensurethat F Q(Z) values are being reduced sufficiently with power increase to staywithin the LCO limits).The Frequency of 31 EFPD is adequate to monitor the change of powerdistribution with core burnup because such changes are slow and well controlled when the plant is operated in accordance with the Technical Specifications (TS).REFERENCES1. 10 CFR 50.46, 1974.2. UFSAR, Section 14.2.6.
: 3. 10 CFR 50, Appendix A.
F N HB 3.2.2 INDIAN POINT 2B 3.2.2 - 1 Revision 2B 3.2  POWER DISTRIBUTION LIMITSB 3.2.2Nuclear Enthalpy Rise Hot Channel Factor (F N H)BASESBACKGROUNDThe purpose of this LCO is to establish limits on the power density at anypoint in the core so that the fuel design criteria are not exceeded and the accident analysis assumptions remain valid. The design limits on local (pellet) and integrated fuel rod peak power density are expressed in terms of hot channel factors. Control of the core power distribution with respect to these factors ensures that local conditions in the fuel rods and coolant channels do not challenge core integrity at any location during either normal operation or a postulated accident analyzed in the safety analyses.
F N H is defined as the ratio of the integral of the linear power along the fuel rodwith the highest integrated power to the average integrated fuel rod power.Therefore, F N H is a measure of the maximum total power produced in a fuel rod.F N H is sensitive to fuel loading patterns, bank insertion, and fuel burnup. F N Htypically increases with control bank insertion and typically decreases with fuel burnup.
F N H is not directly measurable but is inferred from a power distribution mapobtained with the movable incore detector system. Specifically, the results ofthe three dimensional power distribution map are analyzed by a computer to determine F N H. This factor is calculated at least every 31 EFPD. However,during power operation, the global power distribution is monitored by LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," which address directly and continuously measured process variables.The COLR provides peaking factor limits that ensure that the design basisvalue of the departure from nucleate boiling (DNB) is met for normal operation, operational transients, and any transient condition arising from events of moderate frequency. The DNB design basis precludes DNB and is met by limiting the minimum local DNB heat flux ratio to 1.17 using the WRB-1 DNB correlation for 15 X 15 fuel. All DNB limited transient events are assumed to begin with an F N H value that satisfies the LCO requirements.Operation outside the LCO limits may produce unacceptable consequences if a DNB limiting event occurs. The DNB design basis ensures that there is no overheating of the fuel that results in possible cladding perforation with the release of fission products to the reactor coolant.
F N HB 3.2.2 BASES INDIAN POINT 2B 3.2.2 - 2 Revision 2APPLICABLE SAFETY ANALYSESLimits on F N H preclude core power distributions that exceed the following fueldesign limits:a. There must be at least 95% probability at the 95% confidence level (the95/95 DNB criterion) that the hottest fuel rod in the core does notexperience a DNB condition,b. During a large break loss of coolant accident (LOCA), peak claddingtemperature (PCT) must not exceed 2200 F,c. During an ejected rod accident, the energy deposition to the fuel mustnot exceed 200 cal/gm (Ref. 1), andd. Fuel design limits required by GDC 26 (Ref. 2) for the condition whencontrol rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn.For transients that may be DNB limited, the Reactor Coolant System flow and
 
F N H are the core parameters of most importance. The limits on F N H ensurethat the DNB design basis is met for normal operation, operational transients, and any transients arising from events of moderate frequency. The DNB design basis is met by limiting the minimum DNBR to the 95/95 DNB criterion of 1.17 using the WRB-1 DNB correlation for 15 X 15 fuel. This value provides a high degree of assurance that the hottest fuel rod in the core does
 
not experience a DNB.The allowable F N H limit increases with decreasing power level. Thisfunctionality in F N H is included in the analyses that provide the Reactor CoreSafety Limits (SLs) of SL 2.1.1. Therefore, any DNB events in which thecalculation of the core limits is modeled implicitly use this variable value of
 
F N H in the analyses. Likewise, all transients that may be DNB limited areassumed to begin with an initial F N H as a function of power level defined bythe COLR limit equation.The LOCA safety analysis indirectly models F N H as an input parameter. TheNuclear Heat Flux Hot Channel Factor (F Q(Z)) and the axial peaking factorsare inserted directly into the LOCA safety analyses that verify theacceptability of the resulting peak cladding temperature (Ref. 3).
F N HB 3.2.2 BASESAPPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2B 3.2.2 - 3 Revision 2The fuel is protected in part by the following Technical Specifications, whichensure that the initial conditions assumed in the safety and accident analyses remain valid:  LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," LCO 3.1.6, "Control Bank Insertion Limits," LCO 3.2.2, "Nuclear Enthalpy Rise Hot Channel Factor (F N H)," and LCO 3.2.1, "Heat Flux Hot Channel Factor (F Q (Z))."F N H and F Q(Z) are measured periodically using the movable incore detectorsystem. Measurements are generally taken with the core at, or near, steady state conditions. Core monitoring and control under transient conditions (Condition 1 events) are accomplished by operating the core within the limits of the LCOs on AFD, QPTR, and Bank Insertion Limits.
F N H satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO F N H shall be maintained within the limits of the relationship provided in theCOLR.
The F N H limit identifies the coolant flow channel with the maximum enthalpyrise. This channel has the least heat removal capability and thus the highestprobability for a DNB.The limiting value of F N H, described by the equation contained in the COLR, isthe design radial peaking factor used in the unit safety analyses.
A power multiplication factor in this equation includes an additional margin forhigher radial peaking from reduced thermal feedback and greater control rod insertion at low power levels. The limiting value of F N H is allowed to increase0.3% for every 1% RTP reduction in THERMAL POWER.APPLICABILITY The F N H limits must be maintained in MODE 1 to preclude core powerdistributions from exceeding the fuel design limits for DNBR and PCT.
Applicability in other modes is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the coolant to require a limit on the distribution of core power. Specifically, the design bases events that are sensitive to F N H in other modes (MODES 2 through 5)have significant margin to DNB, and therefore, there is no need  to restrict
 
F N H in these modes.
F N HB 3.2.2 BASES INDIAN POINT 2B 3.2.2 - 4 Revision 2ACTIONSA.1.1With F N H exceeding its limit, the unit is allowed 4 hours to restore F N H towithin its limits. This restoration may, for example, involve realigning anymisaligned rods or reducing power enough to bring F N H within its powerdependent limit. When the F N H limit is exceeded, the DNBR limit is not likelyviolated in steady state operation, because events that could significantly perturb the F N H value (e.g., static control rod misalignment) are considered inthe safety analyses. However, the DNBR limit may be violated if a DNB limiting event occurs. Thus, the allowed Completion Time of 4 hours provides an acceptable time to restore F N H to within its limits without allowingthe plant to remain in an unacceptable condition for an extended period of time.Condition A is modified by a Note that requires that Required Actions A.2and A.3 must be completed whenever Condition A is entered. Thus, if poweris not reduced because this Required Action is completed within the 4 hour time period, Required Action A.2 nevertheless requires another measurement and calculation of F N H within 24 hours in accordance with SR 3.2.2.1.However, if power is reduced below 50% RTP, Required Action A.3 requires that another determination of F N H must be done prior to exceeding 50% RTP,prior to exceeding 75% RTP, and within 24 hours after reaching or exceeding 95% RTP. A single performance of SR 3.2.2.1 may be used to satisfy requirements of both Required Action A.2 and A.3, if it is completed within 24 hours of entering Condition A.A.1.2.1 and A.1.2.2If the value of F N H is not restored to within its specified limit either by adjustinga misaligned rod or by reducing THERMAL POWER, the alternative option isto reduce THERMAL POWER to 50% RTP in accordance with RequiredAction A.1.2.1 and reduce the Power Range Neutron Flux - High to 55% RTP in accordance with Required Action A.1.2.2. Reducing RTP to 50% RTP increases the DNB margin and does not likely cause the DNBRlimit to be violated in steady state operation. The reduction in trip setpoints ensures that continuing operation remains at an acceptable low power level with adequate DNBR margin. The allowed Completion Time of 4 hours for Required Action A.1.2.1 is consistent with those allowed for in Required Action A.1.1 and provides an acceptable time to reach the required power level from full power operation without allowing F N HB 3.2.2 BASESACTIONS  (continued)
INDIAN POINT 2B 3.2.2 - 5 Revision 2the plant to remain in an unacceptable condition for an extended period oftime. The Completion Times of 4 hours for Required Actions A.1.1 and A.1.2.1 are not additive.The allowed Completion Time of 72 hours to reset the trip setpoints perRequired Action A.1.2.2 recognizes that, once power is reduced, the safety analysis assumptions are satisfied and there is no urgent need to reduce the trip setpoints. This is a sensitive operation that may inadvertently trip the Reactor Protection System.
A.2Once the power level has been reduced per Required Action A.1.2.1, anincore flux map (SR 3.2.2.1) must be obtained and the measured value of F N Hverified not to exceed the allowed limit at the lower power level. The unit is provided 20 additional hours to perform this task over and above the 4 hours allowed by either Action A.1.1 or Action A.1.2.1. The Completion Time of 24 hours is acceptable because of the increase in the DNB margin, which is obtained at lower power levels, and the low probability of having a DNB limiting event within this 24 hour period. Additionally, operating experience has indicated that this Completion Time is sufficient to obtain the incore flux map, perform the required calculations, and evaluate F N H. A singleperformance of SR 3.2.2.1 may be used to satisfy requirements of both Required Action A.2 and A.3, if it is completed within 24 hours of entering
 
Condition A.
A.3Verification that F N H is within its specified limits after an out of limitoccurrence ensures that the cause that led to the F N H exceeding its limit iscorrected, and that subsequent operation proceeds within the LCO limit. ThisAction demonstrates that the F N H limit is within the LCO limits prior toexceeding 50% RTP, again prior to exceeding 75% RTP, and within 24 hours after THERMAL POWER is 95% RTP. A single performance of SR 3.2.2.1may be used to satisfy requirements of both Required Action A.2 and A.3, if it is completed within 24 hours of entering Condition A.This Required Action is modified by a Note that states that THERMALPOWER does not have to be reduced prior to performing this Action.
F N HB 3.2.2 BASESACTIONS  (continued)
INDIAN POINT 2B 3.2.2 - 6 Revision 2 B.1When Required Actions A.1.1 through A.3 cannot be completed within theirrequired Completion Times, the plant must be placed in a mode in which the LCO requirements are not applicable. This is done by placing the plant in at least MODE 2 within 6 hours. The allowed Completion Time of 6 hours is reasonable, based on operating experience regarding the time required to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCESR  3.2.2.1REQUIREMENTSThe value of F N H is determined by using the movable incore detectorsystem to obtain a flux distribution map. A data reduction computer program then calculates the maximum value of F N H from the measured fluxdistributions. The measured value of F N H must be multiplied by 1.04 (75%available thimbles) to account for measurement uncertainty before making comparisons to the F N H limit.After each refueling, F N H must be determined in MODE 1 prior to exceeding75% RTP. This requirement ensures that F N H limits are met at the beginningof each fuel cycle.The 31 EFPD Frequency is acceptable because the power distributionchanges relatively slowly over this amount of fuel burnup. Accordingly, this Frequency is short enough that the F N H limit cannot be exceeded for anysignificant period of operation.REFERENCES 1.UFSAR, Section 14.2.6.2.10 CFR 50, Appendix A.3.10 CFR 50.46.
AFD (CAOC Methodology) B 3.2.3  INDIAN POINT 2 B 3.2.3 - 1 Revision 0 B 3.2  POWER DISTRIBUTION LIMITS B 3.2.3 AXIAL FLUX DIFFERENCE (AFD) (Constant Axial Offset Control (CAOC) Methodology)
 
BASES  BACKGROUND The purpose of this LCO is to establish limits on the values of the AFD in order to limit the axial power distribution skewing to either the top or bottom of the core. By limiting the amount of power distribution skewing, core peaking factors are consistent with the assumptions used in the safety analyses. Limiting power distribution skewing over time also minimizes the xenon distribution skewing, which is a significant factor in axial power distribution control.
 
The operating scheme used to control the axial power distribution, CAOC, involves maintaining the AFD within a tolerance band around a burnup dependent target, known as the target flux difference, to minimize the variation of the axial peaking factor and axial xenon distribution during unit maneuvers.
 
The target flux difference is determined at equilibrium xenon conditions. The control banks must be positioned within the core in accordance with their insertion limits and Control Bank D should be inserted near its normal position (i.e.,  210 steps withdrawn) for steady state operation at high power levels. The power level should be as near RTP as practical. The value of the target flux difference obtained under these conditions divided by the Fraction of RTP is the target flux difference at RTP for the associated core burnup conditions. Target flux differences for other THERMAL POWER levels are obtained by multiplying the RTP value by the appropriate fractional THERMAL POWER level.
 
The AFD is monitored on an automatic basis using the unit process computer that has an AFD monitor alarm. The computer determines the 1 minute average of each of the OPERABLE excore detector outputs and provides an alarm message immediately if the AFDs for two or more OPERABLE excore channels are outside the target band and the THERMAL POWER is  90% RTP. During operation at THERMAL POWER levels  90% RTP but  15% RTP, the computer sends an alarm message when the cumulative penalty deviation time is  1 hour in the previous 24 hours.
 
Periodic updating of the target flux difference value is necessary to follow the change of the flux difference at steady state conditions with burnup.
AFD (CAOC Methodology) B 3.2.3 BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.2.3 - 2 Revision 0 The Nuclear Enthalpy Rise Hot Channel Factor (F N H) and QPTR LCOs limit the radial component of the peaking factors.
APPLICABLE SAFETY ANALYSES The AFD is a measure of axial power distribution skewing to the top or bottom half of the core. The AFD is sensitive to many core related parameters such as control bank positions, core power level, axial burnup, axial xenon distribution and, to a lesser extent, reactor coolant temperature and boron concentrations. The allowed range of the AFD is used in the nuclear design process to confirm that operation within these limits produces core peaking factors and axial power distributions that meet safety analysis requirements.
 
The CAOC methodology entails:
: a. Establishing an envelope of allowed power shapes and power densities, 
: b. Devising an operating strategy for the cycle that maximizes unit flexibility (maneuvering) and minimizes axial power shape changes, 
: c. Demonstrating that this strategy does not result in core conditions that violate the envelope of permissible core power characteristics, and
: d. Demonstrating that this power distribution control scheme can be effectively supervised with excore detectors.
 
The limits on the AFD ensure that the Heat Flux Hot Channel Factor (F Q (Z)) is not exceeded during either normal operation or in the event of xenon redistribution following power changes. The limits on the AFD also limit the range of power distributions that are assumed as initial conditions in analyzing Condition II, III, and IV events. This ensures that fuel cladding integrity is maintained for these postulated accidents. The most important Condition IV event is the loss of coolant accident. The most significant Condition III event is the loss of flow accident. The most significant Condition II events are uncontrolled bank withdrawal and boration or dilution accidents. Condition II accidents, assumed to begin from within the AFD limits, are used to confirm the adequacy of Overpower T and Overtemperature T trip setpoints.
 
The limits on the AFD satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
AFD (CAOC Methodology) B 3.2.3 BASES  INDIAN POINT 2 B 3.2.3 - 3 Revision 0 LCO The shape of the power profile in the axial (i.e., the vertical) direction is largely under the control of the operator, through either the manual operation of the control banks, or automatic motion of control banks responding to temperature deviations resulting from either manual operation of the Chemical and Volume Control System to change boron concentration, or from power level changes.
 
The AFD LCO establishes the limits for how much and for how long the measured AFD may deviate from a predetermined AFD. The amount that the measured AFD may deviate from the target AFD is called the "target band" which is specified in the COLR. If the measured AFD is within the "target band," then there are no restrictions on plant operations.
 
If the measured AFD cannot be consistently maintained within the "target band" but can be maintained within the "acceptable operation limits," then reactor power must be reduced to  90% RTP. However, even when operating with reduced power (i.e.,  90% and  50%), the measured AFD must be maintained within the target band for 23 out of every 24 hours (the cumulative penalty deviation time cannot be exceeded); otherwise additional power reductions are required.
 
If the measured axial flux difference cannot be maintained within the "acceptable operation limits" or the cumulative penalty deviation time for operating outside the target band is exceeded, then reactor power must be reduced to  50% RTP. There are no restrictions on measured AFD when reactor power is  50% RTP; however, the measured AFD must be within the "target band" for a specified period of time (the cumulative penalty deviation time must be within a specified limit) before reactor power can be increased  50% RTP.
 
Signals are available to the operator from the Nuclear Instrumentation System (NIS) excore neutron detectors (Ref. 1). Separate signals are taken from the top and bottom detectors. The AFD is defined as the difference in normalized flux signals between the top and bottom excore detector in each detector well. For convenience, this flux difference is converted to provide flux difference units expressed as a percentage and labeled as % flux or %I.
AFD (CAOC Methodology) B 3.2.3 BASES LCO  (continued) INDIAN POINT 2 B 3.2.3 - 4 Revision 0 The required target band varies with axial burnup distribution, which in turn varies with the core average accumulated burnup. The target band defined in the COLR may provide one target band for the entire cycle or more than one band, each to be followed for a specific range of cycle burnup. With THERMAL POWER  90% RTP, the AFD must be kept within the target band. With the AFD outside the target band with THERMAL POWER  90% RTP, the assumptions of the accident analyses may be violated.
 
In some case, the limits established for the required target band fall outside the region normally defined as the acceptable operation limits. Operation within the target band is always considered to be within the acceptable operation limits.
 
The frequency of monitoring the AFD by the unit computer is once per minute providing an essentially continuous accumulation of penalty deviation time that allows the operator to accurately assess the status of the penalty deviation time.
 
Violating the LCO on the AFD could produce unacceptable consequences if a Condition II, III, or IV event occurs while the AFD is outside its limits.
 
The LCO is modified by four Notes. Note 1 states the conditions necessary for declaring the AFD outside of the target band. Notes 2 and 3 describe how the cumulative penalty deviation time is calculated. It is intended that the unit is operated with the AFD within the target band about the target flux difference. However, during rapid THERMAL POWER reductions, control bank motion may cause the AFD to deviate outside of the target band at reduced THERMAL POWER levels. This deviation does not affect the xenon distribution sufficiently to change the envelope of peaking factors that may be reached on a subsequent return to RTP with the AFD within the target band, provided the time duration of the deviation is limited.
Accordingly, while THERMAL POWER is  50% RTP and  90% RTP (i.e., Part b of this LCO), a 1 hour cumulative penalty deviation time limit, cumulative during the preceding 24 hours, is allowed during which the unit may be operated outside of the target band but within the acceptable operation limits provided in the COLR (Note 2). This penalty time is accumulated at the rate of 1 minute for each 1 minute of operating time within the power range of Part b of this LCO (i.e., THERMAL POWER  50% RTP). The cumulative penalty time is the sum of penalty times from Parts b and c of this LCO.
AFD (CAOC Methodology) B 3.2.3 BASES LCO  (continued) INDIAN POINT 2 B 3.2.3 - 5 Revision 0 For THERMAL POWER levels  15% RTP and  50% RTP (i.e., Part c of this LCO), deviations of the AFD outside of the target band are less significant. Note 3 allows the accumulation of 1/2 minute penalty deviation time per 1 minute of actual time outside the target band and reflects this reduced significance. With THERMAL POWER  15% RTP, AFD is not a significant parameter in the assumptions used in the safety analysis and, therefore, requires no limits. Because the xenon distribution produced at THERMAL POWER levels less than RTP does affect the power distribution as power is increased, unanalyzed xenon and power distribution is prevented by limiting the accumulated penalty deviation time.
 
For surveillance of the power range channels performed according to SR 3.3.1.6, Note 4 allows deviation outside the target band for 16 hours and no penalty deviation time accumulated. Some deviation in the AFD is required for doing the NIS calibration with the incore detector system. This calibration is performed every 92 days.
APPLICABILITY AFD requirements are applicable in MODE 1 above 15% RTP. At or above 50% RTP, the combination of THERMAL POWER and core peaking factors are the core parameters of primary importance in safety analyses.
 
Between 15% RTP and 90% RTP, this LCO is applicable to ensure that the distributions of xenon are consistent with safety analysis assumptions.
 
At or below 15% RTP and for lower operating MODES, the stored energy in the fuel and the energy being transferred to the reactor coolant are low. The value of the AFD in these conditions does not affect the consequences of the design basis events.
 
Low signal levels in the excore channels may preclude obtaining valid AFD signals below 15% RTP. ACTIONS A.1
 
With the AFD outside the target band and THERMAL POWER  90% RTP, the assumptions used in the accident analyses may be violated with respect to the maximum heat generation. Therefore, a Completion Time of 15 minutes is allowed to restore the AFD to within the target band because xenon distributions change little in this relatively short time.
AFD (CAOC Methodology) B 3.2.3 BASES ACTIONS  (continued) INDIAN POINT 2 B 3.2.3 - 6 Revision 0 B.1 If the AFD cannot be restored within the target band, then reducing THERMAL POWER to  90% RTP places the core in a condition that has been analyzed and found to be acceptable, provided that the AFD is within the acceptable operation limits provided in the COLR.
 
The allowed Completion Time of 15 minutes provides an acceptable time to reduce power to  90% RTP without allowing the plant to remain in an unanalyzed condition for an extended period of time.
 
C.1 With THERMAL POWER  90% RTP but  50% RTP, operation with the AFD outside the target band is allowed for up to 1 hour if the AFD is within the acceptable operation limits provided in the COLR. With the AFD within these limits, the resulting axial power distribution is acceptable as an initial condition for accident analyses assuming the then existing xenon distributions. The 1 hour cumulative penalty deviation time restricts the extent of xenon redistribution. Without this limitation, unanalyzed xenon axial distributions may result from a different pattern of xenon buildup and decay. The reduction to a power level  50% RTP puts the reactor at a THERMAL POWER level at which the AFD is not a significant accident analysis parameter.
 
If the indicated AFD is outside the target band and outside the acceptable operation limits provided in the COLR, the peaking factors assumed in accident analysis may be exceeded with the existing xenon condition.  (Any AFD within the target band is acceptable.)  The Completion Time of 30 minutes allows for a prompt, yet orderly, reduction in power.
 
Condition C is modified by a Note that requires that Required Action C.1 must be completed whenever this Condition is entered.
 
D.1 If Required Action C.1 is not completed within its required Completion Time of 30 minutes, the axial xenon distribution starts to become significantly skewed with the THERMAL POWER  50% RTP. In this situation, the assumption that a cumulative penalty deviation time of 1 hour or less during the previous 24 hours while the AFD is outside its target band is acceptable at  50% RTP, is no longer valid.
AFD (CAOC Methodology) B 3.2.3 BASES ACTIONS  (continued) INDIAN POINT 2 B 3.2.3 - 7 Revision 0 Reducing the power level to  15% RTP within the Completion Time of 9 hours and complying with LCO penalty deviation time requirements for subsequent increases in THERMAL POWER ensure that acceptable xenon conditions are restored.
 
This Required Action must also be implemented either if the cumulative penalty deviation time is > 1 hour during the previous 24 hours, or the AFD is not within the target band and not within the acceptable operation limits.
SURVEILLANCE SR  3.2.3.1 REQUIREMENTS This Surveillance verifies that the AFD as indicated by the NIS excore channels is within the target band. The Surveillance Frequency of 7 days is adequate because the AFD is controlled by the operator and monitored by the process computer. More frequent monitoring is necessary when alarms provided by the process computer are not available. Any deviations of the AFD from the target band that is not alarmed should be readily noticed.
 
The AFD should be monitored and logged more frequently in periods of operation for which the power level or control bank positions are changing to allow corrective measures when the AFD is more likely to move outside the target band.
 
SR  3.2.3.2
 
This Surveillance requires that the target flux difference is updated at a Frequency of 31 effective full power days (EFPD) to account for small changes that may occur in the target flux differences in that period due to burnup by performing SR 3.2.3.3.
 
Alternatively, linear interpolation between the most recent measurement of the target flux differences and a predicted end of cycle value provides a reasonable update because the AFD changes due to burnup tend toward 0% AFD. When the predicted end of cycle AFD from the cycle nuclear design is different from 0%, it may be a better value for the interpolation.
AFD (CAOC Methodology) B 3.2.3 BASES SURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.2.3 - 8 Revision 0 SR  3.2.3.3
 
Measurement of the target flux difference is accomplished by taking a flux map when the core is at equilibrium xenon conditions, preferably at high power levels with the control banks nearly withdrawn. This flux map provides the equilibrium xenon axial power distribution from which the target value can be determined. The target flux difference varies slowly with core burnup.
 
A Frequency of 31 EFPD after each refueling and 92 EFPD thereafter for remeasuring the target flux differences adjusts the target flux difference for each excore channel to the value measured at steady state conditions. This is the basis for the CAOC. Remeasurement at this Surveillance interval also establishes the AFD target flux difference values that account for changes in incore excore calibrations that may have occurred in the interim.
 
A Note modifies this SR to allow the predicted AFD from the cycle nuclear design to be used to determine the initial target flux difference after each refueling.
REFERENCES 1. UFSAR, Section 7.4.
QPTR B 3.2.4  INDIAN POINT 2 B 3.2.4 - 1 Revision 0 B 3.2  POWER DISTRIBUTION LIMITS B 3.2.4 QUADRANT POWER TILT RATIO (QPTR) BASES BACKGROUND The QPTR limit ensures that the gross radial power distribution remains consistent with the design values used in the safety analyses. Precise radial power distribution measurements are made during startup testing, after refueling, and periodically during power operation.
 
The power density at any point in the core must be limited so that the fuel design criteria are maintained. Together, LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," LCO 3.2.4, and LCO 3.1.6, "Control Bank Insertion Limits," provide limits on process variables that characterize and control the three dimensional power distribution of the reactor core. Control of these variables ensures that the core operates within the fuel design criteria and that the power distribution remains within the bounds used in the safety analyses. APPLICABLE SAFETY ANALYSES This LCO precludes core power distributions that violate the following fuel design criteria: a. During a large break loss of coolant accident, the peak cladding temperature must not exceed 2200F (Ref. 1),  b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95% confidence level (the 95/95 departure from nucleate boiling (DNB) criterion) that the hottest fuel rod in the core does not experience a DNB condition, 
: c. During an ejected rod accident, the energy deposition to the fuel must not exceed 200 cal/gm (Ref. 2), and
: d. The control rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn (Ref. 3).
 
The LCO limits on the AFD, the QPTR, the Heat Flux Hot Channel Factor (F Q(Z)), the Nuclear Enthalpy Rise Hot Channel Factor (F N H), and control bank insertion are established to preclude core power distributions that exceed the safety analyses limits.
QPTR B 3.2.4 BASES APPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.2.4 - 2 Revision 0 The QPTR limits ensure that F N H and F Q(Z) remain below their limiting values by preventing an undetected change in the gross radial power distribution.
 
In MODE 1, the F N H and F Q(Z) limits must be maintained to preclude core power distributions from exceeding design limits assumed in the safety analyses.
 
The QPTR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCO The QPTR limit of 1.02, at which corrective action is required, provides a margin of protection for both the DNB ratio and linear heat generation rate contributing to excessive power peaks resulting from X-Y plane power tilts. A limiting QPTR of 1.02 can be tolerated before the margin for uncertainty in F Q(Z) and (F N H) is possibly challenged.
APPLICABILITY The QPTR limit must be maintained in MODE 1 with THERMAL POWER  50% RTP to prevent core power distributions from exceeding the design limits.
Applicability in MODE 1  50% RTP and in other MODES is not required because there is either insufficient stored energy in the fuel or insufficient energy being transferred to the reactor coolant to require the implementation of a QPTR limit on the distribution of core power. The QPTR limit in these conditions is, therefore, not important. Note that the F N H and F Q(Z) LCOs still apply, but allow progressively higher peaking factors at 50% RTP or lower.
ACTIONS A.1 With the QPTR exceeding its limit, a power level reduction of 3% from RTP for each 1% by which the QPTR exceeds 1.00 is a conservative tradeoff of total core power with peak linear power. The Completion Time of 2 hours allows sufficient time to identify the cause and correct the tilt. Note that the power reduction itself may cause a change in the tilted condition.
 
The maximum allowable power level initially determined by Required Action A.1 may be affected by subsequent determinations of QPTR. Increases in QPTR would require power reduction within 2 hours of QPTR determination, QPTR B 3.2.4 BASES ACTIONS  (continued) INDIAN POINT 2 B 3.2.4 - 3 Revision 0 if necessary to comply with the decreased maximum allowable power level.
Decreases in QPTR would allow raising the maximum allowable THERMAL POWER level and increasing THERMAL POWER up to this revised limit.
 
A.2 After completion of Required Action A.1, the QPTR may still exceed the specified limit. As such, any additional changes in the QPTR are detected by requiring a check of the QPTR once per 12 hours thereafter. A 12 hour Completion Time is sufficient because any additional change in QPTR would be relatively slow.
 
A.3 The peaking factors F Q(Z) and F N H are of primary importance in ensuring that the power distribution remains consistent with the initial conditions used in the safety analyses. Performing SRs on F N H and F Q(Z) within the Completion Time of 24 hours after achieving equilibrium conditions from a Thermal Power reduction power Required Action A.1 ensures that these primary indicators of power distribution are within their respective limits. Equilibrium conditions are achieved when the core is sufficiently stable at intended operating conditions to support flux mapping. A Completion Time of 24 hours after achieving equilibrium conditions from Thermal Power reduction per Required Action A.1 takes into consideration the rate at which peaking factors are likely to change, and the time required to stabilize the plant and perform a flux map. If these peaking factors are not within their limits, the Required Actions of these Surveillances provide an appropriate response for the abnormal condition. As long as the power restrictions imposed by Required Action A.1 are needed to meet QPTR limits, the peaking factor surveillances are required each 7 days thereafter to evaluate
 
F N H and F Q(Z) with changes in power distribution. Relatively small changes are expected due to either burnup and xenon redistribution or correction of the cause for exceeding the QPTR limit.
 
A.4 Although F N H and F Q(Z) are of primary importance as initial conditions in the safety analyses, other changes in the power distribution may occur as the QPTR limit is exceeded and may have an impact on the validity of the safety analysis. A change in the power distribution can affect such reactor parameters as bank worths and peaking factors for rod malfunction accidents. When the QPTR exceeds its limit, it does not necessarily mean a safety concern exists. It does mean that there is an indication of a change in QPTR B 3.2.4 BASES ACTIONS  (continued) INDIAN POINT 2 B 3.2.4 - 4 Revision 0 the gross radial power distribution that requires an investigation and evaluation that is accomplished by examining the incore power distribution.
Specifically, the core peaking factors and the quadrant tilt must be evaluated because they are the factors that best characterize the core power distribution. This re-evaluation is required to ensure that, before increasing THERMAL POWER to above the limit of Required Action A.1, the reactor core conditions are consistent with the assumptions in the safety analyses.
 
A.5 If the QPTR has exceeded the 1.02 limit and a re-evaluation of the safety analysis is completed and shows that safety requirements are met, the excore detectors are normalized to restore QPTR to within limits prior to increasing THERMAL POWER to above the limit of Required Action A.1.
Normalization is accomplished in such a manner that the indicated QPTR following normalization is near 1.00. This is done to detect any subsequent significant changes in QPTR.
 
Required Action A.5 is modified by two Notes. Note 1 states that the QPTR is not restored to within limits via normalization until after the re-evaluation of the safety analysis has determined that core conditions at RTP are within the safety analysis assumptions (i.e., Required Action A.4). Note 2 states that if Required Action A.5 is performed, then Required Action A.6 shall be performed. Required Action A.5 normalizes the excore detectors to restore QPTR to within limits, which restores compliance with LCO 3.2.4. Thus, Note 2 prevents exiting the Actions prior to completing flux mapping to verify peaking factors, per Required Action A.6. These Notes are intended to prevent any ambiguity about the required sequence of actions.
 
A.6 Once the flux tilt is restored to within limits (i.e., Required Action A.5 is performed), it is acceptable to return to full power operation. However, as an added check that the core power distribution is consistent with the safety analysis assumptions, Required Action A.6 requires verification that F Q (Z) and F N H are within their specified limits within 24 hours of achieving equilibrium conditions at RTP. As an added precaution, if the core power does not reach equilibrium conditions at RTP within 24 hours, but is increased slowly, then the peaking factor surveillances must be performed within 48 hours after increasing THERMAL POWER above the limit of Required Action A.1. These Completion Times are intended to allow QPTR B 3.2.4 BASES ACTIONS  (continued) INDIAN POINT 2 B 3.2.4 - 5 Revision 0 adequate time to increase THERMAL POWER to above the limit of Required Action A.1, while not permitting the core to remain with unconfirmed power distributions for extended periods of time.
 
Required Action A.6 is modified by a Note that states that the peaking factor surveillances may only be done after the excore detectors have been normalized to restore QPTR to within limits (i.e., Required Action A.5). The intent of this Note is to have the peaking factor surveillances performed at operating power levels, which can only be accomplished after the excore detectors are normalized to restore QPTR to within limits and the core returned to power.
 
B.1 If Required Actions A.1 through A.6 are not completed within their associated Completion Times, the unit must be brought to a MODE or condition in which the requirements do not apply. To achieve this status, THERMAL POWER must be reduced to  50% RTP within 4 hours. The allowed Completion Time of 4 hours is reasonable, based on operating experience regarding the amount of time required to reach the reduced power level without challenging plant systems.
SURVEILLANCE SR  3.2.4.1 REQUIREMENTS SR 3.2.4.1 is modified by two Notes. Note 1 allows QPTR to be calculated with three power range channels if THERMAL POWER is  75% RTP and the input from one Power Range Neutron Flux channel is inoperable. Note 2 allows performance of SR 3.2.4.2 in lieu of SR 3.2.4.1.
 
This Surveillance verifies that the QPTR, as indicated by the Nuclear Instrumentation System (NIS) excore channels, is within its limits. The Frequency of 7 days takes into account other information and alarms available to the operator in the control room.
 
For those causes of QPT that occur quickly (e.g., a dropped rod), there typically are other indications of abnormality that prompt a verification of core power tilt.
 
QPTR B 3.2.4 BASES SURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.2.4 - 6 Revision 0 SR  3.2.4.2
 
This Surveillance is modified by a Note, which states that it is not required until 24 hours after the input from one or more Power Range Neutron Flux channels are inoperable and the THERMAL POWER is  75% RTP.
 
With an NIS power range channel inoperable, tilt monitoring for a portion of the reactor core becomes degraded. Large tilts are likely detected with the remaining channels, but the capability for detection of small power tilts in some quadrants is decreased. Performing SR 3.2.4.2 at a Frequency of 24 hours provides an accurate alternative means for ensuring that any tilt remains within its limits.
 
For purposes of monitoring the QPTR when one power range channel is inoperable, the moveable incore detectors are used to confirm that the normalized symmetric power distribution is consistent with the indicated QPTR and any previous data indicating a tilt. The incore detector monitoring is performed with a full incore flux map or two sets of tour thimble locations with quarter core symmetry. The two sets of four symmetric thimbles is a set of eight unique detector locations.
 
The symmetric thimble flux map can be used to generate symmetric thimble tilt. This can be compared to reference symmetric thimble tilt, from the most recent full core flux map, to generate an incore QPTR. Therefore, incore monitoring of QPTR can be used to confirm that QPTR is within limits.
 
With one NIS channel inoperable, the indicated tilt may be changed from the value indicated with all four channels OPERABLE. To confirm that no change in tilt has actually occurred, which might cause the QPTR limit to be exceeded, the incore result may be compared against previous flux maps. Nominally, quadrant tilt from the Surveillance should be within 2% of the tilt shown by the most recent flux map data.
REFERENCES 1. 10 CFR 50.46.
: 2. UFSAR, Section 14.2.6.
: 3. 10 CFR 50, Appendix A, GDC 26.
RPS Instrumentation B 3.3.1 INDIAN POINT 2 B 3.3.1 - 1 Revision 5 B 3.3  INSTRUMENTATION B 3.3.1 Reactor Protection System (RPS) Instrumentation BASESBACKGROUND The RPS initiates a reactor shutdown, based on the values of selected unit parameters, to protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (AOOs) and to assist the Engineered Safety Features (ESF) Systems in mitigating accidents. The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as specifying LCOs on other reactor system parameters and equipment performance. Technical specifications are required by 10 CFR 50.36 to contain LSSS defined by the regulation as "...settings for automatic protective devices...so chosen that automatic protective action will correct the abnormal situation before a Safety Limit (SL) is exceeded."  The Analytical Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protective devices must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur. The trip setpoint (the "as-left" setting following calibration) is a predetermined setting for a protective device chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit and thus ensuring that the SL would not be exceeded. As such, the trip setpoint accounts for uncertainties in setting the device (e.g. calibration),
uncertainties in how the device might actually perform (e.g., repeatability),
changes in the point of action of the device over time (e.g., drift during surveillance intervals) and operating margin.
RPS Instrumentation B 3.3.1 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.3.1 - 2 Revision 5 Technical specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in technical specifications as "...being capable of performing its safety functions(s)."  For automatic protective devices, the required safety function is to ensure that a SL is not exceeded and therefore the LSSS as defined by 10 CFR 50.36 is the same as the OPERABILITY limit for these devices.
However, use of the trip setpoint to define OPERABILITY in technical specifications and its corresponding designation as the LSSS required by 10 CFR 50.36 would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as found" value of a protective device setting during a surveillance. This would result in technical specification compliance problems and reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protective device with a setting that has been found to be different from the trip setpoint due to some drift of the setting may still be OPERABLE since drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the trip setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as found" setting of the protective device. Therefore, the device would still be OPERABLE since it would have performed its safety function and the only corrective action required would be to reset the device to the trip setpoint to account for further drift during the next surveillance interval.There is also some point beyond which the device would have not been able to perform its function due, for example, to greater than expected drift. This value needs to be specified in the technical specifications in order to define OPERABILITY of the devices and is designated as the Allowable Value which, as stated above, is the same as the LSSS. The Allowable Value specified in Table 3.3.1-1 serves as the LSSS such that a channel is OPERABLE if the actuation point is found not to exceed the Allowable Value during the CHANNEL OPERATIONAL TEST (COT). As such, the Allowable Value differs from the limiting setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift and calibration effect, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition and ensure that a Safety Limit is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.
Note that, although the channel is "OPERABLE" under these circumstances, the trip setpoint should be left adjusted to a value within the established trip setpoint calibration tolerance band, in accordance with uncertainty RPS Instrumentation B 3.3.1 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.3.1 - 3 Revision 5 assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned. If the actual setting of the device is found to have exceeded the as-found allowance, the channel would be evaluated to determine Technical Specification OPERABILITY. The results of this evaluation would result in corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.Allowable Values for each RPS function are listed in Table 3.3.1-1. Trip Setpoints that ensure that the Allowable Values are not exceeded over the calibration interval are controlled administratively outside of the Technical Specifications.During AOOs, which are those events expected to occur one or more times during the unit life, the acceptable limits are: 1. The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling (DNB), 2. Fuel centerline melt shall not occur, and 3. The RCS pressure SL of 2735 psig shall not be exceeded.
Operation within the SLs of Specification 2.0, "Safety Limits (SLs)," also maintains the above values and assures that offsite dose will be within the 10 CFR 50.67 criteria during AOOs. Accidents are events that are analyzed even though they are not expected to occur during the unit life. The acceptable limit during accidents is that offsite dose shall be maintained within 10 CFR 50.67 limits. 10 CFR 50.67 limits are used in the evaluation of proposed design basis changes with respect to potential reactor accidents of exceedingly low probability of occurrence and low risk of public exposure to radiation. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event. With regard to maintenance activities, two types can be done; corrective and preventive. Corrective maintenance, or repair activities due to component failures, are those that are done after a component failure is identified through either a test or by some other means, such as through visual control RPS Instrumentation B 3.3.1 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.3.1 - 4 Revision 5 room board scans. Preventive maintenance activities are pre-scheduled maintenance activities done to maintain the component in operable condition. Both types of activities impact the component availability. (p. 2-4, Reference 7) The RPS instrumentation is segmented into four distinct but interconnected modules as identified below: 1. Field transmitters or process sensors:  provide a measurable electronic signal based upon the physical characteristics of the parameter being measured,2. Signal Process Control and Protection System, including Analog Protection System, Nuclear Instrumentation System (NIS), field contacts, and protection channel sets:  provides signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board/control room/miscellaneous indications, 3. RPS Automatic Trip Logic, including input, logic, and output:  initiates proper reactor shutdown and/or ESF actuation in accordance with the defined logic, which is based on the bistable outputs from the signal process control and protection system, and 4. Reactor trip switchgear, including reactor trip breakers (RTBs) and bypass breakers:  provide the means to interrupt power to the control rod drive mechanisms (CRDMs) and allows the rod cluster control assemblies (RCCAs), or "rods," to fall into the core and shut down the reactor. The bypass breakers allow testing of the RTBs at power. Field Transmitters or SensorsTo meet the design demands for redundancy and reliability, more than one, and often as many as four, field transmitters or sensors are used to measure unit parameters. In many cases, field transmitters or sensors that input to the Reactor Protection System (RPS) are shared with the Engineered Safety Feature Actuation System (ESFAS). In some cases, the same channels also provide control system inputs. To account for the calibration tolerances and instrument drift, which are assumed to occur between calibrations, statistical allowances are provided in the trip setpoint. The OPERABILITY of each transmitter or sensor is determined by either "as-found" calibration data evaluated during the RPS Instrumentation B 3.3.1 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.3.1 - 5 Revision 5 CHANNEL CALIBRATION or by qualitative assessment of field transmitter or  sensor as related to the channel behavior observed during performance of the CHANNEL CHECK. Signal Process Control and Protection SystemGenerally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments. The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established to ensure that actuation will occur within the limits assumed in the accident analysis described in UFSAR Sections 6 and 14 (Refs. 2 and 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the RPS Automatic Trip Logic for decision evaluation. Channel separation is maintained up to the RPS Automatic Trip Logic. However, not all unit parameters require four channels of sensor measurement and signal processing. Some unit parameters provide input only to the RPS Automatic Trip Logic, while others provide input to the RPS Automatic Trip Logic, the main control board, the unit computer, and one or more control systems. Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails, such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic. Generally, if a parameter is used for input to the RPS Automatic Trip Logic and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy. The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Again, a single failure will not prevent the protection function actuation. These requirements are described in IEEE-279-1968 (Ref. 4). The actual number of channels required for each unit parameter is specified in Reference 1 and described later in these Technical Specification Bases.
RPS Instrumentation B 3.3.1 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.3.1 - 6 Revision 5 Two logic trains are required to ensure no single random failure of a logic train will disable the RPS. The logic trains are designed such that testing required while the reactor is at power may be accomplished without causing trip.Some bistable channels that provide inputs to the RPS logic have a built in "Test in Bypass" circuitry, which provides the capability to bypass a channel while that channel is being tested. This is accomplished in the channel being tested by providing a source of power to the first relay after the bistable, which maintains the associated channel logic untripped, while the bistable output is directed to a test lamp. The channel being bypassed will remain untripped during testing and will result in a 2 out of 4 logic becoming a 2 out of 3 logic and a 2 out of 3 logic becoming a 2 out of 2 logic. Installed bypass capability is present for the following functions: Overtemperature T,OverpowerT, Pressurizer Pressure, Pressurizer Level, Reactor Coolant Flow, Steam Generator Level, Steam Flow/Feed Flow Mismatch. Where the bypass capability does not exist, the channel is tested in the tripped state and the channel is providing a trip signal to the logic. The additional logic then required for actuation changes from 2 out of 3 to 1 out of 2 or from 2 out of 4 to 1 out of 3. Trip Setpoints and Allowable ValuesThe following describes the relationship between the safety limit, analytical limit, allowable value, limiting setpoint and trip setpoint: a. A Safety Limit (SL) is a limit on the combination of THERMAL POWER, RCS highest loop average temperature, and RCS pressure needed to protect the integrity of physical barriers that guard against the uncontrolled release of radioactivity (i.e., fuel, fuel cladding, RCS pressure boundary and containment). The safety limits are identified in Technical Specification 2.0, Safety Limits (SLs).b. An Analytical Limit (AL) is the limit for a measured or calculated variable used as an input to the accident analyses presented in UFSAR, Chapter 14 (Ref. 3). Analytical limits are developed from event analyses models which consider parameters such as process delays, rod insertion times, reactivity changes, instrument response times, etc. An analytical limit for a trip actuation point is established at a point that will ensure that a Safety Limit (SL) is not exceeded.
RPS Instrumentation B 3.3.1 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.3.1 - 7 Revision 5 c. An Allowable Value (AV) is the limiting actuation point for the entire channel of a trip function that will ensure, within the required level of confidence, that sufficient allocation exists between this actuation point and the analytical limit. The Allowable Value is more conservative than the Analytical Limit to account for instrument uncertainties that either are not present or are not measured during periodic testing. Channel uncertainties that either are not present or are not measured during periodic testing may include design basis accident temperature and radiation effects or process dependent effects. The channel allowable value for each RPS function iscontrolled by Technical Specifications and is listed in Table 3.3.1-1, Reactor Protection System Instrumentation.d. A limiting setpoint is the maximum or minimum setpoint, which can be safely set for trip actuation, after allowing for channel statistical allowances from the analytical limit.e. A trip setpoint is an administratively selected point at which the bistable is set and is expected to be achieved during calibration. It is selected to accommodate the ease of calibration and operation. The difference between limiting setpoint and trip setpoint is the margin available during calibration and operation. The trip setpoints are established by plant administrative programs for the components of a channel (i.e., required sensor, alarm, interlock, display, and trip function) to ensure, within the required level of confidence, that the Allowable Value for the entire channel will not be exceeded during the calibration interval. A description of the methodology used to calculate the allowable values, limiting setpoint and trip setpoint is provided in References 6 and 11. The trip setpoint value ensures the LSSS and the safety analysis limits are met for surveillance interval selected when a channel is adjusted based on stated channel uncertainties. Any bistable is considered to be properly adjusted when the "as left" setpoint value is within the band for CHANNEL CALIBRATION uncertainty allowance (i.e.,  rack calibration and comparator setting uncertainties). The trip setpoint value is therefore considered a "nominal" value (i.e., expressed as a value without inequalities) for the purposes of COT and CHANNEL CALIBRATION. Trip setpoints consistent with the requirements of the Allowable Value ensure that SLs are not violated during AOOs (and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed).
RPS Instrumentation B 3.3.1 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.3.1 - 8 Revision 5 Each channel of the process control equipment can be tested on line to verify that the signal or setpoint accuracy is within the specified allowance requirements of calculations performed in accordance with Reference 6 that are based on analytical limits consistent with References 2 and 3. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated. SRs for the channels are specified in the SR section. RPS Automatic Trip LogicThe RPS Automatic Trip Logic is used for the decision logic processing of outputs from the signal processing equipment bistables. To meet the redundancy requirements, two trains of RPS Automatic Trip Logic, each performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide reactor trip. If both trains are taken out of service or placed in test, a reactor trip will result. The system has been designed to trip in the event of a loss of power, directing the unit to a safe shutdown condition. The RPS Automatic Trip Logic performs the decision logic for actuating a reactor trip, generates the electrical output signal that will initiate the required trip or actuation, and provides the status, permissive, and annunciator output signals to the main control room. The bistable outputs from the signal processing equipment are sensed by the RPS Automatic Trip Logic and combined into logic matrices that represent combinations indicative of various unit upset and accident transients. If a required logic matrix combination is completed, the system will initiate a reactor trip. Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases. Reactor Trip BreakersThe RTBs are in the electrical power supply line from the control rod drive motor generator set power supply to the CRDMs. Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods and control rods to fall into the core by gravity. Each RTB is equipped with a bypass breaker to allow testing of the RTB while the unit is at power.
RPS Instrumentation B 3.3.1 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.3.1 - 9 Revision 5 During normal operation the output from the RPS Automatic Trip Logic is a voltage signal that energizes the undervoltage coils in the RTBs and bypass breakers, if in use. When the required logic matrix combination is completed, the RPS Automatic Trip Logic output voltage signal is removed, the undervoltage coils are de-energized, the breaker trip lever is actuated by the de-energized undervoltage coil, and the RTBs and bypass breakers are tripped open. This allows the shutdown rods and control rods to fall into the core. In addition to the de-energization of the undervoltage coils, each breaker is also equipped with a shunt trip device that is energized to trip the breaker open upon receipt of a reactor trip signal from the RPS Automatic Trip Logic. Either the undervoltage coil or the shunt trip mechanism is sufficient by itself, thus providing a diverse trip mechanism. There are two reactor trip breakers in series so that opening either will interrupt power to the rod control system and allow the rod cluster control assemblies (RCCAs), or "rods," to fall into the core and shut down the reactor. Each reactor trip breaker has a parallel reactor trip bypass breaker that is normally open. This feature allows testing of the reactor trip breakers at power. A trip signal from RPS logic train A will trip reactor trip breaker A and reactor trip bypass breaker B; and, a trip signal from logic train B will trip reactor trip breaker B and reactor trip bypass breaker A. During normal operation, both reactor trip breakers are closed and both reactor trip bypass breakers are open. An interlock trips both reactor trip bypass breakers if an attempt is made to close a reactor trip bypass breaker when the other reactor trip bypass breaker is already closed. A trip breaker train consists of the main breaker; or, the main breaker and bypass breaker associated with this same RPS logic train if both the breaker and bypass are racked in, closed, and capable of supplying power to the CRD System. The decision logic matrix Functions are described in Reference 1 and later in these Technical Specification Bases. In addition to the reactor trip, the various "permissive interlocks" that are associated with unit conditions are also described. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed. APPLICABLESAFETY ANALYSES, LCO, and APPLICABILITYThe RPS functions to maintain the SLs during all AOOs and mitigates the consequences of DBAs in all MODES in which the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 10 Revision 5 Each of the analyzed accidents and transients can be detected by one or more RPS Functions. The accident analysis described in Reference 3 takes credit for most RPS trip Functions. RPS trip Functions not specifically credited in the accident analysis are qualitatively credited in the safety analysis and the NRC staff approved licensing basis. These RPS trip Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. They may also serve as backups to RPS trip Functions that were credited in the accident analysis.The LCO requires all instrumentation performing an RPS Function, listed in Table 3.3.1-1 in the accompanying LCO, to be OPERABLE. A channel is OPERABLE provided the trip setpoint "as-found" value does not exceed its associated Allowable Value. The trip setpoint "as-left" value is adjusted to a value within the "as-left" calibration tolerance band of the nominal trip setpoint. Nominal trip setpoints are controlled administratively outside of Technical Specifications. A trip setpoint may be set more conservative than the Nominal Trip Setpoint as necessary in response to plant conditions.
Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. The LCO generally requires OPERABILITY of four or three channels in each instrumentation Function, two channels of Manual Reactor Trip in each logic Function, and two trains in each Automatic Trip Logic Function. Four OPERABLE instrumentation channels in a two-out-of-four configuration are required when one RPS channel is also used as a control system input.
This configuration accounts for the possibility of the shared channel failing in such a manner that it creates a transient that requires RPS action. In this case, the RPS will still provide protection, even with random failure of one of the other three protection channels. Three OPERABLE instrumentation channels in a two-out-of-three configuration are generally required when there is no potential for control system and protection system interaction that could simultaneously create a need for RPS trip and disable one RPS channel. The two-out-of-three and two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing a reactor trip. Specific exceptions to the above general philosophy exist and are discussed below.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 11 Revision 5 Reactor Protection System FunctionsThe safety analyses and OPERABILITY requirements applicable to each RPS Function are discussed below: 1. Manual Reactor TripThe Manual Reactor Trip ensures that the control room operator can initiate a reactor trip at any time by using either of two reactor trip pushbuttons in the control room. A Manual Reactor Trip accomplishes the same results as any one of the automatic trip Functions. It is used by the reactor operator to shut down the reactor whenever any parameter is rapidly trending toward its trip setpoint or has exceeded the trip setpoint without actuation. The LCO requires two Manual Reactor Trip channels to be OPERABLE. Each channel is controlled by a manual reactor trip pushbutton. Each channel activates the reactor trip breaker in both trains. Two independent channels are required to be OPERABLE so that no single random failure will disable the Manual Reactor Trip Function.In MODE 1 or 2, manual initiation of a reactor trip must be OPERABLE. These are the MODES in which the shutdown rods and/or control rods are partially or fully withdrawn from the core. In MODE 3, 4, or 5, the manual initiation Function must also be OPERABLE if one or more shutdown rods or control rods are withdrawn or the Rod Control System is capable of withdrawing the shutdown rods or the control rods. In this condition, inadvertent control rod withdrawal is possible. In MODE 3, 4, or 5, manual initiation of a reactor trip does not have to be OPERABLE if the Rod Control System is not capable of withdrawing the shutdown rods or control rods and if all rods are fully inserted. If the rods cannot be withdrawn from the core, and all of the rods are inserted, there is no need to be able to trip the reactor. In MODE 6, neither the shutdown rods nor the control rods are permitted to be withdrawn and the CRDMs are disconnected from the control rods and shutdown rods. Therefore, the manual initiation Function is not required.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 12 Revision 5 2. Power Range Neutron FluxThe NIS power range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS power range detectors provide input to the Rod Control System. Four channels of NIS are required because the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Note that this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip. Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor. a. Power Range Neutron Flux - HighThe Power Range Neutron Flux - High trip Function ensures that protection is provided, from all power levels, against a positive reactivity excursion leading to DNB during power operations.
These can be caused by rod withdrawal or reductions in RCS temperature.The LCO requires all four of the Power Range Neutron Flux - High channels to be OPERABLE. In MODE 1 or 2, when a positive reactivity excursion could occur, the Power Range Neutron Flux - High trip must be OPERABLE.
This Function will terminate the reactivity excursion and shut down the reactor prior to reaching a power level that could damage the fuel. In MODE 3, 4, 5, or 6, the NIS power range detectors cannot detect neutron levels in this range. In these MODES, the Power Range Neutron Flux - High does not have to be OPERABLE because the reactor is shut down and reactivity excursions into the power range are extremely unlikely. Other RPS Functions and administrative controls provide protection against reactivity additions when in MODE 3, 4, 5, or 6. b. Power Range Neutron Flux - LowThe LCO requirement for the Power Range Neutron Flux - Low trip Function ensures that protection is provided against a positive reactivity excursion from low power or subcritical conditions.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 13 Revision 5 The LCO requires all four of the Power Range Neutron Flux - Low channels to be OPERABLE. In MODE 1, below the Power Range Neutron Flux (P-10 setpoint), and in MODE 2, the Power Range Neutron Flux - Low trip must be OPERABLE. This Function may be manually blocked by the operator when two out of four power range channels are greater than approximately 10% RTP (P-10 setpoint). This Function is automatically unblocked when three out of four power range channels are below the P-10 setpoint.
Above the P-10 setpoint, positive reactivity additions are mitigated by the Power Range Neutron Flux - High trip Function. In MODE 3, 4, 5, or 6, the Power Range Neutron Flux - Low trip Function does not have to be OPERABLE because the reactor is shut down and the NIS power range detectors cannot detect neutron levels in this range. Other RPS trip Functions and administrative controls provide protection against positive reactivity additions or power excursions in MODE 3, 4, 5, or 6. 3. Intermediate Range Neutron FluxThe Intermediate Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident from a subcritical condition during startup. This trip Function provides redundant protection to the Power Range Neutron Flux - Low Setpoint trip Function.The NIS intermediate range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS intermediate range detectors do not provide any input to control systems. Note that this Function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip.
Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor. The LCO requires two channels of Intermediate Range Neutron Flux to be OPERABLE. Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function and provide diverse protection to the Power Range Neutron Flux - Low Setpoint Trip Function.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 14 Revision 5 Because this trip Function is important only during startup, there is generally no need to disable channels for testing while the Function is required to be OPERABLE. Therefore, a third channel is unnecessary. In MODE 1 below the P-10 setpoint, and in MODE 2 above the P-6 setpoint, when there is a potential for an uncontrolled RCCA bank rod withdrawal accident during reactor startup, the Intermediate Range Neutron Flux trip must be OPERABLE. Above the P-10 setpoint, the Power Range Neutron Flux - High Setpoint trip provides core protection for a rod withdrawal accident. In MODE 2 below the P-6 setpoint, the Source Range Neutron Flux Trip provides the core protection for reactivity accidents. In MODE 3, 4, or 5, the Intermediate Range Neutron Flux trip does not have to be OPERABLE because LCO 3.1.1, "Shutdown Margin (SDM)," requires that SDM is maintained within limits that ensure the reactor is shutdown. The reactor cannot be started up in this condition. In MODE 6, all rods are fully inserted and the core has a required increased SDM. Also, the NIS intermediate range detectors cannot detect neutron levels present in this MODE. 4. Source Range Neutron FluxThe LCO requirement for the Source Range Neutron Flux trip Function ensures that protection is provided against an uncontrolled rod withdrawal accident from a subcritical condition during startup. This trip Function provides diverse protection to the Power Range Neutron Flux - Low trip Function. Two channels of Source Range Neutron Flux are required to be OPERABLE in the Applicable MODES.In MODES 3, 4, and 5, administrative controls also prevent the uncontrolled withdrawal of rods. The NIS source range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS source range detectors do not provide any inputs to control systems. The source range trip is the only RPS automatic protection function required in MODES 3, 4, and 5 when rods are capable of withdrawal or one or more rods are not fully inserted. Therefore, the functional capability at the specified allowable value is assumed to be available. The Source Range Neutron Flux Function provides protection for control rod withdrawal from subcritical, boron dilution and control rod ejection events.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 15 Revision 5 In MODE 2 when below the P-6 setpoint and in MODES 3, 4, and 5 when there is a potential for an uncontrolled RCCA bank rod withdrawal accident, the Source Range Neutron Flux trip must be OPERABLE. Two OPERABLE channels are sufficient to ensure no single random failure will disable this trip Function and provide diverse protection to the Power Range Neutron Flux - Low Setpoint trip Function. Above the P-6 setpoint, the Intermediate Range Neutron Flux trip and the Power Range Neutron Flux - Low trip will provide core protection for reactivity accidents. Above the P-6 setpoint, the NIS source range detectors are de-energized. In MODES 3, 4, and 5 with all rods fully inserted and the Rod Control System not capable of rod withdrawal, and in MODE 6, the outputs of the Function to RPS logic are not required OPERABLE. The requirements for the NIS source range detectors to monitor core neutron levels and provide indication of reactivity changes that may occur as a result of events like a boron dilution are addressed in LCO 3.9.2, "Nuclear Instrumentation," for MODE 6. 5. Overtemperature TThe Overtemperature T trip Function is provided to ensure that the design limit DNBR is met. This trip Function also limits the range over which the Overpower T trip Function must provide protection. The inputs to the Overtemperature T trip include all pressure, coolant temperature, axial power distribution, and reactor power as indicated by loop T assuming full reactor coolant flow. Protection from violating the DNBR limit is assured for those transients that are slow with respect to delays from the core to the measurement system. The Function monitors variations in power, but a decrease in flow has the same effect on T as a power increase. The Overtemperature T trip Function uses each loop's T as a measure of reactor power and is compared with a setpoint that is automatically varied with the following parameters: reactor coolant average temperature - the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature,  pressurizer pressure - the Trip Setpoint is varied to correct for changes in system pressure, and RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 16 Revision 5  axial power distribution - f(I), the Trip Setpoint is varied to account for imbalances in the axial power distribution as detected by the NIS upper and lower power range detectors. If axial peaks are greater than the design limit, as indicated by the difference between the upper and lower NIS power range detectors, the Trip Setpoint is reduced in accordance with Note 1 of Table 3.3.1-1. Dynamic compensation is included for system piping delays from the core to the temperature measurement system. The Overtemperature T trip Function is calculated for each loop as described in Note 1 of Table 3.3.1-1. Trip occurs if Overtemperature T is indicated in two loops. The pressure and temperature signals are used for other control functions. Therefore, the actuation logic is designed to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. The LCO requires all four channels of the Overtemperature T trip Function to be OPERABLE. Note that the Overtemperature TFunction receives input from channels shared with other RPS Functions. Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions. In MODE 1 or 2, the Overtemperature T trip must be OPERABLE to prevent DNB. In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about DNB. 6. Overpower TThe Overpower T trip Function ensures that protection is provided to ensure the integrity of the fuel (i.e., no fuel pellet melting and less than 1% cladding strain) under all possible overpower conditions. This trip Function also limits the required range of the Overtemperature T trip Function and provides a backup to the Power Range Neutron Flux -
High Setpoint trip. The Overpower T trip Function ensures that the allowable heat generation rate (kW/ft) of the fuel is not exceeded. It uses the T of each loop as a measure of reactor power with a setpoint that is automatically varied with the following parameters:
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 17 Revision 5  reactor coolant average temperature - the trip setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature, and  rate of change of reactor coolant average temperature - including a constant determined by dynamic considerations that provides compensation for the delays between the core and the temperature measurement system. The Overpower T trip Function is calculated for each loop per Note 2 of Table 3.3.1-1. Trip occurs if Overpower T is indicated in two loops. The temperature signals are used for other control functions.
Therefore, the actuation logic is designed to withstand an input failure to the control system, which may then require the protection function actuation and a single failure in the remaining channels providing the protection function actuation. The LCO requires four channels of the Overpower T trip Function to be OPERABLE. Note that the Overpower T trip Function receives input from channels shared with other RPS Functions. Failures that affect multiple Functions require entry into the Conditions applicable to all affected Functions. In MODE 1 or 2, the Overpower T trip Function must be OPERABLE. These are the only times that enough heat is generated in the fuel to be concerned about the heat generation rates and overheating of the fuel. In MODE 3, 4, 5, or 6, this trip Function does not have to be OPERABLE because the reactor is not operating. 7. Pressurizer PressureThe same sensors provide input to the Pressurizer Pressure - High and  - Low trips and the Overtemperature T trip. The Pressurizer Pressure channels are also used to provide input to the Pressurizer Pressure Control System. Therefore, the actuation logic is designed to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 18 Revision 5 a. Pressurizer Pressure - LowThe Pressurizer Pressure - Low trip Function ensures that protection is provided against violating the DNBR limit due to low pressure.The LCO requires four channels of Pressurizer Pressure - Low to be OPERABLE. In MODE 1, when DNB is a major concern, the Pressurizer Pressure - Low trip must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-7 interlock (NIS power range P-10  (Function 17.d) or turbine first stage pressure greater than approximately 10% of full power equivalent (Function 17.e)). On decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, no conceivable power distributions can occur that would cause DNB concerns.b. Pressurizer Pressure - HighThe Pressurizer Pressure - High trip Function ensures that protection is provided against overpressurizing the RCS. This trip Function operates in conjunction with the pressurizer relief and safety valves to prevent RCS overpressure conditions. The LCO requires three channels of the Pressurizer Pressure - High to be OPERABLE. Note that the plant design and this LCO requires 4 channels for the Pressurizer Pressure - Low trip but requires only 3 channels of Pressurizer Pressure - High trip. This is an exception to the requirement for additional redundancy when a protective function circuit is also used for a control function which is described and justified in Reference 1. This exception was evaluated during the evaluation for the increase in licensed Thermal Power and determined to be acceptable (Ref. 9). The Pressurizer Pressure - High allowable value is selected to be below the pressurizer safety valve actuation pressure and above the power operated relief valve (PORV) setting. This setting minimizes challenges to safety valves while avoiding unnecessary reactor trip for those pressure increases that can be controlled by the PORVs.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 19 Revision 5 In MODE 1 or 2, the Pressurizer Pressure - High trip must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the safety valves. In MODE 3, 4, 5, or 6, the Pressurizer Pressure - High trip Function does not have to be OPERABLE because transients that could cause an overpressure condition will be slow to occur. Therefore, the operator will have sufficient time to evaluate unit conditions and take corrective actions. Additionally, low temperature overpressure protection requirements provide overpressure protection when RCS temperature is less than the LTOP Applicability temperature specified in LCO 3.4.12, Low Temperature Overpressure Protection (LTOP). 8. Pressurizer Water Level - HighThe Pressurizer Water Level - High trip Function provides a backup signal for the Pressurizer Pressure - High trip and also provides protection against water relief through the pressurizer safety valves.
These valves are designed to pass steam in order to achieve their design energy removal rate. A reactor trip is actuated prior to the pressurizer becoming water solid. The LCO requires three channels of Pressurizer Water Level - High to be OPERABLE. The pressurizer level channels are used as input to the Pressurizer Level Control System. A fourth channel is not required to address control/protection interaction concerns because the level channels do not actuate the safety valves, and the high pressure reactor trip is set below the safety valve setting. Therefore, with the slow rate of charging available, pressure overshoot due to level channel failure cannot cause the safety valve to lift before reactor high pressure trip. In MODE 1, when there is a potential for overfilling the pressurizer, the Pressurizer Water Level - High trip must be OPERABLE. This trip Function is automatically enabled on increasing power by the P-7 interlock. On decreasing power, this trip Function is automatically blocked below P-7. Below the P-7 setpoint, transients that could raise the pressurizer water level will be slow and the operator will have sufficient time to evaluate unit conditions and take corrective actions.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 20 Revision 5 9. Reactor Coolant Flow - LowThe Reactor Coolant Flow - Low trip Function ensures that protection is provided against violating the DNBR limit due to low flow in one or more RCS loops, while avoiding reactor trips due to normal variations in loop flow. Above the P-7 setpoint, the reactor trip on low flow in two or more RCS loops is automatically enabled. Above the P-8 setpoint, which is  26.4% RTP, a loss of flow in any RCS loop will actuate a reactor trip. Each RCS loop has three flow detectors to monitor flow.
The flow signals are not used for any control system input. The LCO requires three Reactor Coolant Flow - Low channels per loop to be OPERABLE in MODE 1 above P-7. Each reactor coolant loop is considered to be a separate Function. Therefore, separate condition entry is allowed for each loop with an inoperable channel. In MODE 1 above the P-8 setpoint, a loss of flow in one RCS loop could result in DNB conditions in the core because of the higher power level. In MODE 1 below the P-8 setpoint and above the P-7 setpoint, a loss of flow in two or more loops is required to actuate a reactor trip because of the lower power level and the greater margin to the design limit DNBR. Below the P-7 setpoint, all reactor trips on low flow are automatically blocked since there is insufficient heat production to generate DNB conditions. 10. Reactor Coolant Pump (RCP) Breaker PositionBoth RCP Breaker Position trip Functions operate to anticipate the Reactor Coolant Flow - Low trips to avoid RCS heatup that would occur before the low flow trip actuates. a. Reactor Coolant Pump Breaker Position (Single Loop)The RCP Breaker Position (Single Loop) trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in one RCS loop. The position of each RCP breaker is monitored. If one RCP breaker is open above the P-8 setpoint, a reactor trip is initiated. This trip Function will generate a reactor trip before the Reactor Coolant Flow - Low (Single Loop) Trip Setpoint is reached.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 21 Revision 5 The LCO requires one RCP Breaker Position channel per RCP to be OPERABLE. One OPERABLE channel is sufficient for this trip Function because the RCS Flow - Low trip alone provides sufficient protection of unit SLs for loss of flow events. The RCP Breaker Position trip serves only to anticipate the low flow trip, minimizing the thermal transient associated with loss of a pump.
Each reactor coolant pump is considered to be a separate function. Therefore, separate condition entry is allowed for each pump with an inoperable channel. This Function measures only the discrete position (open or closed) of the RCP breaker, using a position switch. Therefore, the Function has no adjustable trip setpoint with which to associate an LSSS. In MODE 1 above the P-8 setpoint, when a loss of flow in any RCS loop could result in DNB conditions in the core, the RCP Breaker Position (Single Loop) trip must be OPERABLE. In MODE 1 below the P-8 setpoint, a loss of flow in two or more loops is required to actuate a reactor trip because of the lower power level and the greater margin to the design limit DNBR. b. Reactor Coolant Pump Breaker Position (Two Loops)The RCP Breaker Position (Two Loops) trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops. The position of each RCP breaker is monitored. Above the P-7 setpoint, a loss of flow in two or more loops will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow -
Low (Two Loops) Trip Setpoint is reached. The LCO requires one RCP Breaker Position channel per RCP to be OPERABLE. One OPERABLE channel is sufficient for this Function because the RCS Flow - Low trip alone provides sufficient protection of unit SLs for loss of flow events. The RCP Breaker Position trip serves only to anticipate the low flow trip, minimizing the thermal transient associated with loss of an RCP. Each reactor coolant pump is considered to be a separate function. Therefore, separate condition entry is allowed for each pump with an inoperable channel.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 22 Revision 5 This Function measures only the discrete position (open or closed) of the RCP breaker, using a position switch. Therefore, the Function has no adjustable trip setpoint with which to associate an allowable value. In MODE 1 above the P-7 setpoint and below the P-8 setpoint, the RCP Breaker Position (Two Loops) trip must be OPERABLE.
Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on loss of flow in two RCS loops is automatically enabled. Above the P-8 setpoint, a loss of flow in any one loop will actuate a reactor trip because of the higher power level and the reduced margin to the design limit DNBR. 11. Reactor Coolant Pump Undervoltage (6.9 kV bus)The RCP Undervoltage reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops. The voltage to each 6.9 kV bus used to power an RCP is monitored. Above the P-7 setpoint, a loss of voltage detected on two or more RCP buses will initiate a reactor trip. This trip Function will generate a reactor trip before the Reactor Coolant Flow - Low (Two Loops) Trip Setpoint is reached. Time delays are incorporated into the Undervoltage RCPs channels to prevent reactor trips due to momentary electrical power transients. The LCO requires one RCP Undervoltage channel (one per RCP) per bus to be OPERABLE. In MODE 1 above the P-7 setpoint, the RCP Undervoltage trip must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P-7 setpoint, the reactor trip on loss of flow in two or more RCS loops is automatically enabled.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 23 Revision 5 In addition to the direct reactor trip that results from undervoltage on any two of the four reactor coolant pump 6.9 kV buses specified in Function 11, RCP Undervoltage (6.9 kV bus), each reactor coolant pump circuit breaker is automatically tripped (after a time delay) on an undervoltage on its associated 6.9 kV bus. Therefore, above the P-8 setpoint, undervoltage on any one reactor coolant pump 6.9 kV bus will result in a reactor trip via Function 10.a, Reactor Coolant Pump Breaker Position-Single Loop. Additionally, undervoltage on two reactor coolant pump 6.9 kV buses will result in a reactor trip via Function 10.b, Reactor Coolant Pump Breaker Position - Two Loops, when above the P-7 setpoint.12. Reactor Coolant Pump Underfrequency (6.9 kV bus)The RCP Underfrequency reactor trip Function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops from a major network frequency disturbance. An underfrequency condition will slow down the pumps, thereby reducing their coastdown time following a pump trip. The proper coastdown time is required so that reactor heat can be removed immediately after reactor trip. The frequency of each RCP bus is monitored. A low frequency detected on two or more RCP buses trips all four RCPs, a condition that will initiate a reactor trip above the P-7 setpoint. This trip Function will generate a reactor trip before the Reactor Coolant Flow - Low (Two Loops) Trip Setpoint is reached. The LCO requires one RCP Underfrequency channel per bus to be OPERABLE.In MODE 1 above the P-7 setpoint, the RCP Underfrequency trip must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level.
Above the P-7 setpoint, the reactor trip on loss of flow in two or more RCS loops is automatically enabled.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 24 Revision 5 13. Steam Generator Water Level - Low LowThe SG Water Level - Low Low trip Function ensures that protection is provided against a loss of heat sink and actuates the AFW System prior to uncovering the SG tubes. The SGs are the heat sink for the reactor. In order to act as a heat sink, the SGs must contain a minimum amount of water. A narrow range low low level in any SG is indicative of a loss of heat sink for the reactor. One of the level transmitters in each SG also provides input to the SG Level Control System. This Function also performs the ESFAS function of starting the AFW pumps on low low SG level. The LCO requires three channels of SG Water Level - Low Low per SG to be OPERABLE. In MODE 1 or 2, when the reactor requires a heat sink, the SG Water Level - Low Low trip must be OPERABLE. The normal source of water for the SGs is the Main Feedwater (MFW) System (not safety related).
The MFW System is only in operation in MODE 1 or 2. The AFW System is the safety related backup source of water to ensure that the SGs remain the heat sink for the reactor. During normal startups and shutdowns, the AFW System provides feedwater to maintain SG level.
In MODE 3, 4, 5, or 6, the SG Water Level - Low Low Function does not have to be OPERABLE because the MFW System is not in operation and the reactor is not operating or even critical. Decay heat removal is accomplished by the AFW System in MODE 3 and 4 and by the Residual Heat Removal (RHR) System in MODE 4, 5, or 6. 14. Steam Generator Water Level - Low, Coincident With Steam Flow/Feedwater Flow MismatchSG Water Level - Low, in conjunction with the Steam Flow/Feedwater Flow Mismatch, ensures that protection is provided against a loss of heat sink and actuates the AFW System prior to uncovering the SG tubes. In addition to a decreasing water level in the SG, the difference between feedwater flow and steam flow is evaluated to determine if feedwater flow is significantly less than steam flow. With less feedwater flow than steam flow, SG level will decrease at a rate dependent upon the magnitude of the difference in flow rates. The required logic is developed from two SG level channels and two Steam Flow/Feedwater Flow Mismatch channels per SG. One narrow range level channel sensing a low level coincident with the associated Steam RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 25 Revision 5 Flow/Feedwater Flow Mismatch channel sensing flow mismatch (steam flow greater than feed flow) for the associated SG will actuate a reactor trip. The LCO requires two channels per SG of SG Water Level - Low coincident with Steam Flow/Feedwater Flow Mismatch. In MODE 1 or 2, when the reactor requires a heat sink, the SG Water Level - Low coincident with Steam Flow/Feedwater Flow Mismatch trip must be OPERABLE. The normal source of water for the SGs is the MFW System (not safety related). The MFW System is only in operation in MODE 1 or 2. The AFW System is the safety related backup source of water to ensure that the SGs remain the heat sink for the reactor. During normal startups and shutdowns, the AFW System provides feedwater to maintain SG level. In MODE 3, 4, 5, or 6, the SG Water Level - Low coincident with Steam Flow/Feedwater Flow Mismatch Function does not have to be OPERABLE because the MFW System is not in operation and the reactor is not operating or even critical. Decay heat removal is accomplished by the AFW System in MODE 3 and by the RHR System in MODE 4, 5, or 6. The MFW System is in operation only in MODE 1 or 2 and, therefore, this trip Function need only be OPERABLE in these MODES. 15. Turbine Trip - Low Auto Stop Oil PressureThe Turbine Trip - Low Auto Stop Oil Pressure trip Function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip. This trip Function acts to minimize the pressure/temperature transient on the reactor. Any turbine trip from a power level below the P-8 setpoint, which is  26.4% RTP, will not actuate a reactor trip. Three pressure switches monitor the control oil pressure in the Turbine Control System. A low pressure condition sensed by two-out-of-three pressure switches will actuate a reactor trip. These pressure switches do not provide any input to the control system. The unit is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations.
Core protection is provided by the Pressurizer Pressure - High trip Function and RCS integrity is ensured by the pressurizer safety valves.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 26 Revision 5 The LCO requires three channels of Turbine Trip - Low Auto Stop Oil Pressure to be OPERABLE in MODE 1 above P-8. Below the P-8 setpoint, a turbine trip does not actuate a reactor trip. In MODE 2, 3, 4, 5, or 6, there is no potential for a turbine trip, and the Turbine Trip - Low Auto Stop Oil Pressure trip Function does not need to be OPERABLE. 16. Safety Injection Input from Engineered Safety Feature Actuation SystemThe SI Input from ESFAS ensures that if a reactor trip has not already been generated by the RPS, the ESFAS automatic actuation logic will initiate a reactor trip upon any signal that initiates SI. This is a condition of acceptability for the LOCA. However, other transients and accidents take credit for varying levels of ESF performance and rely upon rod insertion, except for the most reactive rod that is assumed to be fully withdrawn, to ensure reactor shutdown. Therefore, a reactor trip is initiated every time an SI signal is present. Trip Setpoint and Allowable Values are not applicable to this Function. The SI Input is provided by relay in the ESFAS. Therefore, there is no measurement signal with which to associate an LSSS. The LCO requires two trains of SI Input from ESFAS to be OPERABLE in MODE 1 or 2. A reactor trip is initiated every time an SI signal is present. Therefore, this trip Function must be OPERABLE in MODE 1 or 2, when the reactor is critical, and must be shut down in the event of an accident.
In MODE 3, 4, 5, or 6, the reactor is not critical, and this trip Function does not need to be OPERABLE. 17. Reactor Protection System InterlocksReactor protection interlocks are provided to ensure reactor trips are in the correct configuration for the current unit status. They back up operator actions to ensure protection system Functions are not bypassed during unit conditions under which the safety analysis assumes the Functions are not bypassed. Therefore, the interlock Functions do not need to be OPERABLE when the associated reactor trip functions are outside the applicable MODES. These are:
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 27 Revision 5 a. Intermediate Range Neutron Flux, P-6The Intermediate Range Neutron Flux, P-6 interlock is actuated when any NIS intermediate range channel goes approximately one decade above the minimum channel reading. If both channels drop below the setpoint, the permissive will automatically be defeated. This interlock can also be defeated manually. The LCO requirement for the P-6 interlock ensures that the following Functions are performed:  on increasing power, the P-6 interlock allows the manual block of the NIS Source Range, Neutron Flux reactor trip.
This prevents a premature block of the source range trip and allows the operator to ensure that the intermediate range is OPERABLE prior to leaving the source range.
When the source range trip is blocked, the high voltage to the detectors is also removed, and  on decreasing power, the P-6 interlock automatically energizes the NIS source range detectors and enables the NIS Source Range Neutron Flux reactor trip. The LCO requires two trains of Intermediate Range Neutron Flux, P-6 interlock to be OPERABLE in MODE 2 when below the P-6 interlock setpoint. Above the P-6 interlock setpoint, the NIS Source Range Neutron Flux reactor trip will be blocked, and this Function will no longer be necessary. In MODE 3, 4, 5, or 6, the P-6 interlock does not have to be OPERABLE because the NIS Source Range is providing core protection.b. Low Power Reactor Trips Block, P-7The Low Power Reactor Trips Block, P-7 interlock is actuated by input from either the Power Range Neutron Flux, P-10, or the Turbine First Stage Pressure interlock. The LCO requirement for the P-7 interlock ensures that the following Functions are performed:
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 28 Revision 5 (1) on increasing power, the P-7 interlock (2 of 4 Power Range channels increasing above the P-10 (Function 17.d) setpoint or 1 of 2 Turbine First Stage Pressure (Function 17.e) above the setpoint) automatically enables reactor trips on the following Functions:  Pressurizer Pressure - Low,  Pressurizer Water Level - High,  Reactor Coolant Flow - Low (low flow in two or more RCS loops),  RCPs Breaker Open (Two Loops),  Undervoltage RCPs, and  Underfrequency RCPs. These reactor trips are only required when operating above the P-7 setpoint (approximately 10% power). The reactor trips provide protection against violating the DNBR limit.
Below the P-7 setpoint, the RCS is capable of providing sufficient natural circulation without any RCP running. (2) on decreasing power, the P-7 interlock (3 of 4 Power Range channels decreasing below the P-10 (Function 17.d) setpoint and 2 of 2 Turbine First Stage Pressure channels decreasing below the Turbine First Stage Pressure (Function 17.e) setpoint) automatically blocks reactor trips on the following Functions:  Pressurizer Pressure - Low,  Pressurizer Water Level - High,  Reactor Coolant Flow - Low (low flow in two or more RCS loops),  RCP Breaker Position (Two Loops),
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 29 Revision 5  Undervoltage RCPs, and  Underfrequency RCPs. Trip Setpoint and Allowable Value are not applicable to the P-7 interlock because it is a logic Function and thus has no parameter with which to associate an allowable value. The Allowable Value for the P-10 interlock (Function 17.d) governs input from the Power Range instruments and the Allowable Value for the Turbine First Stage Pressure interlock (Function 17.e) governs input for turbine power. The P-7 interlock is a logic Function with train and not channel identity. Therefore, the LCO requires one channel per train (i.e.,
two trains) of Low Power Reactor Trips Block, P-7 interlock to be OPERABLE in MODE 1. The low power trips are blocked below the P-7 setpoint and unblocked above the P-7 setpoint. In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the interlock performs its Function when power level drops below 10% power, which is in MODE 1. c. Power Range Neutron Flux, P-8The Power Range Neutron Flux, P-8 interlock is actuated at approximately 20% RTP (nominal) as determined by two-out-of-four NIS power range detectors. The P-8 interlock automatically enables the Reactor Coolant Flow - Low and RCP Breaker Position (Single Loop) reactor trips on low flow in one or more RCS loops whenever at least 2 of the 4 Power Range instruments increase to above the P-8 setpoint. The LCO requirement for this trip Function ensures that protection is provided against a loss of flow in any RCS loop that could result in DNB conditions in the core when greater than approximately 20% RTP (nominal). On decreasing power, the reactor trip on low flow in any loop is automatically blocked whenever at least 3 of the 4 Power Range instruments decrease to below the P-8 setpoint.The LCO requires four channels of Power Range Neutron Flux, P-8 interlock to be OPERABLE in MODE 1.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 30 Revision 5 In MODE 1, a loss of flow in one RCS loop could result in DNB conditions, so the Power Range Neutron Flux, P-8 interlock must be OPERABLE. In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the core is not producing sufficient power to be concerned about DNB conditions. d. Power Range Neutron Flux, P-10The Power Range Neutron Flux, P-10 interlock is actuated at approximately 10% power, as determined by two-out-of-four NIS power range detectors. If power level falls below 10% RTP on 3 of 4 channels, the nuclear instrument trips will be automatically unblocked. The LCO requirement for the P-10 interlock ensures that the following Functions are performed:  on increasing power, the P-10 interlock allows the operator to manually block the Intermediate Range Neutron Flux reactor trip. Note that blocking the reactor trip also blocks the signal to prevent automatic and manual rod withdrawal,  on increasing power, the P-10 interlock allows the operator to manually block the Power Range Neutron Flux - Low reactor trip,  on increasing power, the P-10 interlock automatically provides a backup signal to block the Source Range Neutron Flux reactor trip and also to de-energize the NIS source range detectors,  the P-10 interlock provides one of the two inputs to the P-7 interlock, and  on decreasing power, the P-10 interlock automatically enables the Power Range Neutron Flux - Low reactor trip and the Intermediate Range Neutron Flux reactor trip (and rod stop). The LCO requires four channels of Power Range Neutron Flux, P-10 interlock to be OPERABLE in MODE 1 or 2.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 31 Revision 5 OPERABILITY in MODE 1 ensures the Function is available to perform its decreasing power Functions in the event of a reactor shutdown. This Function must be OPERABLE in MODE 2 to ensure that core protection is provided during a startup or shutdown by the Power Range Neutron Flux - Low and Intermediate Range Neutron Flux reactor trips. In MODE 3, 4, 5, or  6, this Function does not have to be OPERABLE because the reactor is not at power and the Source Range Neutron Flux reactor trip provides core protection. e. Turbine First Stage PressureThe Turbine First Stage Pressure (P-7 input) interlock is actuated when the pressure in the first stage of the high pressure turbine is greater than approximately 10% of the pressure consistent with 100% RTP. This is determined by one-out-of-two pressure detectors. The LCO requirement for this Function ensures that one of the inputs to the P-7 interlock is available. The LCO requires two channels of Turbine First Stage Pressure interlock to be OPERABLE in MODE 1. The Turbine First Stage Pressure (P-7 input) interlock must be OPERABLE when the turbine generator is operating. The interlock Function is not required OPERABLE in MODE 2, 3, 4, 5, or 6 because the turbine generator is not operating. 18. Reactor Trip BreakersThis trip Function applies to the RTBs exclusive of undervoltage and shunt trip mechanisms which are addressed in Function 19. The LCO requires two OPERABLE trains of trip breakers. A trip breaker train consists of all trip breakers associated with a single RPS logic train that are racked in, closed, and capable of supplying power to the Rod Control System. Thus, the train may consist of the main breaker, bypass breaker, or main breaker and bypass breaker, depending upon the system configuration.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 32 Revision 5 The LCO requires two OPERABLE trains of trip breakers. Two OPERABLE trains ensure no single random failure can disable the RPS trip capability. When a reactor trip breaker is being tested, both reactor trip breaker and the reactor trip bypass breaker (RTBB) associated with RPS logic train not in test are closed. In this configuration, a single failure in the RPS logic train not in test could disable RPS trip capability; therefore, limits on the duration of testing are established. These trip Functions must be OPERABLE in MODE 1 or 2. In MODE 3, 4, or 5, these RPS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted. 19. Reactor Trip Breaker Undervoltage and Shunt Trip MechanismsThe LCO requires both the Undervoltage and Shunt Trip Mechanisms to be OPERABLE for each RTB that is in service. The trip mechanisms are not required to be OPERABLE for trip breakers that are open, racked out, incapable of supplying power to the Rod Control System, or declared inoperable under Function 18 above.
OPERABILITY of both trip mechanisms on each breaker ensures that no single trip mechanism failure will prevent opening any breaker on a valid signal. These trip Functions must be OPERABLE in MODE 1 or 2. In MODE 3, 4, or 5, these RPS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted. 20. Automatic Trip LogicThe LCO requirement for the RTBs (Functions 18 and 19) and Automatic Trip Logic (Function 20) ensures that means are provided to interrupt the power to allow the rods to fall into the reactor core. Each RTB is equipped with a bypass breaker to allow testing of the trip breaker while the unit is at power. Each RTB and RTBB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed. The reactor trip signals generated by the RPS Automatic Trip Logic cause the RTBs and associated bypass breakers to open and shut down the reactor.
RPS Instrumentation B 3.3.1 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued) INDIAN POINT 2 B 3.3.1 - 33 Revision 5 The LCO requires two trains of RPS Automatic Trip Logic to be OPERABLE. Having two OPERABLE channels ensures that random failure of a single logic channel will not prevent reactor trip. These trip Functions must be OPERABLE in MODE 1 or 2. In MODE 3, 4, or 5, these RPS trip Functions must be OPERABLE when the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted. The RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). ACTIONS A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.1-1. In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected. When the number of inoperable channels in a trip Function exceed those specified in one or other related Conditions associated with a trip Function, then the unit is outside the safety analysis. Therefore, LCO 3.0.3 must be immediately entered if applicable in the current MODE of operation. A.1Condition A applies to all RPS protection Functions. Condition A addresses the situation where one or more required channels or trains for one or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.1-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions. B.1 and B.2Condition B applies to the Manual Reactor Trip in MODE 1 or 2. This action addresses the train orientation of the RPS Automatic Trip Logic for this Function. With one channel inoperable, the inoperable channel must be restored to OPERABLE status within 48 hours. In this Condition, the remaining OPERABLE channel is adequate to perform the safety function.
RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 34 Revision 5 The Completion Time of 48 hours is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE, and the low probability of an event occurring during this interval.If the Manual Reactor Trip Function cannot be restored to OPERABLE status within the allowed 48 hour Completion Time, the unit must be brought to a MODE in which the requirement does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 additional hours (54 hours total time). The 6 additional hours to reach MODE 3 is reasonable, based on operating experience, to reach MODE 3 from full power operation in an orderly manner and without challenging unit systems.
With the unit in MODE 3, ACTION C would apply to any inoperable Manual Reactor Trip Function if the Rod Control System is capable of rod withdrawal or one or more rods are not fully inserted. C.1, C.2.1, and C.2.2Condition C applies to the following reactor trip Functions in MODE 3, 4, or 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted:  Manual Reactor Trip,  RTBs,  RTB Undervoltage and Shunt Trip Mechanisms, and  Automatic Trip Logic. This action addresses the train orientation of the RPS Automatic Trip Logic for these Functions. With one channel or train inoperable, the inoperable channel or train must be restored to OPERABLE status within 48 hours. If the affected Function(s) cannot be restored to OPERABLE status within the allowed 48 hour Completion Time, the unit must be placed in a MODE in which the requirement does not apply. To achieve this status, action must be initiated within the same 48 hours to ensure that all rods are fully inserted, and the Rod Control System must be placed in a condition incapable of rod withdrawal within the next hour. The additional hour provides sufficient time to accomplish the action in an orderly manner. With rods fully inserted and the Rod Control System incapable of rod withdrawal, these Functions are no longer required.
RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 35 Revision 5 The Completion Time is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function, and given the low probability of an event occurring during this interval. D.1 and D.2Condition D applies to the Power Range Neutron Flux - High Function.
The NIS power range detectors provide input to the Rod Control System and, therefore, have a two-out-of-four trip logic. A known inoperable channel must be placed in the tripped condition. This results in a partial trip condition requiring only one-out-of-three logic for actuation. The 72 hours allowed to place the inoperable channel in the tripped condition is justified in WCAP-14333-P-A (Ref. 7). If the inoperable channel is not placed in trip within the required Completion Time, the plant must be placed in a MODE where this Function is no longer required OPERABLE. Seventy-Eight hours are allowed to place the plant in MODE 3. The 78 hour Completion Time includes 72 hours for channel corrective maintenance and an additional 6 hours for the MODE reduction as required by Required Action D.2. This is a reasonable time, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging plant systems. If Required Actions cannot be completed within their allowed Completion Times, LCO 3.0.3 must be entered.The Required Actions have been modified by a NOTE that allows placing one otherwise inoperable channel in bypass for up to 12 hours while performing routine surveillance testing (this includes setpoint adjustment but no other maintenance) and setpoint adjustments when a setpoint reduction is required by other Technical Specifications. This NOTE allows a delay in entry in to the Condition and associated Required Actions. The 12 hour time limit is justified in Reference 7. LCO 3.0.5 may be used to administratively restore to service an inoperable channel that is in trip (e.g., allow bypass) in order to perform surveillance testing on another channel. To maintain the actuation logic per Reference 7, the channel being tested may not be bypassed and no other preventative or corrective maintenance may be performed.
RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 36 Revision 5 If a channel is declared inoperable and the Condition is entered (for a failed surveillance test the channel would be declared inoperable retroactively to the time the bypass was entered), the 72 hours allows for bypassing the channel to perform corrective maintenance. This changes the actuation logic from two-out-of three to two-out-of-two or from two-out-of-four to two-out-of-three depending on the initial logic requirement. This 72 hour AOT may be done in conjunction with the test or as a stand-alone event if the situation allows. After the inoperable channel is repaired, it may be administratively restored to service in accordance with TS 3.0.5 for surveillance testing to demonstrate operability. The NOTE is applicable at this time and may be used to perform the test in bypass. Preventative maintenance is not allowed during the 72 hour AOT since it is normally scheduled during refuel outages per Reference 7. This allowance does not apply to the Frequency for performing SR 3.2.4.2 if the input from a neutron flux channel to the QPTR monitor is inoperable. Specifically, SR 3.2.4.2 must be completed within 24 hours after the input from a neutron flux channel to the QPTR monitor is inoperable even if the channel was originally made inoperable for required testing. The Required Actions have been modified by Note 2 that states SR 3.2.4.2 is applicable if the Power Range Neutron Flux input to QPTR is inoperable.
This Note is needed because failure of a component in the Power Range Neutron Flux Channel which renders the High Flux Trip Function inoperable may affect the capability to monitor QPTR as required by LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)."  If the ability to monitor QPTR is impaired because of an inoperable power range channel, then SR 3.2.4.2 requires either a reduction in reactor power or use of the movable incore detectors for monitoring QPTR. This Note specifies that LCO 3.0.6 is not applicable to QPTR monitoring when a Power Range Neutron Flux Channel is inoperable and that the special requirements for monitoring QPTR in SR 3.2.4.2 are applicable. Note that SR 3.2.4.2 will require action within 12 hours of the discovery of an inoperable Power Range Neutron Flux Channel.E.1 and E.2 Condition E applies to the following reactor trip Functions:  Power Range Neutron Flux - Low,  Overtemperature T, Overpower T,
RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 37 Revision 5  Pressurizer Pressure - High,  SG Water Level - Low Low, and  SG Water Level - Low coincident with Steam Flow/Feedwater Flow Mismatch. A known inoperable channel must be placed in the tripped condition within 72 hours. Placing the channel in the tripped condition results in a partial trip condition requiring only one-out-of-two logic for actuation of the two-out-of-three trips and one-out-of-three logic for actuation of the two-out-of-four trips. The 72 hours allowed to place the inoperable channel in the tripped condition is justified in Reference 7. If the inoperable channel cannot be placed in the trip condition within the specified Completion Time, the unit must be placed in a MODE where these Functions are not required OPERABLE. An additional 6 hours is allowed to place the unit in MODE 3. Six hours is a reasonable time, based on operating experience, to place the unit in MODE 3 from full power in an orderly manner and without challenging unit systems. The Required Actions have been modified by a NOTE that allows placing one otherwise inoperable channel in bypass for up to 12 hours while performing routine surveillance testing (this includes setpoint adjustment but no other maintenance). This NOTE allows a delay in entry in to the Condition and associated Required Actions. The 12 hour time limit is justified in Reference 7. LCO 3.0.5 may be used to administratively restore to service an inoperable channel that is in trip (e.g., allow bypass) in order to perform surveillance testing on another channel. To maintain the actuation logic per  Reference 7, the channel being tested may not be bypassed and no other preventative or corrective maintenance may be performed. If a channel is declared inoperable and the Condition is entered (for a failed surveillance test the channel would be declared inoperable retroactively to the time the bypass was entered), the 72 hours allows for bypassing the channel to perform corrective maintenance. This changes the actuation logic from two-out-of-three to two-out-of-two or from two-out-of-four to two-out-of-three depending the initial logic requirement. This 72 hour AOT may be done in conjunction with the test or as a stand-alone event if the situation allows. After the inoperable channel is repaired, it may be administratively restored to service in accordance with TS 3.0.5 for surveillance testing to RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 38 Revision 5 demonstrate operability. The NOTE is applicable at this time and may be used to perform the test in bypass. Preventative maintenance is not allowed during the 72 hour AOT since it is normally scheduled during refuel outages per Reference 7. F.1 and F.2Condition F applies to the Intermediate Range Neutron Flux trip when THERMAL POWER is above the P-6 setpoint and below the P-10 setpoint and one channel is inoperable. Above the P-6 setpoint and below the P-10 setpoint, the NIS intermediate range detector performs the monitoring Functions. If THERMAL POWER is greater than the P-6 setpoint but less than the P-10 setpoint, 24 hours is allowed to reduce THERMAL POWER below the P-6 setpoint or to increase THERMAL POWER above the P-10 setpoint. The NIS Intermediate Range Neutron Flux channels must be OPERABLE when the power level is above the capability of the source range, P-6, and below the capability of the power range, P-10. If THERMAL POWER is greater than the P-10 setpoint, the NIS power range detectors perform the monitoring and protection functions and the intermediate range is not required. The Completion Times allow for a slow and controlled power adjustment above P-10 or below P-6 and take into account the redundant capability afforded by the redundant OPERABLE channel, and the low probability of its failure during this period. This action does not require the inoperable channel to be tripped because the Function uses one-out-of-two logic. Tripping one channel would trip the reactor. Thus, the Required Actions specified in this Condition are only applicable when channel failure does not result in reactor trip. G.1 and G.2Condition G applies when there are no Intermediate Range Neutron Flux trip channels OPERABLE in MODE 2 when THERMAL POWER is above the P-6 setpoint and below the P-10 setpoint. Required Actions specified in this Condition are only applicable when channel failures do not result in reactor trip. Above the P-6 setpoint and below the P-10 setpoint, the NIS intermediate range detector performs the monitoring Functions. With no intermediate range channels OPERABLE, the Required Actions are to suspend operations involving positive reactivity additions immediately. This will preclude any power level increase since there are no OPERABLE Intermediate Range Neutron Flux channels. The operator must also reduce THERMAL POWER below the P-6 setpoint within two hours. Below P-6, the Source Range Neutron Flux channels will be able to monitor the core power RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 39 Revision 5 level. The Completion Time of 2 hours will allow a slow and controlled power reduction to less than the P-6 setpoint and takes into account the low probability of occurrence of an event during this period that may require the protection afforded by the NIS Intermediate Range Neutron Flux trip and because the Power Range Neutron Flux - Low trips provide diverse protection against reactivity addition events. Required Action G.1 is modified by a note to indicate that normal plant control operations that individually add limited positive reactivity (e.g.,
temperature or boron fluctuations associated with RCS inventory management or temperature control) are not precluded by this Action, provided they are accounted for in the calculated SDM.
H.1Condition H applies to one inoperable Source Range Neutron Flux trip channel when in MODE 2, below the P-6 setpoint, and performing a reactor startup. With the unit in this Condition, below P-6, the NIS source range performs the monitoring and protection functions. With one of the two channels inoperable, operations involving positive reactivity additions shall be suspended immediately. This will preclude any power escalation. With only one source range channel OPERABLE, core protection is severely reduced. However, the Power Range Neutron Flux - Low Function provides required protection for a startup rod withdrawal event from subcritical. Therefore, any actions that add positive reactivity to the core must be suspended immediately. Required Action H.1 is modified by a note to indicate that normal plant control operations that individually add limited positive reactivity (e.g., temperature or boron fluctuations associated with RCS inventory management or temperature control) are not precluded by this Action, provided they are accounted for in the calculated SDM.
I.1Condition I applies when there are no Source Range Neutron Flux trip channels OPERABLE when in MODE 2, below the P-6 setpoint, and in MODE 3, 4, or 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. With the unit in this Condition, below P-6, the NIS source range performs the monitoring and protection functions. With both source range channels inoperable, the RTBs must be RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 40 Revision 5 opened immediately. With the RTBs open, the core is in a more stable condition.J.1, J.2, and J.2.2Condition J applies to one inoperable source range channel in MODE 3, 4, or 5 with the Rod Control System capable of rod withdrawal or one or more rods not fully inserted. With the unit in this Condition, below P-6, the NIS source range performs the monitoring and protection functions. With one of the source range channels inoperable, 48 hours is allowed to restore it to an OPERABLE status. If the channel cannot be returned to an OPERABLE status, action must be initiated within the same 48 hours to ensure that all rods are fully inserted, and the Rod Control System must be placed in a condition incapable of rod withdrawal within the next hour. The allowance of 48 hours to restore the channel to OPERABLE status, and the additional hour, are justified in Reference 8. K.1 and K.2Condition K applies to the following reactor trip Functions:  Pressurizer Pressure - Low,  Pressurizer Water Level - High,  Reactor Coolant Flow - Low  RCP Breaker Position,  RCP Undervoltage, and  RCP Underfrequency. With one channel inoperable, the inoperable channel must be placed in the tripped condition within 72 hours. For the Pressurizer Pressure - Low, Pressurizer Water Level - High, Undervoltage RCPs, and Underfrequency RCPs trip Functions, placing the channel in the tripped condition when above the P-7 setpoint results in a condition requiring only one additional channel to initiate a reactor trip. For the Reactor Coolant Flow - Low trip Function, placing the channel in the tripped condition when above the P-8 setpoint results in a partial trip condition requiring only one additional channel in the same loop to initiate a reactor trip. Two tripped channels in RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 41 Revision 5 two RCS loops are required to initiate a reactor trip when below the P-8 setpoint and above the P-7 setpoint. These Functions do not have to be OPERABLE below the P-7 setpoint because there are no loss of flow trips below the P-7 setpoint.There is insufficient heat production to generate DNB conditions below the P-7 setpoint. The 72 hours allowed to place the channel in the tripped condition is justified in Reference 8. An additional 6 hours is allowed to reduce THERMAL POWER to below P-7 if the inoperable channel cannot be restored to OPERABLE status or placed in trip within the specified Completion Time. Allowance of this time interval takes into consideration the redundant capability provided by the remaining redundant OPERABLE channel, and the low probability of occurrence of an event during this period that may require the protection afforded by the Functions associated with Condition K. The Required Actions have been modified by a NOTE that allows placing one otherwise inoperable channel in bypass for up to 12 hours while performing routine surveillance testing (this includes setpoint adjustment but no other maintenance). This NOTE allows a delay in entry in to the Condition and associated Required Actions. The 12 hour time limit is justified in Reference 7. LCO 3.0.5 may be used to administratively restore to service an inoperable channel that is in trip (e.g., allow bypass) in order to perform surveillance testing on another channel. To maintain the actuation logic per Reference 7, the channel being tested may not be bypassed and no other preventative or corrective maintenance may be performed. If a channel is declared inoperable and the Condition is entered (for a failed surveillance test the channel would be declared inoperable retroactively to the time the bypass was entered), the 72 hours allows for bypassing the channel to perform corrective maintenance. This changes the actuation logic from two-out-of-three to two-out-of-two or from two-out-of-four to two-out-of-three depending the initial logic requirement. This 72 hour AOT may be done in conjunction with the test or as a stand-alone event if the situation allows. After the inoperable channel is repaired, it may be administratively restored to service in accordance with TS 3.0.5 for surveillance testing to demonstrate operability. The NOTE is applicable at this time and may be used to perform the test in bypass. Preventative maintenance is not allowed during the 72 hour AOT since it is normally scheduled during refuel outages per Reference 7.
RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 42 Revision 5 L.1 and L.2Condition L applies to the RCP Breaker Position (Single Loop) reactor trip Function. There is one breaker position device per RCP breaker. With one channel inoperable, the inoperable channel must be restored to OPERABLE status within 6 hours. If the channel cannot be restored to OPERABLE status within the 6 hours, then THERMAL POWER must be reduced below the P-8 setpoint within the next 4 hours. This places the unit in a MODE where the LCO is no longer applicable. This Function does not have to be OPERABLE below the P-8 setpoint because other RPS Functions provide core protection below the P-8 setpoint. The 6 hours allowed to restore the channel to OPERABLE status and the 4 additional hours allowed to reduce THERMAL POWER to below the P-8 setpoint are justified in Reference 8.The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours while performing online surveillance testing of the other channels. The 4 hour time limit is justified in Reference 8. This allowance may be used to bypass an inoperable channel that is in trip to permit surveillance testing (including associated repairs) of the other channels. This Note provides an allowance that when an inoperable channel is bypassed solely for performance of required Surveillances on other the channels for this Function, entry into associated Required Actions may be delayed for up to 4 hours provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 12 hour allowance, the channel must be returned to returned to the tripped status or the applicable Required Actions taken.M.1 and M.2Condition M applies to the RCP Breaker Position (Two Loops) reactor trip Function. There is one breaker position device per RCP breaker. With one channel inoperable, the inoperable channel must be placed in trip within 6 hours. If the channel cannot be placed in trip within the 6 hours, then THERMAL POWER must be reduced below the P-7 setpoint within the next 6 hours. This places the unit in a MODE where the LCO is no longer applicable.
RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 43 Revision 5 This Function does not have to be OPERABLE below the P-7 setpoint because other RPS Functions provide core protection below the P-7 setpoint. The 6 hours allowed to place the channel in trip and the 6 additional hours allowed to reduce THERMAL POWER to below the P-7 setpoint are justified in Reference 8. The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours while performing routine surveillance testing of the other channels. The 4 hour time limit is justified in Reference 8. N.1 and N.2Condition N applies to Turbine Trip on Low Auto Stop Oil Pressure. With one channel inoperable, the inoperable channel must be placed in the trip condition within 72 hours. If placed in the tripped condition, this results in a condition requiring only one additional channel to initiate a reactor trip. If the channel cannot be restored to OPERABLE status or placed in the trip  condition, then power must be reduced below the P-8 setpoint within the next 4 hours. The 72 hours allowed to place the inoperable channel in the tripped condition and the 4 hours allowed for reducing power are justified in Reference 7. The Required Actions have been modified by a NOTE that allows placing one otherwise inoperable channel in bypass for up to 12 hours while performing routine surveillance testing (this includes setpoint adjustment but no other maintenance). This NOTE allows a delay in entry in the Condition and associated Required Actions. The 12 hour time limit is justified in Reference 7. LCO 3.0.5 may be used to administratively restore to service an inoperable channel that is in trip (e.g., allow bypass) in order to perform surveillance testing on another channel. To maintain the actuation logic per Reference 7, the channel being tested may not be bypassed and no other preventative or corrective maintenance may be performed O.1 and O.2Condition O applies to the SI Input from ESFAS reactor trip and the RPS Automatic Trip Logic in MODES 1 and 2. These actions address the train orientation of the RPS for these Functions. With one train inoperable, 24 hours are allowed to restore the train to OPERABLE status (Required Action O.1) or the unit must be placed in MODE 3 within the next 6 hours.
The Completion Time of 24 hours (Required Action O.1) is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function and given the low probability of an RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 44 Revision 5 event during this interval. The 24 hours allowed to restore the inoperable RPS Automatic Trip Logic train to OPERABLE status is justified in Reference 7. The Completion Time of 30 hours (Required Action O.2) is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. The Required Actions have been modified by a Note that allows bypassing one train up to 24 hours for surveillance testing, provided the other train is OPERABLE. The 24 hour time limit for testing the RPS Automatic Trip Logic train may include testing the RTB also, if both the logic test and the RTB test are conducted within the 24 hour time limit. The 24 hour time limit may include maintenance that is performed at the same time as the surveillance test. The 24 hour time limit is justified in Reference 7. This Note provides an allowance that when an inoperable channel is bypassed solely for performance of required Surveillances on other the channels for this Function, entry into associated Required Actions may be delayed for up to 4 hours provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 12 hour allowance, thechannel must be returned to returned to the tripped status or the applicable Required Actions taken. The 24 hour time limit for the RPS Automatic Trip Logic train testing and maintenance is greater than the 4 hour time limit for RTBs, which the logic trains supports. The longer time limit for the Logic train (24 hours) is acceptable based on Reference 7. P.1 and P.2Condition P applies to the RTBs in MODES 1 and 2. These actions address the train orientation of the RPS for the RTBs. With one train inoperable, 24 hours is allowed for train corrective maintenance to restore the train to OPERABLE status or the unit must be placed in MODE 3 within the next 6 hours. The 24 hour Completion Time is justified in Reference 10. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. Placing the unit in MODE 3 results in ACTION C entry while RTB(s) are inoperable. The Required Actions have been modified by a Note that allows one train to be bypassed for up to 4 hours for surveillance testing, provided the other train is OPERABLE. This Note applies to RTB testing that is performed independently from the corresponding Logic train testing. For concurrent testing of the Logic and RTB, the 24 hour test time limit of Condition O RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 45 Revision 5 applies. The 24 hour time is justified in Ref. 10. This Note provides an allowance that when a train is placed in an inoperable status solely for performance of required Surveillances, entry into associated Required Actions may be delayed for up to 4 hours provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 4 hour allowance, the channel must be returned to OPERABLE status or the applicable Required Actions taken. Q.1 and Q.2Condition Q applies to the P-6 and P-10 interlocks. With one or more channels or trains inoperable for one-out-of-two or two-out-of-four coincidence logic, the associated interlock must be verified to be in its required state for the existing unit condition within 1 hour or the unit must be placed in MODE 3 within the next 6 hours. Verifying the interlock status manually accomplishes the interlock's Function. The Completion Time of 1 hour is based on operating experience and the minimum amount of time allowed for manual operator actions. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. The 1 hour and 6 hour Completion Times are equal to the time allowed by LCO 3.0.3 for shutdown actions in the event of a complete loss of RPS Function.R.1 and R.2Condition R applies to the P-7 and P-8 interlocks and the input to P-7 from turbine first stage pressure. With one or more channels or trains inoperable for one-out-of-two or two-out-of-four coincidence logic, the associated interlock must be verified to be in its required state for the existing unit condition within 1 hour or the unit must be placed in MODE 2 within the next 6 hours. These actions are conservative for the case where power level is being raised. Verifying the interlock status manually accomplishes the interlock's Function. The Completion Time of 1 hour is based on operating experience and the minimum amount of time allowed for manual operator actions. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 2 from full power in an orderly manner and without challenging unit systems.
RPS Instrumentation B 3.3.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.1 - 46 Revision 5 S.1 and S.2Condition S applies to the RTB Undervoltage and Shunt Trip Mechanisms, or diverse trip features, in MODES 1 and 2. With one of the diverse trip features inoperable, it must be restored to an OPERABLE status within 48 hours or the unit must be placed in a MODE where the requirement does not apply. This is accomplished by placing the unit in MODE 3 within the next 6 hours (54 hours total time). The Completion Time of 6 hours is a reasonable time, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging unit systems. With the unit in MODE 3, ACTION C would apply to any inoperable RTB trip
 
mechanism.The Completion Time of 48 hours for Required Action S.1 is reasonable considering that in this Condition there is one remaining diverse feature for the affected RTB, and one OPERABLE RTB capable of performing the safety function and given the low probability of an event occurring during this interval.SURVEILLANCE
 
REQUIREMENTSThe SRs for each RPS Function are identified by the SRs column of Table 3.3.1-1 for that Function. A Note has been added to the SR Table stating that Table 3.3.1-1 determines which SRs apply to which RPS Functions. Note that each channel of process protection supplies both train A and train B of the RPS. When testing an individual channel, both train A and train B logics are tested. The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies. SR  3.3.1.1Performance of the CHANNEL CHECK once every 12 hours ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in RPS Instrumentation B 3.3.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.1 - 47 Revision 5 one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL
 
CALIBRATION.Agreement criteria are determined by the unit staff based on a combination of the channel instrument uncertainties, including indication and readability.
If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels. SR  3.3.1.2SR 3.3.1.2 compares the calorimetric heat balance calculation to the NIS channel output every 24 hours. If the calorimetric exceeds the NIS channel output by > 2% RTP, the NIS is not declared inoperable, but must be adjusted. If the NIS channel output cannot be properly adjusted, the channel is declared inoperable. Two Notes modify SR 3.3.1.2. The first Note indicates that the NIS channel output shall be adjusted consistent with the calorimetric results if the absolute difference between the NIS channel output and the calorimetric is
> 2% RTP. The second Note clarifies that this Surveillance is required only if reactor power is  15% RTP and that 12 hours is allowed for performing the first Surveillance after reaching 15% RTP. At lower power levels, calorimetric data are inaccurate. The Frequency of every 24 hours is adequate based on unit operating experience, considering instrument reliability and operating history data for instrument drift. Together these factors demonstrate the change in the absolute difference between NIS and heat balance calculated powers rarely exceeds 2% in any 24 hour period. In addition, control room operators periodically monitor redundant indications and alarms to detect deviations in channel outputs.
RPS Instrumentation B 3.3.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.1 - 48 Revision 5 SR  3.3.1.3SR 3.3.1.3 compares the AFD as determined by the incore detectors and the AFD as determined by the NIS channel output every 31 EFPD. If the absolute difference is  3%, the NIS channel is still OPERABLE, but must be readjusted.If the NIS channel cannot be properly readjusted, the channel is declared inoperable. This Surveillance is performed to verify the f(I) input to the overtemperatureT Function. Two Notes modify SR 3.3.1.3. Note 1 indicates that the excore NIS channel shall be adjusted if the absolute difference between the incore and excore AFD is  3%. Note 2 clarifies that the Surveillance is required only if reactor power is  15% RTP and that 24 Hours is allowed for performing the first surveillance after reaching 15% RTP. The Frequency of every 31 EFPD is adequate based on unit operating experience, considering instrument reliability and operating history data for instrument drift. Also, the slow changes in neutron flux during the fuel cycle can be detected during this interval. SR  3.3.1.4SR 3.3.1.4 is the performance of a TADOT every 62 days on a STAGGERED TEST BASIS. This test shall verify OPERABILITY by actuation of the end devices. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.The RTB test shall include separate verification of the undervoltage and shunt trip mechanisms. Independent verification of RTB undervoltage and shunt trip Function is not required for the bypass breakers. No capability is provided for performing such a test at power. The independent test for bypass breakers is included in SR 3.3.1.14. The bypass breaker test shall include a local shunt trip. A Note has been added to indicate that this test RPS Instrumentation B 3.3.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.1 - 49 Revision 5 must be performed on the bypass breaker prior to placing it in service. The Frequency of every 62 days on a STAGGERED TEST BASIS is justified in Reference 10. SR  3.3.1.5SR 3.3.1.5 is the performance of an ACTUATION LOGIC TEST. The RPS relay logic is tested every 92 days on a STAGGERED TEST BASIS, the train being tested is placed in the bypass condition, thus preventing inadvertent actuation. All possible logic combinations, with and without applicable permissives, are tested for each protection function required by Table 3.3.1-1. The Frequency of every 92 days on a STAGGERED TEST BASIS is justified in Reference 10. SR  3.3.1.6SR 3.3.1.6 is a calibration of the excore channels to the incore channels. If the measurements do not agree, the excore channels are not declared inoperable but must be calibrated to agree with the incore detector measurements. If the excore channels cannot be adjusted, the channels are declared inoperable. This Surveillance is performed to verify the f(I) input to the overtemperature T Function. A Note modifies SR 3.3.1.6. The Note states that this Surveillance is required only if reactor power is  50% RTP and that 24 hours is allowed for performing the first surveillance after reaching 50% RTP. The Frequency of 92 EFPD is adequate based on industry operating experience, considering instrument reliability and operating history data for instrument drift. Additionally, this Frequency is consistent with the Frequency of SR 3.2.3.3 which measures the target flux differences and adjusts the target flux difference for each excore channel to the value measured at steady state conditions. The Frequency of 92 EFPDs recognizes that the target flux difference varies slowly with core burnup. SR  3.3.1.7SR 3.3.1.7 is the performance of a COT every 184 days.
A COT is performed on each required channel to ensure the entire channel will perform the intended Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the RPS Instrumentation B 3.3.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.1 - 50 Revision 5 change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Setpoints must be within the Allowable Values specified in Table 3.3.1-1. The "as found" and "as left" values must also be recorded and reviewed for consistency with the assumptions of References 7 and 8. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology.
The setpoint shall be left set consistent with the assumptions of Reference 6 which incorporates the requirements of References 7 and 8. SR 3.3.1.7 is modified by a Note that provides a 4 hour delay in the requirement to perform this Surveillance for source range instrumentation when entering MODE 3 from MODE 2. This Note allows a normal shutdown to proceed without a delay for testing in MODE 2 and for a short time in MODE 3 until the RTBs are open and SR 3.3.1.7 is no longer required to be performed. If the unit is to be in MODE 3 with the RTBs closed for > 4 hours this Surveillance must be performed prior to 4 hours after entry into MODE 3. The Frequency of 184 days is justified in Reference 10.
SR  3.3.1.8SR 3.3.1.8 is the performance of a COT as described in SR 3.3.1.7, except it is modified by a Note that this test shall include verification that the P-6 and P-10 interlocks are in their required state for the existing unit condition. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Frequency is modified by a Note that allows this surveillance to be satisfied if it has been performed within 184 days of the Frequencies prior to reactor startup, four hours after reducing power below P-6 for source range instrumentation, and twelve hours after reducing power below P-10 for power and intermediate range instrumentation.
RPS Instrumentation B 3.3.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.1 - 51 Revision 5 The Frequency of "prior to startup" and the note on surveillance intervals ensures this surveillance is performed prior to critical operations or within the prior 184 days and applies to the source, intermediate and power range low instrument channels. The Frequency of 12 hours after reducing power below P-10 (applicable to intermediate and power range low channels) and 4 hours after reducing power below P-6 (applicable to source range channels) allows a normal shutdown to be completed and the unit removed from the MODE of Applicability for this surveillance without a delay to perform the testing required by this surveillance.The Frequency of every 184 days thereafter applies if the plant remains in the MODE of Applicability after the initial performances of prior to reactor startup and 12 and four hours after reducing power below P-10 or P-6, respectively. The MODE of Applicability for this surveillance is < P-10 for the power range low and intermediate range channels and < P-6 for the source range channels. Once the unit is in MODE 3, this surveillance is no longer required. If power is to be maintained < P-10 for more than 12 hours or
< P-6 for more than 4 hours, then the testing required by this surveillance must be performed prior to the expiration of the time limit unless removed from the mode of applicability. Twelve hours and four hours are reasonable times to complete the required testing or place the unit in a MODE where this surveillance is no longer required. This test ensures that the NIS source, intermediate, and power range low channels are OPERABLE prior to taking the reactor critical and after reducing power into the applicable MODE
(< P-10 or < P-6) for periods > 12 and 4 hours, respectively, based on startup testing or testing within the prior 184 days (e.g., during the shutdown).The Frequency of 184 days is justified in Reference 10.
SR  3.3.1.9SR 3.3.1.9 is the performance of a TADOT and is performed every 92 days, as justified in Reference 7. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.
RPS Instrumentation B 3.3.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.1 - 52 Revision 5 The SR is modified by a Note that excludes verification of setpoints from the TADOT. Since this SR applies to RCP undervoltage and underfrequency relays, setpoint verification requires elaborate bench calibration and is accomplished during the CHANNEL CALIBRATION. SR  3.3.1.10A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATIONS must be performed consistent with the assumptions used in Reference 6. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology. The Frequency of 24 months is based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint methodology. SR  3.3.1.11SR 3.3.1.11 is the performance of a CHANNEL CALIBRATION, as described in SR 3.3.1.10, every 24 months. This is a calibration of the channel other than the neutron detectors. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. This is needed because CHANNEL CALIBRATION for the power range neutron detectors consists of a normalization of the detectors based on a power calorimetric and flux map performed above 15% RTP. This normalization of the power range neutron detectors is performed by SR 3.3.1.2 within 12 hours after exceeding 15% RTP. The CHANNEL CALIBRATION for the neutron detector portion of the source range and intermediate range neutron detectors consists of obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturer's data. This Surveillance is not required for the NIS power range detectors for entry into MODE 2 or 1, and is not required for the NIS intermediate range detectors for entry into MODE 2, because the unit must be in MODE 1 to perform SR 3.3.1.2 and the unit must be in at least MODE 2 to perform the test for the intermediate range detectors.
RPS Instrumentation B 3.3.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.1 - 53 Revision 5 The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance when performed on the 24 month Frequency. SR  3.3.1.12SR 3.3.1.12 is the performance of a CHANNEL CALIBRATION, as described in SR 3.3.1.10, every 24 months. This SR includes verification that the electronic dynamic compensation time constants in Table 3.3.1-1, Notes 1 and 2, are set at the required values. Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the resistance temperature detectors (RTD) sensors is accomplished by an in place cross calibration that compares the other sensing elements with the recently installed sensing element. The Frequency is justified by the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. SR  3.3.1.13SR 3.3.1.13 is the performance of a COT of RPS interlocks every 24 months. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Frequency is based on the known reliability of the interlocks and the multichannel redundancy available, and has been shown to be acceptable through operating experience.
RPS Instrumentation B 3.3.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.1 - 54 Revision 5 SR  3.3.1.14SR 3.3.1.14 is the performance of a TADOT of the Manual Reactor Trip, RCP Breaker Position, Turbine Trip Low Auto Stop Oil Pressure, and the SI Input from ESFAS. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay.
This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This TADOT is performed every 24 months. The test shall independently verify the OPERABILITY of the tested functions including overlap with the undervoltage and shunt trip mechanisms for the Manual Reactor Trip Function for the Reactor Trip Breakers and Reactor Trip Bypass Breakers up to and including matrix contacts of RT-11/RT-12 from both manual trip actuating devices. The Reactor Trip Bypass Breaker test shall include testing of the automatic undervoltage trip and the shunt trip through the trip actuating devices. The Frequency is based on the known reliability of the Functions and the multichannel redundancy available, and has been shown to be acceptable through operating experience. The SR is modified by a Note that excludes verification of setpoints from the TADOT. Except for Turbine Trip Low Auto Stop Oil Pressure, which is also calibrated under SR 3.3.1.10, the Functions affected have no setpoints associated with them.
RPS Instrumentation B 3.3.1 BASESINDIAN POINT 2 B 3.3.1 - 55 Revision 5 REFERENCES 1. UFSAR, Chapter 7. 2. UFSAR, Chapter 6. 3. UFSAR, Chapter 14.
: 4. IEEE-279-1968.
: 5. 10 CFR 50.49.
: 6. Indian Point 2 Specification FIX-95-A-001, Guidelines for Preparation Of Instrument Loop Accuracy and Setpoint Determination Calculation. 7. WCAP-14333-P-A, Rev.1, Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times. 8. WCAP-10271-P-A, Supplement 1, Rev. 1, May, 1986.
: 9. Safety Evaluation by the Office of Nuclear Reactor Regulation Related Indian Point 2 Proposed Increase in Licensed Thermal Power, January 29, 1990. 10. WCAP-15376-P-A, Rev. 0, Risk Informed assessment of RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times, October 2000. 11. WCAP-16041-P, Westinghouse Setpoint Methodology for Protection and Control Systems Indian Point Unit 2.
ESFAS InstrumentationB 3.3.2 INDIAN POINT 2B 3.3.2 - 1 Revision 4B 3.3  INSTRUMENTATIONB 3.3.2Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASESBACKGROUNDThe ESFAS initiates necessary safety systems, based on the values ofselected unit parameters, to protect against violating core design limits and the Reactor Coolant System (RCS) pressure boundary, and to mitigate accidents.The ESFAS instrumentation is segmented into three distinct butinterconnected modules as identified below: Field transmitters or process sensors and instrumentation:  provide ameasurable electronic signal based on the physical characteristics of the parameter being measured, Signal processing equipment including analog protection system, fieldcontacts, and protection channel sets:  provide signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board/control room/miscellaneous indications, and ESFAS Automatic Actuation Logic and Relays:  initiates the properengineered safety feature (ESF) actuation in accordance with the defined logic and based on the bistable outputs from the signal process control and protection system.The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for ESFAS action to prevent exceeding acceptable limits such that the consequences of Design Basis Accidents (DBAs) will be acceptable.
The Allowable Value is considered a limiting value such that a channel is OPERABLE if the setpoint is found not to exceed the Allowable Value during the CHANNEL OPERATIONAL TEST (COT). Note that, although a channel is "OPERABLE" under these circumstances, the ESFAS setpoint must be left adjusted to within the established calibration tolerance band of the ESFAS setpoint in accordance with the uncertainty assumptions stated in the referenced setpoint methodology, (as-left criteria) and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.
If the actual setting of the device is found to have exceeded the as-found allowance, the channel would be evaluated to determine Technical Specification OPERABILITY. The results of this evaluation would result in corrective action including those actions required by 10 CFR 50.36 when automatic protective devices do not function as required.
ESFAS InstrumentationB 3.3.2 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.3.2 - 2 Revision 4Field Transmitters or SensorsTo meet the design demands for redundancy and reliability, more than one,and often as many as four, field transmitters or sensors are used to measure unit parameters. In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Protection System (RPS). In some cases, the same channels also provide control system inputs. To account for calibration tolerances and instrument drift, which are assumed to occur between calibrations, statistical allowances are provided in the trip setpoint.
The OPERABILITY of each transmitter or sensor is determined by either "as-found" calibration data evaluated during the CHANNEL CALIBRATION or by qualitative assessment of field transmitter or sensor, as related to the channel behavior observed during performance of the CHANNEL CHECK.Signal Processing EquipmentGenerally, three or four channels of process control equipment are used forthe signal processing of unit parameters measured by the field instruments.
The process control equipment provides signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established to ensure that actuation will occur within the limits assumed in the accident analysis described in UFSAR Sections 6 and 14 (Refs. 1 and 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable is forwarded to the ESFAS Automatic Actuation Logic for decision evaluation. Channel separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing. Some unit parameters provide input only to the ESFAS Automatic Actuation Logic, while others provide input to the ESFAS Automatic Actuation Logic, the main control board, the unit computer, and one or more control systems.Generally, if a parameter is used only for input to the protection circuits, threechannels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function is still OPERABLE with a two-out-of-two logic. If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function is still OPERABLE with a one-out-of-two logic.
ESFAS InstrumentationB 3.3.2 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.3.2 - 3 Revision 4Generally, if a parameter is used for input to the ESFAS Automatic ActuationLogic and a control function, four channels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy. The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the otherchannels providing the protection function actuation. Again, a single failurewill neither cause nor prevent the protection function actuation.These requirements are described in IEEE-279-1968 (Ref. 4). The actualnumber of channels required for each unit parameter is specified in Reference 2 and discussed later in these Technical Specification Bases.ESFAS Automatic Actuation LogicThe ESFAS Automatic Actuation Logic is used for the decision logicprocessing of outputs from the signal processing equipment bistables. To meet the redundancy requirements, two trains of ESFAS Automatic Actuation Logic, each performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide ESF actuation for the unit. If both trains are taken out of service or placed in test, ESFAS actuation will result. Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements.The ESFAS Automatic Actuation Logic performs the decision logic for mostESF equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room.The bistable outputs from the signal processing equipment are sensed by theESFAS Automatic Actuation Logic and combined into logic matrices that represent combinations indicative of various transients. If a required logic matrix combination is completed, the system will send actuation signals via master and slave relays to those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition.
Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.Each ESFAS Automatic Actuation Logic train has a built in testing capabilitythat can test the decision logic matrix functions and the actuation devices while the unit is at power. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.
ESFAS InstrumentationB 3.3.2 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.3.2 - 4 Revision 4The actuation of ESF components is accomplished through master and slaverelays. The ESFAS Automatic Actuation Logic energizes the master relays appropriate for the condition of the unit. Each master relay then energizes one or more slave relays, which then cause actuation of the end devices.
The master and slave relays are routinely tested to ensure operation.Trip Setpoints and Allowable ValuesThe following describes the relationship between the safety limit, analyticallimit, allowable value, limiting setpoint and trip setpoint:a. A Safety Limit (SL) is a limit on the combination of THERMAL POWER,RCS highest loop average temperature, and RCS pressure needed toprotect the integrity of physical barriers that guard against the uncontrolled release of radioactivity (i.e., fuel, fuel cladding, RCS pressure boundary and containment). The safety limits are identified in Technical Specification 2.0, Safety Limits (SLs).b. An Analytical Limit (AL) is the limit for a measured or calculatedvariable used as an input to the accident analyses presented in UFSAR, Chapter 14 (Ref. 3). Analytical limits are developed from event analyses models which consider parameters such as process delays, rod insertion times, reactivity changes, instrument response times, etc.
An analytical limit for a trip actuation point is established at a point that will ensure that a Safety Limit (SL) is not exceeded.c. An Allowable Value (AV) is the limiting actuation point for the entirechannel of a trip function that will ensure, within the required level of confidence, that sufficient allocation exists between this actuation point and the analytical limit. The Allowable Value is more conservative than the Analytical Limit to account for instrument uncertainties that either are not present or are not measured during periodic testing. Channel uncertainties that either are not present or are not measured during periodic testing may include design basis accident temperature and radiation effects or process dependent effects. The channel allowable value for each ESFAS function is controlled by Technical Specifications and is listed in Table 3.3.2-1, ESFAS Instrumentation.d. A limiting Setpoint is the maximum or minimum setpoint, which can besafely set for trip actuation, after allowing for channel statisticalallowances from the analytical limit.
ESFAS InstrumentationB 3.3.2 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.3.2 - 5 Revision 4e. A trip setpoint is an administratively selected point at which the bistableis set and is expected to be achieved during calibration. It is selectedto accommodate the ease of calibration and operation. The difference between limiting setpoint and trip setpoint is the margin available during calibration and operation. The trip setpoints are established by plant administrative programs for the components of a channel (i.e., required sensor, alarm, interlock, display, and trip function) to ensure, within the required level of confidence, that the Allowable Value for the entire channel will not be exceeded during the calibration interval. A description of the methodology used to calculate the allowable values, limiting setpoint and trip setpoint is provided in References 6 and 11.The trip setpoint value ensures the allowable value and the safety analysis limits are met for surveillance interval selected when a channel is adjusted based on stated channel uncertainties. Any bistable is considered to be properly adjusted when the "as left" setpoint value is within the band forCHANNEL CALIBRATION uncertainty allowance (i.e., rack calibration andcomparator setting uncertainties). The trip setpoint value is thereforeconsidered a "nominal" value (i.e., expressed as a value without inequalities) for the purposes of COT and CHANNEL CALIBRATION.Trip setpoints consistent with the requirements of the Allowable Value ensurethat SLs are not violated during AOOs (and that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed).Each channel can be tested on line to verify that the signal processingequipment and setpoint accuracy is within the specified allowance requirements of Reference 2. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated. SRs for the channels are specified in the SR section.APPLICABLE
 
SAFETY ANALYSES, LCO, and APPLICABILITYEach of the analyzed accidents can be detected by one or more ESFAS Functions. One of the ESFAS Functions is the primary actuation signal for that accident. An ESFAS Function may be the primary actuation signal for more than one type of accident. An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents. For example, Pressurizer Pressure - Low is a primary actuation signal for small loss of coolant accidents (LOCAs) and a backup actuation signal for ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 6 Revision 4steam line breaks (SLBs) outside containment. Functions such as manualinitiation, not specifically credited in the accident safety analysis, are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrateFunction performance. These Functions may also serve as backups toFunctions that were credited in the accident analysis (Ref. 3).The LCO requires all instrumentation performing an ESFAS Functionidentified in Table 3.3.2-1 to be OPERABLE. A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the calibration tolerance band of the Nominal Trip Setpoint. A trip setpoint may be set more conservative than the Nominal Trip Setpoint as necessary in response to plant conditions. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.The LCO generally requires OPERABILITY of four or three channels in eachinstrumentation function and two channels in each logic and manual initiation function. The two-out-of-three and the two-out-of-four configurations allow one channel to be tripped during maintenance or testing without causing an ESFAS initiation. Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.The required channels of ESFAS instrumentation provide unit protection inthe event of any of the analyzed accidents. ESFAS protection functions are as follows:1. Safety InjectionSafety Injection (SI) provides two primary functions necessary tomitigate the effects of high energy line breaks (HELBs) both inside and outside of containment:1. Primary side water addition to ensure maintenance or recovery ofreactor vessel water level (coverage of the active fuel for heatremoval, clad integrity, and for limiting peak clad temperature to
 
< 2200 F), and2. Boration to ensure recovery and maintenance of SDM (k eff < 1.0).
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 7 Revision 4The SI signal is also used to initiate other Functions such as:Phase A Isolation, Containment Isolation,Reactor Trip,Turbine Trip,Feedwater Isolation,Start of auxiliary feedwater (AFW) pumps, andControl room ventilation isolation.These other functions ensure:Isolation of nonessential systems through containmentpenetrations to limit leakage to the environment,Trip of the turbine and reactor to limit power generation,Isolation of main feedwater (MFW) to limit secondary side mass losses,Start of AFW to ensure secondary side cooling capability, andIsolation of the control room to ensure habitability.a. Safety Injection - Manual InitiationThe LCO requires one channel per train to be OPERABLE. The operator can initiate SI at any time by using either of two push buttons in the control room. This action will cause actuation of one ESFAS logic train and associated components in the same manner as any of the automatic actuation signals.The LCO for the Manual Initiation Function ensures the properamount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 8 Revision 4Each channel consists of one push button and the interconnectingwiring to the actuation logic cabinet. Each push button actuates
 
one ESFAS logic train.b. Safety Injection - Automatic Actuation Logic and Actuation RelaysThis LCO requires two trains to be OPERABLE. Actuation logic consists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the
 
ESF equipment.Manual and automatic initiation of SI must be OPERABLE inMODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. Manual Initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.These Functions are not required to be OPERABLE in MODES 5and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. Unit pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.c. Safety Injection - Containment Pressure - HighThis signal provides protection against the following accidents:SLB inside containment, and LOCA.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 9 Revision 4Containment Pressure - High provides no input to any controlfunctions. Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic. The transmitters (d/p cells) and electronics are located outside of containment with the sensing line (high pressure side of thetransmitter) located inside containment.Thus, the high pressure Function will not experience any adverseenvironmental conditions and the Allowable Value reflects only steady state instrument uncertainties.Containment Pressure - High must be OPERABLE in MODES 1,2, and 3 because there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment.d. Safety Injection - Pressurizer Pressure - LowThis signal provides protection against the following accidents:Inadvertent opening of a steam generator (SG) relief or safety valve, SLB,A rod cluster control assembly ejection accident (rod ejection),Inadvertent opening of a PORV or safety valve, LOCAs, and SG Tube Rupture.Three channels of pressurizer pressure provide input into the ESFAS actuation logic. These channels initiate the ESFAS automatically when two of the three channels exceed the low pressure setpoint. These protection channels also provide control functions; however, the two-out-of-three logic is considered adequate to provide the required protection.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 10 Revision 4The transmitters are located inside containment, with the taps inthe vapor space region of the pressurizer, and thus possibly experiencing adverse environmental conditions (LOCA, SLB inside containment, rod ejection). Therefore, the Allowable Value reflects the inclusion of both steady state and adverseenvironmental instrument uncertainties.This Function must be OPERABLE in MODES 1, 2, and 3 (abovethe Pressurizer Pressure Interlock (Table 3.3.2-1, Function 7)) to mitigate the consequences of an HELB inside containment. This signal may be manually blocked by the operator below the Pressurizer Pressure Interlock (Table 3.3.2-1, Function 7) setpoint. Automatic SI actuation below this pressure setpoint is then performed by the Containment Pressure - High signal.This Function is not required to be OPERABLE in MODE 3 belowthe Pressurizer Pressure Interlock (Table 3.3.2-1, Function 7) setpoint. Other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this Function is not needed for accident detection and mitigation.e. Safety Injection - High Differential Pressure Between Steam LinesHigh Differential Pressure Between Steam Lines provides protection against the following accidents:
SLB, andInadvertent opening of an Atmospheric Dump Valve (ADV) or an SG safety valve.High Differential Pressure Between Steam Lines provides no input to any control functions. Thus, three OPERABLE channels on each steam line are sufficient to satisfy the requirements, with a two-out-of-three logic on each steam line.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 11 Revision 4With the transmitters located inside the auxiliary feed pump room,it is possible for them to experience adverse environmental conditions during an SLB event. Therefore, the Allowable Value reflects both steady state and adverse environmental instrument uncertainties.Steam line high differential pressure must be OPERABLE inMODES 1, 2, and 3 when a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). This Function is not required to be OPERABLE in MODE 4, 5, or 6 because there is not sufficient energy in the secondary side of the unit to cause an accident.f, g. Safety Injection - High Steam Flow in Two Steam LinesCoincident With Tavg - Low or Coincident With Steam LinePressure - LowThese Functions (1.f and 1.g) provide protection against the following accidents:
SLB, andthe inadvertent opening of an ADV or an SG safety valve.Two steam line flow channels per steam line are required OPERABLE for these Functions. The steam line flow channels are combined in a one-out-of-two logic to indicate high steam flow in one steam line. The steam flow transmitters provide control inputs, but the control function cannot cause the events that the Function must protect against. Therefore, two channels are sufficient to satisfy redundancy requirements. The one-out-of-two configuration allows online testing because trip of one high steam flow channel is not sufficient to cause initiation. High steam flow in two steam lines is acceptable in the case of a single steam line fault due to the fact that the remaining intact steam lines will pick up the full turbine load. The increased steam flow in the remaining intact lines will actuate the required second high steam flow trip. Additional protection is provided by Function 1.e, High Differential Pressure Between Steam Lines.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 12 Revision 4One channel of Tavg per loop and one channel of low steam linepressure per steam line are required OPERABLE. For eachparameter, the channels for all loops or steam lines are combined in a logic such that two channels tripped will cause a trip for the parameter. The Function trips on one-out-of-two high flow in anytwo-out-of-four steam lines if there is one-out-of-one low Tavg tripin any two-out-of-four RCS loops, or if there is a one-out-of-onelow pressure trip in any two-out-of-four steam lines. Since the accidents that this event protects against cause both low steam line pressure and low Tavg, provision of one channel per loop orsteam line ensures no single random failure can disable both of these Functions. The steam line pressure channels provide no control inputs. The Tavg channels provide control inputs, but thecontrol function cannot initiate events that the Function acts to mitigate.The Allowable Value for high steam flow is a linear function thatvaries with power level (Turbine inlet pressure also known as Turbine first stage pressure). The function is aP correspondingto approximately 45.9% of full steam flow between 0% and 20%
load to 122.0% of full steam flow at 100% load. The nominal trip setpoint is similarly calculated.With the transmitters located inside the containment (Tavg) orinside the auxiliary feed pump room (High Steam Flow), it ispossible for them to experience adverse steady state environmental conditions during an SLB event. Therefore, the Trip Setpoint reflects both steady state and adverse environmental instrument uncertainties.This Function must be OPERABLE in MODES 1, 2, and 3because a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). SLB may be addressed by Containment Pressure High (inside containment) or by High Steam Flow in Two Steam Lines coincident with Steam Line Pressure - Low, for Steam Line Isolation, followed by High Differential Pressure Between Two Steam Lines, for SI. This Function is not required to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to cause an accident.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 13 Revision 42. Containment SprayContainment Spray provides two primary functions:1. Lowers containment pressure and temperature after a HELB incontainment, and2. Reduces the amount of radioactive iodine in the containmentatmosphere.These functions are necessary to:Ensure the pressure boundary integrity of the containmentstructure, andLimit the release of radioactive iodine to the environment in the event of a failure of the containment structure.The containment spray actuation signal starts the containment spray pump associated with that logic train and aligns the discharge of the pumps to the containment spray nozzle headers in the upper levels of containment. Water is initially drawn from the RWST by the containment spray pumps. When the RWST reaches a specified minimum level, the spray pumps are manually secured. Recirculation or RHR pumps are used by diverting flow to the spray headers if continued containment spray is required. Containment spray is actuated manually or by Containment Pressure - High High.a. Containment Spray - Manual InitiationThe operator can initiate containment spray at any time from thecontrol room. Manual initiation of containment spray (CS) requires that either of two pushbuttons in the control room be depressed. Each pushbutton will actuate one logic train and the associated CS train. Two trains are required to be Operable (one pushbutton associated with each logic train).Note that Manual Initiation of containment spray also actuatesPhase B containment isolation and containment purge and exhaust line isolation and pressure relief line isolation.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 14 Revision 4b. Containment Spray - Automatic Actuation Logic and ActuationRelaysThis LCO requires two trains to be OPERABLE. Actuation logicconsists of all circuitry housed within the actuation subsystems, including the initiating relay contacts responsible for actuating the
 
ESF equipment.Manual and automatic initiation of containment spray must beOPERABLE in MODES 1, 2, and 3 when there is a potential for an accident to occur, and sufficient energy in the primary or secondary systems to pose a threat to containment integrity due to overpressure conditions. Manual initiation is also required in MODE 4, even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA. However, because of the number of components actuated on a containment spray, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation.
In MODES 5 and 6, there is insufficient energy in the primary and secondary systems to result in containment overpressure. In MODES 5 and 6, there is also adequate time for the operators to evaluate unit conditions and respond, to mitigate the consequences of abnormal conditions by manually starting individual components.c. Containment Spray - Containment PressureThis signal provides protection against a LOCA or an SLB inside containment. The transmitters (d/p cells) are located outside of containment with the sensing line (high pressure side of the transmitter) located inside containment. The transmitters and electronics are located outside of containment. Thus, they will not experience any adverse environmental conditions and the Trip Setpoint reflects only steady state instrument uncertainties.This Function requires the bistable output to energize to performits required action. It is not desirable to have a loss of power actuate containment spray because the consequences of an inadvertent actuation of containment spray could be serious.
Therefore, the IP2 design consists of 2 sets of 3 channels (6 pressure instruments) and 2 channels from each set of 3 are ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 15 Revision 4required to energize to actuate Containment Spray. Thisconfiguration provides sufficient redundancy to prevent a single failure from causing or preventing Containment Spray initiation even when testing with one inoperable channel already in trip.
The Required Actions for an inoperable channel associated withthis Function decreases the probability of an inadvertent actuationby allowing no more than one channel per set to be placed in trip.Containment pressure is not used for control; therefore, thisarrangement exceeds the minimum redundancy requirements.Containment Pressure - High High must be OPERABLE inMODES 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary and secondary sides to pressurize the containment and reach the Containment Pressure - High High setpoint.3. Containment IsolationContainment Isolation provides isolation of the containment atmosphere, and selected process systems that penetrate containment.
This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a large break LOCA.There are two separate Containment Isolation signals, Phase A andPhase B. Phase A isolation isolates all automatically isolable process lines exiting containment, except component cooling water (CCW) and RCP seal return, at a relatively low containment pressure indicative of primary or secondary system leaks. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required) method of decay heat removal. Since CCW is required to support RCP operation, not isolating CCW and RCP seal return on the low pressure Phase A signal enhances unit safety by allowing operators to use forced RCS circulation to cool the unit.Phase A containment isolation is actuated automatically by any SIsignal, or manually. Both methods utilize the Phase A automatic actuation logic. All process lines penetrating containment, with the exception of CCW and RCP seal return, are isolated. CCW and RCP seal return are not isolated at this time to permit continued operation ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 16 Revision 4of the RCPs with cooling water flow to the thermal barrier heatexchangers and oil coolers. All process lines not equipped with remote operated isolation valves are manually closed, or otherwise isolated, prior to reaching MODE 4 except for manual isolation valves that are not assumed to be closed at the start of an analyzed event.Manual Phase A Containment Isolation is accomplished by either of twopushbuttons in the control room. Each pushbutton actuates one train of Phase A logic. Note that manual actuation of Phase A Containment Isolation also actuates Containment Purge, Exhaust, and Pressure
 
Relief Line Isolation.The Phase B signal isolates CCW and RCP seal injection. This occursat a relatively high containment pressure that is indicative of a large break LOCA or an SLB. For these events, forced circulation using the RCPs is no longer desirable. Isolating the CCW at the higher pressure does not pose a challenge to the containment boundary because the CCW System is a closed loop inside containment. Although some CCW system components may not meet all of the ASME Code requirements applied to the containment itself, the system is continuously pressurized to a pressure greater than the Phase B setpoint. Thus, routine operation demonstrates the integrity of the system pressure boundary for pressures exceeding the Phase B setpoint. Furthermore, because system pressure exceeds the Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment. Therefore, the combination of CCW System design and Phase B isolation ensures the CCW System is not a potential path for radioactive release from containment.Phase B containment isolation is actuated by Containment Pressure -High High, or manually, via the automatic actuation logic, as previously discussed. For containment pressure to reach a value high enough to actuate Containment Pressure - High High, a large break LOCA or SLB must have occurred and containment spray must have been actuated.
RCP operation will no longer be required. Therefore, CCW to the RCPs is no longer necessary.Manual Phase B Containment Isolation is accomplished by either of twopushbuttons in the control room. Either pushbutton actuates one train of Phase B actuation logic. Manual Phase B Containment Isolation is also initiated by the pushbuttons that actuate Containment ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 17 Revision 4Spray. When the two CS pushbuttons are depressed simultaneously,Phase B Containment Isolation and Containment Spray will be actuated in both trains.a. Containment Isolation - Phase A Isolation(1) Phase A Isolation - Manual InitiationManual Phase A Containment Isolation is actuated by eitherof two pushbuttons in the control room. Each pushbutton actuates one logic train. Note that manual initiation of Phase A Containment Isolation also actuates isolation of Containment Purge and Exhaust and the Containment Pressure relief line.(2) Phase A Isolation - Automatic Actuation Logic andActuation RelaysAutomatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS Function 1.b.Manual and automatic initiation of Phase A ContainmentIsolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. Manual initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a Phase A Containment Isolation, actuation is simplified by the use of the manual actuation pushbuttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase A Containment Isolation. There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 18 Revision 4(3) Phase A Isolation - Safety InjectionPhase A Containment Isolation is also initiated by allFunctions that initiate SI. The Phase A Containment Isolation requirements for these Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.b. Containment Isolation - Phase B IsolationPhase B Containment Isolation is accomplished by Manual Initiation, Automatic Actuation Logic and Actuation Relays, and by Containment Pressure channels (the same channels that actuate Containment Spray, Function 2). The Containment Pressure trip of Phase B Containment Isolation is energized to trip in order to minimize the potential of spurious trips that may damage the RCPs.(1) Phase B Isolation - Manual InitiationManual Phase B Containment Isolation is accomplished byeither of two pushbuttons in the control room. Either pushbutton actuates both trains.(2) Phase B Isolation - Automatic Actuation Logic andActuation RelaysManual and automatic initiation of Phase B containment isolation must be OPERABLE in MODES 1, 2, and 3, when there is a potential for an accident to occur. Manual initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA. However, because of the number of components actuated on a Phase B containment isolation, actuation is simplified by the use of the manual actuation push buttons. Automatic actuation logic and actuation relays must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 19 Revision 4pressurize the containment to require Phase B containmentisolation. There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.(3) Phase B Isolation - Containment PressureThe basis for containment pressure MODE applicability is as discussed for ESFAS Function 2.c above.4. Steam Line IsolationIsolation of the main steam lines provides protection in the event of an SLB inside or outside containment. For the limiting SLB, rapid isolation of the steam lines will limit the steam break accident to the blowdown from one SG even if a steam line check valve fails. For an SLB upstream of the main steam isolation valves (MSIVs), inside or outside of containment, closure of the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSIVs terminates the accident.a. Steam Line Isolation - Manual InitiationManual initiation of Steam Line Isolation can be accomplishedfrom the control room. There are two separate and redundant circuits (channel A and channel B) capable of closing each MSIV.
Each main steam isolation valve (MSIV) will close if either of twosolenoid exhaust valves in parallel (channel A and channel B) areopened and either of two solenoid supply valves in series (channel A and channel B) are closed. The solenoid valves associated with each MSIV are operated by a single switch and there is a separate switch for each MSIV. Each of these switches actuates both channels; however, the switch in the control room is common to both channels. Therefore, the LCO requires 2 channels per MSIV and each MSIV is considered a separate
 
Function.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 20 Revision 4b. Steam Line Isolation - Automatic Actuation Logic and ActuationRelaysAutomatic actuation logic and actuation relays consist of thesame features and operate in the same manner as described for ESFAS Function 1.b.Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB or other accident. This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless all MSIVs are closed. In MODES 4, 5, and 6, there is insufficient energy in the RCS and SGs to experience an SLB or other accident releasing significant quantities of energy.c. Steam Line Isolation - Containment Pressure - High-HighThis Function actuates closure of the MSIVs in the event of aLOCA or an SLB inside containment to maintain at least two unfaulted SGs as a heat sink for the reactor, and to limit the mass and energy release to containment. The transmitters (d/p cells) are located outside containment with the sensing line (high pressure side of the transmitter) located inside containment.
Containment Pressure - High-High provides no input to any control functions. The transmitters and electronics are located outside of containment. Thus, they will not experience any adverse environmental conditions, and the Allowable Value reflects only steady state instrument uncertainties.The IP2 design consists of 2 sets of 3 channels and 2 channelsfrom each set of 3 are required to energize to actuate steam line isolation on high pressure in the containment. This is the same logic that initiates Containment Spray. Therefore, this logic is designed to provide sufficient redundancy to prevent a single failure from causing or preventing Containment Spray initiation even when testing with one inoperable channel already in trip.
The Required Action for an inoperable channel associated with this Function permits no more than one channel per set to be placed in trip to decrease the probability of an inadvertent actuation.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 21 Revision 4Containment Pressure - High-High must be OPERABLE inMODES 1, 2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection and closure of the MSIVs. TheSteam Line Isolation Function remains OPERABLE in MODES 2and 3 unless all MSIVs are closed. In MODES 4, 5, and 6, there is not enough energy in the primary and secondary sides to pressurize the containment to the Containment Pressure -
High-High setpoint.d., e. Steam Line Isolation - High Steam Flow in Two Steam LinesCoincident with Tavg - Low or Coincident With Steam LinePressure - LowThese Functions (4.d and 4.e) provide closure of the MSIVs during an SLB or inadvertent opening of an SG relief or a safety valve, to maintain at least two unfaulted SGs as a heat sink for the reactor and to limit RCS cooldown rate and to limit the mass and energy release to containment.These Functions were discussed previously as Functions 1.f.
and 1.g.These Functions must be OPERABLE in MODES 1 and 2, and inMODE 3, because a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines unless all MSIVs are closed. These Functions are not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.5. Feedwater IsolationThe Feedwater Isolation function is needed to isolate feedwater to mitigate various accident and transient conditions (main steamline breaks, steam generator tube ruptures, and excessive heat removal due to feedwater system malfunction). Main feedwater must be automatically isolated to prevent excessive Reactor Coolant System (RCS) cooldown, containment overpressure, and steam generator ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 22 Revision 4overfill. Additionally, the Feedwater Isolation function and the turbinetrip which is initiated by the same Functions are needed to prevent damage to the turbine due to water in the steam lines, and to stop the excessive flow of feedwater into the SGs.This Function is actuated by SG Water Level - High High, or by an SIsignal and initiates redundant main feedwater isolation to all four steam generators as required by LCO 3.7.3, "Main Feedwater Isolation."  The MFW System is also taken out of operation and the AFW System is automatically started. The SI signal was discussed previously.a. Feedwater Isolation - Automatic Actuation Logic and ActuationRelaysAutomatic Actuation Logic and Actuation Relays consist of thesame features and operate in the same manner as described for ESFAS Function 1.b.b. Feedwater Isolation - Steam Generator Water Level - High HighThis signal provides protection against excessive feedwater flow.
The ESFAS SG water level instruments provide input to the SG Water Level Control System. However, only three protection channels are necessary to satisfy the protective requirements because the trip is initiated by any of the four SGs and the RPS provides diverse protection for feedwater addition event.The transmitters (d/p cells) are located inside containment.However, the events that this Function protects against cannot cause a severe environment in containment. Therefore, the Trip Setpoint reflects only steady state instrument uncertainties.c. Feedwater Isolation - Safety InjectionFeedwater Isolation is also initiated by all Functions that initiate SI. Therefore, there are two trains of this function, one initiated by SI train A and one initiated by SI train B.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 23 Revision 4Feedwater Isolation Functions must be OPERABLE in MODES 1, 2and 3 except when the main feedwater flowpath to each SG is isolated by a closed and deactivated automatic valve or a closed manual valve when the MFW System is in operation and the turbine generator may be in operation. In MODES 4, 5, and 6, the MFW System is not inservice and this Function is not required to be OPERABLE.6. Auxiliary FeedwaterThe AFW System is designed to provide a secondary side heat sink forthe reactor in the event that the MFW System is not available. The system has two motor driven pumps and a turbine driven pump. This ensures AFW is available during normal unit operation, during a loss of AC power and a loss of MFW. The normal source of water for the AFW System is the condensate storage tank (CST). The AFW System is aligned so that upon a motor driven pump start, flow is initiated to the respective SGs immediately.a. Auxiliary Feedwater - Automatic Actuation Logic and ActuationRelaysAutomatic actuation logic and actuation relays consist of thesame features and operate in the same manner as described for ESFAS Function 1.b.b. Auxiliary Feedwater - Steam Generator Water Level - Low LowSG Water Level - Low Low provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. Signals from two-out-of-three channels from any one SG will start the motor driven AFW pumps. Signals from two-out-of-three channels from any two SGs will start the steam driven AFW pump. The LCO requires three OPERABLE channels per steam
 
generator.With the transmitters (d/p cells) located inside containment andthus possibly experiencing adverse environmental conditions (feed line break), the Allowable Value reflects the inclusion of both steady state and adverse environmental instrument uncertainties.
ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 24 Revision 4c. Auxiliary Feedwater - Safety InjectionAn SI signal starts the motor driven AFW pumps. The AFWinitiation functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.d. Auxiliary Feedwater - Station Blackout (SBO) (Undervoltage Bus 5A or 6A)The SBO Function that generates Auxiliary Feedwater systemstart signals uses the same undervoltage relays (i.e., channels) required to be OPERABLE by LCO 3.3.5, "Loss of Power (LOP)
Diesel Generator (DG) Start Instrumentation," Function c. In addition to the DG starting function described in the Bases of LCO 3.3.5, the SBO Function generates an automatic start signal for the turbine driven AFW pump if the undervoltage condition occurs in conjunction with a unit trip if no ESFAS safety injection signal is present. The SBO Function also generates an automatic start signal for the motor driven AFW pumps if the undervoltage condition occurs in conjunction with a unit trip.As described in the Bases of LCO 3.3.5, the SBO relays (i.e.,channels) consist of two sets of three relays with one set of three relays associated with 480 V safeguards bus 5A (SBO train 5A) and the other set of three relays associated with safeguards bus 6A (SBO train 6A). If there is a loss of voltage on 480 V bus 5A or 6A, two out of the three SBO undervoltage relays associated with either bus 5A or 6A will actuate the undervoltage portion of the SBO function.LCO 3.3.2, Function 6.d, Auxiliary Feedwater SBO (UndervoltageBus 5A or 6A), establishes requirements (except for the applicability) for the SBO start of the auxiliary feedwater pumps by referencing the SBO requirements in LCO 3.3.5, Function c. This is acceptable because the requirements for the SBO function for the number of OPERABLE channels, the Required Actions when one or more channels are inoperable, Surveillance Testing of SBO channels, and the allowable values for LCO 3.3.2, Function 6.d, and LCO 3.3.5, Function c.1, are identical. However, LCO 3.3.5, Function c.1, LOP DG Start Instrumentation, is applicable in MODES 1, 2, 3 and 4 and LCO 3.3.2, Function 6.d, Auxiliary Feedwater SBO, is only ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 25 Revision 4applicable in MODES 1, 2, and 3. Therefore, if the requirementsof LCO 3.3.5, Function c.1, LOP DG Start Instrumentation, are met, then the LCO 3.3.2, Function 6.d, Auxiliary Feedwater SBO (Undervoltage Bus 5A or 6A), are also met.LCO 3.3.2, Function 6.a, Auxiliary Feedwater - AutomaticActuation Logic and Actuation Relays, and LCO 3.7.5, Auxiliary Feedwater (AFW) System, establish Required Actions and Surveillance Testing for the logic that changes the function of the SBO relays depending on the presence of a safety injection signal and unit trip signal.This function is needed because loss of offsite power to the6.9 kV buses (and consequently the 480 V buses) will be accompanied by a loss of reactor coolant pumping power and the subsequent need for some method of decay heat removal.Functions 6.a through 6.d must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. SG Water Level - Low Low in any operating SG will cause the motor driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level - Low Low in any two operating SGs will cause the turbine driven pumps to start. These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.e. Auxiliary Feedwater - Trip of Main Boiler Feedwater PumpA Trip of either MBFP is an indication of a potential loss of MFWand the subsequent potential need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure. Each turbine driven MBFP is equipped with a pressure switch on the control oil line for the speed control system. A low pressure signal from this pressure switch indicates a trip of that pump. The single channel associated with each operating MBFP will start both motor driven AFW pumps. However, there is no single failure tolerance for this Function unless both MBFPs are operating. This is ESFAS InstrumentationB 3.3.2 BASESAPPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY  (continued)
INDIAN POINT 2B 3.3.2 - 26 Revision 4acceptable because this is a backup method for starting AFW andother Functions, in particular SG Water Level-Low Low, provide the primary protection against a loss of heat sink. The LCO requires one Operable channel for each operating MBFP. A trip of either MBFP starts the motor driven AFW pumps to ensure that atleast two SGs are available with water to act as the heat sink forthe reactor.Function 6.e must be OPERABLE in MODES 1 and 2. Thisensures that at least two SGs are provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of a loss of main feedwater. In MODES 3, 4, and 5, the RCPs and MFW pumps may be shut down, and thus neither pump trip is indicative of a condition requiring automatic AFW initiation.7. ESFAS Interlock - Pressurizer PressureThe Pressurizer Pressure interlock permits a normal unit cooldown and depressurization without actuation of an SI signal. With two-out-of-three pressurizer pressure channels (discussed previously) less than the setpoint, the operator can manually block the Pressurizer Pressure - Low SI signal. With two-out-of-three pressurizer pressure channels above the setpoint, the Pressurizer Pressure - Low SI signal is automatically enabled. The operator can also enable these trips manually.This Function must be OPERABLE in MODES 1, 2, and 3 to allow anorderly cooldown and depressurization of the unit without the actuation of SI. This interlock backs up manual action needed to ensure that the SI function on low pressurizer pressure is enabled when required. This Function does not have to be OPERABLE in MODE 4, 5, or 6 because system pressure must already be below the setpoint for the requirements of the heatup and cooldown curves to be met.The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).ACTIONSA Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1.
ESFAS InstrumentationB 3.3.2 BASESACTIONS  (continued)
INDIAN POINT 2B 3.3.2 - 27 Revision 4In the event a channel's trip setpoint is found nonconservative with respectto the Allowable Value, or the transmitter, instrument Loop, signal processing electronics, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected. When theRequired Channels in Table 3.3.2-1 are specified (e.g., on a per steam line,per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.When the number of inoperable channels in a trip function exceed thosespecified in one or other related Conditions associated with a trip function, then the unit is outside the safety analysis. Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.
A.1Condition A applies to all ESFAS protection functions.
Condition A addresses the situation where one or more channels or trains forone or more Functions are inoperable at the same time. The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection functions affected. The Completion Times are those from the referenced Conditions and Required Actions.B.1, B.2.1 and B.2.2Condition B applies to manual initiation of:
SI,Containment Spray,Phase A Isolation, andPhase B Isolation.This action addresses the train orientation of the ESFAS Automatic ActuationLogic for the functions listed above. If a manual initiation channel or train is inoperable, 48 hours is allowed to return it to an OPERABLE status. The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each Function, and the low probability of an event occurring during this interval. If the train cannot be restored to OPERABLE status, the ESFAS InstrumentationB 3.3.2 BASESACTIONS  (continued)
INDIAN POINT 2B 3.3.2 - 28 Revision 4unit must be placed in a MODE in which overall plant risk is reduced. This isdone by placing the unit in at least MODE 3 within an additional 6 hours (54 hours total time) and in MODE 4 within an additional 6 hours (60 hours total time).Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 12). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 12, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action B.2.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowable Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.C.1, C.2.1 and C.2.2Condition C applies to the automatic actuation logic and actuation relays forthe following functions:
SI,Containment Spray,Phase A Isolation, andPhase B Isolation.
ESFAS InstrumentationB 3.3.2 BASESACTIONS  (continued)
INDIAN POINT 2B 3.3.2 - 29 Revision 4This action addresses the train orientation of the relay logic and the masterand slave relays. If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference 8. The specified Completion Time is reasonable considering that there is anothertrain OPERABLE, and the low probability of an event occurring during thisinterval. If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which overall plant risk is reduced. This is done by placing the unit in at least MODE 3 within an additional 6 hours (30 hours total time) and in MODE 4 within an additional 6 hours (36 hours total time).Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 12). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 12, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action C.2.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met. However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The Completion Times are reasonable, based on operating experience, toreach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.The Required Actions are modified by a Note that allows one train to bebypassed for up to 8 hours for surveillance testing, provided the other train is OPERABLE. This allowance is based on the reliability analysis assumption of WCAP-14333 (Ref. 8) that 8 hours is required to perform train surveillance.
This Note provides an allowance that when a train is placed in an inoperable status solely for performance of required Surveillances, entry into associated ESFAS InstrumentationB 3.3.2 BASESACTIONS  (continued)
INDIAN POINT 2B 3.3.2 - 30 Revision 4Required Actions may be delayed for up to 8 hours provided the redundanttrain maintains trip capability. Upon completion of theSurveillance, or expiration of the 8 hour allowance, the channel must bereturned to OPERABLE status or the applicable Required Actions taken. This allowance does not apply to the performance of preventative maintenance or the performance of maintenance for inoperable instrumentation discovered by other means than the performance of a required surveillance test.D.1, D.2.1, and D.2.2 Condition D applies to:Containment Pressure - High,Pressurizer Pressure - Low,High Differential Pressure Between Steam Lines,High Steam Flow in Two Steam Lines Coincident With Tavg - Low orCoincident With Steam Line Pressure - Low,SG Water level - Low Low, andSG Water level - High High.If one channel is inoperable, 72 hours are allowed to restore the channel toOPERABLE status or to place it in the tripped condition. Generally this Condition applies to functions that operate on two-out-of-three logic.
Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.The 72 hours allowed for restoring the inoperable channel to OPERABLEstatus or to place it in the tripped condition is justified in Reference 8.Required Actions associated with High Steam Flow in Two Steam LinesCoincident With Tave-Low or Coincident With Steam Line Pressure-Low areentered by treating Steam Flow, Tave, and Steam Line Pressure as threeseparate Functions. The protective action is initiated on one-out-of-two high flow in any two-out-of-four steam lines if there is one-out-of-one low Tave tripin any two-out-of-four RCS loops, or if there is a low pressure trip in any two-out-of-four steam lines. This logic is acceptable because a single steam ESFAS InstrumentationB 3.3.2 BASESACTIONS  (continued)
INDIAN POINT 2B 3.3.2 - 31 Revision 4line fault will cause the remaining intact steam lines to pick up the full turbineload with the protective action initiated by the conditions in the non faulted steam lines. Therefore, a maximum of one channel of each of the three Functions may be placed in trip without creating a condition where a single failure will prevent the protective action.Failure to restore the inoperable channel to OPERABLE status or place it inthe tripped condition within 72 hours requires the unit be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours.The allowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows placing one channelin bypass for up to 12 hours while performing routine surveillance testing.
The 12 hour time limit is justified in Reference 8. This allowance may be used to bypass an inoperable channel that is in trip to permit surveillance testing and setpoint adjustment of other channels. This allowance may also be used to bypass an otherwise OPERABLE channel during surveillance testing and setpoint adjustment. In either case, this Note provides an allowance that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Required Actions may be delayed for up to 12 hours provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 12 hour allowance, the channel must be returned to OPERABLE status or the applicable Required Actions taken. This allowance does not apply to the performance of preventative maintenance or the performance of maintenance for inoperable instrumentation discovered by other means than the performance of a required surveillance test.E.1, E.2.1, and E.2.2Condition E applies to:Steam Line Isolation Containment Pressure - High HighContainment Spray Containment Pressure - High High, andContainment Phase B Isolation Containment Pressure - High High.The IP2 design for the Containment Pressure (High High) ESFAS Functionconsists of 2 sets of 3 channels. This design requires that 2 channels from ESFAS InstrumentationB 3.3.2 BASESACTIONS  (continued)
INDIAN POINT 2B 3.3.2 - 32 Revision 4each set of 3 are energized to actuate the Containment Spray, ContainmentIsolation-Phase B and Steam Line Isolation Functions. This configuration provides sufficient redundancy to prevent a single failure from causing or preventing containment spray initiation or steamline isolation even when testing with one inoperable channel per set already in trip.Note that Condition E applies when one channel in one or both sets isinoperable. If more than one channel in either set of 3 is inoperable, entry into LCO 3.0.3 is required. This is required because two inoperable channels from the same set that fail low could result in a loss of containment spray initiation or steamline isolation when a Containment Pressure (High High)
ESFAS initiation is required. Additionally, this ensures that no more than one channel per set can be placed in trip which decreases the probability of an inadvertent actuation of containment spray or steamline isolation if additional
 
channels fail high.An inoperable channel is placed in trip within 72 hours to limit the amount oftime that a single failure of a different channel on the same set could result in the failure of containment spray or steamline isolation to actuate. With no more than one channel from each set in trip, a single failure will not cause or prevent containment spray initiation or steamline isolation. Failure to place an inoperable channel in trip within 72 hours, requires the unit be placed in MODE 3 within the following 6 hours and MODE 4 within the next 6 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.The Required Actions are modified by a Note that allows placing one channelin bypass for up to 12 hours while performing routine surveillance testing.
The 12 hour time limit is justified in Reference 8. This allowance may be used to bypass an inoperable channel that is in trip to permit surveillance testing and setpoint adjustment of other channels. This allowance may also be used to bypass an otherwise OPERABLE channel during surveillance testing and setpoint adjustment. In either case, this Note provides an allowance that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Required Actions may be delayed for up to 12 hours provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 12 hour allowance, the channel must be returned to OPERABLE status or the applicable Required Actions taken. This allowance does not apply to the performance of preventative maintenance or the performance of maintenance for inoperable instrumentation discovered by other means than the performance of a required surveillance test.
ESFAS InstrumentationB 3.3.2 BASESACTIONS  (continued)
INDIAN POINT 2B 3.3.2 - 33 Revision 4F.1, F.2.1, and F.2.2Condition F applies to manual initiation of Steam Line Isolation. For themanual MSIV isolation Function, each MSIV will close if one of the two channels required per MSIV is tripped. If one channel is inoperable, the ability to tolerate a single failure is lost but manual isolation capability is maintained. Therefore, an inoperable channel cannot be placed in trip without causing an actuation and the inoperable channel must be restored to Operable to restore single failure protection. Additionally, since a single switch actuates both channels for each MSIV, the failure of a manual switch may result in the failure of both channels and a loss of Function. The specified Completion Time, 48 hours to restore an inoperable channel, is reasonable considering that there are two automatic actuation trains and another manual initiation train OPERABLE for each MSIV, and the low probability of an event occurring during this interval. Each MSIV is considered a separate Function. If either of these Functions cannot bereturned to OPERABLE status, the unit must be placed in MODE 3 within thenext 6 hours and MODE 4 within the following 6 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.G.1, G.2.1 and G.2.2Condition G applies to the automatic actuation logic and actuation relays forthe Steam Line Isolation Feedwater Isolation and AFW actuation Functions.The action addresses the train orientation of the relay logic and the masterand slave relays for these functions. If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference 8. If the train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours and MODE 4 within the following 6 hours unless the plant can be placed outside of the Applicable MODE or Conditions by other means (e.g.,
shutting all MSIVs or isolating the main feedwater flowpath to each SG). The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.
ESFAS InstrumentationB 3.3.2 BASESACTIONS  (continued)
INDIAN POINT 2B 3.3.2 - 34 Revision 4Placing the unit in MODE 4 removes all requirements for OPERABILITY ofthe protection channels and actuation functions. In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.The Required Actions are modified by a Note that allows one train to bebypassed for up to 8 hours for surveillance testing provided the other train is OPERABLE. This allowance is based on the reliability analysis (Ref. 8) assumption that 8 hours is required to perform channel surveillance. This Note provides an allowance that when a train is placed in an inoperable status solely for performance of required Surveillances, entry into associated Required Actions may be delayed for up to 8 hours provided the redundant train maintains trip capability. Upon completion of the Surveillance, or expiration of the 8 hour allowance, the channel must be returned to OPERABLE status or the applicable Required Actions taken. This allowance does not apply to the performance of preventative maintenance or the performance of maintenance for inoperable instrumentation discovered by other means than the performance of a required surveillance test.H.1, H.2 and I.1Condition H applies to the AFW pump start on trip of either Main BoilerFeedwater pump.The single channel associated with each operating MBFP will start bothmotor driven AFW pumps if either MBFP trips. This ensures that AFW is started on a loss of main feedwater. However, there is no single failure tolerance for this Function unless both MBFPs are operating. Therefore, when a channel is inoperable, Required Action H.1 requires immediate verification that a channel associated with an operating MBFP is OPERABLE to ensure that AFW will start automatically when there is a loss of main feedwater. Otherwise, Required Action I.1 requires that the plant be in MODE 3 within the following 6 hours. The requirement for verification of the status of the channel associated with an operating MBFP may be completed by an administrative review. Actual testing is not required.If both MBFPs are operating and there is an OPERABLE channel associatedwith only one operating pump, Required Action H.2 allows 48 hours to restore redundancy by requiring an OPERABLE channel for each operating MBFP.
Otherwise, Required Action I.1 requires that the plant be in MODE 3 within the following 6 hours. Operating without redundant channels when only one MBFP is operating and operating for 48 hours when only one of the two MBFPs has an OPERABLE AFW starting channel is acceptable because ESFAS InstrumentationB 3.3.2 BASESACTIONS  (continued)
INDIAN POINT 2B 3.3.2 - 35 Revision 4this Function is a backup method for starting AFW and other Functions, inparticular SG Water Level - Low Low, provide the primary protection against a loss of heat sink.The Required Action I.1 Completion Time of 6 hours is reasonable, based onoperating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, the unit does not have any analyzed transients or conditions that require the explicit use of the protection function noted above.J.1, J.2.1 and J.2.2Condition J applies to the Pressurizer Pressure interlock.
With one or more channels inoperable, the operator must verify that theinterlock is in the required state for the existing unit condition. This action manually accomplishes the function of the interlock. Determination must be made within 1 hour. The 1 hour Completion Time is equal to the time allowed by LCO 3.0.3 to initiate shutdown actions in the event of a complete loss of ESFAS function. If the interlock is not in the required state (or placed in the required state) for the existing unit condition, the unit must be placed in MODE 3 within the next 6 hours and MODE 4 within the following 6 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of this interlock.SURVEILLANCE REQUIREMENTSThe SRs for each ESFAS Function are identified by the SRs column of Table 3.3.2-1.A Note has been added to the SR Table to clarify that Table 3.3.2-1determines which SRs apply to which ESFAS Functions.Note that each channel of process protection supplies both trains of theESFAS. When testing an individual channel, the SR is not met until both train A and train B logic are tested. The CHANNEL CALIBRATION and COTs are performed in a manner that is consistent with the assumptions used in the setpoint methodology described in Reference 6.
ESFAS InstrumentationB 3.3.2 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.3.2 - 36 Revision 4SR  3.3.2.1Performance of the CHANNEL CHECK once every 12 hours ensures that agross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.Agreement criteria are determined by the unit staff, based on a combinationof the channel instrument uncertainties, including indication and reliability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.The Frequency is based on operating experience that demonstrates channelfailure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.SR  3.3.2.2SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST. The relaylogic is tested every 92 days on a STAGGERED TEST BASIS. The train being tested is placed in the bypass condition, thus preventing inadvertent actuation. All possible logic combinations, with and without applicable permissives, are tested for each protection function. In addition, the master relay is tested. This verifies that the logic modules are OPERABLE and that there is a voltage signal path to the master relay coils. The Frequency of every 92 days on a STAGGERED TEST BASIS is justified in Reference 10.SR  3.3.2.3SR 3.3.2.3 is the performance of a MASTER RELAY TEST. The MASTERRELAY TEST is the energizing of the master relay and verifying contact operation. During master relay testing, operation of the slave relays is blocked to prevent equipment operation. This test is performed every 31 days on a STAGGERED TEST BASIS. The time allowed for the testing (8 hours) and the surveillance interval are justified in Reference 7.
ESFAS InstrumentationB 3.3.2 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.3.2 - 37 Revision 4SR  3.3.2.4SR 3.3.2.4 is the performance of a COT. A COT is performed on eachrequired channel to ensure the entire channel  (except for the transmitter sensing device) will perform the intended Function. Setpoints must be found within calibration acceptance criteria consistent with the Allowable Values specified in Table 3.3.2-1. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.The "as found" and "as left" values must also be recorded and reviewed forconsistency with the assumptions of Reference 6 which incorporates the assumptions of Reference 7. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology. The setpoint shall be left set consistent with the assumptions of the current unit specific setpoint methodology.The Frequency of 184 days is justified in Reference 10.
SR  3.3.2.5SR 3.3.2.5 is the performance of a SLAVE RELAY TEST. The SLAVERELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is placed in a condition where the circuit operation can be verified without operation of the equipment. Actuation equipment that may not be operated in the design mitigation MODE is prevented from operation. Alternately, contact operation is verified by a continuity check of the circuit containing the slave relay. This test is performed every 24 months. The Frequency is adequate, based on operating experience, considering instrument reliability and operating history
 
data.SR  3.3.2.6SR 3.3.2.6 is the performance of a TADOT. This test is a check of theManual Actuation Functions and AFW pump start on a trip of either main boiler feed pump. It is performed every 24 months. Each Manual Actuation ESFAS InstrumentationB 3.3.2 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.3.2 - 38 Revision 4Function is tested up to, and including, the master relay coils. A successfultest of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. In some instances, the test includes actuation of the end device (i.e., pump starts, valve cycles, etc.).
The Frequency is adequate, based on industry operating experience and is consistent with the typical refueling cycle. The SR is modified by a Note that excludes verification of setpoints during the TADOT for manual initiation Functions. The manual initiation Functions have no associated setpoints.SR  3.3.2.7SR 3.3.2.7 is the performance of a CHANNEL CALIBRATION.
A CHANNEL CALIBRATION is performed every 24 months, or approximatelyat every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.CHANNEL CALIBRATIONS must be performed consistent with theassumptions of the unit specific setpoint methodology (Ref. 6). The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology.The Frequency of 24 months is based on the assumption of a 24 monthcalibration interval in the determination of the magnitude of equipment drift in the setpoint methodology.REFERENCES1. UFSAR, Chapter 6.2. UFSAR, Chapter 7.
: 3. UFSAR, Chapter 14.
: 4. IEEE-279-1968.
: 5. 10 CFR 50.49.
ESFAS InstrumentationB 3.3.2 BASESREFERENCES  (continued)
INDIAN POINT 2B 3.3.2 - 39 Revision 46. Indian Point 2 Specification FIX-95-A-001, Guidelines for Preparation OfInstrument Loop Accuracy and Setpoint Determination Calculation.7. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.8. WCAP-14333-P-A, Rev.1, Probabilistic Risk Analysis of the RPS andESFAS Test Times and Completion Times.9. Regulatory Guide 1.105, Revision 3, "Setpoints for Safety-RelatedInstrumentation."10. WCAP-15376-P-A, Rev.0, Risk Informed assessment of RTS andESFAS Surveillance Test Intervals and Reactor Trip Breaker Test andCompletion Times, October 2000.11. WCAP-16041-P, Westinghouse Setpoint Methodology for Protectionand Control Systems Indian Point Unit 2.
12.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changes to Technical Specification Required Action Endstates for Westinghouse NSSS PWRs," June 2010.
PAM Instrumentation B 3.3.3 INDIAN POINT 2 B 3.3.3 - 1 Revision 4 B 3.3  INSTRUMENTATION B 3.3.3 Post Accident Monitoring (PAM) Instrumentation BASESBACKGROUND The primary purpose of the PAM instrumentation is to display unit variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Accidents (DBAs). The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected unit parameters to monitor and to assess unit status and behavior following an accident. The availability of accident monitoring instrumentation is important so that responses to corrective actions can be observed and the need for, and magnitude of, further actions can be determined. These essential instruments are identified by unit specific documents (References 1 and 4) addressing the recommendations of Regulatory Guide 1.97 (Ref. 2) as required by Supplement 1 to NUREG-0737 (Ref. 3). The instrument channels required to be OPERABLE by this LCO include two classes of parameters identified during unit specific implementation of Regulatory Guide 1.97 as Type A and Category I variables. Type A variables are included in this LCO because they provide the primary information required for the control room operator to take specific manually controlled actions for which no automatic control is provided, and that are required for safety systems to accomplish their safety functions for DBAs. Categories I, II and III define the design and qualification criteria for the instrumentation used to monitor the variables. This LCO requires that the plant maintain the ability to monitor the key variables deemed risk significant because they are needed to: Determine whether other systems important to safety are performing their intended functions, Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release, and PAM Instrumentation B 3.3.3 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.3.3 - 2 Revision 4 Provide information regarding the release of radioactive materials to allow for early indication of the need to initiate action necessary to protect the public, and to estimate the magnitude of any impending threat. These key variables are identified by the Indian Point 2 specific Regulatory Guide 1.97 analyses (Ref. 4). These analyses identify the Indian Point 2 specific Type A and Category I variables and provide justification for deviating from the NRC proposed list of Category I variables. The specific instrument Functions listed in Table 3.3.3-1 are discussed in the LCO section. APPLICABLE
 
SAFETY ANALYSESThe PAM instrumentation ensures the operability of Regulatory Guide 1.97 Type A and Category I variables so that the control room operating staff can:Perform the diagnosis specified in the emergency operating procedures (these variables are restricted to preplanned actions for the primary success path of DBAs), e.g., loss of coolant accident (LOCA),Take the specified, pre-planned, manually controlled actions, for which no automatic control is provided, and that are required for safety systems to accomplish their safety function, Determine whether systems important to safety are performing their intended functions, Determine the likelihood of a gross breach of the barriers to radioactivity release, Determine if a gross breach of a barrier has occurred, and Initiate action necessary to protect the public and to estimate the magnitude of any impending threat.
PAM Instrumentation B 3.3.3 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.3.3 - 3 Revision 4 PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Category I, non-Type A, instrumentation must be retained in TS because it is intended to assist operators in minimizing the consequences of accidents. Therefore, Category I, non-Type A, variables are important for reducing public risk.
LCOThe PAM instrumentation LCO provides OPERABILITY requirements for Regulatory Guide 1.97 Type A monitors, which provide information required by the control room operators to perform certain manual actions specified in the unit Emergency Operating Procedures. These manual actions ensure that a system can accomplish its safety function, and are credited in the safety analyses. Additionally, this LCO addresses Regulatory Guide 1.97 instruments that have been designated Category I, non-Type A. The OPERABILITY of the PAM instrumentation ensures there is sufficient information available on selected unit parameters to monitor and assess unit status following an accident. This capability is consistent with the recommendations of Reference 2. LCO 3.3.3 requires at least two OPERABLE channels for most Functions. However, some functions, such as the RCS hot leg temperature and RCS cold leg temperature, require only one channel because they credit a required diverse function as a redundant channel. Two OPERABLE channels ensure no single failure prevents operators from getting the information necessary for them to determine the safety status of the unit, and to bring the unit to and maintain it in a safe condition following an accident. Furthermore, OPERABILITY of two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information. More than two channels may be required for some functions if the IP2 Regulatory Guide 1.97 analyses (Ref. 4) determined that failure of one accident monitoring channel results in information ambiguity (that is, the redundant displays disagree) that could lead operators to defeat or fail to accomplish a required safety function. Table 3.3.3-1 provides a list of variables typical of those identified by the IP2 Regulatory Guide 1.97 (Ref. 4) analyses. Table 3.3.3-1 includes all Type A and Category I variables identified by the unit specific Regulatory Guide 1.97 analyses, as amended by the NRC's SER (Ref. 1).
PAM Instrumentation B 3.3.3 BASESLCO  (continued) INDIAN POINT 2 B 3.3.3 - 4 Revision 4 Type A and Category I variables are required to meet Regulatory Guide 1.97 Category I (Ref. 2) design and qualification requirements for seismic and environmental qualification, single failure criterion, utilization of emergency standby power, immediately accessible display, continuous readout, and recording of display. Specific exceptions to these requirements are described and justified in documents listed in Reference 4. Listed below are discussions of the specified instrument Functions listed in Table 3.3.3-1.
1, 2. Reactor Coolant System (RCS) Hot and Cold Leg TemperaturesRCS Hot and Cold Leg Temperatures are Type A, Category I variables provided for verification of core cooling and long term surveillance. RCS hot and cold leg temperatures are used to determine RCS subcooling margin. RCS subcooling margin will allow termination of safety injection (SI),
if still in progress, or reinitiation of SI if it has been stopped. RCS subcooling margin is also used for unit stabilization and cooldown control. This LCO is satisfied by the OPERABILITY of one RCS hot leg channel and one RCS cold leg channel in each of the four RCS loops: Hot Leg Loop No. 1 (TE-411A/1)  Cold Leg Loop No. 1 (TE-413) Hot Leg Loop No. 2 (TE-422A/1)  Cold Leg Loop No. 2 (TE-423)
Hot Leg Loop No. 3 (TE-431A/1)  Cold Leg Loop No. 3 (TE-433)
Hot Leg Loop No. 4 (TE-440A/1)  Cold Leg Loop No. 4 (TE-443) Requirements for RCS hot leg and RCS cold leg temperature are designated as one channel per loop because each channel is considered a separate function. Only one channel per loop of hot leg temperature is required because redundant indication is provided by a diverse Function (either of the Core Exit Temperature (CET) trains) in the quadrant associated with the loop (Functions 15, 16, 17 and 18). Therefore, separate entry into Condition A (one required hot leg temperature channel inoperable) is allowed for each leg.
If a hot leg temperature channel is inoperable at the same time both required CET trains in the associated quadrant are inoperable, entry into Condition C (two or more required channels inoperable) is required because the combination of the hot leg temperature channel and a CET train in the associated quadrant are used to satisfy requirements for redundancy as specified in Note (a) to Table 3.3.3-1.
PAM Instrumentation B 3.3.3 BASESLCO  (continued) INDIAN POINT 2 B 3.3.3 - 5 Revision 4 Only one channel per loop of RCS cold leg temperature is required because redundant indication for the RCS cold leg temperature is provided by the Steam Generator Pressure (Function 20). Therefore, separate entry into Condition A (one required cold leg temperature channel inoperable) is allowed for each leg. If a cold leg temperature channel is inoperable at the same time both required steam generator pressure channels in the associated loop are inoperable, entry into Condition C (two or more required channels inoperable) is required because the combination of the cold leg temperature channel and a steam generator pressure channel in the associated loop are used to satisfy requirements for redundancy as specified in Note (b) to Table 3.3.3-1. Each hot leg and cold leg channel provides indication over a range of 0F to 700F. 3. Reactor Coolant System Pressure (Wide Range)RCS wide range pressure is a Type A, Category I variable provided for verification of core cooling and RCS integrity long term surveillance. RCS pressure is used to verify delivery of SI flow to RCS from at least one train when the RCS pressure is below the pump shutoff head. RCS pressure is also used to verify closure of manually closed spray line valves and pressurizer power operated relief valves (PORVs). In addition to these verifications, RCS pressure is used for determining RCS subcooling margin. RCS subcooling margin will allow termination of SI, if still in progress, or reinitiation of SI if it has been stopped. RCS pressure can
 
also be used: to determine when to reset SI and shut off low head SI, to manually restart low head SI, as reactor coolant pump (RCP) trip criteria, and to make a determination on the nature of the accident in progress and where to go next in the procedure. RCS subcooling margin is also used for unit stabilization and cooldown control.
PAM Instrumentation B 3.3.3 BASESLCO  (continued) INDIAN POINT 2 B 3.3.3 - 6 Revision 4 RCS pressure is also related to three decisions about depressurization. They are:to determine whether to proceed with primary system depressurization, to verify termination of depressurization, and to determine whether to close accumulator isolation valves during a controlled cooldown/depressurization. A final use of RCS pressure (and pressurizer level) is to determine whether to operate the pressurizer heaters. RCS pressure is a Type A variable because the operator uses this indication to monitor the cooldown of the RCS following a steam generator tube rupture (SGTR) or small break LOCA. Operator actions to maintain a controlled cooldown, such as adjusting steam generator (SG) pressure or level, would use this indication. Furthermore, RCS pressure is one factor that may be used in decisions to terminate RCP operation. The LCO requirement for RCS Pressure (wide range) indication is satisfied by pressure transmitters designated PT-402 and PT-403. 4. Reactor Vessel Level Indication System (RVLIS) RVLIS is a Type B, Category I function that is provided for verification and long term surveillance of core cooling. It is also used for accident diagnosis and to determine reactor coolant inventory adequacy. RVLIS provides a direct measurement of the collapsed liquid level from the bottom to the top of the reactor vessel and under different coolant flow conditions with and without reactor coolant pumps operating. The RVLIS automatically compensates for variations in fluid temperature and density in both the RCS and instrument capillary tubes. The collapsed level represents the amount of liquid mass that is in the reactor vessel above the core.
Measurement of the collapsed water level is selected because it is a direct indication of the water inventory. This LCO is satisfied by the OPERABILITY of two channels of RVLIS (RVLIS-A and RVLIS-B). RVLIS-A includes both a wide range and a narrow range transmitter (LT-1311 and LT-1312). RVLIS-B includes both a wide range and a narrow range transmitter (LT-1321 and LT-1322).
PAM Instrumentation B 3.3.3 BASESLCO  (continued) INDIAN POINT 2 B 3.3.3 - 7 Revision 4 5. Sump Water Level Sump Water Level is a Type A, category I Function that is provided for verification and long term surveillance of RCS integrity. Sump Water Level is used to determine that water has been delivered to the containment following a LOCA, and subsequently show that sufficient water has been collected by the sump to permit recirculation to the reactor and/or to the spray headers. Sump water level also provides a diverse indication for RWST level regarding when to begin the recirculation procedure. This LCO is satisfied by the OPERABILITY of two channels of sump water level. LT- 3300 and  LT-3301, differential pressure transmitters, located in the Containment and Recirculation Sumps, respectively, are used to meet LCO requirements for the two channels. These provide a calibrated sump level span that is continuously indicated. LT-939, a magnetic switch/float type detector, and LT-941, a thermal type detector may also be used to meet LCO requirements for one of the associated channels (i.e., the instrument buses for LT-3300 and LT-939 are powered by bus 2A/3A and the instrument buses for LT-3301 and LT-941 are powered by bus 5A). The LT-939 and LT-
 
941 channels provides a series of five lights each energized from the associated instrument as a preset level is exceeded 6. NOT USED PAM Instrumentation B 3.3.3 BASESLCO  (continued) INDIAN POINT 2 B 3.3.3 - 8 Revision 4 7. Containment PressureContainment Pressure (narrow range) is a Type A, Category I Function that is needed for determination of whether a steam line break is inside or outside containment. This Function is also used for the verification of the need for and effectiveness of containment spray and fan cooler units. This LCO is satisfied by the OPERABILITY of any 2 of the 6 channels supported by PT-948A, PT-948B, PT-948C, PT-949A, PT-949B or PT-949C.
Each channel provides indication in the control room over a range of -5 psig to 75 psig. 8. Containment Pressure (High Range)Containment Pressure (High Range) is a Type C, Category I Function that is provided for verification of RCS and containment OPERABILITY. This Function would be used for the assessment of the potential for a containment boundary breach. This LCO is satisfied by the OPERABILITY of PT-3300 and PT-3301. Each channel provides indication in the control room over a range of
-10 psig to 150 psig. 9. Containment Area Radiation (High Range)Containment Area Radiation is a Type A, Category I Function that is provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans. Containment radiation level is used to determine if a high energy line break (HELB) has occurred, and whether the event is inside or outside of containment. This LCO is satisfied by the OPERABILITY of High Range Containment Radiation Monitors R-25 and R-26. Each channel has a range of 1 R/hour to
 
10 7R/hour. Acceptable criteria for calibration are provided in Table II.F-13 of NUREG-0737. 10. Not Used PAM Instrumentation B 3.3.3 BASESLCO  (continued) INDIAN POINT 2 B 3.3.3 - 9 Revision 4 11. Pressurizer LevelPressurizer Level is a Type A, Category I Function that is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped. Knowledge of pressurizer water level is also used to verify the unit conditions necessary to establish natural circulation in the RCS and to verify that the unit is maintained in a safe shutdown condition. This LCO is satisfied by the OPERABILITY of any two of the pressurizer level instruments designated LT-459, LT-460 and LT-461. Each channel has a range from the upper tap to the lower tap of the pressurizer which covers 85% of the pressurizer span
.12. Steam Generator Water Level (Narrow Range)SG Water Level (narrow range) is a Type A, Category I Function. This Function is provided to monitor operation of decay heat removal via the SGs. Each SG has three narrow range transmitters which span a range from the top of the tube bundles up to the moisture separator. The LCO requirement for SG Level (narrow range) is satisfied by any two of the level instruments for each SG in the following list:
SG 21 SG 22 SG 23 SG 24LT-417A  LT-427A  LT-437A  LT-447ALT-417B  LT-427B  LT-437B  LT-447B LT-417C  LT-427C  LT-437C  LT-447C13. Steam Generator Water Level (Wide Range)SG Water Level (wide range) is a Type B, Category I Function. Each SG has one wide range transmitter which spans a range from the tube sheet up to the moisture separator. SG Water Level (Wide Range) is used to: identify the ruptured SG following a tube rupture, verify that the intact SGs are an adequate heat sink for the reactor, PAM Instrumentation B 3.3.3 BASESLCO  (continued) INDIAN POINT 2 B 3.3.3 - 10 Revision 4 determine the nature of the accident in progress (e.g., verify an SGTR), and verify unit conditions for termination of SI during secondary unit HELBs outside containment. The requirement for Steam Generator Water Level (Wide Range) is OPERABILITY of 4 channels of SG Water Level (Wide Range) (not 1 channel per SG). This presentation of the requirement recognizes that two SGs are required to conduct a plant cooldown (i.e., one SG is unavailable as a result of the event and a second SG is assumed to be unavailable as a result of a single failure either before or after the event). Requiring one SG Water Level (Wide Range) instrument in each of the 4 SGs is conservative because, if the single failure is assumed to be a Steam Generator Water Level (Wide Range) instrument, the SG associated with the single failure will still be available because SG water inventory could be confirmed using Auxiliary Feedwater flow or either of the two Steam Generator Water Level (Narrow Range) instruments required for each SG. Therefore, entry into Condition A (one required channel inoperable) is required when one SG Water Level (Wide Range) channel is inoperable and entry into Condition C (two or more required channels inoperable) is required if the SG Water Level (Wide Range) channel is inoperable on more than one SG. The LCO requirement for SG Level (wide range) is satisfied by the level instruments for each SG in the following list:
SG 21 SG 22 SG 23 SG 24LT-417D LT-427D  LT-437D LT-447D14. Condensate Storage Tank (CST) LevelCST Level is a Type A, Category I Function that is provided to ensure water supply for auxiliary feedwater (AFW). The CST provides the ensured safety grade water supply for the AFW System. CST Level is considered a Type A variable because the control room meter and annunciator are considered the primary indication used by the operator. The DBAs that require AFW are the loss of electric power, steam line break (SLB), and small break LOCA. The CST is the initial source of water for the AFW System. However, as the CST is depleted, manual operator action is necessary to replenish the CST or align suction to the AFW pumps to City Water. The LCO requirement for CST level indication is satisfied by OPERABILITY of the level transmitters designated LT-1128 and LT-1128A
.
PAM Instrumentation B 3.3.3 BASESLCO  (continued) INDIAN POINT 2 B 3.3.3 - 11 Revision 4 15, 16, 17, 18. Core Exit TemperatureCore Exit Temperature is a Type A, Category III Function that is provided for verification and long term surveillance of core cooling. Core exit temperature also serves as a redundant channel for the RCS Hot Leg Temperature (Function 1). Core exit temperature is monitored by the core exit thermocouples (CETs). A total of 65 thermocouples are installed at preselected core locations to provide core exit temperature data up to 2300F. There are two trains of CETs, one to process data for 34 thermocouples and the other for the remaining 31. The two trains receive power from redundant instrument busses. Two display units (one for each train) are provided on the central control room accident assessment panels. Each presents a graphic core location map with an alphanumeric display of core exit temperatures. This LCO is satisfied by having 2 trains, each with a minimum of 2 qualified CETS (i.e., 4 CETs total) in each of the four quadrants. Requiring 2 qualified CETs in each train in each of the four quadrants provides assurance that sufficient CETs are available to support evaluation of core radial decay power distribution. Each pairing of 2 CETs from the same train in each quadrant is considered a separate function. 19. Auxiliary Feedwater FlowAFW Flow is a Type A, Category II Function that is provided to monitor operation of decay heat removal via the SGs. AFW flow is used three ways:  to verify delivery of AFW flow to the SGs if SG narrow range level indicators are off scale low; to determine whether to terminate SI if still in progress, in conjunction with SG water level (narrow range); and to regulate AFW flow so that the SG tubes remain covered. The LCO requirement for AFW flow indication is satisfied by OPERABILITY of the following 4 flow transmitters:
SG 21 SG 22 SG 23 SG 24FT-1200  FT-1201  FT-1202 FT-1203 PAM Instrumentation B 3.3.3 BASESLCO  (continued) INDIAN POINT 2 B 3.3.3 - 12 Revision 4 Note that the requirement is for OPERABILITY of 4 channels of AFW flow indication (not 1 channel per SG). This presentation of the requirement assumes that one SG is rendered inoperable as a result of the event and that two SGs are required to conduct a plant cooldown. Therefore, entry into Condition A (one required channel inoperable) is required when one AFW flow indication channel is inoperable and entry into Condition C (two or more required channels inoperable) is required if more than one AFW flow indication channel is inoperable
.20. Steam Generator PressureSteam Generator Pressure is a Type A, Category I Function that is used to determine if a high energy secondary line rupture occurred and which steam generator is faulted. SG pressure is also used as the redundant channel of RCS cold leg temperature (Function 2) for natural circulation determination. The LCO requirement for steam generator pressure indication is satisfied by any two of the following three channels for each of the four SGs:
SG 21 SG 22 SG 23 SG 24PT-419A  PT-429A  PT-439A  PT-449APT-419B  PT-429B  PT-439B  PT-449B PT-419C  PT-429C  PT-439C  PT-449CRequirements for steam generator pressure are designated as two channels per SG because each SG is considered a separate function. Therefore, separate entry into Condition A (one required channel inoperable) and Condition C (two required channels inoperable) is separate for each SG. 21. RCS Subcooling Margin MonitoringRCS Subcooling Margin Monitoring is a Type A, Category I Function provided for diagnosing early symptoms of inadequate core cooling, determining whether to terminate actuated SI or to reinitiate stopped SI. The system has two independent, redundant channels, each providing indication in the control room. The inputs of one subcooling margin monitoring channel (reactor coolant system pressure, hot-leg temperature, cold-leg temperature) are provided by a wide range reactor coolant system pressure transmitter in reactor coolant loop 21, and the reactor coolant system cold and hot leg resistance temperature detectors in loops 21 and 23.
The redundant channel receives pressure input from a transmitter in loop 24, and temperature input from detectors in loops 22 and 24.
PAM Instrumentation B 3.3.3 BASESLCO  (continued) INDIAN POINT 2 B 3.3.3 - 13 Revision 4 Two channels are required to be Operable for redundancy. The subcooling margin monitor readout on the plant computer can be used as a substitute for the control room panel readout of the RCS Subcooling Margin Monitor. 22. Refueling Water Storage Tank (RWST) LevelRWST Level is a Type A, Category II Function that is used to confirm RWST level prior to the manual switchover to the cold leg recirculation phase that is initiated when the RWST level has reached the low low alarm setpoint and sufficient coolant inventory to support pump operation in recirculation mode is verified in the containment. Two channels of RWST Level indication are required consistent with LCO 3.5.4, "Refueling Water Storage Tank," requirements for OPERABILITY of two channels of the RWST level low low alarm. This is required because the IP2 ESFAS design does not include automatic switchover from the safety injection mode to the recirculation mode of operation based on low low level in the RWST coincident with a safety injection signal.The LCO requirement for two channels of RWST level indication is satisfied by the OPERABILITY of LT-920 and LT-5751. APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1, 2, and 3. These variables are related to the diagnosis and pre-planned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1, 2, and 3. In MODES 4, 5, and 6, unit conditions are such that the likelihood of an event that would require PAM instrumentation is low; therefore, the PAM instrumentation is not required to be OPERABLE in these MODES. ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.3-1. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that
 
Function.
PAM Instrumentation B 3.3.3 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.3 - 14 Revision 4 A.1Condition A applies when one or more Functions have one required channel or train that is inoperable. Required Action A.1 requires restoring the inoperable channel to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel (or in the case of a Function that has only one required channel, other non-Regulatory Guide 1.97 instrument channels to monitor the Function), the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.
B.1Condition B applies when the Required Action and associated Completion Time for Condition A are not met. This Required Action specifies initiation of actions in Specification 5.6.6, which requires a written report to be submitted to the NRC immediately. This report discusses the results of the root cause evaluation of the inoperability and identifies proposed restorative actions.
This action is appropriate in lieu of a shutdown requirement since alternative actions are identified before loss of functional capability, and given the likelihood of unit conditions that would require information provided by this instrumentation. C.1Condition C applies when one or more Functions have two or more inoperable required channels or trains (i.e., two channels or trains inoperable in the same Function). For Functions 1 and 2, Condition C applies when the one required channel is inoperable and there are no OPERABLE channels of the diverse Function that provides redundant indication. Required Action C.1 requires restoring one or more channel in the Function(s) to OPERABLE status within 7 days so that Condition C is no longer applicable. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.
PAM Instrumentation B 3.3.3 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.3 - 15 Revision 4 Only one channel per loop of hot leg temperature is required because redundancy is provided by a diverse Function (i.e., either of the two trains of Core Exit Temperature (CET) Function in the core quadrant associated with the loop). If a hot leg temperature channel is inoperable and at least one of the two required trains of CET in the associated quadrant is OPERABLE, entry into Condition A is appropriate. If a hot leg temperature channel is inoperable at the same time both required CET trains in the associated quadrant are inoperable, entry into Condition C is appropriate because there is a loss of function for hot leg temperature for that loop. Additionally, entry into Condition C is also required when both required CET trains in a quadrant are inoperable regardless of the status of the hot leg temperature function in the associated loop because the CETs provide a function for which the hot leg temperature function does not provide redundancy. Only one channel per loop of RCS cold leg temperature is required because redundancy for the RCS cold leg temperature is provided by either of the two channels of SG Pressure (Function 20). If a cold leg temperature channel is inoperable and at least one of the two required channels of SG Pressure in the associated SG is OPERABLE, entry into Condition A is appropriate. If a cold leg temperature channel is inoperable at the same time both required SG Pressure channels in the associated SG are inoperable, entry into Condition C is appropriate because there is a loss of function for cold leg temperature for that loop. Additionally, entry into Condition C is required when both required SG Pressure channels in a SG are inoperable regardless of the status of the cold leg temperature function in the associated loop because SG Pressure channels provide a function for which the cold leg temperature function does not provide redundancy. D.1Condition D applies when the Required Action and associated Completion Time of Condition C are not met. Required Action D.1 requires entering the appropriate Condition referenced in Table 3.3.3-1 for the channel immediately. The applicable Condition referenced in the Table is Function dependent. Each time an inoperable channel has not met any Required Action of Condition C, and the associated Completion Time has expired, Condition D is entered for that channel and provides for transfer to the appropriate subsequent Condition.
PAM Instrumentation B 3.3.3 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.3 - 16 Revision 4 E.1 and E.2If the Required Action and associated Completion Time of Condition C are not met and Table 3.3.3-1 directs entry into Condition E, the unit must be brought to a MODE where the requirements of this LCO do not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. F.1At Indian Point 2, Function 4 (Reactor Vessel Level Indication System) and Function 10 (Containment Hydrogen Monitor) are not classified as Type A variables based on the evaluations listed in Reference 1. Additionally, alternate methods or diverse variables providing adequate information to make required assessments are available to operators even if these functions are not available. Therefore, plant shutdown within 7 days is not warranted if more than one channel of these Functions are not OPERABLE. Function 9 (Containment Area Radiation - High Range) and Function 14 (Condensate Storage Tank Level) are Type A variables; however, alternate methods for monitoring these variables are available. Therefore, plant shutdown within 7 days is not warranted if more than one channel of these Functions are not OPERABLE. If these alternate means are used to monitor a parameter, the Required Action is not to shut down the unit but rather to follow the directions of Specification 5.6.6, in the Administrative Controls section of the TS. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels. SURVEILLANCE REQUIREMENTS A Note has been added to the SR Table to clarify that SR 3.3.3.1 and SR 3.3.3.3 apply to each PAM instrumentation Function in Table 3.3.3-1.
PAM Instrumentation B 3.3.3 BASESSURVEILLANCE REQUIREMENTS (continued) INDIAN POINT 2 B 3.3.3 - 17 Revision 4 SR  3.3.3.1Performance of the CHANNEL CHECK once every 31 days ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation should be compared to similar unit instruments located throughout the unit. Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are
 
OPERABLE.As specified in the SR, a CHANNEL CHECK is only required for those channels that are normally energized. Instruments that are normally isolated or normally not in service are considered de-energized. The Frequency of 31 days is based on operating experience that demonstrates that channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels. SR  3.3.3.2 and SR 3.3.3.3A CHANNEL CALIBRATION is performed every 92 days for the RWST level and every 24 months, or approximately at every refueling for all other Table 3.3.3-1 Functions. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter with the necessary range and accuracy.
Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the Core Exit thermocouple sensors is accomplished PAM Instrumentation B 3.3.3 BASESSURVEILLANCE REQUIREMENTS (continued) INDIAN POINT 2 B 3.3.3 - 18 Revision 4 by an in-place cross calibration that compares the other sensing elements with the recently installed sensing element. The Frequency is based on operating experience and consistency with the typical industry refueling cycle. REFERENCES 1. Safety Evaluation by the Office of Nuclear Reactor Regulation Regarding Conformance to Regulatory Guide 1.97 for Consolidated Edison Company of New York, Inc. Indian Point Nuclear Generating Unit No. 2, Docket No. 50-247, September 27, 1990. 2. Regulatory Guide 1.97, December 1980. 3. NUREG-0737, Supplement 1, "TMI Action Items."
: 4. UFSAR, Section 7.1.5 Remote ShutdownB 3.3.4 INDIAN POINT 2 B 3.3.4 - 1 Revision 3 B 3.3  INSTRUMENTATION B 3.3.4 Remote Shutdown BASESBACKGROUND Remote Shutdown provides the control room operator with sufficient instrumentation and controls to place and maintain the unit in a safe shutdown condition from locations other than the control room. This capability is necessary to protect against the possibility that the control room becomes inaccessible. A safe shutdown condition is defined as MODE 3.
With the unit in MODE 3, the Auxiliary Feedwater (AFW) System and the steam generator (SG) safety valves or the SG atmospheric dump valves (ADVs) can be used to remove core decay heat and meet all safety requirements. The long term supply of water for the AFW System and the ability to borate the Reactor Coolant System (RCS) from outside the control room allows extended operation in MODE 3. If the control room becomes inaccessible, the operators can establish control at various local control stations, and place and maintain the unit in MODE 3.
Controls and transfer switches are operated locally at the switchgear, motor control panels, or other local stations. The unit automatically reaches MODE 3 following a unit shutdown and can be maintained safely in MODE 3 for an extended period of time. The OPERABILITY of the remote shutdown control and instrumentation functions ensures there is sufficient information available on selected unit parameters to place and maintain the unit in MODE 3 should the control room become inaccessible. APPLICABLE SAFETY ANALYSESRemote Shutdown is required to provide equipment at appropriate locations outside the control room with a capability to promptly shut down and maintain the unit in a safe condition in MODE 3. The criteria governing the design and specific system requirements of Remote Shutdown are located in 10 CFR 50, Appendix A, GDC 19 (Ref. 1).
Remote Shutdown requirements and capability needed to satisfy the requirements of 10 CFR 50, Appendix A, GDC 19 (Ref. 1), are listed in Table B 3.3.4-1 and Reference 2. These requirements are similar to but may be less restrictive than the requirements in SAO 703, "Fire Protection Impairment Criteria and Surveillance," that enforce the requirements of 10 CFR 50, Appendix R, which are not governed by Technical Specifications. The Remote Shutdown LCO satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).
Remote ShutdownB 3.3.4 BASESINDIAN POINT 2 B 3.3.4 - 2 Revision 3 LCO The Remote Shutdown LCO provides the OPERABILITY requirements of  the instrumentation and controls necessary to place and maintain the unit in MODE 3 from a location other than the control room. The instrumentation and controls required are listed in Table B 3.3.4-1. The controls, instrumentation, and transfer switches are required for:  Core reactivity control (initial and long term),  RCS pressure control,  Decay heat removal via the AFW System and the SG safety valves or SG ADVs and the RHR System,  RCS inventory control via charging flow, and  Safety support systems for the above Functions, including service water, component cooling water, and onsite power, including the diesel generators.A Function of a Remote Shutdown is OPERABLE if all instrument and control channels needed to support the Remote Shutdown Function are OPERABLE. In some cases, Table B 3.3.4-1 may indicate that the required information or control capability is available from several alternate sources.
In these cases, the Function is OPERABLE as long as one channel of any of the alternate information or control sources is OPERABLE. The remote shutdown instrument and control circuits covered by this LCO do not need to be energized to be considered OPERABLE. This LCO is intended to ensure the instruments and control circuits will be OPERABLE if unit conditions require plant shutdown from a location other than the control
 
room.APPLICABILITY The Remote Shutdown LCO is applicable in MODES 1, 2, and 3. This is required so that the unit can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room. This LCO is not applicable in MODE 4, 5, or 6. In these MODES, the facility is already subcritical and in a condition of reduced RCS energy. Under these conditions, considerable time is available to restore necessary instrument control functions if control room instruments or controls become unavailable.
Remote ShutdownB 3.3.4 BASESINDIAN POINT 2 B 3.3.4 - 3 Revision 3 ACTIONS  A Note has been added to the ACTIONS to clarify the application of Completion Time rules. Separate Condition entry is allowed for each Function. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function. A.1Condition A addresses the situation where one or more required Functions of the Remote Shutdown LCO are inoperable. This includes the control and transfer switches for any required Function. The Required Action is to restore the required Function to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room. B.1 and B.2If the Required Action and associated Completion Time of Condition A is not met, the unit must be brought to a MODE in which the LCO does not apply.
To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE The following surveillance requirements are applied to each of REQUIREMENTS the remote shutdown functions in Table B 3.3.4-1. SR  3.3.4.1Performance of the CHANNEL CHECK once every 31 days ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels including channels in other locations. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.
Remote ShutdownB 3.3.4 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.4 - 4 Revision 3 Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability.
If the channels are within the criteria, it is an indication that the channels are OPERABLE. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. As specified in the Surveillance, a CHANNEL CHECK is only required for those channels which are normally energized. Any instrument that is normally isolated or not in service is considered de-energized. The Frequency of 31 days is based upon operating experience which demonstrates that channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.SR  3.3.4.2SR 3.3.4.2 verifies each required Remote Shutdown Function control circuit and transfer switch performs the intended function. This verification is performed locally, as appropriate. Operation of the equipment is not necessary. The Surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the unit can be placed and maintained in MODE 3 from the local control stations.
The 24 month Frequencyis based on industry experience and assumes that this SR is typically performed during an outage. However, this SR may be performed during periods other than a plant outage. Operating experience demonstrates that remote shutdown control channels usually pass the Surveillance test when performed at the 24 month Frequency. SR  3.3.4.3CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the resistance temperature detectors (RTD) sensors is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element.
Remote ShutdownB 3.3.4 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.4 - 5 Revision 3 The Frequency of 24 months is based upon operating experience and consistency with the typical industry refueling cycle. SR  3.3.4.4SR 3.3.4.4 is a verification of the proper operation of the reactor trip breaker (RTB) and reactor trip bypass breaker (RTBB) local open/closed indication every 24 months. This test should verify the OPERABILITY of the RTB and RTBB open and closed indication by actuating the RTBs. This SR can be satisfied by verification of the RTB local indication during performance of RTB testing required by LCO 3.3.1, "Reactor Protection System (RPS)
Instrumentation."REFERENCES 1. 10 CFR 50, Appendix A, GDC 19. 2. UFSAR, Section 7.7.3 and 8.3.
Remote ShutdownB 3.3.4 INDIAN POINT 2 B 3.3.4 - 6 Revision 3 Table B 3.3.4-1 (page 1 of 2) Remote Shutdown Instrumentation and Controls FUNCTION/INSTRUMENTOR CONTROL PARAMETER REQUIREDNUMBER OF FUNCTIONS 1.REACTIVITY CONTROL a. Source Range Neutron Flux (NI-5143-1).
1 b. Reactor Trip and Bypass Breaker Position. 1 per breaker c. Reactor Trip & Bypass Breaker Trip Switch; or 1 per breaker; or 21 MG Set & 22 MG Set Trip Switch. 1 per train d. Seal Injection Flow 1 per RCP (FI-144, FI-143, FI-116 and FI-115) 2. REACTOR COOLANT SYSTEM PRESSURE CONTROL a. 21 Pressurizer Backup Heater 1 Local/Remote transfer switch. b. Pressurizer Pressure (PI-3105-1).
1 3. DECAY HEAT REMOVAL via STEAM GENERATORS a. Hot Leg Temperature.
1 (TI-5139 for Loop 21 or TI-5141 for Loop 22) b. Cold Leg Temperature.
1 (TI-5140 for Loop 21 or TI-5142 for Loop 22) c. SG Pressure. 1 per SG (PI-1353, PI-1354, PI-1355 and PI-1356)
: d. SG Level. 2 (LI-5001-1 for 21 SG and LI-5002-1 for 22 SG)
: e. CST Level. 1 f. Atmospheric Steam Dump Valve controls.
1 (Local nitrogen control stations in AFW Pump Building) g. Auxiliary Feedwater Pump 21.
1 (Transfer switch EDC5 and breaker 1B)
Remote ShutdownB 3.3.4 INDIAN POINT 2 B 3.3.4 - 7 Revision 3 Table B 3.3.4-1 (page 2 of 2) Remote Shutdown Instrumentation and Controls FUNCTION/INSTRUMENTOR CONTROL PARAMETER REQUIREDNUMBER OF FUNCTIONS h. AFW Pump suction and discharge pressure.
1 each per pump i. 21 RHR and 22 RHR Pumps.
1(Transfer switches EDG3 and EDG1 and breaker 1T) 4. RCS INVENTORY CONTROL a. Pressurizer Level (LI-3101-1, LI-459A, LI-459B) 1b. RWST Level (LI-921) 1c. Charging Pump 23 1(Transfer switch EDC4 and breaker 1M) 5. SUPPORT EQUIPMENT a. CCW Flow from RCP seals (thermal barriers) (FIC-625) 1 b. CCW flow to Charging Pumps (FI-637) 1 c. CCW flow to RHR Pumps (FIC-645, FIC 646) 2 d. Service Water Pumps 2 (Transfer switch EDG3 and breaker 1M for SW Pump 23) (Transfer switch EDG4 and breaker 3M for SW Pump 24) e. Component Cooling Water Pump 1 (Transfer switch EDF9 and breaker 2B for CCW Pump 23)f. Service Water Pressure at 2 CCW-HX Inlet (PI-1276, PI-1277)
LOP DG Start Instrumentation B 3.3.5 INDIAN POINT 2 B 3.3.5 - 1 Revision 2 B 3.3  INSTRUMENTATION B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation BASESBACKGROUND Indian Point 2 Loss of Power (LOP) DG Start Instrumentation responds to degraded offsite voltage or a loss of offsite voltage on the 480 V safeguards buses. The LOP start instrumentation starts the DGs, opens breakers that connect the 480 V safeguards buses to offsite power or the unit auxiliary transformer (i.e., plant main generator), opens circuit breakers that disconnect loads from the 480 V safeguards buses in preparation for load sequencing, and close the breakers that connect the DGs to their respective 480 V safeguards buses. The LOP DG Start Instrumentation consists of three different sets of undervoltage detection relays: Station Blackout (SBO) relays, Undervoltage relays and Degraded voltage relays. Station Blackout (SBO) relays (i.e., channels) consist of two sets of three relays with one set associated with 480 V safeguards bus 5A (SBO train 5A) and the other set associated with safeguards bus 6A (SBO train 6A). For bus 5A, the SBO relays are 27-51, 27-52, and 27-53. For bus 6A, the SBO relays are 27-61, 27-62, and 27-63. If there is a loss of voltage on 480 V bus 5A or 6A, two out of the three SBO undervoltage relays associated with either train are required to actuate the undervoltage portion of the SBO function.The undervoltage portion of the SBO function will provide a start signal to all three DGs.If the undervoltage portion of the SBO actuates: a) in conjunction with a safety injection signal; or, b) in conjunction with a turbine trip with no safety injection signal present, the SBO function will do the following: a) provide a signal that will open breakers that connect 480 V buses 5A and 6A to offsite power and open breakers that connect 480 V buses 2A and 3A to either offsite power or the unit auxiliary transformer (i.e., plant main generator); b)  provide one of the required conditions for closing the DG output breakers for all three DGs. The SBO undervoltage relay setpoints are designed to provide a fast trip response under complete loss-of-power ("dead bus") conditions on 480 V bus 5A or 6A. These 480 V buses are directly connected to 6.9 kV buses 5 and 6 which are the conduit for all offsite power to the plant safety systems. The SBO actuation logic design, two out of three channels on bus 5A LOP DG Start Instrumentation B 3.3.5 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.3.5 - 2 Revision 2 or two out of three on bus 6A, provides sufficient redundancy such that the channels associated with either bus will actuate the SBO function in conjunction with any single active failure. The SBO function on either bus will also actuate Auxiliary Feedwater as described in and required by LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)
Instrumentation."  The allowable value for this function is established in accordance with Reference 2. Undervoltage relays (i.e., channels), two channels per bus on 480 V buses 6A, 2A, 3A and 5A, will detect an undervoltage condition on any of the four 480 V safeguards buses. The two undervoltage relays on each bus are combined in a one-out-of-two logic to generate a bus undervoltage signal. Generally, the undervoltage relays perform functions that are specific to the associated 480 V bus. Specifically, actuation of the undervoltage function will do the following: a) provide a signal that will initiate load shedding on the associated 480 V bus;b) provide a signal that will open tie breakers between 480 V breakers; c)  provide one of the required conditions for closing the DG output breakers for the associated DG; d) provide a signal that ensures the 480 V bus is energized as a condition for starting load sequencing. Additionally, the undervoltage relays associated with 480 V buses 2A and 3A will provide a start signal to all three DGs similar to the function performed by the SBO relays on buses 5A and 6A. An ESFAS safety injection signal will initiate all of the functions actuated by the undervoltage relays. Undervoltage relay actuation includes a time delay to prevent spurious actuation. The allowable value for this function (including time delay) is established in accordance with Reference 2.
LOP DG Start Instrumentation B 3.3.5 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.3.5 - 3 Revision 2 Degraded Voltage relays (i.e., channels), two channels per bus on 480 V buses 6A, 2A, 3A and 5A, will detect a degraded voltage condition on any of the four 480 V safeguards buses. Detection of a degraded voltage condition on a 480 V bus will open breakers on the associated bus that connect the 480 V bus to offsite power or the unit auxiliary transformer (i.e., plant main generator). The relays are combined in a two-out-of-two logic to prevent spurious actuation. A two-out-of-two logic for each bus is acceptable because redundancy is provided by the number of DGs available. The degraded voltage function actuation includes time delays to ensure proper coordination with plant electrical transients (large motor starts, fast transfers, etc.). As specified in the acceptance criteria for SR 3.3.5.5, the degraded voltage function will actuate after a short time delay if there is a concurrent safety injection signal and will actuate after a longer time delay if there is no concurrent safety injection signal. The allowable values for this function (including time delays) are established in accordance with Reference 2. The LOP start actuation is described in UFSAR, Sections 7.5, 8.1 and 8.2 (Ref. 1). Technical Specification Allowable Values are determined based on the relationship between an analytical limit and a calculated trip setpoint. A detailed discussion of the relative position of the safety limit, analytical limit, allowable value and the trip setpoint with respect to the normal plant operation point is presented in the Bases of LCO 3.3.1, "Reactor Protection System (RPS) Instrumentation." A detailed description of the methodology used to calculate the channel and bistable device allowable value, including their explicit uncertainties, is provided in Reference 2. APPLICABLE SAFETY ANALYSESThe LOP DG start instrumentation is required for the Engineered Safety Features (ESF) Systems to function in any accident with a loss of offsite power. Its design basis is that of the ESF Actuation System (ESFAS). Accident analyses credit the loading of the DG based on the loss of offsite power during a loss of coolant accident (LOCA). The actual DG start has historically been associated with the ESFAS actuation. The DG loading has been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power.
LOP DG Start Instrumentation B 3.3.5 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.3.5 - 4 Revision 2 The required channels of LOP DG start instrumentation, in conjunction with the ESF systems powered from the DGs, provide unit protection in the event of any of the analyzed accidents discussed in Reference 1, in which a loss of offsite power is assumed. The delay times assumed in the safety analysis for the ESF equipment include the 10 second DG start delay, and the appropriate sequencing delay, if applicable. The response times for ESFAS actuated equipment in LCO 3.3.2 include the appropriate DG loading and sequencing delay. Loss of the LOP DG Start Instrumentation Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents. During the loss of offsite power the DG powers the motor driven auxiliary feedwater pumps. Failure of these pumps to start would leave only one turbine driven pump, as well as an increased potential for a loss of decay heat removal through the secondary system. The LOP DG start instrumentation channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCOThe LCO for LOP DG start instrumentation requires that the following instrumentation is OPERABLE: a. Two channels per bus of the 480 V bus Undervoltage Function on buses 5A, 2A, 3A and 6A. OPERABILITY requires that both the trip setpoint and the time delay are within the Allowable Values specified in SR 3.3.5.5. Either of the undervoltage relays will actuate the undervoltage function with additional redundancy provided by the number of DGs available. Additionally, an ESFAS safety injection signal will initiate all of the functions actuated by the undervoltage relays.b. Two channels per bus of the 480 V bus Degraded Voltage Function on buses 5A, 2A, 3A and 6A. Both channels on each bus are required to be OPERABLE because relays are combined in a two-out-of-two logic to prevent spurious actuation. A two out of two logic for each bus is acceptable because redundancy is provided by the number of DGs available. OPERABILITY requires that both the trip setpoint and the time delay are within the allowable values specified in SR 3.3.5.5.
LOP DG Start Instrumentation B 3.3.5 BASESLCO  (continued) INDIAN POINT 2 B 3.3.5 - 5 Revision 2 c.1 Three channels per bus of the Station Blackout (SBO) Function on both bus 5A and 6A are required when in MODE 1, 2, 3 and 4. Each set of three SBO undervoltage relays (i.e., channels) is considered a train because, if there is a loss of voltage on 480 V bus 5A or 6A, two out of the three SBO undervoltage relays associated with either train will actuate the undervoltage portion of the SBO function. The SBO actuation logic design, two out of three channels on bus 6A or two out of three on bus 5A, provides sufficient redundancy such that the three channels associated with either bus will actuate the SBO function in conjunction with any single active failure. Actuation logic for the SBO undervoltage function includes input from a safety injection signal and/or a plant trip. If either of these inputs is inoperable, all three channels with the associated train are inoperable. OPERABILITY requires that the trip setpoint is within the allowable values specified in SR 3.3.5.5.c.2 Three channels per bus of the Station Blackout (SBO) Function on either bus 5A or 6A are required when in MODE 5 and 6. As explained in the Bases for LCO 3.8.2, "AC Sources - Shutdown," the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required. In MODE 5 and 6, operators have sufficient time to align a DG manually if the SBO function fails to automatically connect a DG to its 480 V bus. APPLICABILITY The LOP DG Start Instrumentation Functions are required in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODE 5 or 6 is required whenever a DG must be OPERABLE so that it can perform its function on an LOP or degraded power to the vital bus.
ACTIONSIn the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the channel is found inoperable, then the function that channel provides must be declared inoperable and the LCO Condition entered for the particular protection function affected.
LOP DG Start Instrumentation B 3.3.5 BASESACTIONS (continued) INDIAN POINT 2 B 3.3.5 - 6 Revision 2 A.1Condition A applies when one SBO channel on one bus is inoperable. In this Condition, the remaining two OPERABLE channels associated with the affected bus will still actuate the SBO function. Additionally, any two of the three OPERABLE channels associated with the other bus will also actuate the SBO function. Therefore, a Completion Time of 7 days to place the inoperable channel in trip provides adequate time to accomplish required repairs without any significant degradation of safety.Condition A is modified by a Note stating that the Condition is not applicable in MODE 5 or 6. This note is necessary because three channels per bus of the Station Blackout (SBO) Function are required on either bus 5A or 6A when in MODE 5 and 6.B.1Condition B applies when two or more SBO channels on one bus are inoperable but all three SBO channels on the other bus are OPERABLE or when one SBO channel is inoperable on both buses. Note that inoperability of the input from a safety injection signal and/or a plant trip into the SBO actuation logic is equivalent to three inoperable channels on that bus. Therefore, if either of these inputs is inoperable, all three channels are inoperable.In Condition B, either of the two OPERABLE channels associated with each bus or two OPERABLE channels associated with the OPERABLE bus will still actuate the SBO function on a loss of offsite power to 480 V buses 5A and 6A. Therefore, a Completion Time of 48 hours to restore at least one of the inoperable channels provides adequate time to accomplish required repairs without significant degradation of safety.Condition B is modified by a Note stating that the Condition is not applicable in MODE 5 or 6. This note is necessary because three channels per bus of the Station Blackout (SBO) Function on either bus 5A or 6A are required when in MODE 5 and 6.
LOP DG Start Instrumentation B 3.3.5 BASESACTIONS (continued) INDIAN POINT 2 B 3.3.5 - 7 Revision 2 C.1 and C.2If the inoperable SBO channels cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
D.1Condition D applies when one SBO channel is inoperable on the required bus (i.e., either 480 V bus 5A or 6A) when in MODE 5 or 6. In this Condition, the two remaining OPERABLE SBO channels will accomplish the SBO function. A Completion Time of 48 hours to place the inoperable channel in trip is appropriate because operators have sufficient time to align a DG manually if the SBO function fails to automatically connect a DG to its 480 V bus when in MODE 5 and 6. E.1Condition E applies when two or more SBO channels on both buses are inoperable when in MODE 1, 2, 3 or 4. In this Condition, the SBO logic will not perform its required safety function and the DGs will not automatically supply the 480 V safeguards buses as assumed in the accident analysis.
However, if an SI signal is not present, the DGs will start automatically but operator action will be required to align the DGs to the associated 480 V buses. Therefore, immediate entry into the applicable Condition(s) and Required Action(s) for all DGs inoperable is appropriate. Condition E applies when the Required Actions and Completion Time of Condition D are not met. F.1Condition F applies when one of the two channels of 480 V bus undervoltage function is inoperable. In this Condition, the associated DG will automatically connect to the associated 480 V bus on an undervoltage signal; however, the design redundancy for this function is lost. Therefore, Required Action F.1 allows 6 hours to restore the required channel to OPERABLE status before the affected DG must be declared inoperable in accordance with Required Action H.1. Condition F is modified by a Note explaining that separate condition entry is allowed for each 480 V bus.
LOP DG Start Instrumentation B 3.3.5 BASESACTIONS (continued) INDIAN POINT 2 B 3.3.5 - 8 Revision 2 G.1Condition G applies when one channel of the 480 V bus Degraded Voltage Function is inoperable. Note that the 480 V bus Degraded Voltage Function uses a two out of two logic. Therefore, the 480 V bus Degraded Voltage Function may not trip the supply breaker and de-energize the affected bus when one channel is inoperable. Therefore, Required Action G.1 allows 1 hour to place the inoperable channel in trip before the affected DG must be declared inoperable in accordance with Required Action H.1. Placing the inoperable channel in trip will restore the 480 V bus Degraded Voltage Function because of the two out of two logic used to initiate this Function. Extended operation with one operable channel and one channel in trip is acceptable because 480 V bus Degraded Voltage Function will function as required and redundancy for the safety function is provided by redundant DGs.The Completion Time of 1 hour to trip an inoperable 480 V bus degraded voltage channel is acceptable because there is loss of redundancy for DGs but no loss of safety function. During the 1 hour Completion Time, at least 2 DGs will receive a start signal from an 480 V bus undervoltage signal from an associated 480 V bus, all 3 DGs receive a start signal on a Safety Injection signal, and there is a low probability of an event during this interval.
Condition G is modified by a Note explaining that separate condition entry is allowed for each 480 V bus.
H.1Condition H applies to each of the LOP DG start Functions when the Required Action and associated Completion Time for Condition F or G are not met. Condition H also applies when both channels of the Undervoltage Function are inoperable in one or more buses. In this Condition, one or more DGs may not receive the required start signal when an undervoltage or degraded voltage condition exists on the associated 480 V buses.
Condition H also applies when two channels of Degraded Voltage Function are inoperable in one or more bus(es) because placing both inoperable channels in trip will start the associated DG. In these circumstances the Conditions specified in LCO 3.8.1, "AC Sources - Operating," or LCO 3.8.2, "AC Sources - Shutdown," for the DGs made inoperable by failure of the LOP DG start instrumentation are required to be entered immediately. The actions of those LCOs provide for adequate compensatory actions to assure unit safety.
LOP DG Start Instrumentation B 3.3.5 BASESINDIAN POINT 2 B 3.3.5 - 9 Revision 2 SURVEILLANCE SR  3.3.5.1 REQUIREMENTSPerformance of the CHANNEL CHECK once every 12 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL
 
CALIBRATION.Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability.
If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels. SR  3.3.5.2 and SR  3.3.5.3SR 3.3.5.2 and SR 3.3.5.3 require performance of TADOTs. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This test is performed every 31 days for the 480 V bus Degraded Voltage Function and every 24 months for the 480 V bus undervoltage function and the 480 V SBO function. The test checks trip devices that provide actuation signals directly, bypassing the analog process control equipment. For these tests, the SBO, undervoltage and degraded voltage relay trip setpoints are not verified (the degraded voltage time delay relay setpoints are verified and adjusted as necessary). The TADOT does not perform the setpoint verification for undervoltage and SBO as part of the test since the CALIBRATION is performed on the same frequency and that test is credited for accomplishing this. SR 3.3.5.2 is modified by a note that excludes verification of degraded voltage setpoints from the TADOT. Since this TADOT applies to 480V LOP DG Start Instrumentation B 3.3.5 BASESINDIAN POINT 2 B 3.3.5 - 10 Revision 2 degraded voltage, setpoint verification requires bench calibration and is accomplished during CHANNEL CALIBRATION. The Frequency is based on the known reliability of the relays and controls and the multichannel redundancy available, and has been shown to be acceptable through operating experience. SR 3.3.5.4SR 3.3.5.4 is the performance of an ACTUATION LOGIC TEST for the 480 V function and 480 V undervoltage function. This test is performed every 24 months which is consistent with the plant conditions needed to perform the test. This Test is performed in conjunction with the testing of LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation,"
Function 6.d, Auxiliary Feedwater - Station Blackout. The Surveillance interval is acceptable based on instrument reliability and operating experience.SR  3.3.5.5SR 3.3.5.5 is the performance of a CHANNEL CALIBRATION.
The setpoints, as well as the response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay. A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. The Frequency of 24 months is based on operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. REFERENCES 1. UFSAR, Section 7, 8, and 14. 2. Indian Point 2 Specification FIX-95-A-001, Guidelines For Preparation Of Instrument Loop Accuracy And Setpoint Determination Calculation.
Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 INDIAN POINT 2 B 3.3.6 - 1 Revision 1 B 3.3  INSTRUMENTATION B 3.3.6 Containment Purge System and Pressure Relief Line Isolation Instrumentation BASESBACKGROUND Containment purge system and pressure relief line isolation instrumentation closes the containment isolation valves in the Containment Purge System (containment purge supply line and containment purge exhaust line) and the Containment Pressure Relief Line. This action isolates the containment atmosphere from the environment to minimize releases of radioactivity in the event of an accident. A detailed description of the Containment Purge System (containment purge supply line and containment purge exhaust line) and the Containment Pressure Relief Line is provided in the Background of the Bases for Technical Specification 3.6.3, "Containment Isolation Valves." Both the containment purge supply and exhaust isolation valves (FCV-1170, FCV-1171, FCV-1172, and FCV-1173) and the containment pressure relief line isolation valves (PCV-1190, PCV-1191 and PCV-1192) close when high radiation levels are detected by the Containment Air Particulate Monitor (R-41) or Containment Radioactive Gas Monitor (R-42). The Containment Phase A Isolation ESFAS signal (LCO 3.3.2, Function 3.a) and Containment Spray ESFAS signal (LCO 3.3.2, Function 2) also cause closure of the containment purge isolation valves and the containment pressure relief isolation valves. Although not required to satisfy Technical Specifications, containment purge and containment pressure relief are also isolated when high gas radiation levels are detected in the plant vent (R-44). A failure of the R-44 monitor does not affect operation of the isolation function performed by R-41 and R-42. APPLICABLE SAFETY ANALYSESThe safety analyses assume that the containment remains intact with penetrations unnecessary for core cooling isolated early in the event, within approximately 60 seconds.In MODES 1, 2, 3 and 4, isolation instrumentation for the containment purge supply line, containment purge exhaust line and the containment pressure relief line may be open, as needed, for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open consistent with Surveillance Requirements 3.6.3.1 and 3.6.3.2. This is acceptable because the containment purge (supply and exhaust) lines and pressure relief line are equipped with redundant containment isolation valves that are automatically closed upon receipt of a Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.3.6 - 2 Revision 1 Containment Phase A Isolation ESFAS signal (LCO 3.3.2, Function 3.a) or Containment Spray ESFAS signal (LCO 3.3.2, Function 2). High radiation levels detected by the Containment Air Particulate Monitor (R-41) or Containment Radioactive Gas Monitor (R-42) will also initiate closure of these valves. The containment purge supply line, containment purge exhaust line and the containment pressure relief line isolation valves are capable of closing within 3 seconds in the environment following a LOCA. At Indian Point 2, radiological consequence analyses have been revised to demonstrate compliance with 10 CFR 50.67, Accident Source Term (Ref. 1). OPERABILITY of Containment Purge System and Pressure Relief Line Isolation instrumentation ensures that exposures following each event analyzed for MODES 1, 2, 3 and 4 are significantly below the required limits (Ref. 1). In MODES 5 and 6 without fuel handling in progress, isolation instrumentation for the containment purge supply line, containment purge exhaust line and the containment pressure relief line need not be OPERABLE because the potential for radioactive releases is minimized and operator action is sufficient to ensure post accident offsite doses are maintained within the limits of Reference 1. In MODE 6 with fuel handling in progress after the reactor has been subcritical for more than 84 hours, isolation instrumentation for the containment purge supply line, containment purge exhaust line and the containment pressure relief line need not be OPERABLE. This is acceptable because water level and decay time are the primary success path for mitigating a fuel handling accident if at least 84 hours of decay time have elapsed (i.e., fuel involved in the accident has not occupied part of a critical reactor core within the previous 84 hours). This is consistent with the Indian Point 2 analysis of the radiological consequence for the fuel handling accident (Ref. 2) that was revised to demonstrate compliance with 10 CFR 50.67, Accident Source Term (Ref. 1). This analysis assumed that activity released from the damaged assembly was released to the outside atmosphere through the containment purge system without taking any credit for filtration of the release path. This is conservative because the containment purge supply line, containment purge exhaust line and the containment pressure relief line are expected to be isolated by a Containment Air Particulate Monitor (R-41) or Containment Radioactive Gas Monitor (R-42) even though this isolation is not required to meet the dose acceptance limits of Regulatory Guide 1.183 (Ref. 3) and 10 CFR 50.67  (Ref. 1).
Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.3.6 - 3 Revision 1 During movement of recently irradiated fuel (i.e., fuel assemblies that have been part of a critical reactor in the previous 84 hours), the relaxations justified in Reference 2 do not apply. Therefore, during movement of recently irradiated fuel assemblies, LCO 3.9.3, "Containment Penetrations," establishes requirements for containment closure that minimize any release via Containment Purge System and Pressure Relief Line Isolation to the environment resulting from a fuel handling accident that occurs when the reactor has been subcritical for less than the 84 hours assumed in Reference 2. Therefore, LCO 3.3.6 requirements are applicable during the movement of recently irradiated fuel. The containment purge supply line, containment purge exhaust line and the containment pressure relief line isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii)
LCOThe LCO requirements ensure that the instrumentation necessary to initiate containment purge supply line, containment purge exhaust line and the containment pressure relief line isolation, listed in Table 3.3.6-1, is OPERABLE.1. Automatic Actuation Logic and Actuation RelaysThe LCO requires two trains of Automatic Actuation Logic and Actuation Relays OPERABLE to ensure that no single random failure can prevent automatic actuation. The Automatic Actuation Logic and Actuation Relays Function is required to be OPERABLE to support the OPERABILITY of all of the functions that isolate the containment purge system and pressure relief line (gaseous and particulate radiation monitors (R-42 and R-41) and ESFAS containment phase A isolation and containment spray initiation signals). There are two trains of automatic actuation logic and actuation relays for the containment purge system and pressure relief line. If one or more of the Containment Spray or Phase A isolation Functions becomes inoperable in such a manner that only the Containment Purge Isolation Function is affected, the Conditions applicable to their Containment Spray and Phase A isolation Functions need not be entered. The less restrictive Actions specified for inoperability of the Containment Purge and Pressure Relief Line Isolation Functions specify sufficient compensatory measures for this case.
Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASESLCO  (continued) INDIAN POINT 2 B 3.3.6 - 4 Revision 1 2. Containment RadiationThe LCO specifies two required channels of radiation monitors to ensure that the radiation monitoring instrumentation necessary to initiate Containment Purge Isolation remains OPERABLE. The requirement for two channels is satisfied by the Containment Air Particulate Monitor (R-41) and the Containment Radioactive Gas Monitor (R-42). Allowable values and setpoints for these Functions are based on engineering judgment. Channel OPERABILITY involves more than OPERABILITY of the channel electronics. OPERABILITY may also require correct valve lineups, sample pump operation, and filter motor operation, as well as detector OPERABILITY, if these supporting features are necessary for trip to occur under the conditions assumed by the safety analyses. 3. Containment Isolation - Phase ARefer to LCO 3.3.2, Function 3.a., for all initiating Functions and requirements. This Function is required only when the associated LCO 3.3.2, "ESFAS Instrumentation," function is required to be OPERABLE.4. Containment SprayRefer to LCO 3.3.2, "ESFAS Instrumentation," Function 2, for all initiation functions and requirements. This Function is required only when the associated LCO 3.3.2, "ESFAS Instrumentation," function is required to be OPERABLE. APPLICABILITY In MODES 1, 2, 3 or 4, isolation instrumentation for the containment purge supply line, containment purge exhaust line and the containment pressure relief line automatic isolation capability is not required if the associated flow paths are isolated in accordance with the requirements of LCO 3.6.3, "Containment Isolation Valves". If the associated flow paths are open in accordance with Surveillance Requirements 3.6.3.1 or 3.6.3.2, automatic isolation Function 1, Automatic Actuation Logic and Actuation Relays, and Function 3, Containment Isolation - Phase A, and Function 4, Containment Spray, are required as part of the containment isolation function initiated by the ESFAS Instrumentation required by LCO 3.3.2. Function 2.a, Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASESAPPLICABILITY  (continued) INDIAN POINT 2 B 3.3.6 - 5 Revision 1 Containment Radioactive Gaseous Monitor (R-42), and Function 2.b, Containment Air Particulate Monitor (R-41), are required to be OPERABLE to provide an isolation signal that is diverse to the ESFAS isolation signals. The Applicability for the containment purge system and pressure relief line isolation on the ESFAS Containment Isolation-Phase A and Containment Spray Functions are specified in LCO 3.3.2. Refer to the Bases for LCO 3.3.2 for discussion of the Containment Isolation-Phase A and Containment Spray Function Applicability. In MODES 5 and 6, without fuel handling in progress or after 84 hours since reactor shutdown, isolation instrumentation for the containment purge supply line, containment purge exhaust line and the containment pressure relief line need not be OPERABLE because the potential for radioactive releases is minimized and operator action is sufficient to ensure post accident offsite doses are maintained within the limits of Reference 3.During movement of recently irradiated fuel (i.e., fuel assemblies that have been part of a critical reactor in the previous 84 hours), the relaxations justified in Reference 2 do not apply. Therefore, LCO 3.3.6, "Containment Purge System and Pressure Relief Line Isolation Instrumentation,"
requirements are applicable during the movement of recently irradiated fuel.
ACTIONSThe most common cause of channel inoperability is outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by unit specific calibration procedures. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a COT, when the process instrumentation is set up for adjustment to bring it within specification. If the Trip Setpoint is less conservative than the tolerance specified by the calibration procedure, the channel must be declared inoperable immediately and the appropriate Condition entered. A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.6-1. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.6 - 6 Revision 1 A.1Condition A applies to the failure of one containment purge isolation radiation monitor channel (either R-41 or R-42). Since the two containment radiation monitors measure different parameters, failure of a single channel may result in loss of the radiation monitoring Function for certain events.
Consequently, the failed channel must be restored to OPERABLE status. A Completion Time of 7 days is allowed to restore the affected channel because the accident analysis assumes that an ESFAS SI signal isolates the containment vent paths. Therefore, the containment radiation monitoring function is not the primary method of ensuring that 10 CFR 50.67 limits are not exceeded. B.1Condition B applies to all Containment Purge System and Pressure Relief Line Isolation Functions and addresses the train orientation use of master relays for these Functions. It also addresses the failure of both radiation monitoring channels, or the inability to restore a single failed channel to OPERABLE status in the time allowed for Required Action A.1. If a train is inoperable, multiple channels are inoperable, or the Required Action and associated Completion Time of Condition A are not met, operation may continue as long as the Required Action for the applicable Conditions of LCO 3.6.3 is met for each valve made inoperable by failure of isolation instrumentation. A Note is added stating that Condition B is only applicable in MODE 1, 2, 3 or 4. C.1 and C.2Condition C applies to all Containment Purge System and Pressure Relief Line Isolation Functions. It also addresses the failure of multiple radiation monitoring channels, or the inability to restore a single failed channel to OPERABLE status in the time allowed for Required Action A.1. If a train is inoperable, multiple channels are inoperable, or the Required Action and associated Completion Time of Condition A are not met, operation may continue as long as the Required Action to place and maintain containment purge system and pressure relief line isolation valves in their closed position is met or the applicable Conditions of LCO 3.9.3, "Containment Penetrations," are met for each valve made inoperable by failure of isolation Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASESACTIONS  (continued) INDIAN POINT 2 B 3.3.6 - 7 Revision 1 instrumentation. The Completion Time for these Required Actions is immediately.A Note states that Condition C is applicable during movement of recently irradiated fuel assemblies within containment. SURVEILLANCE
 
REQUIREMENTSA Note has been added to the SR Table to clarify that Table 3.3.6-1 determines which SRs apply to which Containment Purge and Exhaust Isolation Functions. SR  3.3.6.1Performance of the CHANNEL CHECK once every 24 hours ensures that a gross failure of instrumentation has not occurred and is key to verifying the instrumentation continues to operate properly between each CHANNEL
 
CALIBRATION.Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. A CHANNEL CHECK for a single channel instrument is satisfied by verification that the sensor or the signal processing equipment has not drifted outside its limit.The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels. SR  3.3.6.2SR 3.3.6.2 is the performance of an ACTUATION LOGIC TEST. This test is performed every 31 days on a STAGGERED TEST BASIS. The Surveillance interval is acceptable based on instrument reliability and industry operating experience. SR  3.3.6.3SR 3.3.6.3 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay and verifying contact operation. This test is performed every 31 days on a STAGGERED TEST Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.6 - 8 Revision 1 BASIS. The Surveillance interval is acceptable based on instrument reliability and industry operating experience. SR  3.3.6.4A COT is performed every 31 days on each radiation monitoring channel to ensure the entire channel will perform the intended Function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This test verifies the capability of the instrumentation to provide the containment purge supply line, containment purge exhaust line and the containment pressure relief line isolation. The setpoint shall be left consistent with the current unit specific calibration procedure tolerance. SR  3.3.6.5SR 3.3.6.5 is the performance of a TADOT. This test is a check performed every 24 months that verifies actuation of the end device (i.e., valve cycles, etc.).The test also includes trip devices that provide actuation signals directly to the actuation relays, bypassing the analog process control equipment. The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Functions tested have no setpoints associated with them. The Frequency is based on the known reliability of the Function and the redundancy available, and has been shown to be acceptable through operating experience. SR  3.3.6.6A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. Allowable values and setpoints for these Functions are based on engineering judgment.
Containment Purge System and Pressure Relief Line Isolation Instrumentation B 3.3.6 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.3.6 - 9 Revision 1 The Frequency is based on operating experience and is consistent with the typical industry refueling cycle. REFERENCES 1. 10 CFR 50.67. 2. WCAP-16157, "Indian Point Unit 2 Stretch Power Uprating Licensing Report," January 2004. 3. Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.
CRVS Actuation InstrumentationB 3.3.7 INDIAN POINT 2B 3.3.7 - 1 Revision 2B 3.3  INSTRUMENTATIONB 3.3.7Control Room Ventilation System (CRVS) Actuation Instrumentation BASESBACKGROUNDThe CRVS provides an enclosed control room environment from which theunit can be operated following an uncontrolled release of radioactivity. Upon receipt of an actuation signal, the CRVS initiates filtered pressurization of the control room. This system is described in the Bases for LCO 3.7.10, "Control Room Ventilation System."The actuation instrumentation consists of control room radiation monitor(R-38-2) in the air intake to the control room and the control building radiation monitor (R-38-1). The control room operator can also align and start both CRVS trains manually using the CRVS mode switch. The CRVS is also actuated by a safety injection (SI) signal. The SI Function is discussed in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)
Instrumentation."APPLICABLE SAFETY ANALYSESThe control room must be kept habitable for the operators stationed there during accident recovery and post accident operations.The CRVS acts to terminate the supply of unfiltered outside air to the controlroom and pressurize the control room. These actions are necessary to ensure the control room is kept habitable for the operators stationed there during accident recovery and post accident operations by minimizing the radiation exposure of control room personnel.In MODES 1, 2, 3, and 4, the radiation monitors actuate CRVS as a backupto the SI signal actuation. This ensures initiation of the CRVS during a loss of coolant accident or steam generator tube rupture.Radiological consequence analyses have been revised to demonstratecompliance with 10 CFR 50.67, Accident Source Term (Ref. 1) which requires that accident analyses show adequate radiation protection is provided to permit access to and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem total effective dose equivalent for the duration of the accident.In MODES 1, 2, 3 and 4, automatic CRVS actuation is needed because there-analysis of the large-break LOCA, Steam Line Break and Steam Generator Tube Rupture accidents performed to demonstrate compliancewith 10 CFR 50.67 modeled the control room air filtration system in the CRVS Actuation InstrumentationB 3.3.7 BASESAPPLICABLE SAFETY ANALYSES (continued)
INDIAN POINT 2B 3.3.7 - 2 Revision 2pressurization mode of operation. The dose to personnel is affected more bythe inleakage of unfiltered air than by the intake of filtered air, and the calculated doses to an operator in the control room (Ref. 2) are below the acceptance criterion in 10 CFR 50.67 (Ref. 1).In MODES 5 and 6 without fuel handling in progress, automatic CRVSactuation need not be OPERABLE because the potential for radioactive releases is minimized and operator action is sufficient to ensure post accident control room doses are maintained within the limits of Reference 1.In MODE 6 with fuel handling in progress after the reactor has beenshutdown for more than 84 hours, automatic CRVS actuation need not be OPERABLE because water level and decay time are the primary success path for mitigating a fuel handling accident after 84 hours of decay time have elapsed (fuel involved in the accident has occupied part of a critical reactor core within the previous 84 hours). This is consistent with the analysis of the radiological consequences for the fuel handling accident (Ref. 2). However, Reference 2 did not address fuel handling accidents when less than 84 hours of decay time have elapsed. Therefore, automatic CRVS actuation is required to be OPERABLE during movement of fuel that has occupied part of a critical reactor core within the previous 84 hours.The CRVS actuation instrumentation satisfies Criterion 3 of10 CFR 50.36(c)(2)(ii).
LCOThe LCO requirements ensure that instrumentation necessary to initiate the CRVS is OPERABLE.1. Manual InitiationThe LCO requires that the switch used to place the CRVS in thepressurization mode (mode 2) is OPERABLE.2. Control Building Air Intake Radiation Monitor (R-38-1)The LCO requires a Control Building Air Intake Radiation Monitor toensure that the radiation monitoring instrumentation will initiate a control room isolation if isolation on an SI signal fails to occur.
CRVS Actuation InstrumentationB 3.3.7 BASES LCO  (continued)
INDIAN POINT 2B 3.3.7 - 3 Revision 23. Control Room Air Intake Radiation Monitor (R-38-2)The LCO requires a Control Room Air Intake Radiation Monitor toensure that the radiation monitoring instrumentation will initiate a control room isolation if isolation on an SI signal fails to occur.4. Safety InjectionRefer to LCO 3.3.2, Function 1, for all initiating Functions and requirements.APPLICABILITYIn MODES 1, 2, 3 and 4, automatic CRVS actuation is needed to demonstrate compliance with 10 CFR 50.67, Accident Source Term (Ref. 1).
OPERABILITY of CRVS Isolation instrumentation ensures that exposures following each event analyzed for MODES 1, 2, 3 and 4 are significantlybelow the required limits (Ref. 2).In MODES 5 and 6 without fuel handling in progress or after the reactor hasbeen shutdown for more than 84 hours, automatic CRVS actuation need not be OPERABLE because the potential for radioactive releases is minimized and operator action is sufficient to ensure post accident control room doses are maintained within the limits of Reference 1.During movement of recently irradiated fuel assemblies either in containmentor the fuel handling building, automatic CRVS actuation must be OPERABLE to cope with the release from a fuel handling accident involving recently irradiated fuel. The CRVS is only required to be OPERABLE during fuel handling involving recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84 hours), due to radioactive decay.The Applicability for the CRVS actuation on the ESFAS Safety InjectionFunctions are specified in LCO 3.3.2. Refer to the Bases for LCO 3.3.2 for discussion of the Safety Injection Function Applicability.ACTIONSA Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each Function. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.7-1 in the accompanying LCO. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.
CRVS Actuation InstrumentationB 3.3.7 BASESACTIONS  (continued)
INDIAN POINT 2B 3.3.7 - 4 Revision 2 A.1Condition A applies if one or more functions in Table 3.3.7-1 are inoperable. Ifthe automatic CRVS start signal from any Function is inoperable, 72 hours is allowed to restore the Function consistent with the limit of 72 hours for loss of CRVS Function allowed by LCO 3.7.10. If the channel/train cannot be restored to OPERABLE status, one CRVS train must be placed in the filtered pressurization mode of operation. This accomplishes the actuation instrumentation Function and places the unit in a conservative mode of
 
operation.A Note to Condition A clarifies that Required Action A.1 is applicable only inMODE 1, 2, 3 or 4.B.1 and B.2Condition B applies when the Required Action and associated CompletionTime for Condition A have not been met and the unit is in MODE 1, 2, 3, or 4.
The unit must be brought to a MODE in which overall plant risk is reduced.
To achieve this status, the unit must be brought to MODE 3 within 6 hours and MODE 4 within 12 hours.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 3). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 3, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5may be made as it is also acceptable from a risk perspective.Required Action B.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or otherspecified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
CRVS Actuation InstrumentationB 3.3.7 BASESACTIONS  (continued)
INDIAN POINT 2B 3.3.7 - 5 Revision 2The allowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.C.1Condition C applies when one or more functions are not OPERABLE whenrecently irradiated fuel assemblies are being moved. Movement of recently irradiated fuel assemblies must be suspended immediately to reduce the risk of accidents that could require CRVS actuation.SURVEILLANCE REQUIREMENTSA Note has been added to the SR Table to clarify that Table 3.3.7-1 determines which SRs apply to which CRVS Actuation Functions.SR  3.3.7.1Performance of the CHANNEL CHECK for R-38-1 and R-38-2 once every24 hours ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK for a single channel instrument is satisfied by verification that the sensor or the signal processing equipment has not drifted outside its limit. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.Agreement criteria are determined by the unit staff, based on a combinationof the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.The Frequency is based on operating experience that demonstrates channelfailure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.SR  3.3.7.2A COT is performed once every 31 days on the R-38-1 and R-38-2 channelsto ensure the entire channel will perform the intended function. This test verifies the capability of the instrumentation to provide the CRVS actuation.
A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST CRVS Actuation InstrumentationB 3.3.7 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.3.7 - 6 Revision 2of a relay. This is acceptable because all of the other required contacts ofthe relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Frequency is based on the known reliability of the monitoring equipment and has been shown to be acceptable through operating experience.SR  3.3.7.3SR 3.3.7.3 is the performance of a MASTER RELAY TEST. The MASTERRELAY TEST is the energizing of the master relay and verifying contact operation. This test is performed every 31 days. The Frequency is acceptable based on instrument reliability and industry operating experience.SR 3.3.7.4SR 3.3.7.4 requires the performance of a TADOT for the manual actuationfunction of the CRVS. This test verifies that CRVS actuates to the pressurization mode (mode 2) using the manual initiation switch. This SR can be satisfied by the performance of SR 3.7.10.3.SR  3.3.7.5A CHANNEL CALIBRATION of R-38-1 and R-38-2 is performed every24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.The Frequency is based on operating experience and is consistent with thetypical industry refueling cycle.REFERENCES 1.10 CFR 50.67.
2.WCAP-16157, "Indian Point Unit 2 Stretch Power Uprating LicensingReport," January 2004.
3.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changesto Technical Specification Required Action Endstates for Westinghouse NSSS PWRs," June 2010.
RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 INDIAN POINT 2 B 3.4.1 - 1 Revision 1 B 3.4  REACTOR COOLANT SYSTEM (RCS) B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits BASESBACKGROUND These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within limits assumed in the safety analyses. The safety analyses (Ref. 1) of normal operating conditions and anticipated operational occurrences assume initial conditions within the normal steady state envelope. The limits placed on RCS pressure, temperature, and flow rate ensure that the minimum departure from nucleate boiling ratio (DNBR) will be met for each of the transients analyzed. The RCS pressure limits are consistent with operation within the nominal operational envelope. Pressurizer pressure indications are averaged to come up with a value for comparison to the limit. A lower pressure will cause the reactor core to approach DNB limits. The RCS coolant average temperature limit is consistent with full power operation within the nominal operational envelope. Because there may be differences between the loop temperatures, both the average of the loop Tavgvalues and the highest of the loop T avg values are compared to their respective limits. A higher average temperature will cause the core to approach DNB limits. The RCS flow rate normally remains constant during an operational fuel cycle with all pumps running. The minimum RCS flow limit corresponds to that assumed for DNB analyses. Flow rate indications are averaged to derive a value for comparison to the limit. A lower RCS flow will cause the core to approach DNB limits. Operation for significant periods of time outside these DNB limits increases the likelihood of a fuel cladding failure in a DNB limited event. APPLICABLE SAFETY ANALYSESThe requirements of this LCO represent the initial conditions for DNB limited transients analyzed in the plant safety analyses (Ref. 1). The safety analyses have shown that transients initiated from the limits of this LCO will result in meeting the DNBR criterion. This is the acceptance limit for the RCS DNB parameters. Changes to the unit that could impact these parameters must be assessed for their impact on the DNBR criteria. The transients analyzed include loss of coolant flow events and dropped or stuck rod events. A key assumption for the analysis of these events is that the RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.4.1 - 2 Revision 1 core power distribution is within the limits of LCO 3.1.6, "Control Bank Insertion Limits," LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)." The pressurizer pressure limit and RCS average temperature limit specified in the COLR are consistent with the analytical limits used in the safety analyses and include allowance for measurement uncertainty. The RCS DNB parameters satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). LCOThis LCO specifies limits on the monitored process variables - pressurizer pressure, RCS average temperature, and RCS total flow rate - to ensure the core operates within the limits assumed in the safety analyses. These variables are contained in the COLR to provide operating and analysis flexibility from cycle to cycle. However, the minimum RCS flow, which is based on maximum analyzed steam generator tube plugging, is retained in the TS LCO. Operating within these limits will result in meeting the DNBR criterion in the event of a DNB limited transient. RCS total flow rate contains a measurement error based on performing a precision heat balance and using the result to calibrate the RCS flow rate indicators.The numerical values for pressure, temperature, and flow rate specified in the COLR are given for the measurement location and have been adjusted for instrument error. APPLICABILITY In MODE 1, the limits on pressurizer pressure, RCS coolant average temperature, and RCS flow rate must be maintained during steady state operation in order to ensure DNBR criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient. In all other MODES, the power level is low enough that DNB is not a concern. A Note has been added to indicate the limit on pressurizer pressure is not applicable during short term operational transients such as a THERMAL POWER ramp increase > 5% RTP per minute or a THERMAL POWER step increase > 10% RTP. These conditions represent short term perturbations where actions to control pressure variations might be counterproductive.
Also, since they represent transients initiated from power levels
< 100% RTP, an increased DNBR margin exists to offset the temporary pressure variations.
RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASESAPPLICABILITY  (continued) INDIAN POINT 2 B 3.4.1 - 3 Revision 1 The DNBR limit is provided in SL 2.1.1, "Reactor Core SLs."  The conditions which define the DNBR limit are less restrictive than the limits of this LCO, but violation of a Safety Limit (SL) merits a stricter, more severe Required Action. Should a violation of this LCO occur, the operator must check whether or not an SL may have been exceeded. ACTIONS A.1RCS pressure and RCS average temperature are controllable and measurable parameters. With one or both of these parameters not within LCO limits, action must be taken to restore parameter(s). RCS total flow rate is not a controllable parameter and is not expected to vary during steady state operation. If the indicated RCS total flow rate is below the LCO limit, power must be reduced, as required by Required Action B.1, to restore DNB margin and eliminate the potential for violation of the accident analysis bounds. The 2 hour Completion Time for restoration of the parameters provides sufficient time to adjust plant parameters, to determine the cause for the off normal condition, and to restore the readings within limits, and is based on plant operating experience. B.1If Required Action A.1 is not met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours. In MODE 2, the reduced power condition eliminates the potential for violation of the accident analysis bounds. The Completion Time of 6 hours is reasonable to reach the required plant conditions in an orderly manner.SURVEILLANCE SR  3.4.1.1 REQUIREMENTSSince Required Action A.1 allows a Completion Time of 2 hours to restore parameters that are not within limits, the 12 hour Surveillance Frequency for pressurizer pressure is sufficient to ensure the pressure can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The 12 hour interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.
RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.4.1 - 4 Revision 1 SR  3.4.1.2Since Required Action A.1 allows a Completion Time of 2 hours to restore parameters that are not within limits, the 12 hour Surveillance Frequency for RCS average temperature is sufficient to ensure the temperature can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The 12 hour interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.SR  3.4.1.3The 12 hour Surveillance Frequency for RCS total flow rate is performed using the installed flow instrumentation. The 12 hour interval has been shown by operating practice to be sufficient to regularly assess potential degradation and to verify operation within safety analysis assumptions. SR 3.4.1.4Measurement of RCS total flow rate by performance of a precision calorimetric heat balance once every 24 months allows the installed RCS flow instrumentation to be calibrated and verifies the actual RCS flow rate is greater than or equal to the minimum required RCS flow rate. The Frequency of 24 months reflects the importance of verifying flow after a refueling outage when the core has been altered, which may have caused an alteration of flow resistance. This SR is modified by a Note that allows entry into MODE 1, without having performed the SR, and placement of the unit in the best condition for performing the SR. The Note states that the SR is not required to be performed until 24 hours after  90% RTP. This exception is appropriate since the heat balance requires the plant to be at a minimum of 90% RTP to obtain the stated RCS flow accuracies. The Surveillance shall be performed within 24 hours after reaching 90% RTP. REFERENCES 1. UFSAR, Section 14.
RCS Minimum Temperature for Criticality B 3.4.2    INDIAN POINT 2 B 3.4.2 - 1 Revision 0 B 3.4  REACTOR COOLANT SYSTEM (RCS) B 3.4.2 RCS Minimum Temperature for Criticality BASES BACKGROUND This LCO is based upon meeting several major considerations before the reactor can be made critical and while the reactor is critical.
 
The first and limiting consideration is moderator temperature coefficient (MTC), LCO 3.1.3, "Moderator Temperature Coefficient (MTC)."  In the transient and accident analyses, the MTC is assumed to be zero or negative and the operating temperature is assumed to be within the nominal operating envelope while the reactor is critical. The LCO on minimum temperature for criticality helps ensure the plant is operated consistent with these assumptions.
 
The second consideration is the protective instrumentation. Because certain protective instrumentation (e.g., excore neutron detectors) can be affected by moderator temperature, a temperature value within the nominal operating envelope is chosen to ensure proper indication and response while the reactor is critical.
 
The third consideration is the pressurizer operating characteristics. The transient and accident analyses assume that the pressurizer is within its normal startup and operating range (i.e., saturated conditions and steam bubble present). It is also assumed that the RCS temperature is within its normal expected range for startup and power operation. Since the density of the water, and hence the response of the pressurizer to transients, depends upon the initial temperature of the moderator, a minimum value for moderator temperature within the nominal operating envelope is chosen.
 
The fourth consideration is that the reactor vessel is above its minimum nil ductility reference temperature when the reactor is critical. APPLICABLE SAFETY ANALYSES Although the RCS minimum temperature for criticality is not itself an initial condition assumed in Design Basis Accidents (DBAs), the closely aligned temperature for hot zero power (HZP) is a process variable that is an initial condition of DBAs, such as the rod cluster control assembly (RCCA) withdrawal, RCCA ejection, and main steam line break accidents performed at zero power that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier.
RCS Minimum Temperature for Criticality B 3.4.2  BASES APPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.4.2 - 2 Revision 0 All low power safety analyses assume initial RCS loop temperatures  the HZP temperature of 547F (Ref. 1). The minimum temperature for criticality limitation provides a small band, 6F, for critical operation below HZP. This band allows critical operation below HZP during plant startup and does not adversely affect any safety analyses since the MTC is not significantly affected by the small temperature difference between HZP and the minimum temperature for criticality.
 
The RCS minimum temperature for criticality satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). LCO Compliance with the LCO ensures that the reactor will not be made or maintained critical (k eff  1.0) at a temperature less than a small band below the HZP temperature, which is assumed in the safety analysis. Failure to meet the requirements of this LCO may produce initial conditions inconsistent with the initial conditions assumed in the safety analysis.
APPLICABILITY In MODE 1 and MODE 2 with k eff 1.0, LCO 3.4.2 is applicable since the reactor can only be critical (k eff  1.0) in these MODES.
The special test exception of LCO 3.1.8, "PHYSICS TESTS Exceptions -
MODE 2," permits PHYSICS TESTS to be performed at  5% RTP with RCS loop average temperatures slightly lower than normally allowed so that fundamental nuclear characteristics of the core can be verified. In order for nuclear characteristics to be accurately measured, it may be necessary to operate outside the normal restrictions of this LCO. For example, to measure the MTC at beginning of cycle, it is necessary to allow RCS loop average temperatures to fall below Tno load, which may cause RCS loop average temperatures to fall below the temperature limit of this LCO.
ACTIONS A.1 If the parameters that are outside the limit cannot be restored, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 2 with K eff < 1.0 within 30 minutes. Rapid reactor shutdown can be readily and practically achieved within a 30 minute period. The allowed time is reasonable, based on operating experience, to reach MODE 2 with K eff < 1.0 in an orderly manner and without challenging plant systems.
RCS Minimum Temperature for Criticality B 3.4.2  BASES  INDIAN POINT 2 B 3.4.2 - 3 Revision 0 SURVEILLANCE SR  3.4.2.1 REQUIREMENTS RCS loop average temperature is required to be verified at or above 541F every 12 hours. The SR to verify RCS loop average temperatures every 12 hours takes into account indications and alarms that are continuously available to the operator in the control room and is consistent with other routine Surveillances which are typically performed once per shift. In addition, operators are trained to be sensitive to RCS temperature during approach to criticality and will ensure that the minimum temperature for criticality is met as criticality is approached.
REFERENCES 1. UFSAR, Section 14.
RCS P/T LimitsB 3.4.3INDIAN POINT 2B 3.4.3 - 1Revision 2B 3.4  REACTOR COOLANT SYSTEM (RCS)B 3.4.3RCS Pressure and Temperature (P/T) LimitsBASESBACKGROUNDAll components of the RCS are designed to withstand effects of cyclicloads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.Figure 3.4.3-1, "Heatup Limitations for the Reactor Coolant System (RCS)and Hydrostatic and Inservice Leak Testing Limitations for the RCS," andFigure 3.4.3-2, "Cooldown Limitations for the RCS (including RCS cooldown following RCS inservice leak and hydrostatic testing)," contain P/T limit curves for heatup, cooldown, inservice leak and hydrostatic(ISLH) testing, and data for the maximum rate of change of reactorcoolant temperature (References 1 and 8 ).Each P/T limit curve defines an acceptable region for normal operation.The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine thatoperation is within the allowable region.Vacuum fill of the RCS isperformed in Mode 5 under sub-atmospheric pressure and isothermal RCS conditions. Vacuum fill is an acceptable condition since the resulting pressure/temperature combination is located in the region to the right and below the operating limits provided in Figures 3.4.3-1 and 3.4.3-
 
2.The LCO establishes operating limits that provide a margin to brittlefailure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the pressurizer, which has different design characteristics and operating functions.10 CFR 50, Appendix G (Ref. 2), requires the establishment of P/T limitsfor specific material fracture toughness requirements of the RCPB materials. Reference 2 requires an adequate margin to brittle failureduring normal operation, anticipated operational occurrences, and systemhydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code, Section III, Appendix G (Ref. 3).The neutron embrittlement effect on the material toughness is reflected byincreasing the nil ductility reference temperature (RT NDT) as exposure toneutron fluence increases.
RCS P/T LimitsB 3.4.3BASESBACKGROUND  (continued)INDIAN POINT 2B 3.4.3 - 2Revision 2The actual shift in the RTNDT of the vessel material will be establishedperiodically by removing and evaluating the irradiated reactor vesselmaterial specimens, in accordance with ASTM E 185 (Ref. 4) and Appendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curves will be adjusted, as necessary, based on the evaluation findings and the recommendations of Regulatory Guide 1.99 (Ref. 6).The P/T limit curves are composite curves established by superimposinglimits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the P/T limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.The heatup curve represents a different set of restrictions than thecooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.The criticality limit curve has been removed from the figures: minimumcriticality is now covered under TS 3.4.2.The consequence of violating the LCO limits is that the RCS has beenoperated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components.
The ASME Code, Section XI, Appendix E (Ref. 7), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.APPLICABLE SAFETY ANALYSESThe P/T limits are not derived from Design Basis Accident (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, an unanalyzed condition. Reference 1 establishes the RCS P/T LimitsB 3.4.3BASESAPPLICABLE SAFETY ANALYSES  (continued)INDIAN POINT 2B 3.4.3 - 3Revision 2methodology for determining the P/T limits. Although the P/T limits arenot derived from any DBA, the P/T limits are acceptance limits since they preclude operation in an unanalyzed condition.RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCOThe two elements of this LCO are:
: a. The limit curves (Figures 3.4.3-1 and 3.4.3-2) for heatup, cooldown,and ISLH testing andb. Limits on the rate of change of temperature (Figures 3.4.3-1 and3.4.3-2).The LCO limits apply to all components of the RCS pressure boundary,except the pressurizer. These limits define allowable operating regions and permit a large number of operating cycles while providing a wide margin to nonductile failure.Heatup and cooldown limits are specified in hourly increments (i.e., theheatup and cooldown limits are based on the temperature change averaged over a one hour period). Limit lines for cooldown rates between those presented may be obtained by interpolation. The maximum heatup or cooldown rate is 100F/hour.The limits for the rate of change of temperature control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and ISLH testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.Violating the LCO limits places the reactor vessel outside of the bounds ofthe stress analyses and can increase stresses in other RCPB components. The consequences depend on several factors, as follow:a. The severity of the departure from the allowable operating P/Tregime or the severity of the rate of change of temperature,b. The length of time the limits were violated (longer violations allowthe temperature gradient in the thick vessel walls to become morepronounced), and RCS P/T LimitsB 3.4.3BASESLCO  (continued)INDIAN POINT 2B 3.4.3 - 4Revision 2c. The existences, sizes, and orientations of flaws in the vesselmaterial.Figures 3.4.3-1 and 3.4.3-2 must be revised using approved methodologyprior to exceeding  48 EFPYs.APPLICABILITYThe RCS P/T limits LCO provides a definition of acceptable operation for prevention of nonductile failure in accordance with 10 CFR 50, Appendix G (Ref. 2). Although the P/T limits were developed to provide guidance for operation during heatup or cooldown (MODES 3, 4, and 5) or ISLH testing, their Applicability is at all times in keeping with the concern for nonductile failure. The limits do not apply to the pressurizer.During MODES 1 and 2, other Technical Specifications provide limits foroperation that can be more restrictive than or can supplement these P/T limits. LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits," LCO 3.4.2, "RCS Minimum Temperature for Criticality," and Safety Limit 2.1, "Safety Limits," also provide operational restrictions for pressure and temperature andmaximum pressure. Furthermore, MODES 1 and 2 are above thetemperature range of concern for nonductile failure, and stress analyses have been performed for normal maneuvering profiles, such as power ascension or descent.ACTIONSA.1 and A.2Operation outside the P/T limits during MODE 1, 2, 3, or 4 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.The 30 minute Completion Time of Required Action A.1 reflects theurgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.Required Action A.2 recognizes that besides restoring operation withinlimits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.
RCS P/T LimitsB 3.4.3BASESACTIONS  (continued)INDIAN POINT 2B 3.4.3 - 5Revision 2ASME Code, Section XI, Appendix E (Ref. 7), may be used to support theevaluation. However, its use is restricted to evaluation of the vessel beltline.The 72 hour Completion Time of Required Action A.2 is reasonable toaccomplish the evaluation. The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed before continuing to operate.Condition A is modified by a Note requiring Required Action A.2 to becompleted whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action A.1 is insufficientbecause higher than analyzed stresses may have occurred and may haveaffected the RCPB integrity.B.1 and B.2If a Required Action and associated Completion Time of Condition A arenot met, the plant must be placed in a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. In reduced pressure and temperature conditions, the possibility of propagation with undetected flaws is decreased.If the required restoration activity cannot be accomplished within30 minutes, Required Action B.1 and Required Action B.2 must be implemented to reduce pressure and temperature.If the required evaluation for continued operation cannot be accomplishedwithin 72 hours or the results are indeterminate or unfavorable, action must proceed to reduce pressure and temperature as specified in Required Action B.1 and Required Action B.2. A favorable evaluation must be completed and documented before returning to operatingpressure and temperature conditions.Pressure and temperature are reduced by bringing the plant to MODE 3within 6 hours and to MODE 5 with RCS pressure < 500 psig within 36 hours.
RCS P/T LimitsB 3.4.3BASESACTIONS  (continued)INDIAN POINT 2B 3.4.3 - 6Revision 2The allowed Completion Times are reasonable, based on operatingexperience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.C.1 and C.2Actions must be initiated immediately to correct operation outside of theP/T limits at times other than when in MODE 1, 2, 3, or 4, so that the RCPB is returned to a condition that has been verified by stress analysis.The immediate Completion Time reflects the urgency of initiating action torestore the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.Besides restoring operation within limits, an evaluation is required todetermine if RCS operation can continue. The evaluation must verify that the RCPB integrity remains acceptable and must be completed prior to entry into MODE 4. Several methods may be used, including comparison with  pre-analyzed transients in the stress analyses, or inspection of the components.ASME Code, Section XI, Appendix E (Ref. 7), may be used to support theevaluation. However, its use is restricted to evaluation of the vessel beltline.Condition C is modified by a Note requiring Required Action C.2 to becompleted whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.SURVEILLANCESR  3.4.3.1REQUIREMENTSVerification that operation is within the Figure 3.4.3-1 and Figure 3.4.3-2 limits is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. This Frequency is considered reasonable in view of the control room indication available to monitor RCS status. Also, since temperature rate of change limits are specified in hourly increments, 30 minutes permits assessment and correction for minor deviations within a reasonable time. Heatup and cooldown limits are specified in hourly increments (i.e., the heatup andcooldown limits are based on the temperature change averaged over a RCS P/T LimitsB 3.4.3BASESSURVEILLANCE REQUIREMENTS  (continued)INDIAN POINT 2B 3.4.3 - 7Revision 2one hour period). Limit lines for cooldown rates between those presentedmay be obtained by interpolation.Surveillance for heatup, cooldown, or ISLH testing may be discontinuedwhen the definition given in the relevant plant procedure for ending the activity is satisfied.This SR is modified by a Note that only requires this SR to be performedduring system heatup, cooldown, and ISLH testing. No SR is given for criticality operations because LCO 3.4.2 contains a more restrictive requirement.REFERENCES          1.WCAP-7924A, Basis for Heatup and Cooldown Limit Curves, W.
S. Hazelton, S.L. Anderson, S.E. Yanichko, April 1975.
2.10 CFR 50, Appendix G.
3.ASME, Boiler and Pressure Vessel Code, Section III, Appendix G.
4.ASTM E 185-82, July 1982.5.10 CFR 50, Appendix H.
6.Regulatory Guide 1.99, Revision 2, May 1988.
7.ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E.
8.WCAP-16752-NP, Revision 0, "Indian Point Unit 2 Heatup andCooldown Limit Curves for Normal Operation, " Westinghouse Electric Co, January 2008 RCS Loops - MODES 1 and 2 B 3.4.4 INDIAN POINT 2 B 3.4.4 - 1 Revision 1 B 3.4  REACTOR COOLANT SYSTEM (RCS) B 3.4.4 RCS Loops - MODES 1 and 2 BASESBACKGROUND The primary function of the RCS is removal of the heat generated in the fuel due to the fission process, and transfer of this heat, via the steam generators (SGs), to the secondary plant. The secondary functions of the RCS include:
: a. Moderating the neutron energy level to the thermal state, to increase the probability of fission, b. Improving the neutron economy by acting as a reflector,
: c. Carrying the soluble neutron poison, boric acid,
: d. Providing a second barrier against fission product release to the environment, and e. Removing the heat generated in the fuel due to fission product decay following a unit shutdown. The reactor coolant is circulated through four loops connected in parallel to the reactor vessel, each containing a SG, a reactor coolant pump (RCP),
and appropriate flow and temperature instrumentation for both control and protection. The reactor vessel contains the clad fuel. The SGs provide the heat sink to the isolated secondary coolant. The RCPs circulate the coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage. This forced circulation of the reactor coolant ensures mixing of the coolant for proper boration and chemistry control.APPLICABLE SAFETY ANALYSESSafety analyses contain various assumptions for the design bases accident initial conditions including RCS pressure, RCS temperature, reactor power level, core parameters, and safety system setpoints. The important aspect for this LCO is the reactor coolant forced flow rate, which is represented by the number of RCS loops in service.
RCS Loops - MODES 1 and 2 B 3.4.4 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.4.4 - 2 Revision 1 Both transient and steady state analyses have been performed to establish the effect of flow on the departure from nucleate boiling (DNB). The transient and accident analyses for the plant have been performed assuming four RCS loops are in operation. The majority of the plant safety analyses are based on initial conditions at high core power or zero power. The accident analyses that are most important to RCP operation are the four pump coastdown, single pump locked rotor, single pump (broken shaft or coastdown), and rod withdrawal events (Ref. 1). Steady state DNB analysis has been performed for the four RCS loop operation. For four RCS loop operation, the steady state DNB analysis generates the pressure and temperature Safety Limit (SL) (i.e., the departure from nucleate boiling ratio (DNBR) limit) by assuming a maximum for the power level. This is the design overpower condition for four RCS loop operation. The allowable value for the nuclear overpower (high flux) trip in LCO 3.3.1, "Reactor Protection System (RPS) Instrumentation," is based on this analysis assumption and bounds instrumentation errors. The DNBR limit defines a locus of pressure and temperature points that result in a minimum DNBR greater than or equal to the critical heat flux correlation limit. The plant is designed to operate with all RCS loops in operation to maintain DNBR above the SL, during all normal operations and anticipated transients.
By ensuring heat transfer in the nucleate boiling region, adequate heat transfer is provided between the fuel cladding and the reactor coolant. RCS Loops - MODES 1 and 2 satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). LCOThe purpose of this LCO is to require an adequate forced flow rate for core heat removal. Flow is represented by the number of RCPs in operation for removal of heat by the SGs. To meet safety analysis acceptance criteria for DNB, four pumps are required at rated power. An OPERABLE RCS loop consists of an OPERABLE RCP in operation providing forced flow for heat transport and an OPERABLE SG. APPLICABILITY In MODES 1 and 2, the reactor is critical and thus has the potential to produce maximum THERMAL POWER. Thus, to ensure that the assumptions of the accident analyses remain valid, all RCS loops are required to be OPERABLE and in operation in these MODES to prevent DNB and core damage.
RCS Loops - MODES 1 and 2 B 3.4.4 BASESAPPLICABILITY  (continued) INDIAN POINT 2 B 3.4.4 - 3 Revision 1 The decay heat production rate is much lower than the full power heat rate. As such, the forced circulation flow and heat sink requirements are reduced for lower, noncritical MODES as indicated by the LCOs for MODES 3, 4, and 5. Operation in other MODES is covered by:
LCO 3.4.5, "RCS Loops - MODE 3," LCO 3.4.6, "RCS Loops - MODE 4,"
LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled,"
LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled,"
LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level" (MODE 6), and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level" (MODE 6). ACTIONS A.1If the requirements of the LCO are not met, the Required Action is to reduce power and bring the plant to MODE 3. This lowers power level and thus reduces the core heat removal needs and minimizes the possibility of violating DNB limits. The Completion Time of 6 hours is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging safety systems. SURVEILLANCE SR  3.4.4.1 REQUIREMENTSThis SR requires verification every 12 hours that each RCS loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal while maintaining the margin to DNB. The Frequency of 12 hours is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS loop performance. REFERENCES 1. UFSAR, Section 14.
RCS Loops - MODE 3 B 3.4.5 INDIAN POINT 2 B 3.4.5 - 1 Revision 1 B 3.4  REACTOR COOLANT SYSTEM (RCS) B 3.4.5 RCS Loops - MODE 3 BASESBACKGROUND In MODE 3, the primary function of the reactor coolant is removal of decay heat and transfer of this heat, via the steam generator (SG), to the secondary plant fluid. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid. The reactor coolant is circulated through four RCS loops, connected in parallel to the reactor vessel, each containing an SG, a reactor coolant pump (RCP), and appropriate flow, pressure, and temperature instrumentation for control, protection, and indication. The reactor vessel contains the clad fuel.
The SGs provide the heat sink. The RCPs circulate the water through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage. In MODE 3, RCPs are used to provide forced circulation for heat removal during heatup and cooldown. The MODE 3 decay heat removal requirements are low enough that a single RCS loop with one RCP running is sufficient to remove core decay heat. However, two RCS loops are required to be OPERABLE to ensure redundant capability for decay heat removal.APPLICABLE SAFETY ANALYSESWhenever the reactor trip breakers (RTBs) are in the closed position and the control rod drive mechanisms (CRDMs) are energized, an inadvertent rod withdrawal from subcritical, resulting in a power excursion, is possible. Such a transient could be caused by a malfunction of the rod control system. Therefore, in MODE 3 with the Rod Control System capable of rod withdrawal, uncontrolled control rod withdrawal from subcritical is postulated and requires at least two RCS loops to be OPERABLE and in operation to ensure that the accident analyses limits are met. For those conditions when the Rod Control System is not capable of rod withdrawal, two RCS loops are required to be OPERABLE, but only one RCS loop is required to be in operation to be consistent with MODE 3 accident analyses. Failure to provide decay heat removal may result in challenges to a fission product barrier. The RCS loops are part of the primary success path that functions or actuates to prevent or mitigate a Design Basis Accident or transient that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier.
RCS Loops - MODE 3 B 3.4.5 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.4.5 - 2 Revision 1 RCS Loops - MODE 3 satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCOThe purpose of this LCO is to require that at least two RCS loops be OPERABLE. In MODE 3 with the Rod Control System capable of rod withdrawal, two RCS loops must be in operation. Two RCS loops are required to be in operation in MODE 3 with the Rod Control System capable of rod withdrawal due to the postulation of a power excursion because of an inadvertent control rod withdrawal. The required number of RCS loops in operation ensures that the Safety Limit criteria will be met for all of the postulated accidents. When the Rod Control System is not capable of rod withdrawal, only one RCS loop in operation is necessary to ensure removal of decay heat from the core and homogenous boron concentration throughout the RCS. An additional RCS loop is required to be OPERABLE to ensure redundant forced circulation capability for decay heat removal. The Note permits all RCPs to be removed from operation for  1 hour per 8 hour period. The purpose of the Note is to perform tests that are designed to validate various accident analyses values. One of these tests is validation of the pump coastdown curve used as input to a number of accident analyses including a loss of flow accident. This test is generally performed in MODE 3 during the initial startup testing program, and as such should only be performed once. If, however, changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values of the coastdown curve must be revalidated by conducting the test again. Another test performed during the startup testing program is the validation of rod drop times during cold conditions, both with and without
 
flow.The no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits the stopping of the pumps in order to perform this test and validate the assumed analysis values. As with the validation of the pump coastdown curve, this test should be performed only once unless the flow characteristics of the RCS are changed. The 1 hour time period specified is adequate to perform the desired tests, and operating experience has shown that boron stratification is not a problem during this short period with no forced flow.
RCS Loops - MODE 3 B 3.4.5 BASESLCO  (continued) INDIAN POINT 2 B 3.4.5 - 3 Revision 1 Utilization of the Note is permitted provided the following conditions are met, along with any other conditions imposed by test or maintenance procedures: a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1, thereby maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation. This Note does not prohibit injection into the RCS of water with a boron concentration that is equal to or greater than the minimum boron concentration needed to meet the SDM requirement in LCO 3.1.1 even if the water being injected has a lower boron concentration than the water already in the RCS. b. Core outlet temperature is maintained at least 10F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction. An OPERABLE RCS loop consists of one OPERABLE RCP and one OPERABLE SG which has the minimum water level specified in SR 3.4.5.2.
An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required. APPLICABILITY In MODE 3, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. The most stringent condition of the LCO, that is, two RCS loops OPERABLE and two RCS loops in operation, applies to MODE 3 with the Rod Control System capable of rod withdrawal. The least stringent condition, that is, two RCS loops OPERABLE and one RCS loop in operation, applies to MODE 3 with the Rod Control System not capable of rod withdrawal. Operation in other MODES is covered by:
LCO 3.4.4, "RCS Loops - MODES 1 and 2," LCO 3.4.6, "RCS Loops - MODE 4,"
LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled,"
LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled,"
RCS Loops - MODE 3 B 3.4.5 BASESAPPLICABILITY  (continued) INDIAN POINT 2 B 3.4.5 - 4 Revision 1 LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level" (MODE 6), and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level" (MODE 6). ACTIONS A.1If one required RCS loop is inoperable, redundancy for forced circulation heat removal is lost. The Required Action is restoration of the required RCS loop to OPERABLE status within the Completion Time of 72 hours. This time allowance is a justified period to be without the redundant, nonoperating loop because a single loop in operation has a heat transfer capability greater than that needed to remove the decay heat produced in the reactor core and because of the low probability of a failure in the remaining loop occurring during this period. B.1If restoration for Required Action A.1 is not possible within 72 hours, the unit must be brought to MODE 4. In MODE 4, the unit may be placed on the Residual Heat Removal System. The additional Completion Time of 12 hours is compatible with required operations to achieve cooldown and depressurization from the existing plant conditions in an orderly manner and without challenging plant systems. C.1 and C.2If only one RCS loop is in operation and the Rod Control System is capable of rod withdrawal, the Required Action is either: restore the required RCS loop to operation; or, place the Rod Control System in a condition incapable of rod withdrawal (e.g., de-energize all CRDMs by opening the RTBs or de-energizing the motor generator (MG) sets). These actions are necessary because the analysis of an uncontrolled rod cluster control assembly withdrawal from a subcritical condition assumes at least two RCPs are in operation. The Completion Times of 1 hour, to restore the required RCS loop to operation or defeat the Rod Control System is adequate to perform these operations in an orderly manner without exposing the unit to risk for an undue time period.
RCS Loops - MODE 3 B 3.4.5 BASESACTIONS  (continued) INDIAN POINT 2 B 3.4.5 - 5 Revision 1 D.1, D.2, and D.3If the two required RCS loops are inoperable or a required RCS loop is not in operation, except during conditions permitted by the Note in the LCO section, the Rod Control System must be placed in a condition incapable of rod withdrawal (e.g., all CRDMs must be de-energized by opening the RTBs or de-energizing the MG sets). All operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended, and action to restore one of the RCS loops to OPERABLE status and operation must be initiated.
Action D.2 does not prohibit injection into the RCS of water with a boron concentration that is equal to or greater than the minimum boron concentration needed to meet the SDM requirement in LCO 3.1.1 even if the water being injected has a lower boron concentration than the water already in the RCS.These actions are necessary because boron dilution requires forced circulation for proper mixing. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Time reflects the importance of maintaining operation for forced circulation heat removal.
The action to restore must be continued until one loop is restored to OPERABLE status and operation. SURVEILLANCE SR  3.4.5.1 REQUIREMENTSThis SR requires verification every 12 hours that the required loops are in operation. Verification includes flow rate, temperature, and pump status monitoring, which ensure that forced flow is maintained. The Frequency of 12 hours is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS loop performance. SR  3.4.5.2SR 3.4.5.2 requires verification of SG OPERABILITY. SG OPERABILITY is verified by ensuring that thesecondary side SG water level is greater than or equal to 0% narrow range. This acceptance criteria is the minimum observable level that ensures the SG tubes are covered. Depending on plant conditions, either wide range or narrow range SG level instruments may be used to verify this SR is met. Operators may be required to adjust the indicated level to compensate for the effects of SG temperature. If SG RCS Loops - MODE 3 B 3.4.5 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.4.5 - 6 Revision 1 level is less than this limit, the tubes may become uncovered and the associated loop may not be capable of providing the heat sink for removal of the decay heat. The 12 hour Frequency is considered adequate in view of other indications available in the control room to alert the operator to a loss of SG level. SR  3.4.5.3Verification that each required RCP is OPERABLE ensures that redundant forced circulation capability is available for decay heat removal. The requirement ensures that an additional RCP can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation.
Verification is performed by verifying proper breaker alignment and power availability to each required RCP. If a pump is in operation, this constitutes verification of proper breaker alignment and power availability. This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation. REFERENCES None.
RCS Loops - MODE 4 B 3.4.6 INDIAN POINT 2 B 3.4.6 - 1 Revision 1 B 3.4  REACTOR COOLANT SYSTEM (RCS) B 3.4.6 RCS Loops - MODE 4 BASESBACKGROUND In MODE 4, the primary function of the reactor coolant is the removal of decay heat and the transfer of this heat to either the steam generator (SG) secondary side coolant or the component cooling water via the residual heat removal (RHR) heat exchangers. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid. The reactor coolant is circulated through four RCS loops connected in parallel to the reactor vessel, each loop containing an SG, a reactor coolant pump (RCP), and appropriate flow, pressure, and temperature instrumentation for control, protection, and indication. Each RHR loop consists of one RHR pump and one RHR heat exchanger as well as associated piping and valves to transfer heat between the RHR heat exchanger and the core. Although either RHR heat exchanger may be credited for either RHR loop, one RHR heat exchanger must be OPERABLE for each OPERABLE RHR loop. One RCP or one RHR pump circulates the coolant through the reactor vessel at a sufficient rate to ensure proper heat transfer and to prevent boric acid stratification. In MODE 4, either RCPs or RHR loops can be used to provide forced circulation. The intent of this LCO is to provide forced flow from at least one RCP or one RHR loop for decay heat removal and transport. The flow provided by one RCP loop or RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that two paths be available to provide redundancy for decay heat removal. APPLICABLE SAFETY ANALYSESIn MODE 4, RCS circulation is considered in the determination of the time available for mitigation of the accidental boron dilution event. The RCS and RHR loops provide this circulation. RCS Loops - MODE 4 satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). LCOThe purpose of this LCO is to require that at least two loops be OPERABLE in MODE 4 and that one of these loops be in operation. The LCO allows the two loops that are required to be OPERABLE to consist of any combination of RCS loops and RHR loops. Any one loop in operation provides enough RCS Loops - MODE 4 B 3.4.6 BASESLCO  (continued) INDIAN POINT 2 B 3.4.6 - 2 Revision 1 flow to remove the decay heat from the core with forced circulation. An additional loop is required to be OPERABLE to provide redundancy for heat removal.Note 1 permits all RCPs and RHR pumps to be removed from operation for  1 hour per 8 hour period. The purpose of the Note is to permit tests that are designed to validate various accident analyses values. One of the tests performed during the startup testing program is the validation of rod drop times during cold conditions, both with and without flow. The no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits the stopping of the pumps in order to perform this test and validate the assumed analysis values. If changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values must be revalidated by conducting the test again. The 1 hour time period is acceptable because operating experience has shown that boron stratification is not a problem during this short period with no forced flow. Utilization of Note 1 is permitted provided the following conditions are met along with any other conditions imposed by maintenance or test procedures: a. No operations are permitted that would dilute the RCS boron concentration with coolant with boron concentrations less than required to meet SDM of LCO 3.1.1, therefore maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation. This Note does not prohibit injection into the RCS of water with a boron concentration that is equal to or greater than the minimum boron concentration needed to meet the SDM requirement in LCO 3.1.1 even if the water being injected has a lower boron concentration than the water already in the RCS. b. Core outlet temperature is maintained at least 10F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction. Note 2 requires that the reactor coolant pump starting requirements of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP)", must be met if RCS temperature is less than or equal to the LTOP Applicability temperature. This restraint is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.
RCS Loops - MODE 4 B 3.4.6 BASESLCO  (continued) INDIAN POINT 2 B 3.4.6 - 3 Revision 1 An OPERABLE RCS loop comprises an OPERABLE RCP and an OPERABLE SG which has the minimum water level specified in SR 3.4.6.2. An OPERABLE RHR loop consists of one OPERABLE RHR pump and one OPERABLE RHR heat exchanger as well as associated piping and valves to transfer heat between the RHR heat exchanger and the core. Although either RHR heat exchanger may be credited for either RHR loop, one RHR heat exchanger must be OPERABLE for each OPERABLE RHR loop. RCPs and RHR pumps are OPERABLE if they are capable of being powered and are able to provide forced flow if required. APPLICABILITY In MODE 4, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. One loop of either RCS or RHR provides sufficient circulation for these purposes.
However, two loops consisting of any combination of RCS and RHR loops are required to be OPERABLE to meet single failure considerations. Operation in other MODES is covered by:
LCO 3.4.4, "RCS Loops - MODES 1 and 2," LCO 3.4.5, "RCS Loops - MODE 3,"
LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled,"
LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled,"
LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level" (MODE 6), and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level" (MODE 6). ACTIONS A.1If one required loop is inoperable, redundancy for heat removal is lost.
Action must be initiated to restore a second RCS or RHR loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
RCS Loops - MODE 4 B 3.4.6 BASESACTIONS  (continued) INDIAN POINT 2 B 3.4.6 - 4 Revision 1 A.2If restoration is not accomplished and an RHR loop is OPERABLE, the unit must be brought to MODE 5 within 24 hours. Bringing the unit to MODE 5 is a conservative action with regard to decay heat removal. With only one RHR loop OPERABLE, redundancy for decay heat removal is lost and, in the event of a loss of the remaining RHR loop, it would be safer to initiate that loss from MODE 5 rather than MODE 4. The Completion Time of 24 hours is a reasonable time, based on operating experience, to reach MODE 5 from MODE 4 in an orderly manner and without challenging plant systems. This Required Action is modified by a Note, which indicates that the unit must be placed in MODE 5 only if a RHR loop is OPERABLE. With no RHR loop OPERABLE, the unit is in a condition with only limited cooldown capabilities. Therefore, the actions are to be concentrated on the restoration of a RHR loop, rather than a cooldown of extended duration. B.1 and B.2If two required loops are inoperable or a required loop is not in operation, except during conditions permitted by Note 1 in the LCO section, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RCS or RHR loop to OPERABLE status and operation must be initiated. Action B.2 does not prohibit injection into the RCS of water with a boron concentration that is equal to or greater than the minimum boron concentration needed to meet the SDM requirement in LCO 3.1.1 even if the water being injected has a lower boron concentration than the water already in the RCS. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. When coolant is added without forced circulation, unmixed coolant could be introduced to the core, however coolant with boron concentration sufficient to meet minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Times reflect the importance of maintaining operation for decay heat removal. The action to restore must be continued until one loop is restored to OPERABLE status and operation.
RCS Loops - MODE 4 B 3.4.6 BASESINDIAN POINT 2 B 3.4.6 - 5 Revision 1 SURVEILLANCE SR  3.4.6.1 REQUIREMENTSThis SR requires verification every 12 hours that the required RCS or RHR loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, which ensure that forced flow is providing heat removal. The Frequency of 12 hours is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS and RHR loop performance. SR  3.4.6.2SR 3.4.6.2 requires verification of SG OPERABILITY. SG OPERABILITY is verified by ensuring that the secondary side SG water level is greater than or equal to 0% narrow range. This acceptance criteria is the minimum observable level that ensures the SG tubes are covered. Depending on plant conditions, either wide range or narrow range SG level instruments may be used to verify this SR is met. Operators may be required to adjust the indicated level to compensate for the effects of SG temperature. If SG level is less than this limit, the tubes may become uncovered and the associated loop may not be capable of providing the heat sink necessary for removal of decay heat. The 12 hour Frequency is considered adequate in view of other indications available in the control room to alert the operator to the loss of SG level. SR  3.4.6.3Verification that each required pump is OPERABLE ensures that an additional RCS or RHR pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to each required pump. Alternatively, verification that a pump is in operation also verifies proper breaker alignment and power availability. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation. REFERENCES None.
RCS Loops - MODE 5, Loops Filled B 3.4.7 INDIAN POINT 2 B 3.4.7 - 1 Revision 2 B 3.4  REACTOR COOLANT SYSTEM (RCS) B 3.4.7 RCS Loops - MODE 5, Loops Filled BASESBACKGROUND In MODE 5 with the RCS loops filled, the primary function of the reactor coolant is the removal of decay heat and transfer this heat either to the steam generator (SG) secondary side coolant via natural circulation (Ref. 1) or the component cooling water via the residual heat removal (RHR) heat exchangers. While the principal means for decay heat removal is via the RHR System, the SGs via natural circulation (Ref. 1) are specified as a backup means for redundancy. Even though the SGs cannot produce steam in this MODE, they are capable of being a heat sink due to their large contained volume of secondary water. As long as the SG secondary side water is at a lower temperature than the reactor coolant, heat transfer will occur. The rate of heat transfer is directly proportional to the temperature difference. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid. In MODE 5 with RCS loops filled, the reactor coolant is circulated by means of two RHR loops connected to the RCS, each loop containing an RHR heat exchanger, an RHR pump, and appropriate flow and temperature instrumentation for control, protection, and indication. One RHR pump circulates the water through the RCS at a sufficient rate to prevent boric acid stratification.The number of loops in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one RHR loop for decay heat removal and transport. The flow provided by one RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that a second path be available to provide redundancy for heat removal. The LCO provides for redundant paths of decay heat removal capability. The first path can be an RHR loop that must be OPERABLE and in operation. An RHR loop consists of one RHR pump and one RHR heat exchanger as well as associated piping and valves to transfer heat between the RHR heat exchanger and the core. Although either RHR heat exchanger may be credited for either RHR loop, one RHR heat exchanger must be OPERABLE for each OPERABLE RHR loop. The second path can be another OPERABLE RHR loop or maintaining two SGs with secondary side water levels  0% narrow range to provide an alternate method for decay heat removal via natural circulation (Ref. 1).
RCS Loops - MODE 5, Loops Filled B 3.4.7 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.4.7 - 2 Revision 2 When using SGs depending on natural circulation as the backup decay heat removal system in MODE 5, consideration should be given to the potential need for the following:(1) the ability to pressurize and control pressure in the RCS; (2) secondary side water level in the SG relied upon for decay heat removal,(3) availability of a supply of feedwater, and (4) availability of an auxiliary feedwater pump capable of injecting into the relied-upon SGs (Ref. 1).During natural circulation, the SGs secondary side water may boil creating the need to release steam through the atmospheric relief valves or other openings that may exist during shutdown conditions. Therefore, consideration should be given to avoiding the potential for pressurization of the SGs secondary side. It is also important to note that during the decay heat removal using natural circulation, a MODE change (MODE 5 to MODE 4) could occur due to heat up of the RCS (Ref. 1). APPLICABLE SAFETY ANALYSESIn MODE 5, RCS circulation is considered in the determination of the time available for mitigation of the accidental boron dilution event. The RHR loops provide this circulation. RCS Loops - MODE 5 (Loops Filled) satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). LCOThe purpose of this LCO is to require that at least one of the RHR loops be OPERABLE and in operation with an additional RHR loop OPERABLE or two SGs with secondary side water level  0% narrow range. One RHR loop provides sufficient forced circulation to perform the safety functions of the reactor coolant under these conditions. An additional RHR loop is required to be OPERABLE to meet single failure considerations. However, if the standby RHR loop is not OPERABLE, an acceptable alternate method is two SGs with their secondary side water levels  0% narrow range. Should the operating RHR loop fail, the SGs could be used to remove the decay heat via natural circulation.
RCS Loops - MODE 5, Loops Filled B 3.4.7 BASESLCO  (continued) INDIAN POINT 2 B 3.4.7 - 3 Revision 2 Note 1 permits all RHR pumps to be removed from operation for  1 hour per 8 hour period. The purpose of the Note is to permit tests designed to validate various accident analyses values. One of the tests performed during the startup testing program is the validation of rod drop times during cold conditions, both with and without flow. The no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits stopping of the pumps in order to perform this test and validate the assumed analysis values. If changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values must be revalidated by conducting the test again.
The 1 hour time period is acceptable because operating experience has shown that boron stratification is not likely during this short period with no forced flow. Utilization of Note 1 is permitted provided the following conditions are met, along with any other conditions imposed by test or maintenance procedures: a. No operations are permitted that would dilute the RCS boron concentration with coolant with boron concentrations less than required to meet SDM of LCO 3.1.1, therefore maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation. This Note does not prohibit injection into the RCS of water with a boron concentration that is equal to or greater than the minimum boron concentration needed to meet the SDM requirement in LCO 3.1.1 even if the water being injected has a lower boron concentration than the water already in the RCS.b. Core outlet temperature is maintained at least 10F below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction. Note 2 allows one RHR loop to be inoperable for a period of up to 2 hours, provided that the other RHR loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when such testing is safe and possible. Note 3 requires that the reactor coolant pump starting requirements of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP)," be met if RCS temperature is less than or equal to the LTOP Applicability temperature specified in LCO 3.4.12. This restriction is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.
RCS Loops - MODE 5, Loops Filled B 3.4.7 BASESLCO  (continued) INDIAN POINT 2 B 3.4.7 - 4 Revision 2 Note 4 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting removal of RHR loops from operation when at least one RCS loop is in operation. This Note provides for the transition to MODE 4 where an RCS loop is permitted to be in operation and replaces the RCS circulation function provided by the RHR loops. RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. A SG can perform as a heat sink via natural circulation when it has an adequate water level and is OPERABLE. If the SGs being credited as the redundant method of decay heat removal depend on natural circulation (Ref. 1) for decay heat removal, the SGs are considered OPERABLE only if: a. RCS loop and reactor pressure vessel filling and venting was completed during startup or pressurizer level has been maintained > 10% to assure no draining of SG tubes, b. The ability to pressurize and control pressure in the RCS to > 100 psig is maintained to control the potential for flashing and void formation at the top of the SG tubes; and, c. The Condensate Storage Tank (CST) and the motor driven auxiliary feedwater pump(s) associated with the credited SGs is operable. Additionally, the level indication in the pressurizer should be monitored since an unexplained rise in level could be indicative of non-condensable gases coming out of solution. APPLICABILITY In MODE 5 with RCS loops filled, this LCO requires forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. One loop of RHR provides sufficient circulation for these purposes. However, one additional RHR loop is required to be OPERABLE, or the secondary side water level of at least two SGs is required to be 0% narrow range. Operation in other MODES is covered by:
LCO 3.4.4, "RCS Loops - MODES 1 and 2;" LCO 3.4.5, "RCS Loops - MODE 3;"
RCS Loops - MODE 5, Loops Filled B 3.4.7 BASESAPPLICABILITY (continued) INDIAN POINT 2 B 3.4.7 - 5 Revision 2 LCO 3.4.6, "RCS Loops - MODE 4;" LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled;"
LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level" (MODE 6), and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level" (MODE 6).
ACTIONSA.1, A.2, B.1 and B.2If one RHR loop is OPERABLE and the required SGs have secondary side water levels < 0% narrow range, redundancy for heat removal is lost. Action must be initiated immediately to restore a second RHR loop to OPERABLE status or to restore the secondary side water levels to within limits for the required SGs. Either Required Action will restore redundant heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal. C.1 and C.2If a required RHR loop is not in operation, except during conditions permitted by Note 1, or if no required loop is OPERABLE, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RHR loop to OPERABLE status and operation must be initiated.Action C.1 does not prohibit injection into the RCS of water with a boron concentration that is equal to or greater than the minimum boron concentration needed to meet the SDM requirement in LCO 3.1.1 even if the water being injected has a lower boron concentration than the water already in the RCS. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Times reflect the importance of maintaining operation for heat removal.
RCS Loops - MODE 5, Loops Filled B 3.4.7 BASESINDIAN POINT 2 B 3.4.7 - 6 Revision 2 SURVEILLANCE SR  3.4.7.1 REQUIREMENTSThis SR requires verification every 12 hours that the required loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, which ensures that forced flow is maintained. The Frequency of 12 hours is sufficient considering other indications and alarms available to the operator in the control room to monitor RHR loop performance. SR  3.4.7.2Verifying that at least two SGs are OPERABLE by ensuring their secondary side SG water level is greater than or equal to 0% narrow range. This acceptance criteria is the minimum level that ensures the SG tubes are covered. Depending on plant conditions, either wide range or narrow range SG level instruments may be used to verify this SR is met. Operators may be required to adjust the indicated level to compensate for the effects of SG temperature. SG level above this limit ensures an alternate decay heat removal method via natural circulation in the event that the second RHR loop is not OPERABLE. If both RHR loops are OPERABLE, this Surveillance is not needed. The 12 hour Frequency is considered adequate in view of other indications available in the control room to alert the operator to the loss of SG level. SR  3.4.7.3Verification that each required RHR pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to each required RHR pump. Alternatively, verification that a pump is in operation also verifies proper breaker alignment and power availability. If secondary side water level is above the minimum level required by SR 3.4.7.2 in at least two SGs, this Surveillance is not needed. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience. This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation. REFERENCES 1. NRC Information Notice 95-35, "Degraded Ability of Steam Generators to Remove Decay Heat by Natural Circulation."
RCS Loops - MODE 5, Loops Not Filled B 3.4.8    INDIAN POINT 2 B 3.4.8 - 1 Revision 0 B 3.4  REACTOR COOLANT SYSTEM (RCS) B 3.4.8 RCS Loops - MODE 5, Loops Not Filled BASES BACKGROUND In MODE 5 with the RCS loops not filled, the primary function of the reactor coolant is the removal of decay heat generated in the fuel, and the transfer of this heat to the component cooling water via the residual heat removal (RHR) heat exchangers. The steam generators (SGs) are not available as a heat sink when the loops are not filled. The secondary function of the reactor coolant is to act as a carrier for the soluble neutron poison, boric acid.
 
In MODE 5 with loops not filled, only RHR pumps can be used for coolant circulation. The number of pumps in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one RHR pump for decay heat removal and transport and to require that two loops be available to provide redundancy for heat removal.
 
An RHR loop consists of one RHR pump and one RHR heat exchanger as well as associated piping and valves to transfer heat between the RHR heat exchanger and the core. Although either RHR heat exchanger may be credited for either RHR loop, one RHR heat exchanger must be OPERABLE for each OPERABLE RHR loop.
APPLICABLE SAFETY ANALYSES In MODE 5, RCS circulation is considered in the determination of the time available for mitigation of the accidental boron dilution event. The RHR loops provide this circulation. The flow provided by one RHR loop is adequate for heat removal and for boron mixing.
 
RCS loops in MODE 5 (loops not filled) satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). LCO The purpose of this LCO is to require that at least two RHR loops be OPERABLE and one of these loops be in operation. An OPERABLE loop is one that has the capability of transferring heat from the reactor coolant at a controlled rate. Heat cannot be removed via the RHR System unless forced flow is used. A minimum of one running RHR pump meets the LCO requirement for one loop in operation. An additional RHR loop is required to be OPERABLE to meet redundancy considerations.
RCS Loops - MODE 5, Loops Not Filled B 3.4.8  BASES LCO  (continued) INDIAN POINT 2 B 3.4.8 - 2 Revision 0 Note 1 permits all RHR pumps to be removed from operation for  15 minutes when switching from one loop to another. The circumstances for stopping both RHR pumps are to be limited to situations when the outage time is short and core outlet temperature is maintained > 10F below saturation temperature. The Note prohibits boron dilution with coolant at boron concentrations less than required to assure SDM of LCO 3.1.1 is maintained or draining operations when RHR forced flow is stopped. This Note does not prohibit injection into the RCS of water with a boron concentration that is equal to or greater than the minimum boron concentration needed to meet the SDM requirement in LCO 3.1.1 even if the water being injected has a lower boron concentration than the water already in the RCS. 
 
Note 2 allows one RHR loop to be inoperable for a period of  2 hours, provided that the other loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when these tests are safe and possible.
 
An OPERABLE RHR loop is comprised of an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger.
RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required.
APPLICABILITY In MODE 5 with loops not filled, this LCO requires core heat removal and coolant circulation by the RHR System.
 
Operation in other MODES is covered by:
 
LCO 3.4.4, "RCS Loops - MODES 1 and 2,"
LCO 3.4.5, "RCS Loops - MODE 3,"
LCO 3.4.6, "RCS Loops - MODE 4,"
LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled,"
LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level" (MODE 6), and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level" (MODE 6).
RCS Loops - MODE 5, Loops Not Filled B 3.4.8  BASES  INDIAN POINT 2 B 3.4.8 - 3 Revision 0 ACTIONS A.1 If one required RHR loop is inoperable, redundancy for RHR is lost. Action must be initiated to restore a second loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.
 
B.1 and B.2
 
If no required RHR loop is OPERABLE or the required loop is not in operation, except during conditions permitted by Note 1, all operations involving introduction into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action must be initiated immediately to restore an RHR loop to OPERABLE status and operation. 
 
Action B.1 does not prohibit injection into the RCS of water with a boron concentration that is equal to or greater than the minimum boron concentration needed to meet the SDM requirement in LCO 3.1.1 even if the water being injected has a lower boron concentration than the water already in the RCS. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Time reflects the importance of maintaining operation for heat removal. The action to restore must continue until one loop is restored to OPERABLE status and operation.
SURVEILLANCE SR  3.4.8.1 REQUIREMENTS This SR requires verification every 12 hours that the required loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, which ensure that forced flow is providing heat removal. The Frequency of 12 hours is sufficient considering other indications and alarms available to the operator in the control room to monitor RHR loop performance.
RCS Loops - MODE 5, Loops Not Filled B 3.4.8  BASES SURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.4.8 - 4 Revision 0 SR  3.4.8.2
 
Verification that each required pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to each required pump. Alternatively, verification that a pump is in operation also verifies proper breaker alignment and power availability. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.
 
This SR is modified by a Note that states the SR is not required to be performed until 24 hours after a required pump is not in operation.
REFERENCES None.
PressurizerB 3.4.9 INDIAN POINT 2 B 3.4.9 - 1 Revision 2 B 3.4  REACTOR COOLANT SYSTEM (RCS) B 3.4.9 Pressurizer BASESBACKGROUND The pressurizer provides a point in the RCS where liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primary system pressure during steady state operation, and limiting the pressure changes caused by reactor coolant thermal expansion and contraction during normal load transients. The pressure control components addressed by this LCO include the pressurizer water level, the required heaters, and their controls and emergency power supplies. Pressurizer safety valves and pressurizer power operated relief valves are addressed by LCO 3.4.10, "Pressurizer Safety Valves," and LCO 3.4.11, "Pressurizer Power Operated Relief Valves (PORVs)," respectively. The intent of the LCO is to ensure that a steam bubble exists in the pressurizer prior to power operation to minimize the consequences of potential overpressure transients. The presence of a steam bubble is consistent with analytical assumptions. Relatively small amounts of noncondensible gases can inhibit the condensation heat transfer between the pressurizer spray and the steam, and diminish the spray effectiveness for pressure control. Electrical immersion heaters, located in the lower section of the pressurizer vessel, keep the water in the pressurizer at saturation temperature and maintain a constant operating pressure. A minimum required available capacity of pressurizer heaters ensures that the RCS pressure can be maintained. The capability to maintain and control system pressure is important for maintaining subcooled conditions in the RCS and ensuring the capability to remove core decay heat by either forced or natural circulation of reactor coolant. Unless adequate heater capacity is available, the hot, high pressure condition cannot be maintained indefinitely and still provide the required subcooling margin in the primary system. Inability to control the system pressure and maintain subcooling under conditions of natural circulation flow in the primary system could lead to a loss of single phase natural circulation and decreased capability to remove core decay heat.
PressurizerB 3.4.9 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.4.9 - 2 Revision 2 Pressurizer heaters are powered from either the offsite source or the diesel generators (DGs) through the four 480 V vital buses as follows:Safeguards Power Train 5A supports heater group 23 (485 kW);
Safeguards Power Train 6A supports heater group 24 (277 kW); and Safeguards Power Train 2A/3A supports both: heater group 21 from Bus 3A (554 kW);  and heater group 22 from Bus 2A (485 kW). APPLICABLE SAFETY ANALYSESIn MODES 1, 2, and 3, the LCO requirement for a steam bubble is reflected implicitly in the accident analyses. For events that result in pressurizer insurge (e.g., loss of normal feedwater and the loss of load/turbine trip), the analyses assume that the limiting value for the highest initial pressurizer level is 71.0%. This is an analytical limit and is based on the pressurizer program level at a full power T avg of 572 Degrees F (65%) plus a 6.0% allowance for instrument error. For other events, the nominal value of pressurizer level is assumed because the effect of initial pressurizer level on PCT is small (Ref. 1). Safety analyses performed for lower MODES are not limiting. All analyses performed from a critical reactor condition assume the existence of a steam bubble and saturated conditions in the pressurizer. In making this assumption, the analyses neglect the small fraction of noncondensible gases normally present. Safety analyses presented in the UFSAR (Ref. 1) do not take credit for pressurizer heater operation; however, an implicit initial condition assumption of the safety analyses is that the RCS is operating at normal pressure.The maximum pressurizer water level limit, which ensures that a steam bubble exists in the pressurizer, satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Although the heaters are not specifically used in accident analysis, the need to maintain subcooling in the long term during loss of offsite power, as indicated in NUREG-0737 (Ref. 2), is the reason for providing an LCO.
LCOThe LCO requires the pressurizer to be OPERABLE with the indicated water level less than or equal to 65.1% in MODES 1 and 2, and less than or equal to 84% in MODE 3. These limits account for instrument uncertainty and provide assurance that the actual levels corresponding to these indicated level limits do not exceed 71% and 90%, respectively. A higher limit on PressurizerB 3.4.9 BASESLCO  (continued) INDIAN POINT 2 B 3.4.9 - 3 Revision 2 pressurizer level in MODE 3 is allowed because the lower value of core decay heat in this mode would result in slower transients associated with reactor coolant thermal expansion. This higher limit is typically used to provide greater flexibility to the plant operator when performing a plant shutdown below MODE 3, such as in preparation for a refueling outage.
Whenever pressurizer water level in MODE 3 is above the MODE 1 and 2 limit, a dedicated operator is assigned for operating and controlling the chemical and volume control system, including monitoring pressurizer water level.A 5.9% allowance for instrument uncertainty is based on averaging 2 of the 3 channels that are calibrated for a MODE 1 / 2 pressurizer temperature of 650 F ('hot-calibrated channels'). The 5.9% value bounds the 4.8%
uncertainty applicable to the channel calibrated for a pressurizer temperature of 70 F ('cold-calibrated channel'). Also, whenever the pressurizer temperature is not at the calibration temperature for the instrument channel(s) being used, density compensation correction must be applied.Limiting the LCO maximum operating water level preserves the steam space for pressure control. The LCO has been established to ensure the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure transients. Requiring the presence of a steam bubble is also consistent with analytical assumptions.The LCO requires two groups of OPERABLE pressurizer heaters, each with a capacity  150 kW. Each of the two groups of pressurizer heaters must be powered from a different DG to ensure that the minimum required capacity of 150 kW can be energized during a loss of offsite power condition assuming the failure of a single DG. The minimum heater capacity required is sufficient to maintain the RCS near normal operating pressure when accounting for heat losses through the pressurizer insulation. By maintaining the pressure near the operating conditions, a wide margin to subcooling can be obtained in the loops. The value of 150 kW has been demonstrated to be adequate to maintain RCS pressures control. APPLICABILITY The need for pressure control is most pertinent when core heat can cause the greatest effect on RCS temperature, resulting in the greatest effect on pressurizer level and RCS pressure control. Thus, applicability has been designated for MODES 1 and 2. The applicability is also provided for MODE 3. The purpose is to prevent solid water RCS operation during heatup and cooldown to avoid rapid pressure rises caused by normal operational perturbation, such as reactor coolant pump startup.
PressurizerB 3.4.9 BASESAPPLICABILITY  (continued) INDIAN POINT 2 B 3.4.9 - 4 Revision 2 In MODES 1, 2, and 3, there is need to maintain the availability of pressurizer heaters, capable of being powered from an emergency power supply. In the event of a loss of offsite power, the initial conditions of these MODES give the greatest demand for maintaining the RCS in a hot pressurized condition with loop subcooling for an extended period. For MODE 4, 5, or 6, it is not necessary to control pressure (by heaters) to ensure loop subcooling for heat transfer when the Residual Heat Removal (RHR) System is in service, and therefore, the LCO is not applicable.
ACTIONSA.1, A.2, A.3, and A.4Pressurizer water level control malfunctions or other plant evolutions may result in a pressurizer water level above the nominal upper limit, even with the plant at steady state conditions. If the pressurizer water level is not within the limit, action must be taken to bring the plant to a MODE in which the LCO does not apply. To achieve this status, within 6 hours the unit must be brought to MODE 3 with all rods fully inserted and incapable of withdrawal. Additionally, the unit must be brought to MODE 4 within 12 hours. This takes the unit out of the applicable MODES. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. B.1If one required group of pressurizer heaters is inoperable, restoration is required within 72 hours. The Completion Time of 72 hours is reasonable considering that the redundant heater group is still available and the low probability of an event during this period. Pressure control may be maintained during this time using the remaining heaters. C.1 and C.2If one group of pressurizer heaters are inoperable and cannot be restored in the allowed Completion Time of Required Action B.1, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
PressurizerB 3.4.9 BASESINDIAN POINT 2 B 3.4.9 - 5 Revision 2 SURVEILLANCE SR  3.4.9.1 REQUIREMENTSThis SR requires that during steady state operation, pressurizer level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The LCO requires that the indicated pressurizer water level be less than or equal to 65.1% in MODES 1 and 2, and 84% in MODE 3.
Pressurizer level indications in the control room are usually averaged to come up with a value for comparison to the limit. In addition, density compensation correction is required if the pressurizer temperature is not at the calibration temperature for the instrument channel(s) being used. The Frequency of 12 hours has been shown by operating practice to be sufficient to regularly assess level for any deviation and verify that operation is within safety analyses assumption of ensuring that a steam bubble exists in the pressurizer. Alarms are also available for early detection of abnormal level indications. SR  3.4.9.2The SR is satisfied when the power supplies are demonstrated to be capable of producing the minimum power and the associated pressurizer heaters are verified to be at their design rating. This may be done separately by testing the power supply output which is performed by surveillance tests required by LCO 3.8.1, "AC Sources - Operating," and by performing an electrical check on heater element continuity and resistance.
The Frequency of 24 months is considered adequate to detect heater degradation and has been shown by operating experience to be acceptable. REFERENCES 1. UFSAR, Section 14. 2. NUREG-0737, November 1980.
Pressurizer Safety Valves B 3.4.10 INDIAN POINT 2 B 3.4.10 - 1 Revision 1 B 3.4  REACTOR COOLANT SYSTEM (RCS) B 3.4.10 Pressurizer Safety Valves BASESBACKGROUND The pressurizer safety valves, in conjunction with the Reactor Protection System, provide overpressure protection for the RCS. The pressurizer safety valves are totally enclosed pop type, spring loaded, self-actuated valves with backpressure compensation. The safety valves are designed to prevent the system pressure from exceeding the system Safety Limit (SL),
2735 psig, which is 110% of the design pressure. Because the safety valves are totally enclosed and self actuating, they are considered independent components. The relief capacity for each valve, 408,000 lb/hr, is based on postulated overpressure transient conditions resulting from a complete loss of steam flow to the turbine without a direct reactor trip or any other control, except that the safety valves on the secondary plant are assumed to open when the steam pressure reaches the secondary plant safety valve setting. This event results in the maximum surge rate into the pressurizer, which specifies the minimum relief capacity for the safety valves. The discharge flow from the pressurizer safety valves is directed to the pressurizer relief tank. This discharge flow is indicated by an increase in temperature downstream of the pressurizer safety valves; actuation of acoustic monitors; or, an increase in the pressurizer relief tank temperature or level. Overpressure protection is required in MODES 1, 2, 3, 4, and 5; however, in MODE 4, with one or more RCS cold leg temperatures less than or equal to Low Temperature Overpressure Protection (LTOP) Applicability temperature specified in LCO 3.4.12, and MODE 5 and MODE 6 with the reactor vessel head on, overpressure protection is provided by operating procedures and by meeting the requirements of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System." The upper and lower pressure limits are based on the  1% tolerance requirement (Ref. 1) for lifting pressures above 1000 psig. The lift setting is for the ambient conditions associated with MODES 1, 2, and 3. This requires either that the valves be set hot or that a correlation between hot and cold settings be established.
Pressurizer Safety Valves B 3.4.10 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.4.10 - 2 Revision 1 The pressurizer safety valves are part of the primary success path and mitigate the effects of postulated accidents. OPERABILITY of the safety valves ensures that the RCS pressure will be limited to 110% of design pressure. The consequences of exceeding the American Society of Mechanical Engineers (ASME) pressure limit (Ref. 1) could include damage to RCS components, increased leakage, or a requirement to perform additional stress analyses prior to resumption of reactor operation. APPLICABLE SAFETY ANALYSESAll accident and safety analyses in the UFSAR (Ref. 2) that require safety valve actuation assume operation of three pressurizer safety valves to limit increases in RCS pressure. Single failure tolerance is not required for spring-loaded safety valves designed in accordance with ASME Boiler and Pressure Vessel Code. The overpressure protection analysis (Ref. 3) is also based on operation of three safety valves. Accidents that could result in overpressurization if not properly terminated include: a. Uncontrolled rod withdrawal from full power,
: b. Loss of reactor coolant flow,
: c. Loss of external electrical load,
: d. Loss of normal feedwater,
: e. Loss of all AC power to station auxiliaries, and
: f. Locked rotor.
Detailed analyses of the above transients are contained in Reference 2. Safety valve actuation may be required in events above to limit the pressure increase. Compliance with this LCO is consistent with the design bases and accident analyses assumptions. Pressurizer safety valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCOThe three pressurizer safety valves are set to open at the RCS design pressure (2500 psia), and within the ASME specified tolerance, to avoid exceeding the maximum design pressure SL, to maintain accident analyses assumptions, and to comply with ASME requirements. The upper and lower pressure tolerance limits are based on the  1% tolerance requirements Pressurizer Safety Valves B 3.4.10 BASESLCO  (continued) INDIAN POINT 2 B 3.4.10 - 3 Revision 1 (Ref. 1) for lifting pressures above 1000 psig. The limit protected by this Specification is the reactor coolant pressure boundary (RCPB) SL of 110%
of design pressure. Inoperability of one or more valves could result in exceeding the SL if a transient were to occur. The consequences of exceeding the ASME pressure limit could include damage to one or more RCS components, increased leakage, or additional stress analysis being required prior to resumption of reactor operation. APPLICABILITY In MODES 1, 2, and 3, and portions of MODE 4 above the LTOP Applicability temperature, OPERABILITY of three valves is required because the combined capacity is required to keep reactor coolant pressure below 110% of its design value during certain accidents. MODE 3 and portions of MODE 4 are conservatively included, although the listed accidents may not require the safety valves for protection. The LCO is not applicable in MODE 4 when any RCS cold leg temperatures are less than or equal to Low Temperature Overpressure Protection (LTOP)
Applicability temperature specified in LCO 3.4.12, or in MODE 5 because LTOP is provided. Overpressure protection is not required in MODE 6 with reactor vessel head removed. The Note allows entry into MODES 3 and 4 with the lift settings outside the LCO limits. This permits testing and examination of the safety valves at high pressure and temperature near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design condition. Only one valve at a time will be removed from service for testing. The 54 hour exception is based on 18 hour outage time for each of the three valves. The 18 hour period is derived from industry operating experience that hot testing can be performed in this timeframe.
ACTIONSA.1With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS overpressure protection. An inoperable safety valve coincident with an RCS overpressure event could challenge the integrity of the pressure boundary.
Pressurizer Safety Valves B 3.4.10 BASESACTIONS  (continued) B.1 and B.2If the Required Action of A.1 cannot be met within the required Completion Time or if two or more pressurizer safety valves are inoperable, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 with any RCS cold leg temperatures Low Temperature Overpressure Protection (LTOP) Applicability temperature specified in LCO 3.4.12 within 24 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. With any RCS cold leg temperatures at or below the Low Temperature Overpressure (LTOP) Applicability temperature specified in LCO 3.4.12, overpressure protection is provided by the LTOP System. The change from MODE 1, 2, or 3 to MODE 4 reduces the RCS energy (core power and pressure), lowers the potential for large pressurizer insurges, and thereby removes the need for overpressure protection by three pressurizer safety valves. SURVEILLANCESR  3.4.10.1 REQUIREMENTSSRs are specified in the Inservice Testing Program. Pressurizer safety valves are to be tested in accordance with the requirements of the ASME Code (Ref. 4), which provides the activities and Frequencies necessary to satisfy the SRs. No additional requirements are specified. REFERENCES 1. ASME, Boiler and Pressure Vessel Code, Section III. 2. UFSAR, Chapter 14.1. 3. WCAP-7769, Rev. 1, June 1972. 4. ASME code for Operation and Maintenance of Nuclear Power Plants.INDIAN POINT 2 B 3.4.10 - 4 Revision 1 Pressurizer PORVs B 3.4.11 INDIAN POINT 2 B 3.4.11 - 1 Revision 1 B 3.4  REACTOR COOLANT SYSTEM (RCS) B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)
BASESBACKGROUND The pressurizer is equipped with two types of devices for pressure relief:  pressurizer safety valves and PORVs. The PORVs are air (i.e., nitrogen) operated valves that are controlled to open at a specific set pressure when the pressurizer pressure increases and close when the pressurizer pressure decreases. The PORVs may also be manually operated from the control
 
room.Block valves, which may be open or closed, are located between the pressurizer and the PORVs. The block valves are used to isolate the PORVs in case of excessive leakage or a stuck open PORV. Block valve closure is accomplished manually using controls in the control room. A stuck open PORV is, in effect, a small break loss of coolant accident (LOCA). As such, block valve closure terminates the RCS depressurization and coolant inventory loss. The PORVs and their associated block valves may be used by plant operators to depressurize the RCS to recover from certain transients if normal pressurizer spray is not available. Additionally, the series arrangement of the PORVs and their block valves permit performance of surveillances on the valves during power operation. The PORVs may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total loss of feedwater. The PORVs, their block valves, and their controls are powered from the vital buses that normally receive power from offsite power sources, but are also capable of being powered from emergency power sources in the event of a loss of offsite power. Two PORVs and their associated block valves are powered from two separate safety trains (Ref. 1). The plant has two PORVs, each having a design capacity of 179,000 lb/hr at 2335 psig. The functional design of the PORVs is based on maintaining pressure below the Pressurizer Pressure - High reactor trip setpoint following a step reduction of 50% of full load with steam dump. In addition, the PORVs minimize challenges to the pressurizer safety valves and are used for low temperature overpressure protection (LTOP). See LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System."
Pressurizer PORVs B 3.4.11 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.4.11 - 2 Revision 1 The safety function of the two PORVs and their associated block valves is to provide the following functions: a single failure proof method of manually venting the RCS via the pressurizer which may be needed to respond to a SGTR event; and, a single failure proof method of isolating that vent path which may be needed to respond to a stuck open PORV. The PORVs and block valves also function to minimize challenges to the pressurizer safety valves. Even when in their role of minimizing challenges to the pressurizer safety valves, the plant typically operates with the PORV block valves closed to minimize the consequences of an inadvertent opening of a PORV. This configuration is acceptable because the block valves receive an automatic open signal when pressurizer pressure reaches a preset limit below the pressure at which the PORVs open (Ref. 1). Neither the PORV function of minimizing challenges to the pressurizer safety valves or the associated block valve automatic opening on high pressurizer pressure are required for Technical Specification OPERABILITY. APPLICABLE SAFETY ANALYSES  Plant operators employ the PORVs to depressurize the RCS in response to certain plant transients if normal pressurizer spray is not available. For the Steam Generator Tube Rupture (SGTR) event, the safety analysis assumes that manual operator actions are required to mitigate the event. A loss of offsite power is assumed to accompany the event, and thus, normal pressurizer spray is unavailable to reduce RCS pressure. The PORVs are assumed to be used for RCS depressurization, which is one of the steps performed to equalize the primary and secondary pressures in order to terminate the primary to secondary break flow and the radioactive releases from the affected steam generator. The PORVs are also modeled in safety analyses for events that result in increasing RCS pressure for which departure from nucleate boiling ratio (DNBR) criteria are critical (Ref. 2). By assuming PORV actuation, the primary pressure remains below the high pressurizer pressure trip setpoint; thus, the DNBR calculation is more conservative. As such, this actuation is not required to mitigate these events, and PORV automatic operation is, therefore, not an assumed safety function. Pressurizer PORVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCOThe LCO requires the PORVs (PCV-455C and PCV-456) and their associated block valves (MOV-535 and MOV-536) to be OPERABLE for manual operation to mitigate the effects associated with an SGTR.
Pressurizer PORVs B 3.4.11 BASESLCO  (continued) INDIAN POINT 2 B 3.4.11 - 3 Revision 1 By maintaining two PORVs and their associated block valves OPERABLE, the single failure criterion is satisfied. An OPERABLE block valve may be either open and energized with the capability to be closed, or closed and energized with the capability to be opened, since the required safety function is accomplished by manual operation. Isolation of an OPERABLE PORV does not render that PORV or block valve inoperable provided the ability to both open and close the valves from the control room remains available with manual action. An OPERABLE PORV is required to be capable of manually opening and closing, and not experiencing excessive seat leakage. Excessive seat leakage, although not associated with a specific acceptance criteria, exists when conditions dictate closure of the block valve to limit leakage. Neither the PORV function of minimizing challenges to the pressurizer safety valves or the associated block valve automatic open on high pressurizer are required for Technical Specification OPERABILITY. Satisfying the LCO helps minimize challenges to fission product barriers. APPLICABILITY In MODES 1, 2, and 3, the PORV and its block valve are required to be OPERABLE to limit the potential for a small break LOCA through the flow path. The most likely cause for a PORV small break LOCA is a result of a pressure increase transient that causes the PORV to open. Imbalances in the energy output of the core and heat removal by the secondary system can cause the RCS pressure to increase to the PORV opening setpoint. The most rapid increases will occur at the higher operating power and pressure conditions of MODES 1 and 2. The PORVs are also required to be OPERABLE in MODES 1, 2, and 3 for manual actuation to mitigate a steam generator tube rupture event. Pressure increases are less prominent in MODE 3 because the core input energy is reduced, but the RCS pressure is high. Therefore, the LCO is applicable in MODES 1, 2, and 3. The LCO is not applicable in MODES 4, 5, and 6 with the reactor vessel head in place when both pressure and core energy are decreased and the pressure surges become much less significant. LCO 3.4.12 addresses the PORV requirements in these MODES.
Pressurizer PORVs B 3.4.11 BASESINDIAN POINT 2 B 3.4.11 - 4 Revision 1 ACTIONS A Note has been added to clarify that all pressurizer PORVs and block valves are treated as separate entities, each with separate Completion Times (i.e.,
the Completion Time is on a component basis).
A.1PORVs may be inoperable and capable of being manually cycled (e.g., excessive seat leakage). In this condition, either the PORVs must be restored or the flow path isolated within 4 hours. The associated block valve is required to be closed, but power must be maintained to the associated block valve, since removal of power would render the block valve inoperable.
This permits operation of the plant until maintenance can be performed on the PORVs to eliminate the problem condition. Quick access to the PORV for pressure control can be made when power remains on the closed block valve. The Completion Time of 4 hours is based on plant operating experience that has shown that minor problems can be corrected or closure accomplished in this time period. B.1, B.2, and B.3If one PORV is inoperable and not capable of being manually cycled, it must be either restored, or isolated by closing the associated block valve and removing the power to the associated block valve. The Completion Times of 4 hours are reasonable, based on challenges to the PORVs during this time period, and provide the operator adequate time to correct the situation. If the inoperable valve cannot be restored to OPERABLE status, it must be isolated within the specified time. Because there is at least one PORV that remains OPERABLE, 7 days is provided to restore the inoperable PORV to OPERABLE status. If the PORV cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition D. C.1 and C.2If one block valve is inoperable, then it is necessary to either restore the block valve to OPERABLE status within the Completion Time of 4 hours or place the associated PORV in manual control. The prime importance for the capability to close the block valve(s) is to isolate a stuck open PORV.
Therefore, if the block valve(s) cannot be restored to OPERABLE status within 4 hours, the Required Action is to place the PORV in manual control Pressurizer PORVs B 3.4.11 BASESACTIONS  (continued) INDIAN POINT 2 B 3.4.11 - 5 Revision 1 to preclude its automatic opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve(s) are inoperable. The Completion Time of 4 hours is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation. Because at least one PORV remains OPERABLE, the operator is permitted a Completion Time of 7 days to restore the inoperable block valve(s) to OPERABLE status. The time allowed to restore the block valve(s) is based upon the Completion Time for restoring an inoperable PORV in Condition B, since the PORVs may not be capable of mitigating an event if the inoperable block valve(s) are not full open. If the block valve(s) are restored within the Completion Time of 7 days, the PORV may be restored to automatic operation. If it cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply, as required by Condition D. The Required Actions C.1 and C.2 are modified by a Note stating that the Required Actions do not apply if the sole reason for the block valve being declared inoperable is as a result of power being removed to comply with other Required Actions. In this event, the Required Actions for inoperable PORV(s) (which require the block valve power to be removed once it is closed) are adequate to address the condition. While it may be desirable to also place the PORV(s) in manual control, this may not be possible for all causes of Condition B or E entry with PORV(s) inoperable and not capable of being manually cycled (e.g., as a result of failed control power fuse(s) or control switch malfunctions(s)). D.1 and D.2If the Required Action of Condition A, B, or C is not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, automatic PORV OPERABILITY may be
 
required. See LCO 3.4.12. E.1, E.2, E.3, and E.4If more than one PORV is inoperable and not capable of being manually cycled, it is necessary to either restore at least one valve within the Completion Time of 4 hours or isolate the flow path by closing and removing the power to the associated block valves. The Completion Time of 4 hours Pressurizer PORVs B 3.4.11 BASESACTIONS  (continued) INDIAN POINT 2 B 3.4.11 - 6 Revision 1 is reasonable, based on the small potential for challenges to the system during this time and provides the operator time to correct the situation. If no PORVs are restored within the Completion Time, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, automatic PORV OPERABILITY may be required. See LCO 3.4.12. F.1If two block valves are inoperable, it is necessary to restore at least one block valve within 4 hours. The Completion Time is reasonable, based on the small potential for challenges to the system during this time and provide the operator time to correct the situation. The Required Action is modified by a Note stating that the Required Action does not apply if the sole reason for the block valve being declared inoperable is a result of power being removed to comply with other Required Actions. In this event, the Required Actions for inoperable PORV(s) (which require the block valve power to be removed once it is closed) are adequate to address the condition. While it may be desirable to also place the PORV(s) in manual control, this may not be possible for all causes of Condition B or E entry with PORV(s) inoperable and not capable of being manually cycled (e.g., as a result of failed control power fuse(s) or control switch malfunctions(s)). G.1 and G.2If the Required Actions of Condition F are not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4 and 5, automatic PORV OPERABILITY may be required. See LCO 3.4.12.
Pressurizer PORVs B 3.4.11 BASESINDIAN POINT 2 B 3.4.11 - 7 Revision 1 SURVEILLANCE SR  3.4.11.1REQUIREMENTS This SR requires block valve cycling to verify that the valve(s) can be opened and closed if needed. The basis for the Frequency of 92 days is the ASME Code (Ref. 3). This SR is modified by two Notes. Note 1 modifies this SR by stating that it is not required to be performed with the block valve closed in accordance with the Required Actions of this LCO. Opening the block valve in this condition increases the risk of an unisolable leak from the RCS since the PORV is already inoperable. Note 2 modifies this SR to allow entry into and operation in MODE 3 prior to performing the SR. This allows the test to be performed in MODE 3 under operating temperature and pressure conditions, prior to
 
entering MODE 1 or 2. SR  3.4.11.2SR 3.4.11.2 requires a complete cycle of each PORV. Operating a PORV through one complete cycle ensures that the PORV can be manually actuated for mitigation of an SGTR. The Frequency of 24 months is based on a typical refueling cycle and industry accepted practice. The Note modifies this SR to allow entry into and operation in MODE 3 prior to performing the SR. This allows the test to be performed in MODE 3 under operating temperature and pressure conditions, prior to entering MODE 1 or 2. REFERENCES 1.UFSAR, Sections 4.2 and 4.3.
2.UFSAR, Section 14.
3.ASME code for Operation and Maintenance of Nuclear Power Plants
.
LTOPB 3.4.12B 3.4  REACTOR COOLANT SYSTEM (RCS)B 3.4.12Low Temperature Overpressure Protection (LTOP)
BASESBACKGROUND LTOP is the combination of restrictions on RCS injection capability, RCS relief capacity or vent size, and reactor coolant pump starting restrictions that limit RCS pressure at low temperatures. The LTOP restrictions ensure the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the pressure and temperature (P/T) limits of 10CFR50, Appendix G as described in Reference 1. The reactor vessel is the limiting RCPB component for demonstrating such protection. This LCO provides the maximum allowable actuation logic setpoints for the power operated relief valves (PORVs) and the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference1 requirements during the LTOP MODES.The reactor vessel material is less tough at low temperatures than at normal operating temperature. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref.2). RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.The potential for vessel overpressurization is most acute when the RCS is water solid, which occurs only while shutdown. In a solid condition, a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO3.4.3, "RCS Pressure and Temperature (P/T) Limits," requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the Reference 1 limits.This LCOprovides RCS overpressure protection by a combination of limiting RCS injection capability of the high head safety injection (HHSI) pumps and the charging pumps based on the pressure relief capability provided by the LTOP (i.e., redundant power operated relief valves with setpoints based on the RCS temperature) or the size of the vent provided in the RCS for pressure relief.
Alternately, if redundant PORVs are not OPERABLE or an RCS vent cannot be established, LTOP protection may be established by limiting the pressurizer level to within limits specified in Figure3.4.12-2, Figure3.4.12-3, or Figure3.4.12-4 consistent with the number of charging pumps and number of HHSI pumps capable of injecting into the RCS. This approach is acceptable because pressurizer level can be maintained such that it will either accommodate any anticipated pressure surge or allow operators timeINDIAN POINT 2B 3.4.12 - 1 Revision 3 LTOPB 3.4.12 BASESBACKGROUND  (continued)to react to any unanticipated pressure surge. When limitations on pressurizer level are used to satisfy LTOP requirements, operator action is assumed to terminate an unplanned HHSI pump injection within 10minutes. The LTOP analysis also assumes that the RCS accumulator pressure is below the Figure3.4.12-1 limit or the accumulators are isolated or depressurized whenever LTOP requirements are applicable.Operating under LTOP restrictions, the ability to provide core coolant addition is restricted. The LCOdoes not require the makeup control system deactivated or the safety injection (SI) actuation circuits blocked. Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve. If conditions require the use of more than the number of HHSI pumps or charging pumps permitted by this LCO for makeup in the event of loss of inventory, then pumps can be made available through manual actions.When configured to provide low temperature overpressure protection, the PORVs are part of a system called the LTOP. LTOP for pressure relief consists of two PORVs with reduced lift settings or a depressurized RCS and an RCS vent with a minimum size based on the number of HHSI pumps and/or charging pumps capable of injecting into the RCS. Two PORVs are required for redundancy. One PORV has adequate relieving capability to keep from overpressurization for the coolant input capability.PORV RequirementsThe LTOP, described in Reference4, provides low temperature overpressure protection by establishing thelift setpoints for the PORVs that vary with RCS cold leg temperature.Cold leg temperature signals from three RCS loops areused for two purposes. Three channels of RCS cold leg temperature are supplied to three associated function generators that calculate the maximum RCS pressure allowed for the measured temperature. The maximum RCS pressure limit generated for each RCS temperature is used as the PORVs setpoint which changes as the temperature changes. Limits for the PORV  lift setpoint at each RCS temperature are maintained in Figure3.4.12-1 and correspond to the 10CFR50, AppendixG, limit curve (as discussed in Reference1) with appropriate allowances for overshoot during a transient. Additionally, the same three channels of RCS cold leg temperature are used in a two-out-of-three logic to perform two functions: a) open the PORV block INDIAN POINT 2B 3.4.12 - 2 Revision 3 LTOPB 3.4.12 BASESBACKGROUND  (continued)valves when RCS temperature falls below the temperature at which low temperature overpressure protection is required; and, b) provide an open permissive in a two-out-of-two (temperature and pressure) logic for each PORV. When the PORV block valves are open (either manually or as a result of the signal from RCS cold leg temperature) and temperature requirement for PORV opening is met, the PORVs are said to be "armed."Three channels of RCS pressure are used in a two-out-of-three logic to satisfy the pressure portion of the two-out-of-two (temperature-pressure) logic that actuates each PORV in the overpressure protection mode of operation. Having the pressure/temperature setpoint of both PORVs within the limits in Figure3.4.12-1 ensures that the Reference1 limits will not be exceeded in any analyzed event. Use of two PORVs, each with adequate relieving capability to prevent overpressurization, ensures that a single failure will not prevent PORV actuation. Use of a two-out-of-three logic for pressure and for temperature ensures that a single failure will not cause or prevent a PORV actuation when in the overpressure protection mode of operation.When a PORV is opened during an increasing pressure transient, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.RCS Vent RequirementsWhen the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at containment ambient pressure in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass or heat input transient, and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.Depending on the required vent size, RCS vent flow capacity requirements may be met by removing a pressurizer safety valve, blocking open the PORV and disabling its blockvalve in the open position, removing a PORV's internals, and disabling its block valve in the open position, establishing a vent by opening an RCS vent valve or by removing the pressurizer manway cover. The vent path(s) must be above the level of reactorcoolant, so as not to drain the RCS when open.INDIAN POINT 2B 3.4.12 - 3 Revision 3 LTOPB 3.4.12 BASESAPPLICABLE SAFETY ANALYSES  Safety analyses (Ref.4) demonstrate that the reactor vessel is adequately protected against exceeding the Reference1 P/T limits. In MODES1, 2, and3, and in MODE4 with allRCS cold leg temperatures exceeding 288F, the pressurizer safety valves will prevent RCS pressure from exceeding the Reference1 limits. At about 288F and below, overpressure protection is established by restricting RCS injection capability using the HHSI pumps and the charging pumps based on the pressure relief capability provided by one of the two power operated relief valves with setpoints based on the RCS temperature or the size of the vent provided in the RCS for pressure relief.
Alternately, if redundant PORVs are not OPERABLE or an RCS vent cannot be established, LTOP protection may be established by limiting the pressurizer level to within limits specified in Figure3.4.12-2, Figure3.4.12-3, or Figure3.4.12-4 depending on the number of chargingpumps and number of HHSI pumps capable of injecting into the RCS. This approach is acceptable because pressurizer level can be maintained such that it will either accommodate any anticipated pressure surge or allow operators time to react to any unanticipated pressure surge. When pressurizer level is used to satisfy LTOP requirements, operator action is assumed to terminate an unplanned HHSI pump injection within 10minutes. The LTOP analysis also assumes that the RCS accumulators are either isolated ordepressurized whenever LTOP requirements are applicable.The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the P/T curves are revised, LTOP must be re-evaluated to ensure its functional requirements can still be met using the RCS relief valve method or the depressurized and vented RCS condition.Table3.4.12-1 and Figures3.4.12-1 through 3.4.12-6 contain the acceptance limits that define the LTOP requirements. Any change to the RCS must be evaluated against the Reference4 analyses to determine the impact of the change on the LTOP acceptance limits.Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow:Mass Input Type Transientsa.Inadvertent safety injection or b.Charging/letdown flow mismatch.INDIAN POINT 2B 3.4.12 - 4 Revision 3 LTOPB 3.4.12 BASESAPPLICABLE SAFETY ANALYSES  (continued)Heat Input Type Transientsa.Inadvertent actuation of pressurizer heaters,b.Loss of RHR cooling, or
 
c.Reactor coolant pump (RCP) startup with temperature asymmetry within the RCS or between the RCS and steam generators.PORV PerformanceThe fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the limit shown in Figure3.4.12-1. The setpoints are derived by analyses that model the performance of the PORVs in the LTOPmode of operation. These analyses consider pressure overshoot and undershoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensures the Reference1 P/T limits will be met. The LTOP analysis currently addresses two scenarios that depend on the PORVs in the LTOPmode. With the PORVs set at the LTOPsetpoint, the analysis requires limiting injection capability to three charging pumps and no HHSI pumpsorto two charging pumps and one HHSI pump.The PORV setpoints in Figure3.4.12-1 will be updated when the revised P/T limits conflict with the LTOP analysis limits. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation. Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LCO3.4.3, "RCS Pressure and Temperature (P/T) Limits," discuss these examinations.The PORVs are considered active components. Thus, the failure of one PORV is assumed to represent the worst case, single active failure.RCS Vent PerformanceWith the RCS depressurized, analyses show an RCS vent of 2.00 square inches with a maximum of one HHSI pump and three charging pumps capable of injecting into the RCS or an RCS vent of 5.00 square inches INDIAN POINT 2B 3.4.12 - 5 Revision 3 LTOPB 3.4.12 BASESAPPLICABLE SAFETY ANALYSES  (continued)with all three HHSI pumps and all three charging pumps capable of injecting into the RCS will maintain RCS pressure less than the maximum pressure on the P/T limit curve.The RCS vent size will be re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material surveillance.The RCS vent is passive and is not subject to active failure.
LTOP satisfies Criterion2 of 10CFR 50.36(c)(2)(ii).
LCOThis LCOrequires that LTOP is OPERABLE. LTOP is OPERABLE when the maximum coolant input and pressure relief capabilities are within limits specified in this LCO. Violation of this LCOcould lead to the loss of low temperature overpressure mitigation and violation of the Reference1 limits as a result of an operational transient.LTOP is OPERABLE (i.e., LTOP requirements are met) when one of the Options in Table3.4.12-1 is met and the RCS accumulators are isolated from the RCS or accumulator pressure is less than the maximum RCS pressure allowed by the P/T limit curves provided in Figure3.4.12-1 for the coldest existing RCS cold leg temperature. The isolated accumulators must have their discharge valves closed and the valvepower supply breakers fixed in the open position. Limitations on injection capability required by Table3.4.12-1 are met when SR3.4.12.1 is met as described in the Bases for this surveillance.Options A and B satisfy LTOP requirements using two power operated relief valves (PORVs) with lift settings within the limits specified in Figure3.4.12-1.
The PORV is OPERABLE if the block valve opens automatically by the LTOP signal or is maintained in the open position. The PORVs are OPERABLE for LTOP when there are three OPERABLE RCS pressure channels and three OPERABLE RCS temperature channels. The PORVs are OPERABLE if an inoperable RCS pressure or temperature channel is in the tripped condition.
PORVS are considered OPERABLE for meeting LCO3.4.12 requirements even if one or two RCS cold leg temperatures are above the LTOP Applicability limit (which could result in the PORV not openingwhen required)
.INDIAN POINT 2B 3.4.12 - 6 Revision 3 LTOPB 3.4.12 BASES LCO  (continued)Options C, D or E are used only when the required PORVs in LTOPmode arenot OPERABLE and there is no vent path established. These options depend on maintaining the combination of pressurizer pressure, pressurizer level andRCS temperature within the limits specified in Figure3.4.12-2, Figure3.4.12-3, or Figure3.4.12-4 depending on the number of HHSI pumps and charging pumps capable of injecting into the RCS. Options F, G, H and I satisfy LTOP requirements when the RCS is depressurized and an RCS vent of the required size is maintained. A fully blocked open PORV or a PORV with the internals removed with the 2.00 square inches. Other methods for establishing a vent of the required size are also acceptable.Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.The LCO is modified by four Notes. Note 1 states that accumulator isolation (i.e., valve closed and power removed as specified in SR3.4.12.3) is only required when the accumulator pressure is more than or at the maximum RCS pressure for the coldest existing temperature, as allowed by the P/T limit curves. This note permits the accumulator discharge isolation valve Surveillance to be performed only under these pressure and temperature conditions.Note2 allows the HHSI pumps to be madecapable of injecting into the RCS if required to respond to a loss of RCS inventory. Note3 allows one HHSI pump to be made capable of injecting into the RCS as needed for emergency boration or in response to loss of RHR cooling. Note4 specifies that SR 3.4.12.8 must be met when starting any RCP to ensure that temperature asymmetry within the RCS or between the RCS and steam generators does not result in a pressure increase that could exceed LTOP relief capacity.APPLICABILITY This LCOis applicable in MODE4 when any RCS cold leg temperature is 288F, in MODE5, and in MODE6 when the reactor vessel head is on. The pressurizer safety valves provide overpressure protection that meets the Reference1 P/T limits above 288F. When the reactor vessel head is off, overpressurization cannot occur.INDIAN POINT 2B 3.4.12 - 7 Revision 3 LTOPB 3.4.12 BASESAPPLICABILITY  (continued)LCO3.4.3 provides the operational P/T limits for all MODES. LCO3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES1, 2, and3, and MODE4 above 288 F.Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allowsoperator action to mitigate the event.ACTIONSA Note prohibits the application of LCO3.0.4.b to an inoperable LTOP system. There is an increased risk associated with entering MODE4 from MODE5 with LTOP inoperable and the provisions of LCO3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
A.1 RCS overpressurization is possible whenever the number of HHSI pumps and/or charging pumps capable of injecting into the RCS exceeds Table3.4.12-1 limits for plant conditions or the combination of pressurizer pressure, pressurizer level and RCS temperature is not within the limits specified in Figure3.4.12-2, Figure3.4.12-3 or Figure3.4.12-4 depending on the number of HHSI pumps and charging pumps capable of injecting into the
 
RCS.The urgency for removing the RCS from this condition is reflected in the Completion Time of immediately for the Required Action to verify that the number of HHSI pumps and charging pumps capable of injecting into the RCS is within Table3.4.12-1 limits for plant conditions or restore the combination of pressurizer pressure, pressurizer level and RCS temperature to within the limits specified in Figure3.4.12-2, Figure3.4.12-3 or Figure3.4.12-4 depending on the number of HHSI pumps and charging pumps capable of injecting into the RCS.INDIAN POINT 2B 3.4.12 - 8 Revision 3 LTOPB 3.4.12 BASESACTIONS  (continued)Required Action A.1 is modified by a Note that permits exceeding the Table3.4.12-1 limit on the number of charging pumps capable of injecting into the RCS for a period of 15 minutes during pump swap operations. This allowance recognizes operational requirements for continuous availability of a minimum number ofcharging pumps and the low probability of an overpressure event during the 15minutes allowed for swapping pumps.B.1, C.1, and C.2An improperly isolated accumulator (isolation valve closed with power not removed per SR3.4.12.3) requires isolation within 1hour. This is only required when the accumulator pressure is at or more than the maximum RCS pressure for the existing temperature allowed by the P/T limit curves.If isolation is needed and cannot be accomplished in 1hour, Required Action C.1 andRequired ActionC.2 provide two options, either of which must be performed in the next 12hours. By increasing the RCS temperature to 288F, accumulator pressure cannot exceed the LTOP limits if the accumulators are injected. Depressurizing the accumulators below the LTOP limit from Figure3.4.12-1 also gives this protection.The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering evaluations indicating that an event requiring LTOP is not likely in the allowed times.D.1In MODE4 when any RCS cold leg temperature is 288F, with one required PORV inoperable, the PORV must be restored to OPERABLE status within a Completion Time of 7days. Two PORVs are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component.The Completion Time considers the facts that only one of the PORVs is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low.INDIAN POINT 2B 3.4.12 - 9 Revision 3 LTOPB 3.4.12 BASESACTIONS  (continued)
E.1 The RCS must be depressurized and a vent must be established within 8hours when:a.Both required PORVs are inoperable, b.A Required Action and associated Completion Time of ConditionA or D is not met, or c.LTOP is inoperable for any reason other than ConditionA, B, C orD.The vent must be consistent with Table3.4.12-1, OptionsF, G, H or I, to ensure that the flow capacity is greater than that required for the worst case mass input transient reasonable during the applicable MODES. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel.Required Action E.1 requires that injection capability be limited in accordance with Table3.4.12-1 for existing plant conditions to minimize the potential for an overpressure event while the plant is being depressurized and a vent path established.The Completion Time of 8hours for depressurizing and establishing the vent required by Table3.4.12-1 considers the time required to place the plant in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.SURVEILLANCESR3.4.12.1, SR3.4.12.2, and SR3.4.12.3REQUIREMENTSTo minimize the potential for a low temperature overpressure event by limiting the mass input capability, any HHSI or charging pump above the specified limit is verified incapable of injecting into the RCS and the accumulator discharge isolation valves are verified closed and locked out.
The HHSI pumps and charging pumps are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers outor by providing isolation of the injection path with the valve de-energized or locked closedunder administrative control. An alternate method of LTOP control may be employed using at least two independent means to prevent a pump injectionsuch that a single failure or single action will not result in an injection into the RCS. This may be accomplished INDIAN POINT 2B 3.4.12 -10Revision 3 LTOPB 3.4.12 BASESSURVEILLANCE REQUIREMENTS  (continued)through the pump control switch being placed in pull to lock and at least one valve in the discharge flow path being closed or by one valve in the discharge flow path being locked or de-energized closed. The Frequency of 12hours (and 31days for pumps with circuit breakers locked out) is sufficient, considering other indications and alarms available to the operator in the control room, to verify the required status of the equipment. SR3.4.12.1 is modified by a Note that permits not performing the required verification that the number of HHSI pumps and charging pumps capable of injecting into the RCS is within Table3.4.12-1 limits when OptionI is met. This is acceptable because Table3.4.12-1, OptionI, does not impose any limitations on the status of HHSI pumps and charging pumps.SR 3.4.12.2 is modified by a Note that permits not performing the required verification that pressurizer pressure, pressurizer level and RCS temperature are within limits for the number of HHSI pumps and charging pumps capable of injecting into the RCS unless when Table3.4.12-1, Option A, B, F, G, H orI, is being used to meet LTOP requirements. This is acceptable because these options do not impose any restrictions on the combination of pressurizer pressure, pressurizer level and RCS temperature.SR3.4.12.4The RCS vent 2.00 or 5.00 square inches is proven OPERABLE by verifying its open condition either:
a.Once every 24hours for a valve that is not locked (valves that are sealed or secured in the open position are considered "locked" in this context) orb.Once every 31days for other vent path(s) (e.g., a vent valve that is locked, sealed, or secured in position or a removed PORV (for a vent 2.00 square inches per PORV) or a pressurizer safety valve (for a vent 5.00 square inches) or open manway also fits this category).The passive vent path arrangement must only be open to be OPERABLE.
This Surveillance is required to be met if the vent is being used to satisfy the pressure relief requirements of Table3.4.12-1, Options F through I.INDIAN POINT 2B 3.4.12 -11Revision 3 LTOPB 3.4.12 BASESSURVEILLANCE REQUIREMENTS  (continued)SR  3.4.12.5The PORV block valve must be verified open every 72hours to provide the flow pathfor each required PORV to perform its function when actuated.The valve must be remotely verified open in the main control room. This Surveillance is performed only if the PORV is being used to satisfy the LCO.The block valve is a remotely controlled,motor operated valve that opens automatically below the LTOP Applicability temperature. The power to the valve operator is not required to be removed, and the manual operator is not required to be locked in the open position. Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation.The 72hour Frequency is considered adequate in view of other administrative controls available to the operator in the control room, such as valve position indication, that verify that the PORV block valve remains open.SR  3.4.12.6Performance of a COT on each required PORV is required within 12hours after decreasing RCS temperature to less than or equal to LTOP Applicability temperature and every 31days thereafter to verify and, as necessary, adjust its lift setpoint. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable COT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling intervalwith applicable extensions. The COT will verify the setpoint is within Figure 3.4.12-1 allowed maximum limits.
PORV actuation could depressurize the RCS and is not required.A Note has been added indicating that this SRis required to be performed (i.e., completed) within 12hours after decreasing RCS cold leg temperature
 
to 288F. The 12hour allowance considers the unlikelihood of a low temperature overpressure event during this time.INDIAN POINT 2B 3.4.12 -12Revision 3 LTOPB 3.4.12 BASESSURVEILLANCE REQUIREMENTS  (continued)SR3.4.12.7Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required every 24months to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input.SR  3.4.12.8The RCP starting prerequisites must be satisfied prior to starting or jogging any reactor coolant pump (RCP) when low temperature overpressure protection is required. The RCP starting prerequisites prevent an overpressure event due to thermal transients when an RCP is started. RCP starting or jogging is prohibitedif the RCP starting prerequisites in this SR cannot be satisfied.The principal contributor to an RCP start induced thermal and pressure transient is the difference between RCS cold leg temperatures and SG secondary side water temperature prior to the start of an RCP. The RCP starting prerequisites vary depending on plant conditions but include the following: reactor coolant temperature relative to the LTOP Applicability temperature; secondary side water temperature of the hottest SG relative to the temperature of the coldest RCS cold leg temperature; and, the status of the LTOP. When the LTOPis inoperable, additional compensatory requirements are required including limits for the pressurizer level and RCS pressure and temperature. When a pressurizer level is specified as a requirement, the level specified is sufficient to prevent the RCS from going water solid for 10 minutes which is sufficient time for operator action to terminate the pressure transient.The determination of reactor coolant temperature and pressurizer level may be made from the Control Room instrumentation. The determination of the steam generator water temperature may be made using any of the following: (a)assume that the secondary side water temperature is at the saturation temperature corresponding to the secondary side steam pressure indicated on the Control Room instrumentation, or (b)assume that the secondary side water temperature is at the reactor coolant temperature at which the last RCP was stopped during cooldown, orINDIAN POINT 2B 3.4.12 -13Revision 3 LTOPB 3.4.12 BASESSURVEILLANCE REQUIREMENTS  (continued)(c) contact reading from the steam generator shell; or (d)actual or inferred measurement of the secondary side steam generator water temperature at those times it can be measured (such as return from a refueling outage).The Frequency for verification of the RCP starting prerequisites is 30 minutes prior to starting any RCP. This means that each of the required verifications must be performed within 30 minutes prior to the pump start and must be met at the time of the pump start.REFERENCES 1.Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No.274to Facility Operating License No.
DPR-26, March 5, 2014.2.Generic Letter88-11.
3.ASME, Boiler and Pressure Vessel Code, SectionIII.
4.UFSAR, Section 4.3.4.
5.10CFR50, Section50.46.
6.10CFR50, Appendix K.
7.Generic Letter90-06.
8.ASME, Boiler and Pressure Vessel Code, SectionXI.INDIAN POINT 2B 3.4.12 -14 Revision 3 RCS Operational LEAKAGEB 3.4.13B 3.4  REACTOR COOLANT SYSTEM (RCS)B 3.4.13RCS Operational LEAKAGEBASES BACKGROUNDComponents that contain or transport the coolant to or from the reactor core make up the RCS. Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the RCSOperational LEAKAGE LCOis to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCOspecifies the types and amounts of LEAKAGE.10CFR50, AppendixA, GDC30 (Ref.1), requires means fordetecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE.
Regulatory Guide1.45 (Ref.2) describes acceptable methods for selecting leakage detection systems. These requirements are addressed in Technical Specification 3.4.15, "Leakage Detection Instrumentation."The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur that is detrimental to the safety of the facility and the public.A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight. Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS leakage detection.Limits on the primary to secondary leakage for each steam generator (SG) are part of comprehensive program for maintaining SG tube integrity that includes a balanced plan of prevention (design and chemistry control),
inspection, evaluation, repair, and leakage monitoring measures that are explained in Reference 5. INDIAN POINT 2B 3.4.13 - 1 Revision 5 RCS Operational LEAKAGEB 3.4.13BASESBACKGROUND  (continued)This LCOdeals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCOinclude the possibility of a loss of coolant accident (LOCA).APPLICABLE SAFETY ANALYSES Except for primary to secondaryLEAKAGE, the safety analyses do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA because the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumesthat primary to secondary LEAKAGE from all steam generators (SGs) is 600 gallons per day or increases to 600 gallons per day as a result of accident induced conditions. The LCO requirement to limit primary to secondary LEAKAGE through any one SG to less than or equal to 85gallons per day is equal to the 150 gallons per dayassumed in the safety analysis.Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from locked rotor and steam line break (SLB) accidents. To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR). The leakage contaminates the secondary fluid.In the analyses of the locked rotor and steamline break accidents the 150 gpdper steam generator primary to secondary LEAKAGE is theprimary contributor to the doses. In the locked rotor accident analysis the leakage is the only path by which the contaminated primary coolant can be transferred out of the reactor coolant system. Activity transferred to the secondary side during a locked rotor event is subject to partitioning as steam is released to the atmosphere, but the leakage is the main source of the secondary activity. In the steamline break analysis all activity transferred to the faulted steam generator by the leakage is released without partitioning. The safety analysis for the SLB accident assumes 150 gpd primary to secondary LEAKAGE through the affected generator as an initial condition. Activity transferred to the intact steam generators is subject to partitioning so this leakage is relatively inconsequential. In the SGTR analysis the ruptured tube is the primary path by which the contaminated primary coolant is transferred out of the reactor coolant system. Activity transferred to the intact steam generators is much lower due to the lower leak rate and is subject to partitioning so the 450 gpd primary to secondary LEAKAGE safety analysis assumptionis relatively inconsequential. The dose consequences resulting from these events are within the applicable limits (Ref. 3). The dose acceptance limits are defined by Regulatory Guide 1.183 (Ref. 4).INDIAN POINT 2B 3.4.13 - 2 Revision 5 RCS Operational LEAKAGEB 3.4.13BASESAPPLICABLE SAFETY ANALYSES (continued)A limit of 85gpd of primary to secondary leakage per SG is established as part of the performance criteria for the SG tube surveillance program recommended in Reference 5 and the technical support document (WCAP-17828, Rev. 0) for the cracks located at or below the H* distance during a MSLB. Monitoring and limiting primary to secondary leakage is an important defense in depth measure for monitoring overall tube integrity during operation. SG leakage monitoring and the associated limit allows operators to safely respond to situations in which tube integrity becomes impaired before significant leakage or tube failure occurs. Additionally, leakage is an important tool for assessing the effectiveness of the steam generator program required by Technical Specification 5.5.7.The RCS operational LEAKAGEsatisfies Criterion2 of 10CFR50.36(c)(2)(ii).
LCORCS operational LEAKAGE shall be limited to:
a.Pressure Boundary LEAKAGENo pressure boundary LEAKAGE is allowed, being indicative of material deterioration. LEAKAGE of thistype is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE. Violation of this LCOcould result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.
b.Unidentified LEAKAGEOne gallon per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time period. Violation of this LCOcould result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.
c.Identified LEAKAGEUp to 10gpm of identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of unidentified LEAKAGE and is well within the capability of the RCS Makeup System. Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not INDIAN POINT 2B 3.4.13 - 3 Revision 5 RCS Operational LEAKAGEB 3.4.13BASESLCO (continued)c.Identified LEAKAGE (continued)include pressure boundary LEAKAGE or controlled reactor coolant pump (RCP) seal leakoff (a normal function not considered LEAKAGE). Violation of this LCOcould result in continued degradation of a component or system.
d.Primary to Secondary LEAKAGE through Any One SGThe limit of 85gallons per day per SG is based on the operational LEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines as supplemented by Amendment 277 (Ref. 5).
The Steam Generator Program operational LEAKAGE performance criterion in NEI 97-06 states, "The RCS operational primary to secondary leakage through any one SG shall be limited to 150 gallons per day."  The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage.TS Amendment reduced this leakage to 85 gallons per day(WCAP-17828, Rev 0)to account for tube sheet criterion changeson MSLB accident assumptions.The operational leakage rate criterion in conjunction with the implementation of the Steam Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.APPLICABILITYIn MODES1, 2, 3, and4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.In MODES5 and6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.LCO3.4.14, "RCS Pressure Isolation Valve (PIV) Leakage," measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leak tight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.INDIAN POINT 2B 3.4.13 - 4 Revision 5 RCS Operational LEAKAGEB 3.4.13BASESSURVEILLANCE REQUIREMENTS  (continued)
ACTIONS A.1Unidentified LEAKAGEoridentified LEAKAGEin excess of the LCOlimits must be reduced to within limits within 4hours. This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGEto within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.B.1 and B.2If any pressure boundary LEAKAGE exists, or primary to secondary LEAKAGE is not within limits, or if unidentifiedor identified LEAKAGEcannot be reduced to within limits within 4hours, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. The reactor must be brought to MODE3 within 6hours and MODE 4 within 12hours. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.Remaining within the Applicability of the LCO is acceptable to accomplish short duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 7). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 7, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action B.2 is modified by a Note that states that LCO3.0.4.a is not applicable when entering MODE4. This Note prohibits the use of LCO3.0.4.a to enter MODE4 during startup with the LCO not met.
However, there is no restriction on the use of LCO3.0.4.b, if applicable, because LCO3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude,changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 4, the pressure stresses acting on the RCPB are much lower, and further deterioration is much less likely.INDIAN POINT 2B 3.4.13 - 5 Revision 5 RCS Operational LEAKAGEB 3.4.13BASESSURVEILLANCE REQUIREMENTS  (continued)SURVEILLANCESR  3.4.13.1REQUIREMENTS Verifying RCS LEAKAGE to be within the LCOlimits ensures the integrity of the RCPB is maintained. Pressure boundary LEAKAGE would at first appear as unidentified LEAKAGE and can only be positively identified by inspection.
It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an RCS water inventory balance. The RCS water inventory balance must be met with the reactor at steady state operating conditions. The Surveillance is modified by two Notes. Note 1 states that this SRis not required to be performed until 12hours after establishing steady state operation. The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established.Steady state operation is required to perform a proper inventory balance since calculations during maneuvering are not useful. For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.
These leakage detection systems are specified in LCO3.4.15, "RCS Leakage Detection Instrumentation."Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 85gallons per day cannot be measured accurately by an RCS water inventory balance.The 72hour Frequency is areasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents.SR3.4.13.2This SR verifies that primary to secondary LEAKAGE is less than or equal to 85gallons per day through any one SG. Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with LCO 3.4.17 "Steam Generator Tube Integrity," should be evaluated.
The 85 gallons per day limit is measured at room temperature as described in Reference 6. The operational LEAKAGE rate INDIAN POINT 2B 3.4.13 - 6 Revision 5 RCS Operational LEAKAGEB 3.4.13BASESSURVEILLANCE REQUIREMENTS  (continued)limit applies to LEAKAGE through any one SG. If it is not practical to assign the LEAKAGE to an individual SG, allthe primary to secondary LEAKAGE should be conservatively assumed to be from one SG.The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours after establishment of steady state operation. For RCS primary to secondary LEAKAGE determination, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.The Surveillance Frequency of 72 hours is a reasonable interval to trend primary to secondary LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRI guidelines (Ref. 6)
REFERENCES 1.10CFR50, AppendixA, GDC30.
2.Regulatory Guide 1.45, May 1973.
3.WCAP-16157, "Indian Point Unit 2 Stretch Power Uprating Licensing Report," January 2004.
4.Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000. 5.NEI 97-06, "Steam Generator Program Guidelines" as supplemented by TS Amendment 277.
6.EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."
7.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changes to Technical Specification Required Action Endstates for Westinghouse NSSS PWRs," June 2010.INDIAN POINT 2B 3.4.13 - 7 Revision 5 RCS PIV LeakageB 3.4.14 INDIAN POINT 2B 3.4.14 - 1 Revision 2B 3.4  REACTOR COOLANT SYSTEM (RCS)B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage BASESBACKGROUND10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A(Refs. 1, 2, and 3), define RCS PIVs as any two normally closed valves in series within the reactor coolant pressure boundary (RCPB), which separate the high pressure RCS from an attached low pressure system. During their lives, these valves can produce varying amounts of reactor coolant leakage through either normal operational wear or mechanical deterioration. The RCS PIV Leakage LCO allows RCS high pressure operation when leakage through these valves exists in amounts that do not compromise safety. This LCO establishes requirements for Event V PIVs only. Event V PIVs are defined as two check valves in series at a low pressure/RCS interface whose failure may result in a LOCA that by-passes containment. Event V refers to the scenario described for this event in the WASH-1400 study and Generic Letter 87-006 (Refs 4 and 9). A list of all PIVs and requirements for non Event V PIVs are identified in UFSAR 5.2 (Ref. 6).The PIV leakage limit applies to each individual valve. Leakage through bothseries PIVs in a line must be included as part of the identified LEAKAGE, governed by LCO 3.4.13, "RCS Operational LEAKAGE."  This is true during operation only when the loss of RCS mass through two series valves is determined by a water inventory balance (SR 3.4.13.1). A known component of the identified LEAKAGE before operation begins is the least of the two individual leak rates determined for leaking series PIVs during the required surveillance testing; leakage measured through one PIV in a line is not RCS operational LEAKAGE if the other is leaktight.Although this specification provides a limit on allowable PIV leakage rate, itsmain purpose is to prevent overpressure failure of the low pressure portions of connecting systems. The leakage limit is an indication that the PIVs between the RCS and the connecting systems are degraded or degrading.
PIV leakage could lead to overpressure of the low pressure piping or components. Failure consequences could be a loss of coolant accident (LOCA) outside of containment, an unanalyzed accident, that could degrade the ability for low pressure injection.
RCS PIV LeakageB 3.4.14 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.4.14 - 2 Revision 2This LCO also establishes requirements intended to ensure that both RHRsuction isolation valves are closed to provide a double barrier between the RCS and the RHR System when not in the RHR cooling mode and RCS pressure is above the RHR System design pressure. The intent is to prevent a situation in which only one of the two RHR suction isolation valves is closedwhen securing from RHR operation or one of the two RHR suction isolationvalves is opened during power operation. When only one of the RHR suction isolation valves is closed, a single failure of the remaining barrier has the potential to cause a LOCA in which the containment and containment safeguards radionuclide protective barriers are bypassed (Ref. 10). This LCO does not require OPERABILITY of the RHR suction open permissive interlock which acts as a backup to administrative controls that ensure both RHR suction isolation valves are closed when at operating temperature and pressure.The basis for this LCO is the 1975 NRC "Reactor Safety Study" (Ref. 4) thatidentified potential intersystem LOCAs as a significant contributor to the risk of core melt. A subsequent study (Ref. 5) evaluated various PIV configurations to determine the probability of intersystem LOCAs.PIVs typically are provided to isolate the RCS from the following connectedsystems:a. Residual Heat Removal (RHR) System,
: b. Safety Injection System, and
: c. Chemical and Volume Control System.
The PIVs are listed in the UFSAR, Section 5.2 (Ref. 6).
Violation of this LCO could result in continued degradation of a PIV, whichcould lead to overpressurization of a low pressure system and the loss of the integrity of a fission product barrier.
RCS PIV LeakageB 3.4.14 BASES INDIAN POINT 2B 3.4.14 - 3 Revision 2APPLICABLE SAFETY ANALYSESReference 4 identified potential intersystem LOCAs as a significant contributor to the risk of core melt. The dominant accident sequence in the intersystem LOCA category is the failure of the low pressure portion of the RHR System outside of containment. The accident is the result of a postulated failure of the PIVs, which are part of the RCPB, and thesubsequent pressurization of the RHR System. Because the low pressureportion of the RHR System is typically designed for 600 psig, overpressurization failure of the RHR low pressure line would result in a LOCA outside containment and subsequent risk of core melt.Requiring a double barrier between the RCS and the RHR System when notin the RHR cooling mode and RCS pressure is above the RHR System design pressure minimizes the potential that a single failure of the remaining barrier causes a LOCA in which the containment and containment safeguards radionuclide protective barriers are bypassed (Ref. 10).Reference 5 evaluated various PIV configurations, leakage testing of thevalves, and operational changes to determine the effect on the probability of intersystem LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce the probability of an intersystem LOCA.RCS PIV leakage satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCORCS PIV leakage is identified LEAKAGE into closed systems connected tothe RCS. Isolation valve leakage is usually on the order of drops per minute.
Leakage that increases significantly suggests that something is operationally wrong and corrective action must be taken.As specified in Generic Letter 87-006 (Ref. 9), this LCO applies only to thosePIVs which were listed in an order dated April 20, 1981 (Event V Order).
Therefore, this LCO applies only to the following valves:897 A, 897 B, 897 C and 897 D and838 A, 838 B, 838 C and 838 D.A list of all PIVs and requirements for non Event V PIVs are identified inUFSAR Section 5.2 (Ref.6).
RCS PIV LeakageB 3.4.14 BASES LCO  (continued)
INDIAN POINT 2B 3.4.14 - 4 Revision 2The LCO PIV leakage limit is a maximum limit of 5 gpm. However, if theleakage is greater than 1.0 gpm and the leak test indicates that there is significant deterioration from the previous leak test, then the results are unacceptable because of the adverse trend. Significant deterioration is indicated when the leakage is greater than the results of the previous test plus one-half of the margin following the previous test (i.e., margin following previous test is the 5.0 gpm limit minus the results of the previous test).Leakage limit acceptance criteria is based on the leakage rate that wouldexist when the RCS is at normal operating pressure (i.e., 2215 psig and 2255 psig). Reference 7 permits leakage testing at a lower pressuredifferential than between the specified maximum RCS pressure and thenormal pressure of the connected system during RCS operation (the maximum pressure differential) in those types of valves in which the higher service pressure will tend to diminish the overall leakage channel opening. In such cases, the observed rate may be adjusted to the maximum pressure differential by assuming leakage is directly proportional to the pressure differential to the one-half power. Minimum test differential pressure is 150 psid. Leakage may be measured indirectly (as from the performance of pressure indicators) if accomplished in accordance with approved procedures and supported by computations showing the method is capable of demonstrating valve compliance with the leakage criteria.This LCO also requires that RCS boundary valves 730 and 731 are closedand de-energized within 24 hours after securing from use of the RHR in decay heat removal mode.APPLICABILITYIn MODES 1, 2, 3, and 4, this LCO applies because the PIV leakage potential is greatest when the RCS is pressurized. In MODE 4, valves in the RHR flow path are not required to meet the requirements of this LCO when in, or during the transition to or from, the RHR mode of operation.In MODES 5 and 6, leakage limits are not provided because the lower reactorcoolant pressure results in a reduced potential for leakage and for a LOCA outside the containment.
RCS PIV LeakageB 3.4.14 BASES INDIAN POINT 2B 3.4.14 - 5 Revision 2ACTIONSThe Actions are modified by two Notes. Note 1 provides clarification thateach flow path allows separate entry into a Condition. This is allowed based upon the functional independence of the flow path. Note 2 requires an evaluation of affected systems if a PIV is inoperable. The leakage may have affected system operability, or isolation of a leaking flow path with an alternate valve may have degraded the ability of the interconnected system to perform its safety function.A.1 and A.2The flow path must be isolated by two valves. Required Actions A.1 and A.2are modified by a Note that the valves used for isolation must meet the same leakage requirements as the PIVs and must be within the RCPB or the high pressure portion of the system.Required Action A.1 requires that the isolation with one valve must beperformed within 4 hours. Four hours provides time to reduce leakage in excess of the allowable limit and to isolate the affected system if leakage cannot be reduced. The 4 hour Completion Time allows the actions and restricts the operation with leaking isolation valves.The 72 hour Completion Time after exceeding the limit allows for therestoration of the leaking PIV to OPERABLE status. This timeframe considers the time required to complete this Action and the low probability of a second valve failing during this period.B.1 and B.2If leakage cannot be reduced, the plant must be brought to a MODE in whichoverall plant risk is reduced. To achieve this status, the plant must be brought to MODE 3 within 6 hours and MODE 4 within 12 hours. This Action may reduce the leakage and also reduces the potential for a LOCA outside the containment.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 11). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 11, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.
RCS PIV LeakageB 3.4.14 BASESACTIONS  (continued)
INDIAN POINT 2B 3.4.14 - 6 Revision 2Required Action B.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Times are reasonable based on operatingexperience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.C.1If one or both RCS boundary valves 730 and 731 are not closed andde-energized, a single failure of the remaining barrier has the potential to cause a LOCA in which the containment and containment safeguards radionuclide protective barriers are bypassed (Ref. 10). Therefore, action must be taken to ensure that RCS boundary valves 730 and 731 are closed and de-energized. The Completion Time of 24 hours is acceptable because one or both valves are closed and provide an adequate RCS pressure boundary and the low probability of an event that could cause the failure of both RCS pressure boundary valves during this period.SURVEILLANCESR  3.4.14.1REQUIREMENTSPerformance of leakage testing on each RCS PIV or isolation valve used to satisfy Required Action A.1 and Required Action A.2 is required to verify that leakage is below the specified limit and to identify each leaking valve. The leakage limit of 5 gpm maximum applies to each valve. However, if the leakage is greater than 1.0 gpm and the leak test indicates that there is significant deterioration from the previous leak test, then the results are unacceptable because of the adverse trend. Significant deterioration is indicated when the leakage is greater than the results of the previous test plus one-half of the margin following the previous test (i.e., margin following previous test is the 5.0 gpm limit minus the results of the previous test).
Leakage limit acceptance criteria is based on the leakage rate that would RCS PIV LeakageB 3.4.14 BASESACTIONS  (continued)
INDIAN POINT 2B 3.4.14 - 7 Revision 2exist when the RCS is at normal operating pressure. Leakage testingrequires a stable pressure condition.For the two PIVs in series, the leakage requirement applies to each valveindividually and not to the combined leakage across both valves. If the PIVs are not individually leakage tested, one valve may have failed completely and not be detected if the other valve in series meets the leakage requirement. In this situation, the protection provided by redundant valves would be lost.Testing is to be performed every 24 months, a typical refueling cycle, if theplant does not go into MODE 5 for at least 7 days. The 24 month Frequency is consistent with 10 CFR 50.55a(g) (Ref. 8) as contained in the Inservice Testing Program, is within frequency allowed by the American Society of Mechanical Engineers (ASME) Code (Ref. 7), and is based on the need to perform such surveillances under the conditions that apply during an outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.In addition, testing must be performed once after the valve has been openedby flow or exercised to ensure tight reseating. PIVs disturbed in the performance of this Surveillance should also be tested unless documentation shows that an infinite testing loop cannot practically be avoided. Testing must be performed within 24 hours after the valve has been reseated. Within 24 hours is a reasonable and practical time limit for performing this test after opening or reseating a valve.The leakage limit is to be met at the RCS pressure associated with MODES 1and 2. This permits leakage testing at high differential pressures with stable conditions not possible in the MODES with lower pressures.Entry into MODES 3 and 4 is allowed to establish the necessary differentialpressures and stable conditions to allow for performance of this Surveillance.
The Note that allows this provision is complementary to the Frequency of prior to entry into MODE 2 whenever the unit has been in MODE 5 for 7 days or more, if leakage testing has not been performed in the previous 9 months.
In addition, this Surveillance is not required to be performed on the RHR System when the RHR System is aligned to the RCS in the shutdown cooling mode of operation. PIVs contained in the RHR shutdown cooling flow path must be leakage rate tested after RHR is secured and stable unit conditions and the necessary differential pressures are established.
RCS PIV LeakageB 3.4.14 BASESREFERENCES  (continued)
INDIAN POINT 2B 3.4.14 - 8 Revision 2SR  3.4.14.2Periodic verification that both RCS boundary valves 730 and 731 are closedand de-energized ensures that a single failure of the remaining barrier does not cause a LOCA in which the containment and containment safeguards radionuclide protective barriers are bypassed (Ref. 10). The 92 day Frequency is adequate to ensure both valves remain closed and de-energized based on operating experience.REFERENCES 1.10 CFR 50.2.
2.10 CFR 50.55a(c).3.10 CFR 50, Appendix A, Section V, GDC 55.
4.WASH-1400 (NUREG-75/014), Appendix V, October 1975.
5.NUREG-0677, May 1980.
6.UFSAR, Section 5.2.
7.ASME code for Operation and Maintenance of Nuclear Power Plants.
8.10 CFR 50.55a(g).
9.Generic Letter 87-006, Periodic Verification of Leak Tight Integrity ofPressure Isolation Valves.10. WCAP-11736-A, Residual Heat Removal System AutoclosureInterlock (ACI) Removal Report.11. WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changesto Technical Specification Required Action Endstates forWestinghouse NSSS PWRs," June 2010.
RCS Leakage Detection InstrumentationB 3.4.15 INDIAN POINT 2B 3.4.15 - 1 Revision 4B 3.4  REACTOR COOLANT SYSTEM (RCS)B 3.4.15 RCS Leakage Detection Instrumentation BASESBACKGROUNDGDC 30 of Appendix A to 10 CFR 50 (Ref. 1) requires means for detectingand, to the extent practical, identifying the location of the source of RCS LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.Leakage detection systems must have the capability to detect significantreactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE.Industry practice has shown that water flow changes of 0.5 to 1.0 gpm can bereadily detected in contained volumes by monitoring changes in water level, in flow rate, or in the operating frequency of a pump. The containment sump used to collect unidentified LEAKAGE and fan cooler condensate flow rate monitors are capable of detecting increases of 0.5 to 1.0 gpm in the normal flow rates. The containment sump flow and level indicators are capable of detecting a 1 gpm leak within 4 hours (Ref. 4). This sensitivity is acceptable for detecting increases in unidentified LEAKAGE.The reactor coolant contains radioactivity that, when released to thecontainment, can be detected by radiation monitoring instrumentation.
Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects. Instrument sensitivities of 10
-9Ci/cc radioactivity forparticulate monitoring and of 10
-6Ci/cc radioactivity for gaseous monitoringare practical for these leakage detection systems. Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid responses to RCS LEAKAGE.Humidity Detectors located just upstream of each fan cooling unit are used todetermine the dewpoint in containment. An increase in humidity of the containment atmosphere would indicate release of water vapor to the containment. Dew point temperature measurements can thus be used to monitor humidity levels of the containment atmosphere as an indicator of potential RCS LEAKAGE. A 1F increase in dew point is within the sensitivityrange of available instruments.
RCS Leakage Detection InstrumentationB 3.4.15 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.4.15 - 2 Revision 4Since the humidity level is influenced by several factors, a quantitativeevaluation of an indicated leakage rate by this means may be questionable and should be compared to observed increases in liquid flow into or from the containment sump and condensate flow from fan cooler units (FCU). Humidity level monitoring is considered most useful as an indirect alarm or indicationto alert the operator to a potential problem. Humidity monitors are notrequired by this LCO.Air temperature and pressure monitoring methods may also be used to inferunidentified LEAKAGE to the containment. Containment temperature and pressure fluctuate slightly during plant operation, but a rise above the normally indicated range of values may indicate RCS leakage into the containment. The relevance of temperature and pressure measurements are affected by containment free volume and, for temperature, detector location.
Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment. Temperature and pressure monitors are not required by this LCO.APPLICABLE SAFETY ANALYSESThe need to evaluate the severity of an alarm or an indication is important to the operators, and the ability to compare and verify with indications from other systems is necessary. The system response times and sensitivities are described in the UFSAR (Ref. 3). Multiple instrument locations are utilized, if needed, to ensure that the transport delay time of the leakage from its source to an instrument location yields an acceptable overall response time.The safety significance of RCS LEAKAGE varies widely depending on itssource, rate, and duration. Therefore, detecting and monitoring RCS LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leakage occur detrimental to the safety of the unit and the public.RCS leakage detection instrumentation satisfies Criterion 1 of10 CFR 50.36(c)(2)(ii).
LCOOne method of protecting against large RCS leakage derives from the ability of instruments to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide a RCS Leakage Detection InstrumentationB 3.4.15 BASES LCO  (continued)
INDIAN POINT 2B 3.4.15 - 3 Revision 4high degree of confidence that extremely small leaks are detected in time toallow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.The LCO is satisfied when monitors of diverse measurement means areavailable. Thus, the containment sump monitor, in combination with agaseous or particulate radioactivity monitor and the containment fan cooler condensate flow rate monitor, provides an acceptable minimum.The following instruments may be used to satisfy requirements for diverseRCS leakage monitoring requirements:a. Requirement for one containment sump (level or discharge flow)monitor may be satisfied by any one of the following instruments:LT-3300 a containment sump level instrument is used to meetthis requirement; orFIT-3401 if containment sump discharge flow is used to meet thisrequirement.b. Requirement for one containment atmosphere radioactivity monitor(gaseous or particulate) may be satisfied by either R-41, Containment Air Particulate Monitor, or R-42, Containment Air Gaseous Monitor.
Note that either FCU 22 or FCU 25 should be in operation to provide representative sampling to the R-41 and R-42 Radiation Monitors. If neither FCU 22 or FCU 25 are in operation, plant operating procedures provide direction for use of temporary sampling hoses that may be used to ensure R-41 and R-42 receive representative samples.c. Requirement for one containment fan cooler condensate flow ratemonitor is satisfied by one condensate flow monitor associated with anyFCU with fan in operation and cooling water flow through the unit.APPLICABILITYBecause of elevated RCS temperature and pressure in MODES 1, 2, 3, and 4, RCS leakage detection instrumentation is required to be OPERABLE.In MODE 5 or 6, the temperature is to be 200F and pressure is maintainedlow or at atmospheric pressure. Since the temperatures and pressures arefar lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation are much smaller. Therefore, the requirements of this
 
LCO are not applicable in MODES 5 and 6.
RCS Leakage Detection InstrumentationB 3.4.15 BASES INDIAN POINT 2B 3.4.15 - 4 Revision 4ACTIONSA.1 and A.2With the required containment sump monitor inoperable, no other form ofsampling can provide the equivalent information; however, the containment atmosphere radioactivity monitor will provide indications of changes in leakage. Together with the atmosphere monitor, the periodic surveillance for RCS water inventory balance, SR 3.4.13.1, must be performed at an increased frequency of 24 hours to provide information that is adequate to detect leakage. A Note is added allowing that SR 3.4.13.1 is not required to be performed until 12 hours after establishing steady state operation (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows). The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established.Restoration of the required sump monitor to OPERABLE status within aCompletion Time of 30 days is required to regain the function after the monitor's failure. This time is acceptable, considering the Frequency and adequacy of the RCS water inventory balance required by Required Action A.1.B.1 and B.2With both gaseous and particulate containment atmosphere radioactivitymonitoring instrumentation channels inoperable, alternative action is required.
Either grab samples of the containment atmosphere must be taken and analyzed or water inventory balances, in accordance with SR 3.4.13.1, must be performed to provide alternate periodic information.With a sample obtained and analyzed or water inventory balance performedevery 24 hours, the reactor may be operated for up to 30 days to allow restoration of the required containment atmosphere radioactivity monitors.The 24 hour interval provides periodic information that is adequate to detectleakage. A Note is added allowing that SR 3.4.13.1 is not required to be performed until 12 hours after establishing steady state operation (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows). The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established.
RCS Leakage Detection InstrumentationB 3.4.15 BASESACTIONS  (continued)
INDIAN POINT 2B 3.4.15 - 5 Revision 4C.1 and C.2With the required containment FCU condensate flow rate monitor inoperable,alternative action is again required. Either SR 3.4.15.1 must be performed or water inventory balances, in accordance with SR 3.4.13.1, must be performed to provide alternate periodic information. Provided a CHANNEL CHECK is performed every 8 hours or a water inventory balance is performed every 24 hours, reactor operation may continue while awaiting restoration of the containment FCU condensate flow rate monitor to OPERABLE status.The 24 hour interval provides periodic information that is adequate to detectRCS LEAKAGE. A Note is added allowing that SR 3.4.13.1 is not required to be performed until 12 hours after establishing steady state operation (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows). The 12 hour allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established.D.1 and D.2With the required containment atmosphere radioactivity monitor and therequired containment FCU condensate flow rate monitor inoperable, the only means of detecting leakage is the containment sump monitor. This Condition does not provide the required diverse means of leakage detection. The Required Action is to restore either of the inoperable required monitors to OPERABLE status within 30 days to regain the intended leakage detection diversity. The 30 day Completion Time ensures that the plant will not be operated in a reduced configuration for a lengthy time period.E.1 and E.2If a Required Action of Condition A, B, C, or D cannot be met, the plant mustbe brought to a MODE in which overall plant risk is reduced. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 5). In MODE 4the Steam Generators and Residual Heat Removal System are availableto remove decay heat, which provides diversity and defense in depth. As stated in Reference 5, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling RCS Leakage Detection InstrumentationB 3.4.15 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.4.15 - 6 Revision 4be lost while relying on this Required Action, there are preplanned actionsto ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action E.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Times are reasonable, based on operatingexperience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.F.1With all required monitors inoperable, no automatic means of monitoringleakage are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.SURVEILLANCESR  3.4.15.1, SR  3.4.15.2 and SR  3.4.15.3REQUIREMENTSSR 3.4.15.1, SR 3.4.15.2 and SR 3.4.15.3 require the performance of CHANNEL CHECKS of the required containment atmosphere radioactivity monitor, the required containment sump (level or discharge flow) monitor, and the required containment fan cooler condensate flow rate monitor. These checks are required only on the instruments being used to satisfy the requirements of the LCO (i.e., either the containment sump level or the containment sump discharge flow and either R-41, Containment Air Particulate Monitor, or R-42, Containment Air Gaseous Monitor). For the required containment sump (level or discharge flow) monitor, this check includes calculation of the indicated leakage rate based on changes in the containment sump level or the total containment sump discharge flow. The check gives reasonable confidence that the channel is operating properly. The Frequency of 12 hours is based on instrument reliability and is reasonable for detecting off normal conditions.
RCS Leakage Detection InstrumentationB 3.4.15 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.4.15 - 7 Revision 4SR  3.4.15.4 and SR  3.4.15.5SR 3.4.15.4 requires the performance of a COT on the required containmentsump discharge flow monitor. The test ensures that the monitor can perform its function in the desired manner. SR 3.4.15.5 requires the performance of a COT on the required containment atmosphere radioactivity monitor. The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string.
The Frequency of 31 days considers instrument reliability, and operating experience has shown that it is proper for detecting degradation.SR  3.4.15.6, SR  3.4.15.7, and SR  3.4.15.8These SRs require the performance of a CHANNEL CALIBRATION for eachof the RCS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Frequency of 24 months is a typical refueling cycle and considers channel reliability. Operating experience has proven that this Frequency is acceptable.REFERENCES 1.10 CFR 50, Appendix A, Section IV, GDC 30.
2.Regulatory Guide 1.45.
3.UFSAR, Section 6.7.
4.Attachment C of IP2's May 23, 1988 Letter to the NRC requesting elimination of postulated primary loop pipe rupture as a design basis, "Indian Point Unit 2 - Evaluation of R.G. 1.45 Compliance".
5.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changesto Technical Specification Required Action Endstates for Westinghouse NSSS PWRs," June 2010.
RCS Specific ActivityB 3.4.16B 3.4  REACTOR COOLANT SYSTEM (RCS)B 3.4.16  RCS Specific ActivityBASES BACKGROUNDThe maximum dose that an individual at the exclusion areaboundary can receive for 2hours following an accident, or at the low population zone outer boundary for the radiological release duration,is specified in 10 CFR 50.67(Ref.1). Doses to control room operators must be limited per GDC 19. The limits on specific activity ensure that the offsite and control room dosesare appropriately limited during analyzed transients and accidents.The RCS specific activity LCO limits the allowable concentration level of radionuclidesin the reactor coolant. The LCO limits are established to minimize the dose consequences in the event of a steam line break (SLB) or steam generator tube rupture (SGTR) accident.The LCO contains specific activity limits for both DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133. The allowable levels are intended to ensure that offsite and control room doses meet the appropriate acceptance criteria in the Standard Review Plan (Ref. 2).APPLICABLEThe LCO limits on the specific activity of the reactor coolant ensure thatSAFETY the resulting offsite and control room doses meet the appropriate SRPANALYSESacceptance criteria following a SLB or SGTR accident. The safety analyses (Refs. 3 and 4) assume the specific activity of the reactor coolant is at the LCO limits, and an existing reactor coolant steam generator (SG) tube leakage rate of 150 gallon per day per SGexists.
The safety analyses assume the specific activity of the secondary coolant is at its limit of 0.15 Ci/gm DOSE EQUIVALENT I-131 from LCO3.7.18,Secondary Specific Activity." The analyses for the SLB and SGTR accidentsestablish the acceptance limits for RCS specific activity. Reference to these analyses is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.The safety analyses consider two cases of reactor coolant iodine specific activity. One case assumes specific activity at 1.0Ci/gm DOSE EQUIVALENT I-131 with a concurrent large iodine spike that increases  the rate of release of iodine from the fuel rods containing cladding defects to the primary coolant immediately after a SLB (by a factor of 500),or SGTR(by a factor of 335), respectively. The second case assumes the initial reactor coolant iodine activity at 60.0Ci/gm DOSE EQUIVALENT I-131 due to an iodine spike caused by a reactoror an RCS transient prior INDIAN POINT 2B 3.4.16-1 Revision 3 RCS Specific Activity B 3.4.16    INDIAN POINT 2 B 3.4.16-2 Revision 3  BASES APPLICABLE SAFETY ANALYSES  (continued) to the accident. In both cases, the noble gas specific activity is assumed to be 632 Ci/gm DOSE EQUIVALENT XE-133.
 
The SGTR analysis also assumes a loss of offsite power at the same time as the reactor trip. The SGTR causes a reduction in reactor coolant inventory. The reduction initiates a reactor trip from a low pressurizer pressure signal or an RCS overtemperature T signal.
The loss of offsite power causes the steam dump valves to close to protect the condenser. The rise in pressure in the ruptured SG discharges radioactively contaminated steam to the atmosphere through the SG power operated relief valves and the main steam safety valves. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends and the Residual Heat Removal (RHR) system is placed in service.
 
The SLB radiological analysis assumes that offsite power is lost at the same time as the pipe break occurs outside containment. Reactor trip occurs after the generation of an SI signal on low steam line pressure. The affected SG blows down completely and steam is vented directly to the atmosphere. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends and the RHR system is placed in service.
 
Operation with iodine specific activity levels greater than the LCO limit is permissible, if the activity levels do not exceed 60.0 Ci/gm for more than 48 hours.
 
The limits on RCS specific activity are also used for establishing standardization in radiation shielding and plant personnel radiation protection practices.
 
RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
 
LCO The iodine specific activity in the reactor coolant is limited to 1.0 Ci/gm DOSE EQUIVALENT I-131, and the noble gas specific activity in the reactor coolant is limited to 632 Ci/gm DOSE EQUIVALENT XE-133. The limits on specific activity ensure that offsite and control room doses will meet the appropriate SRP acceptance criteria (Ref. 2).
The SLB and SGTR accident analyses (Refs. 3 and 4) show that the calculated doses are within acceptable limits. Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of a SLB or SGTR, lead to doses that exceed the SRP acceptance criteria (Ref. 2).
RCS Specific Activity B 3.4.16    INDIAN POINT 2 B 3.4.16-3 Revision 3  BASES APPLICABILITY In MODES 1, 2, 3, and 4, operation within the LCO limits for DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133 is necessary to limit the potential consequences of a SLB or SGTR to within the SRP acceptance criteria (Ref. 2). In MODES 5 and 6, the steam generators are not being used for decay heat removal, the RCS and steam generators are depressurized, and primary to secondary leakage is minimal. Therefore, the monitoring of RCS specific activity is not required. ACTIONS A.1 and A.2 With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples at intervals of 4 hours must be taken to demonstrate that the specific activity is < 60.0 Ci/gm. The Completion Time of 4 hours is required to obtain and analyze a sample. Sampling is continued every 4 hours to provide a trend.
The DOSE EQUIVALENT I-131 must be restored to within limit within 48 hours. The Completion Time of 48 hours is acceptable since it is expected that, if there were an iodine spike, the normal coolant iodine concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.
A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODE(S), relying on Required Actions A.1 and A.2 while the DOSE EQUIVALENT I-131 LCO limit is not met. This allowance is acceptable due to the significant conservatism  incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, power operation.
 
B.1 With the DOSE EQUIVALENT XE-133 greater than the LCO limit, DOSE EQUIVALENT XE-133 must be restored to within limit within 48 hours. The allowed Completion Time of 48 hours is acceptable since it is expected that, if there were a noble gas spike, the normal coolant noble gas concentration would be restored within this time period. Also, there is a low probability of a SLB or SGTR occurring during this time period.
 
RCS Specific Activity B 3.4.16    INDIAN POINT 2 B 3.4.16-4 Revision 3  BASES ACTIONS  (continued) A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODES(S), relying on Required Action B.1 while the DOSE EQUIVALENT XE-133 LCO limit is not met. This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient-specific activity excursions while the plant remains at, or proceeds to, power operation.
 
C.1 and C.2 If the Required Action and associated Completion Time of Condition A or B is not met, or if the DOSE EQUIVALENT I-131 is > 60.0 Ci/gm, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR  3.4.16.1 REQUIREMENTS SR 3.4.16.1 requires performing a gamma isotopic analysis as a measure of the noble gas specific activity of the reactor coolant at least once every 7 days. This measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in the noble gas specific activity.
Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The 7 day Frequency considers the low probability of a gross fuel failure during this time.
Due to the inherent difficulty in detecting Kr-85 in a reactor coolant sample due to masking from radioisotopes with similar decay energies, such as F-18 and I-134, it is acceptable to include the minimum detectable activity for Kr-85 in the SR 3.4.16.1 calculation. If a specific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE-133 is not detected, it should be assumed to be present at the minimum detectable activity.
A Note modifies the SR to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the SR. This allows the Surveillance to be performed in those MODES, prior to entering MODE 1.
 
RCS Specific Activity B 3.4.16 INDIAN POINT 2 B 3.4.16-5 Revision 3  BASESSURVEILLANCE REQUIREMENTS  (continued) SR 3.4.16.2This Surveillance is performed to ensure iodine specific activity remains within the LCO limit during normal operation and following fast power changes when iodine spiking is more apt to occur. The 14 day Frequency is adequate to trend changes in the iodine activity level, considering noble gas activity is monitored every 7 days. The Frequency, between 2 and 6 hours after a power change > 15% RTP within a 1 hour period, is established because the iodine levels peak during this time following iodine spike initiation; samples at other times would provide inaccurate results.The Note modifies this SR to allow entry into and operation in MODE 4, MODE 3, and MODE 2 prior to performing the SR. This allows the Surveillance to be performed in those MODES, prior to entering MODE 1. REFERENCES 1. 10 CFR 50.67. 2. Standard Review Plan (SRP) Section 15.0.1 "Radiological Consequence Analyses Using Alternative Source Terms." 3. FSAR, Section 14.2.4.
: 4. FSAR, Section 14.2.5.
SG Tube IntegrityB 3.4.17B 3.4  REACTOR COOLANT SYSTEM (RCS)B 3.4.17 Steam Generator (SG) Tube IntegrityBASES BACKGROUNDSteam generator (SG) tubes are small diameter, thin walled tubes that carry primary coolant through the primary to secondary heat exchangers. The SG tubes have a number of important safety functions. Steam generator tubes are an integral part of the reactor coolant pressure boundary (RCPB) and, as such, are relied on to maintain the primary system's pressure and inventory.
The SG tubes isolate the radioactive fission products in the primary coolant from the secondary system. In addition, as part of the RCPB, the SG tubes are unique in that they act as the heat transfer surface between the primary and secondary systems to remove heat from the primary system. This Specification addresses only the RCPB integrity function of the SG. The SG heat removal function is addressed by LCO 3.4.4, "RCS Loops - MODES 1 and 2," LCO 3.4.5, "RCS Loops - MODE 3," LCO 3.4.6, "RCS Loops -
MODE 4," and LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled."SG tube integrity means that the tubes are capable of performing their intended RCPB safety function consistent with the licensing basis, including applicable regulatory requirements.Steam generator tubing is subject to a variety of degradation mechanisms. Steam generator tubes may experience tube degradationrelated to corrosion phenomena, such as wastage, pitting, intergranular attack, and stress corrosion cracking, along with other mechanically induced phenomena such as denting and wear. These degradation mechanisms can impair tube integrity if they are not managed effectively. The SG performance criteria are used to manage SG tube degradation.Specification 5.5.7, "Steam Generator (SG) Program," requires that a program be established and implemented to ensure that SG tube integrity is maintained. Pursuant to Specification 5.5.7, tube integrity is maintained when the SG performance criteria are met. There are three SG performance criteria:  structural integrity, accident induced leakage, and operational LEAKAGE. The SG performance criteria are described in Specification 5.5.7. Meeting the SG performance criteria provides reasonable assurance of maintaining tube integrity at normal and accident conditions.The processes used to meet the SG performance criteria are defined by the Steam Generator Program Guidelines (Ref. 1). INDIAN POINT 2B 3.4.17 - 1 Revision 1 SG Tube IntegrityB 3.4.17BASESAPPLICABLE SAFETY ANALYSES The steam generator tube rupture (SGTR) accident is the limiting design basis event for SG tubes and avoiding an SGTR is the basis for this Specification. The analysis of a SGTR event assumes a bounding primary to secondary LEAKAGE rate equal to the operational LEAKAGE rate limits in LCO 3.4.13, "RCS Operational LEAKAGE," plus the leakage rate associated with a double-ended rupture of a single tube. The accident analysis for a SGTR assumes the contaminated secondary fluid is released to the atmosphere via SG safety valves or atmospheric relief valves.The analysis for design basis accidents andtransients other than a SGTR assume the SG tubes retain their structural integrity (i.e., they are assumed not to rupture.)  In these analyses, the steam discharge to the atmosphere is based on the total primary to secondary LEAKAGE from all SGs of 600 gallons per day or is assumed to increase to 600 gallons per day as a result of accident induced conditions. For accidents that do not involve fuel damage, the primary coolant activity level of DOSE EQUIVALENT I-131 is assumed to be equal to the LCO 3.4.16, "RCSSpecific Activity,"limits. For accidents that assume fuel damage, the primary coolant activity is a function of the amount of activity released from the damaged fuel. The dose consequences of these events are withinthe applicable limits of 10 CFR 50.67 (Ref. 2) and Regulatory Guide 1.183 (Ref. 3).Steam generator tube integrity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
LCOThe LCO requires that SG tube integrity be maintained. The LCO also requires that all SG tubes that satisfy the pluggingcriteria be plugged in accordance with the Steam Generator Program.During an SG inspection, any inspected tube that satisfies the Steam Generator Program pluggingcriteria is removed from service by plugging. If a tube was determined to satisfy the pluggingcriteria but was not plugged, the tube may still have tube integrity.In the context of this Specification, a SG tube is defined as the entire length of the tube, including the tube wall between the tube-to-tubesheet weld as the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.INDIAN POINT 2B 3.4.17 - 2 Revision 1 SG Tube IntegrityB 3.4.17BASESLCO (continued)A SG tube has tube integrity when it satisfies the SG performance criteria. The SG performance criteria are defined in Specification 5.5.7, "Steam Generator Program," and describe acceptable SG tube performance. The Steam Generator Program also provides the evaluation process for determining conformance with the SG performance criteria.There are three SG performance criteria: structural integrity, accident induced leakage, and operational LEAKAGE. Failure to meet any one of these criteria is considered failure to met the LCO.The structural integrity performance criterion provides a margin of safety against tube burst or collapseunder normal and accident conditions, and ensures structural integrity of the SG tubes under all anticipated transients included in the design specification. Tube burst is defined as, "The gross structural failure of the tube wall. The condition typically corresponds to an unstable opening displacement (e.g., opening area increased in response to constant pressure) accompanied by ductile (plastic) tearing of the tube material at the ends of the degradation."  Tube collapse is defined as, "For the load displacement curve for a given structure, collapse occurs at the top of the load versus displacement curve where the slope of the curve becomes zero."  The structural integrity performance criterion provides guidance on assessing loads that have a significant effect on burst or collapse. In that context, the term "significant" is defined as "An accident loading condition other than differential pressure is considered significant when the addition of such loads in the assessment of the structural integrity performance criterion could cause a lower structural limit or limiting burst/collapse condition to be established."  For tube integrity evaluations, except for circumferential degradations, axial thermal loads are classified as secondary loads. For circumferential degradation, the classification of axial thermal loads as primary or secondary loads will be evaluated on a case-by-case basis. The division between primary and secondary classifications will be based on detailed analysis and/or testing.Structural integrity requires that the primary membrane stress intensity in a tube not exceed the yield strength for all ASME Code, Section III, Service Level A (normal operating conditions) and Service Level B (upset or abnormal conditions) transients included inthe design specification. This includes safety factors and applicable design basis loads based on ASME Code, Section III, Subsection NB (Ref. 4) and Draft Regulatory Guide 1.121 (Ref. 5).INDIAN POINT 2B 3.4.17 - 3 Revision 1 SG Tube IntegrityB 3.4.17BASESLCO (continued)The accident induced leakage performance criterion ensures that the primary to secondary LEAKAGE caused by a design basis accident, other than a SGTR, is within the accident analysis assumptions. The accident analysis assumes that accident induced leakage does not exceed 150 gallons per day per SG. The accident induced leakage rate includes any primary to secondary LEAKAGE existing prior to the accident in addition to primary to secondary LEAKAGE induced during the accident.The operational LEAKAGE performance criterion provides an observable indication of SG tube conditions during plant operation. The limit on operational LEAKAGE is contained in LCO 3.4.13, "RCS Operational LEAKAGE," and limits primary to secondary LEAKAGE through any one SG to 150 gallons per day. This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line break. If this amount of LEAKAGE is due to more than one crack, the cracks are very small, and the above assumption is conservative.APPLICABILITYSteam generator tube integrity is challenged when the pressure differential across the tubes is large. Large differential pressures across SG tubes can only be experienced in MODE 1, 2, 3, or 4.RCS conditions are far less challenging in MODES 5 and 6 than during MODES 1, 2, 3, and 4. In MODES 5 and 6, primary to secondary differential pressure is low, resulting in lower stresses and reduced potential for LEAKAGE.ACTIONSThe ACTIONS are modified by a Note clarifying that the Conditions may be entered independently for each SG tube. This is acceptable because the Required Actions provide appropriate compensatory actions for each affected SG tube. Complying with the Required Actions may allow for continued operation, and subsequent affected SG tubes are governed by subsequent Condition entry and application of associated Required Actions.A.1 and A.2Condition A applies if it is discovered that one or more SG tubes examined in an inservice inspection satisfy the tube pluggingcriteria but were not plugged in accordance with the Steam Generator Program as required by SR 3.4.17.2.INDIAN POINT 2B 3.4.17 - 4 Revision 1 SG Tube IntegrityB 3.4.17BASESACTIONS (continued)A.1 and A.2(continued)An evaluation of SG tube integrity of the affected tube(s) must be made. Steam generator tube integrity is based on meeting the SG performance criteria described in the Steam Generator Program. The SG pluggingcriteria define limits on SG tube degradation that allow for flaw growth between inspections while still providing assurance that the SG performance criteria will continue to be met. In order to determine if a SG tube that should have been plugged has tube integrity, an evaluation must be completed that demonstrates that the SG performance criteria will continue to be met until the next refueling out age or SG tube inspection. The tube integrity determination is based on the estimated condition of the tube at the time the situation is discovered and the estimated growth of the degradation prior to the next SG tube inspection. If it is determined that tube integrity is not being maintained, Condition B applies.A Completion Time of 7 days is sufficient to complete the evaluation while minimizing the risk of plant operation with a SG tube that may not have tube integrity. If the evaluation determines that the affected tube(s) have tube integrity, Required Action A.2 allows plant operation to continue until the next refueling outage or SG inspection provided the inspection interval continues to be supported by an operational assessment that reflects the affected tubes.
However,the affected tube(s) must be plugged prior to entering MODE 4 following the next refueling outageor SG inspection. This Completion Time is acceptable since operation until the next inspectionis supported by the operational assessment.B.1 and B.2If the Required Actions and associated Completion Times of Condition A are not met or if SG tube integrity is not being maintained, the reactor must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours.The allowed Completion Times are reasonable, based on operating experience, to reach the desired plant conditions from full power conditions in an orderly manner and without challenging plant systems.INDIAN POINT 2B 3.4.17 - 5 Revision 1 SG Tube IntegrityB 3.4.17BASESSURVEILLANCESR  3.4.17.1REQUIREMENTSDuring shutdown periods the SGs are inspected as required by this SR and the Steam Generator Program. NEI 97-06, Steam Generator Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, establish the content of the Steam Generator Program. Use of the Steam Generator Program ensures that the inspection is appropriate and consistent with accepted industry practices.During SG inspections a condition monitoring assessment of the SG tubes is performed. The condition monitoring assessment determines the "as found" condition of the SG tubes. The purpose of the condition monitoring assessment is to ensure that the SG performance criteria have been met for the previous operating period.The Steam Generator Program determines the scope of the inspection and the methods used to determine whether the tubes contain flaws satisfying the tube pluggingcriteria. Inspection scope (i.e., which tubes or areas of tubing within the SG are to be inspected) is a function of existing and potential degradation locations. The Steam Generator Program also specifies the inspection methods to be used to find potential degradation.
Inspection methods area function of degradation morphology, non-destructive examination (NDE) technique capabilities, and inspection locations.The Steam Generator Program defines the Frequency ofSR 3.4.17.1. The Frequency is determined by the operational assessment and other limits in the SG examination guidelines (Ref. 6). The Steam Generator Program uses information on existing degradations and growth rates to determine an inspection Frequency that provides reasonable assurance that the tubing will meet the SG performance criteria at the next scheduled inspection. In addition, Specification 5.5.7 contains prescriptive requirements concerning inspection intervals to provide added assurance that the SG performance criteria will be met between scheduled inspections.If crack indications are found in any SG tube, the maximum inspection interval for all affectedand potentially affected SGs is restricted by Specification 5.5.7 untilsubsequent inspections support extending the inspection interval.SR 3.4.17.2During an SG inspection, any inspected tube that satisfies the Steam Generator Program pluggingcriteria is removed from service by plugging.
The tube pluggingcriteria delineated in Specification 5.5.7 are intended to INDIAN POINT 2B 3.4.17 - 6 Revision 1 SG Tube IntegrityB 3.4.17BASESSURVEILLANCE REQUIREMENTS (continued)SR 3.4.17.2 (continued)ensure that tubes accepted for continued service satisfy the SG performance criteria with allowance for error in the flaw size measurement and for future flaw growth. In addition, the tube plugging criteria, in conjunction with other elements of the Steam Generator Program, ensure that the SG performance criteria will continue to be met until the next inspection of the subject tube(s).
Reference 1 provides guidance for performing operational assessments to verify that the tubes remaining in service will continue to meet the SG performance criteria.The Frequency of prior to entering MODE 4 following a SG inspection ensures that the Surveillance has been completed and all tubes meeting the ensure that tubes accepted for continued service satisfy the SG performance criteria with allowance for error in the flaw size measurement and for future flaw growth. In addition, the tube plugging criteria, in conjunction with other criteria are plugged prior to subjecting the SG tubes to significant primary to secondary pressure differential.
REFERENCES 1.NEI 97-06, "Steam Generator Program Guidelines."
2.10 CFR 50.67.
3.Regulatory Guide 1.183, "Alternate Radiological Source Terms for Evaluating Design Basis Accidents in Nuclear Power Reactors", July 2000.4.ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.
5.Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam Generator Tubes," August 1976.
6.EPRI, "Pressurized Water Reactor Steam Generator Examination Guidelines."INDIAN POINT 2B 3.4.17 - 7 Revision 1 Accumulators B 3.5.1  INDIAN POINT 2 B 3.5.1 - 1 Revision 0 B 3.5  EMERGENCY CORE COOLING SYSTEMS (ECCS) B 3.5.1 Accumulators BASES BACKGROUND The functions of the ECCS accumulators are to supply water to the reactor vessel during the blowdown phase of a loss of coolant accident (LOCA), to provide inventory to help accomplish the refill phase that follows thereafter, and to provide Reactor Coolant System (RCS) makeup for a small break LOCA.
 
The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.
 
In the refill phase of a LOCA, which immediately follows the blowdown phase, reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The core is essentially in adiabatic heatup. The balance of accumulator inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer so as to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of safety injection (SI) water.
 
The accumulators are pressure vessels partially filled with borated water and pressurized with nitrogen gas. The accumulators are passive components, since no operator or control actions are required in order for them to perform their function. Internal accumulator tank pressure is sufficient to discharge the accumulator contents to the RCS, if RCS pressure decreases below the accumulator pressure.
 
Each accumulator is piped into an RCS cold leg via an accumulator line and is isolated from the RCS by a motor operated isolation valve and two check valves in series.
 
The accumulator size, water volume, and nitrogen cover pressure are selected so that three of the four accumulators are sufficient to partially cover the core before significant clad melting or zirconium water reaction can occur following a LOCA. The need to ensure that three accumulators are adequate for this function is consistent with the LOCA assumption that the entire contents of one accumulator will be lost via the RCS pipe break during the blowdown phase of the LOCA.
Accumulators B 3.5.1 BASES INDIAN POINT 2 B 3.5.1 - 2 Revision 0 APPLICABLE SAFETY ANALYSES The accumulators are assumed OPERABLE in both the large and small break LOCA analyses at full power (Ref. 1). These are the Design Basis Accidents (DBAs) that establish the acceptance limits for the accumulators.
Reference to the analyses for these DBAs is used to assess changes in the accumulators as they relate to the acceptance limits.
 
In performing the LOCA calculations, conservative assumptions are made concerning the availability of ECCS flow. In the early stages of a LOCA, with or without a loss of offsite power, the accumulators provide the sole source of makeup water to the RCS. The assumption of loss of offsite power is required by regulations and conservatively imposes a delay wherein the ECCS pumps cannot deliver flow until the emergency diesel generators start, come to rated speed, and go through their timed loading sequence. In cold leg break scenarios, the entire contents of one accumulator are assumed to be lost through the break.
 
The limiting large break LOCA is a double ended guillotine break near the mid point of the cold leg. During this event, the accumulators discharge to the RCS as soon as RCS pressure decreases to below accumulator pressure.
 
As a conservative estimate, no credit is taken for ECCS pump flow until an effective delay has elapsed. This delay includes the time required for diesel startup and loading of the safety injection pumps onto the emergency buses.
During this time, the accumulators are analyzed as providing the sole source of emergency core cooling. No operator action is assumed during the blowdown stage of a large break LOCA.
 
The worst case small break LOCA analyses also assume a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the accumulators, with pumped flow then providing continued cooling. As break size decreases, the accumulators and high head safety injection pumps both play a part in terminating the rise in clad temperature. As break size continues to decrease, the role of the accumulators continues to decrease until they are not required and the high head safety injection pumps become solely responsible for terminating the temperature increase.
 
This LCO helps to ensure that the following acceptance criteria established for the ECCS by 10 CFR 50.46 (Ref. 2) will be met following a LOCA:
Accumulators B 3.5.1 BASES APPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.5.1 - 3 Revision 0
: a. Maximum fuel element cladding temperature is  2200 F, 
: b. Maximum cladding oxidation is  0.17 times the total cladding thickness before oxidation, 
: c. Maximum hydrogen generation from a zirconium water reaction is  0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react, and
: d. Core is maintained in a coolable geometry.
 
Since the accumulators discharge during the blowdown phase of a LOCA, they do not contribute to the long term cooling requirements of 10 CFR 50.46.
 
For both the large and small break LOCA analyses, a nominal contained accumulator water volume is used. The contained water volume is the same as the deliverable volume for the accumulators, since the accumulators are emptied, once discharged. The large break LCO analysis assumes a 795 ft 3 accumulator water volume. Variations in volume are addressed as initial condition uncertainty. The small break LOCA analysis results are not sensitive to accumulator water volume differences. The safety analysis assumes analytical limits for accumulator volume of  723 cubic feet and  875 cubic feet. To allow for instrument inaccuracy, administrative limits for accumulator volume of  763 cubic feet and  835 cubic feet are used.
 
The minimum boron concentration setpoint is used in the post LOCA boron concentration calculation. The calculation is performed to assure reactor subcriticality in a post LOCA environment. Of particular interest is the large break LOCA, since no credit is taken for control rod assembly insertion. A reduction in the accumulator minimum boron concentration would produce a subsequent reduction in the available containment sump concentration for post LOCA shutdown and an increase in the maximum sump pH. The maximum boron concentration is used in determining the cold leg to hot leg recirculation injection switchover time and minimum sump pH.
Accumulators B 3.5.1 BASES APPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.5.1 - 4 Revision 0 The large and small break LOCA analyses are performed using the nominal value of accumulator pressure with variations in pressure addressed as initial condition uncertainty. The safety analysis assumes analytical limits for accumulator pressure of  598 psig and  685 psig. To allow for instrument inaccuracy, administrative limits for accumulator pressure of  630 psig and  675 psig are used. The maximum nitrogen cover pressure limit prevents accumulator relief valve actuation, and ultimately preserves accumulator integrity.
 
The effects on containment mass and energy releases from the accumulators are accounted for in the appropriate analyses (Refs. 1 and 3).
 
The accumulators satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO The LCO establishes the minimum conditions required to ensure that the accumulators are available to accomplish their core cooling safety function following a LOCA. Four accumulators are required to ensure that 100% of the contents of three of the accumulators will reach the core during a LOCA.
This is consistent with the assumption that the contents of one accumulator spill through the break. If less than three accumulators are injected during the blowdown phase of a LOCA, the ECCS acceptance criteria of 10 CFR 50.46 (Ref. 2) could be violated.
 
For an accumulator to be considered OPERABLE, the isolation valve must be fully open, power removed above 2000 psig, and the limits established in the SRs for contained volume, boron concentration, and nitrogen cover pressure must be met.
APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS pressure  1000 psig, the accumulator OPERABILITY requirements are based on full power operation. Although cooling requirements decrease as power decreases, the accumulators are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.
 
This LCO is only applicable at pressures  1000 psig. At pressures  1000 psig, the rate of RCS blowdown is such that the ECCS pumps can provide adequate injection to ensure that peak clad temperature remains below the 10 CFR 50.46 (Ref. 2) limit of 2200 F.
Accumulators B 3.5.1 BASES APPLICABILITY  (continued) INDIAN POINT 2 B 3.5.1 - 5 Revision 0 In MODE 3, with RCS pressure  1000 psig, and in MODES 4, 5, and 6, the accumulator motor operated isolation valves are closed to isolate the accumulators from the RCS. This allows RCS cooldown and depressurization without discharging the accumulators into the RCS or requiring depressurization of the accumulators.
ACTIONS A.1 If the boron concentration of one accumulator is not within limits of SR 3.5.1.4, it must be returned to within the limits within 72 hours. In this Condition, ability to maintain subcriticality or minimum boron precipitation time may be reduced. The boron in the accumulators contributes to the assumption that the combined ECCS water in the partially recovered core during the early reflooding phase of a large break LOCA is sufficient to keep that portion of the core subcritical. One accumulator below the minimum boron concentration limit, however, will have no effect on available ECCS water and an insignificant effect on core subcriticality during reflood. Boiling of ECCS water in the core during reflood concentrates boron in the saturated liquid that remains in the core. In addition, current analysis techniques demonstrate that the accumulators do not discharge following a large main steam line break for the majority of plants. Even if they do discharge, their impact is minor and not a design limiting event. Thus, 72 hours is allowed to return the boron concentration to within limits.
 
B.1 If one accumulator is inoperable for a reason other than boron concentration, the accumulator must be returned to OPERABLE status within 24 hours. In this Condition, the required contents of three accumulators cannot be assumed to reach the core during a LOCA. Due to the severity of the consequences should a LOCA occur in these conditions, the 24 hour Completion Time to open the valve, remove power to the valve, or restore the proper water volume or nitrogen cover pressure ensures that prompt action will be taken to return the inoperable accumulator to OPERABLE status. The Completion Time minimizes the potential for exposure of the plant to a LOCA under these conditions. The 24 hours allowed to restore an inoperable accumulator to OPERABLE status is justified in WCAP-15049, Rev. 1 (Ref. 4).
Accumulators B 3.5.1 BASES ACTIONS  (continued) INDIAN POINT 2 B 3.5.1 - 6 Revision 0 C.1 and C.2
 
If the accumulator cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and RCS pressure reduced to  1000 psig within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
 
D.1 If more than one accumulator is inoperable, the plant is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be entered immediately.
SURVEILLANCE SR  3.5.1.1 REQUIREMENTS Each accumulator valve should be verified to be fully open every 12 hours. This verification ensures that the accumulators are available for injection and ensures timely discovery if a valve should be less than fully open. If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve position should not change with power removed, a closed valve could result in not meeting accident analyses assumptions. This Frequency is considered reasonable in view of other administrative controls that ensure a mispositioned isolation valve is unlikely.
 
SR  3.5.1.2 and SR  3.5.1.3
 
Every 12 hours, borated water volume and nitrogen cover pressure are verified for each accumulator. This Frequency is sufficient to ensure adequate injection during a LOCA. Because of the static design of the accumulator, a 12 hour Frequency usually allows the operator to identify changes before limits are reached. Operating experience has shown this Frequency to be appropriate for early detection and correction of off normal trends.
 
The acceptance criteria for accumulator borated water volume and nitrogen cover pressure are the analytical limits. Appropriate allowances for instrument inaccuracy must be applied as follows:
Accumulators B 3.5.1 BASES SURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.5.1 - 7 Revision 0
: a. The safety analysis assumes analytical limits for accumulator volume of  723 cubic feet and  875 cubic feet. To allow for instrument inaccuracy, administrative limits for accumulator volume of  763 cubic feet and  835 cubic feet are used.
: b. The safety analysis assumes analytical limits for accumulator pressure of  598 psig and  685 psig. To allow for instrument inaccuracy, administrative limits for accumulator pressure of  630 psig and  675 psig are used.
 
SR  3.5.1.4
 
The boron concentration should be verified to be within required limits for each accumulator every 31 days since the static design of the accumulators limits the ways in which the concentration can be changed. The 31 day Frequency is adequate to identify changes that could occur from mechanisms such as stratification or inleakage.
 
SR  3.5.1.5
 
Verification every 31 days that power is removed from each accumulator isolation valve operator when the RCS pressure is  2000 psig ensures that an active failure could not result in the undetected closure of an accumulator motor operated isolation valve. If this were to occur, only two accumulators would be available for injection given a single failure coincident with a LOCA.
Since power is removed under administrative control, the 31 day Frequency will provide adequate assurance that power is removed.
 
This SR allows power to be supplied to the motor operated isolation valves when RCS pressure is < 2000 psig, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during plant startups or shutdowns.
REFERENCES 1. UFSAR, Chapter 6.
: 2. 10 CFR 50.46.
: 3. UFSAR, Chapter 14.
: 4. WCAP-15049-A, Rev. 1, April 1999.
ECCS - Operating B 3.5.2 INDIAN POINT 2 B 3.5.2-1 Revision 5 B 3.5  EMERGENCY CORE COOLING SYSTEMS (ECCS) B 3.5.2 ECCS - Operating BASES BACKGROUND The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents: a. Loss of coolant accident (LOCA), coolant leakage greater than the capability of the normal charging system, b. Rod ejection accident,
: c. Loss of secondary coolant accident, including uncontrolled steam release or loss of feedwater, and d. Steam generator tube rupture (SGTR).
The addition of negative reactivity is designed primarily for the loss of secondary coolant accident where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power. There are three phases of ECCS operation:  injection, cold leg recirculation, and hot leg recirculation. In the injection phase, water is taken from the refueling water storage tank (RWST) and injected into the Reactor Coolant System (RCS) through the cold legs. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment and recirculation sumps have enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to the recirculation sump for cold leg recirculation. After approximately 6.5 hours, the ECCS flow is shifted to the hot leg recirculation phase to provide a backflush, which would reduce the boiling in the top of the core and any resulting boron precipitation. The ECCS Function is provided by three separate ECCS systems: High Head Safety Injection (HHSI), Residual Heat Removal (RHR) injection, and Containment Recirculation. Each ECCS is divided into subsystemsas follows:
ECCS - Operating B 3.5.2 BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.5.2-2 Revision 5 a. The HHSI System is divided into three 50% capacity subsystems (i.e., HHSI 21, 22 and 23) which share two pump discharge headers (i.e., 21 and 23). Each HHSI subsystem consists of one pump as well as associated piping and valves to transfer water from the suction source to the core. HHSI subsystem 22 is aligned to inject using the flow path associated with both HHSI subsystem 21 and 23.If all three HHSI pumps start, flow from HHSI pump 22 will be divided between header 21 and 23. If either HHSI pump 21 or 23 fails to start, either valve 851A or 851B will close automatically so that HHSI pump 22 will inject via the header associated with the failed pump. This is consistent with the ECCS analyses which assume high head safety injection into all four RCS cold legs (including the faulted loop). The inadvertent isolation of high head safety injection header flow to any one of the RCS cold legs will not place the plant outside the design bases. Therefore, flow through both ECCS injection flow paths is required to satisfy the safety function of the head safety injection system (i.e., both flow paths are required to support Operability of two or more HHSI pumps). b. The RHR Injection System is divided into two 100% capacity subsystems (i.e., RHR 21 and 22). Each ECCS RHR subsystem consists of one RHR pump and one RHR heat exchanger as well as associated piping and valves to transfer water from the suction source to the core. Although either RHR heat exchanger may be credited for either RHR subsystem, one RHR heat exchanger must be OPERABLE for each OPERABLE RHR injection subsystem.
The ECCS analyses assumes RHR injection into all four RCS cold legs (including the faulted loop). The inadvertent isolation of RHR flow header to any one of the RCS cold legs will not place the plant outside the design bases. Therefore, flow through both ECCS injection flow paths is required to satisfy the ECCS safety function of the RHR system (i.e., both flow paths are required to support Operability of the ECCS function of either of the RHR pumps). c. The Containment Recirculation System is divided into two 100% capacity subsystems (Recirculation 21 and 22). Each subsystem consists of one Containment Recirculation pump and one RHR heat exchanger as well as associated piping and valves to transfer water from the suction source to the core. Although either RHR heat exchanger may be credited for either Recirculation subsystem, one RHR heat exchanger must be OPERABLE for each OPERABLE Containment Recirculation subsystem. The ECCS analyses assumes Recirculation System injection into all four RCS cold legs ECCS - Operating B 3.5.2 BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.5.2-3 Revision 5 (including the faulted loop). The inadvertent isolation of Recirculation System header flow to any one of the RCS cold legs will not place the plant outside the design bases. Therefore, flow through both ECCS injection flow paths is required to satisfy the ECCS safety function of the Recirculation System (i.e., both flow paths are required to support OPERABILITY of the ECCS function of either of the Containment Recirculation System pumps). The three ECCS systems (3 HHSI, 2 RHR and 2 Recirculation) are grouped into three trains (5A, 2A/3A and 6A) such that any 2 of the 3 trains are capable of meeting all ECCS capability assumed in the accident analysis. Each ECCS train consists of the following: a. ECCS Train 5A includes subsystems HHSI 21 and containment recirculation 21; b. ECCS Train 2A/3A includes subsystems HHSI 22 and RHR 21; and, c. ECCS Train 6A includes subsystems HHSI 23, RHR 22, and containment recirculation 22. The ECCS trains use the same designation as the Safeguards Power Trains required by LCO 3.8.9, Distribution Systems - Operating, with Safeguards Power Train 5A supported by DG 21, Safeguards Power Train 2A/3A supported by DG 22, Safeguards Power Train 6A supported by DG 23. The ECCS accumulators and the RWST are also part of the ECCS, but are not considered part of an ECCS flow path as described by this LCO. Each of the subsystems (3 HHSI, 2 RHR and 2 Recirculation) are interconnected and redundant such that any combination of 2 HHSI pumps, 1 RHR pump and 1 recirculation pump is capable of supplying 100% of the flow required to mitigate the accident consequences. This interconnecting and redundant subsystem design provides the operators with the ability to utilize components from different trains to achieve the required 100% flow to the core. The design intent is that any two of the three safeguards power trains is capable of providing 100% of the required ECCS flow; however, any combination of the minimum number of pumps is capable of providing 100% of the required ECCS flow. During the injection phase of LOCA recovery, a suction header supplies water from the RWST to the HHSI and RHR pumps. The discharge from the HHSI and RHR pumps divides and feeds an injection line to each of the RCS cold legs. Control valves are set to balance the HHSI flow to the
 
RCS.
ECCS - Operating B 3.5.2 BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.5.2-4 Revision 5 This balance ensures sufficient flow to the core to meet the analysis assumptions following a LOCA in one of the RCS cold legs. Additionally, orifices on the HHSI pump discharge prevent pump runout due to increased flow as the RCS depressurizes during an accident. For LOCAs that are too small to depressurize the RCS below the shutoff head of the HHSI pumps, the charging pumps supply water until the RCS pressure decreases below the HHSI pump shutoff head. During this period, the steam generators are used to provide part of the core cooling function. During the recirculation phase of LOCA recovery, the containment recirculation pumps take suction from the containment recirculation sump and direct flow through the RHR heat exchangers to the cold legs. The RHR pumps can also be used to provide a backup method of recirculation because the RHR pump suction is transferred to the containment sump.
The RHR pumps then supply recirculation flow directly and can also supply the suction of the HHSI pumps. Initially, recirculation is through the same paths as the injection phase. Subsequently, recirculation alternates injection between the hot and cold legs. The ECCS also functions to supply borated water to the reactor core following increased heat removal events, such as a main steam line break (MSLB). The limiting design conditions occur when the negative moderator temperature coefficient is highly negative, such as at the end of each cycle. During low temperature conditions in the RCS, limitations are placed on the maximum number of HHSI pumps that may be capable of injecting into the RCS. Refer to the Bases for LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP)," for the basis of these requirements. The ECCS subsystems, except for the containment recirculation subsystems, are actuated upon receipt of an SI signal. The actuation of safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start immediately in the programmed sequence. If offsite power is not available, the Engineered Safety Feature (ESF) buses shed normal operating loads and are connected to the emergency diesel generators (EDGs). Safeguard loads are then actuated in the programmed time sequence. The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required before pumped flow is available to the core following a LOCA.
ECCS - Operating B 3.5.2 BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.5.2-5 Revision 5 The active ECCS components, along with the passive accumulators and the RWST covered in LCO 3.5.1, "Accumulators," and LCO 3.5.4, "Refueling Water Storage Tank (RWST)," provide the cooling water necessary to meet GDC 35 (Ref. 1). APPLICABLE SAFETY ANALYSES The LCO helps to ensure that the following acceptance criteria for the ECCS, established by 10 CFR 50.46 (Ref. 2), will be met following a
 
LOCA:
: a. Maximum fuel element cladding temperature is  2200 F,b. Maximum cladding oxidation is  0.17 times the total cladding thickness before oxidation, c. Maximum hydrogen generation from a zirconium water reaction is  0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react, d. Core is maintained in a coolable geometry, and e. Adequate long term core cooling capability is maintained. The LCO also limits the potential for a post trip return to power following an MSLB event and ensures that containment temperature limits are met. Each ECCS subsystem is taken credit for in a large break LOCA event at full power (Refs. 3 and 4). This event establishes the requirement for runout flow for the ECCS pumps, as well as the maximum response time for their actuation. The HHSI pumps are credited in a small break LOCA event. The OPERABILITY requirements for the ECCS are based on the following LOCA analysis assumptions: a. A large break LOCA event, with loss of offsite power and the loss of one of the three safeguards power trains is assumed for the determination of pumped Emergency Core Cooling System (ECCS) flow during the LOCA. However, all three safeguards power trains were assumed to operate in the calculation of containment backpressure. This will conservatively bound the possible single failures (UFSAR 14.3.3.2); and ECCS - Operating B 3.5.2 BASES APPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.5.2-6 Revision 5 b. A small break LOCA event, with a loss of offsite power and a single failure disabling one ECCS train. During the blowdown stage of a LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment. The nuclear reaction is terminated either by moderator voiding during large breaks or control rod insertion for small breaks. Following depressurization, emergency cooling water is injected into the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core. The effects on containment mass and energy releases are accounted for in appropriate analyses (Refs. 3 and 4). The LCO ensures that an ECCS train will deliver sufficient water to match boiloff rates soon enough to minimize the consequences of the core being uncovered following a large LOCA. It also ensures that the ECCS pumps will deliver sufficient water and boron during a small LOCA to maintain core subcriticality. For a small break LOCA, the steam generators continue to serve as the heat sink, providing part of the required core cooling. The effect of certain valve failures has been evaluated (Reference 7). The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCO In MODES 1, 2, and 3, three ECCS trains are required to ensure that sufficient ECCS flow is available, assuming a single failure affecting any one train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents. In MODES 1, 2, and 3, the three ECCS trains consist of the following: a. ECCS Train 5A includes HHSI subsystem 21 and containment recirculation subsystem 21; b. ECCS Train 2A/3A includes HHSI subsystem 22 and RHR subsystem 21; and, c. ECCS Train 6A includes HHSI subsystem 23, RHR subsystem 22, and containment recirculation subsystem 22. Each HHSI subsystem consists of one pump as well as associated piping and valves to transfer water from the suction source to the core. HHSI subsystem 22 is OPERABLE only when capable of injecting using the flow path associated with both HHSI subsystem 21 and 23. However, ECCS - Operating B 3.5.2 BASES INDIAN POINT 2 B 3.5.2-7 Revision 5 when either HHSI pump 21 or 23 is inoperable, HHSI pump 22 is OPERABLE if it will automatically align or is manually aligned to replace the inoperable HHSI pump. The ECCS analyses assume high head safety injection into all four RCS cold legs (including the faulted loop) with one single failure being of one 856 stop valve. The isolation of high head safety injection header flow to any of the RCS cold legs will not place the plant outside the design bases. Each ECCS RHR subsystem consists of one RHR pump and one RHR heat exchanger as well as associated piping and valves to transfer water from the suction source to the core. Although either RHR heat exchanger may be credited for either RHR subsystem, one RHR heat exchanger must be OPERABLE for each OPERABLE RHR injection subsystem.
The ECCS analyses assume RHR injection into all four RCS cold legs (including the faulted loop). Each containment recirculation subsystem consists of one Containment Recirculation pump and one RHR heat exchanger as well as associated instrumentation, piping and valves to transfer water from the suction source to the core. Although either RHR heat exchanger may be credited for either Containment Recirculation subsystem, one RHR heat exchanger must be OPERABLE for each OPERABLE Containment Recirculation subsystem. During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the HHSI and RHR pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment recirculation sump using the containment recirculation pumps or, alternately, the containment sump using the RHR pumps and to supply its flow to the RCS hot and cold legs. As discussed in UFSAR 6.2.2.12 (Ref 3), the RHR system is arranged to allow either of the RHR pumps to take over the recirculation function. The residual heat removal pumps would be used for recirculation only if both 100% capacity recirculation pumps are not available. Therefore, the ability to align the RHR system for recirculation is not required for the OPERABILITY of the RHR subsystem. However, for conservatism, loss of the ability to align the RHR system to allow the RHR pumps to perform the recirculation function should be treated as if either one RHR subsystem or one Recirculation subsystem is not OPERABLE and restored within the Completion Time specified for Required Action A.1.
ECCS - Operating B 3.5.2 BASES INDIAN POINT 2 B 3.5.2-8 Revision 5 The flow path for each ECCS pump must maintain its designed independence to ensure that no single failure can disable more than one ECCS pump. As indicated in the LCO Note, the SI flow paths may be isolated for 2 hours in MODE 3, under controlled conditions, to perform pressure isolation valve testing per SR 3.4.14.1. The flow path is readily restorable from the control room or the valves are opened under administrative controls that ensure prompt closure when required. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. The two auxiliary component cooling water pumps are started during the injection phase to maintain component cooling water flow to the containment recirculation pump motor coolers; however, this cooling function is not required during the injection phase. However, an auxiliary component cooling water pump is required to support each containment recirculation pump during the recirculation phase. APPLICABILITY In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the limiting Design Basis Accident, a large break LOCA, are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements when at low reactor power or in MODE 3. The HHSI pump performance requirements are based on a small break LOCA. MODE 2 and MODE 3 requirements are bounded by the MODE 1 analysis. This LCO is only applicable in MODE 3 and above. In MODE 4, the SI signal setpoint is manually bypassed by operator control, and system functional requirements are relaxed as described in LCO 3.5.3, "ECCS - Shutdown." In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops -
MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled."  MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."
ECCS - Operating B 3.5.2 BASES INDIAN POINT 2 B 3.5.2-9 Revision 5 ACTIONS A.1With one or more trains inoperable and at least two HHSI pumps, at least one RHR pump, and at least one Containment Recirculation pump are OPERABLE (i.e., 100% of the ECCS capability assumed in the accident analysis is available), the inoperable components must be returned to OPERABLE status within 72 hours. The 72 hour Completion Time is based on an NRC reliability evaluation (Ref. 5) and is a reasonable time for repair of many ECCS components. An ECCS train is inoperable if it is not capable of delivering design flow to the RCS. Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available. The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS. This allows increased flexibility in plant operations under circumstances when components in more than one train are inoperable. An event accompanied by a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref. 5) has shown that the impact of having one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours. Reference 6 describes situations in which one component, such as the valves governed by SR 3.5.2.1, can disable more than one ECCS train. With one or more component(s) inoperable such that 100% of the flow equivalent to 2 HHSI pumps, 1 RHR pump and 1 Recirculation pump is not available, the facility is in a condition outside the accident analysis.
Therefore, LCO 3.0.3 must be immediately entered. B.1 and B.2If the inoperable trains cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours and MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.
ECCS - Operating B 3.5.2 BASES ACTIONS  (continued) INDIAN POINT 2 B 3.5.2-10 Revision 5 C.1Condition A is applicable with one or more trains inoperable. The allowed Completion Time is based on the assumption that at least 100% of the ECCS flow equivalent to 2 HHSI pumps, 1 RHR pump and 1 Recirculation pump is available. With less than 100% of the ECCS flow equivalent to 2 HHSI pumps, 1 RHR pump and 1 Recirculation pump available, the facility is in a condition outside of the accident analyses.
Therefore, LCO 3.0.3 must be entered immediately. SURVEILLANCE SR  3.5.2.1REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained. Misalignment of these valves could render more than one ECCS train inoperable. Therefore, failure to meet this SR requires entry into Condition C. Securing these valves in position by removal of power, use of an interlock switch, or by key locking the control in the correct position ensures that they cannot change position as a result of an active failure or be inadvertently misaligned. These valves are of the type, described in Reference 6, that can disable the function of more than one ECCS train and invalidate the accident analyses. Although closing the RWST outlet isolation valve will render all three ECCS trains inoperable, this valve is not included in SR 3.5.2.1 because it is a locked manual valve located in a locked area. A 7 day Frequency is considered reasonable in view of other administrative controls that will ensure a mispositioned valve is unlikely. SR  3.5.2.2Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time.
ECCS - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.5.2-11 Revision 5 SR 3.5.2.2 (continued)This Surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control, and an improper valve position would only affect a single train. This Frequency has been shown to be acceptable through operating experience. SR  3.5.2.3Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by the ASME Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the plant safety analysis.
SRs are specified in the Inservice Testing Program of the ASME Code.
The ASME Code provides the activities and Frequencies necessary to satisfy the requirements. SR  3.5.2.4 and SR  3.5.2.5These Surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal and that each ECCS pump starts on receipt of an actual or simulated SI signal. Note that the Containment Recirculation system is a manually initiated system and is not included as part of this SR. Additionally, this Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.
The 24 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the potential for unplanned plant transients if the Surveillances were performed with the reactor at power. The 24 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of ESF Actuation System testing, and equipment performance is monitored as part of the Inservice Testing Program.
ECCS - Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.5.2 - 12 Revision 5 SR  3.5.2.6Realignment of valves in the flow path on an SI signal is necessary for proper ECCS performance. These valves have stops to allow proper positioning for restricted flow to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. Therefore, an improperly positioned valve could result in the inoperability of more than one injection flow path. The stops are set based on the results of the most recent ECCS operational flow test. This SR does not include the variable orifices that prevent HHSI pump runout when RCS pressure decreases during an accident. The 24 month Frequency is based on the same reasons as those stated in SR 3.5.2.4 and SR 3.5.2.5. SR  3.5.2.7Periodic inspections of the containment and recirculation sumps ensure that they are unrestricted and stay in proper operating condition. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the need to have access to the location. This Frequency is sufficient to detect abnormal degradation based on industry operating experience. REFERENCES 1. 10 CFR 50, Appendix A. 2. 10 CFR 50.46. 3. UFSAR, Section 6.2. 4. UFSAR, Chapter 14. 5. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975. 6. IE Information Notice No. 87-01. 7. Westinghouse Calculation Note CN-SEE-06-9, Revision 0, "Indian Point Unit 2 Safety Injection Pump Discharge Valve Sump Debris Evaluation," and Westinghouse Letter, "HHSI recirculation Flow -
Sump blockage and Inadvertent 856 Valve Closure," IPP-06-83, dated December 6, 2006.
ECCS - ShutdownB 3.5.3 INDIAN POINT 2B 3.5.3 - 1 Revision 1B 3.5  EMERGENCY CORE COOLING SYSTEMS (ECCS)B 3.5.3ECCS - Shutdown BASESBACKGROUNDThe Background section for Bases 3.5.2, "ECCS - Operating," is applicable tothese Bases, with the following modifications.In MODE 4, two ECCS High Head Safety Injection (HHSI) subsystems andone ECCS Residual Heat Removal (RHR) subsystem are required.The ECCS flow paths consist of piping, valves, heat exchangers, and pumpssuch that water from the refueling water storage tank (RWST) can be injected into the Reactor Coolant System (RCS) following the accidents described in Bases 3.5.2.APPLICABLE
 
SAFETY ANALYSESThe Applicable Safety Analyses section of Bases 3.5.2 also applies to this Bases section.Due to the stable conditions associated with operation in MODE 4, corecooling requirements lower than those following a Design Basis Accident (DBA) initiated from 100% RTP, and the reduced probability of occurrence of a DBA, the ECCS operational requirements are reduced. It is understood in these reductions that certain automatic safety injection (SI) actuation is not available. In this MODE, sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA.Only two ECCS HHSI subsystems (high head) and one ECCS RHRsubsystem (low head) are required for MODE 4. This requirement dictates that single failures are not considered during this MODE of operation. The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCOIn MODE 4, two ECCS HHSI subsystems (high head) and one ECCS RHR subsystem (low head) are required to be OPERABLE to ensure ECCS flow is available to the core following a DBA. Each required subsystem includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST and transferring suction to the containment sump. Either RHR heat exchanger may be used with either RHR pump to meet requirements for an RHR subsystem.
ECCS - ShutdownB 3.5.3 BASES LCO  (continued)
INDIAN POINT 2B 3.5.3 - 2 Revision 1During an event requiring ECCS actuation, a flow path is required to providean abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to deliver its flow to the RCS hot and cold legs.This LCO is modified by a Note that allows an RHR subsystem to beconsidered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows operation in the RHR mode during MODE 4.An HHSI subsystem is considered OPERABLE when injection capability isblocked to meet requirements of LCO 3.4.12, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows injection capability to be blocked in MODE 4 if needed to satisfy the requirements of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP)."APPLICABILITYIn MODES 1, 2, and 3, the OPERABILITY requirements for ECCS are covered by LCO 3.5.2.In MODE 4 with RCS temperature below 350F, two ECCS HHSI subsystemsand one ECCS RHR subsystem are acceptable without single failureconsideration, on the basis of the stable reactivity of the reactor and the limited core cooling requirements.In MODES 5 and 6, plant conditions are such that the probability of an eventrequiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled,"
and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled."  MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."
ECCS - ShutdownB 3.5.3 BASES INDIAN POINT 2B 3.5.3 - 3 Revision 1ACTIONSA Note prohibits the application of LCO 3.0.4.b to inoperable ECCS HighHead Safety Injection subsystems when entering MODE 4. There is an increased risk associated with entering MODE 4 from MODE 5 with an inoperable ECCS high head subsystems and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
A.1With no ECCS RHR subsystem OPERABLE, the plant is not prepared torespond to a loss of coolant accident or to continue a cooldown using the RHR pumps and heat exchangers. The Completion Time of immediately to initiate actions that would restore at least one ECCS RHR subsystem to OPERABLE status ensures that prompt action is taken to restore the required cooling capacity. Normally, in MODE 4, reactor decay heat is removed from the RCS by an RHR loop. If no RHR loop is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generators. The alternate means of heat removal must continue until the inoperable RHR loop components can be restored to operation so that decay heat removal is continuous.With both RHR pumps and heat exchangers inoperable, it would be unwise torequire the plant to go to MODE 5, where the only available heat removal system is the RHR. With no ECCS HHSI subsystem OPERABLE, due to the inoperability of the pump or flow path from the RWST, the plant is not prepared to provide high pressure response to Design Basis Events requiring SI. Therefore, the appropriate action is to initiate measures to restore one ECCS RHR subsystem and two ECCS HHSI subsystems and to continue the actions until the subsystem is restored to OPERABLE status.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 2). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 2, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.
ECCS - ShutdownB 3.5.3 BASESACTIONS  (continued)
INDIAN POINT 2B 3.5.3 - 4 Revision 1Required Action A.1 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.SURVEILLANCESR  3.5.3.1REQUIREMENTSThe applicable Surveillance descriptions from Bases 3.5.2 apply.REFERENCES1. The applicable references from Bases 3.5.2 apply.2. WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changes toTechnical Specification Required Action Endstates for WestinghouseNSSS PWRs," June 2010.
RWSTB 3.5.4 INDIAN POINT 2B 3.5.4 - 1 Revision 3  B 3.5  EMERGENCY CORE COOLING SYSTEMS (ECCS)B 3.5.4Refueling Water Storage Tank (RWST)
BASESBACKGROUNDThe RWST supplies borated water to the Chemical and Volume ControlSystem (CVCS) during abnormal operating conditions, to the refueling cavity during refueling, and to the ECCS and the Containment Spray System during accident conditions.The RWST supplies the ECCS and the Containment Spray System during theinjection phase of a loss of coolant accident (LOCA) recovery. A motor operated isolation valve is provided in each line to isolate the RWST from the ECCS once the system has been transferred to the recirculation mode. The switchover to the cold leg recirculation phase is manually initiated when the RWST level has reached the low-low alarm setpoint and sufficient coolant inventory to support pump operation in recirculation mode is verified to be in the containment. Use of a single RWST to supply both trains of the ECCS and Containment Spray System is acceptable since the RWST is a passive component, and passive failures are not required to be assumed to occur coincidentally with Design Basis Events.During normal operation in MODES 1, 2, and 3, the high head safety injection(HHSI) and residual heat removal (RHR) pumps are aligned to take suction from the RWST. In MODE 4, HHSI pumps may be secured consistent with requirements for low temperature overpressure protection and RHR pumps may be aligned for decay heat removal.The ECCS and Containment Spray System pumps are provided withrecirculation lines that ensure each pump can maintain minimum flow requirements when operating for limited periods of time at or near shutoff head conditions.When the suction for the ECCS pumps is transferred to the recirculationsump or containment sump, the RWST flow paths must be isolated to prevent a release of the containment sump contents to the RWST, which could result in a release of contaminants to the atmosphere and the eventual loss of suction head for the ECCS pumps.This LCO ensures that:
: a. The RWST contains sufficient borated water to support the ECCSduring the injection phase, RWSTB 3.5.4 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.5.4 - 2 Revision 3b. Sufficient water volume exists in the recirculation or containmentsump to support continued operation of the ECCS pumps at the time oftransfer to the recirculation mode of cooling, andc. The reactor remains subcritical following a LOCA.Insufficient water in the RWST could result in insufficient cooling capacitywhen the transfer to the recirculation mode occurs. Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following the LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside the containment due to improper pH in the sumps.APPLICABLE
 
SAFETY ANALYSESDuring accident conditions, the RWST provides a source of borated water to the ECCS and Containment Spray System pumps. As such, it provides containment cooling and depressurization, core cooling, and replacement inventory and is a source of negative reactivity for reactor shutdown (Ref. 1). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of B 3.5.2, "ECCS - Operating," B 3.5.3, "ECCS -
Shutdown," and B 3.6.6, "Containment Spray System and Containment Fan Cooler Unit (FCU) System."  These analyses are used to assess changes to the RWST in order to evaluate their effects in relation to the acceptance limits in the analyses.The RWST must also meet volume, boron concentration, and temperaturerequirements for non-LOCA events. The volume is not an explicit assumption in non-LOCA events since the required volume is a small fraction of the available volume. The deliverable volume limit is set by the LOCA and containment analyses. For the RWST, the deliverable volume is different from the total volume contained since, due to the design of the tank, more water can be contained than can be delivered. The minimum boron concentration is an explicit assumption in the main steam line break (MSLB) analysis to ensure the required shutdown capability. The maximum temperature ensures that the amount of cooling provided from the RWST is consistent with safety analysis assumptions; the minimum is an assumption in both the MSLB and inadvertent ECCS actuation analyses, although the inadvertent ECCS actuation event is typically nonlimiting.
RWSTB 3.5.4 BASESAPPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2B 3.5.4 - 3 Revision 3The specified minimum water quantity for the RWST (345,000 gallons)includes the minimum quantity required for the injection phase (246,000 gallons) for accident mitigation, the minimum quantity of water required during the recirculation phase (60,000 gallons) for accident mitigation, and a sufficient quantity of water (39,000 gallons) to allow for instrument inaccuracies, additional margin, and for water that is unavailable from the bottom of the tank.The minimum RWST boron concentration ensures that the reactor core willremain subcritical during long term recirculation with all control rods fully withdrawn following a postulated large break LOCA.The upper limit on boron concentration of 2600 ppm is used to determine themaximum allowable time to switch to hot leg recirculation following a LOCA. The purpose of switching from cold leg to hot leg injection is to avoid boron precipitation in the core following the accident.In the ECCS analysis, the containment spray temperature is assumed to beequal to the RWST lower temperature limit of 40F. If the lower temperaturelimit is violated, the containment spray further reduces containment pressure, which decreases the rate at which steam can be vented out the break and increases peak clad temperature. Additionally, the lower limit on RWST temperature limits thermal shock to the ECCS injection nozzles and the reactor pressure vessel. The upper temperature limit of 110F is used in thesmall break LOCA analysis and containment OPERABILITY analysis.
Exceeding this temperature will result in a higher peak clad temperature, because there is less heat transfer from the core to the injected water for thesmall break LOCA and higher containment pressures due to reducedcontainment spray cooling capacity. For the containment response following an MSLB, the lower limit on boron concentration and the upper limit on RWST water temperature are used to maximize the total energy release to containment.Following a LOCA, switchover from the injection phase to the recirculationphase must occur before the RWST empties to prevent damage to the pumps and a loss of cooling capability. For similar reasons, switchover must not occur before there is sufficient water in the containment to support recirculation pump suction.The IP2 ESFAS design does not include automatic switchover from the safetyinjection mode to the recirculation mode of operation based on low level in the RWST coincident with a safety injection signal. This function is performed manually by the operator who must be alerted by redundant alarms that annunciate RWST level low low. The switchover to the cold leg recirculation phase is manually initiated when the RWST level has reached RWSTB 3.5.4 BASESAPPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2B 3.5.4 - 4 Revision 3the low low alarm setpoint and sufficient coolant inventory to support pumpoperation in recirculation mode is verified to be in the containment.The RWST level low low alarm setpoint has both upper and lower limits. Theupper limit is set to ensure that switchover does not occur until there is adequate water inventory in the containment to provide ECCS pump suction.
(This is confirmed by recirculation and/or containment sump level indication.)
The lower limit is set to ensure switchover occurs before the RWST empties, to prevent ECCS pump damage.Requiring 2 channels of RWST level low low alarm ensures that the alarmfunction will be available assuming a single failure of one channel.The RWST satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCOThe RWST ensures that an adequate supply of borated water is available tocool and depressurize the containment in the event of a Design Basis Accident (DBA), to cool and cover the core in the event of a LOCA, to maintain the reactor subcritical following a DBA, and to ensure adequate level in the recirculation and containment sump to support ECCS operation in the recirculation mode.To be considered OPERABLE, the RWST must meet the water volume,boron concentration, and temperature limits established in the SRs.RWST OPERABILITY requires OPERABILITY of two channels of the RWSTlevel low low alarm. This is required because the IP2 ESFAS design does not include automatic switchover from the safety injection mode to the recirculation mode of operation based on low level in the RWST coincident with a safety injection signal. This function is performed manually by the operator who must be alerted by redundant alarms that annunciate RWST level low low. The switchover to the cold leg recirculation phase is manually initiated when the RWST level has reached the low low alarm setpoint and sufficient coolant inventory to support pump operation in recirculation mode is verified to be in the containment.A note allows the RWST valves that isolate non-seismic piping to be openedunder administrative control for filtration until the end of RO 22.
RWSTB 3.5.4 BASES INDIAN POINT 2B 3.5.4 - 5 Revision 3APPLICABILITYIn MODES 1, 2, 3, and 4, RWST OPERABILITY requirements are dictatedby ECCS and Containment Spray System OPERABILITY requirements.
Since both the ECCS and the Containment Spray System must be OPERABLE in MODES 1, 2, 3, and 4, the RWST must also be OPERABLE to support their operation. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled."
MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."ACTIONS A.1With RWST boron concentration or borated water temperature not within limits of SR 3.5.4.3 or SR 3.5.4.1, respectively, they must be returned to within limits within 8 hours. Under these conditions neither the ECCS nor the Containment Spray System can perform its design function. Therefore, prompt action must be taken to restore the tank to OPERABLE condition.
The 8 hour limit to restore the RWST temperature or boron concentration to within limits was developed considering the time required to change either the boron concentration or temperature and the fact that the contents of the tank are still available for injection.
B.1Condition B applies when one channel of the RWST level low low alarm isinoperable. Required Action B.1 requires restoring the inoperable channel to OPERABLE status within 7 days. The 7 day Completion Time for restoration of redundancy to the alarm function is needed because the IP2 ESFAS design does not include automatic switchover from the safety injection mode to the recirculation mode of operation based on low level in the RWST coincident with a safety injection signal. This function is performed manually by the operator who is alerted by the RWST level low low alarm as the primary indicator for determining the time for the switchover. The 7 day Completion Time for restoration of redundancy for this alarm function is acceptable because of the remaining alarm channel and the availability of containment and recirculation sump level indication in the control room.
RWSTB 3.5.4 BASESACTIONS  (continued)
INDIAN POINT 2B 3.5.4 - 6 Revision 3C.1With the RWST inoperable for reasons other than Condition A or B (e.g.,water volume not within limit of SR 3.5.4.2 or both RWST level alarms inoperable), it must be restored to OPERABLE status within 1 hour.In this Condition, neither the ECCS nor the Containment Spray System canperform its design function. Therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the plant in a MODE in which the RWST is not required. The short time limit of 1 hour to restore the RWST to OPERABLE status is based on this condition simultaneously affecting redundant trains.D.1 and D.2If the RWST cannot be returned to OPERABLE status within the associatedCompletion Time, the plant must be brought to a MODE in which overall plant risk is reduced. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 2). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 2, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action D.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.
RWSTB 3.5.4 BASESACTIONS  (continued)
INDIAN POINT 2B 3.5.4 - 7 Revision 3The allowed Completion Times are reasonable, based on operatingexperience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCESR  3.5.4.1REQUIREMENTSThe RWST borated water temperature should be verified every 24 hours to be within the limits assumed in the accident analyses band. This Frequency is sufficient to identify a temperature change that would approach either limit and has been shown to be acceptable through operating experience.SR  3.5.4.2The RWST water volume should be verified every 7 days to be above therequired minimum level in order to ensure that a sufficient initial supply is available for injection and containment spray and to support continued ECCS operation on recirculation. Since the RWST volume is normally stable and is protected by an alarm, a 7 day Frequency is appropriate and has been shown to be acceptable through operating experience.SR  3.5.4.3The boron concentration of the RWST should be verified every 31 days to bewithin the required limits. This SR ensures that the reactor will remain subcritical following a LOCA. Further, it assures that the resulting sump pH will be maintained in an acceptable range so that boron precipitation in the core will not occur and the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized. Since the RWST volume is normally stable, a 31 day sampling Frequency to verify boron concentration is appropriate and has been shown to be acceptable through
 
operating experience.SR  3.5.4.4A CHANNEL CALIBRATION of the RWST level alarm is performed at leastevery 92 days. CHANNEL CALIBRATION is a complete check of the level alarm loop including the required alarm. The test verifies the RWST level alarm responds to RWST level within the required range and accuracy. The test also verifies that the RWST level indicating switch will cause the low lowlevel alarm to annunciate to ensure the operator is alerted to start theswitchover to the recirculation mode during accident conditions. The frequency is based on operating experience.
RWSTB 3.5.4BASES (continued)
INDIAN POINT 2B 3.5.4 - 8 Revision 3REFERENCES 1.UFSAR, Chapter 6 and Chapter 14.
2.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changesto Technical Specification Required Action Endstates for Westinghouse NSSS PWRs," June 2010.
ContainmentB 3.6.1 INDIAN POINT 2 B 3.6.1 - 1 Revision 1 B 3.6  CONTAINMENT SYSTEMS B 3.6.1 Containment BASESBACKGROUND The containment consists of the concrete reactor building, its steel liner, and the penetrations through this structure. The structure is designed to contain radioactive material that might be released from the reactor core following a design basis loss of coolant accident (LOCA). Additionally, this structure provides shielding from the fission products that may be present in the containment atmosphere following accident conditions. The containment is a reinforced concrete structure with a cylindrical wall, a flat foundation mat, and a dome roof. The inside surface of the containment is lined with a carbon steel liner to ensure a high degree of leak tightness during operating and accident conditions. The concrete reactor building is required for structural integrity of the containment under Design Basis Accident (DBA) conditions. The steel liner and its penetrations establish the leakage limiting boundary of the containment. Maintaining the containment OPERABLE limits the leakage of fission product radioactivity from the containment to the environment.
SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, Appendix J, Option B (Ref. 1), as modified by approved exemptions. The isolation devices for the penetrations in the containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier: a. All penetrations required to be closed during accident conditions are either:
: 1. Capable of being closed by an OPERABLE automatic containment isolation system or 2. Closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.3, "Containment Isolation Valves," b. Each air lock is OPERABLE, except as provided in LCO 3.6.2, "Containment Air Locks," c. The equipment hatch is properly closed, ContainmentB 3.6.1 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.6.1 - 2 Revision 1 d. The Isolation Valve Seal Water (IVSW) system is OPERABLE, except as provided in LCO 3.6.9, ande. The Weld Channel and Penetration Pressurization System (WC&PPS) is OPERABLE, except as provided in LCO 3.6.10. APPLICABLESAFETY ANALYSESThe safety design basis for the containment is that the containment must withstand the pressures and temperatures of the limiting Design Basis Accident (DBA) without exceeding the design leakage rate. The DBAs that result in a challenge to containment OPERABILITY from high pressures and temperatures are a LOCA and a steam line break (Ref. 2). In addition, release of significant fission product radioactivity within containment can occur from a LOCA or rod ejection accident (REA). In the DBA analyses, it is assumed that the containment is OPERABLE such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.1% of containment air weight per day (Ref. 2). This leakage rate, used to evaluate offsite doses resulting from accidents, is defined in 10 CFR 50, Appendix J, Option B (Ref. 1), as L a:  the maximum allowable containment leakage rate at the calculated peak containment internal pressure (P a) resulting from the limiting design basis LOCA. The allowable leakage rate represented by L aforms the basis for the acceptance criteria imposed on all containment leakage rate testing. In accordance with Technical Specification 5.5.14, the as found measured containment leakage rate must be less than 1.0 L a ,where L a is equal to 0.1 weight percent (w/o) per day of containment steam air atmosphere at 47 psig and 271F, which are the peak accident pressure and temperature conditions. Prior to the first entry into a MODE where containment integrity is required following performance of SR 3.6.1.1, the as left leakage rate must meet the acceptance criteria of Technical Specification 5.5.14.d. Satisfactory leakage rate test results are a requirement for the establishment of containment OPERABILITY. The containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
ContainmentB 3.6.1 BASESINDIAN POINT 2 B 3.6.1 - 3 Revision 1 LCO Containment OPERABILITY is maintained by limiting leakage to  1.0 L a ,except prior to the first startup after performing a required Containment Leakage Rate Testing Program leakage test in accordance with Technical Specification 5.5.14. At this time the applicable leakage limits in Technical Specification 5.5.14 must be met. Compliance with this LCO will ensure a containment configuration, including the equipment hatch, that is structurally sound and that will limit leakage to less than the leakage rates assumed in the safety analysis. Individual leakage rates specified for the containment air lock (LCO 3.6.2) are not specifically part of the acceptance criteria of 10 CFR 50, Appendix J. Therefore, leakage rates exceeding these individual limits only result in the containment being inoperable when the leakage results in exceeding the overall acceptance criteria of 1.0 L a.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, containment is not required to be OPERABLE in MODE 5 to prevent leakage of radioactive material from containment. The requirements for containment during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations." ACTIONS A.1In the event containment is inoperable, containment must be restored to OPERABLE status within 4 hours. The 4 hour Completion Time provides time to correct the problem commensurate with the importance of maintaining containment during MODES 1, 2, 3, and 4. This time period also ensures that the probability of an accident (requiring containment OPERABILITY) occurring during periods when containment is inoperable is minimal.B.1 and B.2If containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach ContainmentB 3.6.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.6.1 - 4 Revision 1 the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR  3.6.1.1 REQUIREMENTSMaintaining the containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Containment Leakage Rate Testing Program in Technical Specification 5.5.14. Failure to meet air lock leakage limits specified in LCO 3.6.2 does not invalidate the acceptability of these overall leakage determinations unless their contribution to overall Type A, B, and C leakage causes that to exceed limits. In accordance with Technical Specification 5.5.14, the as found measured containment leakage rate must be less than 1.0 L a, where L a is equal to 0.1 w/o per day of containment steam air atmosphere at 47 psig and 271F, which are the peak accident pressure and temperature conditions. Prior to the first entry into a MODE where containment integrity is required following performance of SR 3.6.1.1, the as left leakage rate must meet the acceptance criteria of Technical Specification 5.5.14.d. At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of 1.0 L a. At  1.0 L a the offsite dose consequences are bounded by the assumptions of the safety analysis.
SR Frequencies are as required by the Containment Leakage Rate Testing Program. These periodic testing requirements verify that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis.REFERENCES 1. 10 CFR 50, Appendix J, Option B. 2. UFSAR, Chapter 14.
Containment Air Locks B 3.6.2 INDIAN POINT 2 B 3.6.2 - 1 Revision 2 B 3.6  CONTAINMENT SYSTEMS B 3.6.2 Containment Air Locks BASESBACKGROUND Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of operation. Each air lock is a cylinder with a door at each end. One of the air locks is an integral part of the containment structure and the other is an integral part of the containment equipment hatch. Otherwise, the two air locks function identically. Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment. As such, closure of a single door supports containment OPERABILITY. Each air lock door and the equipment hatch is designed with double gasketed seals to permit pressurization between the gaskets. The double gasketed seals are normally pressurized above accident pressure. Finally, to effect a leak tight seal, the air lock design uses pressure seated doors (an increase in containment internal pressure results in increased sealing force on each door) and local leakage rate testing capability is available to ensure containment integrity is being maintained. The doors are interlocked to prevent simultaneous opening of the inner and outer door. This interlock is a requirement for OPERABILITY. During periods when containment is not required to be OPERABLE, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary.Each personnel air lock is provided with limit switches on both doors that provide control room indication of when an airlock door is not fully closed. The containment air locks form part of the containment pressure boundary. As such, air lock integrity and leak tightness is essential for maintaining the containment leakage rate within limit in the event of a DBA. Not maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the unit safety analyses.
Containment Air Locks B 3.6.2 BASESINDIAN POINT 2 B 3.6.2 - 2 Revision 2 APPLICABLESAFETY ANALYSESThe DBAs that result in a release of radioactive material within containment are a loss of coolant accident and a rod ejection accident. In the analysis of each of these accidents, it is assumed that containment is OPERABLE such that release of fission products to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.1% of containment air weight per day (Ref. 2). This leakage rate is defined in 10 CFR 50, Appendix J, Option B (Ref. 1), as
 
L a = 0.1% of containment steam air weight per day, the maximum allowable containment leakage rate at the calculated peak containment internal pressure following a design basis LOCA. This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air locks. The containment air locks satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCO Each containment air lock forms part of the containment pressure boundary. As part of the containment pressure boundary, the air lock safety function is related to control of the containment leakage rate resulting from a DBA.
Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event. Each air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of containment does not exist when containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into or exit from containment. The program established by Technical Specification 5.5.14, "Containment Leakage Rate Testing Program," which conforms to NEI 94-01, Section 10.2.2 (Ref. 3) for Containment Air Locks, requires that air lock doors opened during periods when containment integrity is required must be tested within 7 days after being opened or, for periods of multiple opening with a frequency more than 7 days, within 30 days of the first opening. For Indian Point 2, which has air locks with testable seals, this requirement is satisfied in accordance with ANSI/ANS-56.8-1994 "Containment System Leakage Testing Requirements," (Ref. 4) by verifying that seals re-pressurize to the required pressure after an airlock door is closed.
Pressurization of air lock seals is not required for air lock OPERABILITY except as needed to satisfy testing requirements after being opened.
Containment Air Locks B 3.6.2 BASESINDIAN POINT 2 B 3.6.2 - 3 Revision 2 APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of  radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment air locks are not required in MODE 5 to prevent leakage of radioactive material from containment. The requirements for the containment air locks during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."
ACTIONSThe ACTIONS are modified by a Note that allows entry and exit to perform repairs on the affected air lock component. If the outer door is inoperable, then it may be easily accessed for most repairs. If the inner door is inoperable, it is preferred that the air lock be accessed from inside containment by entering through the other OPERABLE air lock. However, if this is not practicable, or if repairs on either door must be performed from the barrel side of the door then it is permissible to enter the air lock through the OPERABLE door, which means there is a short time during which the containment boundary is not intact (during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed. If ALARA conditions permit, entry and exit should be via an OPERABLE air lock. When personnel are in containment and air lock doors are locked to comply with Required Actions, required locks may be removed to facilitate emergency exit provided a person is stationed at the door to ensure that the door remains closed except for emergency ingress or egress. A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each air lock. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable air lock. Complying with the Required Actions may allow for continued operation, and a subsequent inoperable air lock is governed by subsequent Condition entry and application of associated Required Actions. In the event the air lock leakage results in exceeding the overall containment leakage rate, Note 3 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1, "Containment."
Containment Air Locks B 3.6.2 BASESACTIONS  (continued) INDIAN POINT 2 B 3.6.2 - 4 Revision 2 Note 4 was added to require entry into applicable Conditions and Required Actions of LCO 3.6.10, "Weld Channel and Penetration Pressurization System (WC&PPS)," when required WC&PPS supply to an air lock is inoperable. As stated previously, pressurization of air lock seals is not required for air lock OPERABILITY except as needed to satisfy testing requirements after an air lock door is opened. Therefore, if WC&PPS to the airlock is otherwise OPERABLE, isolation of the WC&PPS supply to an air lock does not cause either WC&PPS or the air lock door to be inoperable. A.1, A.2, and A.3With one air lock door in one or more containment air locks inoperable, the OPERABLE door must be verified closed (Required Action A.1) in each affected containment air lock. This ensures that a leak tight containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 4 hours. This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires containment be restored to OPERABLE status within 4 hours. In addition, the affected air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour Completion Time.
The 24 hour Completion Time is reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed. Required Action A.3 verifies that an air lock with an inoperable door has been isolated by the use of a locked and closed OPERABLE air lock door.
This ensures that an acceptable containment leakage boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small. The Required Actions have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable.
With both doors in the same air lock inoperable, an OPERABLE door is not Containment Air Locks B 3.6.2 BASESACTIONS  (continued) INDIAN POINT 2 B 3.6.2 - 5 Revision 2 available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception of Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls if both air locks have an inoperable door. This 7 day restriction begins when the second air lock is discovered inoperable. Containment entry may be required on a periodic basis to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside containment that are required by TS or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS required activities) if the containment is entered, using the inoperable air lock, to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the containment during the short time that the OPERABLE door is expected to be open. B.1, B.2, and B.3With an air lock interlock mechanism inoperable in one or more air locks, the Required Actions and associated Completion Times are consistent with those specified in Condition A. The Required Actions have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable.
With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from containment under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock). Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.
Containment Air Locks B 3.6.2 BASESACTIONS  (continued) INDIAN POINT 2 B 3.6.2 - 6 Revision 2 C.1, C.2, and C.3With one or more air locks inoperable for reasons other than those described in Condition A (one door inoperable) or B (interlock inoperable), Required Action C.1 requires action to be initiated immediately to evaluate previous combined leakage rates using current air lock test results. An evaluation is acceptable, since it is overly conservative to immediately declare the containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 4 hours (per LCO 3.6.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits. Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed within the 4 hour Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be restored to OPERABLE status within 4 hours. Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24 hour Completion Time unless Condition C is exited. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status, assuming that at least one door is maintained closed in each affected air lock. D.1 and D.2If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR  3.6.2.1 REQUIREMENTSMaintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of Technical Specification 5.5.14, "Containment Leakage Rate Testing Program."  This SR reflects the leakage Containment Air Locks B 3.6.2 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.6.2 - 7 Revision 2 rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and containment OPERABILITY testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is required by Technical Specification 5.5.14, "Containment Leakage Rate Testing Program." The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR requiring the results to be evaluated against the acceptance criteria which is applicable to SR 3.6.1.1.
This ensures that air lock leakage is properly accounted for in determining the combined Type B and C containment leakage rate. SR  3.6.2.2The air lock interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident containment pressure, closure of either door will support containment OPERABILITY. Thus, the door interlock feature supports containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment.
Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous opening of the inner and outer doors will not inadvertently occur. Due to the purely mechanical nature of this interlock, and given that the interlock mechanism is not normally challenged when the containment air lock door is used for entry and exit (procedures require strict adherence to single door opening), this test is only required to be performed every 24 months. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage, and the potential for loss of containment OPERABILITY if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance when performed at 24 month Frequency. The 24 month Frequency is based on engineering judgment and is considered adequate given that the interlock is not challenged during the use of the airlock. REFERENCES 1. 10 CFR 50, Appendix J, Option B. 2. UFSAR, Section 6.6.
Containment Air Locks B 3.6.2 BASESREFERENCES  (continued) INDIAN POINT 2 B 3.6.2 - 8 Revision 2 3. NEI 94-01, Section 10.2.2. 4. ANSI/ANS-56.8-1994 "Containment System Leakage Testing Requirements."
Containment Isolation Valves B 3.6.3 INDIAN POINT 2 B 3.6.3 - 1 Revision 2 B 3.6  CONTAINMENT SYSTEMS B 3.6.3 Containment Isolation Valves BASESBACKGROUND The containment isolation valves (CIVs) form part of the containment pressure boundary and provide a means for fluid penetrations not serving accident consequence limiting systems to be provided with two isolation barriers that are closed on a containment isolation signal. These isolation devices are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured), blind flanges, and closed systems are considered passive devices. Check valves, or other automatic valves designed to close without operator action following an accident, are considered active devices. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analyses. One of these barriers may be a closed system. These barriers (typically containment isolation valves) make up the Containment Isolation System. Automatic isolation signals are produced during accident conditions. Containment Phase "A" isolation occurs upon receipt of a safety injection signal. The Phase "A" isolation signal isolates nonessential process lines in order to minimize leakage of fission product radioactivity. Containment Phase "B" isolation occurs upon receipt of a containment pressure High-High signal and isolates the remaining process lines, except systems required for accident mitigation. In addition to the isolation signals listed above, the containment purge supply and exhaust isolation valves and the containment pressure relief line isolation valves receive an isolation signal on a containment high radiation condition or manual signal as required by LCO 3.3.6, "Containment Purge System and Pressure Relief Line Isolation Instrumentation."  Additionally, a high radiation signal from the monitor in the plant vent will also isolate the containment purge system and pressure relief line. As a result, the containment isolation valves (and blind flanges) help ensure that the containment atmosphere will be isolated from the environment in the event of a release of fission product radioactivity to the containment atmosphere as a result of a Design Basis Accident (DBA). The OPERABILITY requirements for containment isolation valves help ensure that containment is isolated within the time limits assumed in the safety analyses. Therefore, the OPERABILITY requirements provide assurance that the containment function assumed in the safety analyses will be maintained.
Containment Isolation Valves B 3.6.3 BASESBACKGROUND  (continued)INDIAN POINT 2 B 3.6.3 - 2 Revision 2 Containment Purge Supply and Exhaust Isolation ValvesThe containment purge system is independent of the primary auxiliary building exhaust system, (except for the common exhaust fans) and includes provisions for both supply and exhaust air. The supply system includes roughing filters, heating coils, fan, supply penetration with two 36 inch butterfly valves for isolation, and a purge supply distribution header inside containment. The exhaust system includes exhaust penetration with two 36 inch butterfly valves, exhaust ductwork, filter bank with roughing, HEPA and charcoal filters, fans and exhaust vent. The design full purge flow rate is 25,000 cfm.The containment purge system isolation valves are not normally opened when in MODES 1, 2, 3 and 4 because containment pressure control is provided by the containment pressure relief line. However, containment purge system isolation valves may be opened, as needed, for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open. This is acceptable because the containment purge supply duct and exhaust duct are each equipped with two solenoid-controlled, pneumatically operated butterfly valves (one inside and one outside of the containment) to be used for isolation purposes. The valves are automatically closed upon receipt of a safety injection signal or high-containment radiation signal and are spring-loaded to fail closed on loss of control signal or instrument air. Valve travel is limited to a maximum of 60 degrees to ensure that the valves will be able to close against the maximum calculated design-basis accident pressure of 47 psig. An adjustable position setting on the actuators allows the valves to be opened to a full 90 degree position when containment integrity is not required. When the containment purge system isolation valves are closed, the space between each set of valves is pressurized above containment design pressure from the WC&PPS in accordance with LCO 3.6.10, "Weld Channel and Penetration Pressurization System (WC&PPS)." Containment Pressure Relief Line Isolation ValvesThe normal pressure changes in the containment during reactor power operation, and during plant cooldown are handled by the containment pressure relief line. Because the line is intended to be opened periodically during reactor power operation, three 10 inch butterfly valves in series are provided for isolation, one inside and two outside the containment. The design and operation of these valves is similar to the containment purge Containment Isolation Valves B 3.6.3 BASESBACKGROUND  (continued)INDIAN POINT 2 B 3.6.3 - 3 Revision 2 supply and exhaust isolation valves. The valves are automatically closed upon receipt of a safety injection signal or high-containment radiation signal and are equipped with an accumulator to assure each valve can close even if the air supply is lost. Valve travel is limited to a maximum of 60 degrees to ensure that the valves will be able to close against the maximum calculated design-basis accident pressure of 47 psig.When the containment pressure relief line isolation valves are closed, the two spaces between the three valves is pressurized above containment design pressure from the WC&PPS in accordance with LCO 3.6.10, "Weld Channel and Penetration Pressurization System (WC&PPS)." APPLICABLE SAFETY ANALYSESThe containment isolation valve LCO was derived from the assumptions related to establishing the containment boundary during major accidents. As part of the containment boundary, containment isolation valve OPERABILITY supports leak tightness of the containment. Therefore, the safety analysis of any event requiring isolation of containment is applicable to this LCO. The DBAs that result in a release of radioactive material within containment are a loss of coolant accident (LOCA) and a rod ejection accident (Ref. 1). In the analyses for each of these accidents, it is assumed that containment isolation valves are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through containment isolation valves (including containment purge valves) are minimized. The containment purge (supply and exhaust) and the containment pressure relief line may be opened in MODES 1, 2, 3 and 4, as needed, for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open.
This is acceptable because the containment purge (supply and exhaust) and the containment pressure relief line are each equipped with redundant containment isolation valves that are automatically closed upon receipt of a safety injection signal or high-containment radiation signal in containment. The DBA analysis assumes that, within 60 seconds after the accident, isolation of the containment is complete and leakage terminated except for the design leakage rate, L
: a. The containment isolation total response time of 60 seconds includes signal delay, diesel generator startup (for loss of offsite power), and containment isolation valve stroke times.
Containment Isolation Valves B 3.6.3 BASESAPPLICABLE SAFETY ANALYSES  (continued)INDIAN POINT 2 B 3.6.3 - 4 Revision 2 The single failure criterion required to be imposed in the conduct of plant safety analyses was considered in the original design of the containment purge valves. Two valves in series on each purge line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred. The containment isolation valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCOContainment isolation valves form a part of the containment boundary. The containment isolation valves' safety function is related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during a DBA. The automatic power operated isolation valves are required to have isolation times within limits and to actuate on an automatic isolation signal. The 36 inch purge valves must be maintained closed or have blocks installed to prevent full opening. Blocked purge valves also actuate on an automatic signal. The valves covered by this LCO are listed along with their associated stroke times in the UFSAR (Ref. 2). The normally closed isolation valves are considered OPERABLE when manual valves are closed, automatic valves are de-activated and secured in the closed position, blind flanges are in place, and closed systems are intact.
Additionally, entry into Conditions and Required Actions is not required when a manually operated valve is opened under administrative controls in accordance with the Note 1 to the Actions. The containment isolation valves/devices are those listed in Reference 2. The containment isolation valve leakage rate must be within the limits of Technical Specification 5.5.14, "Containment Leakage Rate Testing Program" unless the leakage rate is governed by Technical Specification 3.6.9, "Isolation Valve Seal Water (IVSW) System," or Technical Specification 3.6.10, "Weld Channel and Penetration Pressurization System (WC&PPS)," or Technical Specification 5.5.14.e and SR 3.6.3.9 governing inleakage of service water into containment. UFSAR 5.2.2 (Ref. 2) specifies that the double disc type of gate valve is considered as two barriers against leakage of radioactive liquids or containment atmosphere when sealed by water injection from the IVSW system. Therefore, inoperability of one of these double disc gate valves is considered as a containment penetration with two inoperable valves.
Containment Isolation Valves B 3.6.3 BASESLCO  (continued)INDIAN POINT 2 B 3.6.3 - 5 Revision 2 This LCO provides assurance that the containment isolation valves and purge valves will perform their designed safety functions to minimize the loss of reactor coolant inventory and establish the containment boundary during
 
accidents.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment isolation valves are not required to be OPERABLE in MODE 5. The requirements for containment isolation valves during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."
ACTIONSThe ACTIONS are modified by six Notes. Note 1 allows penetration flow paths, except for 36 inch purge valve penetration flow paths with inoperable automatic isolation capability, to be unisolated intermittently under administrative controls. This allowance also applies to valves without automatic isolation capability including manual valve and remotely operated valves. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated. Requirements for a dedicated operator are further clarified as follows: 1) For those valves that are remote-manually operated from the control room, the dedicated operator is the normally stationed control room operator. This is acceptable because this operator is continuously available to isolate the valve from the control room. 
: 2) When necessary to minimize the radiation exposure, the dedicated operator is permitted to be stationed nearby if transit time to the valve will remain less than two minutes. 3) Administrative controls and a dedicated operator are not required for manually operated CIVs required to be open both during normal plant operations and during a LOCA. Note 1 does not allow a 36 inch containment purge line penetration flow path that is isolated in accordance with Required Action A.1 or B.1 to be unisolated under administrative controls. Note 1 does not apply to the 36 inch purge line containment isolation valves with inoperable automatic isolation capability because the accident analysis assumes that these valves will close within 5 seconds. Due to the size of the containment purge line penetration and the fact that those penetrations exhaust directly from the containment atmosphere to the environment, operator action is not sufficient Containment Isolation Valves B 3.6.3 BASESACTIONS  (continued)INDIAN POINT 2 B 3.6.3 - 6 Revision 2 to compensate for the loss of automatic closure function. A single purge valve in a penetration flow path may be opened to effect repairs to an inoperable valve if the containment purge line penetration flow path remains isolated.Note 1 does not require a dedicated operator at the controls when the RHR suction isolation valve, 732, is open to support operation of the RHR system for shutdown cooling. If containment isolation is required when in the RHR mode of operation, valve 732 is shut in accordance with administrative controls to realign the RHR system for safety injection. Note 2 has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation valve.
Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation valves are governed by subsequent Condition entry and application of associated Required Actions. Note 3 has been added to ensure appropriate remedial actions are taken, if necessary, if the affected systems are rendered inoperable by an inoperable containment isolation valve. In the event the isolation valve leakage results in exceeding the overall containment leakage rate, Note 4 directs entry into the applicable Conditions and Required Actions of LCO 3.6.1. The ACTIONS are further modified by Note 5 and Note 6, which direct entry into the applicable Conditions and Required Actions of LCO 3.6.9 and LCO 3.6.10, when IVSW or WC&PPS to a containment isolation valve is not OPERABLE. This ensures that appropriate remedial actions are taken if required IVSW or WC&PPS supply to a penetration flowpath is inoperable. A.1 and A.2In the event one containment isolation valve in one or more penetration flow paths is inoperable, except for containment bypass leakage not within limit which is governed by Condition D, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.
Isolation barriers that meet this criterion are a closed and de-activated automatic containment isolation valve, a closed manual valve, a blind flange, Containment Isolation Valves B 3.6.3 BASESACTIONS  (continued)INDIAN POINT 2 B 3.6.3 - 7 Revision 2 and a check valve with flow through the valve secured (Ref. 3). For a penetration flow path isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available one to containment. Required Action A.1 must be completed within 4 hours. The 4 hour Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4. For affected penetration flow paths that have been isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. This Action requires verification, through a system walkdown, that those isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two or more containment isolation valves. For penetration flow paths with only one containment isolation valve and a closed system, Condition C provides the appropriate actions.Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, Containment Isolation Valves B 3.6.3 BASESACTIONS  (continued)INDIAN POINT 2 B 3.6.3 - 8 Revision 2 sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these devices once they have been verified to be in the proper position, is small.B.1With two or more containment isolation valves in one or more penetration flow paths inoperable (except for containment bypass leakage not within limit which is addressed in Condition D), the affected penetration flow path must be isolated within 4 hours. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. In the event the affected penetration is isolated in accordance with Required Action B.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action A.2, which remains in effect. This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative control and the probability of their misalignment is low. Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two or more containment isolation valves.
Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration flow path. C.1 and C.2With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve flow path must be restored to OPERABLE status or the affected penetration flow path must be isolated.
The method of isolation must include the use of at least one isolation barrier, other than the closed system, that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration flow path.
Required Action C.1 must be completed within the 72 hour Completion Time. The specified time period is reasonable considering the relative stability of the closed system (hence, reliability) to act as a penetration Containment Isolation Valves B 3.6.3 BASESACTIONS  (continued)INDIAN POINT 2 B 3.6.3 - 9 Revision 2 isolation boundary and the relative importance of maintaining containment integrity during MODES 1, 2, 3, and 4. In the event the affected penetration flow path is isolated in accordance with Required Action C.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This periodic verification is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate because the valves are operated under administrative controls and the probability of their misalignment is low. Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation valve and a closed system. The closed system must meet the requirements of Ref. 3. This Note is necessary since this Condition is written to specifically address those penetration flow paths in a closed system. Required Action C.2 is modified by two Notes. Note 1 applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small.D.1With the hydrostatically tested valve leakage not within limit of SR 3.6.3.8, the potential exists for flooding the Containment Recirculation Pumps during long term post-accident cooling. The leakage must be restored to within limits. Restoration can be accomplished by isolating the penetration(s) that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated the leakage rate for the isolated penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the Containment Isolation Valves B 3.6.3 BASESACTIONS  (continued)INDIAN POINT 2 B 3.6.3 - 10 Revision 2 lesser actual pathway leakage of the two devices. The 72 hour Completion Time is reasonable because of the low probability of an event occurring during this period. E.1 and E.2If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR  3.6.3.1 REQUIREMENTSEach 36 inch containment purge valve (FCV-1170, FCV-1171, FCV-1172, and FCV-1173) is required to be verified closed at 31 day intervals or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage outside of limits. The SR is not required to be met when the containment supply and/or exhaust valves are open for the reasons stated. The valves may be opened for ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open. This is acceptable because the containment purge (supply and exhaust) valves are equipped with redundant containment isolation valves that are automatically closed upon receipt of a safety injection signal or high-containment radiation signal in containment. These isolation valves are capable of closing within 3 seconds in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. This Surveillance is designed to ensure that a gross breach of containment is not caused by an inadvertently open containment purge valve. The Frequency is a result of an NRC initiative, Generic Issue B-24 (Ref. 4), related to containment purge valve use during plant operations.
Containment Isolation Valves B 3.6.3 BASESSURVEILLANCE REQUIREMENTS  (continued)INDIAN POINT 2 B 3.6.3 - 11 Revision 2 SR  3.6.3.2This SR ensures that the pressure relief line isolation valves (PCV-1190, 1191 and 1192) are closed as required or, if open, open for an allowable reason. If a pressure relief line isolation valve is open in violation of this SR, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage outside of limits. The SR is not required to be met when the pressure relief line isolation valves are open for the reasons stated. The valves may be opened for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open. The pressure relief line isolation valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The 31 day Frequency is consistent with other containment isolation valve requirements discussed in SR 3.6.3.3.SR  3.6.3.3This SR requires verification that each containment isolation manual valve and blind flange located outside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those containment isolation valves outside containment and capable of being mispositioned are in the correct position. Since verification of valve position for containment isolation valves outside containment is relatively easy, the 31 day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing. The Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during Containment Isolation Valves B 3.6.3 BASESSURVEILLANCE REQUIREMENTS  (continued)INDIAN POINT 2 B 3.6.3 - 12 Revision 2 MODES 1, 2, 3 and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in the proper position, is small. SR  3.6.3.4This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the containment boundary is within design limits.
For containment isolation valves inside containment, the Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate since these containment isolation valves are operated under administrative controls and the probability of their misalignment is low. The SR specifies that containment isolation valves that are open under administrative controls are not required to meet the SR during the time they are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing. This Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4, for ALARA reasons.
Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in their proper position, is small. SR  3.6.3.5Verifying that the isolation time of each automatic power operated containment isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analyses. The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program. SR  3.6.3.6Automatic containment isolation valves close on a containment isolation signal to prevent leakage of radioactive material from containment following a DBA. This SR ensures that each automatic containment isolation valve will actuate to its isolation position on a containment isolation signal. This Containment Isolation Valves B 3.6.3 BASESSURVEILLANCE REQUIREMENTS  (continued)INDIAN POINT 2 B 3.6.3 - 13 Revision 2 Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass this Surveillance when performed at the 24 month Frequency.
Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.SR 3.6.3.7Verifying that each containment purge supply and exhaust isolation valves (FCV-1170, FCV-1171, FCV-1172, and FCV-1173) and the containment pressure relief line isolation valves (PCV-1190, PCV-1191 and PCV-1192) is blocked to restrict opening to  60 degrees is required to ensure that the valves can close under DBA conditions within the times assumed in the analyses of References 1 and 2. If a LOCA occurs, the purge valves must close to maintain containment leakage within the values assumed in the accident analysis. At other times when purge valves are required to be capable of closing (e.g., during movement of recently irradiated fuel assemblies), pressurization concerns are not present, thus the purge valves can be fully open. The 24 month Frequency is appropriate because the blocking devices are typically removed only during a refueling outage. SR 3.6.3.8Technical Specification 5.5.14, Containment Leakage Rate Testing Program, includes a limit for the inleakage into containment from the containment isolation valves sealed with service water. The maximum permissible inleakage rate of 0.36 gpm per fan-cooler from the containment isolation valves sealed with service water is intended to prevent flooding the internal recirculation pumps during the full 12-month post-accident recirculation period. The results for this inleakage test are not counted against the acceptance criteria for the Type B and C tests that are also performed as part of the SR. The Frequency for this SR is specified in Technical Specification 5.5.14 and is based on operating experience and the plant conditions necessary to perform this test. REFERENCES 1. UFSAR, Section 14. 2. UFSAR, Section 5.
Containment Isolation Valves B 3.6.3 BASESREFERENCES  (continued) INDIAN POINT 2 B 3.6.3 - 14 Revision 2 3. Standard Review Plan 6.2.4. 4. Generic Issue B-24.
Containment PressureB 3.6.4B 3.6  CONTAINMENT SYSTEMSB 3.6.4Containment Pressure BASESBACKGROUND The containment pressure is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) or steam line break (SLB). The containment can withstand an internal vacuum of 3psig. The 2.0psig vacuum specified as an operating limit avoids any difficulties with RCP motor cooling.Containment pressure is a process variable that is monitored and controlled. The containment pressure limits are derived from the input conditions used in the containment functional analyses and the containment structure external pressure analysis. Should operation occur outside these limits coincident with a Design Basis Accident (DBA), post accident containment pressures could exceed calculated values.APPLICABLE
 
SAFETY ANALYSES  Containment internal pressure is an initial condition used in the DBA analyses to establish the maximum peak containment internal pressure. The limiting DBAs considered, relative to containment pressure, are the LOCA and SLB, which are analyzed using computer pressure transients. The worst case LOCA generates larger mass and energy release than the worst case SLB.
Thus, the LOCA event bounds the SLBevent from the containment peak pressure standpoint (Ref.1).The initial pressure condition used in the containment analysis was 16.7psia (2.0psig). This resulted in a maximum peak pressure from a LOCA of 45.82psig. The containment analysis (Ref.1) shows that the maximum peak calculated containment pressure, P a, results from the limiting LOCA.The maximum containment pressure resulting from the worst case LOCA, does not exceed the containment design pressure, 47.0psig.The containment can withstand an internal vacuum of 3psig. The 2.0psig vacuum specified as an operating limit avoids any difficulties with RCP motor
 
cooling.INDIAN POINT 2B 3.6.4 - 1 Revision 2 Containment PressureB 3.6.4 BASESAPPLICABLE SAFETY ANALYSES  (continued)For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the cooling effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure. Therefore, for the reflood phase, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the containment pressure response in accordance with 10CFR50, AppendixK (Ref.2).Containment pressure satisfies Criterion2 of 10 CFR 50.36(c)(2)(ii).
LCOMaintaining containment pressure at less than or equal to the LCOupper pressure limit ensures that, in the event of aDBA, the resultant peak containment accident pressure will remain below the containment design pressure. The LCO limits for containment pressure are analytical limits. Therefore, an appropriate allowance for instrument uncertainty must be applied when ensuring these limits are met.APPLICABILITY In MODES1, 2, 3, and4, a DBA could cause a release of radioactive material to containment. Since maintaining containment pressure within limits is essential to ensure initial conditions assumed in the accident analyses are maintained, the LCOis applicable in MODES1, 2, 3 and4.In MODES5 and6, the probability andconsequences of these events are reduced due to the pressure and temperature limitations of these MODES.
Therefore, maintaining containment pressure within the limits of the LCO is not required in MODE5 or6.ACTIONS A.1 When containment pressure is not within the limits of the LCO, it must be restored to within these limits within 1hour. The Required Action is necessary to return operation to within the bounds of the containment analysis. The 1hour Completion Time is consistent with the importanceof containment pressure as an initial condition in the analysis of peak containment pressure.INDIAN POINT 2B 3.6.4 - 2 Revision 2 Containment PressureB 3.6.4 BASESACTIONS  (continued)B.1 and B.2If containment pressure cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the plant must be brought to at least MODE3 within 6hours and to MODE5 within 36hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCESR3.6.4.1REQUIREMENTSVerifying that containment pressure is within limits ensures that unit operation remains within the limits assumed in the containment analysis. The LCO limits for containment pressure are analytical limits. Therefore, an appropriate allowance for instrument uncertainty must be applied when ensuring these limits are met. The 12hour Frequency of this SRwas developed based on operating experience related to trending of containment pressure variations during the applicable MODES. Furthermore, the 12hour Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal containment pressure condition.REFERENCES 1.UFSAR, Section14.3.5.
2.10CFR50, Appendix K. INDIAN POINT 2B 3.6.4 - 3 Revision 2 Containment Air TemperatureB 3.6.5B 3.6  CONTAINMENT SYSTEMSB 3.6.5Containment Air Temperature BASESBACKGROUND The containment structure serves to contain radioactive material that may be released from the reactor core following a Design Basis Accident (DBA). The containment average air temperature is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a loss of coolant accident (LOCA) or steam line break (SLB).The containment average air temperature upper limit is derived from the input conditions used in the containment functional analyses and the containment structure external pressure analyses. This LCOensures that initial conditions assumed in the analysis of containment response to a DBA are not violated during unit operations. The total amount of energy to be removed from containment by the Containment Spray and Cooling systems during post accident conditions is dependent upon the energy released to the containment due to the event, as well as the initial containment temperature and pressure. The higher the initial temperature, the more energy that must be removed, resulting in higher peak containment pressure and temperature. Exceeding containment design pressure may result in leakage greater than that assumed in the accident analysis. Operation with containment temperature in excess of the LCOlimit violates an initial condition assumed in the accident analysis.APPLICABLE
 
SAFETY ANALYSES Containment average air temperature is an initial condition used in the DBA analyses that establishes the containment environmental qualification operating envelope for both pressure and temperature. The limit for containment average air temperature ensures that operation is maintained within the assumptions used in the DBA analyses for containment (Ref.1).The limiting DBAs considered relative to containment OPERABILITY are the LOCA and SLB. The DBA LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure transients. No two DBAs are assumed to occur simultaneously or consecutively. The postulated DBAs are analyzed with regard to Engineered Safety Feature (ESF) systems, assuming the loss of one safeguards power train, which is the worst case single active failure, resulting in only one containment spray train and two fan cooler trains (i.e., at least fourfan cooler units) being available to respond to the event.INDIAN POINT 2B 3.6.5 - 1 Revision 3 Containment Air TemperatureB 3.6.5 BASESAPPLICABLE SAFETY ANALYSES  (continued)The limiting DBA for the maximum peak containment air temperature may be either a LOCA or a SLB. The initial containment average air temperature assumed in the design basis analyses (Ref.1) is 130F. The maximum initial containment air temperature (130F) is conservatively assumed in the analysis of the containment response to a large break LOCA.The containment average air temperature lower limit is intended to assure that the minimum service metal temperature of the containment liner is well above the NDT +30F criterion for the liner material (Ref.3).The temperature limit is also used to establish the environmental qualification operating envelope for containment. In accordance with the NRC Division of Operating Reactors (DOR) Guidelines and the Environmental Qualification Program (Ref. 5), the regulatory basis for environmental qualification inside containment is established by a LOCA, which is considered bounding DBA.The containment pressure transient is sensitive to the initial air mass in containment and, therefore, to the initial containment air temperature. The limiting DBA forestablishing the maximum peak containment internal pressure may be either a LOCA or a SLB. Theuppertemperature limit is used in this analysis to ensure that in the event of an accident the maximum containment internal pressure will not be exceeded. The initial containment temperature is also an input to the analysis for determining the peak clad temperature (PCT). The PCT analysis is for a LOCA at rated power (Mode 1) and assumes an initial temperature of 80 oF. A LOCA in Modes 2, 3 and 4 at a lowercontainment temperature (>50 oF) will be bounded by the LOCA at rated power. Further, due to available pressure margin, a LOCA in Mode 1 at a lower initial temperature will have no impact
 
on PCT (Ref. 4).Containment average air temperature satisfies Criterion2 of 10CFR 50.36(c)(2)(ii). INDIAN POINT 2B 3.6.5 - 2 Revision 3 Containment Air TemperatureB 3.6.5 BASES LCOThe initial containment average air temperature must be maintained less than or equal to the upper LCOtemperature limit to ensure the resultant peak accident temperature is maintained below the containment design temperature during a DBA. As a result, the ability of containment to perform its design function is ensured.The LCO limits for containment temperature are analytical limits. Therefore, an appropriate allowance for instrument uncertainty must be applied when ensuring these limits are met.APPLICABILITY In MODES1, 2, 3, and4, a DBA could cause a release of radioactive material to containment. In MODES5 and6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment average air temperature within the limits is not required in MODE5 or6.ACTIONS A.1 When containment average air temperature is not within the limits of the LCO, it must be restored to within limits within 8hours. This Required Action is necessary to return operation to within the bounds of the containment analysis. The 8hour Completion Time is acceptable considering the sensitivity of the analysis to variations in this parameter and provides sufficient time to correct minor problems.B.1 and B.2If the containment average air temperature cannot be restored to within its limits within the required Completion Time, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the plant must be brought to at least MODE3 within 6hours and to MODE5 within 36hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.INDIAN POINT 2B 3.6.5 - 3 Revision 3 Containment Air TemperatureB 3.6.5 BASESSURVEILLANCESR3.6.5.1REQUIREMENTSVerifying that containment average air temperature is within the LCO limits ensures that containment operation remains within the limit assumed forthe containment analyses. In order to determine the containment average air temperature, the control room indicator provides an arithmetic average of the air temperature at the inlet of each of the 5 fan cooler units. Portable temperature sensing equipment may also be used to determine containment air temperature if sufficient locations are monitored to determine a representative temperature. The 24hour Frequency of this SRis considered acceptable based on observed slow rates of temperature increase within containment as a result of environmental heat sources (due to the large volume of containment). Furthermore, the 24hour Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal containment temperature condition.REFERENCES 1.UFSAR, Section14.3.2.10CFR50.49.
3.UFSAR, Section 5.1.
4.IPP-09-14/INT-09-28, Operability Assessment for Indian Point Units 2 and 3 at a Containment Temperature of 50 oF in Modes 2, 3 and 4, June 16, 2009.
5.IP2 EnvironmentalQualification Program Plan.INDIAN POINT 2B 3.6.5 - 4 Revision 3 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6B 3.6  CONTAINMENT SYSTEMSB 3.6.6Containment Spray System and Containment Fan Cooler Unit (FCU) System BASESBACKGROUND The Containment Spray and Fan Cooler Unit (FCU) systems provide containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment pressure and the iodine removal capability of the spray reduces the release of fission product radioactivity from containment to the environment, in the event of a Design Basis Accident (DBA), to within limits.
The Containment Spray and Fan Cooler Unit (FCU) systems are designed to meet the requirements of 10CFR50, AppendixA, GDC38, "Containment Heat Removal," GDC39, "Inspection of Containment Heat Removal Systems," GDC40, "Testing of Containment Heat Removal Systems,"
GDC41, "Containment Atmosphere Cleanup," GDC42, "Inspection of Containment Atmosphere Cleanup Systems," and GDC43, "Testing of Containment Atmosphere Cleanup Systems" (Ref.1).The Containment Spray and FCUs are Engineered Safety Feature (ESF) systems. They are designed to ensure that the heat removal capability required during the post accident period can be attained. The Containment Spray System and the FCUs provide diverse methods to limit and maintain post accident conditions to less than the containment design values.Containment Spray SystemThe Containment Spray System consists of two separate trains. Each train includes a containment spray pump, piping and valves and is independently capable of delivering one-half of the design flow needed to maintain the post-accident containment pressure below 47psig. Containment spray is also used for removal of iodine from the containment atmosphere. The spray water is injected into the containment through spray nozzles connected to four 360 degree ring headers located in the containment dome area. Each train supplies two of the four ring headers. Each train is powered from a separate safeguards power train bus. The refueling water storage tank (RWST) supplies borated water to the Containment Spray System during the injection phase of operation. After the Refueling Water Storage Tank has been exhausted, the containment recirculation pumps or the Residual Heat Removal (RHR) pumps are used to supply the Containment Spray ring headers for the long-term containment cooling andINDIAN POINT 2B 3.6.6 - 1 Revision 5 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6 BASESBACKGROUND  (continued)iodine removal during the containment recirculation phase. In this configuration, the RHR heat exchangers provide the necessary cooling of the recirculated containment spray. The Containment Spray System provides a spray of cold borated water into the upper regions of containment to reduce the containment pressure and temperature and to reduce fission products from the containment atmosphere during a DBA. The RWST solution temperature is an important factor in determining the heat removal capability of the Containment Spray System during the injection phase. In the recirculation mode of operation, heat is removed from the recirculation sump or the containment sump water by the residual heat removal coolers. Both trains of the Containment Spray System provides adequate spray to meet the system design requirements for containment heat removal even if the Fan Cooler System is not OPERABLE.The recirculation system pH control system will add sodium tetraborate to the sump when the level of the boric acid solution from the containment spray and the coolant lost from the reactor coolant system rises above the level of the sodium tetraborate baskets in containment. The resulting alkaline pH of the spray enhances the ability of the re-circulated spray to scavenge fission products from the containment atmosphere. The sodium tetraborate also ensures an alkaline pH for the solution recirculated in the containment sump. The alkaline pH of the recirculation sump or the sump water minimizes the evolution of iodine and minimizes the occurrence of chloride and caustic stress corrosion on mechanical systems and components exposed to the
 
fluid.The Containment Spray System is actuated either automatically by a containment High-High pressure signal or manually. An automatic actuation starts the two containment spray pumps, opens the containment spray pump discharge valves, and begins the injection phase. A manual actuation of the Containment Spray System requires the operator to actuate two separate push buttons on the main control board to begin the same sequence. The injection phase continues until the RWST water supply is exhausted. After the Refueling Water Storage Tank has been exhausted, the containment recirculation pumps or the Residual Heat Removal (RHR) pumps may be used to supply the Containment Spray ring headers for the long-term containment cooling and iodine removal during the containment recirculation phase. In this configuration, the RHR heat exchangers provide the necessary cooling of the recirculated containment spray. The Containment Spray System in the recirculation mode may be used to maintain an equilibrium temperature between the containment atmosphere and the INDIAN POINT 2B 3.6.6 - 2 Revision 5 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6 BASESBACKGROUND  (continued)recirculated sump water. Containment Spray in the recirculation mode is controlled by the operator in accordance with the emergency operating procedures.Containment Fan Cooler SystemThe Containment Fan Cooler System consists of five 20% capacity Fan Cooler Units (FCUs) located inside containment. These FCUs are used for both normal and post accident cooling of the containment atmosphere. Each FCU consists of a motor, fan, cooling coils, dampers, duct distribution system, instrumentation and controls. Service water is supplied to the cooling coils to perform the heat removal function. During normal plant operation, service water is supplied to all five FCUs and one or more FCUs fans may be operated for containment cooling.This is necessary to limit the ambient containment air temperature during normal unit operation to less than the limit specified in LCO3.6.5, "Containment Air Temperature."  This temperature limitation ensures that the containment temperature does not exceed the initial temperature conditions assumed for the DBAs.In post accident operation following an actuation signal, the FCU fans are designed to start automatically. The temperature of the service water is an important factor in the heat removal capability of the fan units. The accident analysis assumes 1600gpm of service (cooling) water with a maximum river water inlet temperature of 95F is supplied to each FCU.Containment Cooling and Iodine Removal Function The containment cooling function is provided by either of twosystems; a)the Containment Spray System consisting of two 50% capacity trains (Ref.3); and,b)The Containment Fan Cooler System consisting of five 20% capacity Fan Cooler Units (FCUs) (Ref. 4).Requirements for Containment Spray trains may be designated by the number of the containment spray pump or the associated safeguards power train. Containment Spray Train 21 is associated with Safeguards Power Train 5A which is supported by DG 21. Containment Spray Train 22 is associated with Safeguards Power Train 6A which is supported by DG23. INDIAN POINT 2B 3.6.6 - 3 Revision 5 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6 BASESBACKGROUND  (continued)Requirements for the five fan cooler units are designated by grouping the 5 fan cooler units into three trains based on the safeguards power train needed to support OPERABILITY. This results in the following designations:Fan Cooler Train 5A consists of FCU 21 and FCU 22;Fan Cooler Train 2A/3A consists of FCU 23 and FCU 24; and Fan Cooler Train 6A consists of FCU 25.Design assumptions regarding containment air cooling are met by any of the following configurations: a)Two containment spray trains; or,b)Three fan cooler trains (i.e., five fan cooler units); or, c)One containment spray train and two fan cooler trains (i.e., four fan cooler units for the minimum safeguards, EDG 23 failure, and three fan cooler units for EDG 21/22 failure). This last configuration, one containment spray train and two fan cooler trains, is the minimum configuration available following the loss of any safeguards power train (e.g., diesel failure). It should be noted that the case with EDG 23 failure, which has one more fan cooler unit than EDG 21/22 failure, is more limiting due to the availability of only one RHR pump and one containment spray train, whichis assumed to be available for iodine removal.APPLICABLE
 
SAFETY ANALYSES The Containment Spray System and FCUs limit the temperature and pressure that could be experienced following a DBA. The limiting DBAs considered are the loss of coolant accident (LOCA) and the steam line break (SLB). The LOCA and SLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients. No DBAs are assumed to occur simultaneously or consecutively. The postulated DBAs are analyzed with regard to containment ESF systems, assuming the loss of one safeguards power train, which is the worst case single active failure and results in one train of the Containment Spray System and one train of FCUs
 
being rendered inoperable.The analysis and evaluation show that under the worst case scenario, the highest peak containment pressure and temperature may result from either a LOCA or SLB. These analyses indicate that the containment will not exceed the containment design limits of 47psig and 271F during either of these events. Both results meet the intent of the design basis.  (See the INDIAN POINT 2B 3.6.6 - 4 Revision 5 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6 BASESAPPLICABLE SAFETY ANALYSES  (continued)Bases for LCO3.6.4, "Containment Pressure," and LCO3.6.5, "Containment Air Temperature," for a detailed discussion.)  The analyses and evaluations including assumptions and methodologies are contained in References 3, 4 and 5. The analyses also assume a response time delayed initiation to provide conservative peak calculated containment pressure and temperature responses.For certain aspects of transient accident analyses, maximizing the calculated containment pressure is not conservative. In particular, the effectiveness of the Emergency Core Cooling System during the core reflood phase of a LOCA analysis increases with increasing containment backpressure. For these calculations, the containment backpressure is calculated in a manner designed to conservatively minimize, rather than maximize, the calculated transient containment pressures in accordance with 10CFR50, Appendix K (Ref.2).The modeled Containment Spray System actuation from the containment analysis is based on a response time associated with exceeding the containment High-High pressure setpoint to achieving full flow through the containment spray nozzles. The Containment Spray System total response time includes diesel generator (DG) startup (for loss of offsite power), block loading of equipment, containment spray pump startup, and spray line filling.Containment cooling train performance for post accident conditions is given inReferences3, 4 and 5. The result of the analysis is that Containment air cooling requirements are met by any of the following configurations: a)Two containment spray trains; or, b)Three fan cooler trains (i.e., five fan cooler units); or, c)    One containment spray train and two fan cooler trains (i.e., four fan cooler units for the minimum safeguards, EDG 23 failure, and three fan cooler units for EDG 21/22 failure). This last configuration, one containment spray train and two fan cooler trains, is the minimum configuration available following the loss of any safeguards power train (e.g., diesel failure and loss of offsite power). It should be noted that the case with EDG 23 failure, which has one more fan cooler unit than EDG 21/22 failure, is more limiting due to the availability of only one RHR pump and one containment spray train, which is assumed to functionto improve iodine removal from the containment atmosphere (Ref. 7).INDIAN POINT 2B 3.6.6 - 5 Revision 5 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6 BASESAPPLICABLE SAFETY ANALYSES  (continued)The modeled Containment Spray and FCU actuation from the containment analysis is based upon a response time associated with exceeding the containment High-High pressure setpoint to achieving full Containment Spray and FCU air and safety grade cooling water flow. The Containment Spray and FCU total response time includes signal delay, DG startup (for loss of offsite power), and service water pump startup times (Ref.5).The Containment Spray System and the Containment Fan Cooler System satisfy Criterion3 of 10CFR 50.36(c)(2)(ii).
LCOThis LCO requires that two trains of containment spray and three trains of FCUs (i.e., five FCUs) are OPERABLE. This ensures that a minimum of one containment spray train and two FCU trains, the minimum configuration available following the loss of any safeguards power train (e.g., diesel failure),
will be available to respond to a design basis accident.Each Containment Spray train includes a spray pump, spray headers, nozzles, valves, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an ESF actuation signal and the cross connection to the containment recirculation system which is needed during the recirculation phase. Each FCU consists of a motor, fan, cooling coils, dampers, duct distribution system, instrumentation and controls necessary to maintain an OPERABLE flow path for the containment atmosphere through the cooling coils and an OPERABLE flow path for service water through the cooling coils.APPLICABILITY In MODES1, 2, 3, and4, a DBA could cause a release of radioactive material to containment and an increase incontainment pressure and temperature requiring the operation of the containment spray trains and containment cooling trains.In MODES5 and6, the probability and consequences of these events are reduced due to the pressure and temperature limitations ofthese MODES.
Thus, the Containment Spray System and the Containment FCU System are not required to be OPERABLE in MODES5 and6.INDIAN POINT 2B 3.6.6 - 6 Revision 5 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6 BASESACTIONS A.1 With one containment spray train inoperable, the inoperable containment spray train must be restored to OPERABLEstatus within 72hours. In this Condition, the remaining OPERABLE spray and FCU trains are adequate to perform the iodine removal and containment cooling functions. The 72hour Completion Time takes into account the redundant heat removal capability afforded by the containment spray and containment FCUs, reasonable time for repairs, and low probability of a DBA occurring during this period.The 10day portion of the Completion Time for Required ActionA.1 is based upon engineering judgment. It takes into account the low probability of coincident entry into two Conditions in this Specification coupled with the low probability of an accident occurring during this time. Refer to Section1.3, "Completion Times," for a more detailed discussion of the purpose of the "from discovery of failure to meet the LCO" portion of the Completion Time.B.1 and B.2If the inoperable containment spray train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which overall plant risk is reduced. To achieve this status, the plant must be brought to at least MODE3 within 6hours and to MODE 4 within 54 hours. Remaining within the Applicability of the LCO is acceptable to accomplish short duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 8). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 8, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action B.2 is modified by a Note that states that LCO3.0.4.a is not applicable when entering MODE4. This Note prohibits the use of LCO3.0.4.a toenter MODE4 during startup with the LCO not met.
However, there is no restriction on the use of LCO3.0.4.b, if applicable, because LCO3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE4, and establishment of risk management actions, if appropriate.LCO 3.0.4 is not applicable to, and the Note does not preclude, changes inMODES or INDIAN POINT 2B 3.6.6 - 7 Revision 5 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6 BASESACTIONS  (continued)other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Time of 6hours is reasonable, based on operating experience, to reach MODE3 from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 4 allows 48 hours to restore the containment spray train to OPERABLE status in MODE3 and is reasonable when considering the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE3.C.1With one of the containment FCU trains inoperable, the inoperable required containment FCU train must be restored to OPERABLE status within 7days.
The remaining containment spray and fan cooler units when in this degraded condition provide iodine removal capabilities and are capable of providing at least 100% of the heat removal needs. The 7day Completion Time was developed taking into account the redundant heat removal capabilities afforded by combinations of containment spray and FCUs and the low probability of DBA occurring during this period.The 10day portion of the Completion Time for Required ActionC.1 is based upon engineering judgment. It takes into account the low probability of coincident entry into two Conditions in this Specification coupled with the low probability of an accident occurring during this time. Refer to Section1.3 for a more detailed discussion of the purpose of the "from discovery of failure to meet the LCO" portion of the Completion Time.D.1With two containment FCU trains inoperable, one of the containment FCU trains must be restored to OPERABLE status within 72hours. The remaining containment spray and FCUs when in this degraded condition provide iodine removal capabilities and are capable of providing at least 100% of the heat removal needs after an accident. The 72hour Completion Time was developed taking into account the redundant heat removal capabilities afforded by combinations of the containment spray and FCUs, the iodine removal function of the Containment Spray System, and the low probability of DBA occurring during this period.INDIAN POINT 2B 3.6.6 - 8 Revision 5 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6 BASESACTIONS  (continued)E.1 and E.2If the Required Action and associated Completion Time of ConditionC orD of this LCOare not met, the plant must be brought to aMODE in which overall plant risk is reduced. To achieve this status, the plant must be brought to at least MODE3 within 6hours and to MODE 4 within 12hours. Remaining within the Applicability of the LCO is acceptable to accomplish short duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 8). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense indepth. As stated in Reference 8, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action E.2 is modified by a Note that states that LCO3.0.4.a is not applicable when entering MODE4. This Note prohibits the use of LCO 3.0.4.a to enter MODE4 during startup with the LCO not met.
However, there is no restriction on the use of LCO3.0.4.b, if applicable, because LCO3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE4, and establishment of risk management actions, if appropriate.LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.F.1With two containment spray trains or any combination of three or more containment spray and FCU trains inoperable, the unit is in a condition outside the accident analysis. Entering this Condition represents a substantial degradation of the containment heat removal and iodine removal function even when minimum capability assumed in the analysis is available. Therefore, LCO3.0.3 must be entered immediately.INDIAN POINT 2B 3.6.6 - 9 Revision 5 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6 BASESSURVEILLANCESR3.6.6.1REQUIREMENTSVerifying the correct alignment for manual, power operated, and automatic valves in the containment spray flow path provides assurance that the proper flow paths will exist for Containment Spray System operation. This SRdoes not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. This SRdoes not require any testing or valve manipulation.
Rather, it involves verification, through a system walkdown, that those valves capable of potentially being mispositioned are in the correct position.SR3.6.6.2Starting each FCU from the control room and operating each containment FCU fan for 15minutes ensures that all FCUs are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. The 31day Frequency was developed considering FCUs are operated during normal plant operation, the known reliability of the fan units and controls, the redundancy available, and the low probability of significant degradation of the FCUs occurring between surveillances. It has also been shown to be acceptable through operating experience.SR3.6.6.3Verifying flow rate to each cooling unit is 1600gpm provides assurance that the design flow rate assumed in the safety analyses will be achieved (Ref.3). The 92day Frequency was developed considering quarterly swapping of the essential and non-essential SW headers, the known reliability of the Service Water System, the redundancy available, and the low probability of a significant degradation of flow occurring between surveillances.SR3.6.6.4Verifying each containment spray pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded during the cycle. Flow and differential pressure are normal tests of centrifugal pump performance required by the ASME Code (Ref.6). Since the containment spray pumps cannot be tested with flow through the spray headers, they are tested on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm INDIAN POINT 2B 3.6.6 -10Revision 5 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6 BASESSURVEILLANCE REQUIREMENTS  (continued)component OPERABILITY, trend performance, and detect incipient failures by abnormal performance. The Frequency of the SRis in accordance with the Inservice Testing Program.SR3.6.6.5 and SR3.6.6.6These SRs require verification that each automatic containment spray valve actuates to its correct position and that each containment spray pump starts upon receipt of an actual or simulated actuation of a containment High-High pressure signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 24month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillances were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillances when performed at the 24month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.SR 3.6.6.5 is modified by a note that requires this SR to include valves 869A and 869B even though these valves are normally de-energized in the open position.SR3.6.6.7This SRrequires verification that eachcontainment FCU actuates upon receipt of an actual or simulated safety injection signal. The 24month Frequency is based on engineering judgment and has been shown to be acceptable through operating experience. See SR3.6.6.5 and SR3.6.6.6, above, for further discussion of the basis for the 24month Frequency.SR3.6.6.8With the containment spray inlet valves closed and the spray header drained of any solution, low pressure air or smoke can be blown through test connections. This SRensures that each spray nozzle is unobstructed and provides assurance that spray coverage of the containment during an accident is not degraded. Due to the passive design of the nozzle, a test at 10year intervals is considered adequate to detect obstruction of the nozzles.INDIAN POINT 2B 3.6.6 -11Revision 5 Containment Spray System and Containment Fan Cooler Unit (FCU) SystemB 3.6.6 BASESSURVEILLANCE REQUIREMENTS  (continued)SR  3.6.6.9This SR verifies that minimum air flow through each FCU equals the air flow assumed in the accident analysis for heat removal from the containment.The 24month Frequency is based on engineering judgment.REFERENCES 1.10CFR50, AppendixA, GDC38, GDC 39, GDC40, GDC41, GDC42, and GDC43.
2.10CFR50, Appendix K.
3.UFSAR, Section6.3.
4.UFSAR, Section6.4.
5.UFSAR, Section14.3.
6.ASME code for Operation and Maintenance of Nuclear Power Plants.
7.Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 211 to Facility Operating License No.
DPR-26, July 27, 2000.
8.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changes to Technical Specification Required Action Endstates for Westinghouse NSSS PWRs," June 2010.INDIAN POINT 2B 3.6.6 -12 Revision 5 Recirculation pH Control SystemB 3.6.7 INDIAN POINT 2B 3.6.7 - 1 Revision 3B 3.6  CONTAINMENT SYSTEMSB 3.6.7Recirculation pH Control System BASESBACKGROUNDThe recirculation pH control system is a passive safeguard with baskets ofsodium tetraborate located in the containment sump area. Sodium tetraborate is stored in four baskets at the 46 foot elevation inside the containment building (Ref. 1).Section 6.5.2 of the Standard Review Plan (Ref. 2) specifies a pH valuegreater than or equal to 7.0 to assure continued retention of iodine in the sump solution. The initial containment spray will be boric acid solution from the refueling water storage tank which has a pH of approximately 4.5. As the initial spray solution and, subsequently, the recirculation solution comes in contact with the STB, the STB dissolves raising the pH of the sump solution to an equilibrium value between 7.0 and 7.6.APPLICABLE
 
SAFETY ANALYSESThe recirculation pH control system is a passive safeguard with the baskets of sodium tetraborate located in the containment sump area. The OPERABILITY of the recirculation pH control system ensures that there is sufficient sodium tetraborate (STB) available in containment to guarantee a sump pH >7.0 during the recirculation phase of a postulated LOCA. Themass of sodium tetraborate (STB) required to provide an equilibrium sumpsolution pH of >7.0 is 8,096  pounds. The initial containment spray will be boric acid solution from the refueling water storage tank which has a pH of approximately 4.5. As the initial spray solution and, subsequently, the recirculation solution comes in contact with the STB, the STB dissolves raising the pH of the sump solution to an equilibrium value between 7.0 and 7.6 (Ref. 1).The Recirculation pH Control System satisfies Criterion 3 of10 CFR 50.36(c)(2)(ii).Credit for retention of iodine in the sump solution is assumed for the rodejection accident (Ref. 3), the Small Break Loss of Coolant Accident (Ref. 4),
and the Large Break Loss of Coolant Accident (Ref. 4).
Recirculation pH Control SystemB 3.6.7 BASES INDIAN POINT 2B 3.6.7 - 2 Revision 3 LCOThe recirculation pH control system is necessary to reduce the release ofradioactive material to the environment in the event of a DBA. To be considered OPERABLE, each of the four storage sodium tetraborate baskets must be in place and intact and collectively contain 8096 pounds (160 cubicfeet) of sodium tetraborate decahydrate, or equivalent.APPLICABILITYIn MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment requiring the operation of the recirculation pH control system. The recirculation pH control system assists in reducing the iodine fission product inventory prior to release to the environment.In MODES 5 and 6, the probability and consequences of these events arereduced due to the pressure and temperature limitations in these MODES.
Thus, the recirculation pH control system is not required to be OPERABLE in MODE 5 or 6.ACTIONS A.1If the recirculation pH control system is inoperable, it must be restored to OPERABLE within 72 hours. The pH adjustment of the recirculation pH control system flow for corrosion protection and iodine removal enhancement is reduced in this condition. The Containment Spray system would still be available and would remove some iodine from the containment atmosphere in the event of a DBA. The 72 hour Completion Time takes into account the low probability of the worst case DBA occurring during this period.B.1 and B.2If the recirculation pH control system cannot be restored to OPERABLEstatus within the required Completion Time, the plant must be brought to a MODE in which overall plant risk is reduced. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 4 within
 
54 hours.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 5). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 5, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling Recirculation pH Control SystemB 3.6.7BASES (continued)ACTIONS  (continued)
INDIAN POINT 2B 3.6.7 - 3 Revision 3be lost while relying on this Required Action, there are preplanned actionsto ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action B.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Time of 6 hours is reasonable, based on operatingexperience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 4 allows 48 hours for restoration of recirculation pH control system.
This is reasonable when considering the reduced pressure and temperature conditions in MODE 3 for the release of radioactive material from the Reactor Coolant System.SURVEILLANCESR  3.6.7.1REQUIREMENTSThis SR provides visual verification that each of the four storage sodiumtetraborate baskets is in place and intact and collectively contain8096 pounds (160 cubic feet) of sodium tetraborate decahydrate, orequivalent. This amount of TSP is sufficient to ensure that the recirculation solution following a LOCA is at the correct pH level. The 24 month Frequency is sufficient to ensure that the stainless steel baskets are intact and contain the appropriate amount of STB.REFERENCES 1.UFSAR, Section 6.3.
2.Standard Review Plan, Section 6.5.2.
3.UFSAR, Section 14.2 4.UFSAR, Section 14.3 5.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changes to Technical Specification Required Action Endstates for Westinghouse NSSS PWRs," June 2010.
Not UsedB 3.6.8 INDIAN POINT 2 B 3.6.8 - 1 Revision 1 B 3.6  CONTAINMENT SYSTEMS B 3.6.8 Not  Used Isolation Valve Seal Water System B 3.6.9    INDIAN POINT 2 B 3.6.9-1 Revision 0 B 3.6  CONTAINMENT SYSTEMS B 3.6.9 Isolation Valve Seal Water (IVSW) System BASES BACKGROUND The Isolation Valve Seal Water (IVSW) System improves the effectiveness of certain containment isolation valves (CIVs) by providing a water seal to valve leakage paths. This is accomplished by injecting water between the seats and stem packing of globe and double-disk type isolation valves and into the piping between other closed containment isolation valves. Sealing water is maintained in an IVSW supply tank filled with water and pressurized with nitrogen. The IVSW System is actuated in conjunction with automatic initiation of containment isolation and is applied to CIVs in lines connected to the Reactor Coolant System or exposed to the containment atmosphere during an accident. The seal water is injected at a pressure of at least 52 psig which is  1.1 times the calculated peak containment pressure (P a). For those valves sealed by IVSW, the possibility of leakage from the Containment or Reactor Coolant System to the atmosphere outside containment is eliminated because leakage will be from the IVSW system into the Containment.
The containment is designed with an allowable leakage rate not to exceed 0.1% of the containment air weight per day. The maximum allowable leakage rate is used to evaluate offsite doses resulting from a DBA. Confirmation that the leakage rate is within limit is demonstrated by the performance of a Type A leakage rate test in accordance with the Containment Leakage Rate Testing Program as required by LCO 3.6.1, "Containment."  During the performance of the Type A test, no credit is taken for the IVSW System in meeting the containment leakage rate criteria.
Although IVSW is not needed to maintain plant releases such that the whole body and thyroid offsite doses would be within the guidelines specified in 10 CFR 50.67 on Type A leakage testing, Indian Point 2 elected to consider IVSW as a seal system as described in 10 CFR 50, Appendix J (Ref. 3). This election allows leakage through CIVs sealed by IVSW to be excluded when calculating Type B and C testing results. 
 
To satisfy the requirements of 10 CFR 50, Appendix J, for excluding leakage from CIVs sealed by IVSW from Type B and C limits, Technical Specifications must ensure the IVSW sealing function (both sealing water supply and nitrogen gas supply) is maintained at a pressure of 1.1 P a for at least 30 days.
Isolation Valve Seal Water System B 3.6.9  BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.6.9-2 Revision 0 Sealing water design capacity is sufficient to maintain a source of seal water at the required pressure for a minimum of 24 hours without operator intervention assuming worst case leakage and the single failure of a CIV sealed by IVSW. The requirements for a 24 hour supply of seal water under worst case conditions is satisfied by maintaining a minimum of 144 gallons in the 176 gallon capacity seal water tank.
Nitrogen gas for IVSW seal water pressurization is satisfied by having two compressed nitrogen bottles in the IVSW supply bank aligned to the IVSW supply tank.
To satisfy the requirement of 10 CFR 50, Appendix J, (Ref. 3) for maintaining the IVSW sealing function for at least 30 days, manual operator action may be required to replenish the IVSW seal water supply and/or compressed gas supply. The IVSW tank is instrumented to provide local indication of pressure and water level. Low water level, low pressure and high pressure in the IVSW supply tank have alarms that annunciate on the Waste Disposal-Boron Recycle Panel which has an associated category alarm in the control room.
 
Two sources of makeup water and two alternate sources of compressed gas with sufficient capacity to maintain the IVSW sealing function for 30 days are available. The two sources of makeup water are the primary water storage tank and the city water system. The two alternate sources of compressed gas are the normally isolated nitrogen gas bottles in the nitrogen supply bank and the ability to refill or replace the IVSW nitrogen supply bottles from the plant Nitrogen System. Manual operations required to supply makeup water and gas to the IVSW System are performed in an area that is accessible during an accident.
The IVSW System distribution piping consists of five headers. Three of the five IVSW headers are pressurized by opening either of a single pair of normally closed header injection valves (1410 and 1413) which are in parallel. These valves open automatically on a containment Phase "A" isolation signal to admit seal water to the associated CIVs. One of the five IVSW headers is pressurized by opening either of a single pair of normally closed header injection valves (3518 and 3519) which are in parallel. These valves open automatically on a containment Phase "A" isolation signal to admit seal water to the associated CIVs. One IVSW header is used to supply seal water to CIVs on process lines that are not automatically closed on a containment Phase "A" isolation signal. This header is normally pressurized by the IVSW System with a normally closed manual or air-motor operated isolation valve for each pair of CIVs served by this IVSW header.
Isolation Valve Seal Water System B 3.6.9  BASES BACKGROUND  (continued) INDIAN POINT 2 B 3.6.9-3 Revision 0 Redundant automatic header injection valves in parallel (SDV 3518/SDV 3519 and Valves 1410/1413) ensure the IVSW header is pressurized if there is a failure of one injection valve in either pair. Each of the automatic header injection valves in each pair are actuated from separate and independent signals. A related system, the Isolation Valve Seal Gas System, is not credited as a seal system as described in 10 CFR 50, Appendix J, and is not addressed by this Technical Specification. This system uses the nitrogen bank used to supply the IVSW System to supply high pressure nitrogen that may be used to seal lines subjected to pressure in excess of the 150 psig IVSW design pressure due to operation of the recirculation pumps. This system is manually initiated during the post accident recovery phase and is not part of the IVSW System.
APPLICABLE SAFETY ANALYSES The IVSW System LCO was derived from the requirement related to the control of leakage from the containment during major accidents. This LCO is intended to ensure the actual containment leakage rate is maintained within the maximum value assumed in the safety analyses. As part of the containment boundary, containment isolation valves function to support the leak tightness of the containment. The IVSW System assures the effectiveness of certain containment isolation valves by providing a water seal pressurized to  1.1 times the maximum peak containment accident pressure at the valves and thereby reducing containment leakage. As such, the IVSW System is considered a seal system as described in 10 CFR 50, Appendix J. Therefore, the safety analyses of any event requiring isolation of containment is applicable to this LCO.
The DBA that results in a release of radioactive material within containment is a loss of coolant accident (LOCA)(Ref. 2). The DBAs assume that, within 60 seconds after the accident, isolation of the containment is complete and leakage terminated except for the design leakage rate, L
: a. The containment isolation total response time of 60 seconds includes signal delay, diesel generator startup (for loss of offsite power) and containment isolation valve stroke time. The IVSW System actuates on a containment isolation signal and functions within 60 seconds to help reduce containment leakage below the allowable design leakage rate value, L
: a.
The Isolation Valve Seal Water System satisfies Criterion 3 of 10 CFR 50.36.
 
Isolation Valve Seal Water System B 3.6.9  BASES  INDIAN POINT 2 B 3.6.9-4 Revision 0 LCO OPERABILITY of the IVSW System is based on the system's capability to supply seal water to selective containment isolation valves within the time assumed in the applicable safety analyses and to ensure water at the required pressure is maintained for at least 30 days. This requires the IVSW tank be maintained with an adequate volume of water, an air or nitrogen overpressure sufficient to provide the motive force to move the water to the applicable penetration, piping to provide an OPERABLE flow path and two air operated header injection valves on each of the two automatically actuated branch headers (i.e., SDV 3518/SDV 3519 and Valves 1410/1413).
APPLICABILITY The IVSW System is required to be OPERABLE in MODES 1, 2, 3, and 4 because a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the IVSW System is not required to be OPERABLE in MODE 5 or 6.
ACTIONS A.1 With one IVSW System header (or portion of a header) inoperable, a portion of the CIVs serviced by IVSW may not receive seal water at the required pressure and volume for effective sealing. However, the CIVs are OPERABLE and will still close, the affected CIVs provide adequate isolation to meet containment isolation requirements without IVSW during the most recent Type A test, and the number of CIVs affected by the failure of one IVSW header is small compared to the total number of CIVs. Therefore, the 7 days is allowed to restore the IVSW System header to OPERABLE status.
With one IVSW automatic actuation valve inoperable in either or both automatically actuated header, the IVSW function is still available because the redundant automatic actuation valve is OPERABLE. Therefore, 7 days is allowed to restore the IVSW automatic actuation valve to OPERABLE status. B.1 With the IVSW System inoperable for reasons other than Condition A, the effectiveness of CIVs sealed by IVSW may be compromised. This Condition may result from failure to meet any of the surveillance requirements needed to verify OPERABILITY of IVSW or the inoperability of multiple IVSW headers or automatic actuation devices. However, the CIVs are OPERABLE and will still close and the affected CIVs provide adequate isolation to meet containment isolation requirements without IVSW during the most recent Isolation Valve Seal Water System B 3.6.9  BASES ACTIONS  (continued) INDIAN POINT 2 B 3.6.9-5 Revision 0 Type A test. Additionally, except in the unusual case where inoperability is the result of failure to meet SR 3.6.9.5, the affected CIVs have demonstrated the ability to satisfy IVSW leakage requirements using IVSW seal water in lieu of meeting Type C testing requirements. Therefore, 24 hours is allowed to restore the IVSW System to OPERABLE status. C.1 and C.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems SURVEILLANCE SR  3.6.9.1 REQUIREMENTS This SR verifies the IVSW tank has the necessary pressure to provide motive force to the seal water. A 52 psig pressure is sufficient to ensure the containment penetration flowpaths that are sealed by the IVSW System are maintained at a pressure  1.1 times the calculated peak containment internal pressure (Pa) related to the design bases accident. Verification of the IVSW tank pressure on a Frequency of once per 24 hours is acceptable because operating experience has shown this Frequency to be appropriate for early detection and correction of off normal trends.
SR  3.6.9.2 This SR ensures the capability of the IVSW nitrogen source to pressurize the IVSW System as needed to support IVSW operation for a minimum of 30 days. Verification of the IVSW tank pressure on a Frequency of once per 24 hours is acceptable because operating experience has shown this Frequency to be appropriate for early detection and correction of off normal trends. SR 3.6.9.3
 
This SR verifies the IVSW tank has an initial volume of water necessary to provide seal water to the containment isolation valves served by the IVSW System for a period of at least 24 hours assuming the failure of one CIV and the maximum allowed leakage past other CIVs served by IVSW. Verification of IVSW tank level on a Frequency of once per 24 hours is acceptable since Isolation Valve Seal Water System B 3.6.9  BASES SURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.6.9-6 Revision 0 tank level is monitored by installed instrumentation and will alarm in the control room and on the Waste Disposal-Boron Recycle Panel in sufficient time to re-fill the tank before it is depleted.
SR 3.6.9.4
 
This SR verifies the stroke time of each automatic IVSW header injection solenoid valve is within limits. The frequency is 24 months. Previous operating experience has shown that these valves usually pass the required test when performed.
SR 3.6.9.5
 
This SR ensures that automatic header injection valves actuate to the correct position on a simulated or actual signal. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance when performed at the 24 month Frequency.
SR 3.6.9.6
 
Integrity of the IVSW seal boundary is important in providing assurance that the design leakage value required for the system to perform its sealing function is not exceeded. This testing is performed in accordance with the requirements, Frequency and acceptance criteria established in Technical Specification 5.5.14, Containment Leakage Rate Testing Program. This program was established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50, Appendix J, Option B, as modified by IP2 specific approved exemptions. This program conforms to guidelines contained in Regulatory Guide 1.163, "Performance-Based Containment Leak Test Program, dated September 1995."  REFERENCES 1. UFSAR, Section 6.5.
: 2. UFSAR, Chapter 14.3.
: 3. 10 CFR 50, Appendix J.
WC&PPSB 3.6.10 INDIAN POINT 2 B 3.6.10 - 1 Revision 3 B 3.6  CONTAINMENT SYSTEMS 3.6.10 Weld Channel and Penetration Pressurization System BASESBACKGROUND The Weld Channel and Penetration Pressurization System (WC&PPS) is designed to continuously pressurize the space between selected isolation valves, system piping containment penetration barriers, and most of the weld seam channels installed on the inside of the liner of the Containment. Pressurization by the WC&PPS provides a continuous, sensitive, and accurate means of monitoring Containment status with respect to leakage. The WC&PPS is maintained at a pressure above the containment peak accident pressure so that postulated leakage past the monitored barriers will be into the containment rather than out of the containment. The design basis leakage rate from the WC&PPS is 0.2% of containment free volume per day which assumes leakage of 0.1% of containment free volume per day into the containment and an identical amount leaking to the environment. Following a design basis accident, the system will maintain pressure greater than the post accident containment pressure for 24 hours (Ref. 1).The WC&PPS is divided into four independent zones to simplify the process of locating leaks during operation. If one zone has a leak during operation, the specific penetration, weld channel, or containment isolation valve containing the leak can be identified by isolating the individual air supply line to each component in the zone. Additionally, a capped tube connection installed in each line allows injecting leak test gas (Ref. 1). The instrument air system provides a regulated supply of clean and dry compressed air for the WC&PPS. One instrument air compressor is sufficient to maintain pressurization at the maximum allowable leakage rate of the WC&PPS. A backup source of air for the WC&PPS is the station air system which includes at least one station air compressor. Each WC&PPS zone is served by its own air receiver which will continue to supply air to the zone if the instrument air system and station air system are lost. Each of the air receivers is sized to supply air to its zone for a period of at least one hour based on a total leakage rate of 0.2% of the containment free volume per day. If the receivers are exhausted before normal and backup air supplies are restored, additional backup is provided by a bank of nitrogen cylinders. The nitrogen backup system will automatically deliver nitrogen at a pressure slightly lower than the normal regulated air supply. Thus, in the event of failure of the normal and backup air supply systems during periods when the system is in operation, WC&PPS pressure requirements will be automatically maintained by the nitrogen supply. This assures reliable pressurization under both normal and accident conditions.
WC&PPSB 3.6.10 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.6.10 - 2 Revision 3 The combination of the air receivers and nitrogen supply is sufficient to ensure WC&PPS pressure is above the peak containment pressure at the start of a LOCA and to maintain WC&PPS above the post-LOCA containment pressure profile for the 24 hour period following a LOCA at the design leakage rate of 0.2% of the containment free volume per day. WC&PPS pressure control valves, isolation valves and check valves are generally located outside of the containment for ease of inspection and maintenance. The line to each of the four pressurized zones is equipped with a critical pressure drop orifice to assure that air consumption will be within the capacity of the system and that high air consumption in one zone does not affect the operation of the other zones. Additionally, restricting orifices are installed on pressurization lines, where required, to assure that air consumption, even on failure of an individual line, will not result in loss of pressure to the other components connected to the same pressurization header.All pressurized components have provisions for either local pressure indication, mounted outside the Containment, or remote low pressure alarms in the Control Room (Ref. 1). The actuating pressure for each pressure alarm is set above incident pressure and below the nitrogen supply regulator setting.WC&PPS air consumption is continuously monitored by two flow sensing meters located in each of the headers supplying makeup air to the four WC&PPS zones. Output from these sensors is applied to a summing amplifier which drives a total flow recorder. The flow measurement range is 0-15 scfm with an accuracy of  1% of full scale. High flow alarms in the Control Room are derived from the recording channel. With the WC&PPS at 47 psig and the containment at approximately atmospheric pressure, an indicated WC&PPS flow rate of 15.2 scfm is equivalent to the WC&PPS design leakage limit. A WC&PPS flow rate of 15.2 scfm, if sustained for 24 hours, is equivalent to 0.2% of the containment free volume at a pressure of 47 psig. APPLICABLESAFETYANALYSESAt Indian Point 2, the radiological consequence analyses that evaluated the adoption of the alternate source term assumptions in accordance with 10 CFR 50.67, Accident Source Term, showed that 10 CFR 50.67 limits are met assuming the Containment leaks at a rate of 0.1% per day of Containment free volume for the first 24 hours and 0.05% per day of Containment free volume thereafter (References 2 and 3). No credit is taken for the WC&PPSB 3.6.10 BASESAPPLICABLE SAFETY ANALYSES (Continued) INDIAN POINT 2 B 3.6.10 - 3 Revision 3 WC&PPS when determining the amount of radioactivity released for offsite dose evaluations because the integrated leakage rate tests required by Technical Specification 5.5.14, Containment Leakage Rate Testing Program, are performed with the penetration barriers and weld channel zones open to the containment atmosphere. However, WC&PPS does provide an additional means for ensuring that containment leakage is minimized (Ref. 4). A design function of WC&PPS is to provide a continuous, sensitive, and accurate means of monitoring leakage of selected containment isolation valves (CIVs), the air lock door seals, and containment welds that are pressurized by this system. WC&PPS leakage, even if  below the WC&PPS design leakage rate, may indicate that one of these supported components is exceeding its leakage rate acceptance criteria. In this situation, the supported component may be inoperable and the APPLICABLE SAFETY ANALYSES for the supported component is applicable. For containment isolation valves (CIVs) supported by WC&PPS, WC&PPS pressurization is applied to the space between those CIVs that are normally closed. CIVs supported by WC&PPS are Type C tested in accordance with Technical Specification 5.5.14 because WC&PPS is not credited as a seal system.  - If WC&PPS pressurization is lost without indication of high air consumption, the WC&PPS is a potential leakage path from the containment to the atmosphere. Isolation of the WC&PPS supply to the affected CIVs provides appropriate compensatory action because the supported CIVs are a tested boundary and isolating the depressurized WC&PPS supply eliminates WC&PPS as a potential leakage path from containment to the atmosphere.- If WC&PPS air consumption is high, the WC&PPS leakage pathway is a potential leakage path from the containment to the atmosphere; however, potential leakage from containment is minimized as long as WC&PPS pressurization is maintained. After the leakage pathway is depressurized by being isolated from the WC&PPS air supply, the supported CIVs may be inoperable if the leakage pathway is not also isolated from the supported CIVs. If the leakage pathway is not isolated from the supported CIVs after depressurization, the requirements of LCO 3.6.3, "Containment Isolation Valves," are applicable.
WC&PPSB 3.6.10 BASESAPPLICABLE SAFETY ANALYSES (Continued) INDIAN POINT 2 B 3.6.10 - 4 Revision 3 For the containment air lock door seals, WC&PPS may be aligned to continuously pressurize the space between the seals on each airlock door. Air lock OPERABILITY does not require pressurization of the air lock door seals except as needed to verify the seals have reseated after each air lock door is operated (see LCO 3.6.2, "Containment Air Locks"). - If WC&PPS pressurization is lost without indication of high air consumption, the WC&PPS is a potential leakage path from the containment to the atmosphere. Isolation of the WC&PPS supply to the affected air lock door provides appropriate compensatory action because seal pressurization is not required for air lock OPERABILITY and isolating the depressurized WC&PPS supply eliminates WC&PPS as a potential leakage path from containment to the atmosphere. Note that LCO 3.6.2, "Containment Air Locks," requires verification that air lock seals have re-seated by temporarily pressurizing the seals within 7 days after operation of the air lock door. - If WC&PPS air consumption is high, the WC&PPS leakage pathway is a potential leakage path from the containment to the atmosphere; however, potential leakage from containment is minimized as long as WC&PPS pressurization is maintained. After the leakage pathway is depressurized by being isolated from the WC&PPS air supply, the supported air lock door may be inoperable if the leakage pathway is not also isolated from the supported air lock door. If the leakage pathway is not isolated from the supported air lock door after depressurization, the requirements of LCO 3.6.2, "Containment Air Locks," are applicable. For weld channels and piping penetrations, WC&PPS pressurizes what is equivalent to a closed system inside containment. Because it is reasonable to assume that WC&PPS leakage is not the result of a containment weld or piping penetration defect, WC&PPS leakage and/or lack of pressurization is a concern only because it presents a potential leakage path from containment to the atmosphere via the depressurized WC&PPS. Therefore, isolation of the WC&PPS supply to the affected section of weld channel or piping penetration provides appropriate compensatory action for both loss of pressurization and air consumption caused by flow from the WC&PPS into containment. This assumes that containment leakage rate testing required by Technical Specification 5.5.14 provides a high degree of assurance that WC&PPS air consumption is not indicative of deterioration of the containment boundary.
WC&PPSB 3.6.10 BASESAPPLICABLE SAFETY ANALYSES (Continued) INDIAN POINT 2 B 3.6.10 - 5 Revision 3 Limits for air consumption are based on the integrated containment leak rate test acceptance criterion and the ability of the reserve air supplies in the air receivers and nitrogen cylinders to maintain WC&PPS pressure above calculated containment pressure for a minimum of 24 hours following an event.WC&PPS satisfies Criterion 3 of 10 CFR 50.36 where it is used to pressurize the space between selected CIVs and pressurize air lock door seals. The WC&PPS system, if not maintained at the required pressure, represents a potential leakage path to the environment if there is a single failure of a supported CIV or air lock seal. WC&PPS satisfies Criterion 4 of 10 CFR 50.36 because it provides an additional means for ensuring that containment leakage is minimized although no credit is taken for the WC&PPS in calculating offsite dose for meeting 10 CFR 50.67 and 10 CFR 50, Appendix A, Criterion 19. LCOThis LCO requires that the WC&PPS is OPERABLE. OPERABILITY requires the following: all required portions of each WC&PPS zone are pressurized to a value that exceeds peak containment pressure during a design basis accident; and, total leakage (i.e., air consumption) from the required portions of the WC&PPS are within specified limits. Limits for air consumption are based on the sensible leak rate test acceptance criterion and the ability of the reserve air supplies in the air receivers and nitrogen cylinders to maintain WC&PPS pressure above calculated containment pressure for a minimum of 24 hours following an event. Station Air is not credited for air supply to the WC&PPS during an event. For a portion of the WC&PPS to be considered not required, it must meet all of the following criteria:1) it must be inoperable (i.e., can not maintain a pressure above required limits and/or causes system air consumption to exceed required limits);  2) it must be isolated or disconnected from the system; and, 
: 3) it must have been determined by written evaluation as not practicably accessible for repair.
WC&PPSB 3.6.10 BASESLCO  (continued) INDIAN POINT 2 B 3.6.10 - 6 Revision 3 Inoperable sections of WC&PPS piping which can be considered as not practicably accessible for repair will satisfy one of the following criteria: 1) the piping is covered by concrete and repairs of the piping would involve the removal of some portion of the containment structure; or,2) the piping is located behind plant equipment in the containment building and repairs of the piping would involve the relocation of the equipment.The integrity of the welds associated with any disconnected or isolated portions of the WC&PPS is considered verified by integrated leak rate testing performed in accordance with Technical Specification 5.5.14. The provision that allows for the disconnection of portions of the WC&PPS piping does not apply to any other WC&PPS piping. Isolation of the WC&PPS supply to an individual component does not cause WC&PPS to be inoperable.APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. WC&PPS is required to support OPERABILITY of the containment, containment air locks, and selected containment isolation valves. In MODES 5 and 6, OPERABILITY of the containment, containment air locks, and containment isolation valves is not required. Therefore, the WC&PPS is not required to be OPERABLE in MODES 5 and 6.
ACTIONSThe ACTIONS are modified by two Notes. Note 1 is added to clarify that Separate Condition entry is allowed for each component supplied by WC&PPS. This is acceptable because the Required Actions for each Condition provide appropriate compensatory actions for each component supported by WC&PPS. Complying with the Required Actions may allow for continued operation, and subsequent inoperable WC&PPS components are governed by subsequent Condition entry and application of associated Required Actions. Note 2 is added to direct entry into the applicable Conditions and Required Actions of LCO 3.6.1, "Containment," if it is determined that WC&PPS inoperability is indicative of exceeding the overall containment leakage rate. Note that entry into the Conditions and Required Actions of LCO 3.6.1 may be required even if WC&PPS air consumption limits are not exceeded.
WC&PPSB 3.6.10 BASESACTIONS  (continued) INDIAN POINT 2 B 3.6.10 - 7 Revision 3 A.1 and A.2In the event one or more components supplied by WC&PPS is not maintained within the pressure limit of SR 3.6.10.1, Required Action A.1 requires that the WC&PPS supply to the affected weld channels, penetrations, or containment isolation valves must be isolated within 4 hours. Required Action A.1 is needed because isolation of the WC&PPS supply to the affected component results in using an isolation valve as a substitute for pressurization. This prevents the WC&PPS from becoming a potential leakage path from the containment to the atmosphere. This action satisfies the required safety function for containment because the leakage rate testing performed in accordance with Technical Specification 5.5.14 has already verified that the containment leakage rate is within required limits without crediting the WC&PPS. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange (including compression fittings), and a check valve with flow through the valve secured (Ref. 3). For a WC&PPS supply isolated in accordance with Required Action A.1, the device used to isolate the weld channel, penetration or containment isolation valves should be the closest available to component. The 4 hour Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4. If a WC&PPS supply cannot be restored to OPERABLE status within the 4 hour Completion Time and is isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and not pressurized by WC&PPS will be in the isolation position should an event occur. Required Action A.2 does not require any testing or device manipulation. This action involves verification, through a system walkdown, that isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" and exempting valves that are locked, sealed or otherwise secured in the required position is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior WC&PPSB 3.6.10 BASESACTIONS  (continued) INDIAN POINT 2 B 3.6.10 - 8 Revision 3 to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small. B.1, B.2 and B.3Condition B applies if one or more required portions of WC&PPS has leakage that places the WC&PPS outside the limits of SR 3.6.10.2. This also applies if the air receivers or nitrogen cylinders necessary to maintain WC&PPS pressure above calculated containment pressure for a minimum of 24 hours following a design basis event are unavailable. In this condition, Required Action B.3 requires that portions of the WC&PPS are isolated, as necessary, to restore WC&PPS leakage to within the limits of SR 3.6.10.2. However, safety function is not restored until any portions of the WC&PPS that are depressurized by this Action are isolated. Therefore, Required Action B.3, is modified by a Note that requires entry into Condition A for components not within the pressure limit of SR 3.6.10.1 as a result of isolating the leakage path. The Completion Time of 7 days to isolate the leakage path is acceptable because all un-isolated portions of the WC&PPS are pressurized, otherwise, Condition A is applicable immediately. Containment function is restored when leaking portions of the WC&PPS are isolated and at least one isolation device separates the containment barrier from the WC&PPS leakage path. As discussed in the Applicable Safety Analyses, containment function is not restored by Required Action B.3 if the air consumption leakage path is depressurized but not isolated from the supported containment isolation valves or containment air lock seal. In this situation, the WC&PPS air consumption leakage path could create a leakage path from containment to the atmosphere. Therefore, Required Action B.1 requires entry into the applicable Conditions and Required Actions of LCO 3.6.3, "Containment Isolation Valves" within 1 hour of discovery that the WC&PPS air consumption leakage path is depressurized and not isolated from the supported containment isolation valves. Likewise, Required Action B.2 requires entry into the applicable Conditions and Required Actions of WC&PPSB 3.6.10 BASESACTIONS  (continued) INDIAN POINT 2 B 3.6.10 - 9 Revision 3 LCO 3.6.2, "Containment Air Locks" within 1 hour of discovery that the WC&PPS air consumption leakage path is depressurized and not isolated from the supported air locks. The Required Actions of LCO 3.6.2 and LCO 3.6.3 will restore safety function for WC&PPS air consumption leakage path that is depressurized. C.1 and C.2If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. SURVEILLANCE SR  3.6.10.1 REQUIREMENTSThis SR requires periodic verification during plant operation that the required portions of each WC&PPS zone are maintained at a pressure greater than the containment peak accident pressure. This SR is satisfied by verification of zone pressure on each of the four WC&PPS zones is above the specified limit. The 31 day Frequency is acceptable because there are low pressure alarms in the Control Room to ensure that operators are aware that all WC&PPS zones are pressurized. SR  3.6.10.2This SR requires periodic verification during plant operation that the WC&PPS air consumption is  0.2% of the containment free volume per day. This SR is performed by taking the sum of the reading on the flow sensing devices located in each of the zone headers. A WC&PPS total flow rate of 15.2 scfm, if sustained for 24 hours, is equivalent to 0.2% of the containment free volume at a pressure of 47 psig. The 31 day Frequency recognizes that WC&PPS air consumption indication and high flow alarms are provided in the control room.
WC&PPSB 3.6.10 BASESSURVEILLANCES REQUIREMENTS (continued) INDIAN POINT 2 B 3.6.10 - 10 Revision 3 SR 3.6.10.3This SR, sometimes called the sensitive leak rate test, ensures that the leakage rate for the WC&PPS is  0.2% of the containment free volume per day when pressurized to  52 psig above containment pressure. The sensitive leak rate test includes only the volume of the weld channels, double penetrations, and containment isolation valves supported by WC&PPS. This test is considered more sensitive than the integrated leakage rate test, as the instrumentation used permits a direct measurement of leakage from the pressurized zones. The 24 month Frequency is acceptable because experience has shown that the WC&PPS usually passes this Surveillance when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.REFERENCES 1. UFSAR, Section 6.6. 2. 10 CFR 50.67. 3. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 211 to Facility Operating License No. DPR-26, July 27, 2000. 4. UFSAR, Section 14.3. 5. Standard Review Plan Section 6.2.4.
MSSVsB 3.7.1 INDIAN POINT 2 B 3.7.1 - 1 Revision 2 B 3.7  PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs)
BASESBACKGROUND The primary purpose of the MSSVs is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the reactor coolant pressure boundary (RCPB) by providing a heat sink for the removal of energy from the Reactor Coolant System (RCS) if the preferred heat sink, provided by the Condenser and Circulating Water System, is not available. Five MSSVs are located on each main steam header, outside containment, upstream of the main steam isolation valves, as described in the UFSAR, Section 10.2 (Ref. 1). The MSSVs must have sufficient capacity to limit the secondary system pressure to  110% of the steam generator design pressure in order to meet the requirements of the ASME Code, Section III (Ref. 2). The MSSV design includes staggered setpoints, according to Table 3.7.1-2 in the accompanying LCO, so that only the needed valves will actuate. Staggered setpoints reduce the potential for valve chattering that is due to steam pressure insufficient to fully open all valves following a turbine trip.APPLICABLE
 
SAFETY ANALYSESThe design basis for the MSSVs comes from Reference 2 and its purpose is to limit the secondary system pressure to  110% of design pressure for any anticipated operational occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis. The events that challenge the relieving capacity of the MSSVs, and thus RCS pressure, are those characterized as decreased heat removal events, which are presented in the UFSAR, Section 14 (Ref. 3). Of these, the full power turbine trip (loss of external electrical load) without steam dump is typically the limiting AOO. This event also assumes loss of normal feedwater flow to the steam generators. The safety analysis demonstrates that the transient response for turbine trip occurring from full power without a direct reactor trip presents no hazard to the integrity of the RCS or the Main Steam System. One turbine trip analysis is performed assuming primary system pressure control via operation of the pressurizer relief valves and spray. This analysis demonstrates that the DNB design basis is met. Another analysis is performed assuming no primary system pressure control, but crediting MSSVsB 3.7.1 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.7.1 - 2 Revision 2 reactor trip on high pressurizer pressure and operation of the pressurizer safety valves. This analysis demonstrates that RCS integrity is maintained by showing that the maximum RCS pressure does not exceed 110% of the design pressure. All cases analyzed demonstrate that the MSSVs maintain Main Steam System integrity by limiting the maximum steam pressure to less than 110% of the steam generator design pressure. In addition to the decreased heat removal events, reactivity insertion events may also challenge the relieving capacity of the MSSVs. The uncontrolled rod cluster control assembly (RCCA) bank withdrawal at power event is characterized by an increase in core power and steam generation rate until reactor trip occurs when the Overpower T, Overtemperature T or Power Range Neutron Flux-High setpoint is reached. Steam flow to the turbine will not increase from its initial value for this event. The increased heat transfer to the secondary side causes an increase in steam pressure and may result in opening of the MSSVs prior to reactor trip, assuming no credit for operation of the atmospheric or condenser steam dump valves. The UFSAR Section 14.1.2 safety analysis of the RCCA bank withdrawal at power event for a range of initial core power levels demonstrates that the MSSVs are capable of preventing secondary side overpressurization for this AOO. The UFSAR safety analyses discussed above assume that all of the MSSVs for each steam generator are OPERABLE. If there are inoperable MSSV(s),
it is necessary to limit the primary system power during steady-state operation and AOOs to a value that does not result in exceeding the combined steam flow capacity of the remaining OPERABLE MSSVs. The required limitation on primary system power necessary to prevent secondary system overpressurization may be determined by system transient analyses or conservatively arrived at by a simple heat balance calculation. In some circumstances it is necessary to limit the primary side heat generation that can be achieved during an AOO by reducing the setpoint of the Power Range Neutron Flux-High reactor trip function. For example, if more than one MSSV on a single steam generator is inoperable, an uncontrolled RCCA bank withdrawal at power event occurring from a partial power level may result in an increase in reactor power that exceeds the combined steam flow capacity of the turbine and the remaining OPERABLE MSSVs. Thus, for multiple inoperable MSSVs on the same steam generator it is necessary to prevent this power increase by lowering the Power Range Neutron Flux-High setpoint to an appropriate value.
MSSVsB 3.7.1 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.7.1 - 3 Revision 2 The MSSVs are assumed to have two active and one passive failure modes. The active failure modes are spurious opening, and failure to reclose once opened. The passive failure mode is failure to open upon demand. The MSSVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCOThe accident analysis requires that five MSSVs per steam generator be OPERABLE to provide overpressure protection for design basis transients occurring at 102% RTP. The LCO requires that five MSSVs per steam generator be OPERABLE in compliance with Reference 2, and the DBA analysis. The OPERABILITY of the MSSVs is defined as the ability to open upon demand within the setpoint tolerances, to relieve steam generator overpressure, and reseat when pressure has been reduced. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the Inservice Testing Program. This LCO provides assurance that the MSSVs will perform their designed safety functions to mitigate the consequences of accidents that could result in a challenge to the RCPB, or Main Steam System integrity. APPLICABILITY In MODES 1, 2, and 3, five MSSVs per steam generator are required to be OPERABLE to prevent Main Steam System overpressurization. In MODES 4 and 5, there are no credible transients requiring the MSSVs. The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES. ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each MSSV. With one or more MSSVs inoperable, action must be taken so that the available MSSV relieving capacity meets Reference 2 requirements.
MSSVsB 3.7.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.7.1 - 4 Revision 2 Operation with less than all five MSSVs OPERABLE for each steam generator is permissible, if THERMAL POWER is limited to the relief capacity of the remaining MSSVs. This is accomplished by restricting THERMAL POWER so that the energy transfer to the most limiting steam generator is not greater than the available relief capacity in that steam generator.
A.1In the case of only a single inoperable MSSV on one or more steam generators, a reactor power reduction alone is sufficient to limit primary side heat generation such that overpressurization of the secondary side is precluded for any RCS heatup event. Furthermore, for this case there is sufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. Therefore, Required Action A.1 requires an appropriate reduction in reactor power within 4 hours. The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the attachment to Reference 6, with an appropriate allowance for calorimetric power uncertainty. B.1 and B.2In the case of multiple inoperable MSSVs on one or more steam generators, with a reactor power reduction alone there may be insufficient total steam flow capacity provided by the turbine and remaining OPERABLE MSSVs to preclude overpressurization in the event of an increased reactor power due to reactivity insertion, such as in the event of an uncontrolled RCCA bank withdrawal at power. The 4 hour Completion Time for Required Action B.1 is consistent with A.1. An additional 32 hours is allowed in Required ActionB.2 to reduce the setpoints. The Completion Time of 36 hours is based on a reasonable time to correct the MSSV inoperability, the time required to perform the power reduction, operating experience in resetting all channels of a protective function, and on the low probability of the occurrence of a transient that could result in steam generator overpressure during this period.
MSSVsB 3.7.1 BASESACTIONS  (continued) INDIAN POINT 2 B 3.7.1 - 5 Revision 2 The maximum THERMAL POWER corresponding to the heat removal capacity of the remaining OPERABLE MSSVs is determined via a conservative heat balance calculation as described in the attachment to Reference 6, with an appropriate allowance for Nuclear Instrumentation System trip channel uncertainties. Required Action B.2 is modified by a Note, indicating that the Power Range Neutron Flux-High reactor trip setpoint reduction is only required in MODE 1. In MODES 2 and 3 the reactor protection system trips specified in LCO 3.3.1, "Reactor Protection System Instrumentation," already establish a trip setpoint lower than that required by this LCO. The allowed Completion Times are reasonable based on operating experience to accomplish the Required Actions in an orderly manner without challenging unit systems. C.1 and C.2If the Required Actions are not completed within the associated Completion Time, or if one or more steam generators have  4 inoperable MSSVs, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE SR  3.7.1.1REQUIREMENTS This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift setpoint in accordance with the Inservice Testing Program. The ASME Code (Ref. 4), requires that safety and relief valve tests be performed in accordance with ANSI/ASME OM-1-1987 (Ref. 5). According to Reference 5, the following tests are required: a. Visual examination,
: b. Seat tightness determination,
: c. Setpoint pressure determination (lift setting), and
: d. Compliance with owner's seat tightness criteria.
MSSVsB 3.7.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.7.1 - 6 Revision 2 The ANSI/ASME Standard requires that all valves be tested every 5 years, and a minimum of 20% of the valves be tested every 24 months. The ASME Code specifies the activities and frequencies necessary to satisfy the requirements. Table 3.7.1-2 allows a  3% setpoint tolerance for OPERABILITY; however, the valves are reset to  1% during the Surveillance to allow for drift. The lift settings, according to Table 3.7.1-2, correspond to ambient conditions of the valve at nominal operating temperature and pressure. This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure. REFERENCES 1.UFSAR, Section 10.2.
2.ASME, Boiler and Pressure Vessel Code, Section III, Article NC-7000, Class 2 Components.
3.UFSAR, Section 14.
4.ASME code for Operation and Maintenance of Nuclear Power Plants.
5.ANSI/ASME OM-1-1987.
6.NRC Information Notice 94-60, "Potential Overpressurization of the Main Steam System," August 22, 1994.
MSIVs and MSCVs B 3.7.2 INDIAN POINT 2 B 3.7.2 - 1 Revision 1 B 3.7  PLANT SYSTEMS B 3.7.2 Main Steam Isolation Valves (MSIVs) and Main Steam Check Valves (MSCVs)
BASESBACKGROUND The Main Steam System conducts steam from each of the four steam generators within the containment building to the turbine stop and control valves. The four steam lines are interconnected near the turbine. Each steam line is equipped with an isolation valve identified as the Main Steam Isolation Valve (MSIV) and a nonreturn valve identified as the Main Steam
 
Check Valve (MSCV). The MSIVs isolate steam flow from the secondary side of the steam generators following a high energy line break (HELB). MSIV closure terminates flow from the unaffected (intact) steam generators. The MSIVs are swing disc type check valves that are aligned to prevent flow out of the steam generator. During normal operation, the free swinging discs in the MSIVs are held out of the main steam flow path by an air piston and the MSIVs close to prevent the release of steam from the SG when air is removed from the piston. The isolation valves are designed to and required to close in less than five seconds. The MSIV operators are supplied by instrument air and each MSIV is equipped with an air receiver to prevent spurious MSIV closure due to pressure transients in the instrument air system. Each MSIV is equipped with a bypass valve used to warm up the steam line during unit startup which equalizes pressure across the valve allowing it to be opened. The bypass valves are manually operated and are closed during normal plant operation. An MSIV closure signal is generated by the following signals:  High steam flow in any two out of the four steam lines coincident with low steam line pressure; or,  High steam flow in any two out of the four steam lines coincident with low Tavg; or, Two sets of the two-of-three high-high containment pressure signals; or,  Manual actuation using a separate switch in the control room for each MSIV.
MSIVs and MSCVs B 3.7.2 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.7.2 - 2 Revision 1 Note that a turbine trip is initiated whenever an MSIV is not fully open. The MSCVs are swing disc type check valves that are aligned to prevent reverse flow of steam into an SG if an individual SG pressure falls below steamline pressure. One MSIV and one MSCV are located in each main steam line outside, but close to, containment. The MSIVs are downstream from the  main steam safety valves (MSSVs) and auxiliary feedwater (AFW) pump turbine steam supply, to prevent MSSV and AFW isolation from the steam generators by MSIV closure. Closing the MSIVs isolates each steam generator from the others, and isolates the turbine, Steam Bypass System, and other auxiliary steam supplies from the steam generators. A description of the MSIVs and MSCVs is found in the UFSAR, Section 10.2 (Ref. 1). APPLICABLE
 
SAFETY ANALYSESThe design basis of the MSIVs and MSCVs is established by the containment analysis for the large steam line break (SLB) inside or outside containment, discussed in the UFSAR, Section 14.2 (Ref. 2). The combination of MSIVs and MSCVs precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g., the failure of one MSIV or one MSCV to close on demand). For a break upstream of an MSIV, either the MSIVs in the other three steam lines or the MSCV in the steam line with the faulted SG must close to prevent the blowdown of more than one SG.
For a break downstream of an MSCV, the MSCVs are not required to function. The limiting case for the containment analysis is the SLB inside containment, without a loss of offsite power following turbine trip. The limiting failure is the failure of the MSCV associated with the faulted SG or the failure of the MSIV associated with any other SG. With either of these failures, only one SG blows down. If the most reactive rod cluster control assembly is assumed stuck in the fully withdrawn position, there is an increased possibility that the core will become critical and return to power. The core is ultimately shut down by the boric acid injection delivered by the Emergency Core Cooling System.
MSIVs and MSCVs B 3.7.2 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.7.2 - 3 Revision 1 The accident analysis compares several different SLB events against different acceptance criteria. The large SLB outside containment upstream of the MSIV is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The large SLB inside containment at hot zero power is the limiting case for a post trip return to power. The analysis includes scenarios with offsite power available, and with a loss of offsite power following turbine trip. With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System cooldown. With a loss of offsite power, the response of mitigating systems is delayed. Significant single failures considered include failure of an MSIV or MSCV to close. The MSIVs and MSCVs serve a safety function by closing and remain open during power operation. These valves operate under the following situations: a. An SLB inside containment. In order to maximize the mass and energy release into containment, the analysis assumes that the MSCV in the affected steam generator remains open. For this accident scenario, steam is discharged into containment from all steam generators until the remaining MSIVs close. After MSIV closure, steam is discharged into containment only from the affected steam generator and from the residual steam in the main steam header downstream of the closed MSIVs in the unaffected loops. Closure of the MSCV on the faulted SG or closure of the MSIV on the other three SGs isolates the break from the unaffected steam generators. b. An SLB outside of containment and upstream from the MSIVs. This case is not a containment pressurization concern. The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive reactivity addition. Closure of the MSCV on the faulted SG or closure of the MSIV on the other three SGs isolates the break and limits the blowdown to a single steam generator. c. An SLB downstream of the MSIVs. This case will be isolated by the closure of the MSIVs. d. A steam generator tube rupture. In this case, closure of the MSIVs or MSCVs isolates the ruptured steam generator from the intact steam generators to minimize radiological releases.
MSIVs and MSCVs B 3.7.2 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.7.2 - 4 Revision 1 The MSIVs and MSCVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCOThis LCO requires that four MSIVs and four MSCVs be OPERABLE. The MSIVs are considered OPERABLE when the isolation times are within limits, and they close on an isolation actuation signal. The MSCVs are considered OPERABLE when Inservice Test Program requirements are met in accordance with SR 3.7.2.3. This LCO provides assurance that the MSIVs and MSCVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures. At Indian Point 2, radiological consequence analyses demonstrate compliance with 10 CFR 50.67, Accident Source Term (References 3 and 4). OPERABILITY of the MSIVs and MSCVs ensures that exposures following a main steam line break are below the required limits (Ref. 4). APPLICABILITY The MSIVs and MSCVs must be OPERABLE in MODE 1, and in MODES 2 and 3 except when MSIVs are closed. These are the conditions when there is significant mass and energy in the RCS and steam generators. When the MSIVs are closed, they are already performing the safety function. In MODE 4, the MSIVs are normally closed, the steam generator energy is low and the potential for and consequences of an SLB are significantly
 
reduced.In MODE 5 or 6, the steam generators do not contain much energy because their temperature is below the boiling point of water; therefore, the MSIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES. ACTIONS A.1With one or more MSCVs inoperable, action must be taken to restore OPERABLE status within 72 hours. In this condition, the MSIVs in the other three steam lines must close to prevent the blowdown of more than one SG following an SLB upstream of an MSIV. Having more than one MSCV inoperable will not increase the consequences of an SLB upstream of an MSIV because only the MSCV associated with the faulted SG needs to MSIVs and MSCVs B 3.7.2 BASESACTIONS  (continued) INDIAN POINT 2 B 3.7.2 - 5 Revision 1 function to mitigate the failure of an MSIV associated with any of the other SGs. Additionally, an inoperable MSCV does not affect the consequences of an SLB downstream of the MSIV. The 72 hour Completion Time is acceptable because of the following: all MSIVs are Operable, there is a low probability of the failure of an MSIV during the 72 hour period that one or more MSCVs are inoperable; and, there is a low probability of an accident that would require a closure of the MSCVs or MSIVs during this period. B.1 and B.2If the MSCV cannot be restored to OPERABLE status within 72 hours, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours and all MSIVs must be closed within 14 hours. The Completion Times are reasonable, based on operating experience, to reach MODE 2 and to close the MSIVs in an orderly manner and without challenging unit systems. C.1With one MSIV inoperable in MODE 1, action must be taken to restore OPERABLE status within 72 hours. Some repairs to the MSIV can be made with the unit hot. The 72 hour Completion Time for restoration of an inoperable MSIV is acceptable because the plant remains within the SGTR and SLB accident analysis assumptions (including assumptions regarding single failure of an MSIV) except for an SLB that occurs downstream of the MSIVs. For an SLB that occurs downstream of the MSIVs, IP2 remains within the accident analysis assumptions except for the ability to tolerate the random failure of a second MSIV during the 72 hour allowable out of service time for the one MSIV permitted to be inoperable. D.1If the MSIV cannot be restored to OPERABLE status within 72 hours, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours and Condition E would be entered. The Completion Times are reasonable, based on operating experience, to reach MODE 2 and to close the MSIVs in an orderly manner and without challenging unit systems.
MSIVs and MSCVs B 3.7.2 BASESACTIONS  (continued) INDIAN POINT 2 B 3.7.2 - 6 Revision 1 E.1 and E.2Condition E is modified by a Note indicating that separate Condition entry is allowed for each MSIV. Since the MSIVs are required to be OPERABLE in MODES 2 and 3, the inoperable MSIVs may either be restored to OPERABLE status or closed.
When closed, the MSIVs are already in the position required by the assumptions in the safety analysis. The 8 hour Completion Time is reasonable, based on operating experience, to close the MSIVs after reaching MODE 2. For inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, the inoperable MSIVs must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of MSIV status indications available in the control room, and other administrative controls, to ensure that these valves are in the closed position. F.1 and F.2If one MSIV is inoperable when one or more MSCVs are inoperable, then more than one SG may blowdown following an SLB upstream of an MSIV and the plant is outside of the analysis assumptions. The plant remains within the analysis assumptions for an SLB downstream of an MSIV although the ability to tolerate the failure if a second MSIV is lost. In this condition, all MSCVs must be restored to OPERABLE status or all MSIVs must be restored to OPERABLE status within 1 hour. The 1 hour Completion Time is acceptable because of the low probability of an accident that would require a closure of the MSCVs or MSIVs during this time period. G.1 and G.2If the MSIVs or MSCVs cannot be restored to OPERABLE status or are not closed within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed at least in MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems.
MSIVs and MSCVs B 3.7.2 BASESINDIAN POINT 2 B 3.7.2 - 7 Revision 1 SURVEILLANCE SR  3.7.2.1REQUIREMENTS This SR verifies that MSIV closure time is  5.0 seconds. The MSIV isolation time is assumed in the accident and containment analyses. This Surveillance is normally performed upon returning the unit to operation following a refueling outage. The MSIVs should not be tested at power because even a part stroke causes a turbine trip. As the MSIVs are not tested at power, they are exempt from the ASME Code (Ref. 5), requirements during operation in MODE 1 or 2. The Frequency is in accordance with the Inservice Testing Program.
This test is conducted in MODE 3 with the unit at operating temperature and pressure. This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows a delay of testing until MODE 3, to establish conditions consistent with those under which the acceptance criterion was generated. SR 3.7.2.2This SR verifies that each MSIV can close on an actual or simulated actuation signal. This Surveillance is normally performed upon returning the plant to operation following a refueling outage. The Frequency of MSIV testing is every 24 months. The 24 month Frequency for testing is based on the refueling cycle. Operating experience has shown that these components usually pass the Surveillance when performed at this Frequency. Therefore, this Frequency is acceptable from a reliability standpoint. SR 3.7.2.3Each MSCV must be inspected to ensure that it closes properly. This ensures that the safety analysis assumptions are met. The Frequency of this SR is based on Inservice Testing Program requirements and corresponds to the expected refueling cycle.
MSIVs and MSCVs B 3.7.2 BASESINDIAN POINT 2 B 3.7.2 - 8 Revision 1 REFERENCES 1.UFSAR, Section 10.2.
2.UFSAR, Section 14.2.
3.10 CFR 50.67.
4.Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 211 to Facility Operating License No.
DPR-26, July 27, 2000.
5.ASME code for Operation and Maintenance of Nuclear Power Plants.
Main Feedwater Isolation B 3.7.3 INDIAN POINT 2 B 3.7.3 - 1 Revision 5 B 3.7  PLANT SYSTEMS B 3.7.3 Main Feedwater Isolation BASESBACKGROUND Isolation of the main feedwater system is necessary to mitigate various accident and transient conditions (main steamline breaks, steam generator tube ruptures, and excessive heat removal due to feedwater system malfunction). Main feedwater must be automatically isolated to prevent excessive Reactor Coolant System (RCS) cooldown, containment overpressure, and steam generator overfill. Main feedwater isolation is initiated by either an ESFAS safety injection (SI) signal or high steam generator water level. Main feedwater isolation to all four steam generators is provided by either of the following: a. Closure of all four Main Feedwater Regulating Valves (MFRVs) and closure of all four Low Flow Main Feedwater Bypass Valves (FBVs); or, b. Closure of both Main Boiler Feedwater Pump (MBFP) discharge valves which initiates closure of all eight  Feedwater Isolation Valves (MFIVs), and the trip of both Main Boiler Feedwater Pumps (MBFPs). Either of these combinations is capable of achieving main feedwater isolation to all four steam generators within the time limits assumed in the accident analysis. Note that closure of the four Low Flow FIVs is not required to meet accident analysis assumptions and these valves have not been qualified for this service. Main feedwater isolation is initiated by a safety injection ESFAS signal or a high steam generator water level ESFAS signal either of which provides a direct signal that closes all four MFRVs within 8 seconds and all four Low Flow FBVs within 15 seconds. If all eight of these valves close, main feedwater isolation to all four SGs is completed within time limits that satisfy accident analysis assumptions (Ref. 2). To establish required redundancy for the main feedwater isolation safety function, the safety injection ESFAS signal or high steam generator water level ESFAS signal also provides a direct signal that closes the two MBFP discharge valves within 60 seconds. Although closure of the MBFP discharge valves provides complete isolation of main feedwater to all four SGs, closure of the MBFP discharge valves does not satisfy accident analysis assumptions. Therefore, when the MBFP discharge valves close in response to an ESFAS signal, the main boiler feed pump will automatically trip when the associated MBFP discharge valve moves off the open seat.
Main Feedwater Isolation B 3.7.3 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.7.3 - 2 Revision 5 MBFP discharge valves closure and the MBFP trip are not sufficient to satisfy accident analysis assumptions for peak containment pressure when there is a MRFV failure to close. The barrier does not isolate the SGs and containment from the significant amount of feedwater mass and energy in the three high pressure feedwater heaters and the feedwater piping located between the MBFP discharge valves and the SGs. Therefore, when both MBFP discharge valves move off the open seat, the BFPD-X relay, powered from a control transformer off MOV BFD-90, actuates to generate a signal  that initiates closure of the four Main Feedwater Isolation Valves (MFIVs) and the four Low Flow FIVs. The eight FIVs are motor operated valves that are located near to and isolate the four MFRVs and the four Low Flow FBVs. A two-second electronic delay is assumed in the ESFAS signal that initiates closure of the MBFP discharge valve. The MBFP trip then occurs within 5 seconds and closure of the four MFIVs occurs within an additional 120 seconds. Closure of the four MFIVs conservatively limits peak containment pressure following a SLB with an assumed failure of a MFRV with the Low Flow FBVs initially open or excess feedwater event. The Low Flow FIVs are not credited with closing for a failure of a FBV to close. The eight FIVs are the following:  four motor operated MFRV isolation valves (BFD-5, BFD-5-1, BFD-5-2 and BFD-5-3), and four motor operated Low Flow feedwater isolation valves (BFD-90, BFD-90-1, BFD-90-2 and BFD-90-3). The Low Flow FIVs are not credited for operation to limit feedwater mass addition since they are not qualified. The Low Flow FBVs  and FIVs are routinely closed during power ascension; however, it is acceptable to operate the plant at full thermal power (3216 MWth) with the Low Flow FBVs and Low Flow FIVs fully open since they are assumed open at the initiation of the MSLB. In addition to the MFRVs, Low Flow FBVs and the MSIVs, the main feedwater line and auxiliary feedwater line to each SG includes a check valve that is located outside containment. These check valves provide a pressure boundary that allows either the main feedwater system or auxiliary feedwater system to supply an SG and prevent blowdown of a SG if main and auxiliary feedwater pressure is lost. The main feedwater isolation safety function and components are described in References 1 and 2. APPLICABLE SAFETY ANALYSES The design basis of the main feedwater isolation function is established by the analyses for the large SLB. Main feedwater isolation may also be relied on to terminate an SLB for core response analysis and excess feedwater event upon the receipt of a steam generator water level - high high signal or a feedwater isolation signal on high steam generator level. APPLICABLE SAFETY ANALYSES (continued)
Main Feedwater Isolation B 3.7.3 BASESINDIAN POINT 2 B 3.7.3 - 3 Revision 5 Failure of main feedwater isolation following an SLB can result in additional mass and energy being delivered to the steam generators, contributing to cooldown. This failure also results in additional mass and energy releases following an SLB. Main feedwater isolation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCOThis LCO requires redundant main feedwater isolation within the time limits assumed in the accident analysis in response to a safety injection ESFAS signal or a high steam generator water level ESFAS signal. Main feedwater flow isolation safety function to all four steam generators within the time limits assumed in the accident analysis is provided by the following: Closure of all four MFRVs (FCV-417, FCV-427, FCV-437, and FCV-447) in  8 seconds; and  Closure of all four Low Flow FBVs (FCV-417L, FCV-427L, FCV-437L, and FCV-447L) in  15 seconds. Redundant feedwater flow isolation safety function to all four steam generators within the time limits assumed in the accident analysis is provided by the following: Closure of both MBFP discharge valves (BFD-2-21 and BFD-2-22) in  60 seconds;  Closure of four MFIVs (BFD-5, BFD-5-1, BFD-5-2, and BFD-5-3) in <
120 seconds (this is valve closure time and does not include time allowed for signals) and Tripping of both MBFPs (BFP 21 and BFP 22) in  5 seconds (in addition, a 2 second electronic delay is also assumed). The main feedwater isolation function is OPERABLE when ESFAS actuation signals will cause all required valve closures and pump trips to occur within specified time limits. Inoperability of either of the MBFP discharge valves (BFD-2-21 and BFD-2-22) could cause the inoperability of the MBFP trips.
Main Feedwater Isolation B 3.7.3 BASESLCO  (continued) INDIAN POINT 2 B 3.7.3 - 4 Revision 5 Failure to meet the LCO requirements can result in additional mass and energy being released to containment following an SLB inside containment. A feedwater isolation signal on high steam generator level is relied on to terminate an excess feedwater flow event; therefore, failure to meet the LCO may also result in the introduction of water into the main steam lines. APPLICABILITY The main feedwater isolation function must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and steam generators. This ensures that, in the event of an HELB, a single failure cannot result in the blowdown of more than one steam generator. In MODES 1, 2, and 3, the main feedwater isolation function is required to be OPERABLE to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment. When the valves are closed and de-activated or isolated by a closed manual valve, they are already performing their safety function. In MODES 4, 5, and 6, steam generator energy is low. Therefore, the main feedwater flowpaths are normally closed since MFW is not required. ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each valve. This Note recognizes that the main feedwater isolation function consists of redundant barriers. Multiple inoperabilities of one of the two barriers results in a loss of redundancy but not a loss of safety function. Therefore, multiple Condition entry for either of the two barriers is appropriate. Condition F and Required Action F.1 govern a concurrent inoperability in both barriers. A.1, A.2, B.1 and B.2With one or more MFRVs and/or one or more Low Flow FBVs in one or more flow paths inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate affected valves within 72 hours.
When these valves are closed or isolated, they are performing their required safety function. The 72 hour Completion Time takes into account the redundancy afforded by MBFP discharge valves, MBFP trips and the MFIVs. Additionally, there is a low probability of an event occurring during this time period that would require isolation of the MFW flow paths. The 72 hour Completion Time is reasonable, based on operating experience.
Main Feedwater Isolation B 3.7.3 BASESACTIONS (continued) INDIAN POINT 2 B 3.7.3 - 5 Revision 5 Inoperable MFRVs and/or Low Flow FBVs that are closed or isolated must be verified closed or isolated on a periodic basis. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated. C.1 and C.2With one or both MBFP discharge valves inoperable, action must be taken to restore the affected valves to OPERABLE status, or to close or isolate inoperable affected valves within 72 hours. When these valves are closed or isolated, they are performing their required safety function. The actuation of the BFPD-X relay to shut the MFIVs is considered a support function.
Unavailability of the relay or any MFIV would result in entry into this Condition. The 72 hour Completion Time takes into account the redundancy afforded by the remaining OPERABLE MFRVs and Low Flow FBVs and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths. Inoperable MBFP discharge valves that are closed or isolated must be verified on a periodic basis that they are closed or isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls, to ensure that these valves are closed or isolated. D.1 and D.2With one or both MBFP trips inoperable, the main feedwater isolation safety function is maintained by the MFRVs and Low Flow FBVs; however, the required redundancy is lost. Therefore, the MBFP trip must be restored to OPERABLE within 72 hours or the MBFP must be tripped. The safety function is satisfied when the affected MBFP is not in operation. The 72 hour Completion Time takes into account the redundancy afforded by the OPERABLE MFRVs and Low Flow FBVs and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths.
Main Feedwater Isolation B 3.7.3 BASESACTIONS (continued) INDIAN POINT 2 B 3.7.3 - 6 Revision 5 E.1With one or more MFRVs or Low Flow FBVs and one or more MBFP trips or discharge valves inoperable, there may be no redundant system to perform the required safety function in the flow path to one or more SGs. Under these conditions, valves in the flow path to each affected SG must be restored to OPERABLE status, or the flow path to each affected SG must be isolated within 8 hours. This action returns the system to the condition where at least one of the redundant main feedwater isolation barriers in each flow path is performing the required safety function. The 8 hour Completion Time is reasonable, based on operating experience, to complete the actions required to close the MFIV or MFRV, or otherwise isolate the affected flow path.
F.1 and F.2If the main feedwater isolation safety function and/or required redundancy cannot be restored to OPERABLE status, or affected valves closed, or affected flow paths isolated within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE SR  3.7.3.1 and SR  3.7.3.2REQUIREMENTS These SRs verify that each of the valves in both of the main feedwater isolation barriers close within the time limits assumed in the accident analysis. SR 3.7.3.1 requires verification that MFRVs and Lo Flow FBVs close within the following limits: MFRVs (FCV-417, FCV-427, FCV-437, and FCV-447) close in  8 seconds; and  Low Flow FBVs (FCV-417L, FCV-427L, FCV-437L, and FCV-447L) close in  15 seconds.
Main Feedwater Isolation B 3.7.3 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.7.3 - 7 Revision 5 SR 3.7.3.2 requires verification that MBFP discharge valves and MBFP trips within the following limits: MBFP discharge valves (BFD-2-21 and BFD-2-22) close in  60 seconds; and MBFPs (BFP 21 and BFP 22) trip in  5 seconds. These Surveillances are normally performed upon returning the unit to operation following a refueling outage. These valves should not be tested at power since even a part stroke exercise increases the risk of a valve closure with the unit generating power. This is consistent with the ASME Code (Ref. 3), quarterly stroke requirements during operation in MODES 1 and 2.
Surveillance testing of the MFIVs (BFD-5, BFD-5-1, BFD-5-2, and BFD-5-3) is administratively controlled. The Frequency for these SRs is in accordance with the Inservice Testing Program.SR 3.7.3.3This SR verifies that each MFRV, Low Flow FBV, and MBFP discharge valve will close and that each MBFP will trip on an actual or simulated actuation signal. This Surveillance is normally performed upon returning the plant to operation following a refueling outage. The Frequency for this SR is every 24 months. The 24 month Frequency for testing is based on the refueling cycle. Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month Frequency. Therefore, this Frequency is acceptable from a reliability standpoint. REFERENCES 1.UFSAR, Section 10.2.
2.UFSAR, Section 14.2.
: 3. ASME code for Operation and Maintenance of Nuclear Power Plants.
ADVsB 3.7.4 INDIAN POINT 2 B 3.7.4 - 1 Revision 1 B 3.7  PLANT SYSTEMS B 3.7.4 Atmospheric Dump Valves (ADVs) BASESBACKGROUND The ADVs (SG Power Operated Atmospheric Relief Valves) provide a method for cooling the unit to residual heat removal (RHR) entry conditions should the preferred heat sink via the Steam Bypass System to the condenser not be available, as discussed in the UFSAR, Section 10.2 (Ref. 1). This is done in conjunction with the Auxiliary Feedwater System providing cooling water from the condensate storage tank (CST). The ADVs may also be needed during a normal cooldown when steam pressure drops too low for maintenance of a vacuum in the condenser to permit use of the Steam Dump System. One ADV line for each of the four steam generators is provided. Each ADV line consists of one ADV and an associated manually operated block valve. The ADVs are provided with upstream block valves to permit maintenance at power, and to provide an alternate means of isolation. The ADVs are equipped with pneumatic controllers to permit control of the cooldown rate. The ADVs are provided with a pressurized gas supply of bottled nitrogen that, on a loss of pressure in the normal instrument air supply, supplies nitrogen to operate the ADVs. The nitrogen supply is sized to provide sufficient pressurized gas to operate the ADVs for the time required for Reactor Coolant System cooldown to RHR entry conditions. A description of the ADVs is found in Reference 1. APPLICABLE SAFETY ANALYSESThe design basis of the ADVs is established by the capability to cool the unit to RHR entry conditions. The total relief capacity of the four ADVs is approximately 10% of the rated steam flow. This capacity is adequate to cool the unit to RHR entry conditions with only one steam generator and one ADV, utilizing the cooling water supply available in the CST. The CST minimum required volume is sufficient to complete this cooldown or to maintain the plant for 24 hours in MODE 3 following a trip from full power.
When the CST supply is exhausted, city water will be used. In the accident analysis presented in Reference 2, the ADVs are assumed to be used by the operator to cool down the unit to RHR entry conditions for accidents accompanied by a loss of offsite power. Prior to operator actions ADVsB 3.7.4 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.7.4 - 2 Revision 1 to cool down the unit, the ADVs and main steam safety valves (MSSVs) are assumed to operate automatically to relieve steam and maintain the steam generator pressure below the design value. For the recovery from a steam generator tube rupture (SGTR) event, the operator is also required to perform a limited cooldown to establish adequate subcooling as a necessary step to terminate the primary to secondary break flow into the ruptured steam generator. The time required to terminate the primary to secondary break flow for an SGTR is more critical than the time required to cool down to RHR conditions for this event and also for other accidents. Thus, the SGTR is the limiting event for the ADVs. The IP2 analysis of the radiological consequences of a SGTR (Reference 2 ) models no operator actions that would help to terminate the primary to secondary leakage such as controlled depressurization of the RCS to the ruptured steam generator pressure or subsequent termination of safety injection flow to stop primary to secondary leakage. If the operators take no action to respond to the event, the break flow will tend to an equilibrium RCS pressure where incoming safety injection flow is balanced by outgoing break flow. In the accident analysis, this equilibrium break flow is assumed to persist from plant trip until 30 minutes after the accident initiation. The analysis does not require that the operators demonstrate the ability to terminate break flow within 30 minutes from the start of the event. It is recognized that the operators may not be able to terminate break flow within 30 minutes for all postulated SGTR events. The purpose of the calculation is to provide conservatively high mass-transfer rates for use in the radiological consequences analysis. This is achieved by assuming a constant break flow at the equilibrium flow rate for a relatively long time period (i.e., 30 minutes). Because this analysis assumed a loss of offsite power, plant cool-down occurs using the ADVs.Using the conservative assumptions described above, the radiological consequences were determined assuming both a pre-accident iodine spike (RCS at 60 times the assumed maximum coolant equilibrium concentration limit of 1.0 &#xb5;Ci/gpm of DOSE EQUIVALENT I-131) and an accident-initiated iodine spike (RCS at the assumed maximum coolant equilibrium concentration limit of 1.0 &#xb5;Ci/gpm of DOSE EQUIVALENT I-131).The SGTR doses (Ref. 2) are within the acceptance criteria identified in Reference 3.
ADVsB 3.7.4 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.7.4 - 3 Revision 1 The ADVs are equipped with block valves in the event an ADV spuriously opens or fails to close during use. The ADVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCOFour ADV lines are required to be OPERABLE. The block valves must be OPERABLE to isolate a failed open ADV line.The analysis of the radiological consequences of a SGTR (Reference 2) with concurrent loss of offsite power rendering the steam dumps unavailable assumed plant cooldown using all available ADVs.Failure to meet the LCO can result in increasing the amount of time required to equalize pressure between the RCS and the ruptured SG following a SGTR with concurrent loss of offsite power rendering the steam dumps unavailable. Additionally, failure to meet the LCO can result in the inability to cool the unit to RHR entry conditions following an event in which the condenser is unavailable for use with the Steam Bypass System. An ADV is considered OPERABLE when  it is capable of providing controlled relief of the main steam flow and capable of fully opening and closing on demand. A closed block valve does not render it or its ADV line inoperable if operator action time to open the block valve is supported in the accident analysis.APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when a steam generator is being relied upon for heat removal in accordance with LCO 3.4.6, "RCS Loops - MODE 4," the ADVs are required to be OPERABLE. In MODE 5 or 6, an SGTR is not a credible event.
ADVsB 3.7.4 BASESINDIAN POINT 2 B 3.7.4 - 4 Revision 1 ACTIONS A.1With one required ADV line inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time allows for the redundant capability afforded by the remaining OPERABLE ADV lines and  a nonsafety grade backup in the Steam Bypass System, and MSSVs.
Additionally, the substantial margin between the SGTR analysis results and the Reference 3 dose acceptance limits supports a conclusion that the limits would be met if an inoperable ADV increases the time required to equalize pressure between the RCS and the ruptured SG following a SGTR. B.1With two or more required ADV lines inoperable, action must be taken to restore all but one ADV line to OPERABLE status. Since the block valve can be closed to isolate an ADV, some repairs may be possible with the unit at power. The 24 hour Completion Time is reasonable to repair inoperable ADV lines, based on the availability of the Steam Bypass System and MSSVs, and the low probability of an event occurring during this period that would require the ADV lines. C.1 and C.2If the ADV lines cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4, without reliance upon steam generator for heat removal, within 24 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE SR  3.7.4.1 REQUIREMENTSTo perform a controlled cooldown of the RCS, the ADVs must be able to be opened either remotely or locally and throttled through their full range. This SR ensures that the ADVs are tested through a full control cycle at least once per fuel cycle. Performance of inservice testing or use of an ADV during a unit cooldown may satisfy this requirement. Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month Frequency. The Frequency is acceptable from a reliability standpoint.
ADVsB 3.7.4 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.7.4 - 5 Revision 1 SR  3.7.4.2The function of the block valve is to isolate a failed open ADV. Cycling the block valve both closed and open demonstrates its capability to perform this function. Performance of inservice testing or use of the block valve during unit cooldown may satisfy this requirement. Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month Frequency. The Frequency is acceptable from a reliability standpoint.REFERENCES 1. UFSAR, Section 10.2. 2. WCAP-16157, "Indian Point Unit 2 Stretch Power Uprating Licensing Report," January 2004. 3. NUREG-0800, Standard Review Plan, US Nuclear Regulatory Commission, Section 15.0.1, "Radiological Consequences Analysis Using Alternative Source Terms," Rev. 0, July 2000.
AFW System B 3.7.5 INDIAN POINT 2 B 3.7.5 - 1 Revision 5 B 3.7  PLANT SYSTEMS B 3.7.5 Auxiliary Feedwater (AFW) System BASESBACKGROUND The AFW System automatically supplies feedwater to the steam generators to remove decay heat from the Reactor Coolant System upon the loss of normal feedwater supply. The AFW pumps take suction from the condensate storage tank (CST) (LCO 3.7.6) and pump to the steam generator secondary side via connections to the main feedwater (MFW) piping outside containment. The steam generators function as a heat sink for core decay heat. The heat load is dissipated by releasing steam to the atmosphere from the steam generators via the main steam safety valves (MSSVs) (LCO 3.7.1) or atmospheric dump valves (LCO 3.7.4). If the main condenser is available, steam may be released via the steam bypass valves and recirculated to the CST. The AFW System consists of two motor driven AFW pumps and one steam turbine driven pump configured into three trains. Each motor driven pump provides 100% of AFW flow capacity (near best estimate analysis), and the turbine driven pump provides 200% of the required capacity to the steam generators, as assumed in the accident analysis. The pumps are equipped with independent recirculation lines to prevent pump operation against a closed system. Each motor driven AFW pump is powered from an independent power supply and feeds two steam generators. The steam turbine driven AFW pump receives steam from two main steam lines upstream of the main steam isolation valves. Each of the steam feed lines will supply 100% of the requirements of the turbine driven AFW pump. The AFW System is capable of supplying feedwater to the steam generators during normal unit startup, shutdown, and hot standby conditions. The turbine driven AFW pump supplies a common header capable of feeding all steam generators. Any of the three AFW pumps is sufficient to remove decay heat and cool the unit to residual heat removal (RHR) entry conditions.
Thus, the requirement for diversity in motive power sources for the AFW System is met. The AFW System is designed to supply sufficient water to the steam generator(s) to remove decay heat with steam generator pressure at the setpoint of the MSSVs. Subsequently, the AFW System supplies sufficient water to cool the unit to RHR entry conditions, with steam released through the ADVs.
AFW System B 3.7.5 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.7.5 - 2 Revision 5 The auxiliary feedwater pumps are automatically started on receipt of any of the following signals: Steam-driven auxiliary feedwater pump: a. Low-low water level in any two of the four steam generators. b. Loss of offsite power concurrent with a unit trip and with no safety injection signal present. Motor-driven auxiliary feedwater pumps:
: a. Low-low water level in any steam generator.
: b. Automatic trip of main feedwater pumps as indicated by loss of main feed pump control oil pressure if manual control switch was last operated to the "start" position. Trip of either (or both) main feedwater pumps automatically sends a demand start signal to both motor-driven auxiliary feedwater pumps. c. Safety injection signal. d. Loss of outside power concurrent with a unit trip.
The steam-driven and the motor-driven auxiliary feedwater pumps start automatically on an AMSAC signal (ATWAS Mitigation System Activation Circuitry) and can be started manually from the control room and locally at the pumps. The steam driven AFW pump must be throttled manually in order to bring the unit up to speed after a start signal. In addition, the steam driven pump discharge flow control valves must be manually opened as necessary to provide adequate auxiliary feedwater flow. The AFW System is discussed in the UFSAR, Section 10.2 (Ref. 1). APPLICABLE SAFETY ANALYSESThe AFW System mitigates the consequences of any event with loss of normal feedwater. The design basis of the AFW System is to supply water to the steam generator to remove decay heat and other residual heat by delivering at least the minimum required flow rate (380 gpm per pump) to the steam AFW System B 3.7.5 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.7.5 - 3 Revision 5 generators at pressures corresponding to the lowest steam generator safety valve set pressure plus 3%. In addition, the AFW System must supply enough makeup water to replace steam generator secondary inventory lost as the unit cools to MODE 4 conditions. Sufficient AFW flow must also be available to account for flow losses such as pump recirculation and line breaks. The limiting transient for the AFW System is loss of main feedwater. For this event, the licensing analysis credits 380 gpm delivered automatically to two steam generators and the minimum of an additional 380 gpm delivered to the other two steam generators in 10 minutes. A near best estimate analysis has also been performed, and this demonstrated that acceptance criteria are satisfied without assuming additional AFW flow in 10 minutes. The ESFAS automatically actuates the AFW turbine driven pump and the associated power operated valves and controls are manually operated when required to ensure an adequate feedwater supply to the steam generators during loss of power. The AFW System satisfies the requirements of Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCO        This LCO provides assurance that the AFW System will perform its design safety function to mitigate the consequences of events that could result in overpressurization of the reactor coolant pressure boundary. Three independent AFW pumps in three diverse trains are required to be OPERABLE to ensure the availability of decay heat removal capability for all events accompanied by a loss of offsite power and a single failure. This is accomplished by powering two of the pumps from independent emergency buses. The third AFW pump is powered by a steam driven turbine supplied with steam from a source that is not isolated by closure of the MSIVs. The AFW System is configured into three trains. The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow to the steam generators are OPERABLE. This requires that the two motor driven AFW pumps be OPERABLE in two diverse paths, each supplying AFW to separate steam generators. The turbine driven AFW pump is required to be OPERABLE with redundant steam supplies from each of two main steam lines upstream of the MSIVs, and shall be capable of supplying AFW to any of the steam generators. The piping, valves, instrumentation, and controls in the required flow paths also are AFW System B 3.7.5 BASESLCO  (continued) INDIAN POINT 2 B 3.7.5 - 4 Revision 5  required to be OPERABLE
.Since instrument air cannot be credited for an accident analysis, loss of the nitrogen supply will not allow control room operation. The two motor driven AFW pumps are considered inoperable until local operator action is taken to manually control the pumps. The turbine driven pump can perform its function.The LCO is modified by a Note indicating that one AFW train with a motor driven pump capable of supporting the steam generators being relied upon for heat removal is required to be OPERABLE in MODE 4. This is because of the reduced heat removal requirements and short period of time in MODE 4 during which the AFW is required and the insufficient steam available in MODE 4 to power the turbine driven AFW pump. APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in the event that it is called upon to function when the MFW is lost. In addition, the AFW System is required to supply enough makeup water to replace the steam generator secondary inventory needed to achieve and maintain MODE 4 conditions. In MODE 4 the AFW System may be used for heat removal via the steam generators. In MODE 5 or 6, the steam generators are not normally used for heat removal, and the AFW System is not required. ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable AFW train.
There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an AFW train inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.
A.1If one of the two steam supplies to the turbine driven AFW train is inoperable, or if a turbine driven pump is determined to be inoperable while in MODE 3 immediately following refueling, action must be taken to restore the inoperable equipment to an OPERABLE status within 7 days. The 7 day Completion Time is reasonable, based on the following reasons:
AFW System B 3.7.5 BASESACTIONS  (continued) INDIAN POINT 2 B 3.7.5 - 5 Revision 5 a. For the inoperability of a steam supply to the turbine driven AFW pump, the 7 day Completion Time is reasonable since there is a redundant steam supply line for the turbine driven pump. b. For the inoperability of a turbine driven AFW pump while in MODE 3 immediately subsequent to a refueling, the 7 day Completion Time is reasonable due to the minimal decay heat levels in this situation. c. For both the inoperability of a steam supply line to the turbine driven pump and an inoperable turbine driven AFW pump while in MODE 3 immediately following a refueling outage, the 7 day Completion Time is reasonable due to the availability of redundant OPERABLE motor driven AFW pumps, and due to the low probability of an event requiring the use of the turbine driven AFW pump. The second Completion Time for Required Action A.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO. The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 7 days and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must
 
be met. Condition A is modified by a Note which limits the applicability of the Condition to when the unit has not entered MODE 2 following a refueling.
Condition A allows one AFW train to be inoperable for 7 days versus the 72 hour Completion Time in Condition B. This longer Completion Time is based on the reduced decay heat following refueling and prior to the reactor being critical.
B.1With one of the required AFW trains (pump or flow path) inoperable in MODE 1, 2, or 3 for reasons other than Condition A, action must be taken to restore OPERABLE status within 72 hours. This Condition includes the loss of two steam supply lines to the turbine driven AFW pump. The 72 hour Completion Time is reasonable, based on redundant capabilities afforded by the AFW System, time needed for repairs, and the low probability of a DBA occurring during this time period.
AFW System B 3.7.5 BASESACTIONS  (continued) INDIAN POINT 2 B 3.7.5 - 6 Revision 5 The second Completion Time for Required Action B.1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO. The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 72 hours and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met. C.1 and C.2When Required Action A.1 or B.1 cannot be completed within the required Completion Time, or if two AFW trains are inoperable in MODE 1, 2, or 3, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within 18 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4 with two AFW trains inoperable, operation is allowed to continue because only one motor driven pump AFW train is required in accordance with the Note that modifies the LCO. Although not required, the unit may continue to cool down and initiate RHR. D.1If all three AFW trains are inoperable in MODE 1, 2, or 3, the unit is in a seriously degraded condition with no safety related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety related equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status. Required Action D.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status. In this case, LCO 3.0.3 is not applicable because it could force the unit into a less safe condition.
AFW System B 3.7.5 BASESACTIONS  (continued) INDIAN POINT 2 B 3.7.5 - 7 Revision 5 E.1In MODE 4, either the reactor coolant pumps or the RHR loops can be used to provide forced circulation. This is addressed in LCO 3.4.6, "RCS Loops -
MODE 4."  With one required AFW train inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status. The immediate Completion Time is consistent with LCO 3.4.6. SURVEILLANCE SR  3.7.5.1REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW System water and steam supply flow paths provides assurance that the proper flow paths will exist for AFW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. The SR is modified by a Note that states one or more AFW trains may be considered OPERABLE during alignment and operation for steam generator level control, if it is capable of being manually (i.e., remotely or locally, as appropriate) realigned to the AFW mode of operation, provided it is not otherwise inoperable. This exception allows the system to be out of its normal standby alignment and temporarily incapable of automatic initiation without declaring the train(s) inoperable. Since AFW may be used during startup, shutdown, hot standby operations, and hot shutdown operations for steam generator level control, and these manual operations are an accepted function of the AFW System, OPERABILITY (i.e., the intended safety function) continues to be maintained. The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.
AFW System B 3.7.5 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.7.5 - 8 Revision 5 SR  3.7.5.2Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are normal tests of centrifugal pump performance required by the ASME Code (Ref 2). Because it is undesirable to introduce cold AFW into the steam generators while they are operating, this testing is performed on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. Performance of inservice testing discussed in the ASME Code (Ref. 2) (only required at 3 month intervals) satisfies this requirement. This SR is modified by a Note indicating that the SR should be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test when SG pressure is 600 psig.SR  3.7.5.3This SR verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient that generates an ESFAS, by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage (i.e., unit at less than or equal to 97% power and in preparation for main generator breaker opening with no plans to raise power between the time of the surveillance and breaker open) and the potential for an unplanned transient if the Surveillance were performed with the reactor at full power. The 24 month Frequency is acceptable based on operating experience and the design reliability of the equipment. The SR is modified by a Note that states one or more AFW trains may be considered OPERABLE during alignment and operation for steam generator level control, if it is capable of being manually (i.e., remotely or locally, as appropriate) realigned to the AFW mode of operation, provided it is not otherwise inoperable. This exception allows the system to be out of its normal standby alignment and temporarily incapable of automatic initiation without declaring the train(s) inoperable. Since AFW may be used during AFW System B 3.7.5 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.7.5 - 9 Revision 5 startup, shutdown, hot standby operations, and hot shutdown operations for  steam generator level control, and these manual operations are an accepted function of the AFW System, OPERABILITY (i.e., the intended safety function) continues to be maintained. This SR is modified by a Note that states the SR is not required in MODE 4. In MODE 4, the required AFW train is aligned and operated as necessary to maintain SG water level. SR  3.7.5.4This SR verifies that the AFW pumps will start in the event of any accident or transient that generates an actuation signal by demonstrating that each AFW pump starts automatically on an actual or simulated actuation signal in MODES 1, 2, and 3. In MODE 4, the required pump is operated as necessary to maintain SG water level and the autostart function is not required. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This SR is modified by two Notes. Note 1 indicates that the SR be deferred until suitable test conditions are established. This deferral is required because there is insufficient steam pressure to perform the test. Note 2 states that one or more AFW trains may be considered OPERABLE during alignment and operation for steam generator level control, if it is capable of being manually (i.e., remotely or locally, as appropriate) realigned to the AFW mode of operation, provided it is not otherwise inoperable. This exception allowing the system to be out of its normal standby alignment and temporarily incapable of automatic initiation without declaring the train(s) inoperable. Since AFW may be used during startup, shutdown, hot standby operations, and hot shutdown operations for steam generator level control, and these manual operations are an accepted function of the AFW System.
OPERABILITY (i.e., the intended safety function) continues to be maintained.REFERENCES 1.UFSAR, Section 10.2.
2.ASME code for Operation and Maintenance of Nuclear Power Plants.
CSTB 3.7.6 INDIAN POINT 2 B 3.7.6 - 1 Revision 1 B 3.7  PLANT SYSTEMS B 3.7.6 Condensate Storage Tank (CST) BASESBACKGROUND The CST provides a safety grade source of water to the steam generators for removing decay and sensible heat from the Reactor Coolant System (RCS). The CST provides a passive flow of water, by gravity, to the Auxiliary Feedwater (AFW) System (LCO 3.7.5). The steam produced is released to the atmosphere by the main steam safety valves or the atmospheric dump valves. The AFW steam driven pump operates with a continuous recirculation to the CST. The motor driven AFW pumps have recirculation controllers that recirculate flow to the CST, as necessary, to maintain a minimum required AFW pump flow. When the main steam isolation valves are open, the preferred means of heat removal is to discharge steam to the condenser by the nonsafety grade path of the steam bypass valves. The condensed steam is returned to the CST by the condensate transfer pump. This has the advantage of conserving condensate while minimizing releases to the environment. Because the CST is a principal component in removing residual heat from the RCS, it is designed to withstand earthquakes and other natural phenomena. The condensate makeup system connects the 600,000 gallon capacity condensate storage tank to the main condenser. The condensate makeup system automatically supplies makeup water from the CST to the condenser if there is a low level in the condenser hotwell. Condenser makeup is isolated when the CST level decreases to approximately 360,000 gallons to reserve the required volume of condensate available to the auxiliary feedwater pumps sufficient to hold the plant at hot shutdown for 24 hours following a trip at full power. The CST is designed to Seismic Category I to ensure availability of the feedwater supply. Feedwater is also available from the City Water (CW) System. City water will be used to supply the Auxiliary Feedwater System only when the CST supply is exhausted. The City Water System includes the site city water header consisting of the 1.5million gallon city water storage tank and the connection to the offsite water supply. A description of the CW system is found in UFSAR, Section 10 (Ref. 1). Requirements for the OPERABILITY of the City Water System are in the Technical Requirements Manual (TRM)
(Ref. 2). A description of the CST is found in the UFSAR, Section 10.2 (Ref. 1).
CSTB 3.7.6 BASESINDIAN POINT 2 B 3.7.6 - 2 Revision 1 APPLICABLESAFETY ANALYSESThe CST provides cooling water to remove decay heat. The minimum amount of water in the condensate storage tank is the amount needed to maintain the plant for 24 hours in MODE 3 following a trip from full power.
When the condensate storage tank supply is exhausted, city water will be used.The CST satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii). LCOTo satisfy accident analysis assumptions, the CST must contain sufficient cooling water to remove decay heat while in MODE 3 for 24 hours following a reactor trip from 102% RTP. In doing this, it must retain sufficient water to ensure adequate net positive suction head for the AFW pumps during cooldown, as well as account for any losses from the steam driven AFW pump turbine. The CST required minimum volume of 360,000 gallons includes conservative allowances for instrument accuracy and the unusable volume.
When the condensate storage tank supply is exhausted, city water will be used to supply the AFW pumps. The OPERABILITY of the CST is determined by maintaining the tank level at or above the minimum required level. APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when steam generator is being relied upon for heat removal, the CST is required to be OPERABLE. In MODE 5 or 6, the CST is not required because the AFW System is not required.ACTIONSA.1 and A.2If the CST is not OPERABLE, the OPERABILITY of the backup supply (City Water) should be verified by administrative means within 4 hours and once every 12 hours thereafter. OPERABILITY of the backup feedwater supply must include verification that City Water is OPERABLE in accordance with requirements specified in the Technical Requirements Manual (TRM)
(Ref. 2). The CST must be restored to OPERABLE status within 7 days. The Completion Time for verification of the OPERABILITY of the backup water supply ensures that Condition B is entered promptly if both CSTB 3.7.6 BASESACTIONS  (continued) INDIAN POINT 2 B 3.7.6 - 3 Revision 1 the CST and City Water are inoperable. Verifying the OPERABILITY of City Water every 12 hours is adequate to ensure the backup water supply continues to be available. The 7 day Completion Time for restoration of the CST is reasonable, based on an OPERABLE backup water supply being available, and the low probability of an event occurring during this time period requiring the CST. B.1 and B.2If the CST cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4, without reliance on the steam generator for heat removal, within 24 hours. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. If Condition B is entered when both the CST and City Water are not Operable, Conditions and Required Actions for LCO 3.7.5, Auxiliary Feedwater System, may be appropriate. SURVEILLANCE SR  3.7.6.1 REQUIREMENTSThis SR verifies that the CST contains the required volume of cooling water.
The 12 hour Frequency is based on operating experience and the need for operator awareness of unit evolutions that may affect the CST inventory between checks. Also, the 12 hour Frequency is considered adequate in view of other indications in the control room, including alarms, to alert the operator to abnormal deviations in the CST level. REFERENCES 1. UFSAR, Section 10.2. 2. IP2 Technical Requirements Manual (TRM).
CCW SystemB 3.7.7 INDIAN POINT 2B 3.7.7 - 1 Revision 3B 3.7  PLANT SYSTEMSB 3.7.7Component Cooling Water (CCW) System BASESBACKGROUNDThe CCW System provides a heat sink for the removal of process andoperating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation, the CCW System also provides this function for various nonessential components, as well as the spent fuel storage pool. The CCW System serves as a barrier to the release of radioactive byproducts between potentially radioactive systems and the Service Water System, and thus to the environment.The CCW System consists of three pumps and two heat exchangers. TheCCW pumps are connected to a common discharge header that is arranged so that any of the three pumps will supply either CCW heat exchanger and the heat exchangers are connected to a common discharge header so that both heat exchangers supply all CCW System heat loads. The CCW pumps share a common suction header that is supported by a single surge tank.Any one of the three CCW pumps in conjunction with any one of the twoCCW heat exchangers is sufficient to accommodate the normal and post accident heat load (Refs. 1 and 3). Therefore, the CCW system isconsidered to consist of two, 100% capacity trains. A CCW train consists ofany of the three CCW pumps in conjunction with a CCW heat exchanger.
One CCW heat exchanger must be OPERABLE for each OPERABLE train.
The third CCW pump may be used to replace the pump in either train. Each of the three CCW pumps is powered from a separate safeguards power train.
Any service water system pump aligned to the nonessential header can be used to support either or both CCW heat exchangers. An open surge tank in the system ensures that sufficient net positive suction head is available. CCW pumps continue to operate following a safety injection signal without loss of offsite power (LOOP); however, CCW pumps must be manually started as needed following a safety injection signal that includes a LOOP. The CCW pumps are not re-started immediately during the injection phase; therefore, the water volume of the CCW system must act as a heat sink during the injection phase when the CCW pumps are not running. This is acceptable even though high head safety injection pump bearings are cooled by CCW because the cooling water is circulated by a booster pump directly connected to the injection pump motor shaft (Ref. 2).In the event of LOOP without a safety injection signal, the CCW pumps areautomatically loaded onto the emergency buses. Component cooling water to the RCP thermal barrier heat exchanger is thus automatically restored to provide RCP seal cooling (Ref. 1).
CCW SystemB 3.7.7 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.7.7 - 2 Revision 3The two auxiliary component cooling water pumps are not governed by thisLCO because the sole purpose of these pumps is as a support system for the containment recirculation pumps which are governed by Technical Specification 3.5.2, "ECCS Systems - Operating."(Ref. 2).Additional information on the design and operation of the system, along witha list of the components served, is presented in the UFSAR, Section 9.3 (Ref. 1). The principal safety related function of the CCW System is the removal of decay heat from the reactor via the Residual Heat Removal (RHR)
System during a normal or post accident cooldown and shutdown.APPLICABLE
 
SAFETY ANALYSESThe design basis of the CCW System is for one CCW train to remove thepost loss of coolant accident (LOCA) heat load from the containment sump during the recirculation phase. Any one of the three CCW pumps in conjunction with any one of the two CCW heat exchangers is sufficient to accommodate the normal and post accident heat load. Analysis shows that the RCS can be brought to MODE 5 within 72 hours using the auxiliary safe shutdown components (1 RHR pump and heat exchanger, 1 component cooling pump, and 1 service water pump supplying flow to non-essential header). Conditions assumed were an initial core thermal power of 3216 MWand service water temperature of 95F (Refs. 1 and 3).Because the component cooling pumps are not started immediately duringthe injection phase if the event is accompanied by a loss of offsite power, the water volume of the CCW system is used as a heat sink. This heat load causes CCW temperature to rise until the CCW pumps are started. At least one CCW pump must be in operation during the recirculation phase.The minimum CCW requirement is sufficient to prevent the containmentsump fluid from increasing in temperature during the recirculation phase following a LOCA, and provides a gradual reduction in the temperature of this fluid as it is supplied to the Reactor Coolant System (RCS) by the ECCS pumps.The CCW System is designed to perform its function with a single failure ofany active component, assuming a loss of offsite power.
CCW SystemB 3.7.7 BASESAPPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2B 3.7.7 - 3 Revision 3The CCW System also functions to cool the unit from RHR entry conditions (T < 350F), to MODE 5 (T < 200F), during normal and post accidentoperations. The time required to cool from 350 F to 200F is a function of thenumber of CCW, SWS and RHR trains operating. One CCW train is sufficient to remove decay heat during subsequent operations with T < 200 F. This assumes a maximum service water temperature of 95 F occurringsimultaneously with the maximum heat loads on the system.The CCW System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCOThe CCW trains are independent of each other to the degree that each hasseparate controls and power supplies and the operation of one does not depend on the other. In the event of a DBA, one CCW train is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two trains of CCW must be OPERABLE. At least one CCW train will operate assuming the worst case single active failure occurs coincident with a loss of offsite power.A CCW train consists of any of the three CCW pumps in conjunction with aCCW heat exchanger. One CCW heat exchanger must be OPERABLE for each OPERABLE train. A CCW train is considered OPERABLE when:a. The pump and CCW system surge tank are OPERABLE and
: b. The associated piping, valves, heat exchanger, and instrumentationand controls required to perform the safety related function are OPERABLE.The isolation of CCW from components or systems may render those components or systems inoperable but does not affect the OPERABILITY of the CCW System.The two auxiliary component cooling water pumps are not governed by thisLCO because the sole purpose of these pumps is as a support system for the containment recirculation pumps which are governed by Technical Specification 3.5.2, "ECCS Systems - Operating."(Ref. 2).APPLICABILITYIn MODES 1, 2, 3, and 4, the CCW System is a normally operating system, which must be prepared to perform its accident safety functions, primarily RCS heat removal, which is achieved by cooling the RHR heat exchanger.
CCW SystemB 3.7.7 BASESAPPLICABILITY  (continued)
INDIAN POINT 2B 3.7.7 - 4 Revision 3In MODE 5 or 6, the OPERABILITY requirements of the CCW System aredetermined by the systems it supports.ACTIONS A.1Required Action A.1 is modified by a Note indicating that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4," be entered if an inoperable CCW train results in an inoperable RHR loop. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.If one CCW train is inoperable, action must be taken to restore OPERABLEstatus within 72 hours. In this Condition, the remaining OPERABLE CCW train is adequate to perform the heat removal function. The 72 hour Completion Time is reasonable, based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during
 
this period.B.1 and B.2If the CCW train cannot be restored to OPERABLE status within theassociated Completion Time, the unit must be placed in a MODE in which overall plant risk is reduced. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours and in MODE 4 within 12 hours.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 4). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 4, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action B.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and CCW SystemB 3.7.7 BASESAPPLICABILITY  (continued)
INDIAN POINT 2B 3.7.7 - 5 Revision 3establishment of risk management actions, if appropriate. LCO 3.0.4 is notapplicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCESR  3.7.7.1REQUIREMENTSThis SR is modified by a Note indicating that the isolation of the CCW flow to individual components may render those components inoperable but does not affect the OPERABILITY of the CCW System.Verifying the correct alignment for manual, power operated, and automaticvalves in the CCW flow path provides assurance that the proper flow paths exist for CCW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position because these valves are verified to be in the correct position prior to locking, sealing, or securing. Manually operated valves located inside containment are considered locked. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position.The 92 day Frequency is based on operating experience, is consistent withthe procedural controls governing valve operation, and ensures correct valve positions.SR  3.7.7.2This SR verifies proper automatic operation of the CCW valves on an actualor simulated actuation signal. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month CCW SystemB 3.7.7 BASESSURVEILLANCE REQUIREMENTS (continued)
INDIAN POINT 2B 3.7.7 - 6 Revision 3Frequency. Therefore, the Frequency is acceptable from a reliabilitystandpoint.SR  3.7.7.3This SR verifies proper automatic operation of the CCW pumps on an actualor simulated actuation signal. The CCW System is a normally operating system that cannot be fully actuated as part of routine testing during normal operation. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.REFERENCES 1.UFSAR, Sections 9.3 and 9.6.
2.UFSAR, Section 6.2.
3.WCAP-16157, "Indian Point Unit 2 Stretch Power Uprate Licensing Report," January 2004.
4.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changes to Technical Specification Required Action Endstates for Westinghouse NSSS PWRs," June 2010.
SWSB 3.7.8 INDIAN POINT 2B 3.7.8 - 1 Revision 2B 3.7  PLANT SYSTEMSB 3.7.8Service Water System (SWS)
BASESBACKGROUNDThe SWS provides a heat sink for the removal of process and operating heatfrom safety related components during a Design Basis Accident (DBA) or transient. During normal operation, and a normal shutdown, the SWS also provides this function for various safety related and nonsafety related components. The safety related function is covered by this LCO.The SWS consists of two separate, 100% capacity, safety related, coolingwater headers. Each header is supplied by three pumps and includes the pump strainers and the piping up to and including the isolation valves on individual components cooled by the SWS.SWS heat loads are designated as either essential or non-essential. Theessential SWS heat loads are those which must be supplied with cooling water immediately in the event of a LOCA and/or loss of offsite power (LOOP). Examples of essential loads are the diesel generators (DGs) and containment fan cooler units (FCUs). The non-essential SWS heat loads arethose which are required following a postulated LOCA only after the switchover to the recirculation phase. The most significant non-essential loads are the component cooling water (CCW) heat exchangers.The FCUs are connected in parallel to the essential SWS header. NormalSW flow to the FCUs is controlled by TCV-1103. Required ESFAS flow to all five FCUs is initiated when either (or both) of the redundant FCU ESFAS Service Water valves (TCV-1104 and TCV-1105) opens automatically in response to an ESFAS actuation signal.The DGs are connected in parallel to the essential SWS header. Normalrequired ESFAS flow to all three DGs is initiated when either (or both) of the redundant DG ESFAS Service Water valves (FCV-1176 and FCV-1176A) opens automatically in response to an ESFAS actuation which starts the DGs.Either of the two SWS headers can be aligned to supply the essential heatloads or the non-essential SWS heat loads. Both the essential and non-essential SWS headers are operated to support normal plant operation and the plant response to accidents and transients. The SWS pumps associated with the SWS header designated as the essential header will start automatically. The SWS pumps associated with the SWS header designated as the non-essential header must be manually started
 
when SWSB 3.7.8 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.7.8 - 2 Revision 2required during recirculation phase following a LOCA.The essential SWS heat loads can be cooled by any two of the three servicewater pumps on the essential header. The non-essential SWS heat loads can be cooled by any one of the three service water pumps on the non-essential header. To ensure adequate flow to the essential header, the essential and non-essential headers may be cross connected only as necessary while swapping the essential SWS header with the non-essential SWS header.Service water pump suctions are located below the mean sea level in theHudson River, the ultimate heat sink. This configuration ensures adequate submergence of the SWS pump suctions.Additional information about the design and operation of the SWS, along witha list of the components served, is presented in the UFSAR, Section 9.6 (Ref. 1). The principal safety related function of the SWS is supplying cooling water to the DGs and the containment FCUs and the removal of decay heat from the reactor via the CCW System.APPLICABLE
 
SAFETY ANALYSESThe design basis of the SWS is as follows:
a.Post accident essential SWS heat loads can be cooled by any two ofthe three service water pumps on the designated essential header;
 
and, b.Post accident non-essential SWS heat loads can be cooled by any one of the three service water pumps on the designated non-essential
 
header.With the minimum number of pumps operating, the essential and non-essential headers of the SWS have the required capacity to remove core decay heat following a design basis LOCA as discussed in References 1
 
and 2.Analysis shows that the RCS can be brought to MODE 5 within 72 hoursusing the auxiliary safe shutdown components (1 RHR pump and heat exchanger, 1 component cooling pump, and 1 service water pump supplying flow to non-essential header). Conditions assumed were an initial core thermal power of 3216 MW and service water temperature of 95F (Ref. 1).
SWSB 3.7.8 BASESAPPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2B 3.7.8 - 3 Revision 2The SWS flow prevents the containment sump fluid from increasing intemperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the Reactor Coolant System by the ECCS pumps. The Service Water System was designed to fulfill required safety functions while sustaining either:(a) The single failure of any active component used during the injectionphase of a postulated LOCA with or without a loss of offsite power; or,(b) The single failure of any active or passive component used during thelong-term recirculation phase with or without loss of offsite power.The SWS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCOThree of the three SWS pumps associated with the SWS header designatedas the essential header; and, two of the three SWS pumps associated with the SWS header designated as the non-essential header must be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident heat loads, while sustaining: (a) the single failure of any active component used during the injection phase of a postulated LOCA with or without a LOOP, or (b) the single failure of any active or passive component used during the long-term recirculation phase with or without a LOOP.An SWS header is considered OPERABLE during MODES 1, 2, 3, and 4 when:a. The required number of pumps, consistent with the header'sdesignation as the essential or non-essential header, are OPERABLE;b. The essential and non-essential headers are isolated from each otherby at least one closed valve except as specified by the NOTE to theACTIONS;c. The associated piping, valves, and instrumentation and controlsrequired to perform the safety related function are OPERABLE.The FCU ESFAS Service Water valves (TCV-1104 and TCV-1105) and the DG ESFAS Service Water valves (FCV-1176 and FCV-1176A) are OPERABLE when they open automatically in response to an ESFAS actuation signal or are open.
SWSB 3.7.8 BASES INDIAN POINT 2B 3.7.8 - 4 Revision 2APPLICABILITYIn MODES 1, 2, 3, and 4, the SWS is a normally operating system that isrequired to support the OPERABILITY of the equipment serviced by the SWS and required to be OPERABLE in these MODES.In MODES 5 and 6, the OPERABILITY requirements of the SWS aredetermined by the systems it supports.ACTIONSThe Actions are modified by a Note that specifies that LCO 3.0.3 is not applicable for 8 hours while swapping the essential SWS header with the non-essential SWS header but only if LCO 3.7.8 will be met after the essential and non-essential header are swapped. This means that the essential and non-essential SWS headers may be cross-connected for up to 8 hours during transfer of the designated essential SWS header to the alternate SWS header. This is acceptable because the transfer is performed infrequently (approximately every 90 days) and the low probability of an event while the headers are cross connected.A.1 and B.1If one of the three required SWS pumps on the essential SWS header isinoperable (Condition A), three OPERABLE pumps must be restored to the essential SWS header within 72 hours. Likewise, if one of the two required SWS pumps on non-essential SWS header is inoperable (Condition B), the header must be restored so that there are two OPERABLE pumps for the non-essential SWS header within 72 hours. With one required SWS pump inoperable on either or both SWS headers, the remaining OPERABLE SWS pumps are adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in an OPERABLE SWS pump could result in loss of SWS function. The 72 hour Completion Time is based on the redundant capabilities afforded by the OPERABLE SWS pumps in the same header and the low probability of a DBA occurring during this time period.C.1 and D.1Required ESFAS flow to all three DGs is initiated when either of theredundant SW to DG ESFAS valves (FCV-1176 or FCV-1176A) opens automatically in response to an ESFAS actuation which starts the DGs.
Similarly, required ESFAS flow to all five FCUs is initiated when either of the redundant SW to FCU ESFAS valves (TCV-1104 or TCV-1105) opens automatically in response to an ESFAS actuation signal. The SW to FCU ESFAS valves and SW to DG ESFAS valves are OPERABLE when they SWSB 3.7.8 BASESACTIONS (continued)
INDIAN POINT 2B 3.7.8 - 5 Revision 2open automatically in response to an ESFAS actuation signal or aremaintained open (valves fail open on loss of power or loss of air).If one of the redundant SW to DG ESFAS valves is inoperable, a singlefailure of the redundant valve could result in the failure of all three DGs shortly after the initiation of an event. If one of the redundant SW to FCU ESFAS valves is inoperable, a single failure of the redundant valve could result in the failure of all five FCUs. Therefore, a Completion Time of 12 hours is established to restore the required redundancy.A 12 hour Completion Time is acceptable for the SW to DG valves becauseSW to the DGs is still available and the low probability of an event with a loss of offsite power during this period. A 12 hour Completion Time is acceptable for the SW to FCU valves because SW to the FCUs is still available, the availability of Containment Spray, and the low probability of an event during
 
this period.If both SW to DG valves or both SW to FCU valves are inoperable, entry intoLCO 3.0.3 is required.E.1 and E.2If more than one required SWS pump in either the essential or thenon-essential header is inoperable, then the plant must be placed in a MODE in which overall plant risk is reduced. Additionally, if the SWS train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which overall plant risk is reduced.To achieve the required status, the unit must be placed in at least MODE 3within 6 hours and in MODE 4 within 12 hours.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 3). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 3, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action E.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
SWSB 3.7.8 BASESACTIONS (continued)
INDIAN POINT 2B 3.7.8 - 6 Revision 2However, there is no restriction on the use of LCO 3.0.4.b, if applicable,because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCESR  3.7.8.1REQUIREMENTSThis SR is modified by a Note indicating that the isolation of the SWS components or systems may render those components inoperable, but does not affect the OPERABILITY of the SWS.Verifying the correct alignment for manual, power operated, and automaticvalves in the SWS flow path provides assurance that the proper flow paths exist for SWS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to being locked, sealed, or secured. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.The 92 day Frequency is based on engineering judgment, is consistent withthe schedule for swapping the essential and non-essential headers and ensures correct valve positions.SR  3.7.8.2This SR verifies proper automatic operation of the SWS valves on an actualor simulated actuation signal. The SWS is a normally operating system that cannot be fully actuated as part of normal testing. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the SWSB 3.7.8 BASESSURVEILLANCE REQUIREMENTS (continued)
INDIAN POINT 2B 3.7.8 - 7 Revision 2Surveillance were performed with the reactor at power. Operating experiencehas shown that these components usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.SR  3.7.8.3This SR verifies proper automatic operation of the SWS pumps on an actualor simulated actuation signal. Only the SWS pumps associated with the designated essential header are required to operate automatically. However, both sets of SWS pumps are tested because the pumps designated as essential and non-essential are periodically swapped during the operating cycle. The SWS is a normally operating system that cannot be fully actuated as part of normal testing during normal operation. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance when performed at the 24 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.REFERENCES 1.UFSAR, Section 9.6.
2.WCAP-12312, "Safety Evaluation for An Ultimate Heat SinkTemperature to 95F at Indian Point Unit 2," July, 1989, and approvedsupplements.
3.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changes toTechnical Specification Required Action Endstates for Westinghouse NSSS PWRs," June 2010.
UHSB 3.7.9 INDIAN POINT 2B 3.7.9 - 1 Revision 1B 3.7  PLANT SYSTEMSB 3.7.9Ultimate Heat Sink (UHS)
BASESBACKGROUNDThe UHS provides a heat sink for processing and operating heat from safetyrelated components during a transient or accident, as well as during normal operation. This is done by utilizing the Service Water System (SWS) and the Component Cooling Water (CCW) System.The ultimate heat sink for IP2 is the Hudson River. The UHS and supportingstructures are sufficient to:(a) Support simultaneous safe shutdown and cooldown of both operatingnuclear units at the Indian Point site and maintain them in a safecondition, and(b) In the event of an accident in one unit, support required response tothat accident and permit simultaneous safe shutdown and cooldown ofthe remaining unit and maintain them in a safe shutdown condition.The ultimate heat sink is capable of withstanding the effects of the mostsevere natural phenomena associated with the Indian Point site. The two principal functions of the UHS are the dissipation of residual heat after reactor shutdown, and dissipation of residual heat after an accident.APPLICABLE
 
SAFETY ANALYSESThe UHS is the sink for heat removed from the reactor core following all accidents and anticipated operational occurrences in which the unit is cooled down and placed on residual heat removal (RHR) operation. Because IP2 uses the UHS as the normal heat sink for condenser cooling via the Circulating Water System, unit operation at full power is its maximum heat load. Its maximum post accident heat load occurs shortly after a design basis loss of coolant accident (LOCA). Near this time, the unit switches from injection to recirculation and the containment cooling systems and containment recirculation system are required to remove the core decay heat.The operating limits are based on conservative heat transfer analyses for theworst case LOCA. Reference 1 provides the details of the assumptions used in the analysis, which include worst expected meteorological conditions, conservative uncertainties when calculating decay heat, and worst case single active failure (e.g., single failure of a manmade structure).
UHSB 3.7.9 BASESAPPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2B 3.7.9 - 2 Revision 1The UHS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCOThe UHS is required to be OPERABLE and is considered OPERABLE if itcontains water at or below the maximum temperature that would allow the SWS to operate for at least 30 days following the design basis LOCA without the loss of net positive suction head (NPSH), and without exceeding the maximum design temperature of the equipment served by the SWS. To meet this condition, the UHS temperature should not exceed 95 F.APPLICABILITYIn MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of the equipment serviced by the UHS and required to be OPERABLE in these MODES.In MODE 5 or 6, the OPERABILITY requirements of the UHS are determinedby the systems it supports.ACTIONSA.1 and A.2If the UHS temperature exceeds 95F, or the UHS is inoperable for any otherreason, the unit must be placed in a MODE in which overall plant risk is reduced. To achieve this status, the unit must be placed in at least MODE 3 within 7 hours and in MODE 4 within 12 hours.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 3). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 3, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actionsto ensure long-term decay heat removal. Voluntary entry into MODE 5may be made as it is also acceptable from a risk perspective.Required Action A.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the UHSB 3.7.9 BASESACTIONS  (continued)
INDIAN POINT 2B 3.7.9 - 3 Revision 1results, determination of the acceptability of entering MODE 4, andestablishment of risk management actions, if appropriate. LCO 3.0.4 is notapplicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. The Completion Time of 12 hours to reach MODE 4 assumes that more than one component cooling water pump and more than one nonessential service water pump are
 
available.SURVEILLANCESR  3.7.9.1REQUIREMENTSThis SR requires routine monitoring of the UHS (service water inlet) temperature. Requirements for UHS temperature monitoring instrumentation are governed by the Technical Requirements Manual (Ref. 2). The 24 hour Frequency is based on operating experience related to trending of the parameter variations during the applicable MODES. This SR verifies that the water temperature of the UHS is 95F. Reference 2 includes requirementsfor more frequent monitoring of UHS temperature when UHS temperature is 90 F.REFERENCES 1.WCAP-12312, "Safety Evaluation for An Ultimate Heat SinkTemperature to 95F at Indian Point Unit 2," July, 1989, includingapproved supplements.
2.IP2 Technical Requirements Manual.
3.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation ofChanges to Technical Specification Required Action Endstates for Westinghouse NSSS PWRs,' June 2010.
CRVSB 3.7.10 INDIAN POINT 2B 3.7.10 - 1 Revision 7B 3.7  PLANT SYSTEMSB 3.7.10Control Room Ventilation System (CRVS)
BASESBACKGROUNDThe CRVS provides a protected environment from which occupants cancontrol the unit following an uncontrolled release of radioactivity
, hazardouschemicals, or smoke.The Control Room Ventilation System consists of the following:- A direct expansion air conditioning unit complete with a fan(21CCRF) and steam heating coil. The design capacity of the unitis 9200 cfm. A backup fan (CCRCF) of the same design capacity is installed in parallel with the air conditioning unit;- A single 2000 cfm filter unit consisting of two high efficiencyparticulate air (HEPA) filters;- Two activated charcoal adsorbers for removal of gaseous activity (principally iodines);- Two 100% capacity (2000 cfm10%) filter booster fans (21CCRBFand 22CCRBF);- One locker room and toilet exhaust fan (K-8); and- A single duct system that uses redundant dampers, controls andassociated accessories to provide for three different air flowconfigurations.The control room envelope (CRE) is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Habitability Program.
CRVSB 3.7.10 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.7.10 - 2 Revision 7The three CRVS air flow configurations are normal mode, incident 100%recirculation mode, and outside filtered air pressurization mode.Normal mode (mode 1) for the CRVS is used to provide cooling or heating forthe CREatmosphere. In this mode, CREair is recirculated through the airconditioning unit at a rate of approximately 8280 cfm. Outside makeup air is provided to makeup for the approximately 920 cfm that is exhausted through the toilet exhaust fan. In the CRVS normal mode, the HEPA/adsorber filter unit is bypassed.Pressurization mode (mode2) for the CRVS is used for protection againstairborne radiation. In this mode, the CRE is pressurized with outside air thatis drawn through the HEPA/adsorber filter unit. Pressurization with filtered air minimizes inleakage of unfiltered air into the CRE. This mode is established as follows:- A safety injection signal or a high radiation signal from the CREmonitor (RE-38-1 or RE-38-2) as required by LCO 3.3.7, "Control Room Ventilation System (CRVS) Actuation Instrumentation" will automatically place the CRVS in the pressurization mode (mode 2).
In the pressurization mode, either of the two filter booster fans (21CCRBF or 22CCRBF) will maintain the CREat a slight positive pressure relative to adjacent areas.- Toilet area exhaust fan (K-8) is tripped and the associated exhaustflow path is isolated by series redundant dampers (CCRD4 andCCRD5). This action completes the CREto permit pressurization.- Dampers (CCRA1 and CCRA2) in the flowpath that allows outsideair to bypass the HEPA/adsorber filter unit close. These dampersare in series to provide required redundancy.- Filter booster fan (21CCRBF) starts and the associated isolationdamper (F-1) opens and draws outside air through the HEPA/adsorber filter unit at a rate sufficient to pressurize the CRE.
The filter booster fan supplies the filtered air to the suction of the air conditioning unit fan (21CCRF) where the filtered air is mixed with air being recirculated from the CRE. If the filter booster fan (21CCRBF) fails to start or trips, a flow switch will detect the failure and start the redundant filter booster fan (22CCRBF) after a predetermined time delay.
CRVSB 3.7.10 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.7.10 - 3 Revision 7- Air conditioning unit fan (21CCRF) recirculates the mixture offiltered outside air and CRE air. If the air conditioning unit fan(21CCRF) fails to start or trips, a flow switch will detect the failure and a redundant fan (CCRCF) will start. The redundant fan will continue to recirculate air in the CREbut will bypass the air conditioning unit.Incident 100% recirculation mode (mode 3) for the CRVS is used forprotection from smoke. In this mode, the CRVS is aligned for 100%recirculation of CREair through the air conditioning unit with no outside air
 
makeup.The original CRVS design was not required to meet single failure criteria buthas been upgraded so that the active mechanical components needed for pressurization mode (mode 2) are redundant. To meet this requirement, the CRVS is divided into two trains as follows:- CRVS Train A is powered from safeguards power train 2A/3A(MCC-26C) and is supported by DG-22. CRVS Train A includes:
Filter booster fan (21CCRBF) associated isolation damper (CCRF-1); HEPA/adsorber filter unit bypass damper (CCRA2);
Toilet area exhaust fan (K-8) isolation damper (CCRD4); and, air conditioning unit backup fan (CCRCF).- CRVS Train B is powered from safeguards power train 6A(MCC-26B) and is supported by DG-23. CRVS Train B includes:
filter booster fan (22CCRBF) and associated isolation damper (CCRG-1); HEPA/adsorber filter unit bypass damper (CCRA1); toilet area exhaust fan (K-8) isolation damper (CCRD5); and, air conditioning unit fan (21CCRF).The HEPA/adsorber filter unit is considered a passive component and iscommon to both units.APPLICABLE SAFETY ANALYSESAt Indian Point 2, radiological consequence analyses have been revised to demonstrate compliance with 10 CFR 50.67, Accident Source Term (References 2, 3 and 4). 10 CFR 50.67 requires that accident analyses show adequate radiation protection is provided to permit access to and occupancy of the CRE under accident conditions without personnel receiving radiation exposures in excess of 5 rem total effective dose equivalent for the duration of the accident.
CRVSB 3.7.10 BASESAPPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2B 3.7.10 - 4 Revision 7The re-analysis of the large-break LOCA, Steam Line Break and SteamGenerator Tube Rupture accidents performed to demonstrate compliance with 10 CFR 50.67 modeled the CREair filtration system in the pressurization mode of operation (mode 2). The analysis assumed 1800 cfm of outside air is drawn through HEPA and charcoal filters via booster fans and discharged into the CRE. The design of the control room ventilation system in the pressurization mode (mode 2) is to bring in approximately 2000 cfm of outside air and direct it through the HEPA/charcoal filters into the CRE. The analysis also assumes 700 cfm of unfiltered leakage into the CRE. The dose to personnel is affected more by the inleakage of unfiltered air than by the intake of filtered air, and the calculated dose to a CRE occupantis below the acceptance criteria in 10 CFR 50.67.In MODES 5 and 6 without fuel handling in progress, CRVS need not beOPERABLE because the potential for radioactive releases is minimized and operator action is sufficient to ensure post accident CREdoses are maintained within the limits of Reference 3.In MODE 6 with fuel handling in progress or with fuel handling in the fuelstorage building, CRVS need not be OPERABLE because water level and decay time are the primary success path for mitigating a fuel handling accident after 84 hours of decay time have elapsed (fuel involved in the accident has occupied part of a critical reactor core within the previous 84 hours). This is consistent with the analyses of the radiological consequence for the fuel handling accident that were revised to demonstrate compliance with 10 CFR 50.67, Accident Source Term (Ref. 3). However, Reference 3 did not address fuel handling accidents when less than 84 hours of decay time have elapsed. Therefore, CRVS is required to be OPERABLE during movement of fuel that has occupied part of a critical reactor core within the previous 84 hours.The CRVS provides protection from smoke and hazardous chemicals  to theCRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release (Ref. 1). The evaluation of a smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown panels (Ref. 1).
CRVSB 3.7.10 BASESAPPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2B 3.7.10 - 5 Revision 7The CRVS components are arranged in redundant, safety related ventilationtrains. The worst case single active failure of a component of the CRVS, assuming a loss of offsite power, does not impair the ability of the system to perform its design function.The CRVS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCOTwo redundant CRVS trains are required to be OPERABLE to ensure that atleast one is available ifa single activefailure disables the other train. Total system failure
,such as from a loss of both ventilation trains or from aninoperable CRE boundary, could result in exceeding a dose of 5 rem TEDEto the CRE occupants in the event of a large radioactive release.EachCRVS trainis considered OPERABLE when the individual componentsnecessary to limit CRE occupant exposure are OPERABLE. A CRVS train is OPERABLE when the associated:a. Fans are OPERABLE,
: b. HEPA filters and charcoal adsorbers are not excessively restrictingflow, and are capable of performing their filtration functions, andc. Ductwork, valves, and dampers are OPERABLE, and air circulation canbe maintained.In order for the CRVS trains to be considered OPERABLE, the CRE boundarymust be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.Criteria has been established for leakage from primary coolant sourcesoutside of containment which could render the CCR Filter System inoperable.
For more information refer to Technical Specification 5.5.2, "Primary Coolant Sources Outside of Containment".This LCO governs only those portions of the CRVS needed to ensure that thedesign basis single active failure criterion is met for automatic protection against airborne radiation using the filtered pressurization mode of operation (mode 2).
CRVSB 3.7.10 BASES LCO (continued)
INDIAN POINT 2B 3.7.10 - 6 Revision 7The LCO is modified by a Note allowing the CREboundary to be openedintermittently under administrative controls. This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized andconsist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design conditionwhen a need for CRE isolation is indicated.Technical Requirements Manual (TRM) 3.9.A, "Decay Time," (Ref. 7)prevents any movement of recently irradiated fuel by prohibiting movement of any fuel in the reactor until 84 hours after reactor shutdown.APPLICABILITYIn MODES 1, 2, 3 and 4, CRVS must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA.During movement of recently irradiated fuel assemblies, the CRVS must beOPERABLE to cope with the release from a fuel handling accident involving recently irradiated fuel. The CRVS is only required to be OPERABLE during fuel handling involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84 hours), due to radioactive decay.ACTIONS A.1When one CRVS train is inoperable, for reasons other than an inoperable CRE boundary,action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CRVS train is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE CRVS train could result in loss of CRVS function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and ability of the remaining train to provide the required capability.
CRVSB 3.7.10 BASES LCO (continued)
INDIAN POINT 2B 3.7.10 - 7 Revision 7 B.1 , B.2, and B.3If the unfiltered inleakage of potentially contaminated air past the CREboundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.During the period that the CRE boundary is considered inoperable, actionmust be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.C.1When neither CRVS train is OPERABLE (which includes an inoperablecontrol room boundary), action must be taken to restore at least one train to OPERABLE status within 72 hours. The 72 hour Completion Time is acceptable because of the low probability of a DBA occurring during this time
 
period.
CRVSB 3.7.10 BASES LCO (continued)
INDIAN POINT 2B 3.7.10 - 8 Revision 7D.1 and D.2If the inoperable CRVS train(s) or the CRE cannot be restored to OPERABLEstatus within the required Completion Time, the unit must be placed in a MODE in which the overall plant risk is reduced. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 4 within
 
12 hours.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 11). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 11, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action D.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.E.1 and E.2Reference 3 did not address exposure to CRE occupantsresulting from fuelhandling accidents when less than 84 hours of decay time have elapsed if the CRE ventilation safety function is not met. Therefore, when only one CRVS train is OPERABLE during movement of recently irradiated fuel, action must be taken to immediately place the OPERABLE CRVS train in the pressurization mode. This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure would be readily detected. An alternative to Required Action D.1 is to immediately suspend activities that could result in a release CRVSB 3.7.10 BASES LCO (continued)
INDIAN POINT 2B 3.7.10 - 9 Revision 7of radioactivity that might require isolation of the CRE. This places the unit ina condition that minimizes the accidentrisk. This does not preclude the movement of fuel to a safe position.F.1Reference 3 did not address exposure to control room occupants resultingfrom fuel handling accidents when less than 84 hours of decay time have elapsed if the CREventilation safety function is not met. Therefore, during movement of recently irradiated fuelwhen neither CRVS train is OPERABLE or with one or more CRVS trains inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation ofthe CRE.
This places the unit in a condition that minimizes theaccident risk. This does not preclude the movement of fuel to a safe position.SURVEILLANCESR  3.7.10.1REQUIREMENTSStandby systems should be checked periodically to ensure that they function properly. As the environment and normal operating conditions on this system are not too severe, testing each train once every month provides anadequate check of this system. Systems need only be operated for 15 minutes to demonstrate the function of the system. The SR is initiatedfrom the control room. The SR requires air flow through the HEPA filters andcharcoal absorbers. The 31 day Frequency is based on the reliability of the equipment and the two train redundancy.SR  3.7.10.2This SR verifies that the required CRVS testing is performed in accordancewith the Ventilation Filter Testing Program (VFTP). The VFTP includes testing the performance of the HEPA filter, charcoal adsorber efficiency, minimum flow rate, and the physical properties of the activated charcoal. Specific test Frequencies and additional information are discussed in detail in the VFTP.SR  3.7.10.3This SR verifies that each CRVS train starts and operates on an actual orsimulated actuation signal. The Frequency of 24 months is based on industry operating experience which has demonstrated this Frequency provides a high degree of assurance that the booster fans will operate and dampers actuate to the correct position when required and is consistent with the typical refueling cycle.
CRVSB 3.7.10 BASESSURVEILLANCE REQUIREMENTS (continued)
INDIAN POINT 2B 3.7.10 - 10 Revision 7SR  3.7.10.4This SR verifies the OPERABILITY of the CRE boundary by testing forunfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability
 
Program.The CRE is considered habitable when the radiological dose to CREoccupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem TEDE and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Action B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident.
Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, (Ref. 8) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 9). These compensatory measures may also be used as mitigating actions as required by Required Action B.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 10). Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis DBA consequence analysis, repairing the CRE boundary, or a combination of these actions.
Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.REFERENCES 1.UFSAR, Section 9.9.
2.UFSAR, Chapter 14.
3.UFSAR, Section [6.4].
4.UFSAR, Section [9.5].
5.UFSAR Section 6.4 6.UFSAR Section 9.5 7.TRM 3.9A  Decay Time 8.Regulatory Guide 1.196.
CRVSB 3.7.10 BASESREFERENCES (continued)
INDIAN POINT 2B 3.7.10 - 11 Revision 7 9.NEI 99-03, "Control Room Habitability Assessment," June 2001.10. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) datedJanuary 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of ControlRoom Habitability." (ADAMS Accession No. ML040300694).11. WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changes toTechnical Specification Required Action Endstates for WestinghouseNSSS PWRs," June 2010.
Spent Fuel Pit Water Level B 3.7.11 INDIAN POINT 2 B 3.7.11 - 1 Revision 1 B 3.7  PLANT SYSTEMS B 3.7.11 Spent Fuel Pit Water Level BASESBACKGROUND The minimum water level in the spent fuel pit meets the assumptions of iodine decontamination factors following a fuel handling accident. The specified water level shields and minimizes the general area dose when the storage racks are filled to their maximum capacity. The water also provides shielding during the movement of spent fuel. A general description of the spent fuel pit including the cooling and cleanup system is given in the UFSAR, Section 9.3 (Ref. 1). The assumptions of the fuel handling accident are given in Reference 2. APPLICABLE SAFETY ANALYSESThe minimum water level in the spent fuel pit meets the assumptions of the fuel handling accident evaluated. The radiological consequence analysis for a fuel handling accident in the fuel storage building assumes that a fuel assembly is dropped and damaged during refueling. The analysis methodology is consistent with Regulatory Guide 1.183 (Rev. 3). Activity released from the damaged assembly is released to the outside atmosphere through the fuel-handling building ventilation system to the plant vent. No credit is taken for removal of iodine by filters, nor is credit taken for isolation of release paths. The activity released from the damaged assembly is assumed to be released to the environment over a 2-hour period. The fuel assembly fission product inventory is based on the assumption that the subject fuel assembly has been operated at 1.7 times core average power (and thus has 1.7 times the average fuel assembly fission product inventory). The decay time used in the analysis is 84 hours. In accordance with this LCO, it is assumed that there is a minimum of 23 feet of water above the spent fuel racks. With this water depth, the decontamination factor (DF) of 500 specified by Reference 3 for elemental iodine would apply.
The DF was reduced to 400 for conservatism because the fuel rod pressure may exceed the assumption of 1200 psig (but would be less than 1500 psig).
The DF for organic iodine and noble gases was 1.0. The elemental iodine DF was reduced further to 285 in order to be consistent with Reference 3 guidance that the overall iodine DF be equal to 200. Since Reference 3 specifies that the 0.15% iodine is in the organic form, the limit of 200 for the overall iodine DF required that the DF for elemental iodine be 285.
Spent Fuel Pit Water Level B 3.7.11 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.7.11 - 2 Revision 1 With 23 ft of water over the damaged fuel, the assumptions of Reference 3 can be used directly. In practice, this LCO preserves this assumption for the bulk of the fuel in the storage racks. In the case of a single bundle dropped and lying horizontally on top of the spent fuel racks, however, there may be
< 23 ft of water above the top of the fuel bundle and the surface, indicated by the width of the bundle. To offset this small nonconservatism, the analysis assumes that all fuel rods fail, although analysis shows that only the first few rows fail from a hypothetical maximum drop. At Indian Point 2, the radiological consequence analyses for the fuel handling accident demonstrate compliance with the dose acceptance criterion in Reference 4. The spent fuel pit water level satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii). LCOThe spent fuel pit water level is required to be  23 ft over the top of irradiated fuel assemblies seated in the storage racks. The specified water level preserves the assumptions of the fuel handling accident analysis (Ref. 2). As such, it is the minimum required for fuel storage and movement within the spent fuel pit. The spent fuel pit minimum required level of 23 feet corresponds to an elevation of 92 feet, 2 inches. APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the spent fuel pit, because the potential for a release of fission products exists. ACTIONS A.1Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.When the initial conditions for prevention of an accident cannot be met, steps should be taken to preclude the accident from occurring. When the spent fuel pit water level is lower than the required level, the movement of irradiated fuel assemblies in the spent fuel pit is immediately suspended to Spent Fuel Pit Water Level B 3.7.11 BASESACTIONS  (continued) INDIAN POINT 2 B 3.7.11 - 3 Revision 1 a safe position. This action effectively precludes the occurrence of a fuel handling accident. This does not preclude movement of a fuel assembly to a safe position. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODES 1, 2, 3, and 4, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown. SURVEILLANCE SR  3.7.11.1 REQUIREMENTSThis SR verifies sufficient spent fuel pit water is available in the event of a fuel handling accident. The water level in the spent fuel pit must be checked periodically. The 7 day Frequency is appropriate because the volume in the spent fuel pit is normally stable. Water level changes are controlled by plant procedures and are acceptable based on operating experience. During refueling operations, the level in the spent fuel pit is in equilibrium with the refueling canal, and the level in the refueling cavity is checked daily in accordance with SR 3.9.6.1. REFERENCES 1. UFSAR, Section 9.3. 2. WCAP-16157, "Indian Point Unit Stretch Power Uprating Licensing Report," January 2004. 3. Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.4. NUREG-0800, Standard Review Plan, US Nuclear Regulatory Commission, Section 15.0.1, "Radiological Consequences Analysis Using Alternative Source Terms," Rev. 0, July 2000.
Spent Fuel Pit Boron ConcentrationB 3.7.12 INDIAN POINT 2B 3.7.12 - 1 Revision 2B 3.7  PLANT SYSTEMSB 3.7.12 Spent Fuel Pit Boron Concentration BASESBACKGROUNDThe Spent Fuel Pit (SFP) is used to store spent fuel removed from thereactor and new fuel ready for insertion into the reactor. The SFP has been evaluated to meet the requirements of option (b) of 10 CFR 50.68, "Criticality Accident Requirements" (Ref. 1). IP2 compliance with 10 CFR 50.68(b)(4) was confirmed by an analysis documented in Northeast Technology Corporation report NET-173-01, "Criticality Analysis for Soluble Boron and Burnup Credit in the Con Edison Indian Point Unit No. 2 Spent Fuel Storage Racks" (Ref. 2). This analysis demonstrated that 10 CFR 50.68(b)(4) will be met during normal SFP operation and all credible accident scenarios (including the affects of boraflex degradation) if the following requirements are met: a)Spent Fuel Pit boron concentration is maintained within the limits ofLCO 3.7.12, "Spent Fuel Pit Boron Concentration," whenever fuel is stored in the SFP; and, b)Fuel assembly storage location within the Spent Fuel Pit is restricted in accordance with LCO 3.7.13, "Spent Fuel Pit Storage," based on the fuel assembly's initial enrichment, burnup, decay of Plutonium-241 (i.e., cooling time), and number of Integral Fuel Burnable Absorbers (IFBA) rods.A detailed description of how this combination of minimum boron concentration and restrictions on fuel assembly storage location is presented in the Bases for LCO 3.7.13.APPLICABLE SAFETY ANALYSESNET-173-01, "Criticality Analysis for Soluble Boron and Burnup Credit in theCon Edison Indian Point Unit No. 2 Spent Fuel Storage Racks" (Ref. 2) evaluated non-accident conditions in the SFP including the affects of the projected boraflex degradation through the year 2006. Based upon  BADGER testing in calendar years 2003, 2006 and 2010 and RACKLIFE code projections, the validity of the criticality and boron dilution analysis documented in References 2, 3, 5 and 6 can be extended through the end of the current license (September 28, 2013). Reference 7 allowed BADGER testing to be performed in 2013, to confirm the progression of localized Boraflex dissolution. The continued validity of the criticality and boron dilution analysis will be verified based on the boron monitoring program as defined in the License Renewal Application. Reference 2 determined that if storage location requirements in this LCO are met then the Spent Fuel Pit Boron ConcentrationB 3.7.12 BASESAPPLICABLE SAFETY ANALYSES (continued)
INDIAN POINT 2B 3.7.12 - 2 Revision 2SFP will have a keff of 0.95 if filled with a soluble boron concentration of 786 ppm and will have a keff of < 1.0 if filled with unborated water.Reference 2 also evaluated credible abnormal occurrences in accordancewith ANSI/ANS-57.2-1983. This evaluation considered the effects of the following: a) a dropped fuel assembly or an assembly placed alongside a rack; b) a misloaded fuel assembly; and, c) abnormal heat loads. Reference 2determined that the SFP will maintain a keff of 0.95 under the worst-caseaccident scenario if the SFP is filled with a soluble boron concentration of 1495 ppm.NET-173-02, "Indian Point Unit 2 Spent Fuel Pool (SFP) Boron DilutionAnalysis" (Ref. 3) evaluated postulated unplanned SFP boron dilution scenarios assuming an initial SFP boron concentration within the limits of LCO 3.7.12. The evaluation considered various scenarios by which the SFP boron concentration may be diluted and the time available before the minimum boron concentration necessary to ensure subcriticality for the non-accident condition (i.e. it is not assumed an assembly is misloaded concurrent with the Spent Fuel Pit dilution event). Reference 3 determined that an unplanned or inadvertent event that could dilute the SFP boron concentration from 2000 ppm to 786 ppm is not a credible event because of the low frequency of postulated initiating events and because the event would be readily detected and mitigated by plant personnel through alarms, flooding, and operator rounds through the SFP area.References 2 and 3 are based on conservative projections of amount ofBoraflex absorber panel degradation assumed in each sub-region. These projections are valid through the end of the year 2006. Based upon  BADGER testing in calendar years 2003, 2006 and 2010 and RACKLIFE code projections, the validity of the criticality and boron dilution analysis documented in References 2, 3, 5 and 6 can be extended through the end of the current license (September 28, 2013). Reference 7 allowed BADGER testing to be performed in 2013, to confirm the progression of localized Boraflex dissolution. The continued validity of the criticality and boron dilution analysis will be verified based on the boron monitoring program as defined in the License Renewal Application. These compensatory measures for boraflex degradation in the SFP were evaluated by the NRC in Reference 4.The concentration of dissolved boron in the spent fuel pit satisfies Criterion 2of 10 CFR 50.36 (c)(2)(ii).
Spent Fuel Pit Boron ConcentrationB 3.7.12 BASES INDIAN POINT 2B 3.7.12 - 3 Revision 2 LCOThe Spent Fuel Pit boron concentration is required to be 2000 ppm. Thespecified concentration of dissolved boron in the Spent Fuel Pit preserves theassumptions used in the analyses of the potential critical accident scenarios as described in Reference 2. This concentration of dissolved boron is theminimum required concentration for fuel assembly storage and movementwithin the Spent Fuel Pit.
______________________________________________________________________________APPLICABILITYThis LCO applies whenever fuel assemblies are stored in the Spent Fuel Pit.ACTIONSA.1 and A.2The Required Actions are modified by a Note indicating that LCO 3.0.3 doesnot apply.When the concentration of boron in the Spent Fuel Pit is less than required,immediate action must be taken to preclude the occurrence of an accident orto mitigate the consequences of an accident in progress. This is most efficiently achieved by immediately suspending the movement of fuel assemblies. The concentration of boron is restored simultaneously with suspending movement of fuel assemblies.If the LCO is not met while moving irradiated fuel assemblies in MODE 5 or 6,LCO 3.0.3 would not be applicable. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operation.
Therefore, inability to suspend movement of fuel assemblies is not sufficient reason to require a reactor shutdown.SURVEILLANCESR  3.7.12.1REQUIREMENTSThis SR verifies that the concentration of boron in the Spent Fuel Pit is within the required limit. As long as this SR is met, the analyzed accidents are fully addressed. The 7 day Frequency is appropriate because no major replenishment of Spent Fuel Pit water is expected to take place over such a short period of time.
Spent Fuel Pit Boron ConcentrationB 3.7.12 BASES INDIAN POINT 2B 3.7.12 - 4 Revision 2REFERENCES 1.10 CFR 50.68, "Criticality Accident Requirements."
2.Northeast Technology Corporation report NET-173-01, "CriticalityAnalysis for Soluble Boron and Burnup Credit in the Con Edison Indian Point Unit No. 2 Spent Fuel Storage Racks."
3.Northeast Technology Corporation report NET-173-02, "Indian Point Unit 2 Spent Fuel Pool (SFP) Boron Dilution Analysis."
4.Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 227 to Facility Operating License No.
DPR-26, May 29, 2002.
5.NETCO Letter to M. R. Hansler from E. Lindquist, Northeast Technology Corp. dated 12/19/06, Subject - Reference 2 and 3
 
extension.
6.NETCO Letter to Floyd Gumble from Matt Harris dated 12/22/2009, titled "Indian Point 2 RACKLIFE Projections Through 2010 and 2012 BADGER Tests with RACKLIFE Version 2.1" 7.NETCO Letter to Giancarlo Delfini from Matt Harris dated 12/12/2012, titled "Update of IP2 RACKLIFE Model - (In partial fulfillment of Entergy Contract 10351857, Change Order No. 1, Task 2A)".
Spent Fuel Pit StorageB 3.7.13 BASES INDIAN POINT 2B 3.7.13 - 1 Revision 4B 3.7  Plant SystemsB 3.7.13 Spent Fuel Pit Storage BASESBACKGROUNDIP2 Fuel AssembliesThe Spent Fuel Pit (SFP) is used to store spent fuel removed from thereactor and new fuel ready for insertion into the reactor. Spent fuel racks (SFRs) are erected on the SFP floor to hold the fuel assemblies. The SFRshave been evaluated to meet the requirements of option (b) of 10CFR 50.68,"Criticality Accident Requirements" (Ref. 1) when: a) Spent Fuel Pit boronconcentration is maintained within the limits of LCO 3.7.12, "Spent Fuel Pit Boron Concentration," and, b) fuel assembly storage location within the Spent Fuel Pit is restricted in accordance with LCO 3.7.13, "Spent Fuel Pit Storage,"
based on the fuel assembly's initial enrichment, burnup, decay of Plutonium-241 (i.e., cooling time), and number of Integral Fuel Burnable Absorbers (IFBA) rods.In 1990, Spent Fuel Pit storage capacity was increased from 980 fuelassemblies to 1376 fuel assemblies by the installation of high-density racks that reduced the distance between adjacent fuel assemblies. This was possible because the k-effective of the SFP was maintained within the limits of 10 CFR 50.68(b) (Ref. 1) by the following: 1) the use of boraflex absorber panels (i.e., neutron absorbers) between SFR cells; and, 2) restrictions on fuel assembly storage location within the SFP based on initial enrichment and burnup. The original design of the high density racks met the requirements of 10 CFR 50.68(b) without crediting soluble boron.The use of high-density SFRs that depend on boraflex absorber panelsbetween cells requires that IP2 adhere to a long-term inspection program to monitor the performance of the boraflex panels. Requirements for theboraflex inspection program are specified in IP2 Amendment 150 (Ref. 2) andGeneric Letter 96-04, "Boraflex Degradation in Spent Fuel Pool Storage
 
Racks" (Ref. 3).During an inspection of the SFRs in 2000, it was determined that theassumptions regarding the boraflex panels used in the criticality analysis for the SFP were no longer valid because of thinning and gaps in the boraflex panels. This degradation of the boraflex panels between SFR cells required that IP2 adopt the "use of soluble boron" option in 10 CFR 50.68(b)(4) which specifies that:
Spent Fuel Pit StorageB 3.7.13 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.7.13 - 2 Revision 4" - If credit is taken for soluble boron, the k-effective of the spent fuelstorage racks loaded with fuel of the maximum fuel assembly reactivity must not exceed 0.95, at a 95 percent probability, 95 percent confidence level, if flooded with borated water, and the k-effective must remain below 1.0 (subcritical), at a 95 percent probability, 95 percent confidence level, if flooded with unborated water."Based on the results of an inspection and analysis that conservatively projected the condition of the boraflex panels through the end of 2006, IP2 compliance with 10 CFR 50.68(b)(4) was confirmed by an analysis documented in Northeast Technology Corporation report NET-173-01, "Criticality Analysis for Soluble Boron and Burnup Credit in the Con Edison Indian Point Unit No. 2 Spent Fuel Storage Racks" (Ref. 4). Based upon BADGER testing in calendar years 2003, 2006 and 2010 and RACKLIFE code projections, the validity of the critically and boron dilution analysis documented in References 4, 5, 7 and 10 can be extended through the end of the current license (September 28, 2013). Based on Reference 11,BADGER testing was performed in 2013, to confirm the progression oflocalized Boraflex dissolution. The continued validity of the criticality and boron dilution analysis will be verified based on the boron monitoring program as defined in the License Renewal Application. This analysis demonstrated that 10 CFR 50.68(b)(4) will be met for all normal and credible accident scenarios if the following requirements are met:
a)Spent Fuel Pit boron concentration is maintained within the limits ofLCO 3.7.12, "Spent Fuel Pit Boron Concentration," whenever fuel is stored in the SFP; and, b)Fuel assembly storage location within the Spent Fuel Pit is restricted in accordance with LCO 3.7.13, "Spent Fuel Pit Storage," based on the fuel assembly's initial enrichment, burnup, decay of Plutonium-241 (i.e., cooling time), and number of Integral Fuel Burnable Absorbers (IFBA) rods.Fuel assembly storage location within the Spent Fuel Pit is an essential element for the validity of the analysis because the storage racks in the areas designated Region 1 have a different design than the storage racks in the areas designated Region 2. These design differences have a significant impact on criticality calculations. Additionally, each of the two regions is sub-divided into two parts based on the extent of the boraflex degradation.
Therefore, the SFP is divided into four distinct regions based on rack design and boraflex degradation. Figure 3.7.13-5 identifies the four regions as Region 1-1, Region 1-2, Region 2-1 and Region 2-2. Additionally, selected cells located on the perimeter of Region 2-2 have higher neutron leakage rates than other cells in the Region and are designated as "peripheral" cells.
Spent Fuel Pit StorageB 3.7.13 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.7.13 - 3 Revision 4Each SFP region and sub-region is shown in Figure 3.7.13-5 and is describedbelow beginning with the region that can be used to store only the least reactive fuel and ending with the region that must be used to store the most reactive fuel.
Region 2, consisting of nine racks that use the egg-crate design, can store1105 fuel assemblies and two failed fuel canisters. Region 2 racks consist ofboxes welded into a "checkerboard" array with a storage location in each square. One Boraflex absorber panel is held to one side of each cell wall by picture frame sheathing. Region 2 racks were originally designed to storefuel assemblies that have undergone significant burnup (e.g., 5.0 weight percent (w/o) U 235 with a burnup of at least 40,900 megawatt days per metricton (MWD/MT)) or fuel assemblies with a relatively low initial enrichment and low burnup (i.e., 1.764 w/o U 235 at zero burnup).Region 2 is subdivided into two regions (Region 2-1 and Region 2-2):Region 2-1 is assumed to have sustained a 100% loss of Boraflex(i.e., none of the boraflex in the panels is assumed to be available).Figure 3.7.13-1 shows the fuel assembly criteria that will meet the requirements of 10 CFR 50.68(b)(4) if stored in Region 2-1. As shown on Figure 3.7.13-1, the maximum initial enrichment that can be stored in Region 2-1 with no burnup is 1.06 w/o U 235. Figure 3.7.13-1shows an allowance permitting storage of fuel assemblies with higher initial enrichments based on the reactivity reduction due to the cumulative burnup of the fuel assembly in the core and the decay of
 
Pu 241 (expressed as cooling time) after a fuel assembly is discharged.Region 2-2 is assumed to have sustained only a 30% loss of Boraflex(i.e., 70% of the boraflex in the panels is assumed to be available).
Figure 3.7.13-2 shows the fuel assembly criteria that will meet the requirements of 10 CFR 50.68(b)(4) if stored in Region 2-2. As shown on Figure 3.7.13-2, the maximum initial enrichment that can be stored in Region 2-2 with no burnup is 1.80 w/o U 235. Additionally, Figure3.7.13-2 shows an allowance permitting storage of fuel assemblies with higher initial enrichments based on the reactivity reduction due to the cumulative burnup of the fuel assembly in the core and the decay (expressed as cooling time) of Pu 241 after a fuel assembly isdischarged.
Region 1, consisting of three racks that use the flux trap design, can store269 new or irradiated fuel assemblies. The flux trap design used in Region 1 uses spacer plates in the axial direction to separate the cells. Boraflex absorber panels are held in place adjacent to each side of the cell by Spent Fuel Pit StorageB 3.7.13 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.7.13 - 4 Revision 4picture-frame sheathing. The spacer plates between cells form a flux trapbetween the boraflex absorber panels. Region 1 racks were originally designed to store new fuel with enrichments up to 5.0 w/o U 235.Region 1 is subdivided into two regions (Region 1-1 and Region 1-2):Region 1-1 is assumed to have sustained a 100% loss of Boraflex(i.e., none of the boraflex in the panels is assumed to be available).
Figure 3.7.13-3 shows the fuel assembly criteria that will meet the requirements of 10 CFR 50.68(b)(4) if stored in Region 1-1. As shown on Figure 3.7.13-3, the maximum initial enrichment that can be stored in Region 1-1 with no burnup is 1.95 w/o U 235. Additionally,Figure 3.7.13-3 shows an allowance permitting storage of fuel assemblies with higher initial enrichments based on the reactivity reduction due to the cumulative burnup of the fuel assembly in the core. Figure 3.7.13-3 does not provide any allowance from the minimum required fuel assembly burnup based on the decay of Pu 241.(Fuel assemblies that do not meet the criteria in Figure 3.7.13-3 may be stored in Region 1-1 if the following two conditions are met: a) thefuel assemblies are stored in a checkerboard loading configuration(1 out of every two cells with every other cell vacant); and, b) fuel assemblies meet the criteria of Figure 3.7.13-4.)Region 1-2 is assumed to have sustained a 50% loss of Boraflex(i.e., 50% of the boraflex in the panels is assumed to be available).Region 1-2 can accommodate unirradiated fuel up to 5.0 w/o U 235assuming the presence of a minimum number of IFBA rods as specified in Figure 3.7.13-4. As shown on Figure 3.7.13-4, the maximum initial enrichment that can be stored in Region 1-2 when there are no IFBA rods is 4.50 w/o U 235. Figure 3.7.13-4 does notProvide any allowance from the minimum required IFBA rods based on the decay of PU 241.Peripheral" Cells, consisting of six select cells along the SFP west wall inRegion 2-2, are shown in Figure 3.7.13-5. These six "peripheral" cells may be used to store fuel that meets the requirements for storage in any other location in the SFP. Cells between and adjacent to the "peripheral" cells may be filled with fuel assemblies that meet the requirements of Figure 3.7.13-2 (i.e., meet the requirements for storage in Region 2-2). The two prematurely discharged fuel assemblies meet the requirements of Figure 3.7.13-4 and qualify for storage in the "peripheral" cells.
Spent Fuel Pit StorageB 3.7.13 BASESBACKROUND (continued)
INDIAN POINT 2B 3.7.13 - 5 Revision 4IP3 Fuel AssembliesThe SFP is also used to store spent fuel transferred from the IP3 SFP. The IP3 fuel assembly storage location is also restricted in accordance with LCO 3.7.13 that limits IP3 fuel assemblies to Region 1-2 of the IP2 SFP. The NRC has issued Amendment 268 for the inter-unit transfer of spent nuclear fuel (Ref. 8). The Amendment is based on evaluations conducted for each aspect of the inter-unit transfer of fuel as documented in Reference 9.APPLICABLEIP2 Fuel Assemblies SAFETY ANALYSESAs required by 10 CFR 50.68, "Criticality Accident Requirements" (Ref. 1), if the Spent Fuel Pit takes credit for soluble boron, then "the k-effective of the spent fuel storage racks loaded with fuel of the maximum fuel assembly reactivity must not exceed 0.95, at a 95 percent probability, 95 percent confidence level, if flooded with borated water, and the k-effective must remain below 1.0 (subcritical), at a 95 percent probability, 95 percent confidence level, if flooded with unborated water."NET-173-01, "Criticality Analysis for Soluble Boron and Burnup Credit in theCon Edison Indian Point Unit No. 2 Spent Fuel Storage Racks" (Ref. 4) and NET-173-02, "Indian Point Unit 2 Spent Fuel Pool (SFP) Boron Dilution Analysis," (Ref. 5) determined that 10 CFR 50.68(b)(4) will be met during normal SFP operation and all credible accident scenarios (including the affects of boraflex degradation) if: a) Spent Fuel Pit boron concentration is maintained within the limits of LCO 3.7.12, "Spent Fuel Pit Boron Concentration," and, b) fuel assembly storage location within the Spent Fuel Pit is restricted based on the fuel assembly's initial enrichment, burnup, decay of Pu 241 (i.e., cooling time) and number of Integral Fuel BurnableAbsorbers (IFBA) rods.
Spent Fuel Pit StorageB 3.7.13 BASESAPPLICABLE SAFETY ANALYSIS (continued)
INDIAN POINT 2B 3.7.13 - 6 Revision 4Reference 4 evaluated non-accident conditions in the SFP including theaffects of the projected boraflex degradation through the year 2006. Based upon BADGER testing in calendar years 2003, 2006 and 2010 and RACKLIFE code projections, the validity of the critically and boron dilution analysis documented in References 4, 5, 7 and 10 can be extended through the end of the current license (September 28, 2013). Based on Reference 11 BADGER testing was performed in 2013, to confirm the progression of localized Boraflex dissolution. The continued validity of the criticality and boron dilution analysis will be verified based on the boron monitoring program as defined in the License Renewal Application. Reference 4 determined that if storage location requirements in this LCO are met then theSFP will have a keff of 0.95 if filled with a soluble boron concentration of 786 ppm and will have a keff of <1.0 if filled with unborated water.Reference 4 also evaluated credible abnormal occurrences in accordancewith ANSI/ANS-57.2-1983. This evaluation considered the effects of the following: a) a dropped fuel assembly or an assembly placed alongside a rack; b) a misloaded fuel assembly; and, c) abnormal heat loads.Reference 4 determined that the SFP will maintain a keff of 0.95 under theworst-case accident scenario if the SFP is filled with a soluble boron concentration of 1495 ppm.Therefore, reference 4 confirmed that the requirements in 10 CFR 50.68,"Criticality Accident Requirements," (Ref. 1) will be met for both normal SFP operation and credible abnormal occurrences if:
a)Spent Fuel Pit boron concentration is maintained within the limits ofLCO 3.7.12, "Spent Fuel Pit Boron Concentration," whenever fuel is stored in the SFP; and, b)Fuel assembly storage location within the Spent Fuel Pit is restricted in accordance with LCO 3.7.13, "Spent Fuel Pit Storage," based on the fuel assembly's initial enrichment, burnup, decay of Plutonium-241 (i.e., cooling time), and number of Integral Fuel Burnable Absorbers (IFBA) rods.Reference 5 evaluated postulated unplanned SFP boron dilution scenarios assuming an initial SFP boron concentration within the limits of LCO 3.7.12.The evaluation considered various scenarios by which the SFP boronconcentration may be diluted and the time available before the minimum boron concentration necessary to ensure subcriticality for the non-accident condition (i.e. it is not assumed an assembly is misloaded concurrent with the Spent Fuel Pit dilution event). Reference 5 determined that an unplanned or Spent Fuel Pit StorageB 3.7.13 BASESAPPLICABLE SAFETY ANALYSIS (continued)
INDIAN POINT 2B 3.7.13 - 7 Revision 4inadvertent event that could dilute the SFP boron concentration from2000 ppm to 786 ppm is not a credible event because of the low frequency of postulated initiating events and because the event would be readily detected and mitigated by plant personnel through alarms, flooding, and operator rounds through the SFP area.Reference 4 and 5 are based on conservative projections of amount ofBoraflex absorber panel degradation assumed in each sub-region. These projections are valid through the end of the year 2006. These compensatory measures for boraflex degradation in the SFP were evaluated by the NRC in Reference 6. Based upon BADGER testing in calendar years 2003, 2006 and 2010 and RACKLIFE code projections, the validity of the critically and boron dilution analysis documented in References 4, 5, 7 and 10 can be extended through the end of the current license (September 28, 2013). Based onReference 11, BADGER testing was performed in 2013, to confirm theprogression of localized Boraflex dissolution. The continued validity of the criticality and boron dilution analysis will be verified based on the boron monitoring program as defined in the License Renewal Application.IP3 Fuel AssembliesAn analysis, documented in Reference 9, evaluated the effect of modelingIP3 integral and discrete burnable absorbers on reactivity in the IP2 spent fuel pool using current methodologies. A reactivity bias was determined. In order to offset this bias, and maintain the validity of the IP2 SFP criticality analysis, it was determined that IP3 fuel assemblies can be stored in the IP2 SFP with the following restrictions:a. IP3 fuel assemblies shall be stored in Region 1-2 of the IP2Spent Fuel Pit, andb. The fuel assembly initial enrichment > 3.2 and < 4.4 w/o U235, andc. The fuel assembly discharge Cycle > 1 and < 11.The configuration of fuel assemblies in the Spent Fuel Pit satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
Spent Fuel Pit StorageB 3.7.13 BASES INDIAN POINT 2B 3.7.13 - 8 Revision 4 LCOIP2 Fuel AssembliesThis LCO establishes restrictions on fuel assembly storage location within theSFP to ensure that the requirements of 10 CFR 50.68 are met. This LCO requires that each fuel assembly stored in the Spent Fuel Pit is classified in accordance with Figure 3.7.13-1, Figure 3.7.13-2, Figure 3.7.13-3, and Figure 3.7.13-4, based on initial enrichment, burnup, cooling time and number of Integral Fuel Burnable Absorbers (IFBA) rods; and, that fuel assembly storage location within the Spent Fuel Pit is restricted to Regions identified in Figure 3.7.13-5 as follows:a. Fuel assemblies that satisfy requirements of Figure 3.7.13-1 may be storedin any location in Region 2-1, Region 2-2, Region 1-2 or Region 1-1.
As shown on Figure 3.7.13-1, the maximum initial enrichment that can bestored in Region 2-1 with no burnup is 1.06 w/o U 235. Additionally, Figure3.7.13-1 shows an allowance permitting storage of fuel assemblies with higher initial enrichments based on the reactivity reduction due to the cumulative burnup of the fuel assembly in the core and the decay of Pu 241after a fuel assembly is discharged (expressed as cooling time).b. Fuel assemblies that satisfy requirements of Figure 3.7.13-2 may bestored in any location in Region 2-2, Region 1-2 or Region 1-1.As shown on Figure 3.7.13-2, the maximum initial enrichment that can bestored in Region 2-2 with no burnup is 1.80 w/o U 235. Additionally, Figure3.7.13-2 shows an allowance permitting storage of fuel assemblies with higher initial enrichments based on the reactivity reduction due to the cumulative burnup of the fuel assembly in the core and the decay (expressed as cooling time) of Pu 241 after a fuel assembly is discharged.c. Fuel assemblies that satisfy requirements of Figure 3.7.13-3 may bestored in any location in Region 1-2 or Region 1-1.As shown on Figure 3.7.13-3, the maximum initial enrichment that can bestored in Region 1-1 with no burnup is 1.95 w/o U 235. Additionally, Figure3.7.13-3 shows an allowance permitting storage of fuel assemblies with higher initial enrichments based on the reactivity reduction due to the cumulative burnup of the fuel assembly in the core. Figure 3.7.13-3 does not provide any allowance from the minimum required fuel assembly burnup based on the decay of Pu 241.(Fuel assemblies that do not meet the criteria in Figure 3.7.13-3 may bestored in Region 1-1 if the fuel assemblies are stored in a checkerboard Spent Fuel Pit StorageB 3.7.13 BASES LCO (continued)
INDIAN POINT 2B 3.7.13 - 9 Revision 4loading configuration (1 out of every two cells with every other cell vacant) and fuel assemblies meet the criteria of Figure 3.7.13-4.)d. Fuel assemblies that satisfy requirements of Figure 3.7.13-4 may bestored as follows:  1) In any location in Region 1-2; or, 2) In acheckerboard loading configuration (1 out of every two cells with every other cell vacant) in Region 1-1; or, 3) In locations designated as "peripheral" cells in Region 2-2 of Figure 3.7.13-5.As shown on Figure 3.7.13-4, the maximum initial enrichment that can bestored in Region 1-2 with when there are no IFBA rods is 4.50 w/o U 235.Figure 3.7.13-4 does not provide any allowance from the minimum required IFBA rods based on the decay of Pu 241.The six "peripheral" cells may be used to store fuel that meets the requirements for storage in any location in the SFP (i.e., meets requirements for storage in Region 1-1, 1-2, 2-1 or 2-2). Cells between and adjacent to the "peripheral" cells may be filled with fuel assemblies that meet the requirements of Figure 3.7.13-2 (i.e., meet the requirements for storage in Region 2-2). The two prematurely discharged fuel assemblies meet the requirements of Figure 3.7.13-4 and qualify for storage in canisters that are loaded in Module H in the southeast corner of the SFP. Module H is in the upper right corner of the SFP in Figure 3.7.13-5.IP3 Fuel AssembliesThis LCO establishes restrictions on fuel assembly storage location within theSFP to ensure that the requirements of 10 CFR 50.68 are met.APPLICABILITYThis LCO applies whenever any fuel assembly is stored in the Spent Fuel Pit.ACTIONS A.1Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.When the configuration of fuel assemblies stored in the Spent Fuel Pit is notin accordance with the rules established by LCO 3.7.13, the immediate action is to initiate action to make the necessary fuel assembly movement(s)
Spent Fuel Pit StorageB 3.7.13 BASESACTIONS (continued)
INDIAN POINT 2B 3.7.13 - 10 Revision 4to bring the configuration into compliance with the rules established by LCO 3.7.13.If unable to move irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3would not be applicable. If unable to move irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the action is independent of reactor operation.
Therefore, inability to move fuel assemblies is not sufficient reason to require a reactor shutdown.SURVEILLANCESR  3.7.13.1REQUIREMENTSThis SR verifies by administrative means that the IP2 fuel assembly has beenclassified based on initial enrichment, burnup, cooling time and number of Integral Fuel Burnable Absorbers (IFBA) rods in the fuel assembly in accordance with Figure 3.7.13-1, Figure 3.7.13-2, Figure 3.7.13-3, or Figure 3.7.13-4 and that the fuel assembly meets the requirements for the intended storage location defined on Figure 3.7.13-5. This SR also verifies by administrative means that the IP3 fuel assembly meets the requirements for storage in the IP2 SFP. This administrative verification must be completed prior to placing any fuel assembly in the SFP. This SR ensures that this LCO and Specification 4.3.1.1 will be met after the fuel assembly is inserted in the
 
SFP.REFERENCES 1.10 CFR 50.68, "Criticality Accident Requirements."
2.Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 150 to Facility Operating License No.
DPR-26, April 19, 1990.
3.Generic Letter 96-04, "Boraflex Degradation in Spent Fuel Pool Storage Racks."
4.Northeast Technology Corporation report NET-173-01, "Criticality Analysis for Soluble Boron and Burnup Credit in the Con Edison Indian Point Unit No. 2 Spent Fuel Storage Racks."
5.Northeast Technology Corporation report NET-173-02, "Indian Point Unit 2 Spent Fuel Pool (SFP) Boron Dilution Analysis."
6.Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 227 to Facility Operating License No.
DPR-26, May 29, 2002.
Spent Fuel Pit StorageB 3.7.13 BASESREFERENCES (continued)
INDIAN POINT 2B 3.7.13 - 11 Revision 4 7.NETCO Letter to M. R. Hansler from E. Lindquist, NortheastTechnology Corp. dated 12/19/06, Subject - Reference 4 and 5
 
extension.
8.Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 268 to Facility Operating License No.
DPR-26, July 13, 2012.
9.Holtec Report HI-2094289, Licensing Report on the Inter-Unit Transfer of Spent Nuclear Fuel at Indian Point Energy Center, Revision 6.10. NETCO Letter to Floyd Gumble from Matt Harris dated 12/22/2009,titled "Indian Point 2 RACKLIFE Projections Through 2010 and 2012 BADGER Tests with RACKLIFE Version 2.1".11. NETCO Letter to Giancarlo Delfini from Matt Harris dated 12/12/2012,titled "Update of IP2 RACKLIFE Model - (In partial fulfillment of Entergy Contract 10351857, Change Order No. 1, Task 2A)".
Secondary Specific Activity B 3.7.14 INDIAN POINT 2 B 3.7.14 - 1 Revision 1 B 3.7  PLANT SYSTEMS B 3.7.14 Secondary Specific Activity BASESBACKGROUND Activity in the secondary coolant results from steam generator tube inleakage from the Reactor Coolant System (RCS). The noble gas activity entering the secondary coolant is immediately released to the environment.
The iodine activity will build to an equilibrium based on decay, inleakage rate, and blowdown rate. A limit on secondary coolant specific iodine activity during power operation minimizes releases to the environment because of normal operation, anticipated operational occurrences, and accidents. The steam line failure is assumed to result in the release of all the iodine activity contained in the faulted steam generator and a small fraction of the iodine activity present in the non-faulted steam generators. APPLICABLE SAFETY ANALYSESAt Indian Point 2, the radiological consequence analyses demonstrate compliance with 10 CFR 50.67, Accident Source Term (References 1 and 2). The accident analyses assume the initial secondary coolant specific activity  to have a radioactive isotope concentration of 0.15 &#xb5;Ci/gm DOSE EQUIVALENT I-131. This assumption is used in the analysis for determining the radiological consequences of the postulated accidents. The accident analysis, based on this and other assumptions, shows that the radiological consequences of a Main Steam Line Break (MSLB) and Steam Generator Tube Rupture (SGTR) are within the limits of Reference 1.
Secondary Specific Activity B 3.7.14 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.7.14 - 2 Revision 1 The analysis of the Main Steam Line Break assumes that all of the primary to secondary leakage to the faulted steam generator is released to the environment with no credit for iodine and particulate retention in the steam generator. The entire liquid inventory in the steam generator with the steamline break, referred to as the faulted steam generator, is assumed to be steamed off and all of the iodine initially in the steam generator is assumed to be released to the environment. It is assumed that primary to secondary leakage to the intact steam generators would continue at a rate of 150 gpd per steam generator. Because offsite power is assumed to be lost, the main condenser is assumed to be unavailable for steam dump and cooling of the reactor core is assumed to occur through the safety valves (Ref. 2). Any noble gas carried over to the secondary side through primary to secondary leakage is assumed to be immediately released to the environment. At 30 hours after the accident, the RHR system is assumed to be capable of all decay heat removal and there are no further steam releases to the environment from the secondary system. Activity releases from the faulted steam generator continue until the primary coolant temperature is reduced to less than 212F at 65 hours (Ref. 2). Secondary specific activity limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). LCOAs indicated in the Applicable Safety Analyses, the specific activity of the secondary coolant is required to be  0.15 &#xb5;Ci/gm DOSE EQUIVALENT I-131 to limit the radiological consequences of a Design Basis Accident (DBA) to applicable limits (Ref. 2). Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the unit in an operational MODE that would minimize the radiological consequences of a DBA. APPLICABILITY In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere. In MODES 5 and 6, the steam generators are not being used for heat removal. Both the RCS and steam generators are depressurized, and primary to secondary LEAKAGE is minimal. Therefore, monitoring of secondary specific activity is not required.
Secondary Specific Activity B 3.7.14 BASESINDIAN POINT 2 B 3.7.14 - 3 Revision 1 ACTIONS A.1 and A.2DOSE EQUIVALENT I-131 exceeding the allowable value in the secondary coolant, is an indication of a problem in the RCS and contributes to increased post accident doses. If the secondary specific activity cannot be restored to within limits immediately, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. SURVEILLANCE SR  3.7.14.1 REQUIREMENTSThis SR verifies that the secondary specific activity is within the limits of the accident analysis. A gamma isotopic analysis of the secondary coolant, which determines DOSE EQUIVALENT I-131, confirms the validity of the safety analysis assumptions as to the source terms in post accident releases. It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in reactor coolant activity or LEAKAGE. The 31 day Frequency is based on the detection of increasing trends of the level of DOSE EQUIVALENT I-131, and allows for appropriate action to be taken to maintain levels below the LCO limit. REFERENCES 1. 10 CFR 50.67. 2. WCAP-16157, "Indian Point Unit 2 Stretch Power Uprating Licensing Report," January 2004.
AC Sources - OperatingB 3.8.1 INDIAN POINT 2B 3.8.1 - 1 Revision 7B 3.8  ELECTRICAL POWER SYSTEMSB 3.8.1AC Sources - Operating BASESBACKGROUNDThe unit AC Electrical Power Distribution System AC sources consist of thefollowing: two offsite circuits (a 138 kV circuit and a 13.8 kV circuit), each of which has a preferred and backup feeder; and, the onsite standby power circuit consisting of three diesel generators. As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.The plant distribution system is configured around 6.9 kV buses Nos. 1, 2, 3,4, 5, and 6. All offsite power to the safeguards buses enters the plant via 6.9 kV buses Nos. 5 and 6. 6.9 kV buses Nos. 5 and 6 are normally supplied by the 138 kV offsite circuit but may be supplied by the 13.8 kV offsite circuit.
When the plant is operating, 6.9 kV buses 1, 2, 3, and 4 (which supply power to the four reactor coolant pumps) typically receive power from the main generator via the unit auxiliary transformer (UAT). However, when the main generator or UAT is not capable of supporting this arrangement, 6.9 kV buses 1 and 2 receive offsite power via 6.9 kV bus 5 and 6.9 kV buses 3 and 4 receive offsite power via 6.9 kV bus 6. Following a unit trip, 6.9 kV buses 1,2, 3, and 4 will auto transfer (dead fast transfer) to 6.9 kV buses 5 and 6 inorder to receive offsite power.The 6.9 kV buses Nos. 2, 3, 5 and 6 supply power to the 480 V safeguardspower buses using 6.9 kV/480 V station service transformers (SSTs) as follows:a. 6.9 kV bus 5 supplies 480 V bus 5A via SST 5;b. 6.9 kV bus 6 supplies 480 V bus 6A via SST 6;
: c. 6.9 kV bus 2 supplies 480 V bus 2A via SST 2; and,
: d. 6.9 kV bus 3 supplies 480 V bus 3A via SST 3.The onsite AC Power Distribution System begins with the four 480 Vsafeguards power buses 5A, 6A, 2A and 3A. The four 480 V safeguards power buses can be supplied by either of the two offsite circuits or the emergency diesel generators. The onsite Power Distribution System is divided into the following:a. Three safeguards power trains (trains) consisting of the 480 voltsafeguards bus(es) and associated AC electrical power distributionsubsystems; AC Sources - OperatingB 3.8.1 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.8.1 - 2 Revision 7b. Four 125 volt DC bus subsystems; andc. Four 118 volt vital AC instrument subsystems.The three safeguards power trains are designed so that any two trains arecapable of meeting minimum requirements for accident mitigation and/or safe shutdown. The three safeguards power trains are as follows:a. train 5A (480 volt bus 5A and associated DG 21);b. train 6A (480 volt bus 6A and associated DG 23); andc. train 2A/3A (480 volt buses 2A and 3A and associated DG 22).OFFSITE SOURCESAn offsite circuit consists of all breakers, transformers, switches, interruptingdevices, cabling, and controls required to transmit power from the offsite transmission network to the onsite 480 V ESF bus(es). A detailed description of the offsite power network and the circuits to the 480 V safeguards buses is found in the UFSAR, Chapter 8 (Ref. 2).Offsite power is supplied from the offsite transmission network to the plant bytwo electrically and physically separated circuits (a 138 kV circuit and a 13.8 kV circuit). All offsite power enters the plant via 6.9 kV buses Nos. 5 and 6 which are normally connected to the 138 kV offsite circuit but have the ability to be connected to the 13.8 kV offsite circuit. The 138 kV offsite circuit satisfies the requirement in GDC 17 that at least one of the two required circuits can, within a few seconds, provide power to safety-related equipment following a loss-of-coolant accident. The 13.8 kV offsite circuit is considered a delayed access circuit because operator action is normally required to supply offsite power to the plant using the 13.8 kV offsite source.Both the 138 kV offsite circuit and the 13.8 kV offsite circuit have a preferredand a backup feeder that connects the circuit to the Buchanan substation.
For both the 138 kV and 13.8 kV offsite circuits, the preferred IP2 feeder is the backup IP3 feeder and the backup IP2 feeder is the preferred IP3 feeder.For the 138 kV offsite circuit, IP2 and IP3 each have a dedicated StationAuxiliary Transformer (SAT) that can be supplied by either the preferred or the backup 138 kV feeder. The 138 kV offsite circuit, including the SAT used exclusively for IP2, is designed to supply all IP2 loads, including 4 operating RCPs and ESF loads, when using either the preferred (95332) or backup (95331) feeder. There are no restrictions when IP2 and IP3 are both using the same 138 kV feeder concurrently.
AC Sources - OperatingB 3.8.1 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.8.1 - 3 Revision 7For the 13.8 kV offsite circuit, there is a 13.8 kV/6.9 kV auto-transformerassociated with feeder 13W92 and a 13.8 kV/6.9 kV auto-transformer associated with feeder 13W93. Feeder 13W92 and its associated auto-transformer is the preferred feeder for the IP2 13.8 kV circuit and the backup feeder for the IP3 13.8 kV circuit. Feeder 13W93 and its associated auto-transformer is the backup feeder for the IP2 13.8 kV circuit and the preferred feeder for the IP3 13.8 kV circuit.Certain required unit loads are returned to service in a predeterminedsequence in order to prevent overloading the transformer supplying offsite power to the onsite Distribution System. Within 1 minute after the initiating signal is received, all automatic and permanently connected loads needed to recover the unit or maintain it in a safe condition are returned to service via individual load timers associated with each large load.ONSITE SOURCESThe onsite standby power source consists of three 480 V diesel generators(DGs) with a separate DG dedicated to each of the safeguards power trains.
Safeguards power train 5A (480 V bus 5A) is supported by DG 21; safeguards power train 6A (480 V bus 6A) is supported by DG 23; and, safeguards power train 2A/3A (480 V buses 2A and 3A) is supported by DG 22. A DG starts automatically on a safety injection (SI) signal or on an ESF bus degraded voltage or undervoltage signal (refer to LCO 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation"). After the DG has started, it will automatically tie to its respective bus after offsite power is tripped as a consequence of ESF bus 5A or 6A undervoltage or degraded voltage, coincident with an SI signal or unit trip. The DGs will also start and operate in the standby mode without tying to the ESF bus on an SI signal alone. Following the trip of offsite power, an undervoltage signal strips nonpermanent loads from the ESF bus. When the DG is tied to the ESF bus, loads are then sequentially connected to its respective ESF bus by individual load timers. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading the DG by automatic load application.
AC Sources - OperatingB 3.8.1 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.8.1 - 4 Revision 7In the event of a loss of the 138 kV offsite circuit, the ESF electrical loads areautomatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a loss of coolant accident (LOCA).Certain required unit loads are returned to service in a predeterminedsequence in order to prevent overloading the DG in the process. Within 1 minute after the initiating signal is received, all loads needed to recover the unit or maintain it in a safe condition are returned to service.Each diesel generator consists of an Alco Model 16-251-E engine coupledto a Westinghouse 900 rpm, 3-phase, 60-cycle, 480 V generator. The ESF loads that are powered from the 480 V ESF buses are listed in Reference 2. The DG ratings (Reference 12) are as follows:Continuous Normal steady-state electrical power output capability thatcan be maintained 24 hours/day, with no time constraint.2-hourAn overload electrical power output capability that can bemaintained for up to 2 hours in any 24-hour period.1/2-hourAn overload electrical power output capability that can bemaintained for up to 30 minutes in any 24 hour period.The electrical output capabilities applicable to these three ratings are asfollows:RATING DG LOADTIME CONSTRAINTContinuous < 1750 kW None 2-hour< 2100 kW< 2 hours in any 24-hour period 1/2-hour< 2300 kW< 30 minutes in any 24-hour periodThe loading cycle (1/2 -hour, 2-hour, continuous) may be repeated insuccessive 24-hour periods. Operation in excess of 2300 kW, regardless of duration is not analyzed. In such cases, the DG is assumed to be inoperable and the vendor should be consulted.
AC Sources - OperatingB 3.8.1 BASESApplicable Safety Analyses INDIAN POINT 2B 3.8.1 - 5 Revision 7APPLICABLE SAFETY ANALYSESThe initial conditions of DBA and transient analyses in the UFSAR, Chapter 6 (Ref. 4) and Chapter 14 (Ref. 5), assume ESF systems are OPERABLE. The AC electrical power sources are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.The OPERABILITY of the AC electrical power sources is consistent with theinitial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This results in maintaining at least 2 of the 3 safeguards power trains energized from either onsite or offsite AC sources during accident conditions in the event of:a. An assumed loss of all offsite power or all onsite AC power and
: b. A worst case single failure.
The AC sources satisfy Criterion 3 of 10 CFR 50.36.
LCOTwo qualified circuits between the offsite transmission network and the onsiteElectrical Power System and separate and independent DGs for each train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated DBA.Qualified offsite circuits are those that are described in the UFSAR and arepart of the licensing basis for the unit. In addition, required individual load timers for ESF loads must be OPERABLE unless associated with equipment that has automatic initiation capability disabled.Each offsite circuit must be capable of maintaining rated frequency andvoltage, and accepting required loads during an accident, while connected to the ESF buses.There are two qualified circuits from the transmission network at theBuchanan substation to the onsite electric distribution system. Each of these circuits must be supported by a circuit from the offsite network into the Buchanan substation that is physically independent from the other circuit to the extent practical. The circuits into the Buchanan substation that satisfy AC Sources - OperatingB 3.8.1 BASES LCO  (continued)
INDIAN POINT 2B 3.8.1 - 6 Revision 7these requirements are 96951, 96952 and 95891. The 138 kV connection toBuchanan substation from the Westchester Refuse Energy Services Company (RESCO) plant may not be used to satisfy requirements for a circuit from the offsite network into the Buchanan substation.The 138 kV offsite circuit consists of the following:
: a. Either 138 kV feeder 95332 (the preferred feeder for IP2 and thebackup feeder for IP3) or 138 kV feeder 95331 (the backup feeder forIP2 and the preferred feeder for IP3);b. The 138 kV/6.9 kV station auxiliary transformer including the automatictap changer, circuit breakers ST5 and ST6 which supply 6.9 kV buses 5
 
and 6, andc. The following components which are common to both the 138 kV and13.8 kV offsite circuits:i. The supply to 480 V bus 5A consisting of 6.9 kV bus 5, circuitbreaker SS5, station service transformer 5, and circuit breaker 52/5A;ii. The supply to 480 V bus 6A consisting of 6.9 kV bus 6, circuitbreaker SS6, station service transformer 6, and circuit
 
breaker 6A;iii. The supply to 480 V bus 2A consisting of 6.9 kV bus 5, circuitbreaker UT2-ST5 (including fast transfer function), 6.9 kV bus 2, circuit breaker SS2, station service transformer 2, and circuit
 
breaker 52/2A; andiv. The supply to 480 V bus 3A consisting of 6.9 kV bus 6, circuitbreaker UT3-ST6 (including fast transfer function), 6.9 kV bus 3,circuit breaker SS3, station service transformer 3, and circuit
 
breaker 52/3A.LCO 3.8.1 is modified by a Note that requires that the automatic transferfunction for 6.9 kV buses 1, 2, 3, and 4 from the UAT (main generator) to6.9 kV buses 5 and 6 (the 138 offsite circuit) to be OPERABLE whenever the138 kV offsite circuit is being used to supply 6.9 kV bus 5 and 6 and the Unit Auxiliary Transformer (main generator) is supplying 6.9 kV bus 1, 2, 3 or 4.
This is necessary to ensure that safeguards power train 2A/3A (480 volt buses 2A and 3A) will be transferred automatically from the UAT (main generator) to 6.9 kV buses 5 and 6 (the 138 offsite circuit) following a plant trip.
AC Sources - OperatingB 3.8.1 BASES LCO  (continued)
INDIAN POINT 2B 3.8.1 - 7 Revision 7The 13.8 kV offsite circuit consists of the following:a. Either 13.8 kV feeder 13W92 and its associated 13.8/6.9 kVautotransformer (the preferred for IP2 and the backup feeder for IP3) or13.8 kV feeder 13W93 and its associated 13.8/6.9 kV autotransformer (the backup for IP2 and the preferred feeder for IP3),b. Circuit breakers GT25 and GT26, which supply 6.9 kV buses 5 and 6, andc. The following components which are common to both the 138 kV and13.8 kV offsite circuits:i. The supply to 480 V bus 5A consisting of 6.9 kV bus 5, circuitbreaker SS5, station service transformer 5, and circuit breaker 52/5A;ii. The supply to 480 V bus 6A consisting of 6.9 kV bus 6, circuitbreaker SS6, station service transformer 6, and circuit breaker
 
6A;iii. The supply to 480 V bus 2A consisting of 6.9 kV bus 5, circuitbreaker UT2-ST5 (not including fast transfer function), 6.9 kV bus 2, circuit breaker SS2, station service transformer 2, and circuit breaker 52/2A; andiv. The supply to 480 V bus 3A consisting of 6.9 kV bus 6, circuitbreaker UT3-ST6 (not including the fast transfer function), 6.9 kVbus 3, circuit breaker SS3, station service transformer 3, and circuit breaker 52/3A.If the 13.8 kV offsite circuit is being used to supply 6.9 kV bus 5 and/or 6 andthe Unit Auxiliary Transformer (main generator) is supplying 6.9 kV bus 1, 2, 3 or 4, the automatic transfer of 6.9 kV buses 1, 2, 3, and 4 from the UAT (main generator) to 6.9 kV buses 5 and 6 (the 13.8 offsite circuit) must be disabled.
This is necessary because neither the preferred or the backup 13.8 kV/6.9 kV auto-transformer is capable of supplying all 4 operating RCPs. This requirement is not intended to preclude supplying 6.9 kV buses 1, 2, 3, and 4 using the 13.8 kV offsite circuit via the 13.8 kV/6.9 kV auto-transformers once sufficient loads have been stripped from 6.9 kV buses 1, 2, 3, and 4 to assure that the 13.8 kV/6.9 kV auto-transformer will not be overloaded by these manual actions.If IP3 and IP2 are both using a single 13.8 kV feeder (13W92 or 13W93),administrative controls are used to ensure that the 13.8 kV/6.9 kV auto-transformer load restrictions will not be exceeded.
AC Sources - OperatingB 3.8.1 BASES LCO  (continued)
INDIAN POINT 2B 3.8.1 - 8 Revision 7Operability of the offsite power sources requires the ability to provide therequired capacity during design basis conditions. The minimum offsite voltage necessary to provide the required capacity was determined, using system load flow studies with conservative assumptions (Reference 11), to be greater than or equal to 136 kV and 13.4 kV for the 138 kV and 13.8 kV circuits, respectively. Upon notification by Con Ed that these limits are not met, the LCO is considered not met at the time of the initial alarm. When the grid monitoring system is operating the minimum acceptable voltage varies with grid conditions and Con Ed will provide notification.Each DG must be capable of starting, accelerating to rated speed andvoltage, and connecting to its respective ESF bus on detection of bus undervoltage. This will be accomplished within 10 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF buses.Proper sequencing of loads, including tripping of nonessential loads, is arequired function for DG OPERABILITY.The AC sources in safeguards power train must be separate andindependent (to the extent possible) of the AC sources in the other train. For the DGs, separation and independence are complete.For the offsite AC sources, separation and independence are to the extentpractical. A circuit may be connected to more than one ESF bus and not violate separation criteria. An offsite circuit that is not connected to an ESF bus is required to have OPERABLE automatic or manual transfer capability to the ESF buses to support OPERABILITY of that circuit.APPLICABILITYThe AC sources are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:a. Acceptable fuel design limits and reactor coolant pressure boundarylimits are not exceeded as a result of AOOs or abnormal transients andb. Adequate core cooling is provided and containment OPERABILITY andother vital functions are maintained in the event of a postulated DBA.The AC power requirements for MODES 5 and 6 are covered in LCO 3.8.2,"AC Sources - Shutdown."
AC Sources - OperatingB 3.8.1 BASES INDIAN POINT 2B 3.8.1 - 9 Revision 7ACTIONSA Note prohibits the application of LCO 3.0.4.b to an inoperable DG or the138 kV offsite circuit. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG.
This also applies to the 138 kV offsite circuit which is the only immediate access offsite circuit. Therefore, the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in these circumstances.
A.1To ensure a highly reliable power source remains with one offsite circuitinoperable, it is necessary to verify the OPERABILITY of the remaining required offsite circuit on a more frequent basis. For activities that will require entry into the associated Condition, performance of SR 3.8.1.1 for the offsite circuit(s) could be completed up to 8 hours prior to entry into the Condition. Performance of this SR before entry into the Condition can be credited to establish the accelerated Frequency and therefore is equivalent to performing the SR within 1 hour after entry into the Condition. The LCO Bases describes the components and features which comprise the offsite circuits. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action not met.
However, if a second required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is
 
entered.A.2Required Action A.2, which applies only if the 13.8 kV offsite power circuit isbeing used to feed 6.9 kV buses 5 or 6 and the UAT is supplying 6.9 kV bus 1, 2, 3 or 4, prevents the automatic transfer of 6.9 kV buses 1, 2, 3, and 4 from the UAT to the 13.8 kV offsite power circuit after a unit trip. Transfer of buses 1, 2, 3, and 4 from the UAT to the 13.8 kV offsite power circuit could result in overloading the 13.8 kV/6.9 kV autotransformer. This requirement is not intended to preclude supplying 6.9 kV buses 1, 2, 3, and 4 using the 13.8 kV offsite circuit via the 13.8 kV/6.9 kV auto-transformers once sufficient loads have been stripped from 6.9 kV buses 1, 2, 3, and 4 to assure that the 13.8 kV/6.9 kV auto-transformer will not be overloaded. Automatic transfer of buses 1, 2, 3, and 4 can be disabled by placing 6.9 kV AC Sources - OperatingB 3.8.1 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.1 - 10 Revision 7bus tie breaker control switches 1-5, 2-5, 3-6, and 4-6 in the "pull-out"position. These breaker control switches should be "tagged" in the pull-out position if this condition is expected to last more than one full shift.Although the auto-transfer feature is normally disabled prior to placing the13.8 kV offsite power circuit in service, a Completion Time of 1 hour ensures that the 13.8 kV circuit meets requirements for OPERABILITY promptly when the alternate offsite circuit is configured to support the response of ESF functions.
A.3Required Action A.3, which only applies if the train will not be automaticallypowered from an offsite source, is intended to provide assurance that an event coincident with a single failure of the associated DG will not result in a complete loss of redundant required features. When one or more offsite sources are inoperable, a train may not be automatically powered from an offsite source if: 1) the automatic transfer of 6.9 kV buses 1, 2, 3, and 4 to 6.9 kV bus 5 and 6 is disabled; or 2) the immediate access circuit (138 kV) is inoperable and the delayed access circuit (13.8 kV) is not aligned to replace the inoperable circuit.Required safety features are designed with a redundant safety feature that ispowered from a different safeguards power train. Therefore, if a required safety feature is supported by an inoperable offsite circuit, then the failure of the DG associated with that required safety feature will not result in the lossof a safety function because the safety function will be accomplished by theredundant safety feature that is powered from a different safeguards power train. However, if a required safety feature is supported by an inoperable offsite circuit and the redundant safety feature that is powered from a different safeguards power train is also inoperable, then the failure of the DG associated with that required safety feature will result in the loss of a safety function. Required Action A.3 ensures that appropriate compensatory measures are taken for a Condition where the loss of a DG could result in the loss of a safety function when an offsite circuit is not OPERABLE.The turbine driven auxiliary feedwater pump is not required to be considereda redundant required feature, and, therefore, required to be determined OPERABLE by this Required Action, because the design is such that the remaining OPERABLE motor driven auxiliary feedwater pump is by itself capable (without any reliance on the motor driven auxiliary feedwater pump powered by the emergency bus associated with the inoperable diesel generator) of providing 100% of the auxiliary feedwater flow assumed in the safety analysis.
AC Sources - OperatingB 3.8.1 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.1 - 11 Revision 7The Completion Time for Required Action A.3 is intended to allow theoperator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."  In this Required Action, the Completion Time only begins on discovery that both:a. The train will not have offsite power automatically supplying its loadsfollowing a trip of the main turbine generator or following the loss of theimmediate access offsite circuit, andb. A required feature powered from a different safeguards power train is inoperable.If at any time during the existence of Condition A (one offsite circuit inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.Discovering that offsite power is not automatically available to one train of theonsite Class 1E Electrical Power Distribution System coincident with one or more inoperable required support or supported features, or both, that are associated with the other train that has offsite power, results in starting the Completion Times for the Required Action. Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.The remaining OPERABLE offsite circuit and DGs are adequate to supplyelectrical power to the two remaining safeguards power trains of the onsite Distribution System. The 24 hour Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during
 
this period.
A.4According to Regulatory Guide 1.93 (Ref. 6), operation may continue inCondition A for a period that should not exceed 72 hours. With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the unit safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Distribution System.
AC Sources - OperatingB 3.8.1 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.1 - 12 Revision 7The 72 hour Completion Time takes into account the capacity and capabilityof the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.
B.1To ensure a highly reliable power source remains with an inoperable DG, it isnecessary to verify the availability of the offsite circuits on a more frequent basis. For activities that will require entry into the associated Condition, performance of SR 3.8.1.1 for the offsite circuit(s) could be completed up to 8 hours prior to entry into the Condition. Performance of this SR before entry into the Condition can be credited to establish the accelerated Frequency and therefore is equivalent to performing the SR within 1 hour after entry into the Condition. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if an offsite circuit fails to pass SR 3.8.1.1, it is inoperable.
Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered.
B.2Required Action B.2 is intended to provide assurance that a loss of offsitepower, during the period that a DG is inoperable, does not result in a complete loss of redundant required features. Required safety features are designed with a redundant safety feature that is powered from a different safeguards power train. Therefore, if a required safety feature is supported by an inoperable DG, then the failure of the offsite circuit will not result in the loss of a safety function because the safety function will be accomplished by the redundant safety feature that is powered from a different safeguards power train (and DG). However, if a required safety feature is supported by an inoperable DG and the redundant safety feature that is powered from a different safeguards power train is also inoperable, then a loss of offsite power will result in the loss of a safety function. Required Action B.2 ensures that appropriate compensatory measures are taken for a Condition where the loss of offsite power could result in the loss of a safety function when a DG is not OPERABLE.The turbine driven auxiliary feedwater pump is not required to be considereda redundant required feature, and, therefore, not required to be determined OPERABLE by this Required Action, because the design is such that the remaining OPERABLE motor driven auxiliary feedwater pump is by itself capable (without any reliance on the motor driven auxiliary feedwater pump AC Sources - OperatingB 3.8.1 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.1 - 13 Revision 7powered by the emergency bus associated with the inoperable dieselgenerator) of providing 100% of the auxiliary feedwater flow assumed in the safety analysis.The Completion Time for Required Action B.2 is intended to allow theoperator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."  In this Required Action, the Completion Time only begins on discovery that both:a. An inoperable DG exists and
: b. A required feature powered from a different safeguards power train is inoperable.If at any time during the existence of this Condition (one DG inoperable) arequired feature subsequently becomes inoperable, this Completion Time would begin to be tracked.Discovering one required DG inoperable coincident with one or moreinoperable required support or supported features, or both, that are associated with either OPERABLE DG, results in starting the Completion Time for the Required Action. A Completion Time of four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.In this Condition, the remaining OPERABLE DGs and offsite circuits areadequate to supply electrical power to the onsite Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour Completion Time takes into account the OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.B.3.1 and B.3.2Required Action B.3.1 provides an allowance to avoid unnecessary testing ofOPERABLE DG(s). If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DGs, SR 3.8.1.2 does not have to be AC Sources - OperatingB 3.8.1 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.1 - 14 Revision 7performed. If the cause of inoperability exists on other DG(s), the otherDG(s) would be declared inoperable upon discovery and Condition E of LCO 3.8.1 would be entered. Once the failure is repaired, the common cause failure no longer exists, and Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s), performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that DG.In the event the inoperable DG is restored to OPERABLE status prior tocompleting either B.3.1 or B.3.2, the plant corrective action program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour constraint imposed while
 
in Condition B.According to Generic Letter 84-15 (Ref. 10), 24 hours is reasonable toconfirm that the OPERABLE DGs are not affected by the same problem as
 
the inoperable DG.
B.4In Condition B, the remaining OPERABLE DGs and offsite circuits areadequate to supply electrical power to the onsite Distribution System. The 7 day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.C.1 and C.2Required Action C.1, which applies when two offsite circuits are inoperable, isintended to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant required safety functions. The Completion Time for this failure of redundant required features is reduced to 12 hours from that allowed for one train without offsite power (Required Action A.3). The rationale for the reduction to 12 hours is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours for two required offsite circuits inoperable, based upon the assumption that three complete safeguards power trains are OPERABLE. When a redundant required feature is not OPERABLE, this assumption is not the case, and a shorter Completion Time of 12 hours is appropriate. These features are powered from redundant AC safety trains. This includes motor driven auxiliaryfeedwater pumps. Single train features, such as turbine driven auxiliarypumps, are not included as discussed in the Bases for Required Action A.3.
AC Sources - OperatingB 3.8.1 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.1 - 15 Revision 7The Completion Time for Required Action C.1 is intended to allow theoperator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."  In this Required Action the Completion Time only begins on discovery that both:a. All required offsite circuits are inoperable and
: b. A required feature is inoperable.
If at any time during the existence of Condition C (two offsite circuitsinoperable) a required feature becomes inoperable, this Completion Time begins to be tracked.According to Regulatory Guide 1.93 (Ref. 6), operation may continue inCondition C for a period that should not exceed 24 hours. This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.Because of the normally high availability of the offsite sources, this level ofdegradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable. However, two factors tend to decrease the severity of this level of degradation:a. The configuration of the redundant AC electrical power system thatremains available is not susceptible to a single bus or switching failure andb. The time required to detect and restore an unavailable offsite powersource is generally much less than that required to detect and restore an unavailable onsite AC source.With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.
AC Sources - OperatingB 3.8.1 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.1 - 16 Revision 7According to Reference 6, with the available offsite AC sources, two less thanrequired by the LCO, operation may continue for 24 hours. If two offsite sources are restored within 24 hours, unrestricted operation may continue. If only one offsite source is restored within 24 hours, power operation continues in accordance with Condition A.D.1 and D.2Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not beentered even if all AC sources to it were inoperable, resulting in de-energization. Similarly, when the UAT is being used to supply 6.9 kV bus 1, 2, 3 or 4 and the 13.8 kV offsite circuit is being used to supply 6.9 kV buses 5 and 6, the autotransfer function is disabled. Therefore, 480 V safeguards buses 2A and 3A (safeguards train 2A/3A) will not be automatically re-energized with offsite power following a plant trip until connected to the offsite circuit by operator action. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC offsite or DG source to any train, the Conditions and Required Actions for LCO 3.8.9, "Distribution Systems -
Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of one offsite circuit and one DG, without regard to whether a train is or would be de-energized. LCO 3.8.9 provides the appropriate restrictions for a train that is or would be de-energized.According to Regulatory Guide 1.93 (Ref. 6), operation may continue inCondition D for a period that should not exceed 12 hours.In Condition D, individual redundancy is lost in both the offsite electricalpower system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during
 
this period.
AC Sources - OperatingB 3.8.1 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.1 - 17 Revision 7 E.1With two or more DGs inoperable, the remaining standby AC sources are notadequate to satisfy accident analysis assumptions. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.According to Reference 6, with two or more DGs inoperable, operation maycontinue for a period that should not exceed 2 hours.F.1 and F.2If the inoperable AC electric power sources cannot be restored toOPERABLE status within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is reduced. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within 12 hours.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 10). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 10, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action F.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and AC Sources - OperatingB 3.8.1 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.1 - 18 Revision 7establishment of risk management actions, if appropriate. LCO 3.0.4 is notapplicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
G.1 and H.1Conditions G and H correspond to a level of degradation in which allredundancy in the AC electrical power supplies has been lost or a loss of safety function has already occurred. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.SURVEILLANCE REQUIREMENTSThe AC sources are designed to permit inspection and testing of all important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 7). Periodic component tests are supplemented by functional tests during refueling outages (under simulated accident conditions). The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of Regulatory Guide 1.9 (Ref. 3) and Regulatory Guide 1.137 (Ref. 8), as addressed in the UFSAR.Where the SRs discussed herein specify voltage and frequency tolerances,the following is applicable. The minimum steady state output voltage of 428 V is the value determined to be acceptable in the analysis of the degraded grid condition. This value allows for voltage drop to the terminals of 480 V motors. It also allows for voltage drops to motors and other equipment down through the 120 V level where minimum operating voltage is also usually specified as 90% of name plate rating. The specified maximum steady state output voltage of 500 V is equal to the maximum operating voltage specified for 480 V circuit breakers. The specified minimum and maximum frequencies of the DG are 58.8 Hz and 61.2 Hz, respectively.
These values are equal to 2% of the 60 Hz nominal frequency and arederived from the recommendations given in Regulatory Guide 1.9 (Ref. 3).
AC Sources - OperatingB 3.8.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.8.1 - 19 Revision 7SR  3.8.1.1This SR ensures proper circuit continuity for the offsite AC electrical powersupply to the onsite distribution network and availability of offsite ACelectrical power. The lineup check verifies breaker alignment between 480 Vbuses 5A and 6A and the point where the 138 kV and 13.8 kV feeders being used to satisfy this LCO lose their identity in the offsite network. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source, and that appropriate independence of offsite circuits is maintained. The 7 day Frequency is adequate since breaker position is not likely to change without the operator being aware of it and because 6.9 kV bus status and 13.8 kV circuit status is displayed in the control room. For breakers that do not have position indication in the control room, this SR is satisfied by telephone communication with Consolidated Edison personnel capable of confirming the status of the offsite circuits. This SR includes confirmation of the requirement for two independent circuits (i.e., 96951, 96952 or 95891) into the Buchanan substation.SR  3.8.1.2This SR helps to ensure the availability of the standby electrical power supplyto mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.To minimize the wear on moving parts that do not get lubricated when theengine is not running, this SR is modified by a Note to indicate that all DG starts for the Surveillance may be preceded by an engine prelube period.For the purpose of SR 3.8.1.2 testing, the DGs are started from standbyconditions. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.SR 3.8.1.2 requires that, at a 31 day Frequency, the DG starts from standbyconditions and achieves required voltage and frequency within 10 seconds.
The 10 second start requirement supports the assumptions of the design basis LOCA analysis in the UFSAR, Chapter 14 (Ref. 5).The 31 day Frequency for SR 3.8.1.2 is consistent with Regulatory Guide 1.9(Ref. 3). This Frequency provides adequate assurance of DG OPERABILITY, while minimizing degradation resulting from testing. DG 21 and DG 23 have redundant air start motors and both air start motors are actuated by both AC Sources - OperatingB 3.8.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.8.1 - 20 Revision 7channels of the start logic. DG 21 and DG 23 are operable when either airstart motor is operable; however, this SR will not demonstrate that both air start motors are independently capable of starting the DG. If an air start motor is not capable of performing its intended function, a DG is inoperable until a timed start is conducted using the remaining air start motor.
Alternately, this SR may be performed using one air start motor (i.e.
redundant air start motor isolated) on a staggered basis to ensure that the DG will start with either air start motor. The foregoing does not apply to DG 22 as the starting logic is not actuated by both channels. With either air start motor inoperable DG 22 is also inoperable.SR  3.8.1.3This Surveillance verifies that the DGs are capable of synchronizing with theoffsite electrical system and accepting loads of 90% to 100% of the continuous rating. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.Although no power factor requirements are established by this SR, the DG isnormally operated at a power factor between 0.8 lagging and 1.0. The 0.8 value is the design rating of the machine, while the 1.0 is an operational limitation to ensure circulating currents are minimized. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.The 31 day Frequency for this Surveillance is consistent with Regulatory Guide 1.9 (Ref. 3).This SR is modified by four Notes. Note 1 indicates that diesel engine runsfor this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients, because of changing bus loads, do not invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test. Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start, without an intervening shutdown, must precede this test to credit satisfactory performance.SR  3.8.1.4This SR provides verification that the level of fuel oil in the day tank is at orabove the level at which fuel oil is automatically added. The level is AC Sources - OperatingB 3.8.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.8.1 - 21 Revision 7expressed as an equivalent volume in gallons, and ensures adequate fuel oilfor approximately 53 minutes of DG operation at full load.A 24 hour Frequency is needed because the day tank level alarm is not set toalarm when the day tank level falls just below the minimum required level.
Instead, the day tank level alarm is set to indicate a lower level indicative of a failure of the transfer pump after allowing sufficient time for manually restoring power to the transfer pumps which are stripped following a Safety Injection signal or undervoltage signal on buses 5A or 6A. The 24 hour Frequency is acceptable because operators would be aware of any large uses of fuel oil during this period.SR  3.8.1.5Microbiological fouling is a major cause of fuel oil degradation. There arenumerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil day tanks once every 31 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are established by Regulatory Guide 1.137 (Ref. 8).
This SR is for preventative maintenance. The presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed during the performance of this Surveillance.SR  3.8.1.6This Surveillance demonstrates that each required fuel oil transfer pumpoperates and transfers fuel oil from its associated storage tank to its associated day tank. This is required to support continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.The IP2 design includes the following backup feature. If a fuel oil transferpump fails to refill the day tank, one of the fuel oil transfer pumps associated with a different DG will receive an automatic starting signal and will fill the day tank for the affected DG via the common makeup line to all three diesel-generator fuel-oil day tanks. This backup feature is not required for AC Sources - OperatingB 3.8.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.8.1 - 22 Revision 7DG OPERABILITY; however, the feature is tested because its existence ispart of the justification for the 92 day SR Frequency. Therefore, the need for accelerated testing of the transfer function should be evaluated when this backup feature is out of service.The Frequency for this SR is 92 days. The 92 day Frequency corresponds tothe testing requirements for pumps as contained in the ASME Code.SR  3.8.1.7Transfer of each offsite power supply from the 138 kV offsite circuit to the13.8 kV offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to power the shutdown loads. The 24 month Frequency of the Surveillance is based on engineering judgment, taking into consideration the unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.This SR is modified by a Note. The reason for the Note is that, duringoperation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced.SR  3.8.1.8Verification that 6.9 kV buses 2 and 3 will auto transfer (dead fast transfer)from the Unit Auxiliary Transformer (the main generator) to 6.9 kV buses 5 and 6 (the offsite circuit) following a loss of voltage on 6.9 kV buses 2 and 3 is needed to confirm the OPERABILITY of a function assumed to operate to provide offsite power to safeguards power train 2A/3A following a trip of the main generator.  (Note that when the main generator trips on over-frequency, the transfer is blocked by an over-frequency transfer interrupt circuit provided for bus protection of out of phase transfer.)An actual demonstration of this feature requires the tripping the maingenerator while the reactor is at power with the main generator supplying 6.9 kV buses 2 and 3. Credit may be taken for planned plant trips or for unplanned events that satisfy this SR. Other than planned plant trips or AC Sources - OperatingB 3.8.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.8.1 - 23 Revision 7unplanned events, Note 1 specifies that this SR is not normally performed inMODE 1 or 2 because performance of this SR could cause perturbations tothe electrical distribution systems that could challenge continued steady stateoperation and, as a result, unit safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced.In lieu of actually initiating a circuit transfer, this SR may be satisfied bytesting that adequately shows the capability of the transfer. This transfer testing may include any sequence of sequential, overlapping, or total steps so that the entire transfer sequence is verified.The 24 month Frequency is based on engineering judgment taking intoconsideration the plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle length.Note 2 specifies that this SR is required to be met only when the 138 kVoffsite circuit is supplying 6.9 kV bus 5 and 6 and the Unit Auxiliary Transformer is supplying 6.9kV bus 1, 2, 3 or 4. This is acceptable because the feature being tested does not perform a safety function if the 138 kV offsite circuit is already supplying 6.9 kV buses 2 and 3. Likewise, if the 13.8 kV circuit is supplying 6.9 kV buses 5 or 6, then the feature being tested by this SR is required to be disabled by Required Action A.2.SR  3.8.1.9This Surveillance demonstrates that DG noncritical protective functions arebypassed on a loss of voltage signal concurrent with an ESF actuation test signal, and critical protective functions (engine overspeed, low lube oil pressure, high crankcase pressure, and start failure relay (engine overcrank))
trip the DG to avert substantial damage to the DG unit. The noncritical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.The 24 month Frequency is based on engineering judgment, taking intoconsideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating AC Sources - OperatingB 3.8.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.8.1 - 24 Revision 7experience has shown that these components usually pass the SR whenperformed at the 24 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.The SR is modified by a Note. The reason for the Note is that performing theSurveillance would remove a required DG from service. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.SR  3.8.1.10This surveillance demonstrates once per 24 months that the DGs can startand run continuously at full load capability for an interval of not less than 8 hours, where > 105 minutes and < 2 hours loaded at > 2050 kW and <2100kW, the 2 hour rating, followed by, > 10 minutes and < 15 minutesloaded > 2270 kW and < 2300 kW, the 1/2 hour rating, and the remainder ofthe time > 1700 kW and < 1750 kW, the continuous rating. The DG starts forthis Surveillance can be performed either from standby or hot conditions.
The provisions for prelubricating and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR. The load interval is consistent with the recommendations of IEEE 387-1995 (Ref.
 
9).This SR requires that the DG be operated at the peak load expected duringan accident to demonstrate DG OPERABILITYThe 24 month Frequency is consistent with the recommendations ofReference 9, takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.
AC Sources - OperatingB 3.8.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.8.1 - 25 Revision 7This Surveillance is modified by three Notes. Note 1 states that momentarytransients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the power factor limit will not invalidate the test. The reason for Note 2 is that during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems.This restriction from normally performing the Surveillance in MODE 1 or 2 isfurther amplified to allow the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveillance, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.Note 3 ensures that the DG is tested under load conditions that are as closeto design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of 0.88 for DG 21 and23 and < 0.87 for DG 22. This power factor is representative of the actualinductive loading a DG would see under design basis accident conditions.
Under certain conditions, however, Note 3 allows the surveillance to be conducted at an other power factor. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to desired values results in voltages on the emergency busses that are too high. Under these conditions, the power factor should be maintained as close as practicable to the desired values while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DG excitation levels needed to obtain a power factor as desired may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the DG. In such cases, the power factor shall be maintained close as practicable to  the desired values without exceeding the DG excitation limits.
AC Sources - OperatingB 3.8.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.8.1 - 26 Revision 7SR  3.8.1.11Under accident conditions loads are sequentially connected to the bus by theindividual load timers to prevent overloading of the DGs or offsite circuits due to high motor starting currents. The design load sequence time interval tolerance ensures that sufficient time exists for the DG to restore frequency and voltage or the offsite circuit to restore voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. Reference 2 provides a summary of the automatic loading of ESF buses.The Frequency of 24 months is based on engineering judgment, taking intoconsideration operating experience that has shown that these components usually pass the SR. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.This SR is modified by a Note that specifies that load timers associated withequipment that has automatic initiation capability disabled are not required to be OPERABLE. This note is needed because these time delay relays affect the OPERABILITY of both the AC sources (offsite power and DG) and the specific load that the relay starts. If a timer fails to start a required load or if a timer starts the load later than assumed in the analysis, then the required load is not OPERABLE. If a timer starts the load outside the design interval (early or late), then the DG and offsite source are not OPERABLE because overlap of equipment starts may cause an offsite source to exceed limits for voltage or current or a DG to exceed limits for voltage, current or frequency. Therefore, when an individual load sequence timer is not OPERABLE, it is conservative to disable the automatic initiation capability of that component (and declare the specific component inoperable) rather than declare the associated DG and offsite circuit inoperable because of thefollowing: the potential for adverse impact on the DG by simultaneous start ofESF equipment is eliminated; all other loads powered from the safeguards power train are available to respond to the event; and, the load with the inoperable timer remains available for a manual start after the one minute completion of the normal starting sequence.If a load sequence timer is inoperable and the automatic initiation capability ofthat component has not been disabled, Condition D applies because both the associated DG and the 138 kV offsite circuit are inoperable until automatic initiation capability of the associated component has been disabled.
AC Sources - OperatingB 3.8.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.8.1 - 27 Revision 7SR  3.8.1.12In the event of a DBA coincident with a loss of offsite power, the DGs arerequired to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.This Surveillance demonstrates the DG operation during a loss of offsitepower actuation test signal in conjunction with an ESF actuation signal. This SR verifies all actions encountered from an ESF signal concurrent with the loss of offsite power, including shedding of the nonessential loads and energization of the emergency buses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.The DG autostart time of 10 seconds is derived from requirements of theaccident analysis to respond to a design basis large break LOCA. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability is achieved.The requirement to verify the connection and power supply of permanent andauto-connected loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open, or high pressure injection systems are not capable of being operated at full flow, or residual heat removal (RHR) systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation.In lieu of actual demonstration of connection and loading of loads, testing thatadequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.The Frequency of 24 months takes into consideration unit conditions requiredto perform the Surveillance and is intended to be consistent with an expected fuel cycle length of 24 months.
AC Sources - OperatingB 3.8.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.8.1 - 28 Revision 7This SR is modified by three Notes. The reason for Note 1 is to minimizewear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations for DGs.The reason for Note 2 is that the performance of the Surveillance wouldremove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. This restriction from normally performing the Surveillance in MODE 1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE 1 or 2. Risk insights or deterministic methods may be used for the assessment.The reason for Note 3 is to allow the SR to be conducted with only onesafeguards train at a time or with two or three safeguards trains concurrently.
Allowing the LOOP/LOCA test to be conducted using one safeguards power train and one DG at a time is acceptable because the safeguards power trains are designed to respond to this event independently. Therefore, an individual test for each safeguards power train will provide an adequate verification of plant response to this event.Simultaneous testing of all three safeguards power trains is acceptable aslong as the following plant conditions are established:a. All three DGs are available;
: b. Redundant decay heat removal capability is available, preferablyincluding passive decay heat removal capability;c. No offsite power circuits are inoperable; and AC Sources - OperatingB 3.8.1 BASESSURVEILLANCE REQUIREMENTS  (continued)
INDIAN POINT 2B 3.8.1 - 29 Revision 7d. No activities that are precursors to events requiring AC power formitigation (e.g., fuel handling accident or inadvertent RCS draindown)are conducted during performance of this test.SR  3.8.1.13This Surveillance demonstrates that the DG starting independence has not been compromised. Also, this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously.The 10 year Frequency is consistent with the recommendations of Regulatory Guide 1.9 (Ref. 3).This SR is modified by two Notes. The reason for Note 1 is to minimize wearon the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations. The reason for Note 2 is to allow SR 3.8.1.12 to satisfy the requirements of this SR if SR 3.8.1.12 is performed with more than one safeguards power train concurrently.REFERENCES 1.10 CFR 50, Appendix A, GDC 17.
2.UFSAR, Chapter 8.
3.Regulatory Guide 1.9, Rev. 3, July 1993.
4.UFSAR, Chapter 6.
5.UFSAR, Chapter 14.
6.Regulatory Guide 1.93, Rev. 0, December 1974.
7.10 CFR 50, Appendix A, GDC 18.
8.Regulatory Guide 1.137.
9.IEEE Standard 387-1995, IEEE Standard Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating Stations.
AC Sources - OperatingB 3.8.1 BASESREFERENCES  (continued)
INDIAN POINT 2B 3.8.1 - 30 Revision 710. Generic Letter 84-15, July 2, 1984.11. Calculation SGX-00073-01, dated February 6, 2004.
: 12. Indian Point Unit 2 License Amendment 153, dated May 9, 1991.13. WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changes toTechnical Specification Required Action Endstates for WestinghouseNSSS PWRs," June 2010.
AC Sources - Shutdown B 3.8.2 INDIAN POINT 2 B 3.8.2 - 1 Revision 2 B 3.8  ELECTRICAL POWER SYSTEMS B 3.8.2 AC Sources - Shutdown BASESBACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, "AC Sources - Operating." APPLICABLESAFETY ANALYSESThe OPERABILITY of the minimum AC sources during MODES 5 and 6 and during movement of recently irradiated fuel assemblies ensures that:a. The unit can be maintained in the shutdown or refueling condition for extended periods, b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status, and c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident involving handling recently irradiated fuel. Due to radioactive decay, AC electrical power is only required to mitigate fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84 hours (Ref. 1)).In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.
AC Sources - Shutdown B 3.8.2 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.8.2 - 2 Revision 2 During MODES 1, 2, 3, and 4, various deviations from the analysis assumptions and design requirements are allowed within the Required Actions. This allowance is in recognition that certain testing and maintenance activities must be conducted provided an acceptable level of risk is not exceeded. During MODES 5 and 6, performance of a significant number of required testing and maintenance activities is also required. In MODES 5 and 6, the activities are generally planned and administratively controlled. Relaxations from MODE 1, 2, 3, and 4 LCO requirements are acceptable during shutdown modes based on: a. The fact that time in an outage is limited. This is a risk prudent goal as well as a utility economic consideration. b. Requiring appropriate compensatory measures for certain conditions. These may include administrative controls, reliance on systems that do not necessarily meet typical design requirements applied to systems credited in operating MODE analyses, or both. c. Prudent utility consideration of the risk associated with multiple activities that could affect multiple systems. d. Maintaining, to the extent practical, the ability to perform required functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY requirements) with systems assumed to function during an event. One DG has sufficient capacity to support Required Actions that may be needed in response to any event that might occur during refueling operations. Two DGs are normally required to be OPERABLE when shutdown to ensure that potentially required safety features are directly supported by a DG. However, if all features required for existing plant conditions are being directly supported by a single DG (e.g., required RHR pump is supported by its associated DG), only one DG is required to be OPERABLE.In the event of an accident during shutdown, this LCO ensures the capability to support systems necessary to avoid immediate difficulty, assuming either a loss of all offsite power or a loss of all onsite diesel generator (DG) power. The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AC Sources - Shutdown B 3.8.2 BASESINDIAN POINT 2 B 3.8.2 - 3 Revision 2 LCO One offsite circuit capable of supplying the onsite power distribution subsystem(s) of LCO 3.8.10, "Distribution Systems - Shutdown," ensures that all required loads are powered from offsite power. Two OPERABLE DGs, associated with the distribution system train required to be OPERABLE by LCO 3.8.10, ensures a diverse power source is available to provide electrical power support, assuming a loss of the offsite circuit. Together, OPERABILITY of the required offsite circuit and DGs ensures the availability of sufficient AC sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents involving handling recently irradiated fuel). A DG that is not supporting any required feature is not required to be OPERABLE.
Therefore, under these conditions, the number of required OPERABLE DGs may be reduced to one in accordance with Required Action B.1. When one residual heat removal (RHR) loop is required to be OPERABLE and in operation, and one RHR loop is required to be OPERABLE, the RHR loop that is OPERABLE but not operating needs to be capable of being powered in the event the operating RHR loop fails. However, only the operating RHR loop needs to be capable of being powered from an onsite AC electrical power distribution subsystem associated with an OPERABLE diesel. The qualified offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the Engineered Safety Feature (ESF) bus(es). Qualified offsite circuits are those that are described in the Bases of LCO 3.8.1, AC Sources - Operating, except that safeguards power trains may be cross connected when in MODES 5 and 6. The DGs must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage. This sequence must be accomplished within 10 seconds. The DG must be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the ESF buses. Proper sequencing of loads, including tripping of nonessential loads, is a required function for DG OPERABILITY. It is acceptable for safeguards power trains to be cross tied during shutdown conditions, allowing a single offsite power circuit to supply all required trains. However, interlocks that disconnect the affected tie breakers before DGs are automatically connected to the bus must be OPERABLE. Features required to be OPERABLE must be supported directly by their associated
 
DG.
AC Sources - Shutdown B 3.8.2 BASESINDIAN POINT 2 B 3.8.2 - 4 Revision 2 APPLICABILITY The AC sources required to be OPERABLE in MODES 5 and 6 and during movement of recently irradiated fuel assemblies provide assurance that: a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core, b. Systems needed to mitigate a fuel handling accident involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84 hours (Ref. 1)) are available, c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available, and d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition. The AC power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.1.
ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily. A.1An offsite circuit would be considered inoperable if it were not available to one or more required safeguards power train. Although two safeguards power trains may be required by LCO 3.8.10, the one train with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and recently irradiated fuel movement. By the allowance of the option to declare required features inoperable, with no offsite power available, appropriate restrictions will be implemented in accordance with the affected required features LCO's
 
ACTIONS.
AC Sources - Shutdown B 3.8.2 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.2 - 5 Revision 2 A.2.1, A.2.2, A.2.3, and A.2.4With the offsite circuit not available to all required trains, the option would still exist to declare all required features inoperable. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. It is, therefore, required to suspend CORE ALTERATIONS, movement of recently irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM. Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability or the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the unit safety systems. The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power. Pursuant to LCO 3.0.6, the Distribution System's ACTIONS would not be entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A is entered with no AC power to any required ESF bus, the ACTIONS for LCO 3.8.10 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit, whether or not a train is de-energized. LCO 3.8.10 would provide the appropriate restrictions for the situation involving a de-energized bus.
AC Sources - Shutdown B 3.8.2 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.2 - 6 Revision 2 B.1A DG would be considered inoperable if it could not support its associated safeguards power train. One OPERABLE DG and its associated safeguards power train may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement. By the allowance of the option to declare required features inoperable, with no DG available, appropriate restrictions will be implemented in accordance with the affected required features LCO's ACTIONS. B.2.1, B.2.2, B.2.3 and B.2.4When two DGs are required to be OPERABLE and one required DG is inoperable, the option would still exist to declare inoperable all required features supported by the inoperable DG. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. Therefore, with one required DG inoperable, the option exists to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions. With two required DGs inoperable, the minimum required diversity of AC power sources is not available to any required features. Although the option would still exist to declare all required features inoperable, the requirements imposed by the affected required features LCO's ACTIONS would be equivalent to the option provided by Required Actions B.2.1, B.2.2 and B.2.3. Therefore, with two required DGs inoperable, it is required to suspend CORE ALTERATIONS, movement of recently irradiated fuel assemblies, and operations involving positive reactivity additions.With one required DG inoperable, when only one is required to be OPERABLE, the available options are equivalent to the situation described above for two inoperable DGs when two DGs are required. The additional restrictions on plant conditions for requiring only one DG provides ample time for operator action, in the event of a loss of offsite power, to manually restore decay heat removal capability. With one or more required DGs inoperable, the Required Action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory provided the required SDM is maintained. Additionally, Required Actions B.2.1, B.2.2 and B.2.3 do not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability or the occurrence of postulated events.
AC Sources - Shutdown B 3.8.2 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.2 - 7 Revision 2 Furthermore, even when Required Actions B.2.1, B.2.2 and B.2.3 are implemented, it is required to immediately initiate action to restore the required DG(s) and to continue this action until restoration is accomplished in order to provide the necessary AC power to the unit safety systems. The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power. SURVEILLANCE SR  3.8.2.1 REQUIREMENTSSR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, 3, and 4. SR  3.8.1.7 is not required to be met since only one offsite circuit is required to be OPERABLE. SR 3.8.1.8 is not required because autotransfer from the Unit Auxiliary Transformer to an offsite source is not needed when the plant is not at power. SR 3.8.1.9 is not required to be met because the required OPERABLE DG(s) is not required to undergo periods of being synchronized to the offsite circuit. SR 3.8.1.13 is excepted because starting independence is not required with the DG(s) that is not required to be OPERABLE.This SR is modified by two Notes. The reason for Note 1 is to preclude requiring the OPERABLE DG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during performance of SRs, and to preclude deenergizing a required 480 V bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the DG. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the DG and offsite circuit is required to be OPERABLE. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR. Note 2 states that portions of SR 3.8.1.12 are not required to be met. The SR demonstrates the DG response to an ECCS signal (either alone or in conjunction with a loss-of-power signal). This is consistent with the ECCS instrumentation requirements that do not require the ECCS signals when the ECCS System is not required to be OPERABLE per LCO 3.5.3, "ECCS-Shutdown."
AC Sources - Shutdown B 3.8.2 BASESINDIAN POINT 2 B 3.8.2 - 8 Revision 2 REFERENCES 1. WCAP-16157, "Indian Point Unit 2 Stretch Power Uprating Licensing Report," January 2004.
Diesel Fuel Oil and Starting Air B 3.8.3 INDIAN POINT 2 B 3.8.3 - 1 Revision 4B 3.8  ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel Oil and Starting Air BASESBACKGROUND Fuel oil for the three safeguards DGs is stored in the three DG fuel oil storage tanks (one tank associated with each DG) and the common DG fuel oil reserve. The three DG fuel oil storage tanks are required to contain a minimum of 19,000 usable gallons (6334 gallons in the tank associated with each DG) to ensure that at least two of the three diesels can operate for at least 73 hours at the maximum load profile permitted by the diesels ratings. If the oil in one of the DG storage tanks is not available, there is sufficient fuel available to run two diesels for 45 hours at the maximum load profile permitted by the diesels ratings.The DG fuel oil reserve is an additional 29,000 gallons of diesel fuel that is maintained in onsite storage tanks for the exclusive use of Indian Point 2 as described in UFSAR Section 8.2 (Ref. 1). This additional 29,000 gallons of diesel fuel is sufficient for operation of two diesels for an additional 111 hours at the maximum load profile permitted by the diesels ratings.The basis for a minimum volume of diesel fuel oil of 48,000 gallons (i.e. 6334 usable gallons in each of the three DG fuel oil storage tanks and 29,000 gallons in the DG fuel oil reserve) is sufficient to operate two diesels for at least 168 hours at the maximum load profile permitted by the diesels ratings. If only two of the three DG fuel oil storage tanks are available, the total remaining fuel oil in storage is sufficient to provide for operation of two DGs at the maximum load profile permitted by the diesels ratings for a period of at least 160 hours. This volume of fuel oil is sufficient because commercial oil supplies and trucking facilities exist to ensure fuel oil deliveries within one day.Note that the operators of Indian Point 2 are responsible for maintaining the reserve that is designated for Indian Point 3 use only as specified in the Indian Point 3 Technical Specifications at the location specified in the Indian Point 3 UFSAR. The DG fuel oil designated for Indian Point 3 is subject to the same sampling and testing requirements as the DG fuel oil designated for Indian Point 2. Indian Point 2 is responsible for promptly informing Indian Point 3 of the results of the periodic verification of DG fuel oil volume and the results of required DG sampling and testing.
Diesel Fuel Oil and Starting Air B 3.8.3 BASESBACKGROUND (Continued) INDIAN POINT 2 B 3.8.3 - 2 Revision 4Each of the three DG fuel oil storage tanks is provided with a motor-driven transfer pump mounted in a manhole opening above oil level. This pump is used to transfer fuel oil from the storage tank to the 175 gallon day tank supporting each DG. A decrease in day tank level to approximately 115 gallons (65%) will start the transfer pump in the corresponding DG fuel oil storage tank and run until the day tank is at approximately 158 gallons (90%). This process ensures that the day tank always contains sufficient fuel to support approximately 53 minutes of DG operation. If pump 21 fails to refill its associated day tank, transfer pump 22 will receive an automatic starting signal as a backup to the primary pump. In a similar manner, transfer pump 22 receives an automatic starting signal on low level in the day tank for diesel 22 and is backed up by transfer pump 23. Transfer pump 23 starts on low level in the day tank for diesel generator 23 and is backed up by transfer pump 21.If the DGs require fuel oil from the fuel oil reserve tank(s), the fuel oil will be transported by truck to the DG fuel oil storage tanks. A truck with appropriate hose connections and capable of transporting oil is available either on site or at the Buchanan Substation. Commercial oil supplies and trucking facilities are also available in the vicinity of the plant. For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses the recommended fuel oil practices as supplemented by ANSI N195 (Ref. 4).
The fuel oil properties governed by these SRs are the water and sediment content, the viscosity, specific gravity (or API gravity), and impurity level.
Requirements for DG fuel oil testing methodology, frequency, and acceptance criteria are maintained in the program required by Technical Specification 5.5.11, Diesel Fuel Oil Testing Program. The DG lubrication system is designed to provide sufficient lubrication to permit proper operation of its associated DG under all loading conditions.
The system is required to circulate the lube oil to the diesel engine working surfaces and to remove excess heat generated by friction during operation.
Administrative controls ensure that the combination of the lube oil in the engine oil sump and maintained in onsite storage is sufficient to support 7 days of continuous operation of all three DGs. This supply is sufficient to allow operators to replenish the lube oil from offsite sources.
Diesel Fuel Oil and Starting Air B 3.8.3 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.8.3 - 3 Revision 4Each emergency diesel is automatically started by two redundant air motors. Each DG has a 53-ft 3 air storage tank and compressor system powered by a 480-V motor. The piping and the electrical services are arranged so that manual transfer between units is possible. The capability exists to cross-connect a single DG air compressor to more than one DG air receiver, via manual air tie valves. However, to ensure that the OPERABILITY of two of the three DGs is maintained in the event of a single failure, administrative controls are in-place to require an operator to be stationed within the DG Building, whenever any of the starting air tie valves are opened. Each air receiver has sufficient storage for four normal starts. However, all starting air will be consumed during a failed start attempt. APPLICABLE SAFETY ANALYSESThe initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter 14 (Ref. 3), assume Engineered Safety Feature (ESF) systems are OPERABLE. The DGs are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that fuel, Reactor Coolant System and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems. Since diesel fuel oil and the air start subsystem support the operation of the standby AC power sources, they satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCOThe basis for a minimum volume of diesel fuel oil of 48,000 gallons (i.e. 6334 usable gallons in each of the three DG fuel oil storage tanks and 29,000 gallons in the DG fuel oil reserve) is to provide for operation at the maximum load profile permitted by the diesels ratings for a period of at least 168 hours. If only two of the three DG fuel oil storage tanks are available, the total remaining fuel oil in storage is sufficient to provide for operation of two DGs at the maximum load profile permitted by the diesels ratings for a period of at least 160 hours. It is also required to meet specific standards for quality. This requirement, in conjunction with an ability to obtain replacement supplies within 7 days, supports the availability of DGs required to shut down the reactor and to maintain it in a safe condition for an anticipated operational occurrence (AOO) or a postulated DBA with loss of offsite power.
` In MODES 5 and 6, LCO requirements for DG fuel oil are relaxed in recognition that reduced DG loading required to respond to events in Diesel Fuel Oil and Starting Air B 3.8.3 BASESLCO (Continued) INDIAN POINT 2 B 3.8.3 - 4 Revision 4MODES 5 and 6 significantly reduces the amount of fuel oil required in the DG fuel oil storage tanks. Therefore, the LCO requires a total of 6334 gallons of fuel oil in the tanks associated with the DGs that are required to be OPERABLE. This fuel may be stored in one tank associated with an OPERABLE DG or proportioned between the tanks associated with OPERABLE DGs. DG day tank fuel requirements, as well as transfer capability from the storage tank to the day tank, are addressed in LCO 3.8.1, "AC Sources - Operating," and LCO 3.8.2, "AC Sources - Shutdown." The starting air system is required to be maintained >250psig to meet SR 3.3.8.5. At this pressure the system meets its design criteria because it has the capability for four diesel starts, without recharging the air start receivers, each within the 10 seconds assumed for a LOCA. At 90 psig the system has the capability for one diesel start within the 10 seconds assumed for a LOCA. The 250 psig and 90 psig limits for air start receiver pressure are analytical limits. Therefore, an appropriate allowance for instrument uncertainty must be applied when ensuring these limits are met. To allow for instrument uncertainty, administrative limits for starting air pressure of > 260 psig and > 100 psig are used, respectively.APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an AOO or a postulated DBA. Since stored diesel fuel oil and the starting air subsystem support LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil and starting air are required to be within limits when the associated DG is required to be OPERABLE.
ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each DG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable DG subsystem. Complying with the Required Actions for one inoperable DG subsystem may allow for continued operation, and subsequent inoperable DG subsystem(s) are governed by separate Condition entry and application of associated Required Actions. A.1In this Condition, the requirements of SR 3.8.3.2.a are not met for one or more DG fuel oil storage tanks. This means that replenishment of DG fuel oil from the reserve storage tanks will be needed in less time than assumed in the UFSAR (Ref. 1). Therefore, the DG(s) associated with the DG fuel oil storage tank(s) not within limits must be declared inoperable within 2 hours Diesel Fuel Oil and Starting Air B 3.8.3 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.3 - 5 Revision 4because replenishment of the DG fuel oil storage tank requires that fuel be transported from the DG fuel oil reserve by truck and the volume of fuel oil remaining in the DG fuel oil storage tank may not be sufficient to allow continuous DG operation while the fuel transfer is planned and conducted under accident conditions. This Condition is preceded by a Note stating that Condition A is applicable only in MODES 1, 2, 3 and 4. This Note provides recognition that reduced DG loading required to respond to events in MODES 5 and 6 significantly reduces the amount of fuel oil required in the DG fuel oil storage tanks when in these MODES. B.1In this Condition, the requirements of SR 3.8.3.2.b are not met. With less than the total required minimum fuel oil in one or more DG fuel oil storage tanks, the two DGs required to be OPERABLE in MODES 5 and 6 and during movement of recently irradiated fuel may not have sufficient fuel oil to support continuous operation while a fuel transfer from the offsite DG fuel oil reserve or from another offsite source is planned and conducted under accident conditions. This Condition requires that all DGs be declared inoperable immediately because minimum fuel oil level requirements in SR 3.8.3.2.b is a Condition of OPERABILITY of all DGs when in the specified MODES.This Condition is preceded by a Note stating that Condition B is applicable only in MODES 5 and 6. This Note provides recognition that reduced DG loading required to respond to events in MODES 5 and 6 significantly reduces the amount of fuel oil required in the DG fuel oil storage tanks when in these MODES.
C.1In this Condition, the requirements of SR 3.8.3.1 are not met and the fuel oil remaining in the DG fuel oil reserve is not sufficient to operate 2 of the 3 DGs at the maximum load profile permitted by the diesels ratings for 7 days. Therefore, all 3 DGs are declared inoperable within 2 hours. This Condition is preceded by a Note stating that Condition C is applicable only in MODES 1, 2, 3 and 4 because the DG fuel oil reserve is required to be available only in these MODES. This Note provides recognition that reduced DG loading required to respond to events in MODES 5 and 6 and when moving irradiated fuel and, therefore, significantly reduces the amount of fuel oil required when in these MODES.
Diesel Fuel Oil and Starting Air B 3.8.3 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.3 - 6 Revision 4 D.1This Condition is entered as a result of a failure to meet the acceptance criterion for total particulate concentration of the fuel oil in the DG fuel oil storage tanks and/or the DG fuel oil reserve storage tanks is not within the allowable value in Technical Specification 5.5.11, Diesel Fuel Oil Testing Program, during periodic verifications required by SR 3.8.3.3 and SR 3.8.3.4. Normally, trending of particulate levels allows sufficient time to correct high particulate levels prior to reaching the limit of acceptability.
Poor sample procedures (bottom sampling), contaminated sampling equipment, and errors in laboratory analysis can produce failures that do not follow a trend. Since the presence of particulates does not mean failure of the fuel oil to burn properly in the diesel engine, and particulate concentration is unlikely to change significantly between Surveillance Frequency intervals, and proper engine performance has been recently demonstrated (within 31 days), it is prudent to allow a brief period prior to declaring the associated DG inoperable. The Completion Time to restore particulate levels to within required limits is 7 days for DG fuel oil storage tanks and 30 days for reserve storage tanks. These Completion Times allow for further evaluation, resampling and re-analysis of the DG fuel oil and recognize the time that may be required to restore parameters to within limits.This Condition is preceded by a Note that clarifies that this Condition applies to the reserve fuel oil storage tanks only in MODES 1, 2, 3 and 4. E.1New fuel oil may be added to the DG fuel oil storage tanks or the reserve storage tanks before results of samples of this new fuel oil are available. If the properties of new fuel oil are determined not to be within the requirements established by Technical Specification 5.5.11, "Diesel Fuel Oil Testing Program," after the fuel oil has been added to the DG fuel oil storage tanks or the reserve storage tanks, then the oil in the affected storage tank(s) must be confirmed to be within the limits established by Technical Specification 5.5.11. A Completion Time of 30 days is permitted to confirm and/or restore the DG fuel oil storage tanks to within the limits of Technical Specification 5.5.11. A Completion Time of 60 days is permitted to confirm and/or restore the DG fuel oil reserve tanks to within the limits of Technical Specification 5.5.11.
Diesel Fuel Oil and Starting Air B 3.8.3 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.3 - 7 Revision 4This Condition is preceded by a Note that clarifies that this Condition applies to the reserve fuel oil storage tanks only in MODES 1, 2, 3 and 4. For the DG fuel oil storage tanks, this period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or to restore the stored fuel oil properties. This restoration may involve feed and bleed procedures, filtering, or combinations of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is a high likelihood that the DG would still be capable of performing its intended function. For the DG fuel oil reserve, the properties of the fuel oil in the offsite reserve must be maintained within the limits established by Technical Specification 5.5.11, Diesel Fuel Oil Testing Program, because fuel oil from the offsite DG fuel oil reserve will be added to the DG fuel oil storage tanks within the first 48 hours following an event in conjunction with a sustained loss of offsite power. Failure to maintain the offsite DG fuel oil reserve within these limits may adversely impact DG operation of all three DGs at some point following addition of the reserves to the DG fuel oil storage tanks. Therefore, if the offsite DG fuel oil reserve is not restored to within these limits within the specified Completion Time, then all three DGs must be declared inoperable (Required Action E.1 applies to all three DGs). Restoration of properties to within required limits may be performed by removing fuel or using the fuel in the gas turbine peaking units and replacing it with fuel within required limits or by the methods described for the DG fuel oil storage tank.The Completion Time of 60 days for the restoration of fuel oil properties to within limits is acceptable because the DG fuel oil storage tanks contain sufficient fuel for a minimum of 48 hours DG operation at the maximum load profile permitted by the diesels ratings. The Completion Time is acceptable because there is a high likelihood that the DG would still be capable of meeting requirements for starting and endurance even if fuel oil from the DG fuel oil reserve must be added to the DG fuel oil tanks during the time interval the fuel oil properties are outside specified limits. Additionally, IP2 is located in an area where compatible fuel oil is readily available.
Diesel Fuel Oil and Starting Air B 3.8.3 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.3 - 8 Revision 4 F.1With starting air receiver pressure < 250 psig, sufficient capacity for four successive DG start attempts does not exist. However, as long as the receiver pressure is  90 psig, there is adequate capacity for at least one normal start, and the DG can be considered OPERABLE while the air receiver pressure is restored to the required limit. The SR 3.8.3.5 limit for air start receiver pressure of 250 psig is an analytical limit. Therefore an appropriate allowance for instrument uncertainty must be applied when ensuring this limit is met. To allow for this instrument uncertainty, an administrative limit for starting air pressure of  > 260 psig is used. A period of 48 hours is considered sufficient to complete restoration to the required pressure prior to declaring the DG inoperable. This period is acceptable based on the remaining air start capacity, the fact that most DG starts are accomplished on the first attempt, and the low probability of an event during this brief period. Entry into Condition F is not required when air receiver pressure is less than required limits while the DG is operating following a successful start. G.1With a Required Action and associated Completion Time not met, or one or more DG's fuel oil or starting air subsystem is not within limits for reasons other than addressed by Conditions A through F, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable. SURVEILLANCE SR  3.8.3.1 REQUIREMENTSThis SR provides verification that there is an adequate inventory of fuel oil in the DG fuel oil reserve to support 2 DGs at the maximum load profile permitted by the diesels ratings for 7 days assuming requirements for the DG fuel oil storage tanks and day tanks are met. The 7 day duration with 2 of the 3 DGs at the maximum load profile permitted by the diesels ratings is sufficient to place the unit in a safe shutdown condition and to bring in replenishment fuel from a commercial source. This SR is modified by a Note that requires this SR to be met only when in MODES 1, 2, 3 or 4. The requirements for DG fuel oil are relaxed in recognition that in MODES 5 and 6 the reduced DG loading required to respond to events significantly reduces the amount of fuel oil required in the DG fuel oil storage tanks.
Diesel Fuel Oil and Starting Air B 3.8.3 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.8.3 - 9 Revision 4The 24 hour Frequency was needed because the DG fuel oil reserve is stored in fuel oil tanks that used to support the operation of gas turbine peaking units. This warrants frequent verification that required offsite DG fuel oil reserve volume is being maintained. Additionally, the DG fuel oil reserve includes oil designated for the exclusive use of Indian Point 3 and the IP3 UFSAR and the IP3 Technical Specifications require verification of the DG fuel oil reserve every 24 hours. SR  3.8.3.2SR 3.8.3.2.a provides verification when in MODES 1, 2, 3, and 4, that there is an adequate inventory of fuel oil in the DG fuel oil storage tanks to support at least 73 hours of operation at the maximum load profile permitted by the diesels ratings when all three DG fuel oil storage tanks are available or 45 hours of operation at the maximum load profile permitted by the diesels ratings when any two of the DG fuel oil storage tanks are available (Ref. 1). The 45 hour period of DG operation is sufficient time for a fuel transfer (from the fuel oil reserve or an offsite source) to be planned and conducted under accident conditions. SR 3.8.3.2.b provides verification when in MODES 5 and 6 that the minimum required fuel oil for operation in these MODES is available in one or more DG fuel oil storage tanks. The minimum required volume of fuel oil takes into account the reduced DG loading required to respond to events in MODES 5 and 6 is sufficient to support the two DGs required to be operable in MODES 5 and 6 while a fuel transfer from the offsite DG fuel oil reserve or from another offsite source is planned and conducted under accident conditions.This minimum volume required by SR 3.8.3.2.a and SR 3.8.3.2.b is the usable volume and does not include allowances for fuel not usable due to the fuel oil transfer pump cutoff switch (approximately 700 gallons).
Additionally, an allowance must be made for instrument accuracy depending on the method used to determine tank volume. These adjustments must be made for each tank for SR 3.8.3.2.b if the required volume is found in more than one DG fuel oil storage tank. The 31 day Frequency is adequate to ensure that a sufficient supply of fuel oil is available, since low level alarms are provided and unit operators would be aware of any large uses of fuel oil during this period.
Diesel Fuel Oil and Starting Air B 3.8.3 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.8.3 - 10 Revision 4SR  3.8.3.3 and SR  3.8.3.4SR 3.8.3.3 requires that fuel oil properties of new and stored fuel oil in the DG fuel oil storage tanks are tested and maintained in accordance with Technical Specification 5.5.11, " Diesel Fuel Oil Testing Program."SR 3.8.3.4 requires that fuel oil properties of new and stored fuel oil in the reserve storage tank(s) are within limits specified in Technical Specification 5.5.11. SR 3.8.3.4 is modified by a Note that requires this SR to be met only when in MODES 1, 2, 3 or 4 because the fuel oil in the reserve storage tank(s) is required only when in those MODES. These Surveillances verify that the properties of new and stored fuel oil meet the acceptance criteria established by Technical Specification 5.5.11, "Diesel Fuel Oil Testing Program." Sampling and testing requirements for the performance of diesel fuel oil testing in accordance with applicable ASTM Standards are specified in the administrative program developed to ensure that Technical Specification 5.5.11 is met. As required by Technical Specification 5.5.11, new fuel oil is sampled prior to addition to the DG fuel oil storage tanks and stored fuel oil is periodically sampled from the DG fuel oil storage tanks. Requirements and acceptance criteria for fuel oil are divided into 3 parts as follows:a) tests of the sample of new fuel and acceptance criteria that must be met prior to adding the new fuel to the DG fuel oil storage tanks;b) tests of the sample of new fuel that may be completed after the fuel is added to the DG fuel oil storage tanks; and,c) tests of the fuel oil stored in the DG fuel oil storage tanks. These tests are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion.
If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days.
The tests, limits, and applicable ASTM Standards are performed in accordance with the administrative program developed to ensure that Technical Specification 5.5.11 is met.
Diesel Fuel Oil and Starting Air B 3.8.3 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.8.3 - 11 Revision 4Failure to meet any of the Specification 5.5.11 limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO because the fuel oil is not added to the storage tanks. The tests of the sample of new fuel that may be completed after the fuel is added to the DG fuel oil storage tanks must be completed within 31 days.
The fuel oil is analyzed to establish that the other properties of the fuel oil meet the acceptance criteria of Technical Specification 5.5.11. The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on DG operation. Failure to meet the specified acceptance criteria requires entry into Condition D and restoration of the quality of the fuel oil in the DG fuel oil storage tank within the associated Completion Time and explained in the Bases for Condition D. This Surveillance ensures the availability of high quality fuel oil for the DGs. The periodic tests of the fuel oil stored in the DG fuel oil storage tanks verify that the length of time or conditions of storage has not degraded the fuel in a manner that could impact DG OPERABILITY. Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure. Particulate concentrations must meet the acceptance criteria of Technical Specification 5.5.11. It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing. The Frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals. SR  3.8.3.5This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each DG is available. The system design requirements provide for a minimum of four engine normal starts without recharging. However, all starting air will be consumed during a failed start attempt. The pressure specified in this SR is intended to reflect the lowest value at which the four successful starts can be accomplished.
Diesel Fuel Oil and Starting Air B 3.8.3 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.8.3 - 12 Revision 4 The 31 day Frequency takes into account the capacity, capability, redundancy, and diversity of the AC sources and other indications available in the control room, including alarms, to alert the operator to below normal air start pressure. SR  3.8.3.6Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel storage tanks once every 31 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, and contaminated fuel oil, and from breakdown of the fuel oil by bacteria.
Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies are consistent with Regulatory Guide 1.137 (Ref. 2). This SR is for preventive maintenance. Unless the volume of water is sufficient that it could impact DG OPERABILITY, presence of water does not necessarily represent failure of this SR, provided the accumulated water is removed within 7 days of performance of the Surveillance.REFERENCES 1. UFSAR, Section 8.2. 2. Regulatory Guide 1.137. 3. UFSAR, Chapter 14.
: 4. ANSI N195-1976, Appendix B.
DC Sources -OperatingB 3.8.4B 3.8  ELECTRICAL POWER SYSTEMSB 3.8.4DC Sources -Operating BASESBACKGROUND The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety relatedequipment and preferred AC vital bus power (via inverters). As required by 10CFR50, AppendixA, GDC17 (Ref.1), the DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure. The DC electrical power system is consistent with the recommendations of Regulatory Guide1.6 (Ref.2) and IEEE-308 (Ref.3).The 125VDC power supplies consist of four separate systems, each having its own battery, battery charger, and power panel. Each battery is fed from a separate charger and each charger is fed from a separate AC power panel.Under normal conditions, each battery charger supplies its DC loads, while maintaining its associated battery at full charge. The battery provides power to the DC loads when the battery charger is not available. Each battery has been sized to carry its expected shutdown loads for a period of 2hours following a plant trip and a loss of all AC power. All equipment supplied by the batteries are maintained operable with minimum expected voltages at the battery terminals during the 2hours. Each of the four battery chargers has been sized to recharge its own discharged battery within 15hours while carrying its normal load.Emergency diesel generators and all four 480V switchgear buses are safety-related and supply power to ESF systems and equipment. Therefore, two independent sources of DC control power are provided for control of 480V breakers, protective circuits and other devices. This is accomplished by automatic transfer switches located near each switchgear. A transfer from the preferred source to the alternate source occurs when the voltage of the preferred source falls below a predetermined value (100VDC), provided the voltage of the alternate source is above a predetermined value (112.5VDC).When the preferred source is restored to 112.5VDC or higher, the transfer switch will transfer back to the preferred source. With only one source energized, the transfer switch seeks the energized source. Lights indicate the available energized source.Thus, continuity of DC supply for the protection and control of the ESF Switchgear is maintained in the event of a loss of one DC source. INDIAN POINT 2B 3.8.4 - 1 Revision 4 DC Sources -OperatingB 3.8.4 BASESBACKGROUND  (continued)The preferred and alternate sources of DC control power for the breakers and DGs are:Transfer SwitchAssociated 480 V Bus Preferred SourceAlternate Source EDD1 6A PPNL #24 PPNL #22 EDD2 2A PPNL #22 PPNL #24 EDD3 3A PPNL #23 PPNL #21 EDD4 5A PPNL #21 PPNL #23 EDD5 DG-21 PPNL #21 PPNL #23 EDD6 DG-22 PPNL #23 PPNL #22 EDD7 DG-23 PPNL #24 PPNL #22The DC electrical power subsystems 21, 22, 23 and 24 also provide DC electrical power to the static inverters which supply power to the 118 VAC instrument buses.Each of the four DC electrical power subsystems supports one of the four Reactor Protection System (RPS) Instrumentation channels and one of the four Engineered Safety Features Actuation System (ESFAS)
Instrumentation channels. DC electrical power subsystems 21 and 22 each support one of the two trains of RPS Instrumentation actuation logic and one of the two trains of ESFAS Instrumentation actuation logic. Electrical distribution, including DC Sources, is described in the UFSAR (Ref.4).During normaloperation, the 125VDC load is powered from the battery chargers with the batteries floating on the system. In case of loss of normal power to the battery charger, the DC load is automatically powered from the station batteries.The DC power distribution system is described in more detail in Bases for LCO3.8.9, "Distribution Systems -Operating," and LCO3.8.10, "Distribution Systems -Shutdown."Each 125VDC battery is separately housed in a ventilated room apart from its charger and power panels. Each subsystem is separated electrically from the other subsystem to ensure that a single failure in one subsystem does not cause a failure in a redundant subsystem. There is no sharing between redundant subsystems, such as batteries, battery chargers, or power panels.Each battery has adequate storage capacity to meet the duty cycle(s) discussed in the UFSAR, Chapter 8 (Ref 4). The battery is designed with additional capacity above that required by the design duty cycle to allow for temperature variations and other factors.INDIAN POINT 2B 3.8.4 - 2 Revision 4 DC Sources -OperatingB 3.8.4 BASESBACKGROUND  (continued)The batteries are sized to produce required capacity at 85% of nameplate rating, corresponding to expected capacity at end of life cycles and the 100%
design demand. The minimum design voltage limit is 105 V. The battery cells are lead calcium construction with a nominal specific gravity of 1.215. This specific gravity corresponds to an open circuit battery voltage of approximately 120V for a 58 cell battery (i.e., cell voltage of 2.06volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging. Optimal long term performance however, is obtained by maintaining a float voltage of approximately 2.20 to 2.25 Vpc.
The nominal float voltage of 2.20 to2.25 Vpc corresponds to a total float voltage output of approximately 130V for a 58 cell battery.Each of the four DC electrical power subsystem battery chargers has ample power output capacity for the steady state operation of connected loads required during normal operation, while at the same time maintaining its battery bank fully charged. Each battery charger also has sufficient excess capacity to restore the battery from the design minimum charge to its fully charged state within 15hours while supplying normal steady state loads discussed in the UFSAR, Chapter8 (Ref.4).The battery charger is normally in the float-charge mode. Float-charge is the condition in which the charger is supplying the connected loads and the battery cells are receiving adequate current to optimally charge the battery.
This assures the internal losses of a battery are overcome and the battery is maintained in a fully charged state.When desired, the charger can be placed in the equalize mode. The equalize mode is at a higher voltage than the float mode and charging current is correspondingly higher. The battery charger is operated in the equalize mode after a battery discharge or for routine maintenance. Following a battery discharge, the battery recharge characteristic accepts current at the current limit of the battery charger (if the discharge was significant, e.g., following a battery service test) until the battery terminal voltage approaches the charger voltage setpoint. Charging current then reduces exponentially during the remainder of the recharge cycle.Lead-calcium batteries have recharge efficiencies of greater than 95%, so once at least 105% of the ampere-hours discharged have been returned, the battery capacity would be restored to the same condition as it was prior to the discharge. This can be monitored by direct observation of the exponentially decaying charging current or by evaluating the amp-hours discharged from the battery and amp-hours returned to the battery.INDIAN POINT 2B 3.8.4 - 3 Revision 4 DC Sources -OperatingB 3.8.4 BASESAPPLICABLE SAFETY ANALYSES The initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter14 (Ref.5), assume that Engineered Safety Feature (ESF) systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation.The OPERABILITY of the DC sources is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining the DC sources OPERABLE during accident conditions in the event of:a.An assumed loss of all offsite AC power or all onsite AC power and b.A worst-case single failure.
The DC sources satisfy Criterion3 of 10CFR50.36(c)(2)(ii).
LCOThis LCO requires the OPERABILITY of the following four DC electrical power subsystems:Battery 21 and associated Battery Charger; Battery 22 and associated Battery Charger; Battery 23 and associated Battery Charger; andBattery 24 and associated Battery Charger.In addition, the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the subsystem are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. Loss of any train DC electrical power subsystem does not prevent the minimum safety function from being performed (Ref.4).An OPERABLE DC electrical power subsystem requires the battery and respective charger to be operating and connected to the associated DC bus.APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES1, 2, 3, and4 to ensure safe unit operation and to ensure that:a.Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients andINDIAN POINT 2B 3.8.4 - 4 Revision 4 DC Sources -OperatingB 3.8.4 BASESAPPLICABILITY  (continued)b.Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.The DC electrical power requirements for MODES5 and6 are addressed in the Bases for LCO3.8.5, "DC Sources -Shutdown."ACTIONSA.1, A.2.1, A.2.2 and A.2.3ConditionA applies when one battery charger is inoperable and the plant is not in ConditionB for any other battery and/or charger.ConditionA represents one subsystem with one battery charger inoperable (e.g., the voltage limit of SR3.8.4.1 is not maintained). Required Action A.1, which requires immediate entry into Condition B, is intended to allow an inoperable battery charger to be treated as if the DC subsystem (i.e., both the battery and charger) is inoperable. This action is appropriate if it is not expected battery float voltage can be re-established within two hours. Additionally, the option of treating an inoperable battery charger as an inoperable DC subsystem is maintained if Required Actions associated with Condition B are met within the required Completion Time measured from the initial determination that the battery charger is inoperable.Required Actions A.2.1, A.2.2 and A.2.3 provide a tiered response that focuses on returning the battery to the fully charged state and restoring a fully qualified charger to OPERABLE status in a reasonable time period. Required Action A.2.1 requires that the battery terminal voltage be restored to greater than or equal to the minimum established float voltage within 2hours. This time provides for returning the inoperable charger to OPERABLE statusor providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that battery float current will be restored to within the limits of SR3.8.6.1 within 12hours as specified in Required Action A.2.2. Required Action A.2.2, performing SR3.8.6.1 every 12hours, ensures that the battery is OPERABLE and remainsOPERABLE during the time that the charger is inoperable.INDIAN POINT 2B 3.8.4 - 5 Revision 4 DC Sources -OperatingB 3.8.4 BASESACTIONS  (continued)Required ActionA.2.3 limits the restoration time for the inoperable battery charger to 7days. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class1E battery charger). The 7day Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.B.1.1, B.1.2, B.2 and B.3ConditionB applies when one subsystem's battery and/or charger is inoperable and the plant is not in ConditionA for an inoperable battery charger in any other DC electrical power subsystem.Each DC electrical power subsystem supplies DC control power for the associated 480V ESF switchgear and an associated DG and supplies a static inverter associated with one of the four 118 VAC instrument buses.
However, if any of the four DC electrical power subsystems (i.e., battery and/or charger) fail to maintain the associated DC power panel above the required voltage, the IP2 design provides for the automatic transfer of both DC control power and the vital instrument bus to an alternate source of
 
power.When a DC electrical power subsystem is inoperable for reasons other than ConditionA or if the election is made to enter ConditionB for an inoperable battery charger, Required Actions B.1.1 and B.1.2, require verification by administrative means that DC control power supplied by the inoperable battery and/or charger is either being supplied by the alternate source or that the automatic transfer switch that will cause the transfer to the alternate source is OPERABLE. Additionally, Required Action B.2 requires verification that inverters associated with all other DC electrical power subsystems are OPERABLE. This ensures that requirements in LCO3.8.7, "Inverters -
Operating," are met if the inoperable battery and/or changer have caused the associated static inverter to transfer to an alternate source. This Required Action also recognizes there is increased potential that the static inverter will transfer to the alternate source during an accident or transient.The 2hour Completion Time is based on Regulatory Guide1.93 (Ref.6) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if alternate sources of power for DC control power and the static inverter are not available, to initiate an orderly and safe unit shutdown. Required Action B.3 requires that an inoperable subsystem (i.e. battery and/or charger) be restored within 24hours. A Completion Time of 24hours for restoration of an inoperable DC electrical power subsystem is justified by the availability of alternate sources of control power for equipment INDIAN POINT 2B 3.8.4 - 6 Revision 4 DC Sources -OperatingB 3.8.4 BASESACTIONS  (continued)supported by the inoperable battery and/or charger. Additionally, Completion Time of 24hours is consistent with the allowable out of service time for RPS and ESFAS Instrumentation actuation logic trains in LCO 3.3.1,"Reactor Protection System (RPS) Instrumentation," and LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation."C.1 and C.2If an alternate source of power for the inoperable battery and/or charger are not available or the inoperable DC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is reduced. To achieve this status, the unit must be brought to at least MODE3 within 6hours and to MODE 4 within 12hours. Remaining within the Applicability of the LCO is acceptable to accomplish short duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 10). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 10, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.RequiredAction C.2 is modified by a Note that states that LCO3.0.4.a is not applicable when entering MODE4. This Note prohibits the use of LCO3.0.4.a to enter MODE4 during startup with the LCO not met.
However, there is no restriction on the use of LCO3.0.4.b, if applicable, because LCO3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE4, and establishment of risk management actions, if appropriate.LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems. The Completion Time to bring the unit to MODE 4 is consistent with the time required in Regulatory Guide1.93 (Ref.6).INDIAN POINT 2B 3.8.4 - 7 Revision 4 DC Sources -OperatingB 3.8.4 BASESSURVEILLANCESR3.8.4.1REQUIREMENTSVerifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the battery chargers, which support the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state while supplying thecontinuous steady state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to optimally charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by the battery manufacturer (2.20 to 2.25 Vpc or at least 127.6volts (2.20Vpc x 58cells) at the battery terminals). This voltage maintains the battery plates in a condition that supports maintaining battery life (expected to be approximately 18years).The 7day Frequency is consistent with recommendations in IEEE-450 (Ref.7).SR3.8.4.2This SR verifies the design capacity of the battery chargers. This SR provides two options. One option requires thateach battery charger be capable of supplying 250amps at the minimum established float voltage for 2hours. The ampere requirements are based on the output rating of the chargers. The voltage requirements are based on the charger voltage level after a response to a loss of AC power. The time period is sufficient for the charger temperature to have stabilized. The other option requires that each battery charger be capable of recharging the battery after a service test coincident with supplying the normal steady state load as described in Reference4. This level of loading may not be available following the battery service test and may need to be supplemented with additional loads. The duration for this test may be longer than the charger sizing criteria since the battery recharge is affected by float voltage, temperature, and the exponential decay in charging current. The battery is recharged when the measured charging current meets the requirements of SR 3.8.6.1.The Surveillance Frequency is acceptable, given the unit conditions required to perform the test and the other administrative controls that exist to ensure adequate charger performance during the 24month interval. In addition, this Frequency is intended to be consistent with expected fuel cycle lengths.INDIAN POINT 2B 3.8.4 - 8 Revision 4 DC Sources -OperatingB 3.8.4 BASESSURVEILLANCE REQUIREMENTS  (continued)SR3.8.4.3A battery service test is a special test of the battery capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length should correspond tothe design duty cycle requirements as specified in Reference4. The program established by Technical Specification 5.5.15, "Battery Monitoring and Maintenance Program," establishes specific requirements for this SR.The Surveillance Frequency of 24months is consistent with the recommendations of Regulatory Guide1.32 (Ref.8) and Regulatory Guide1.129 (Ref.9), which state that the battery service test should be performed during refueling operations, or at some other outage.This SRis modified by two Notes. Note1 allows the performance of a modified performance discharge test in lieu of a service test.The reason for Note2 is that performing the Surveillance would perturb the electrical distribution system and challenge safety systems. This restriction from normally performing the Surveillance in MODE1 or 2 is further amplified to allow portions of the Surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g. post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed partial Surveillance, a successful partial Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial Surveillance; as well as the operator proceduresavailable to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the Surveillance are performed in MODE1 or 2. Risk insights or deterministic methods may be used for the assessment.SR 3.8.4.4This SR verifies that the alternate source of DC control power will be connected immediately if the required battery and/or charger does not maintain the associated DC power panel above the required minimum voltage needed to support DC control power. This SR also confirms that DC control power will transfer back to the preferred source when preferred source INDIAN POINT 2B 3.8.4 - 9 Revision 4 DC Sources -OperatingB 3.8.4 BASESSURVEILLANCE REQUIREMENTS  (continued)voltage is restored. Specifically, the DC control power transfer switch willfunction as follows:
a.Transfers from the preferred source to the alternate source when the preferred source is <100VDC and the alternate source >112.5VDC;
 
and b.Transfers from the alternate source to the preferred source when the preferred source is > 112.5 VDC.OPERABILITY of this feature is needed only to justify a 24 hour Completion Time for restoration of an inoperable battery and/or charger. Therefore, this SR is modified by a NOTE that this SR is not required to be met unless needed to satisfyrequirements of Required Action B.1.2 when a battery and/or charger is inoperable.REFERENCES 1.10CFR.50, Appendix A.
2.Regulatory Guide1.6, March10,1971.
: 3. IEEE-308-1978.
4.UFSAR, Chapter8.5.UFSAR, Chapter14.
 
6.Regulatory Guide1.93, December1974.
: 7. IEEE-450-1995.
 
8.Regulatory Guide1.32, February1977.
9.Regulatory Guide1.129, December1974.
10.WCAP-16294-NP-A, Rev. 1,  "Risk-Informed Evaluationof Changes to Technical Specification Required Action Endstates for Westinghouse NSSS PWRs," June 2010. INDIAN POINT 2B 3.8.4 -10Revision 4 DC Sources -ShutdownB 3.8.5B 3.8  ELECTRICAL POWER SYSTEMSB 3.8.5DC Sources -Shutdown BASESBACKGROUND A description of the DC sources is provided in the Bases for LCO3.8.4, "DC Sources -Operating."APPLICABLE SAFETY ANALYSESThe initial conditions of Design Basis Accident and transient analyses in the UFSAR, Chapter14 (Ref.1), assume that Engineered Safety Feature systems are OPERABLE.The DC electrical power system provides normal and emergency DC electrical power for the diesel generators and control and switching during all MODES of operation.The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.The OPERABILITY of the minimum DC electrical power sources during MODES5 and 6 and during movement of recently irradiated fuel assemblies ensures that: a.The unit can be maintained in the shutdown or refueling condition for extended periods,b.Sufficient instrumentation and control capability is availablefor monitoring and maintaining the unit status, and c.Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident involving handling recently irradiated fuel.Due to radioactive decay, DC electrical power is only required to mitigate fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84hours (Ref.2)). In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6 because the energy contained within the reactor INDIAN POINT 2B 3.8.5 - 1 Revision 2 DC Sources - Shutdown B 3.8.5 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.8.5 - 2 Revision 2 pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems. The shutdown Technical Specification requirements are designed to ensure that the unit has the capability to mitigate the consequences of certain postulated accidents. Worst case Design Basis Accidents which are analyzed for operating MODES are generally viewed not to be a significant concern during shutdown MODES due to the lower energies involved. The Technical specifications therefore require a lesser complement of electrical equipment to be available during shutdown than is required during operating MODES. More recent work completed on the potential risks associated with shutdown, however, have found significant risk associated with certain shutdown evolutions. As a result, in addition to the requirements established in the Technical Specifications, the industry has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," as an industry initiative to manage shutdown tasks and associated electrical support to maintain risk at an acceptable low level. This may require the availability of additional equipment beyond that required by the shutdown Technical Specifications. The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCOThe DC electrical power subsystems, each required subsystem normally consisting of one battery, one battery charger per battery, and the corresponding control equipment and interconnecting cabling within the train, are required to be OPERABLE to support required trains of the distribution systems required OPERABLE by LCO 3.8.10, "Distribution Systems - Shutdown."  This ensures the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents involving handling recently irradiated fuel). DC subsystems may be cross connected in MODES 5 and 6 and during movement of recently irradiated fuel because there is no requirement for redundancy or separation between DC busses when the plant is in this condition. However, only one pair of subsystems at a time may be cross connected. A cross connection would typically be used to perform surveillance testing or maintenance. If the cross connection configuration takes a subsystem component out of service (e.g., a battery or battery charger), an evaluation of that configuration DC Sources - Shutdown B 3.8.5 BASESLCO (continued) INDIAN POINT 2 B 3.8.5 - 3 Revision 2 is required to demonstrate operability of the affected DC subsystems. Both DC subsystems in the cross connected pair remain operable, if the evaluation shows that the capacity of the single component (e.g., battery or battery charger) is adequate to carry loads on both busses, with no operator action, when the plant is in this connection.APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 5 and 6, and during movement of recently irradiated fuel assemblies, provide assurance that: a. Required features to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies in the core, b. Required features needed to mitigate a fuel handling accident involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84 hours (Ref. 2)) are available, c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available, and d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition. The DC electrical power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.4.
ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations.
Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily. A.1, A.2.1, A.2.2, A.2.3, and A.2.4If one or more DC electrical power subsystems are required by LCO 3.8.10 and one becomes inoperable, the remaining DC power available may be capable of supporting sufficient systems to allow continuation of CORE DC Sources - Shutdown B 3.8.5 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.5 - 4 Revision 2 ALTERATIONS and fuel movement involving handling recently irradiated fuel. By allowing the option to declare required features inoperable with the associated DC power source(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCO ACTIONS. In many instances this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of recently irradiated fuel assemblies, and operations involving positive reactivity additions) that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation.
Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM. Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystems and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the unit safety systems. The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power. SURVEILLANCE SR  3.8.5.1 REQUIREMENTSSR 3.8.5.1 requires performance of all Surveillances required by SR 3.8.4.1 through SR 3.8.4.3. Therefore, see the corresponding Bases for LCO 3.8.4 for a discussion of each SR. This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their capability to provide the required power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs must still be capable of being met, but actual performance is not required.
DC Sources - Shutdown B 3.8.5 BASESINDIAN POINT 2 B 3.8.5 - 5 Revision 2 REFERENCES 1. UFSAR, Chapter 14. 2. WCAP-16157, "Indian Point Unit 2 Stretch Power Uprating Licensing Report," January 2004.
Battery Parameters B 3.8.6 INDIAN POINT 2 B 3.8.6 - 1 Revision 1 B 3.8  ELECTRICAL POWER SYSTEMS B 3.8.6 Battery Parameters BASESBACKGROUND This LCO delineates the limits on battery float current as well as electrolyte temperature, level, and float voltage for the DC power subsystem batteries. A discussion of these batteries and their OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC Sources - Operating," and LCO 3.8.5, "DC Sources - Shutdown."  In addition to the limitations of this Technical Specification, the IP2 Battery Monitoring and Maintenance Program also implements a program specified in Technical Specification 5.5.15 for monitoring various battery parameters that is based on the recommendations of IEEE Standard 450-1995, "IEEE Recommended Practice For Maintenance, Testing, And Replacement Of Vented Lead-Acid Batteries For Stationary Applications" (Ref. 3). The battery cells are lead calcium construction with a nominal specific gravity of 1.215. This specific gravity corresponds to an open circuit battery voltage of approximately 120 V for 58 cell battery (i.e., cell voltage of 2.06 volts per cell (Vpc)). The open circuit voltage is the voltage maintained when there is no charging or discharging. Optimal long term performance however, is obtained by maintaining a float voltage of approximately 2.20 to 2.25 Vpc.
The nominal float voltage of between 2.20 and 2.25 Vpc corresponds to a total float voltage output of at least 127.6 V for a 58 cell battery. APPLICABLE SAFETY ANALYSESThe initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter 8 (Ref. 1) and Chapter 14 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the DGs, emergency auxiliaries, and control and switching during all MODES of operation.The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit. This includes maintaining at least three trains of DC sources OPERABLE during accident conditions, in the event of: a. An assumed loss of all offsite AC power or all onsite AC power and
: b. A worst-case single failure.
Battery Parameters B 3.8.6 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.8.6 - 2 Revision 1 Battery parameters satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCO Battery parameters must remain within acceptable limits to ensure availability of the required DC power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA.
Battery parameter limits are conservatively established, allowing continued DC electrical system function even with limits not met. Additional preventative maintenance, testing, and monitoring performed in accordance with the IP2 Battery Monitoring and Maintenance Program is conducted as specified in Specification 5.5.15. APPLICABILITY The battery parameters are required solely for the support of the associated DC electrical power subsystems. Therefore, battery parameter limits are only required when the DC power source is required to be OPERABLE. Refer to the Applicability discussion in Bases for LCO 3.8.4 and LCO 3.8.5.
ACTIONSA.1, A.2, and A.3With one or more cells in a battery < 2.07 V, the battery is degraded. Within 2 hours verification of the required battery charger OPERABILITY is made by monitoring the battery terminal voltage (SR 3.8.4.1) and of the overall battery state of charge by monitoring the battery float charge current (SR 3.8.6.1).
This assures that there is still sufficient battery capacity to perform the intended function. Therefore, the affected battery is not required to be considered inoperable solely as a result of one or more cells in one or more batteries < 2.07 V, and continued operation is permitted for a limited period up to 24 hours. Since the Required Actions only specify "perform," a failure of SR 3.8.4.1 or SR 3.8.6.1 acceptance criteria does not result in this Required Action not being met. However, if one of the SRs is failed, then the appropriate Condition(s) are entered depending on the cause of the failures. If SR 3.8.6.1 is failed then Condition F may be applicable.
Battery Parameters B 3.8.6 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.6 - 3 Revision 1 B.1 and B.2One battery with float current not within the limits of SR 3.8.6.1 indicates that a partial discharge of the battery capacity has occurred. This may be due to a temporary loss of a battery charger or possibly due to one or more battery cells in a low voltage condition reflecting some loss of capacity. Within 2 hours, Required Action B.1 requires verification of the required battery charger OPERABILITY by monitoring the battery terminal voltage using SR 3.8.4.1. If the terminal voltage is found to be less than the minimum established float voltage there are two possibilities, the battery charger is inoperable or is operating in the current limit mode. LCO 3.8.4, Condition A, addresses charger inoperability. If the charger is operating but still in the current limit mode after 2 hours, that is an indication that the battery has been substantially discharged and likely cannot perform its required design functions. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. If the battery cannot be recharged within 12 hours (Required Action B.2), then battery must be declared inoperable (Required Action F.1). If the float voltage is found to be satisfactory but there are one or more battery cells with float voltage less than 2.07 V, then Condition F is applicable and the battery must be declared inoperable immediately. If float voltage is satisfactory and there are no cells less than 2.07 V, there is good assurance that, within 12 hours, the battery will be restored to its fully charged condition (Required Action B.2) from any discharge that might have occurred due to a temporary loss of the battery charger.A discharged battery with float voltage (the charger setpoint) across its terminals indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery.
Thus there is good assurance of fully recharging the battery within 12 hours, avoiding a premature shutdown with its own attendant risk. If the condition is due to one or more cells in a low voltage condition but still greater than 2.07 V and float voltage is found to be satisfactory, this is not indication of a substantially discharged battery and 12 hours is a reasonable time prior to declaring the battery inoperable.
Battery Parameters B 3.8.6 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.6 - 4 Revision 1 Since Required Action B.1 only specifies "perform," a failure of SR 3.8.4.1 acceptance criteria does not result in the Required Action not being met.
However, if SR 3.8.4.1 is failed, then LCO 3.8.4, Condtion A, may be applicable.C.1, C.2, and C.3With one battery with one or more cells electrolyte level above the top of the plates, but below the minimum established design limits, the battery still retains sufficient capacity to perform the intended function. Therefore, the affected battery is not required to be considered inoperable solely as a result of electrolyte level not met. Required Action C.3 requires that the minimum established design limits for electrolyte level be re-established within
 
31 days. With electrolyte level below the top of the plates, there is a potential for dryout and plate degradation. Required Actions C.1 and C.2 address this condition and are only applicable if electrolyte level is below the top of the plates. If the level is below the top of the plates, Required Action C.1 requires that level is required to be restored to above the top of the plates within 8 hours and Required Action C.2 requires that a visual inspection verify that there is no leakage from the battery.Note that the program required by Technical Specification 5.5.15 may establish additional requirements from IEEE Standard 450-1995 (Ref. 3) for recovery from Condition A (e.g., Annex D Reference 3 could require an equalizing charge and testing in accordance with manufacturer's recommendation following the restoration of the electrolyte level to above the top of the plates).
D.1With one battery with pilot cell temperature less than the minimum established design limits, 12 hours is allowed to restore the temperature to within limits before the battery must be declared inoperable. A battery temperature below the design minimum results in a battery capacity less than assumed in the battery sizing calculation. This Condition is acceptable for 12 hours because the Condition is limited to one DC subsystem and the battery remains functional although with reduced capacity.
Battery Parameters B 3.8.6 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.6 - 5 Revision 1 E.1With more than one battery with battery parameters (i.e., temperature or level) not within limits, a degraded condition exists on more than one DC subsystem. In this Condition, there is not sufficient assurance that battery capacity has not been affected to the degree that the batteries can still perform their required function. This could result in a total loss of function on multiple systems that rely upon the batteries. Therefore, the longer Completion Times specified for restoration of battery parameters on single battery are not appropriate. Required Action E.1 requires that battery parameters for all but one battery be restored to within limits within 2 hours.
F.1If the Required Actions and Completion Times for Condition A, B, C, D or E are not met, the battery is inoperable and the Conditions and Required Actions of LCO 3.8.4, "DC Sources - Operating," or LCO 3.8.5, "DC Sources - Shutdown," are applicable. If a battery has one or more cells with float voltage less than the specified minimum, the battery capacity may not be sufficient to perform the intended functions. Therefore, the battery must be declared inoperable immediately and the Conditions and Required Actions of LCO 3.8.4 or LCO 3.8.5 are applicable.SURVEILLANCE SR  3.8.6.1 REQUIREMENTSVerifying battery float current while on float charge is used to determine the state of charge of the battery. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a charged state. The float current requirements are based on the float current indicative of a charged battery. Use of float current to determine the state of charge of the battery is consistent with IEEE-450 (Ref. 3). The 7 day Frequency is consistent with IEEE-450 (Ref. 3).
Battery Parameters B 3.8.6 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.8.6 - 6 Revision 1 This SR is modified by a Note that states the float current requirement is not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.4.1. If this float voltage is not maintained, then the Required Actions of LCO 3.8.4 Condition A are taken to provide the necessary and appropriate verifications of the battery condition.
Furthermore, the float current limit is established based on the nominal float voltage value and is not directly applicable when this voltage is not maintained.SR  3.8.6.2 and SR  3.8.6.5Optimal long term battery performance is obtained by maintaining a float voltage greater than or equal to the minimum established design limits provided by the battery manufacturer, which corresponds to at least 127.6 V at the battery terminals, or 2.20 Vpc. This provides adequate over-potential, which limits self discharge, which could eventually render the battery inoperable. Float voltages in this range or less, but greater than 2.07 Vpc, are addressed in Specification 5.5.15. SRs 3.8.6.1 and 3.8.6.4 require verification that the cell float voltages are equal to or greater than the short term absolute minimum voltage of 2.07 V. The Frequency for cell voltage verification every 31 days for pilot cell and 92 days for each connected cell is consistent with IEEE-450 (Ref. 3). SR  3.8.6.3The limit specified for electrolyte level ensures that the plates suffer no physical damage and maintains adequate electron transfer capability. The Frequency is consistent with IEEE-450 (Ref. 3). SR 3.8.6.4This Surveillance verifies that the pilot cell temperature is greater than or equal to the minimum established design limit (i.e., 59F). Pilot cell electrolyte temperature is maintained above this temperature to assure the battery can provided the required current and voltage to meet the design requirements. Temperatures lower than assumed in battery sizing calculations act to inhibit or reduce battery capacity. The Frequency is consistent with IEEE-450 (Ref. 3).
Battery Parameters B 3.8.6 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.8.6 - 7 Revision 1 SR  3.8.6.6A battery performance discharge test is a test of constant current capacity of a battery, normally done in the as found condition, after having been in service, to detect any change in the capacity determined by the acceptance test. The test is intended to determine overall battery degradation due to age and usage. Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.6.5; however, only the modified performance discharge test may be used to satisfy the battery service test requirements of SR 3.8.4.3. A modified discharge test is a test of the battery capacity and its ability to provide a high rate, short duration load (usually the highest rate of the duty cycle). This will often confirm the battery's ability to meet the critical period of the load duty cycle, in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a service test. It may consist of just two rates; for instance the one minute rate for the battery or the largest current load of the duty cycle, followed by the test rate employed for the performance test, both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a one minute discharge represents a very small portion of the battery capacity, the test rate can be changed to that for the performance test without compromising the results of the performance discharge test. The battery terminal voltage for the modified performance discharge test must remain above the minimum battery terminal voltage specified in the battery service test for the duration of time equal to that of the service test.The acceptance criteria for this Surveillance are consistent with the methodology of IEEE-450 (Ref. 3) and IEEE-485 (Ref. 4). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements. The acceptance criteria for this surveillance is battery replacement if capacity is below 85% of the manufacturer's rating, with the difference due to plant loading requirements, temperature limitations and  the expected battery end-of-life conditions. Furthermore, the battery is sized to meet the assumed duty cycle loads when the battery design capacity reaches this 85% limit.
Inverters - Shutdown B 3.8.8 INDIAN POINT 2 B 3.8.8 - 1 Revision 1 B 3.8  ELECTRICAL POWER SYSTEMS B 3.8.8 Inverters - Shutdown BASESBACKGROUND A description of the inverters is provided in the Bases for LCO 3.8.7, "Inverters - Operating." APPLICABLESAFETY ANALYSESThe initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter 14 (Ref. 1), assume Engineered Safety Feature systems are OPERABLE. The DC to AC inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the Reactor Protection System and Engineered Safety Features Actuation System instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.The OPERABILITY of one inverter to each 118 VAC instrument bus during MODES 5 and 6 ensures that: a. The unit can be maintained in the shutdown or refueling condition for extended periods, b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status, and c. Adequate power is available to mitigate events postulated during shutdown, such as a fuel handling accident involving handling recently irradiated fuel. Due to radioactive decay, the AC and DC inverters are only required to mitigate fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84 hours (Ref. 2)).In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents Inverters - OperatingB 3.8.7 INDIAN POINT 2B 3.8.7 - 1 Revision 2B 3.8  ELECTRICAL POWER SYSTEMSB 3.8.7 Inverters - Operating BASESBACKGROUNDThe inverters are the preferred source of power for the 118 VAC instrumentbuses because of the stability and reliability they achieve. The function of the inverter is to provide AC electrical power to the 118 VAC instrument buses.
Each inverter receives power from a different DC Power Panel. The station battery provides an uninterruptible power source for the instrumentation and controls for the Reactor Protection System (RPS) and the Engineered Safety Feature Actuation System (ESFAS). Specific details on inverters and their operating characteristics are found in the UFSAR, Chapter 8 (Ref. 1).In addition to the normal DC power source for the inverter, each inverter hasan associated step-down transformer that is used as alternate input power supply (118 VAC nominal) to the instrument buses. The alternate power supply is used to synchronize the inverter output to the auxiliary electrical system and to provide continuity of power to the vital 118 VAC loads in the unlikely event of an inverter failure. Each alternate power supply can be used to support the 118 VAC loads via the inverter internal static transfer switch or via an external manual bypass switch. Using either of these methods, the alternate input power source to each inverter is the same step-down transformer.Power is supplied to the instrument buses from the DC source via the inverteror from the step-down transformer as follows:
Inverter Normal SourceAlternate Power Supply 21DCPP 21MCC 26A 22DCPP 22MCC 24A 23DCPP 23MCC 29A 24DCPP 24MCC 27AIn the event of a loss of DC power to the inverter, the inverter's internal static transfer switch will automatically transfer the 118 VAC loads to the alternatepower supply. Additionally, each 118 VAC instrument bus has a manualtransfer switch mounted in a separate enclosure that can bypass the static transfer switch and provide backup power from the alternate power supply directly to the 118 VAC buses.
Inverters - OperatingB 3.8.7 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.8.7 - 2 Revision 2To ensure that a single failure of an emergency diesel-generator will notresult in the unavailability of more than one 118 VAC system, the normal and backup supplies for three of the instrument buses 21, 22, and 24 are fed from the associated emergency diesel-generator. Instrument bus 23 is normally fed from DG 22 with a backup supply from DG 21, providing diverse sources to prevent the potential loss of two instrument buses due to loss of a single
 
DG.The alternate power supply to the instrument busses will be interrupted duringaccident conditions involving a safety injection actuation (with or without loss of offsite power) and during a loss of offsite power. The alternate power supply will be available after the emergency diesel generator re-energizes the associated 480 V MCC. Depending on the event and the inverter, operator action may be needed to re-energize the alternate power supply. Therefore, operator action may be required to re-energize an 118 V instrument bus during an SI or a LOOP if the associated inverter is being bypassed or fails during the event.APPLICABLE SAFETY ANALYSESThe initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter 14 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. The inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability of necessary power to the RPS and ESFAS instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.The OPERABILITY of the inverters is consistent with the initial assumptionsof the accident analyses and is based on meeting the design basis of theunit. This includes maintaining required 118 VAC instrument busesOPERABLE during accident conditions in the event of:a. An assumed loss of all offsite AC electrical power or all onsite ACelectrical power andb. A worst case single failure.
Inverters are a part of the distribution system and, as such, satisfy Criterion 3of 10 CFR 50.36(c)(2)(ii).
Inverters - OperatingB 3.8.7 BASES INDIAN POINT 2B 3.8.7 - 3 Revision 2 LCOThe inverters ensure the availability of AC electrical power for the systemsinstrumentation required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated
 
DBA.Maintaining the required inverters OPERABLE ensures that the redundancyincorporated into the design of the RPS and ESFAS instrumentation and controls is maintained. The four inverters ensure an uninterruptible supply of AC electrical power to the 118 VAC instrument buses even if the 480 V safety
 
buses are de-energized.OPERABLE inverters require the associated 118 VAC instrument bus to bepowered by the inverter with output voltage and frequency within tolerances, and power input to the inverter from a station battery.APPLICABILITYThe inverters are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that:a. Acceptable fuel design limits and reactor coolant pressure boundarylimits are not exceeded as a result of AOOs or abnormal transients andb. Adequate core cooling is provided, and containment OPERABILITY andother vital functions are maintained in the event of a postulated DBA.Inverter requirements for MODES 5 and 6 are covered in the Bases forLCO 3.8.8, "Inverters - Shutdown."ACTIONSWith an inverter inoperable, its associated 118 VAC instrument bus will be inoperable until the bus is re-energized from its associated alternate power supply, except for the case when the inverter is inoperable due to high or low frequency. For this reason, a Note to the ACTIONS requires entry into the Conditions and Required Actions of LCO 3.8.9, "Distribution Systems -
Operating," until the 118 VAC instrument bus is energized. The Required Actions of LCO 3.8.9 will ensure that the 118 VAC instrument bus is re-energized within 2 hours.With an inverter inoperable due to high or low frequency, the associated 118VAC instrument bus will only be inoperable if the frequency is outside of the 57-63 Hz range and until a frequency adjustment can be made to the inverter to return it to operable.
Inverters - OperatingB 3.8.7 BASESACTIONS (continued)
INDIAN POINT 2B 3.8.7 - 4 Revision 2 A.1With an inverter inoperable for any reason other than high or low frequency,its associated 118 VAC instrument bus must be powered from its associated alternate power supply. However, the alternate power supply may be supported by MCCs that are stripped and not automatically re-connected following a SI signal or a LOOP. Therefore, operator action may be required to re-energize an 118 V instrument bus during an SI or a LOOP if the associated inverter is being bypassed or fails during the event.If the inverter is inoperable due to high or low frequency, then a transfer tothe instrument bus's alternate power supply cannot be performed using the inverter's static transfer switch when the inverter is not in sync with the alternate power supply. The inverter's frequency should be adjusted to return the inverter to operable, or return it to synchronization with the alternate supply, and subsequently allow the instrument bus to be transferred to the alternate power supply using the inverter's static transfer switch. If the inverter frequency cannot be adjusted it may become necessary to de-energize the inverter and use the external manual bypass switch to completely bypass the inverter and power the instrument bus from its alternate power supply.Required Action A.1 is necessary when the backup power supply is beingused in place of any of the inverters because the associated 118 VAC instrument bus may be de-energized following an SI signal or LOOP.
Therefore, a loss of safety function could exist for any function powered from the 118 VAC instrument bus if that function requires power to perform the required safety function if the redundant required feature is inoperable. To compensate for a potential loss of safety function, Required Action A.1 requires declaring required feature(s) supported by associated inverter inoperable when its required redundant feature(s) is inoperable. As specified in the associated Note, this requirement only applies to feature(s) that require power to perform the required safety function (e.g., automatic actuation of core spray, Regulatory Guide 1.97 instrumentation, etc.). The 2 hour Completion Time is consistent with LCO 3.8.9, "Distribution Systems -
Operating," requirements for an inoperable 118 VAC instrument bus.
A.2Required Action A.2 is necessary because the inverter, as an uninterruptiblepower source to the 118 VAC instrument bus, is the preferred source for powering instrumentation with trip setpoint devices and various control circuits. When an inverter is inoperable and its 118 VAC instrument bus is powered from the alternate power supply, there is increased potential forinadvertent actuation for ESFAS or RPS functions, especially if redundant Inverters - OperatingB 3.8.7 BASESACTIONS (continued)
INDIAN POINT 2B 3.8.7 - 5 Revision 2channels are inoperable and in the tripped condition. This is because these'de-energize to actuate functions' are relying upon interruptible AC electrical power sources (offsite and onsite). Therefore, only one inverter may be inoperable at one time and an inoperable inverter must be restored to OPERABLE within 24 hours. The 24 hour Completion Time is needed because it ensures that the 118 VAC instrument buses are powered from the uninterruptible inverter source. The 24 hour Completion Time is acceptable because Required Action A.1 ensures that an inoperable inverter does not result in a loss of any safety function.B.1 and B.2If the inoperable devices or components cannot be restored to OPERABLEstatus within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is reduced. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within
 
12 hours.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 3). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 3, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action B.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 4, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
Inverters - OperatingB 3.8.7 BASES INDIAN POINT 2B 3.8.7 - 6 Revision 2SURVEILLANCESR  3.8.7.1REQUIREMENTSThis Surveillance verifies that the inverters are functioning properly with allrequired circuit breakers closed and 118 VAC instrument buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation of the RPS and ESFAS connected to the 118 VAC instrument buses. The 7 day Frequency takes into account the redundant capability of the inverters and other indications available in the control room that alert the operator to inverter malfunctions.REFERENCES 1.UFSAR, Chapter 8.2. UFSAR Chapter 14.
3.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changes toTechnical Specification Required Action Endstates for Westinghouse NSSS PWRs," June 2010.
Inverters - Shutdown B 3.8.8 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.8.8 - 2 Revision 1 (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems. The shutdown Technical Specification requirements are designed to ensure that the unit has the capability to mitigate the consequences of certain postulated accidents. Worst case Design Basis Accidents which are analyzed for operating MODES are generally viewed not to be a significant concern during shutdown MODES due to the lower energies involved. The Technical specifications therefore require a lesser complement of electrical equipment to be available during shutdown than is required during operating MODES. More recent work completed on the potential risks associated with shutdown, however, have found significant risk associated with certain shutdown evolutions. As a result, in addition to the requirements established in the Technical Specifications, the industry has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," as an Industry initiative to manage shutdown tasks and associated electrical support to maintain risk at an acceptable low level. This may require the availability of additional equipment beyond that required by the shutdown Technical Specifications. The inverters were previously identified as part of the distribution system and, as such, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCOThe inverters ensure the availability of electrical power for the instrumentation for systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or a postulated DBA. The battery powered inverters provide uninterruptible supply of AC electrical power to the 118 VAC instrument buses even if the 480 V safety buses are de-energized. OPERABILITY of the inverters requires that the 118 VAC instrument bus be powered by the inverter. This ensures the availability of sufficient inverter power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents involving handling recently irradiated fuel).
Inverters - Shutdown B 3.8.8 BASESINDIAN POINT 2 B 3.8.8 - 3 Revision 1 APPLICABILITY The inverters required to be OPERABLE in MODES 5 and 6 and during movement of recently irradiated fuel assemblies provide assurance that: a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core, b. Systems needed to mitigate a fuel handling accident involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84 hours (Ref. 2)) are available,c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available, and d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition. Inverter requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.7.
ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily. A.1, A.2.1, A.2.2, A.2.3, and A.2.4If one or more 118 VAC instrument buses are required by LCO 3.8.10, "Distribution Systems - Shutdown," the remaining OPERABLE inverters may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, recently irradiated fuel movement, and operations with a potential for positive reactivity additions. By the allowance of the option to declare required features inoperable with the associated inverter(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCOs' Required Actions. In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of recently irradiated fuel assemblies, and operations involving positive reactivity additions) that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6). Suspending Inverters - Shutdown B 3.8.8 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.8 - 4 Revision 1 positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM. Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required inverters and to continue this action until restoration is accomplished in order to provide the necessary inverter power to the unit safety systems. The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required inverters should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power or powered from a constant voltage source transformer. SURVEILLANCE SR  3.8.8.1 REQUIREMENTSThis Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and AC vital buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation connected to the AC vital buses. The 7 day Frequency takes into account the redundant capability of the inverters and other indications available in the control room that alert the operator to inverter malfunctions. REFERENCES 1. UFSAR, Chapter 14. 2. WCAP-16157, "Indian Point Unit 2 Stretch Power Uprating Licensing Report," January 2004.
Distribution Systems - OperatingB 3.8.9 INDIAN POINT 2B 3.8.9 - 1 Revision 3B 3.8  ELECTRICAL POWER SYSTEMSB 3.8.9Distribution Systems - Operating BASESBACKGROUNDThe onsite AC, DC, and 118 VAC instrument bus electrical power distributionsystems are divided into three safeguards power trains, four 125 VDC bus subsystems, and four 118 VAC instrument buses.The safeguards subsystems are arranged in three trains (5A, 2A/3A and 6A)such that any two trains are capable of meeting minimum requirements for accident mitigation or safe shutdown. The electrical subsystems are identified in Table B 3.8.9-1.The AC electrical power subsystem for each train consists of an EngineeredSafety Feature (ESF) 480 V bus and motor control centers. Each 480 V bus has at least one offsite source of power as well as a dedicated onsite diesel generator (DG) source. Each of the four 480 V buses can receive offsite power from either the 138 kV (normal) or 13.8 kV (alternate) offsite source.
The 138 kV offsite power source uses either of the two 138 kV ties from the Buchanan substation. The 13.8 kV offsite power source uses either of the two 13.8 kV ties from the Buchanan substation. There is no automatic transfer from the 138 kV to the 13.8 kV source of offsite power.Offsite power to 480 V buses 5A and 6A is supplied from 6.9 kV buses 5and 6, respectively, which in turn receive power from either 138 kV offsite feeder via the Station Auxiliary Transformer (SAT). Alternately, 6.9 kV buses 5 and 6 can be supplied from either of the two 13.8 kV ties via an auto-transformer associated with the 13.8 kV feeder being used.When the plant is at power, 480 V buses 2A and 3A are normally poweredfrom the Main Generator via the Unit Auxiliary Transformer (UAT) and the 6.9 kV buses 2 and 3 via SSTs 2 and 3. When the plant is not operating, buses 2A and 3A are supplied from 6.9 kV buses 5 and 6 via 6.9 kV buses 2 and 3, respectively, via tie breakers. Following a unit trip, power to 480 V buses 2A and 3A is maintained by a fast transfer that connects buses 2A and 3A to power supplied from offsite to 6.9 kV buses 5 and 6. Additional description of this system may be found in the Bases for LCO 3.8.1, "AC Sources - Operating," and the Bases for LCO 3.8.4, "DC Sources -
Operating."The AC electrical power distribution subsystems required for accidentmitigation or safe shutdown includes the safety related buses, motor control centers, and distribution panels shown in Table B 3.8.9-1.
Distribution Systems - OperatingB 3.8.9 BASESBACKGROUND  (continued)
INDIAN POINT 2B 3.8.9 - 2 Revision 3The 118 VAC instrument buses are arranged in four load groups and arenormally powered from the inverters. To ensure that a single failure of an emergency diesel-generator will not result in the unavailability of more than one 118 VAC system, the normal and backup supplies for three of the instrument buses 21, 22, and 24 are fed from the associated emergencydiesel-generator. Instrument bus 23 is fed from emergency diesel generators21 and 22, providing diverse sources to prevent loss of this bus due to loss of a single emergency diesel-generator. Inverters are governed by LCO 3.8.7, "Inverters - Operating."The 125 volt DC system is divided into four buses with one battery andbattery charger (supplied from the 480 volt system) serving each. The battery chargers supply the normal DC loads as well as maintaining proper charges on the batteries. The DC system is redundant from battery source to actuation devices which are powered from the batteries. Four batteries feed four DC power panels, which in turn feed major loads, such as instrument bus inverters and switchgear control circuits. DC power panels 21, 22, 23 and 24 feed DC distribution panels, which in turn feed DC control power and instrumentation loads.The list of all required DC and AC distribution buses is presented inTable B 3.8.9-1.APPLICABLE
 
SAFETY ANALYSESThe initial conditions of Design Basis Accident (DBA) and transient analyses in the UFSAR, Chapter 14 (Ref. 1), assume ESF systems are OPERABLE.
The AC, DC, and 118 VAC instrument bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. These limits are discussed in more detail in the Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, Containment Systems.The OPERABILITY of the AC, DC, and 118 VAC instrument bus electricalpower distribution systems is consistent with the initial assumptions of the accident analyses and is based upon meeting the design basis of the unit.
This includes maintaining power distribution systems OPERABLE during accident conditions in the event of:
Distribution Systems - OperatingB 3.8.9 BASESAPPLICABLE SAFETY ANALYSES  (continued)
INDIAN POINT 2B 3.8.9 - 3 Revision 3a. A loss of all offsite power or all onsite AC electrical power andb. A worst case single failure.The distribution systems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
LCOThe required power distribution subsystems listed in Table B 3.8.9-1 ensurethe availability of AC, DC, and 118 VAC instrument bus electrical power for the systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. The AC, DC, and 118 VAC instrument bus electrical power distribution subsystems are required to be OPERABLE.Maintaining the AC, DC, and 118 VAC instrument bus electrical powerdistribution subsystems OPERABLE ensures that the redundancy incorporated into the design of ESF is not defeated. Therefore, a single failure within any system or within the electrical power distribution subsystems will not prevent safe shutdown of the reactor.OPERABLE AC electrical power distribution subsystems require theassociated buses, motor control centers, and distribution panels to be energized to their proper voltages. OPERABLE DC electrical power distribution subsystems require the associated buses and distribution panels to be energized to their proper voltage from either the associated battery or charger. OPERABLE 118 VAC instrument bus electrical power distribution subsystems require the associated buses to be energized to their proper voltage from the associated inverter via inverted DC voltage, inverter using internal AC source, or external constant voltage transformer.In addition, tie breakers between redundant safety related AC, DC, and118 VAC instrument bus power distribution subsystems, if they exist, must be open. This prevents any electrical malfunction in any power distribution subsystem from propagating to the redundant subsystem, that could cause the failure of a redundant subsystem and a loss of essential safety function(s). If any tie breakers are closed, the affected redundant electrical power distribution subsystems are considered inoperable. This applies to the onsite, safety related redundant electrical power distribution subsystems. It does not, however, preclude redundant 480 V buses from being powered from the same offsite circuit.
Distribution Systems - OperatingB 3.8.9 BASES INDIAN POINT 2B 3.8.9 - 4 Revision 3APPLICABILITYThe electrical power distribution subsystems are required to be OPERABLEin MODES 1, 2, 3, and 4 to ensure that:a. Acceptable fuel design limits and reactor coolant pressure boundarylimits are not exceeded as a result of AOOs or abnormal transients andb. Adequate core cooling is provided, and containment OPERABILITY andother vital functions are maintained in the event of a postulated DBA.Electrical power distribution subsystem requirements for MODES 5 and 6 arecovered in the Bases for LCO 3.8.10, "Distribution Systems - Shutdown."ACTIONS A.1With one or more required AC buses, motor control centers, or distribution panels (except 118 VAC instrument buses), in one train inoperable and a loss of safety function has not occurred, the remaining AC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure and that all redundant required features are OPERABLE. The overall reliability is reduced, however, because a single failure in the remaining power distribution subsystems could result in the minimum required ESF functions not being supported.
Therefore, the required AC buses, motor control centers, and distribution panels must be restored to OPERABLE status within 8 hours.Condition A worst scenario is one train without AC power (i.e., no offsitepower to the train and the associated DG inoperable). In this Condition, the unit is more vulnerable to a loss of the minimum required AC power. It is, therefore, imperative that the unit operator's attention be focused on minimizing the potential for loss of power to the remaining trains by stabilizing the unit, and on restoring power to the affected train. The 8 hour time limit before requiring a unit shutdown in this Condition is acceptable because of:a. The potential for decreased safety if the unit operator's attention isdiverted from the evaluations and actions necessary to restore power tothe affected train, to the actions associated with taking the unit to shutdown within this time limit and Distribution Systems - OperatingB 3.8.9 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.9 - 5 Revision 3b. The potential for an event in conjunction with a single failure of aredundant component in the train with AC power.The second Completion Time for Required Action A.1 establishes a limit onthe maximum time allowed for any combination of required distributionsubsystems to be inoperable during any single contiguous occurrence offailing to meet the LCO. If Condition A is entered while, for instance, a DC bus is inoperable and subsequently restored OPERABLE, the LCO may already have not been met for up to 2 hours. This could lead to a total of 10 hours, since initial failure of the LCO, to restore the AC distribution system. At this time, a DC circuit could again become inoperable, and AC distribution restored OPERABLE. This could continue indefinitely.The Completion Time allows for an exception to the normal "time zero" forbeginning the allowed outage time "clock."  This will result in establishing the "time zero" at the time the LCO was initially not met, instead of the time Condition A was entered. The 16 hour Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.Required Action A.1 is modified by a Note that requires the applicableConditions and Required Actions of LCO 3.8.4, "DC Sources - Operating," to be entered for DC trains made inoperable by inoperable power distribution subsystems. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components. Inoperability of a distribution system can result in loss of charging power to batteries and eventual loss of DC power. This Note ensures that the appropriate attention is given to restoring charging power to batteries, if necessary, after loss of distribution systems.
B.1With one or more 118 VAC instrument buses inoperable, and a loss of safetyfunction has not occurred, the remaining OPERABLE 118 VAC instrument buses are capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition. Overall reliability is reduced, however, since an additional single failure could result in the minimum ESF functions not being supported. Therefore, the required 118 VAC instrument bus must be restored to OPERABLE status within 2 hours by powering the bus from the associated inverter via inverted DC, inverter using internal AC source, or constant voltage transformer.
Distribution Systems - OperatingB 3.8.9 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.9 - 6 Revision 3Condition B represents one or more 118 VAC instrument buses withoutpower; potentially both the DC source and the associated AC source are nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss of noninterruptible power. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential forloss of power to the remaining 118 VAC instrument buses and restoringpower to the affected 118 VAC instrument bus.This 2 hour limit is more conservative than Completion Times allowed for thevast majority of components that are without power from the 118 VAC instrument bus. Taking exception to LCO 3.0.2 for components without power from the 118 VAC instrument bus, that would have the Required Action Completion Times shorter than 2 hours if declared inoperable, is acceptable because of:a. The potential for decreased safety by requiring a change in unitconditions (i.e., requiring a shutdown) and not allowing stableoperations to continue,b. The potential for decreased safety by requiring entry into numerousApplicable Conditions and Required Actions for components without power from the 118 VAC instrument bus and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train, andc. The potential for an event in conjunction with a single failure of aredundant component.The 2 hour Completion Time takes into account the importance to safety of restoring the 118 VAC instrument bus to OPERABLE status, the redundant capability afforded by the other OPERABLE 118 VAC instrument buses, and the low probability of a DBA occurring during this period.The second Completion Time for Required Action B.1 establishes a limit onthe maximum allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an AC bus is inoperable and subsequently returned OPERABLE, the LCO may already have been not met for up to 8 hours. This could lead to a total of 10 hours, since initial failure of the LCO, to restore the 118 VAC instrument bus distribution system. At this time, an AC train could again become inoperable, and 118 VAC instrument bus distribution restored OPERABLE. This could continue indefinitely.
Distribution Systems - OperatingB 3.8.9 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.9 - 7 Revision 3This Completion Time allows for an exception to the normal "time zero" forbeginning the allowed outage time "clock."  This will result in establishing the "time zero" at the time the LCO was initially not met, instead of the time Condition B was entered. The 16 hour Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.C.1With one or more DC buses or distribution panels inoperable, and a loss offunction has not occurred, the remaining DC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure and that redundant required features are OPERABLE. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the DC buses and distribution panels must be restored to OPERABLE status within 2 hours by powering the bus from the associated battery or charger.Condition C represents one or more DC buses or distribution panels withoutadequate DC power; potentially both with the battery significantly degraded and the associated charger nonfunctioning. In this situation, the unit is significantly more vulnerable to a loss of minimum required DC power. It is, therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining trains and restoring power to the affected train.This 2 hour limit is more conservative than Completion Times allowed for thevast majority of components that would be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 2 hours, is acceptable because of:a. The potential for decreased safety by requiring a change in unitconditions (i.e., requiring a shutdown) while allowing stable operationsto continue,b. The potential for decreased safety by requiring entry into numerousapplicable Conditions and Required Actions for components without DC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected
 
train, and Distribution Systems - OperatingB 3.8.9 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.9 - 8 Revision 3c. The potential for an event in conjunction with a single failure of aredundant component.The 2 hour Completion Time for DC buses is consistent with RegulatoryGuide 1.93 (Ref. 2). The second Completion Time for Required Action C.1 establishes a limit on the maximum time allowed for any combination of required distribution subsystems to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition C is entered while, for instance, an AC bus is inoperable and subsequently returned OPERABLE, the LCO may already have been not met for up to 8 hours. This could lead to a total of 10 hours, since initial failure of the LCO, to restore the DC distribution system. At this time, an AC train could again become inoperable, and DC distribution restored OPERABLE. This could continue indefinitely.This Completion Time allows for an exception to the normal "time zero" forbeginning the allowed outage time "clock."  This will result in establishing the "time zero" at the time the LCO was initially not met, instead of the time Condition C was entered. The 16 hour Completion Time is an acceptable limitation on this potential to fail to meet the LCO indefinitely.D.1 and D.2If the inoperable distribution subsystem cannot be restored to OPERABLEstatus within the required Completion Time, the unit must be brought to a MODE in which overall plant risk is reduced. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours and to MODE 4 within
 
12 hours.Remaining within the Applicability of the LCO is acceptable to accomplishshort duration repairs to restore inoperable equipment because the plant risk in MODE 4 is similar to or lower than MODE 5 (Ref. 3). In MODE 4 the Steam Generators and Residual Heat Removal System are available to remove decay heat, which provides diversity and defense in depth. As stated in Reference 3, the steam turbine driven Auxiliary Feedwater Pump must be available to remain in MODE 4. Should Steam Generator cooling be lost while relying on this Required Action, there are preplanned actions to ensure long-term decay heat removal. Voluntary entry into MODE 5 may be made as it is also acceptable from a risk perspective.Required Action D.2 is modified by a Note that states that LCO 3.0.4.a isnot applicable when entering MODE 4. This Note prohibits the use of LCO 3.0.4.a to enter MODE 4 during startup with the LCO not met.
However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the Distribution Systems - OperatingB 3.8.9 BASESACTIONS  (continued)
INDIAN POINT 2B 3.8.9 - 9 Revision 3results, determination of the acceptability of entering MODE 4, andestablishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.The allowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.
E.1Condition E corresponds to a level of degradation in the electrical powerdistribution system that causes a required safety function to be lost. When more than one inoperable electrical power distribution subsystem results in the loss of a required function, the plant is in a condition outside the accident analysis. Therefore, no additional time is justified for continued operation.
LCO 3.0.3 must be entered immediately to commence a controlled shutdown.SURVEILLANCESR  3.8.9.1REQUIREMENTSThis Surveillance verifies that the AC, DC, and 118 VAC instrument bus electrical power distribution systems listed in Table B 3.8.9-1 are functioning properly, with the correct circuit breaker alignment. The correct breaker alignment ensures the appropriate separation and independence of the electrical divisions is maintained, and the appropriate voltage is available to each required bus. The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. The 7 day Frequency takes into account the redundant capability of the AC, DC, and 118 VAC instrument bus electrical power distribution subsystems, and other indications available in the control room that alert the operator to subsystem malfunctions.REFERENCES 1.UFSAR, Chapter 14.
2.Regulatory Guide 1.93, December 1974.
3.WCAP-16294-NP-A, Rev. 1, "Risk-Informed Evaluation of Changes to Technical Specification Required Action Endstates For Westinghouse NSSS PWRs," June 2010.
Distribution Systems - OperatingB 3.8.9 INDIAN POINT 2B 3.8.9 - 10 Revision 3Table B 3.8.9-1 (page 1 of 1)AC and DC Electrical Power Distribution SystemsType Voltage SafeguardsPower Train 5A (DG 21)SafeguardsPower Train 2A/3A (DG 22)SafeguardsPower Train 6A (DG 23)AC Electrical Power Distribution subsystems 480 V Bus 5AMCC 26AMCC 26AA MCC 29A Bus 2AMCC 24A Bus 3A MCC 26CMCC 211 Bus 6AMCC 26BMCC 26BB MCC 27A DC Power Panels 125 VPanel 21Panel 22Panel 23Panel 24AC instrument
 
buses 118 V Bus 21 Bus 21A Bus 22 Bus 22A Bus 23 Bus 23A Bus 24 Bus 24AEach of the three safeguards power trains is a train or a subsystem.Each of the four 118 VAC instrument buses is a train or a subsystem.
(1) Tie breakers must be open between buses 5A and 2A and between buses 3A and 6A whenin MODE 1, 2, 3 and 4.(2) Tie breakers between DC in different subsystem buses must be open when in MODE 1, 2, 3 and 4.
Distribution Systems - Shutdown B 3.8.10 INDIAN POINT 2 B 3.8.10 - 1 Revision 1 B 3.8  ELECTRICAL POWER SYSTEMS B 3.8.10 Distribution Systems - Shutdown BASESBACKGROUND A description of the AC, DC, and 118 VAC instrument bus electrical power distribution systems is provided in the Bases for LCO 3.8.9, "Distribution Systems - Operating." APPLICABLE SAFETY ANALYSESThe initial conditions of Design Basis Accident and transient analyses in the UFSAR, Chapter 14 (Ref. 1), assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC, DC, and 118 VAC instrument bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded. The OPERABILITY of the AC, DC, and 118 VAC instrument bus electrical power distribution system is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.The OPERABILITY of the minimum AC, DC, and 118 VAC instrument bus electrical power distribution subsystems during MODES 5 and 6, and during movement of recently irradiated fuel assemblies ensures that:a. The unit can be maintained in the shutdown or refueling condition for extended periods, b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status, and c. Adequate power is provided to mitigate events postulated during shutdown, such as a fuel handling accident involving handling recently irradiated fuel. Due to radioactive decay, AC and DC electrical power is only required to mitigate fuel handling accidents involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84 hours (Ref. 2)).The AC and DC electrical power distribution systems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Distribution Systems - Shutdown B 3.8.10 BASESINDIAN POINT 2 B 3.8.10 - 2 Revision 1 LCO Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific plant condition. Implicit in those requirements is the required OPERABILITY of necessary support required features. This LCO explicitly requires energization of the portions of the electrical distribution system (see Table B 3.8.9-1, AC and DC Electrical Power Distribution Systems) necessary to support OPERABILITY of required systems, equipment, and components - all specifically addressed in each LCO and implicitly required via the definition of OPERABILITY. Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the unit in a safe manner to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents involving handling recently irradiated fuel).APPLICABILITY The AC and DC electrical power distribution subsystems required to be OPERABLE in MODES 5 and 6, and during movement of recently irradiated fuel assemblies, provide assurance that: a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core, b. Systems needed to mitigate a fuel handling accident involving handling recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84 hours (Ref. 2)) are available,c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available, and d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition and refueling condition.The AC, DC, and 118 VAC instrument bus electrical power distribution subsystems requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.9.
Distribution Systems - Shutdown B 3.8.10 BASESINDIAN POINT 2 B 3.8.10 - 3 Revision 1 ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the ACTIONS have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operations.
Entering LCO 3.0.3, while in MODE 1, 2, 3, or 4 would require the unit to be shutdown unnecessarily. A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5Although redundant required features may require redundant trains of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem train may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and recently irradiated fuel movement. By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected distribution subsystem LCO's Required Actions. In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of recently irradiated fuel assemblies, and operations involving positive reactivity additions that could result in loss of required SDM (MODE 5) or boron concentration (MODE 6). Suspending positive reactivity additions that could result in failure to meet the minimum SDM or boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum SDM or refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Introduction of temperature changes including temperature increases when operating with a positive MTC must also be evaluated to ensure they do not result in a loss of required SDM. Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.
Distribution Systems - Shutdown B 3.8.10 BASESACTIONS  (continued) INDIAN POINT 2 B 3.8.10 - 4 Revision 1 Notwithstanding performance of the above conservative Required Actions, a required residual heat removal (RHR) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR ACTIONS would not be entered. Therefore, Required Action A.2.5 is provided to direct declaring RHR inoperable, which results in taking the appropriate RHR actions. The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power. SURVEILLANCE SR  3.8.10.1 REQUIREMENTSThis Surveillance verifies that the AC, DC, and 118 VAC instrument bus electrical power distribution subsystems are functioning properly, with all the buses energized. The verification of proper voltage availability ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The 7 day Frequency takes into account the capability of the electrical power distribution subsystems, and other indications available in the control room that alert the operator to subsystem malfunctions. REFERENCES 1. UFSAR, Chapter 14. 2. WCAP-16157, "Indian Point Unit 2 Stretch Power Uprating Licensing Report," January 2004.
Boron Concentration B 3.9.1 INDIAN POINT 2 B 3.9.1 - 1 Revision 1 B 3.9  REFUELING OPERATIONS B 3.9.1 Boron Concentration BASESBACKGROUND The limit on the boron concentrations of the Reactor Coolant System (RCS), the refueling canal, and the refueling cavity during refueling ensures that the reactor remains subcritical during MODE 6. Refueling boron concentration is the soluble boron concentration in the coolant in each of these volumes having direct access to the reactor core during refueling. The soluble boron concentration offsets the core reactivity and is measured by chemical analysis of a representative sample of the coolant in each of the volumes. The refueling boron concentration limit is specified in the COLR.
Plant procedures ensure the specified boron concentration in order to maintain an overall core reactivity of k eff 0.95 during fuel handling, with control rods and fuel assemblies assumed to be in the most adverse configuration (least negative reactivity) allowed by plant procedures. GDC 26 of 10 CFR 50, Appendix A, requires that two independent reactivity control systems of different design principles be provided (Ref. 1). However, only one of these systems must be capable of holding the reactor core subcritical under cold conditions. The Chemical and Volume Control System (CVCS) is the system capable of maintaining the reactor subcritical in cold conditions by maintaining the boron concentration. The reactor is brought to shutdown conditions before beginning operations to open the reactor vessel for refueling. After the RCS is cooled and depressurized and the vessel head is unbolted, the head is slowly removed to form the refueling cavity. The refueling canal and the refueling cavity are then flooded with borated water from the refueling water storage tank through the open reactor vessel by gravity feeding, by the use of the Residual Heat Removal (RHR) System pumps, or either containment spray system pump using temporary spool pieces. The pumping action of the RHR System in the RCS and the natural circulation due to thermal driving heads in the reactor vessel and refueling cavity mix the added concentrated boric acid with the water in the refueling canal. The RHR System is in operation during refueling (see LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level,"
and LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation -
Low Water Level") to provide forced circulation in the RCS and assist in maintaining the boron concentrations in the RCS, the refueling canal, and the refueling cavity above the COLR limit.
Boron Concentration B 3.9.1 BASESINDIAN POINT 2 B 3.9.1 - 2 Revision 1 APPLICABLESAFETY ANALYSESDuring refueling operations, the reactivity condition of the core is consistent with the initial conditions assumed for the boron dilution accident in the accident analysis and is conservative for MODE 6. The boron concentration limit specified in the COLR is based on the core reactivity at the beginning of each fuel cycle (the end of refueling) and includes a core reactivity uncertainty allowance. The required boron concentration and the plant refueling procedures, that include use of two independent checks to verify correct fuel assembly and location, ensure that the k eff of the core will remain  0.95 during the refueling operation. Hence, at least a 5% k/k margin of safety is established during refueling. During refueling, the water volume in the spent fuel pit, the refueling canal, the refueling cavity, and the reactor vessel form a single mass. As a result, the soluble boron concentration is relatively the same in each of these volumes. The limiting boron dilution accident analyzed occurs in MODE 5 (Ref. 2). A detailed discussion of this event is provided in Bases B 3.1.1, "SHUTDOWN
 
MARGIN (SDM)." The RCS boron concentration satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). LCOThe LCO requires that a minimum boron concentration be maintained in the RCS, the refueling canal, and the refueling cavity while in MODE 6. The boron concentration limit specified in the COLR ensures that a core k eff of  0.95 is maintained during fuel handling operations. Violation of the LCO could lead to an inadvertent criticality during MODE 6. APPLICABILITY This LCO is applicable in MODE 6 to ensure that the fuel in the reactor vessel will remain subcritical. The required boron concentration ensures a
 
k eff 0.95. Above MODE 6, LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," ensures that an adequate amount of negative reactivity is available to shut down the reactor and maintain it subcritical. The Applicability is modified by a Note that states that the limits on boron concentration are only applicable to the refueling canal and the refueling cavity when those volumes are connected to the Reactor Coolant System.
When the refueling canal and the refueling cavity are isolated from the RCS, no potential path for boron dilution exists.
Boron Concentration B 3.9.1 BASESINDIAN POINT 2 B 3.9.1 - 3 Revision 1 ACTIONS A.1 and A.2Continuation of CORE ALTERATIONS or positive reactivity additions (including actions to reduce boron concentration) is contingent upon maintaining the unit in compliance with the LCO. If the boron concentration of any coolant volume in the RCS, the refueling canal, or the refueling cavity is less than its limit, all operations involving CORE ALTERATIONS or positive reactivity additions must be suspended immediately. Suspension of CORE ALTERATIONS and positive reactivity additions shall not preclude moving a component to a safe position. Operations that individually add limited positive reactivity (e.g. temperature fluctuations from inventory addition or temperature control fluctuations), but when combined with all other operations affecting core reactivity (e.g., intentional boration) result in overall net negative reactivity addition, are not precluded by this action.A.3In addition to immediately suspending CORE ALTERATIONS and positive reactivity additions, boration to restore the concentration must be initiated immediately.In determining the required combination of boration flow rate and concentration, no unique Design Basis Event must be satisfied. The only requirement is to restore the boron concentration to its required value as soon as possible. In order to raise the boron concentration as soon as possible, the operator should begin boration with the best source available for unit conditions. Once actions have been initiated, they must be continued until the boron concentration is restored. The restoration time depends on the amount of boron that must be injected to reach the required concentration. SURVEILLANCE SR  3.9.1.1 REQUIREMENTSThis SR ensures that the coolant boron concentration in the RCS, and connected portions of the refueling canal and the refueling cavity, is within the COLR limits. The boron concentration of the coolant in each required volume is determined periodically by chemical analysis. Prior to re-connecting portions of the refueling canal or the refueling cavity to the Boron Concentration B 3.9.1 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.9.1 - 4 Revision 1 RCS, this SR must be met per SR 3.0.4. If any dilution activity has occurred while the cavity or canal were disconnected from the RCS, this SR ensures the correct boron concentration prior to communication with the RCS. A minimum Frequency of once every 72 hours is a reasonable amount of time to verify the boron concentration of representative samples. The Frequency is based on operating experience, which has shown 72 hours to be adequate. REFERENCES 1. 10 CFR 50, Appendix A, GDC 26. 2. UFSAR, Chapter 14.
Nuclear Instrumentation B 3.9.2 INDIAN POINT 2 B 3.9.2 - 1 Revision 2 B 3.9  REFUELING OPERATIONS B 3.9.2 Nuclear Instrumentation BASESBACKGROUND The source range neutron flux monitors are used during refueling operations to monitor the core reactivity condition. The installed source range neutron flux monitors are part of the Nuclear Instrumentation System (NIS). These detectors are located external to the reactor vessel and detect neutrons leaking from the core. The installed source range neutron flux monitors are BF3 detectors operating in the proportional region of the gas filled detector characteristic curve. The detectors monitor the neutron flux in counts per second. The instrument range covers six decades of neutron flux (1E+6 cps). The detectors also provide continuous visual indication in the control room and an audible count rate in the control room to alert operators to a possible dilution accident. Audible count rate is also provided in the upper containment. The NIS is designed in accordance with the criteria presented in Reference 1. During MODE 6 the Alternate Safe Shutdown (ASS)/ remote shutdown neutron flux monitor may be used to provide control room visual indication when powered from a safety related power source. The ASS monitor was procured to safety related requirements and installed
 
seismically.APPLICABLE SAFETY ANALYSESTwo OPERABLE source range neutron flux monitors are required to alert the operator to unexpected changes in core reactivity such as with a boron dilution accident (Ref. 2) or an improperly loaded fuel assembly. The audible count rate from the selected source range neutron flux monitor provides prompt and definite indication of any boron dilution. The count rate increase is proportional to the subcritical multiplication factor and allows operators to promptly recognize the initiation of a boron dilution event.
Prompt recognition of the initiation of a boron dilution event is consistent with the assumptions of the safety analysis and is necessary to assure sufficient time is available for isolation of the primary water makeup source before SHUTDOWN MARGIN is lost (Ref. 2).The source range neutron flux monitors satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Nuclear Instrumentation B 3.9.2 BASESINDIAN POINT 2 B 3.9.2 - 2 Revision 2 LCO This LCO requires that two source range neutron flux monitors be OPERABLE to ensure that redundant monitoring capability is available to detect changes in core reactivity. To be OPERABLE, each monitor must provide visual indication in the control room. In addition, at least one of the two monitors must provide an OPERABLE audible count rate function in the control room to alert the operators to the initiation of a boron dilution event. The ASS / remote shutdown source range monitor does not provide audible count rate and is used only for control room indication when control room readout and safety related power is provided.APPLICABILITY In MODE 6, the source range neutron flux monitors must be OPERABLE to determine changes in core reactivity. There are no other direct means available to check core reactivity levels. In MODES 2, 3, 4, and 5, the two installed source range detectors and circuitry are also required to be OPERABLE by LCO 3.3.1, "Reactor Protection System (RPS)
Instrumentation". The ASS / remote shutdown source range monitor may be used in MODE 6 for control room readout.
ACTIONSA.1 and A.2With only one source range neutron flux monitor OPERABLE, redundancy has been lost. Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1 must be suspended immediately. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation. Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. Performance of Required Action A.1 shall not preclude completion of movement of a component to a safe position. B.1With no source range neutron flux monitor OPERABLE, action to restore a monitor to OPERABLE status shall be initiated immediately. Once initiated, action shall be continued until a source range neutron flux monitor is restored to OPERABLE status. Note that entry into Condition C is required when Condition B is entered.
Nuclear Instrumentation B 3.9.2 BASESACTIONS  (continued) INDIAN POINT 2 B 3.9.2 - 3 Revision 2 B.2With no source range neutron flux monitor OPERABLE, there are no direct means of detecting changes in core reactivity. However, since CORE ALTERATIONS and positive reactivity additions are not to be made, the core reactivity condition is stabilized until the source range neutron flux monitors are OPERABLE. This stabilized condition is determined by performing SR 3.9.1.1 to ensure that the required boron concentration exists. The Completion Time of once per 12 hours is sufficient to obtain and analyze a reactor coolant sample for boron concentration and ensures that unplanned changes in boron concentration would be identified. The 12 hour Frequency is reasonable, considering the low probability of a change in core reactivity during this time period.
C.1With no audible count rate OPERABLE, prompt and definite indication of a boron dilution event, consistent with the assumptions of the safety analysis, is lost. In this situation, the boron dilution event may not be detected quickly enough to assure sufficient time is available for operators to manually isolate the unborated water source and stop the dilution prior to the loss of SHUTDOWN MARGIN. Therefore, action must be taken to prevent an inadvertent boron dilution event from occurring. This is accomplished by isolating all the unborated water flow paths to the Reactor Coolant System.
Isolating these flow paths ensures that an inadvertent dilution of the reactor coolant boron concentration is prevented. The Completion Time of "Immediately" assures a prompt response by operations and requires an operator to initiate actions to isolate an affected flow path immediately.
Once actions are initiated, they must be continued until all the necessary flow paths are isolated or the circuit is restored to OPERABLE status. SURVEILLANCE SR  3.9.2.1 REQUIREMENTSSR 3.9.2.1 is the performance of a CHANNEL CHECK, which is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that the two indication channels should be consistent with core conditions. Changes in fuel loading and core geometry can result in significant differences between source range channels, but each channel should be consistent with its local conditions.
Nuclear Instrumentation B 3.9.2 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.9.2 - 4 Revision 2 The Frequency of 12 hours is consistent with the CHANNEL CHECK Frequency specified similarly for the same instruments in LCO 3.3.1. SR  3.9.2.2SR 3.9.2.2 is the performance of a CHANNEL CALIBRATION every 24 months. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. The CHANNEL CALIBRATION for the source range neutron flux monitors consists of obtaining the detector plateau or preamp discriminator curves, evaluating those curves, and comparing the curves to the manufacturer's data. The CHANNEL CALIBRATION also includes verification of the audible count rate function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage. Operating experience has shown these components usually pass the Surveillance when performed at the 24 month Frequency. REFERENCES 1. 10 CFR 50, Appendix A, GDC 13, GDC 26, GDC 28, and GDC 29. 2. UFSAR, Section 14.1.5.
Containment Penetrations B 3.9.3 INDIAN POINT 2 B 3.9.3 - 1 Revision 1 B 3.9  REFUELING OPERATIONS B 3.9.3 Containment Penetrations BASESBACKGROUND During movement of recently irradiated fuel assemblies within containment, a release of fission product radioactivity within containment will be restricted from escaping to the environment when the LCO requirements are met. In MODES 1, 2, 3, and 4, this is accomplished by maintaining containment OPERABLE as described in LCO 3.6.1, "Containment."  In MODE 6, the potential for containment pressurization as a result of an accident is not likely; therefore, requirements to isolate the containment from the outside atmosphere can be less stringent. The LCO requirements are referred to as "containment closure" rather than "containment OPERABILITY."
Containment closure means that all potential escape paths are closed or capable of being closed. Since there is no potential for containment pressurization, the Appendix J leakage criteria and tests are not required. The containment serves to contain fission product radioactivity that may be released from the reactor core following an accident, such that offsite radiation exposures are maintained well within the requirements of 10 CFR 50.67, "Accident Source Term."  Additionally, the containment provides radiation shielding from the fission products that may be present in the containment atmosphere following accident conditions. The containment equipment hatch, which is part of the containment pressure boundary, provides a means for moving large equipment and components into and out of containment. During movement of recently irradiated fuel assemblies within containment, the opening must be closed using an equipment hatch closure plate that may include a personnel access door that is capable of being closed and the equipment hatch must be held in place by at least four bolts.The containment air locks, which are also part of the containment pressure boundary, provide a means for personnel access during MODES 1, 2, 3, and 4 unit operation in accordance with LCO 3.6.2, "Containment Air Locks."
Each air lock has a door at both ends. The doors are normally interlocked to prevent simultaneous opening when containment OPERABILITY is required. During periods of unit shutdown when containment closure is not required, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary. During movement of recently irradiated fuel assemblies within containment, containment closure is required; therefore, Containment Penetrations B 3.9.3 BASESBACKGROUND  (continued) INDIAN POINT 2 B 3.9.3 - 2 Revision 1 the door interlock mechanism may remain disabled, but one air lock door must always remain closed. The requirements for containment penetration closure ensure that a release of fission product radioactivity within containment will be restricted to within regulatory limits. A detailed description of the Containment Purge System (containment purge supply line and containment purge exhaust line) and the Containment Pressure Relief Line is provided in the Background of the Bases for Technical Specification 3.6.3, "Containment Isolation Valves." Both the containment purge supply and exhaust isolation valves (FCV-1170, FCV-1171, FCV-1172, and FCV-1173) and the containment pressure relief line isolation valves (PCV-1190, PCV-1191 and PCV-1192) close when high radiation levels are detected by the Containment Air Particulate Monitor (R-41) or Containment Radioactive Gas Monitor (R-42). The Containment Phase A Isolation ESFAS signal (LCO 3.3.2, Function 3.a) and Containment Spray ESFAS signal (LCO 3.3.2, Function 2) also cause closure of the containment purge isolation valves and the containment pressure relief isolation valves. The other containment penetrations that provide direct access from containment atmosphere to outside atmosphere must be isolated on at least one side. Isolation may be achieved by an OPERABLE automatic isolation valve, or by a manual isolation valve, blind flange, or equivalent. Equivalent isolation methods must be approved and may include use of a material that can provide a temporary, atmospheric pressure, ventilation barrier for the other containment penetrations during recently irradiated fuel movements (Ref. 1). APPLICABLE SAFETY ANALYSESAt Indian Point 2, the radiological consequence analyses for the fuel handling accident demonstrate compliance with 10 CFR 50.67, "Accident Source Term."  This analysis of a fuel handling accident is based on the assumption that decay time (i.e., fuel has decayed for greater than 84 hours) and water level are the primary success path for mitigating a fuel handling accident. This analysis assumed that activity from the damaged fuel assembly was released to the outside atmosphere through the containment purge system without taking any credit for either isolation or filtration of the release path (Ref. 2).
Containment Penetrations B 3.9.3 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.9.3 - 3 Revision 1 Additionally, the analysis of a fuel handling accident (Ref. 2) demonstrated that 10 CFR 50.67 limits would be met even if the equipment hatch and personnel airlock remain open during the fuel handling accident inside containment. The analysis was performed to justify refueling operations with the containment personnel air locks and the equipment hatch open (Ref. 2). However, the relaxations justified in Reference 2 do not apply when moving recently irradiated fuel (i.e., fuel assemblies that have been part of a critical reactor in the previous 84 hours). Therefore, during movement of recently irradiated fuel assemblies, LCO 3.9.3, "Containment Penetrations,"
establishes requirements for containment closure that minimize any release to the environment resulting from a fuel handling accident that occurs when the reactor has been subcritical for less than the 84 hours assumed in Reference 2. Containment penetrations satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). LCOThis LCO limits the consequences of a fuel handling accident involving recently irradiated fuel in containment by limiting the potential escape paths for fission product radioactivity released within containment. The LCO requires any penetration providing direct access from the containment atmosphere to the outside atmosphere to be closed except for the OPERABLE containment purge and exhaust penetrations and pressure relief line penetration and the containment personnel air locks. For the OPERABLE containment purge and exhaust penetrations and pressure relief line penetration, this LCO ensures that these penetrations are isolable by the Containment Purge and Exhaust Isolation System. The OPERABILITY requirements for this LCO ensure that the automatic purge and exhaust valve closure times specified in the FSAR can be achieved and, therefore, meet the assumptions used in the safety analysis to ensure that releases through the valves are terminated, such that radiological doses are within the acceptance limit. Technical Requirements Manual (TRM) 3.9.A specifies that movement of fuel in the reactor cannot be initiated until the reactor has been subcritical for  84 hours. Therefore, TRM 3.9.A prohibits movement of any fuel that can be classified as "recently irradiated."
Containment Penetrations B 3.9.3 BASESLCO  (continued) INDIAN POINT 2 B 3.9.3 - 4 Revision 1 The LCO is modified by a Note allowing penetration flow paths with direct access from the containment atmosphere to the outside atmosphere to be unisolated under administrative controls. Administrative controls ensure that
: 1) appropriate personnel are aware of the open status of the penetration flow path during CORE ALTERATIONS involving recently irradiated fuel or movement of recently irradiated fuel assemblies within containment, and
: 2) specified individuals are designated and readily available to isolate the flow path in the event of a fuel handling accident. The containment personnel air lock doors may be open during movement of irradiated fuel in the containment and during CORE ALTERATIONS involving recently irradiated fuel provided that one door is capable of being closed in the event of a fuel handling accident. Should a fuel handling accident occur inside containment, one personnel air lock door will be closed following an evacuation of containment. When moving irradiated fuel, the following guidelines should be included in the assessment of systems removed from service during movement of irradiated fuel: - During fuel handling/core alterations, ventilation system and radiation monitor availability (as defined in NUMARC 91-06) should be assessed, with respect to filtration and monitoring of releases from the fuel. Following shutdown, radioactivity in the fuel decays away fairly rapidly. The basis of the Technical Specification OPERABILITY amendment is the reduction in doses due to such decay. The goal of maintaining ventilation system and radiation monitor availability is to reduce doses even further below that provided by the natural decay. - A single normal or contingency method to promptly close primary or secondary containment penetrations should be developed. Such prompt methods need not completely block the penetration or be capable of resisting pressure. The purpose of the "prompt methods" mentioned above are to enable ventilation systems to draw the release from a postulated fuel handling accident in the proper direction such that it can be treated and monitored. APPLICABILITY The containment penetration requirements are applicable during movement of recently irradiated fuel assemblies within containment because this is when there is a potential for the limiting fuel handling accident. In MODES 1, 2, 3, and 4, containment penetration requirements are addressed Containment Penetrations B 3.9.3 BASESAPPLICABILITY  (continued) INDIAN POINT 2 B 3.9.3 - 5 Revision 1 by LCO 3.6.1. In MODES 5 and 6, when movement of irradiated fuel assemblies within containment is not being conducted, the potential for a fuel handling accident does not exist. Additionally, due to radioactive decay, a fuel handling accident not involving recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 84 hours) even without containment closure capability. Therefore, after the reactor has been subcritical for  84 hours, no requirements are placed on containment penetration status. ACTIONS A.1If the containment equipment hatch, air locks, or any containment penetration that provides direct access from the containment atmosphere to the outside atmosphere is not in the required status, including the Containment Purge and Exhaust pressure relief line Isolation System not capable of automatic actuation when the purge and exhaust valves are open, the unit must be placed in a condition where the isolation function is not needed. This is accomplished by immediately suspending movement of recently irradiated fuel assemblies within containment. Performance of these actions shall not preclude completion of movement of a component to a safe position. SURVEILLANCE SR  3.9.3.1 REQUIREMENTSThis Surveillance demonstrates that each of the containment penetrations required to be in its closed position is in that position. The Surveillance on the open purge and exhaust valves will demonstrate that the valves are not blocked from closing. Also the Surveillance will demonstrate that each valve operator has motive power, which will ensure that each valve is capable of being closed by an OPERABLE automatic containment purge and exhaust isolation signal. The Surveillance is performed within 7 days of movement of recently irradiated fuel assemblies within containment. The Surveillance interval is selected to be commensurate with the 84 hour decay time that defines recently irradiated fuel. A surveillance before the start of refueling operations will not have to be repeated during the applicable period for this LCO. This Surveillance ensures that a postulated fuel handling accident involving recently irradiated fuel that releases fission product radioactivity within the containment will not result in a release of significant fission product radioactivity to the environment.
Containment Penetrations B 3.9.3 BASESSURVEILLANCE REQUIREMENTS  (continued) INDIAN POINT 2 B 3.9.3 - 6 Revision 1 SR  3.9.3.2This Surveillance demonstrates that each containment purge and exhaust and pressure relief line isolation valve actuates to its isolation position on manual initiation or on an actual or simulated high radiation signal. The 24 month Frequency maintains consistency with ESFAS instrumentation testing requirements in LCO 3.3.6, "Containment Purge System and Pressure Relief Line Isolation Instrumentation."  Additionally, SR 3.6.3.5 demonstrates that the isolation time of each valve is in accordance with the Inservice Testing Program requirements. These Surveillances performed during MODE 6 will ensure that the valves are capable of closing after a postulated fuel handling accident involving recently irradiated fuel to limit a release of fission product radioactivity from the containment. The SR is modified by a Note stating that this Surveillance is not required to be met for valves in isolated penetrations. The LCO provides the option to close penetrations in lieu of requiring automatic acutation capability. REFERENCES 1. GPU Nuclear Safety Evaluation SE-0002000-001, Rev. 0, May 20, 1988. 2. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 241 to Facility Operating License No.
DPR-26, October 27, 2004.
RHR and Coolant Circulation - High Water Level B 3.9.4 INDIAN POINT 2 B 3.9.4 - 1 Revision 2 B 3.9  REFUELING OPERATIONS B 3.9.4 Residual Heat Removal (RHR) and Coolant Circulation - High Water Level BASESBACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant and to prevent boron stratification. Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchanger(s), where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown or decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) or by regulating service water or component cooling water flow. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System. APPLICABLE SAFETY ANALYSESIf the reactor coolant temperature is not maintained below 200F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant would eventually challenge the integrity of the fuel cladding, which is a fission product barrier. One train of the RHR System is required to be operational in MODE 6, with the water level  23 ft above the top of the reactor vessel flange, to prevent this challenge. The LCO does permit the RHR pump to be removed from operation for short durations, under the condition that the boron concentration is not diluted. This conditional stopping of the RHR pump does not result in a challenge to the fission product barrier. The RHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). LCOOnly one RHR loop is required for decay heat removal in MODE 6, with the water level  23 ft above the top of the reactor vessel flange. Only one RHR loop is required to be OPERABLE, because the volume of water above the reactor vessel flange provides backup decay heat removal capability. At least one RHR loop must be OPERABLE and in operation to provide: a. Removal of decay heat, RHR and Coolant Circulation - High Water Level B 3.9.4 BASESLCO  (continued) INDIAN POINT 2 B 3.9.4 - 2 Revision 2 b. Mixing of borated coolant to minimize the possibility of criticality, and c. Indication of reactor coolant temperature.
An OPERABLE RHR loop in MODE 6 includes an RHR pump, a heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path and to determine the loop temperature. The flow path starts in the loop 22 RCS hot leg and is returned to the RCS cold legs.
Although either RHR heat exchanger may be credited for either RHR loop, one RHR heat exchanger must be OPERABLE for each OPERABLE RHR loop.The LCO is modified by a Note that allows the required operating RHR loop to be removed from operation for up to 1 hour per 8 hour period, provided no operations are permitted that would dilute the RCS boron concentration introduction of coolant into the RCS with boron concentration less than required to meet the minimum boron concentration of LCO 3.9.1. Boron concentration reduction with coolant at boron concentrations less than required to assure the RCS boron concentration is maintained is prohibited because uniform concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS to RHR isolation valve testing. During this 1 hour period, decay heat is removed by natural convection to the large mass of water in the refueling cavity. APPLICABILITY One RHR loop must be OPERABLE and in operation in MODE 6, with the water level  23 ft above the top of the reactor vessel flange, to provide decay heat removal. The 23 ft water level was selected because it corresponds to the 23 ft requirement established for fuel movement in LCO 3.9.6, "Refueling Cavity Water Level."  Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency  Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with the water level < 23 ft are located in LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level." ACTIONS RHR loop requirements are met by having one RHR loop OPERABLE and in operation, except as permitted in the Note to the LCO.
RHR and Coolant Circulation - High Water Level B 3.9.4 BASESACTIONS  (continued) INDIAN POINT 2 B 3.9.4 - 3 Revision 2 A.1If RHR loop requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation.
Introduction of coolant inventory must be from sources that have a boron concentration greater than what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. A.2If RHR loop requirements are not met, actions shall be taken immediately to suspend loading of irradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core. A minimum refueling water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any operation that would increase decay heat load, such as loading an irradiated fuel assembly, is a prudent action under this condition. A.3If RHR loop requirements are not met, actions shall be initiated and continued in order to satisfy RHR loop requirements. With the unit in MODE 6 and the refueling water level  23 ft above the top of the reactor vessel flange, corrective actions shall be initiated immediately. A.4, A.5, A.6.1, and A.6.2If no RHR is in operation, the following actions must be taken:
: a. The equipment door (or a closure plate) must be properly installed,
: b. One door (permanent or temporary) in each air lock must be closed, and RHR and Coolant Circulation - High Water Level B 3.9.4 BASESACTIONS  (continued) INDIAN POINT 2 B 3.9.4 - 4 Revision 2 c. Each penetration providing direct access from the containment atmosphere to the outside atmosphere must be either closed by a manual or automatic isolation valve, blind flange, or equivalent, or verified to be capable of being closed by an OPERABLE Containment Purge System and Pressure Relief Line Isolation System. With RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Performing the actions described above ensures that all containment penetrations are either closed or can be closed so that the dose limits are not exceeded. The Completion Time of 4 hours allows fixing of most RHR problems and is reasonable, based on the low probability of the coolant boiling in that time. SURVEILLANCE SR  3.9.4.1 REQUIREMENTSThis Surveillance demonstrates that the RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The Frequency of 12 hours is sufficient, considering the flow, temperature, pump control, and alarm indications available to the operator in the control room for monitoring the RHR System. REFERENCES None.
RHR and Coolant Circulation - Low Water Level B 3.9.5 INDIAN POINT 2 B 3.9.5 - 1 Revision 2 B 3.9  REFUELING OPERATIONS B 3.9.5 Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level BASESBACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and sensible heat from the Reactor Coolant System (RCS), as required by GDC 34, to provide mixing of borated coolant, and to prevent boron stratification. Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchangers where the heat is transferred to the Component Cooling Water System. The coolant is then returned to the RCS via the RCS cold leg(s). Operation of the RHR System for normal cooldown decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) or by regulating component cooling water or service water flow. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System. APPLICABLE SAFETY ANALYSESIf the reactor coolant temperature is not maintained below 200F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to a reduction in boron concentration in the coolant due to the boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the reduction of boron concentration in the reactor coolant will eventually challenge the integrity of the fuel cladding, which is a fission product barrier. Two trains of the RHR System are required to be OPERABLE, and one train in operation, in order to prevent this challenge. The RHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). LCOIn MODE 6, with the water level < 23 ft above the top of the reactor vessel flange, both RHR loops must be OPERABLE. Additionally, one loop of RHR must be in operation in order to provide: a. Removal of decay heat,
: b. Mixing of borated coolant to minimize the possibility of criticality, and
: c. Indication of reactor coolant temperature.
RHR and Coolant Circulation - Low Water Level B 3.9.5 BASESLCO  (continued) INDIAN POINT 2 B 3.9.5 - 2 Revision 2 An OPERABLE RHR loop in MODE 6 consists of an RHR pump, a heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path and to determine the loop temperature. The flow path starts in RCS hot leg for loop 22 and is returned to the RCS cold legs.
Although either RHR heat exchanger may be credited for either RHR loop, one RHR heat exchanger must be OPERABLE for each OPERABLE RHR loop.This LCO is modified by a Note that permits the RHR pumps to be removed from operation for  15 minutes when switching from one loop to another. The circumstances for stopping both RHR pumps are to be limited to situations when the outage time is short and the core outlet temperature is maintained > 10 degrees F below saturation temperature (i.e., subcooled).
The Note prohibits boron dilution or draining operations when RHR forced flow is stopped. This LCO is modified by a Note that allows one RHR loop to be inoperable for a period of 2 hours provided the other loop is OPERABLE and in operation. Prior to declaring the loop inoperable, consideration should be given to the existing plant configuration. This consideration should include that the core time to boil is short, there is no draining operation to further reduce RCS water level and that the capability exists to inject borated water into the reactor vessel. This permits surveillance tests to be performed on the inoperable loop during a time when these tests are safe and possible. APPLICABILITY Two RHR loops are required to be OPERABLE, and one RHR loop must be in operation to provide decay heat removal when in MODE 6, with the water level < 23 ft above the top of the reactor vessel flange. Requirements for the RHR System in other MODES are covered by LCOs in Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency Core Cooling System (ECCS). RHR loop requirements in MODE 6 with the water level  23 ft are located in LCO 3.9.4, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level." ACTIONSA.1 and A.2If one or both RHR loops are inoperable, action shall be immediately initiated and continued until the RHR loop is restored to OPERABLE status and to operation or until  23 ft of water level is established above the reactor vessel flange. When the water level is  23 ft above the reactor vessel RHR and Coolant Circulation - Low Water Level B 3.9.5 BASESACTIONS  (continued) INDIAN POINT 2 B 3.9.5 - 3 Revision 2 flange, the Applicability changes to that of LCO 3.9.4, and only one RHR loop is required to be OPERABLE and in operation. An immediate Completion Time is necessary for an operator to initiate corrective actions. B.1If no RHR loop is in operation, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Suspending positive reactivity additions that could result in failure to meet the minimum boron concentration limit is required to assure continued safe operation.
Introduction of coolant inventory must be from sources that have a boron concentration greater than that what would be required in the RCS for minimum refueling boron concentration. This may result in an overall reduction in RCS boron concentration, but provides acceptable margin to maintaining subcritical operation. B.2If no RHR loop is in operation, actions shall be initiated immediately, and continued, to restore one RHR loop to operation. Since the unit is in Conditions A and B concurrently, the restoration of two OPERABLE RHR loops and one operating RHR loop should be accomplished expeditiously. B.3, B.4, B.5.1, and B.5.2If no RHR is in operation, the following actions must be taken: a. The equipment door or closure plate must be properly installed.  (Note: Pending NRC approval of an outstanding LAR, the rollup door is currently not considered a suitable device that can be credited for containment closure subsequent to loss of RHR cooling), b. One door (either permanent or temporary) in each air lock must be closed,c. Each penetration providing direct access from the containment atmosphere to the outside atmosphere must be either closed by a manual or automatic isolation valve, blind flange, or equivalent, and RHR and Coolant Circulation - Low Water Level B 3.9.5 BASESACTIONS  (continued) INDIAN POINT 2 B 3.9.5 - 4 Revision 2 d. Containment purge supply and exhaust and pressure relief line must be verified to be capable of being closed by an OPERABLE Containment Purge System and Pressure Relief Line Isolation System. With RHR loop requirements not met, the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere. Performing the actions stated above ensures that all containment penetrations are either closed or can be closed so that dose limits are not exceeded. The Completion Time of 4 hours allows fixing of most RHR problems and is reasonable, based on the low probability of the coolant boiling in that time. SURVEILLANCE SR  3.9.5.1 REQUIREMENTSThis Surveillance demonstrates that one RHR loop is in operation and circulating reactor coolant. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. In addition, during operation of the RHR loop with the water level in the vicinity of the reactor vessel nozzles, the RHR pump suction requirements must be met. The Frequency of 12 hours is sufficient, considering the flow, temperature, pump control, and alarm indications available to the operator for monitoring the RHR System in the control room. SR  3.9.5.2Verification that the required pump is OPERABLE ensures that an additional RHR pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pump. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience. REFERENCES None.
Refueling Cavity Water Level B 3.9.6 INDIAN POINT 2 B 3.9.6 - 1 Revision 1 B 3.9  REFUELING OPERATIONS B 3.9.6 Refueling Cavity Water Level BASESBACKGROUND The minimum water level of 23 ft above the top of reactor vessel flange required during movement of irradiated fuel assemblies within containment is needed to meet the assumptions for iodine decontamination factors following a fuel handling accident. The analysis of a fuel handling accident is based on the assumption that decay time and water level are the primary success path for mitigating a fuel handling accident. The required minimum water level also provides shielding and minimizes the general area dose during the movement of irradiated fuel. APPLICABLESAFETY ANALYSESThe minimum water level of23 ft above the top of reactor vessel flange required during movement of irradiated fuel assemblies within containment is an assumption in the Indian Point 2 analysis of the radiological consequences of the fuel handling accident (Ref. 1). The analysis demonstrates that the limits specified in 10 CFR 50.67, Accident Source Term (Ref. 2) and Regulatory Guide 1.183 (Ref. 3) are met during the fuel handling accident. The analysis of a fuel handling accident is based on the assumption that decay time and water level are the primary success path for mitigating a fuel handling accident (Ref. 1). Decay of the short-lived fission products greatly reduces the fission product inventory present in irradiated fuel following reactor shutdown. A longer decay period before the fuel handling accident is assumed to occur takes advantage of the reduced radionuclide inventory available for release. Therefore, Reference 1 assumes that fuel involved in the accident has not occupied part of a critical reactor core within the previous 84 hours. The water level above damaged fuel assembly determines the iodine decontamination factors that can be used when determining the radiological consequences of the fuel handling accident. Reference 1 assumed that there is a minimum of 23 feet of water above the reactor vessel flange as required by this LCO when the fuel handling accident occurs. With this water depth, a decontamination factor (DF) of 500 specified by Regulatory Guide 1.183 for elemental iodine would apply. However, the decontamination factor was reduced to 400 for conservatism because the fuel rod pressure may exceed 1200 psig (but would be less than 1500 psig). The decontamination factor for organic iodine and noble gases was 1.0.
Refueling Cavity Water Level B 3.9.6 BASESAPPLICABLE SAFETY ANALYSES  (continued) INDIAN POINT 2 B 3.9.6 - 2 Revision 1 The elemental iodine DF was reduced further to 285 in order to be consistent with Reference 3 guidance that the overall iodine DF equal 200. Since Reference 3 specifies that 0.15% of the iodine is in the organic form, the limit of 200 for the overall iodine DF required that the DF for elemental iodine be 285. The activity released from the damaged assembly is assumed to be released to the environment over a two hour period. These assumptions are consistent with the guidance provided in Regulatory Guide 1.183. The fuel assembly fission product inventory is based on the assumption that the subject fuel assembly has been operated at 1.7 times core average power (and thus has 1.7 times the average fuel assembly fission product inventory) (Ref. 3).This analysis assumed that activity from the damaged fuel assembly was released to the outside atmosphere through the containment purge system without taking any credit for either isolation or filtration of the release path.
This is conservative because the containment purge supply line, containment purge exhaust line and the containment pressure relief line are expected to be isolated by a Containment Air Particulate Monitor (R-42) or Radioactive Gas Monitor (R-41) even though this isolation is not required to meet the dose acceptance limits of Reference 2 and Reference 3. Refueling cavity water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). LCOA minimum refueling cavity water level of 23 ft above the reactor vessel flange is required to ensure that the radiological consequences of a postulated fuel handling accident inside containment are within acceptable limits.APPLICABILITY LCO 3.9.6 is applicable when moving irradiated fuel assemblies within containment. The LCO minimizes the possibility of a fuel handling accident in containment that is beyond the assumptions of the safety analysis. If irradiated fuel assemblies are not present in containment, there can be no significant radioactivity release as a result of a postulated fuel handling accident. Requirements for fuel handling accidents in the spent fuel pit are covered by LCO 3.7.11, "Spent Fuel Pit Water Level." ACTIONS A.1With a water level of < 23 ft above the top of the reactor vessel flange, all operations involving or movement of irradiated fuel assemblies within the Refueling Cavity Water Level B 3.9.6 BASESINDIAN POINT 2 B 3.9.6 - 3 Revision 1 ACTIONS A.1(continued)containment shall be suspended immediately to ensure that a fuel handling accident cannot occur. The suspension of fuel movement shall not preclude completion of movement of a component to a safe position. SURVEILLANCE SR  3.9.6.1 REQUIREMENTSVerification of a minimum water level of 23 ft above the top of the reactor vessel flange ensures that the design basis for the analysis of the postulated fuel handling accident during refueling operations is met. Water at the required level above the top of the reactor vessel flange limits the consequences of damaged fuel rods that are postulated to result from a fuel handling accident inside containment (Ref. 2). The Frequency of 24 hours is based on engineering judgment and is considered adequate in view of the large volume of water and the normal procedural controls of valve positions, which make significant unplanned level changes unlikely. REFERENCES 1. WCAP-16157, "Indian Point Unit 2 Stretch Power Uprating Licensing Report," January 2004. 2. 10 CFR 50.67. 3. Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.
Facility Operating License No. DPR-26 Appendix C - Technical Specifications TABLE OF CONTENTS INDIAN POINT 2 iRevision 0 B.3.0LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY B.3.0SURVEILLANCE REQUIREMENT (SR) APPLICABILITY B.3.1INTER-UNIT FUEL TRANSFER B.3.1.1BoronConcentrationB.3.1.2Shielded Transfer Canister (STC) Loading B.3.1.3Shielded Transfer Canister (STC) Initial Water Level B.3.1.4Shielded Transfer Canister (STC) Pressure Rise B.3.1.5Shielded Transfer Canister (STC) Unloading LCO  Applicability B 3.0 INDIAN POINT 2 B 3.0 - 1 Revision 0 B 3.0  LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOsLCO 3.0.1 through LCO 3.0.5 establish the general requirements applicable to all Specifications and apply under the stated conditions. LCO  3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met. LCO  3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met, except as provided in LCO 3.0.5. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered. The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that: a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification and b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified. Completing the Required Actions is not required when an LCO is met or is  no longer applicable, unless otherwise stated in the individual Specifications. The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Conditions no longer exist. The individual LCO's ACTIONS specify the Required Actions where this is the case. The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The reasons for intentionally relying on the ACTIONS include, but are not limited to, performance of Surveillances, preventive maintenance, corrective maintenance, or investigation of operational problems. Entering ACTIONS for these reasons must be done in a manner that does not compromise safety. Intentional entry into ACTIONS should not be made for operational convenience. Additionally, if intentional entry into ACTIONS would result in redundant equipment being inoperable, alternatives should be used instead.
LCO  Applicability B 3.0 INDIAN POINT 2 B 3.0 - 2 Revision 0 BASESLCO 3.0.3 Not applicable. LCO  3.0.4 LCO 3.0.4 establishes limitations on changes in specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a specified condition stated in that Applicability (e.g., the Applicability desired to be entered) when conditions are such that the requirements of the LCO would not be met, in accordance with LCO 3.0.4. LCO 3.0.4. allows entry into a specified condition in the Applicability with the LCO not met when the associated ACTIONS to be entered permit continued operation in the specified condition in the Applicability for an unlimited period of time. Compliance with Required Actions that permit continued operation for an unlimited period of time in a specified condition provides an acceptable level of safety. Therefore, in such cases, entry into a specified condition in the Applicability may be made in accordance with the provisions of the Required Actions. LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate either: a. The OPERABILITY of the equipment being returned to service or
: b. The OPERABILITY of other equipment.
The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the required testing to demonstrate OPERABILITY. This Specification does not provide time to perform any other preventive or corrective maintenance.
SR  Applicability B 3.0 INDIAN POINT 2 B 3.0 - 3 Revision 0 B 3.0  SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASESSRs SR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated. SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an
 
LCO.Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when: a. The systems or components are known to be inoperable, although still meeting the SRs; or b. The requirements of the Surveillance(s) are known not to be met between required Surveillance performances. Surveillances do not have to be performed when the system is in a specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a test exception are only applicable when the test exception is used as an allowable exception to the requirements of a Specification. Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status.
SR Applicability B 3.0 INDIAN POINT 2 B 3.0 - 4 Revision 0 BASESSR  3.0.1  (continued) Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the specified conditions in the Applicability due to the necessary parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to the specified condition where other necessary post maintenance tests can be completed. SR  3.0.2 SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a "once per . . ."
interval. SR 3.0.2 permits a 25% extension of the interval specified in the Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities). The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications. The requirements of regulations take precedence over the TS. As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per ..." basis. The 25% extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time.
One reason for not allowing the 25% extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.
SR  Applicability B 3.0 INDIAN POINT 2 B 3.0 - 5 Revision 0 BASESSR  3.0.2  (continued) The provisions of SR 3.0.2 are not intended to be used repeatedly merely as an operational convenience to extend Surveillance intervals or periodic Completion Time intervals beyond those specified. SR  3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified Frequency. A delay period of up to 24 hours or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met. This delay period provides adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with Required Actions or other remedial measures that might preclude completion of the Surveillance. The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements. When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations is discovered to not have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity. Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals. While up to 24 hours or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required) and impact on any analysis assumptions, in addition to unit conditions, planning, SR  Applicability B 3.0 INDIAN POINT 2 B 3.0 - 6 Revision 0 BASESSR  3.0.3  (continued) availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants."  This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the Corrective Action Program. If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance. Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1. SR  3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into the specified condition in the Applicability. This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into the specified conditions in the Applicability for which these systems and components ensure safe operation. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated specified condition in the Applicability.
SR  Applicability B 3.0 INDIAN POINT 2 B 3.0 - 7 Revision 0 BASESSR  3.0.4  (continued) A provision is included to allow entry into the specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4. However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing specified conditions of the Applicability. However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to specified condition changes. SR 3.0.4 does not restrict changing specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3. The provisions of SR 3.0.4 shall not prevent entry into specified conditions in the Applicability that are required to comply with ACTIONS. The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO's Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met. Alternately, the Surveillance may be stated in the form of a Note, as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.
Boron ConcentrationB 3.1.1INDIAN POINT 2B 3.1.1-1Revision 0B 3.1  INTER-UNIT FUEL TRANSFERB 3.1.1  Boron ConcentrationBASESBACKGROUNDThe NRC has issued Amendment 268 for the inter-unit transfer ofspent nuclear fuel (Ref. 1). The Amendment is based on evaluations conducted for each aspect of the inter-unit transfer of fuel as documented in Reference 2.The limit on the boron concentration in the Spent Fuel Pit (SFP)and the Shielded Transfer Canister (STC) ensures that the fuel in the STC remains subcritical during postulated accidents. The soluble boron concentration offsets the reactivity addition due to the postulated accidents and is measured by chemical analysis of a representative sample of the water in each of the volumes.APPLICABLEAs required by 10 CFR 50.68 (Ref. 3), if no credit for solubleSAFETYboron in the STC is taken then, the k eff of the STC fuel basketANALYSISloaded with fuel of the maximum fuel assembly reactivitymust not exceed 0.95, at a 95 percent probability, 95 percentconfidence level, if flooded with unborated water.Reference 2 documents the results of a criticality analysis thatdemonstrates that the STC k eff is less than or equal to 0.95 withthe STC fuel basket loaded with fuel of the highest anticipatedreactivity and the STC flooded with water at a temperaturecorresponding to the highest reactivity. The maximum calculatedreactivity, which includes a margin for uncertainty in reactivity calculations, is performed for a combination of worst casetolerances and conditions, and is shown to be less than 0.95 witha 95 percent probability at a 95 percent confidence level. Under normal conditions, the water in the STC is assumed to be pure, unborated water, while under accident conditions, the solubleboron in the water is credited. A summary of the types ofaccidents analyzed and the soluble boron required to ensure the maximum k eff remains below 0.95 is provided in Reference 2.These acceptance criteria are in accordance with 10 CFR 50.68(b) (Ref. 3).The double contingency principle discussed in ANSI N16.1-1975and the April 1978 NRC letter (Ref. 4) allows credit for soluble boron under other abnormal or accident conditions because only Boron ConcentrationB 3.1.1INDIAN POINT 2B 3.1.1-2Revision 0BASESAPPLICABLEa single accident need be considered at one time. For example,SAFETYthe postulated accident scenarios include dropping a fuelANALYSISassembly on top of the STC basket, or accidental misloading of a(continued)fuel assembly in the STC basket. These events could increase thepotential for criticality in the STC. To mitigate these postulatedcriticality related accidents, boron concentration is verified to be within the limits specified in LCO 3.1.1.These events could increase the potential for criticality in the STC.The criticality accidents can only take place during or as a result ofthe movement of an assembly. For these accident occurrences,the presence of soluble boron in the spent fuel storage pit prevents criticality in the STC. Reference 2 describes multiple fuel assembly misloads and determined that in the limitingconfiguration a boron concentration of 1053 ppm was required tomaintain k eff less than or equal to 0.95.The concentration of dissolved boron in the STC satisfies Criterion 2 of 10 CFR 50.36.
LCOThe boron concentration of the water in the spent fuel pit containing the STC and in the STC is required to be  2000 ppm.The specified concentration of dissolved boron preserves the assumptions used in the criticality accident scenarios as describedin Reference 2. This concentration also preserves the criticalityassumptions of the IP2 and IP3 spent fuel pools.The LCO is modified by a Note indicating that the LCO is onlyapplicable to the spent fuel pit when the STC is in the spent fuel pit. When the STC is not in the pit the boron concentration in the pit must continue to meet the requirements of IP3 Appendix ALCO 3.7.15 or IP2 Appendix A LCO 3.7.12.APPLICABILITYThis LCO applies whenever one or more fuel assemblies are in the STC.ACTIONSA.1, A.2 and A.3When the concentration of boron in the STC is less than required,immediate action must be taken to preclude the occurrence of an accident or to mitigate the consequences of an accident inprogress. This is most efficiently achieved by immediately Boron ConcentrationB 3.1.1INDIAN POINT 2B 3.1.1-3Revision 0BASES ACTIONSsuspending the movement of fuel assemblies. The concentration(continued)of boron is restored simultaneously with suspending movement offuel assemblies. Prior to resuming movement of fuel assemblies, the concentration of boron must be restored. This does notpreclude movement of a fuel assembly to a safe position.SURVEILLANCESR 3.1.1.1REQUIREMENTSWhen the concentration of boron in the STC is less than required,immediate action must be taken to preclude the occurrence of anaccident or to mitigate the consequences of an accident inprogress. This SR is modified by a Note indicating that thesurveillance is only required to be performed if the STC issubmerged in water in the spent fuel pool or if water is to beadded to, or recirculated through, the STC. These are the onlytimes when a change in STC boron concentration could potentially occur. In order to preserve the assumptions of the criticalityanalysis, the Note further requires that water added to, orrecirculated through, the STC must meet the boron concentration requirements of LCO 3.1.1. This Note does not apply to theaddition of steam to the STC (Reference 1).This SR verifies that the concentration of boron in the spent fuelpit and the STC is within the required limit. As long as this SR ismet, the analyzed accidents are fully addressed. The initialsurveillance within 4 hours prior to loading fuel into the STC and the 48 hour Frequency thereafter are appropriate because nomajor replenishment of spent fuel pit water is expected to takeplace over such a short period of time and any recirculation of water or water added to the STC will be accomplished using borated water at or above the required limit.Whenever the STC is in the spent fuel pool a measurement ofspent fuel pool boron concentration is equivalent to an STC boronconcentration measurement.
Boron ConcentrationB 3.1.1INDIAN POINT 2B 3.1.1-4Revision 0BASESREFERENCES 1.Safety Evaluation by the Office of Nuclear ReactorRegulation Related to Amendment No. 268 to FacilityOperating License No. DPR-26, June xx, 2012.
2.Holtec Report HI-2094289, Licensing Report on the Inter-Unit Transfer of Spent Nuclear Fuel at Indian Point Energy Center, Revision 6.
3.10 CFR 50.68, "Criticality Accident Requirements."4. Double contingency principle of ANSI N16.1-1975, asspecified in the April 14, 1978 NRC letter (Section 1.2) and implied in the proposed revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).
STC LoadingB 3.1.2INDIAN POINT 2                              B 3.1.2-1Revision 0B 3.1  INTER-UNIT FUEL TRANSFERB 3.1.2  Shielded Transfer Canister (STC) LoadingBASESBACKGROUNDAs required by plant operations IP3 spent fuel is transferred to theIP2 spent fuel pit in order to maintain adequate fuel storage capacity in the IP3 spent fuel pit. IP3 spent fuel moved to the IP2 spent fuel pit is subsequently transferred to dry cask storage at the IPEC on-site Independent Spent Fuel Storage Installation (ISFSI) as part of spent fuel inventory management in the IP2 spent fuel pit. The NRC has issued Amendment 268 for the inter-unit transfer of spent nuclear fuel (Ref. 1).Inter-unit fuel transfer operations are conducted using theShielded Transfer Canister (STC) and the HI-TRAC 100D transfercask. The STC is a bolted-lid pressure vessel with an internal fuelbasket that accommodates up to twelve IP3 spent fuelassemblies. The STC is loaded in the IP3 spent fuel pit, placedinto the HI-TRAC transfer cask in the Fuel Storage Building (FSB)truck bay, and moved outside the truck bay on air pads or otherapproved conveyance. The STC/HI-TRAC assemblage istransported from outside the IP3 FSB truck bay to just outside the IP2 FSB truck bay with a Vertical Cask Transporter (VCT) andmoved into the IP2 FSB truck bay on a Low Profile Transporter.The STC is removed from the HI-TRAC using the cask handlingcrane and placed into the IP2 spent fuel pit. The STC lid is removed and the IP3 fuel assemblies are moved to their designated IP2 wet storage rack cell locations with the spent fuelbridge crane in accordance with IP2 Appendix A TS LCO 3.7.13.Fuel assemblies to be transferred are selected at IP3 based onthe requirements for loading in the STC. The STC fuel loading requirements are such that the fuel selected for transfer to IP2 is suitable for storage in the designated IP2 spent fuel pit storageracks within the limits of IP2 Appendix A TS LCO 3.7.13 and thereare open fuel cells available. Fuel move sheets will govern the transfer of the spent fuel from IP3 to IP2.Table 3.1.2-1 "Minimum Burnup Requirements at Varying InitialEnrichments" is used to classify each assembly as either a Type 1 assembly or a Type 2 assembly based on initial U-235 enrichmentand average assembly burnup. This classification is used todetermine if, and where, the fuel assembly can be placed in the STC fuel basket. In the STC design, the fuel basket is divided into STC LoadingB 3.1.2INDIAN POINT 2                              B 3.1.2-2Revision 0BASESBACKGROUNDtwelve cells as shown in Figure 3.1.2-1, "Shielded Transfer(continued)Canister Layout (Top View)". Type 2 assemblies are relatively lessreactive assemblies and include any assembly that meets the minimum assembly average burnup at a given initial enrichment of Table 3.1.2-1. Type 2 assemblies may be stored in any cell in theSTC subject to the additional restrictions of the LCO. Theseadditional restrictions include post-irradiation cooling time, initial enrichment, allowable average burnup and decay heat of fuel andnon fuel hardware as specified in Table 3.1.2-2 "Non FuelHardware Post Irradiation Cooling Times and Allowable Average Burnup" and Table 3.1.2-3 "Allowable STC LoadingConfigurations".Type 1 assemblies are relatively more reactive assemblies andinclude any assembly that does not meet the minimum assemblyaverage burnup at a given initial enrichment of Table 3.1.2-1.Type 1 fuel must be placed in the outer cells of the STC subject to the additional restrictions of the LCO. These additional restrictionsinclude post-irradiation cooling time, initial enrichment, allowableaverage burnup and decay heat of fuel and non fuel hardware as specified in Tables 3.1.2-2 and 3.1.2-3.Together, the limits on Type 1 and Type 2 fuel assemblies andassociated non fuel hardware ensure the criticality, shielding, structural and thermal analyses performed for the STC remainbounding.To ensure that fuel assemblies selected for transfer can be storedin the IP2 SFP only fuel assemblies with initial averageenrichment  3.2 and  4.4 wt% U-235 and discharged prior to IP3Cycle 12 can be placed in the STC basket.Fuel assemblies with an initial enrichment > 5.0 wt% U-235 arenot shown on Table 3.1.2-1 and cannot be placed in the STC in accordance with TS 3.1.2.APPLICABLEThe STC has been analyzed for criticality prevention, heatSAFETYrejection capability, shielding, and structural integrity to ensureANALYSESsafe transfer operations from the time that the STC is loaded at IP3 to the time it is unloaded at IP2 (Ref. 2).As required by 10 CFR 50.68 (Ref. 3), if no credit for solubleboron in the STC is taken then, the k eff of the STC fuel basketloaded with fuel of the maximum fuel assembly reactivity must notexceed 0.95, at a 95 percent probability, 95 percent confidencelevel, if flooded with unborated water.
STC LoadingB 3.1.2INDIAN POINT 2                              B 3.1.2-3Revision 0BASESAPPLICABLEReference 2 documents the results of a criticality analysis thatSAFETYdemonstrates that the STC k eff is less than or equal to 0.95 withANALYSISthe STC fuel basket loaded with fuel of the highest anticipated(continued)reactivity and the STC flooded with water at a temperaturecorresponding to the highest reactivity. The maximum calculatedreactivity, which includes a margin for uncertainty in reactivity calculations, is performed for a combination of worst casetolerances and conditions, and is shown to be less than 0.95 witha 95 percent  probability at a 95 percent confidence level. Under normal conditions, the water in the STC is assumed to be pure,unborated water, while under accident conditions, the solubleboron in the water is credited. A summary of the types of accidents analyzed and the soluble boron required to ensure the maximum k eff remains below 0.95 is provided in Reference 2.These acceptance criteria are in accordance with 10 CFR 50.68(b) (Ref. 3).The criticality analysis and the limits on fuel selection prescribed inLCO 3.1.2 ensure that the effective neutron multiplication factor (k eff) of a loaded STC in its most reactive configuration remainsless than 0.95.The double contingency principle discussed in ANSI N16.1-1975and the April 1978 NRC letter (Ref. 4) allows credit for solubleboron under other abnormal or accident conditions  because onlya single accident need be considered at one time. For example, the accident scenarios include dropping a fuel assembly on top ofthe STC basket, or accidental misloading of a fuel assembly in theSTC basket. These events could increase the potential for criticality in the STC. To mitigate these postulated criticality related accidents, boron concentration is verified to be within the limitsspecified in LCO 3.1.1, "Boron Concentration".Reference 2 documents the results of a thermal analysis thatshows that the fuel cladding temperature remains below theacceptance criteria of 752 oF and 1058 oF, for normal and accidentconditions respectively, at all times during inter-unit transfer andthat the design pressure and temperature of the STC are notexceeded.Reference 2 documents the results of a structural analysis thatshows that the STC and HI-TRAC maintain their structural integrity under all normal, off-normal, and credible accidentconditions.
STC LoadingB 3.1.2INDIAN POINT 2                              B 3.1.2-4Revision 0BASESAPPLICABLEReference 2 documents the results of a shielding analysis thatSAFETYshows that the dose rates from the STC during the short time it isANALYSISnot inside the HI-TRAC are acceptable with appropriate radiation(continued)protection controls. Dose rates from the loaded HI-TRAC areshown to be low.The configuration of fuel assemblies in the STC satisfies Criterion2 of 10 CFR 50.36.
LCOFuel assemblies stored in the spent fuel pit are classified in accordance with Table 3.1.2-1 based on initial enrichment andburnup which is indicative of fuel assembly reactivity. Based onthis classification, fuel assembly placement in the STC cells is restricted in accordance with the classification of the fuel and the additional constraints established by this LCO.LCO 3.1.2.b is modified by a note stating that if one or more Type1 assemblies are in the STC, cells 1, 2, 3, and 4 must be empty,with a cell blocker installed that prevents inserting fuel assembliesand/or non fuel hardware. The restriction preserves the assumptions of the bounding criticality analysis for Type 1 fuelassemblies placed only in the peripheral fuel cells.APPLICABILITYThis LCO applies whenever one or more fuel assemblies are inthe STC.ACTIONSA.1.1When the configuration of fuel assemblies or non fuel hardware inthe STC is not in accordance with this LCO, one action is to make the necessary fuel assembly or non fuel hardware movement(s) to bring the configuration of the fuel in the STC into compliance withthis LCO. This action restores the STC to an analyzedconfiguration.
ORA.1.2When the configuration of fuel assemblies or non fuel hardware inthe STC is not in accordance with this LCO, an optional action to restore compliance with the LCO is to move the fuel assembly or STC LoadingB 3.1.2INDIAN POINT 2                              B 3.1.2-5Revision 0BASES ACTIONSassemblies or non fuel hardware from the STC back into the IP3(continued)spent fuel pool in accordance with Appendix A TechnicalSpecification LCO 3.7.16.Either action places the fuel in equally safe locations.The completion time of "Immediately" is appropriate because fuellocated in the STC may be in an unanalyzed condition and actionis required to be initiated and completed without delay to restorethe fuel location to an analyzed configuration.SURVEILLANCESR 3.1.2.1REQUIREMENTSThis SR verifies by administrative means that the fuel assemblymeets the requirements of the STC location in which it is to beplaced and that it also meets the requirements for storage in the IP2 spent fuel pit in accordance with IP2 Appendix A TS LCO3.7.13. This SR ensures the LCO limits for fuel selection andlocation in the STC and IP2 spent fuel pit are met and the supporting technical analyses remain bounding for all inter-unittransfer operations.SR 3.1.2.2This SR verifies by visual inspection that a cell blocker is installedprior to placing a Type 1 fuel assembly and/or non fuel hardware in the STC. This SR ensures that a Type 1 fuel assembly cannotbe inserted into STC cells 1, 2, 3, and 4.REFERENCES 1.Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 268 to FacilityOperating License No. DPR-26, June xx, 2012.
2.Holtec Report HI-2094289, Licensing Report on the Inter-Unit Transfer of Spent Nuclear Fuel at Indian Point EnergyCenter, Revision 6.
3.10 CFR 50.68, "Criticality Accident Requirements."4. Double contingency principle of ANSI N16.1-1975, asspecified in the April 14, 1978 NRC letter (Section 1.2) andimplied in the proposed revision to Regulatory Guide 1.13(Section 1.4, Appendix A).
STC Initial Water LevelB 3.1.3INDIAN POINT 2B 3.1.3-1Revision 0B 3.1  INTER-UNIT FUEL TRANSFERB 3.1.3 Shielded Transfer Canister (STC) Initial Water LevelBASESBACKGROUNDThe NRC has issued Amendment 268 for the inter-unit transfer ofspent nuclear fuel (Ref. 1). The Amendment is based on evaluations conducted for each aspect of the inter-unit transfer of fuel as documented in Reference 2.The limit on the STC initial water level ensures the STC waterlevel is within the limits assumed in both design basis and accident analyses.APPLICABLEThe accidental misloading of a high decay heat fuel assembly,SAFETYthe accidental misloading of multiple assemblies, or the accidentalANALYSESintroduction of a significant amount of air into the STC would bedetected based on a comparison of predicted and as measuredSTC pressures as a function of time (LCO 3.1.4). The predicted STC pressure rise is based on the initial STC water level being within the specified range and is therefore an initial condition inthese accident analyses. The initial STC water level is also aninitial condition for other accident analyses as described in Reference 2.The STC initial water level limits satisfy Criterion 2 of 10 CFR50.36.LCOAs indicated in the Applicable Safety Analyses, the STC initial water level is an initial condition for the accident analysesdescribed in Reference 2 and, therefore, must be established priorto TRANSFER OPERATIONS when the STC is in the HI-TRAC and the STC lid has been installed.This LCO preserves the assumptions of the safety analyses forthe STC and HI-TRAC during TRANSFER OPERATIONS.APPLICABILITYPrior to TRANSFER OPERATIONS when the STC is in the HI-TRAC and the STC lid has been installed.
STC Initial Water Level B 3.1.3 BASES ACTIONS A.1Required Action A.1 is modified by a Note indicating that the water used for level restoration must meet the boron concentration requirement of LCO 3.1.1. This requirement preserves the assumptions of the criticality analysis. SURVEILLANCE SR 3.1.3.1REQUIREMENTS This SR verifies that the STC initial water level is within limit by verifying that steam is emitted from the STC drain tube during STC water level establishment and that the required volume of water is removed from the STC. As long as this SR is met, the analyzed accident assumptions are met. REFERENCES 1. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 268 to Facility Operating License No. DPR-26, July 13, 2012.
2.Holtec Report HI-2094289, Licensing Report on the Inter-Unit Transfer of Spent Nuclear Fuel at Indian Point Energy Center, Revision 6. INDIAN POINT 2 B 3.1.3-2 Revision 0 STC Pressure RiseB 3.1.4INDIAN POINT 2B 3.1.4-1Revision 0B 3.1  INTER-UNIT FUEL TRANSFERB 3.1.4 Shielded Transfer Canister (STC) Pressure RiseBASESBACKGROUNDThe NRC has issued Amendment 268 for the inter-unit transfer ofspent nuclear fuel (Ref. 1). The Amendment is based on evaluations conducted for each aspect of the inter-unit transfer of fuel as documented in Reference 2.The limits on the STC pressure rise ensures that there has notbeen an accidental misloading of a high decay heat fuel assembly or the misloading of multiple assemblies and that there is not a significant amount of air in the STC.APPLICABLEThe accidental misloading of a high decay heat fuel assembly,SAFETYthe accidental misloading of multiple assemblies, or the accidentalANALYSESintroduction of a significant amount of air into the STC would bedetected based on a comparison of predicted and as measuredSTC pressures as a function of time. Thermal analyses have been performed (Ref. 2) that predict an STC pressure rise of no more than 0.2 psi/hour after an STC loaded with the design basis heatload is placed in the HI-TRAC and the STC is sealed.The STC pressure rise limit satisfies Criterion 2 of 10 CFR50.36.LCOThe STC pressure rise is required to be  0.2 psi/hour averagedover a rolling 4 hour period prior to TRANSFER OPERATIONS when the STC is in the HI-TRAC and the STC lid has beeninstalled and the STC water level established. Pressure measurements shall be taken once upon establishing requiredwater level and hourly thereafter over a 24 hour period.Monitoring the STC pressure rise ensures that should thepressure rise limit be exceeded, appropriate actions are taken in atimely manner to return the STC to the IP3 spent fuel pool. Also note that the 24 hour STC pressure test will also be a check on the thermal properties of the STC and HI-TRAC system, such thatif there were any significant changes in the thermal properties itwould be expected to show as anomalous readings during the pressure test.This LCO preserves the assumptions of the safety analyses forthe STC.
STC Pressure RiseB 3.1.4INDIAN POINT 2B 3.1.4-2Revision 0BASESAPPLICABILITYOver a 24 hour period after successful completion of LCO 3.1.3and prior to TRANSFER OPERATIONS when the STC is in the HI-TRAC and the STC lid has been installed.
ACTIONS A.1.1The completion time of "Immediately" is appropriate because fuel located in the STC may be in an unanalyzed condition and actionis required to be initiated and completed without delay to preventoverpressurization of the STC.A.1.2Required Action A.1.2 is modified by a Note indicating that thewater used for recirculation must meet the boron concentration requirement of LCO 3.1.1. This requirement preserves the assumptions of the criticality analysis.The completion time of "Immediately" is appropriate because fuellocated in the STC may be in an unanalyzed condition and action is required to be initiated without delay to prevent overpressurization of the STC.A.1.3The completion time of "Immediately" is appropriate because fuellocated in the STC may be in an unanalyzed condition and action is required to be initiated and completed without delay to prevent overpressurization of the STC.B.1.1The completion time of 12 hours is appropriate because fuellocated in the STC may be in an unanalyzed condition and action is required to be initiated to restore fuel location to an analyzed configuration. This timeframe considers the time required to complete this action and that a vent path has been established.B.1.2The completion time of 24 hours is appropriate because fuellocated in the STC may be in an unanalyzed condition and action is required to be initiated and completed to restore fuel location to an analyzed configuration. This timeframe considers the time required to complete this action.
STC Pressure Rise B 3.1.4 BASES ACTIONS C.1(continued) The completion time of 24 hours is appropriate because although the fuel located in the STC is not in an unanalyzed condition prompt action is required to develop and initiate corrective actions to return the STC to compliance with LCO 3.1.3 and LCO 3.1.4. SURVEILLANCE SR 3.1.4.1REQUIREMENTS This SR verifies by direct measurement that the STC cavity pressure is within limit. As long as this SR is met, the analyzed accident assumptions are met. SR 3.1.4.2This SR verifies that an ASME code compliant pressure relief valve or rupture disc and two channels of pressure instrumentation of the required range and accuracy are installed on the STC during performance of the SR. The pressure relief valve or rupture disc protects the STC pressure boundary until it has been demonstrated that there has not been an accidental misloading of a high decay heat fuel assembly or the misloading of multiple assemblies and that there is not a significant amount of air in the STC. REFERENCES 1. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 268 to Facility Operating License No. DPR-26, July 13, 2012.
2.Holtec Report HI-2094289, Licensing Report on the Inter- Unit Transfer of Spent Nuclear Fuel at Indian Point Energy Center, Revision 6. INDIAN POINT 2 B 3.1.4-3 Revision 0 STC UnloadingB 3.1.5INDIAN POINT 2                              B 3.1.5-1Revision 0B 3.1  INTER-UNIT FUEL TRANSFERB 3.1.5  Shielded Transfer Canister (STC) UnloadingBASESBACKGROUNDThe NRC has issued Amendment 268 for the inter-unit transfer ofspent nuclear fuel (Ref. 1). The Amendment is based onevaluations conducted for each aspect of the inter-unit transfer offuel as documented in Reference 2.The limits on STC unloading ensures that the fuel in the STC andthe IP2 spent fuel pool remains subcritical during normaloperations and postulated accidents.The STC is removed from the HI-TRAC using the IP2 caskhandling crane and placed into the IP2 spent fuel pit. The STC lid is removed and the IP3 fuel assemblies are moved to theirdesignated IP2 wet storage rack cell locations with the spent fuelbridge crane in accordance with IP2 Appendix A TS LCO 3.7.13.Fuel assemblies to be transferred are selected at IP3 based onthe requirements for loading in the STC as specified in LCO 3.1.2.
The STC fuel loading requirements are such that the fuel selectedfor transfer to IP2 is suitable for storage in the IP2 spent fuel pitwithin the limits of IP2 Appendix A TS LCO 3.7.13 and there are open fuel cells available. Fuel move sheets will govern thetransfer of the spent fuel from IP3 to IP2.APPLICABLEThe STC has been analyzed for criticality prevention, heatSAFETYrejection capability, shielding, and structural integrity to ensureANALYSESsafe transfer operations from the time that the STC is loaded atIP3 to the time it is unloaded at IP2 (Ref. 2).As required by 10 CFR 50.68 (Ref. 3), if no credit for solubleboron in the STC is taken then, the k-effective of the spent fuel storage racks loaded with fuel of the maximum fuel assemblyreactivity must not exceed 0.95, at a 95 percent probability, 95percent confidence level, if flooded with unborated water.Reference 2 documents the results of a criticality analysis thatdemonstrates that the STC k eff is less than or equal to 0.95 withthe STC fuel basket loaded with fuel of the highest anticipatedreactivity and the STC flooded with water at a temperaturecorresponding to the highest reactivity. The maximum calculatedreactivity, which includes STC UnloadingB 3.1.5INDIAN POINT 2                              B 3.1.5-2Revision 0BASESAPPLICABLEa margin for uncertainty in reactivity calculations, is performed forSAFETYa combination of worst case tolerances and conditions, and isANALYSISshown to be less than 0.95 with a 95 percent probability at a 95(continued)percent confidence level. Under normal conditions, the water inthe STC is assumed to be pure, unborated water, while underaccident conditions, the soluble boron in the water is credited. A summary of the types of accidents analyzed and the soluble boronrequired to ensure the maximum k eff remains below 0.95 isprovided in Reference 2. These acceptance criteria are inaccordance with 10 CFR 50.68(b) (Ref. 3).The criticality analysis and the limits on fuel selection prescribed inLCO 3.1.2 ensure that the effective neutron multiplication factor (k eff) of a loaded STC in its most reactive configuration remainsless than 0.95. In addition, the criticality analysis and the limits on fuel selection prescribed in Appendix A TS LCO 3.7.13 ensure
 
that k eff remains below 0.95 if the spent fuel pool is flooded withborated water and below 1.0 if flood with unborated water both at the 95 percent probability, 95 percent confidence level.The double contingency principle discussed in ANSI N16.1-1975and the April 1978 NRC letter (Ref. 4) allows credit for soluble boron under other abnormal or accident conditions  because only a single accident need be considered at one time. For example,the accident scenarios include dropping a fuel assembly on top ofthe STC basket, or accidental misloading of a fuel assembly in the STC basket. These events could increase the potential forcriticality in the STC. To mitigate these postulated criticality relatedaccidents, boron concentration is verified to be within the limits specified in LCO 3.1.1, "Boron Concentration".Reference 2 documents the results of a thermal analysis thatshows that the fuel cladding temperature remains below the acceptance criteria of 752 oF and 1058 oF, for normal and accidentconditions respectively, at all times during inter-unit transfer and that the design pressure and temperature of the STC are not exceeded.Reference 2 documents the results of a structural analysis thatshows that the STC and HI-TRAC maintain their structuralintegrity under all normal, off-normal, and credible accidentconditions.
STC UnloadingB 3.1.5INDIAN POINT 2                              B 3.1.5-3Revision 0BASESAPPLICABLEReference 2 documents the results of a shielding analysis thatSAFETYshows that the dose rates from the STC during the short time it isANALYSISnot inside the HI-TRAC are acceptable with appropriate radiation(continued)protection controls. Dose rates from the loaded HI-TRAC areshown to be low.The configuration of fuel assemblies in the STC satisfies Criterion2 of 10 CFR 50.36.
LCOLCO 3.1.5 governs the presence of the STC in the IP2 spent fuel pit. The STC arrives at IP2 with its bolted lid in place, whichpreserves the fuel types and fuel locations established at IP3 when the STC was loaded. Once the STC lid is removed at IP2, this LCO requires that a transferred fuel assembly be in one ofthree places:1. In an approved IP2 spent fuel pit storage rack locationper Appendix A TS LCO 3.7.13, or2. In an authorized STC fuel basket cell, or3. In transit between these two locations.This LCO preserves the assumptions of the safety analyses forthe STC and the IP2 spent fuel pit.This LCO is modified by two notes. Note 1 specifies that only IP3spent fuel assemblies are permitted to be in the STC becausethe STC design and analysis are based on IP3 fuel assemblies.
Therefore, loading of IP2 fuel assemblies in the STC is notauthorized. Note 2 specifies that once each IP3 spent fuelassembly is removed from the STC and placed in an IP2 spent fuel pit storage rack location and released from the spent fuel bridge crane, it may not be returned to the STC. This noteprevents loading IP3 fuel out of the IP2 spent fuel pit for transferback to the STC. This is not an authorized evolution.APPLICABILITYThe LCO is applicable whenever the STC is in the IP2 spent fuel
 
pit.ACTIONS A.1When any IP3 spent fuel assembly transferred to the IP2 spent fuel pit is not in one of the three authorized locations, LCO 3.1.5 is STC UnloadingB 3.1.5INDIAN POINT 2                              B 3.1.5-4Revision 0BASES ACTIONSnot met. Required Action A.1 specifies that action begin(continued)immediately to restore compliance with the LCO. The affectedfuel assemblies must be placed in an authorized location without delay.The completion time of "Immediately" is appropriate because fuellocated in the STC or the spent fuel pit racks may be in anunanalyzed condition and action is required to be initiated and completed without delay to restore fuel location to an analyzed configuration.SURVEILLANCESR  3.1.5.1REQUIREMENTSSR 3.1.5.1 requires that any IP3 fuel assembly being returned to the STC be verified by administrative means to have beenreturned to the same STC fuel basket cell location from which itwas removed. This SR ensures that the loading pattern authorized when the STC was loaded at IP3 is preserved.This SR does not apply for placing the IP3 fuel assembly in a IP2spent fuel pit cell location because that process is governed byIP2 Appendix A TS LCO 3.7.13 and a fuel move sheet is requiredto place the IP3 fuel assembly in an approved location in the IP2 spent fuel pit storage racks.REFERENCES 1.Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment No. 268 to Facility Operating License No. DPR-26, June xx, 2012.
2.Holtec Report HI-2094289, Licensing Report on the Inter-Unit Transfer of Spent Nuclear Fuel at Indian Point Energy Center, Revision 6.
3.10 CFR 50.68, "Criticality Accident Requirements."4. Double contingency principle of ANSI N16.1-1975, asspecified in the April 14, 1978 NRC letter (Section 1.2) and implied in the proposed revision to Regulatory Guide 1.13(Section 1.4, Appendix A).}}

Latest revision as of 19:59, 9 January 2025

Improved Technical Specifications Bases
ML16280A229
Person / Time
Site: Indian Point 
Issue date: 09/19/2016
From:
Entergy Nuclear Operations
To:
Office of Nuclear Reactor Regulation
Shared Package
ML16280A161 List: ... further results
References
NL-16-109
Download: ML16280A229 (693)
v • d • e


Text

Retrieved from "https://kanterella.com/w/index.php?title=ML16280A229&oldid=5163299"