ML040210004

Additional Post Examination Comments for the Prairie Island Initial Examination - September 2003

ML040210004
Person / Time
Site:	Prairie Island
Issue date:	11/19/2003
From:	Solymossy J Nuclear Management Co
To:	NRC/RGN-III
References
50-282/03-301, 50-306/03-301
Download: ML040210004 (72)

Text

ADDITIONAL POST-EXAMINATION COMMENTS FOR THE PRAIRIE ISLAND INITIAL EXAMINATION - SEP 2003

November 19,2003 L-PI-03-109 10 CFR 55 Mr. Dell R. McNeil Reactor Engineer USNRC, Region I l l 801 Warrenville Road Lisle, IL 60532-4351

Dear Mr. McNeil:

As a follow-up to our letter dated September 24, 2003, Nuclear Management Company (NMC) has concluded that an additional question should be deleted from the Senior Reactor Operator (SRO) License written examination conducted on September 18, 2003 at Prairie Island. Upon further evaluation of question 14, we have determined that the question should be deleted based upon the attached discussion.

This letter contains no new commitments and no revisions to existing commitments.

Please contact Jim Lash (651-388-1 165 ext 4053) if you have any questions related to this letter.

Sincerely, uclear Generating Plant cc:

Regional Administrator, USNRC, Region 111, w/o Roger D. Lanksbury, USNRC, Region Ill, w/o 1717 Wakonade Drive East Welch, Minnesota 55089-9642 Telephone: 651.388.1 121 u0y 53 4 2m3

L USNRC L-PI-03-109 Page 2

Attachment:

Additional Facility Recommendation -SRO Question 14 - Deletion (3 pages)

Enclosure I:

Prairie Island 2003 SRO Exam Question 14 (I page) : Prairie Island Technical Specification 3.3.2 (ESFAS Instrumentation) : Prairie Island Technical Specification 3.3.2 Bases (ESFAS : Prairie Island Technical Specification 3.7.5 (AFW System) (5 pages)

(12 pages)

Instrumentation) (43 pages) 1717 Wakonade Drive East Welch, Minnesota 55089-9642 Telephone: 651.388.1 121

ATTACHMENT Additional Facility Recommendation SRO Question 14-Deletion November 19,2003 3 Pages Follow

c Recommend SRO Question #I4 be deleted from the examination.

Question 14 of the written SRO exam reads:

The Engineered Safety Feature Actuation System (ESFAS) automatic logic for AFW actuation is required to be OPERABLE in MODES 1,2, and 3. However, the auto-start from undervoltage (UV) on the associated 4KV buses is only required to be OPERABLE in MODES 1 and 2. Why?

a. In MODE 3, the thermal power is limited to decay heat only so the UV auto-start is not needed.

b. RCP UV trip is blocked below P-7 and this auto-start exists to promote NC when the RCPs trip.

c. This auto-start anticipates the loss of both MFW pumps, which are not required in MODE 3.

d. The UV start is associated with the TDAFW pump, which is NOT required in MODE 3.

The question stem contains two statements of fact. First, the ESFAS automatic logic for Auxiliary Feedwater (AFW) actuation is required to be OPERABLE in MODES 1, 2, and

3. Second, the auto-start from undervoltage (UV) on the associated 4KV buses is only required to be OPERABLE in MODES 1 and 2.

0 The term ESFAS automatic logic for AFW actuation is ambiguous. This term does not appear in Technical Specifications as written. Table 3.3.2-1 of Technical Specification LCO 3.3.2 (page 3.3.2-1

2) lists the required components of Function

6. 6.a is the Automatic Actuation Relay Logic. This feature is required in Modes I

,2 and 3. It is not clear whether the stem is referring to this feature or to any AFW actuation in general terms.

The question is phrased as Why? With two statements of fact appearing just prior to Why? it is not clear as to what is being required of the reader. The stem could be asking either or all of:

o Why is the ESFAS automatic logic for AFW actuation required to be operable in Modes 1,2 and 3? Or, o Why is the auto start from UV on the associated 4KV buses only required to be operable in Modes 1 and 2? Or, o Why does the auto start from UV on the associated 4KV buses have different mode requirements from one or more of the other features listed under Function 6?

0 This problem, coupled with the ambiguity of the phrase automatic logic for AFW actuation makes interpretation of question meaning extremely difficult.

1

i The answers also contain wording problems that compound the difficulty at interpreting question meaning.

Answer c reads, This auto-start anticipates the loss of both MFW Pumps which are not required in Mode 3.

0 Answer d reads, The UV start is associated with the TDAFW Pump which is NOT required in Mode 3.

0 The mode requirements listed in these responses contain language that distorts the meaning of the word required. In answer d, the use of the word required is asking the reader to recall a Technical Specification requirement (AFW) and recall if Mode 3 is applicable. In answer c, similar wording is used but the not is not capitalized, and the Main Feedwater (MFW) Pumps are not within the scope of Technical Specifications. Based on the use of the word required in distracter d, the reader would eliminate lit" as the answer, simply based on the knowledge that MFW pumps are not part of Technical Specifications for any mode of operation.

This wording irregularity confuses the reader, and shifts focus from what the question intended to ask.

There is no correct answer to question 14 for the following reasons:

Answer a states In Mode 3, the thermal power is limited to decay heat only so the UV auto-start is not needed.

It is true that thermal power is limited to decay heat only in Mode 3. It is also true that the UV auto start is not required in Mode 3. However, this choice does not answer the Why? posed by the stem. That is, why is automatic AFW actuation logic required in Modes 1, 2, and 3 andlor why is the UV auto start feature only required in Modes I and 2? A correct answer would have to provide more detail about the reasons the applicability is different for these two functions. Therefore, the answer does not completely or correctly answer the Why? of the question stem. For these reasons, answer a is not correct.

Answer b states the RCP UV trip is blocked below P-7 and this auto-start exists to promote NC when the RCPs trip.

It is true that the Reactor Coolant Pump (RCP) UV trip is blocked below P-7, however, the auto-start of the Turbine Driven (TD) AFW Pump due to UV on 4 KV buses 1 I and 12 (21 and 22) does not exist to promote natural circulation when the RCPs trip.

According to Technical Specification Bases page B 3.3.2-29, In Modes 3,4, and 5, the MFW pumps may be normally shut down, and thus neither the pump trip or bus undervoltage are indicative of a condition requiring automatic AFW initiation. For these reasons, answer b is not correct.

2

Answer IC states This auto-start anticipates the loss of both MFW pumps which are not required in MODE 3.

The use of the word required, especially in the context of required in MODE 3 implies a Technical Specification requirement, as in required to be OPERABLE. Usage of the word required in this manner is consistent with the wording in answer d of this question which states The UV start is associated with the TDAFW pump which is NOT required in MODE 3. The main feedwater pumps are also not required in MODE 2, or any other plant mode. However, in MODE 2 the UV auto-start function is required to be OPERABLE. Simply changing from one MODE that does not require MFW pumps, to another MODE that does not require MFW pumps, cannot explain why the feature that anticipates loss of the MFW pumps would be required in one MODE but NOT the other.

For these reasons, answer c is not correct. It does not answer Why?

Answer d states The UV start is associated with the TDAFW pump which is NOT required in MODE 3.

It is true that the UV start is associated with the TDAFW pump. However, it is incorrect to say that the TDAFW pump is not required in Mode 3. Technical Specification 3.7.5 requires 2 trains of AFW to be operable in Modes 1,2, and 3 and Mode 4 when the steam generator are relied upon for heat removal. For these reasons, answer d is not correct.

==

Conclusion:==

Question 14 contains a question stem that is confusing to the reader. It contains an ambiguous question that forces the reader to make an uninformed choice about what is really being asked. The stem uses terminology that does not appear in Technical Specifications, but clearly draws conclusions about Technical Specification requirements (automatic logic for AFW actuation). The answer choices contain ambiguous wording which confuses the reader as to the intent of the word required in context of Technical Specifications or some other plant operational requirement.

Finally, none of the answers provide all the necessary information to answer the question of Why? proposed by the stem under any interpretation. For these reasons, question 14 should be deleted from the SRO exam.

References(attached):

Prairie Island 2003 SRO Exam Question 14 Prairie Island Technical Specification 3.3.2 (ESFAS Instrumentation)

Prairie Island Technical Specification 3.3.2 Bases (ESFAS Instrumentation)

Prairie Island Technical Specification 3.7.5 (AFW System) 3

Enclosure I Prairie Island 2003 SRO Exam Question 14 1 Page Follows

6'"

Name:

KEY SRO Examination Page 14 of 25 Imp. RO 2.5 Imp. SRO 3.7 Level SRO Tier 2

Group I KIA#

013 2.2.25

14. The Engineered Safety Feature Actuation System (ESFAS) automatic logic for AFW actuation is required to be OPERABLE in MODES I, 2 and 3. However, the auto-start from undervoltage (UV) on the associated 4KV buses is only required to be OPERABLE in MODES I and 2. Why?

a.

b.

c.

d.

In MODE 3, the thermal power is limited to decay heat only so the UV auto-start is not needed.

RCP UV trip is blocked below P-7 and this auto-start exists to promote NC when the RCPs trip.

This auto-start anticipates the loss of both MFW pumps which are not required in MODE 3.

The UV start is associated with the TDAFW pump which is NOT required in MODE 3.

ANSWER: C a

b C

...d Plausible because hypothesis is true but the conclusion is NOT related to the question.

Plausible because hypothesis is true but the conclusion is NOT related to the question.

Correct per T.S. LCO 3.3.2 bases.

Plausible because hypothesis is true but the conclusion is false.

Explanation:

T.S. LCO 3.3.2 Bases Technical

References:

Objective:

P8180L-006 Equipment Control: Knowledge of bases in technical specifications for limiting conditions for operations and safety limits. (ESFAS)

KA Statement:

Cog. Level:

LOW 10CFR55.41:

10CFR55.43:

YES New Question:

YES Bank:

Ques. ID:

Modified Last NRC Exam:

Prairie Island Technical Specification 3.3.2 (ESFAS instrumentation)

I 2 Pages Follow

ESFAS Instrumentation 3.3.2 3.3 INSTRUMENTATION 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation LCO 3.3.2 The ESFAS instrumentation for each Function in Table 3.3.2-1 shall be OPERABLE.

APPUCABEJlY According to Table 3.3.2-1.

CONDITION A. One or more Functions with one or more required channels or trains inoperable.

B. One channel or train inoperable.

Prairie Island Units 1 and2 REQUIRED ACTION A.l Enter the Condition referenced in Table 3.3.2-1 for the channel(s) or train(s).

B.l Restore channel or train to OPERABLE status.

OR B.2.1 Be in MODE 3.

AND B.2.2 Be in MODE 5.

COMPLETION TIME Immediately 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> 54 hours 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> 3.3.2-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 ACTIONS (continued)

CONDITION C. One train inoperable.

D. One channel inoperable.

REQUIRED ACTION

---

NOTE----------------

One train may be bypassed for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for surveillance testing provided the other train is OPERABLE.

C.l Restore train to OPERABLE status.

OR C.2.1 Be in MODE 3.

AND C.2.2 Be in MODE 5.

---

NOTE----------------

The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing of other channels.

D. 1 OR D.2.1 Be in MODE 3.

Place channel in trip.

AND D.2.2 Be in MODE 4.

COMPLETION TIME 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours 42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> 6 hours 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> 18 hours Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 3.3.2-2

ESFAS Instrumentation 3.3.2 ACTIONS (continued)

CONDITION E. Oneormore Containment Pressure channel(s) inoperable.

REQUIRED ACTION

---

NOTE----------------

One channel may be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing.

E. 1.1 Place inoperable channel(s) in trip.

E. 1.2 Verify one channel per pair OPERABLE.

E.2.1 Be in MODE 3.

AND E.2.2 Be in MODE 4.

COMPLETION TIME 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 6 hours 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> 18 hours Prairie Island Units 1 and2 3.3.2-3 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 ACTIONS (continued]

CONDITION

~~

~~~~

F. One channel or train inoperable.

G. One train inoperable, REQUIRED ACTION F.1 Restore channel or train to OPERABLE status.

OR F.2.1 Be in MODE 3.

AND F.2.2 Be in MODE 4.

---

NOTE----------------

One train may be bypassed for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for surveillance testing provided the other train is OPERABLE.

G.l Restore train to OPERABLE status.

G.2.1 Be in MODE 3.

AND G.2.2 Be in MODE 4.

COMPLETION TIME 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> 54 hours 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> 6 hours 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> 18 hours Prairie Island Units 1 and2 3.3.2-4 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ACTIONS (continued)

CONDITION H.

Onechannel inoperable.

I.

One or both channel(s) inoperable on one bus.

ESFAS Instrumentation 3.3.2 REQUIRED ACTION

---

NOTE----------------

The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing of other channels.

H.l Place channel in trip.

OR H.2 Be in MODE 3.

~~

---

NOTE----------------

One inoperable channel may be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing of other channels.

1.1 Place channel(s) in trip.

OR 1.2 Be inMODE 3.

COMPLETION TIME 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours Prairie Island Units 1 and2 3.3.2-5 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for surveillance testing provided the other train is OPERABLE.

ACTIONS (continued)

I CONDITION J. One train inoperable.

K. One channel inoperable.

REQUIRED ACTION COMPLETION TIME J. 1 Enter applicable Condition(s) and Required Action( s) for Auxiliary Feedwater (AFW) train made inoperable by ESFAS instrumentation.

Immediately K. 1 Enter applicable Condition(s) and Required Action(s) for Auxiliary Feedwater (AFW) pump made inoperable by ESFAS instrumentation.

Immediately Prairie Island Units 1 and2 3.3.2-6 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 SURVEILLANCE REQUIREMENTS SURVEILLANCE SR 3.3.2.1 Perform CHANNEL CHECK.

SR 3.3.2.2 Perform ACTUATION LOGIC TEST.

SR 3.3.2.3 Perform COT.

Perform TADOT.

Prairie Island Units 1 and2 3.3.2-7 FREQUENCY 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> 31 days on a STAGGERED TEST BASIS 92 days 24 months Unit 1 -Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE Perform TADOT.

SR 3.3.2.6 NOTE---------------------------

This Surveillance shall include verification that the time constants are adjusted to the prescribed values.

Perform CHANNEL CALIBRATION.

SR 3.3.2.7 Perform MASTER RELAY TEST.

SR 3.3.2.8 Perform SLAVE RELAY TEST.

FREQUENCY 24 months on a STAGGERED TEST BASIS 24 months 24 months 24 months Prairie Island Units 1 and2 3.3 2-23 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 1 of 4)

Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE I.

Safety Injection

a. Manual Initiation

b. Automatic Actuation Relay Logic

c. High Containment Pressure

d. Pressurizer Low Pressure

e. SteamLine Low Pressure

2.

Containment spray a Manual Initiation

b. Automatic Actuation Relay Logic 1,2,3 3

1,2,3(a) 3 1,2,3(4 3 per steam line B

SR 3.3.2.5 C

SR 3.3.2.2 SR 3.3.2.8 D

SR 3.3.2.1 SR 3.3.2.3 SR 3.3.2.6 D

SR 3.3.2.1 SR 3.3.2.3 SR 3.3.2.6 D

SR 3.3.2.1 SR 3.3.2.3 SR 3.3.2.6 B

SR 3.3.2.4 C

SR 3.3.2.2 SR 3.3.2.8 NA FiA 5 4.0 psig t 1760psig t 500@) psig NA NA (a) Pressurizer Pressure t 2000 psig.

(b) Time constants used in the l d a g controller are t, )I 12 seconds and t2 5 2 seconds.

Prairie Island Units 1 and 2 3.3.2-9 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 @age 2 of 4)

Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE

2.

Containment Spray (continued)

c. High-High Containment Pressure

3.

Containment Isolation 3 sets of 2 E

SR 3.3.2.1 SR 3.3.2.3 SR 3.3.2.6

a. M & d 1,2,3,4 2

B SR 3.3.2.4 Initiation

b.

Automatic 1,2,3,4 2 trains C

SR 3.3.2.2 Actuation SR 3.3.2.8 Relay Logic

c. Safety Refer to Function 1 (Safety Injection) for all initiation functions and requirements Injection

4.

SteamLine Isolation a Manual 1, z q 3(c) 1 Aoop F

Initiation

b. Automatic I, 2(c), 3(c) 2trains G

Actuation Relay Logic

c. High-High 1, ZCC), 3(c) 3 Containment Pressure D

SR 3.3.2.4 SR 3.3.2.2 SR 3.3.2.7 SR 3.3.2.1 SR 3.3.2.3 SR 3.3.2.6 s 23 psig NA NA NA NA i 17 psig (c)

Except when both Main Steam Isolation Valves (MSNs) are closed.

Prairie Island Units 1 and2 3.3.2-10 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation 3 -3.2 Table 3.3.2-1 @age 3 of4)

Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE

4.

SteamLine Isolation (continued)

d. High Steam Flow Coincident with Safety Injection and Coincident with Low-Low TavE

e. HighHigh Steam Flow Coincident with Safety Injection

5.

Feedwater Isolation

a. Automatic Actuation Relay Logic

b. High-High steam Generator (SG)

Water Level 1,2(c), 3(cXd) 2 per steam D

SR 3.3.2.1 59.18E5 Ibhr at line SR 3.3.2.3 1005 psig SR 3.3.2.6 Refer to Function 1 (Safety Injection) for all initiation functions and requirements.

1,2(4,3(C)(d) 4 D

SR 3.3.2.1 SR 3.3.2.3 SR 3.3.2.6 2 536°F 1,2(~), 3(c) 2 per steam D

SR 3.3.2.1 i 4.5E6 lbhr at l i e SR 3.3.2.3 735 psig SR 3.3.2.6 Refer to Function 1 (Safety Injection) for all initiation fimctions and requirements.

1, 2 q 3(4 2 trains G

SR 3.3.2.2 SR 3.3.2.7 1,2(e) 3 per SG H

SR 3.3.2.1 SR 3.3.2.3 SR 3.3.2.6 NA i 90%

(c) Except when both MSIVs are closed.

(d) Reactor Coolant System (RCS) Tayg 2 520°F (e) Except when all Main Feedwater Regulation Valves (h4FRVs) and MFRV bypass valves are closed and de-activated or isolated by a closed manual valve.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 3.3.2-1 1

ESFAS Instrumentation 3.3.2 Table 3.3.2-1 (page 4 of 4)

Engineered Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE

5.

Feedwater Isolation (continued)

c. Safety Refer to Function 1 (Safety Injection) for ail initiation functions and requirements.

Injection

6.

Auxiliary Feedwater

a. Automatic Actuation Relay Logic

b. Low-LowSG Water Level

c. Safety Injection

d. Undervoltage on 4 kV Buses 11 and 12(21 and 22)(f)

e. Tripofboth Main Feedwater pumps 2 trains J

SR 3.3.2.2 3 per SG D

SR 3.3.2.1 SR 3.3.2.3 SR 3.3.2.6 Refer to Function 1 (Safety Injection) for all initiation functions and requirements.

NA 2 11.3%

192 2 per bus I

SR 3.3.2.4 2 76% rated bus SR 3.3.2.6 voltage SR 3.3.2.4 NA (0

(g)

Start of Turbine Driven Pump only.

This Function may be bypassed during alignment and operation of the AFW System for SG level control.

Prairie Island Units 1 and2 3.3.2-12 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 Prairie Island Technical Specification 3.3.2 Bases (ESFAS Instrumentation) 43 Pages Follow

ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 BASES Engineered Safety Feature Actuation System (ESFAS) Insbxmentation BACKGROUM)

AEC GDC Criterion 15, Engineered Safety Features Protection Systems (Ref. l), requires that protection systems shall be provided for sensing accident situations and initiating the operation of necessary engineered safety features to mitigate accidents.

Accidents are events that are analyzed even though they are not expected to occur during the unit life. One acceptable limit during accidents is that offsite dose shall be maintained within an acceptable fraction of 10 CFR 100 limits. Different accident categories are allowed a different fraction of these limits, based on probability of occurrence. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.

The ESFAS instrumentation is segmented into interconnected portions as described in the USAR (Ref. 2), and as identified below:

1. Field transmitters or process sensors and instsumentation:

provide a measurable electronic signal based on the physical characteristics of the parameter being measured;

2. Signal processing equipment including Reactor Protection Analog System, arranged in protection channel sets: provide signal conditioning, bistable setpoint comparison, bistable electrical signal output to engineered safety features (ESF) relay logic, and control boardkontrol roodmiscellaneous indications; and

3. ESF relay logic system including channelized input and logic:

initiates the proper ESF actuation in accordance with the defmed logic and based on the bistable outputs from the analog protection s ys tem.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-1

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for ESFAS action to prevent exceeding acceptable limits such that the consequences of Design Basis Accidents (DBAs) will be acceptable. The Allowable Value is considered a limiting value such that a channel is OPERABLE if the setpoint is found not to exceed the Allowable Value during the CHANNEL OPERATIONAL TEST (COT). Note that, although a channel is OPERABLE under these circumstances, the ESFAS setpoint must be left adjusted to within the established calibration tolerance band of the ESFAS setpoint in accordance with the uncertainty assumptions stated in the referenced setpoint methodology, (as-left criteria) and confirmed to be operating within the statistical allowances of the uncertainty tenns assigned.

(continued)

Field Transmitters or Sensors To meet the design demands for redundancy and reliability, for the ESFAS Functions, generally two or three field transmitters or sensors are used to measure unit parameters. In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS). To account for calibration tolerances and instrument drift, which are assumed to occur between calibrations, statistical allowances are provided in the Allowable Values. The OPERABILITY of each transmitter or sensor is determined by either as-found calibration data evaluated during the CHANNEL CALIBRATION or by qualitative assessment of field transmitter or sensor, as related to channel behavior observed during performance of the CHANNEL CHECK.

Reactor Protection Analog System Generally, for ESFAS Functions, two or three channels of instrumentation are used for the signal processing of unit parameters measured by the field instruments. The instrument channels provide Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-2

ESFAS Instrumentation B 3.3.2 BASES BACKGROUM)

Reactor Protection Analog System (continued) signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints that are based on safety analyses (Ref. 3). If the measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable actuates logic input relays. Channel separation is described in Reference 2.

Generally, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial Function trip, the Function will still operate with a two-out-of-two logic. If one channel fails such that a partial Function trip occurs, a trip will not occur and the Function will still operate with a one-out-of-two logic.

Therefore, a single failure will neither cause nor prevent the protection function actuation. The actual number of channels required for each unit parameter is specified in Reference 2.

Allowable Values and ESFAS Setpoints The trip setpoints used in the bistables are based on the analytical limits from Reference, 3. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those ESFAS channels that must function in harsh environments as defined by 10 CFR 50.49, the Allowable Values specified in Table 3.3.2-1 in the accompanying LCO are conservative with respect to the analytical limits. A detailed description of the methodology used to calculate the Allowable Value and ESFAS setpoints, including their explicit uncertainties, is provided in the plant specific setpoint methodology study (Ref. 4) which incorporates all the known uncertainties applicable to each channel. The magnitudes of these uncertainties are factored into the Prairie Island Units 1 and2 B 3.3.2-3 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES BACKGROUM>

Allowable Values and ESFAS Setpoints (continued) determination of each ESFAS setpoint and corresponding Allowable Value. The nominal ESFAS setpoint entered into the bistable is more conservative than that specified by the Allowable Value to account for measurement errors detectable by a COT. One example of such a change in measurement error is drift during the surveillance interval. If the measured setpoint does not exceed the Allowable Value, the ESFAS Function is considered OPERABLE.

The ESFAS setpoints are the values at which the bistables are set and is the expected value to be achieved during calibration. The ESFAS setpoint value ensures the safety analysis limits are met for the surveillance interval selected when a channel is adjusted based on stated channel uncertainties. Any bistable is considered to be properly adjusted when the as-left setpoint value is within the band for CHANNEL CALIBRATION uncertainty allowance @e.

calibration tolerance uncertainties).

Setpoints adjusted consistent with the requirements of the Allowable Value ensure that the consequences of DBAs will be acceptable, providing the unit is operated from within the LCOs at the onset of the DBA and the equipment functions as designed.

Each channel can be tested on line to verify that the signal processing equipment and setpoint accuracy is within the specified allowance requirements of Reference 4. Once a designated channel is taken out of service for testing, a simulated signal is injected in place of the field instrument signal. The process equipment for the channel in test is then tested, verified, and calibrated. SRs for the channels are specified in the SR section.

ESF Relay Logic System The relay logic equipment uses outputs from the analog bistables.

To meet the redundancy requirements, two trains of relay logic, each Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-4

ESFAS Instrumentation B 3.3.2 BASES BACKGROUND ESF Relay Logic System (continued) performing the same hctions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide ESF actuation for the unit. Each train is packaged in its own set of cabinets for physical and electrical separation to satisfy separation and independence requirements.

The ESF relay logic system performs the decision logic for most ESF equipment actuation; generates the electrical output signals that initiate the required actuation; and provides the status, permissive, and annunciator output signals to the main control room of the unit.

The relay logic consists of input, master and slave relays. The bistable outputs are combined via the input relays into logic matrices that represent combinations indicative of various transients. If a required logic matrix combination is completed, the appropriate master and slave relays are energized. The master and slave relays cause actuation of those components whose aggregate Function best serves to alleviate the condition and restore the unit to a safe condition. Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections of this Bases.

Each relay logic train has built in test features that allow testing the decision logic matrix.and some master and slave relay functions while the unit is at power. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.

APPHCABLE SAFETY

ANALYSES, A P P u c A l 3 m Each of the analyzed accidents can be detected by one or more ESFAS Functions. One of the ESFAS Functions is the primary actuation signal for that accident. An ESFAS Function may be the primary actuation signal for more than one type of accident.

An ESFAS Function may also be a secondary, or backup, actuation signal for one or more other accidents. For example, Pressurizer Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-5

ESFAS Instrumentation B 3.3.2 BASES APPUCABLE SAFETY

ANALYSES, m

9 4

APPUCABIUTY Low Pressure is a primary actuation signal for loss of coolant accidents (LOCAs) and a backup actuation signal for steam line breaks (SLBs) inside containment. Functions such as manual initiation, not specifically credited in the safety analysis, are qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the unit. These Functions may provide protection for conditions that do not require dynamic transient analysis to demonstrate Function performance. These Functions may also serve as backups to Functions that were credited in the accident analysis (Ref. 3).

(continued)

Prairie Island Units 1 and2 The LCO requires all instrumentation pedorming an ESFAS Function to be OPERABLE. A channel is OPERABLE with a trip setpoint outside its calibration tolerance band provided the trip setpoint as-found value does not exceed its associated Allowable Value and provided the trip setpoint as-left value is adjusted to within the calibration tolerance band. Failure of any instrument renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.

The LCO generally requires OPERABILITY of two or three channels in each instrumentation function and two channels in each logic and manual initiation function. The two-out-of-three configuration allows one channel to be tripped during maintenance or testing without causing an ESFAS initiation. Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.

The required channels of ESFAS instrumentation provide unit protection in the event of any of the analyzed accidents. ESFAS protection functions are as follows:

1. Safety Iniection Safety Injection (SI) provides two primary functions:

Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-6

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE

1. Safetv Iniection (continued) sAFEI*y

ANALYSES,

1. Primary side water addition to ensure maintenance or Lc*Io,d recovery of reactor vessel water level (coverage of the APPUCABrn active fuel for heat removal, clad integrity, and for limiting peak clad temperature to 2200 O F ) ; and

2. Boration to ensure recovery and maintenance of SDM.

These functions are necessary to mitigate the effects of a LOCA or SLB, both inside and outside of containment. The SI signal is also used to initiate other fknctions such as:

Containment Isolation; Containment Ventilation Isolation; Reactor Trip; Feedwater Isolation; Auxiliary Feedwater (AFW); and Control room ventilation isolation.

These other functions ensure:

Isolation of nonessential systems through containment penetrations; Trip of the reactor to limit power generation; Isolation of main feedwater to limit secondary side mass contribution to containment pressurization; Start of AFW to ensure secondary side cooling capability; Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-7

ESFAS Instrumentation B 3.3.2 BASES APPUCAEEE

1. Safety Iniection (continued) sAFEI"y A;NALysE, Isolation of the control room to ensure habitability.

D,&

APPLICAl3Ul-Y

a. Safety Injection-Manual Initiation The LCO requires two channels to be OPERABLE. The operator can initiate SI at any time by using either of two switches in the control room. This action will cause actuation of all components in the same manner as any of the automatic actuation signals.

The LCO for the Manual Initiation Function ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual ESFAS initiation capability.

Each channel consists of one switch and the interconnecting wiring to the actuation logic cabinet. Each switch actuates both trains. This configuration does not allow testing at power. The Applicability of the SI Manual Initiation Function is discussed with the Automatic Actuation Relay Logic Function below.

b. Safety Iniection-Automatic Actuation Relay Logic This LCO requires two trains to be OPERABLE. The SI actuation logic consists of all circuitry housed within the ESF relay logic cabinets for the SI actuation subsystem, including the initiating relay contacts responsible for actuating the ESF equipment.

Manual and automatic initiation of SI must be OPERABLE in MODES 1,2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-8

ESFAS Instrumentation B 3.3.2 BASES APPUCAr3U

b. Safety Injection-Automatic Actuation Relay Logic sAFEL"y (continued)

ANALYSES, APPLICrnW Manual Initiation is also required in MODE 4 even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual actuation switches.

Automatic actuation relay logic must be OPERABLE in MODE 4 to support system level manual initiation.

These Functions are not required to be OPERABLE in MODES 5 and 6 because there is adequate time for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. Unit pressure and temperature are very low and many ESF components are administratively locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of unit systems.

c. Safety Inj ection-High Containment Pressure This signal provides protection against the following accidents:

SLB inside containment; and LOCA.

Three OPERABLE channels are sufficient to satisfy protective requirements with a two-out-of-three logic. The transmitters and electronics are located outside of Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-9

ESFAS Instrumentation B 3.3.2 BASES APPUCABLE

c.

Safety Injection-High Containment Pressure sAFEI"y (continued)

Lco, and APPUCABEJTY

ANALYSES, containment with the sensing line located inside containment. Thus, the high pressure Function will not experience any adverse environmental conditions and the Allowable Value reflects only steady state instrument uncertainties.

High Containment Pressure must be OPERABLE in MODES 1 2, and 3 when there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. In MODES 4,5, and 6, plant conditions are such that the probability of an event requiring Emergency Core Cooling System (ECCS) injection is extremely low. In MODE 4, adequate time is available to manually actuate required components in the event of a DBA.

d. Safety Injection-Pressurizer Low Pressure This signal provides protection against the following accidents:

Inadvertent opening of a steam generator (SG) relief or safety valve; SLB; Rupture of a control rod drive mechanism housing (rod ejection);

Inadvertent opening of a pressurizer relief or safety valve; Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-10

ESFAS Instrumentation B 3.3.2 BASES APPLJCrnLE

d. Safety Injection-Pressurizer Low Pressure SAFETY (continued)

ANALYSES, Lco,d LOCAs; and APPLICABILITY SG Tube Rupture.

Pressurizer pressure provides both control and protection hctions: input to the pressurizer pressure control system, reactor trip, and SI. However, two independent Power Operated Relief Valve (PORV) open signals must be present before a PORV can open. Therefore, a single pressure channel failing high will not fail a PORV open and trigger a depressurization event, which may then require SI actuation. Thus, three OPERABLE channels are sufficient to satisfy the protective requirements with a two-out-of-three logic.

The transmitters are located inside containment, with the taps in the vapor space region of the pressurizer, and thus possibly experiencing adverse environmental conditions (LOCA, SLB inside containment, rod ejection). Therefore, the Allowable Value reflects the inclusion of both steady state and adverse environmental instrument uncertainties.

This Function must be OPERABLE in MODES 1,2, and 3 with pressurizer pressure 2 2000 psig to mitigate the consequences of a LOCA. This signal may be manually blocked by the operator when pressurizer pressure is

< 2000 psig. Automatic SI actuation below this pressure setpoint is then performed by the High Containment Pressure signal.

This Function is not required to be OPERABLE in MODE 3 when pressurizer pressure is < 2000 psig. Other ESF Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-1 1

ESFAS Instrumentation B 3.3.2 BASES APPLICAELE

d. Safetv Iniection-Pressurizer Low Pressure SAFETY (continued)

==,

L a

d APPLICf4BILn-Y functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4,5, and 6, this Function is not needed for accident detection and mitigation.

e.

Safety Iniection-Steam Line Low Pressure Steam Line Low Pressure provides protection against the following accidents:

SLB; Feed line break; and Inadvertent opening of an SG safety valve.

Steam line pressure transmitters provide input to control functions, but the control function cannot initiate events that the Function acts to mitigate. Thus, three OPERABLE channels on each steam line are sufficient to satisfy the protective requirements with a two-out-of-three logic on each steam line.

With the transmitters typically located in the vicinity of the main steam lines, it is possible for them to experience adverse environmental conditions during a secondary side break. Therefore, the Allowable Value reflects both steady state and adverse environmental instrument uncertainties.

This Function is anticipatory in nature and has a typical leaflag ratio of 12/2.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-12

ESFAS Instrumentation B 3.3.2 BASES APPUCAE3r-E

e. Safety Iniection-Steam Line Low Pressure SAFETY (continued)

ANKYSES, L a a n d APPLICABLTTY Steam Line Low Pressure must be OPERABLE in MODES 1, 2, and 3 with pressurizer pressure 2 2000 psig, when a secondary side break or stuck open safety valve could result in the rapid depressurization of the steam lines. This signal may be manually blocked by the operator when pressurizer pressure is 2000 psig. When pressurizer pressure is 2000 psig, feed line break is not a concern.

This Function is not required to be OPERABLE in MODE 4,5, or 6 because there is insufficient energy in the secondary side of the unit to cause an accident.

2. Containment Spray Containment Spray (CS) provides three primary functions:

1. Lowers containment pressure and temperature after a LOCA or SLB in containment;

2. Reduces the amount of radioactive iodine in the containment atmosphere; and

3. Adjusts the pH of the water in the containment sump after a large break LOCA.

These functions are necessary to:

Ensure the pressure boundary integrity of the containment structure; Limit the release of radioactive iodine to the environment in the event of a failure of the containment structure; and Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-13

ESFAS Instrumentation B 3-3.2 BASES APPIJcABL;E

2. Containment Spray (continued)

SAFETY

ANALYSES, Minimize corrosion of the components and systems Lco,a APPLEABrn inside containment following a LOCA.

The CS actuation signal starts the CS pumps and aligns the discharge of the pumps to the CS nozzle headers in the upper levels of containment. Water is initially drawn fiom the RWST by the CS pumps and mixed with a sodium hydroxide solution fiom the spray additive tank. Containment spray is actuated manually or by High High Containment Pressure.

a.

Containment Spray-Manual Initiation Prairie Island Units 1 and2 The LCO requires two channels to be OPERABLE. The operator can initiate CS at any time from the control room by simultaneously turning two CS actuation switches.

Because an inadvertent actuation of CS could have such serious consequences, two switches must be turned simultaneously to initiate both trains of CS. The inoperability of either switch may fail both trains of manual initiation.

Each channel consists of one switch and the interconnecting wiring to the actuation logic cabinets. The Applicability of the CS Manual Initiation Function is discussed with the Automatic Actuation Relay Logic Function below. Note that manual initiation of CS also actuates containment ventilation isolation.

b. Containment Spray-Automatic Actuation Relay Lonic The CS actuation logic consists of all circuitry housed within the ESF relay logic cabinets for the CS actuation subsystem, in the same manner as described for ESFAS Function 1.b.

B 3.3.2-14 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE

b. Containment Spray-Automatic Actuation Relay Lopic SAFErY (continued)

ANALYSES, Manual and automatic initiation of CS must be OPERABLE in MODES 1,2, and 3 when there is a potential for an accident to occur, and sufficient energy in the primary or secondary systems to pose a threat to containment integrity due to overpressure conditions. Manual initiation is also required in MODE 4, even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of a DBA by the use of the manual actuation switches.

Automatic actuation relay logic must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary and Secondary systems to result in containment overpressure. In MODES 5 and 6, there is also adequate time for the operators to evaluate unit conditions and respond, to mitigate the consequences of abnormal conditions by manually starting individual components.

APPLICABrn

c. Containment Spray-High High Containment Pressure This signal provides protection against a LOCA or an SLB inside containment. The transmitters and electronics are located outside of containment with the sensing lines located inside containment. Thus, they will not experience any adverse environmental conditions and the Allowable Value reflects only steady state instrument uncertainties.

This is one of the only Functions that requires the bistable output to energize to perform its required action. It is not desirable to have a loss of power actuate CS, since the consequences of an inadvertent actuation of CS could be serious.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-15

ESFAS Instrumentation B 3.3.2 BASES APPUCABLE

c. Containment Spray-High High Containment Pressure SAFETY (continued) fWALdYSEs, L

a d

A P P U C r n r n High High Containment Pressure uses three sets of two channels, each set combined in a one-out-of-two configuration, with these outputs combined so that three sets tripped initiates CS. This arrangement exceeds the minimum redundancy requirements. High High Containment Pressure must be OPERABLE in MODES 1, 2, and 3 when there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break. In MODES 4,5, and 6, there is insufficient energy in the primary and secondary sides to overpressurize containment.

3. Containment Isolation Containment Isolation (CI) provides isolation of the containment atmosphere, and process systems that penetrate containment, from the environment. This Function is necessary to prevent or limit the release of radioactivity to the environment in the event of a LOCA.

The CI signal isolates all automatically isolable process lines except instrument air and main steam lines, which require a steam line isolation signal.

a. Containment Isolation-Manual Initiation Manual CI is actuated by either of two switches in the control room. Either switch actuates both trains. Note that manual initiation of CI also actuates Containment Ventilation Isolation.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-16

ESFAS Instrumentation B 3.3.2 BASES APPLKXBLE

a. Containment Isolation-Manual Initiation (continued)

SAFETY

ANALYSES, D,&

APPUCABIIJllY The LCO requires two channels to be OPERABLE. Each channel consists of one switch and the interconnecting wiring to the actuation logic cabinets. The Applicability of the CI Manual Initiation Function is discussed with the Automatic Actuation Relay Logic Function below.

b. Containment Isolation - Automatic Actuation Relay Lonic The CI actuation logic consists of all circuitry housed within the ESF relay logic cabinets for the CI actuation subsystem in the same manner as described for ESFAS Function 1.b.

Manual and automatic initiation of CI must be OPERABLE in MODES 1,2, and 3, when there is a potential for an accident to occur. Manual initiation is also required in MODE 4 even though automatic actuation is not required.

In this MODE, adequate time is available to manually actuate required components in the event of a DBA, but because of the large number of components actuated on a CI, actuation is simplified by the use of the manual actuation switches.

Automatic actuation relay logic must be OPERABLE in MODE 4 to support system manual initiation. In MODES 5 and 6, there is insufficient energy in the primary or secondary systems, in the event of a line break, to pressurize the containment to require CI. There is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-17

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE sp;FETy'

ANALYSES, L a a n d A P P U C r n r n (continued)

4.

c.

Containment Isolation - Safety Injection Containment Isolation is initiated by all Functions that initiate SI via the SI signal. The CI requirements for these Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating Functions and requirements.

Steam Line Isolation Isolation of the main steam lines provides protection in the event of an SLB inside or outside containment. Rapid isolation of the steam lines will limit the steam break accident to the blowdown from one SG, at most. For an SLB upstream of the main steam isolation valves (MSNs), inside or outside of containment, closure of the non-return check valves or the MSIVs limits the accident to the blowdown from only the affected SG. For an SLB downstream of the MSIVs, closure of the MSNs terminates the accident.

a. Steam Line Isolation - Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two switches in the control room, one for each MSIV. The LCO requires one channel per loop to be OPERABLE.

b.

Steam Line Isolation - Automatic Actuation Relay Logic The steam line isolation actuation logic consists of all circuitry housed within the ESF relay logic cabinets for the steam line isolation subsystem in the same manner as described for ESFAS Function 1.b.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-18

ESFAS Instrumentation B 3.3.2 BASES i

APPLICAJ3I.E

4. Steam Line Isolation (continued)

SAFETY

ANALYSE, Lco,d APPL4ICAJ3rn Manual and automatic initiation of steam line isolation must be OPERABLE in MODES 1,2, and 3 when there is sufficient energy in the RCS and SGs to have an SLB. This could result in the release of significant quantities of energy and cause a cooldown of the primary system. The Steam Line Isolation Function is required in MODES 2 and 3 unless both MSIVs are closed. In MODES 4,5, and 6, there is insufficient energy in the RCS and SGs to experience an SLB releasing significant quantities of energy.

c. Steam Line Isolation - High High Containment Pressure This Function actuates closure of the MSIVs in the event of a LOCA or an SLB inside containment to maintain at least one unfaulted SG as a heat sink for the reactor. Three OPERABLE channels are sufficient to satisfy protective requirements with two-out-of-three logic. The transmitters and electronics are located outside containment with the sensing line located inside containment. Thus, they will not experience any adverse environmental conditions, and the Allowable Value reflects only steady state instrument uncertainties..

Prairie Island Units 1 and2 High High Containment Pressure must be OPERABLE in MODES 1,2, and 3, when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection and closure of the MSIVs. The Steam Line Isolation Function remains OPERABLE in MODES 2 and 3 unless both MSIVs are closed. In MODES 4,5, and 6, there Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-19

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE

c.

Steam Line Isolation-High High Containment Pressure SAFETY (continued)

ANALYSES, LCO, and APPLICAE3rn over pressurize containment.

is not enough energy in the primary and secondary sides to

d. Steam Line Isolation-High Steam Flow Coincident With Safety Injection and Coincident With Low Low T%

This Function provides closure of the MSIVs during an SLB or inadvertent opening of an SG safety valve to maintain at least one unfaulted SG as a heat sink for the reactor.

Two steam line flow channels per steam line are required OPERABLE for this Function. These are combined in a one-out-of-two logic to indicate high steam flow in one steam line. The steam flow transmitters provide control inputs, but the control function cannot cause the events that the function must protect against. Therefore, two channels are sufficient to satisfy redundancy requirements. The one-out-of-two configuration allows online testing because trip of one high steam flow channel is not sufficient to cause initiation.

The High Steam Flow Allowable Value is a AP corresponding to 5 9.18E5 l b h at 1005 psig.

The main steam line isolates if the High Steam Flow signal occurs coincident with an SI signal and Low Low RCS average temperature. The Main Steam Line Isolation Function requirements for the SI Functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3 1. Instead, Function 1 SI, is referenced for all initiating functions and requirements.

Prairie Island Units 1 and 2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-20

ESFAS Instrumentation B 3.3.2 BASES APPUCAI3E

d. Steam Line Isolation-High Steam Flow Coincident With SAFEI"y

ANALYSES, (continued)

APPUCABrn Safety Injection and Coincident With Low Low Tu m,d Two channels of Tavg per loop are required to be OPERABLE. The Tavg channels are combined in a logic such that two channels tripped cause a trip for the parameter. The accidents that this Function protects against cause reduction of Tavg in the entire primary system.

Therefore, the provision of two OPERABLE channels per loop in a two-out-of-four configuration ensures no single random failure disables the Low Low Tavg Function. The Tavg channels provide control inputs, but the control mitigate. Therefore, additional channels are not required to address control protection interaction issues.

. hnction cannot initiate events that the Function acts to With the Tavg resistance temperature detectors (RTDs) located inside the containment, it is possible for them to experience adverse environmental conditions during an SLB event. Therefore, the Allowable Value reflects both steady state and adverse environmental instrumental uncertainties.

This Function must be OPERABLE in MODES 1 and 2, and in MODE 3, when Tavg is above 520"F, when a secondary side break or stuck open valve could result in rapid depressurization of the steam lines. The Steam Line Isolation Function is required to be OPERABLE in MODES 2 and 3 unless both MSIVs are closed. This Function is not required to be OPERABLE in MODES 4,5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-21

ESFAS Instrumentation B 3.3.2 BASES APPJXABLE SAFE17r'

ANALYSES,

e. Steam Line Isolation-High Hiph Steam Flow Coincident With Safety hiection KO, and APPUCABrn This Function provides closure of the MSIVs during a SLB to maintain at least one unfaulted SG as a heat sink for the (continued) reactor.

Two steam line flow channels per steam line are required to be OPERABLE for this Function. These are combined in a one-out-of-two logic to indicate high steam flow in one steam line. The steam flow transmitters provide control inputs, but the control function cannot cause the events that the Function must protect against. Therefore, two channels are sufficient to satisfy redundancy requirements.

The Allowable Value for High High Steam Flow is a AI?

corresponding to I 4.5E6 l b h at 735 pig.

With the transmitters located inside containment, it is possible for them to experience adverse environmental conditions during an SLB event. Therefore, the Allowable Value reflects both steady state and adverse environmental instrument uncertainties.

The main steam lines isolate if the High High Steam Flow signal occurs coincident with an SI signal. The Main Steam Line Isolation Function requirements for the SI Functions are the same as the requirements for their SI function.

Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.

Prairie Island Units 1 and2 B 3.3.2-22 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICAI3LE

e.

Steam Line Isolation-High High Steam Flow sAFEI"y Coincident With Safety Iniection (continued)

ANALYSESy This Function must be OPERABLE in MODES 1,2, and 3 when a secondary side break could result in rapid depressurization of the steam lines unless both MSIVs are closed. This Function is not required to be OPERABLE in MODES 4,5, and 6 because there is insufficient energy in the secondary side of the unit to have an accident.

APPLJICABrn

5. Feedwater Isolation Prairie Island Units 1 and2 The primary function of the Feedwater Isolation signal is to limit containment pressurization during an SLB. This Function also mitigates the effects of a high water level in the SGs, which could result in carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is due to excessive feedwater flows.

The Function performs the following:

Trips the main turbine; Trips the main feedwater (MFW) pumps; and Shuts the MFW regulating valves (MFRVs) and the MFRV bypass valves.

Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-23

ESFAS Instrumentation B 3.3.2 BASES NPLfICA3LE

5. Feedwater Isolation (continued) sAFEI"y

ANALYSES, L Q d APPLICABILrlY This Function is actuated by High High SG Water Level, or by an SI signal. In the event of SI, the unit is taken off line. The MFW System is also taken out of operation and the M W System is automatically started. The SI signal was discussed previously.

a. Feedwater Isolation-Automatic Actuation Relay Logic The feedwater isolation actuation logic consists of all circuitry housed within the ESF relay logic cabinets for the feedwater isolation subsystem, in the same manner as described for ESFAS Function 1.b.

This Function must be OPERABLE in MODES 1,2, and 3, except when all MFRVs and associated bypass valves are closed and de-activated or isolated by a closed manual valve, when a secondary side break could result in significant containment pressurization. 'This Function is not required to be OPERABLE in MODES 4,5, and 6 because there is insufficient energy in the secondary side of the unit to cause an accident.

b. Feedwater Isolation-High High Steam Generator Water Level This signal provides protection against excessive feedwater flow. The SG water level instruments provide input to the Feedwater Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation. Median signal selection Prairie Island Units 1 and2 B 3.3.2-24 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPUCABLE

b. Feedwater Isolation-High High Steam Generator SAFETY Water Level (continued)

ANAL.YSESy LCO, and APPUCABW is used in the Feedwater Control System. Thus, three OPERABLE channels are sufficient to satisfy the requirements with a two-out-of-three logic. The transmitters (d/p cells) are located inside containment.

However, the events that this Function protects against cannot cause a severe environment in containment.

Therefore, the Allowable Value reflects only steady state instrument uncertainties.

This Function must be OPERABLE in MODES 1 and 2, except when all MFRVs and associated bypass valves ire closed and de-activated or isolated by a closed manual valve. In MODES 3,4,5, and 6, the MFW System and the turbine generator are normally not in service and this Function is not required to be OPERABLE.

c. Feedwater Isolation-Safety Injection Feedwater Isolation is also initiated by all Functions that initiate SI via. the SI signal. The Feedwater Isolation Function requirements for these Functions are the same as the requirements for their SI Function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead Function 1, SI, is referenced for all initiating functions and requirements.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-25

ESFAS Instrumentation B 3.3.2 BASES APPLICfBLE

6.

Auxiliary Feedwater SAFETY

ANALYSES, Lc0,d APPLICAE3rn The AFW System is designed to provide a secondary side heat sink for the reactor in the event that the MFW System is not available. The system has a motor driven pump and a turbine driven pump, making it available during normal unit operation, during a loss of AC power, a loss of MFW, and during a Feedwater System pipe break. The normal source of water for the AFW System is the condensate storage tank (CST) (not safety related). Upon low level in the CST, the operators can manually realign the pump suctions to the Cooling Water (CL) System (safety related). The AFW System is aligned so that upon a pump start, flow is initiated to the SGs immediately.

(continued)

a. Auxiliary Feedwater-Automatic Actuation Relay Logic The auxiliary feedwater actuation logic consists of all circuitry housed within the reactor protection relay logic cabinets for the auxiliary feedwater actuation subsystem.

b. Auxiliary Feedwater-Low Low Steam Generator Water Level Low Low SG Water Level provides protection against a loss of heat sink. A feed line break, inside or outside of containment, or a loss of MFW, would result in a loss of SG water level. The SG water level instruments provide input to the Feedwater Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system, which may then require a protection function actuation, and a single failure in the other channels Prairie Island Units 1 and2

~

Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-26

ESFAS Instrumentation B 3.3.2 BASES APPLICBLE

b. Auxiliaq Feedwater-Low Low Steam Generator Water SAFETY Level ANAL,YSE, m,d APPLICABrn providing the protection function actuation. Median signal selection is used in the Feedwater Control System.

Thus, three OPERABLE channels per SG are sufficient to satisfy the requirements with a two-out-of-three logic.

(continued)

With the transmitters (d/p cells) located inside containment and thus possibly experiencing adverse environmental conditions (feed line break), the Allowable Value reflects the inclusion of both steady state and adverse environmental instrument uncertainties.

c. Auxiliary Feedwater-Safety Iniection An SI signal starts the motor driven and turbine driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI Function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.

Functions 6.a.through 6.c must be OPERABLE in MODES 1,2, and 3 to ensure that the SGs remain the heat sink for the reactor. Low Low SG Water Level in any operating SG will cause the AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs.as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-27

ESFAS Instrumentation B 3.3.2 BASES APPUCAl3LE

d.

Auxiliary Feedwater-Undervoltage on 4kV Buses SAFEIY

ANALYSES, 11 and 12 (21 and22)

A loss of power on the buses that provide power to the MFW pumps provides indication of a pending loss of MFW flow. The undervoltage Function senses the voltage upstream of each MFW pump breaker. A loss of power for both MFW pumps will start the turbine driven AFW pump to ensure that at least one SG contains enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip.

Al?PLK.XBILUY (continued)

e. Auxiliary Feedwater-Trip of Both Main Feedwater Pumps A trip of both MFW pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure. Motor driven MFW pumps are equipped with a breaker position sensing device.

An open supply breaker indicates that the MFW pump is not running. Two-OPERABLE channels per AFW pump provide a start signal to each AFW pump in two-out-of-two taken once logic. A trip of both MFW pumps starts the motor driven.and turbine driven AFW pumps to ensure that at least one SG is available with water to act as the heat sink for the reactor.

Functions 6.d and 6.e must be OPERABLE in MODES 1 and 2.

This ensures that at least one SG is provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident. In MODES 3,4, and 5, the MFW pumps may be normally shut down, and thus neither the pump Prairie Island Units 1 and2 B 3.3.2-28 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE

6.

Auxiliary Feedwater (continued)

SAFETY ANALYSES LCO, and A P P U C r n r n trip or bus undervoltage are indicative of a condition requiring automatic AFW initiation. Also, in MODE 2 the AFW system may be used for SG level control. The MFW trip is bypassed by placing the AFW pump CS in shutdown auto when AFW is aligned for this purpose. Low low SG level provides protection during this operation.

The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

ACTIONS A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed on Table 3.3.2-1.

In the event a channel's setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, or bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition(s) entered for the protection Function(s) affected. When the Required Channels in Table 3.3.2-1 are specified (e.g., on a per steam line, per loop, per SG, etc., basis), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.

When the number of inoperable channels in a trip hction exceed those specified in one or other related Conditions associated with a trip function, then the unit may be outside the safety analysis.

Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.

A. 1 Condition A applies to all ESFAS protection functions.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-29

ESFAS Instrumentation B 3.3.2 BASES ACTIONS A. 1 (continued)

Condition A addresses the situation where one or more channels or trains for one or more Functions are inoperable at the same time.

The Required Action is to refer to Table 3.3.2-1 and to take the Required Actions for the protection fknctions affected. The Completion Times are those fiom the referenced Conditions and Required Actions.

B.1. B.2.1, and B.2.2 Condition B applies to manual initiation of:

SI; Containment Spray (CS); and 0

Containment Isolation (CI).

This action addresses the train orientation of the ESF relay logic for the functions listed above. If a channel or train is inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is allowed to return it to an OPERABLE status. The specified Completion Time is reasonable considering that there are two automatic actuation trains and another manual initiation channel OPERABLE for each Function (except for CS), and the low probability of an event occurring during this interval. If the channel cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (54 hours6.25e-4 days <br />0.015 hours <br />8.928571e-5 weeks <br />2.0547e-5 months <br /> total time) and in MODE 5 within an additional 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> (84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> total time). The allowable Completion Times are reasonable, based on operating experience, to reach the required unit conditions fi-om full power conditions in an orderly manner and without challenging unit systems.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-30

ESFAS Instrumentation B 3.3.2 BASES ACTIONS C.l, C.2.1, and C.2.2 (continued)

Condition C applies to the automatic actuation relay logic for the following functions:

SI; CS; and CI.

This action addresses the train orientation of the ESF relay logic. If one train is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore the train to OPERABLE status. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. If the train cannot be restored to OPERABLE status, the unit must be placed in a MODE in which the LCO does not apply. This is done by placing the unit in at least MODE 3 within an additional 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (1 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> total time) and in MODE 5 within an additional 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> (42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> total time). The Completion Times are reasonable, based on operating experience, to reach the required unit conditions from hll power conditions in an orderly manner and without challenging unit s ys terns.

The Required Actions are modified by a Note that allows one train to be bypassed for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for surveillance testing, provided the other train is OPERABLE. This allowance is based on the reliability analysis assumption of WCAP-1027 1-P-A (Ref. 5) that 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is the average time required to perform relay logic train surveillance.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-3 1

ESFAS Instrumentation B 3.3.2 BASES ACTIONS D.l, D.2.1, and D.2.2 (continued)

Condition D applies to:

High Containment Pressure; Pressurizer Low Pressure; Steam Line Low Pressure; Steam Line Isolation High High Containment Pressure ;

High Steam Flow Coincident With Safety Injection Coincident With Low Low T,;

High High Steam Flow Coincident With Safety Injection; and Low Low SG Water Level.

If one channel is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore the channel to OPERABLE status or to place it in the tripped condition.

Generally this Condition applies to functions that operate on two-out-of-three logic. Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-three configuration that satisfies redundancy requirements.

Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-32

ESFAS Instrumentation B 3.3.2 BASES ACTIONS D.1, D.2.1, and D.2.2 (continued)

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, these Functions are no longer required OPERABLE.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing of other channels. The 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowed to restore the channel to OPERABLE status or to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> allowed for testing, are justified in Reference 5.

E.l.l. E.1.2, E.2.1. and E.2.2 Condition E applies to CS High High Containment Pressure which is a one-out-of-two channels, three-out-of-three sets logic. Condition E addresses the situation where containment pressure channels are inoperable. With channel(s) tripped, one or more of the three sets may be actuated.

Restoring the channel to OPERABLE status, or placing the other inoperable channel in the trip condition and verifying one channel in each pair remains OPERABLE within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, is sufficient to assure that the Function remains OPERABLE. The Completion Time is further justified based on the low probability of an event occurring during this interval. Failure to restore the inoperable channel(s) to OPERABLE status, or place it in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, requires the unit be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-33

ESFAS Instrumentation B 3.3.2 BASES ACTIONS E.l.l, E.1.2, E.2.1, and E.2.2 (continued)

Completion Times are reasonable, based on operating experience, to reach the required unit conditions fiom full power conditions in an orderly manner and without challenging unit systems. In MODE 4, this Function is a no longer required OPERABLE.

The Required Actions are modified by a Note that allows one channel to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing.

Placing a channel in the bypass condition for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for testing purposes is acceptable based on the results of Reference 5.

F.l, F.2.1, and F.2.2 Condition F applies to Manual Initiation of Steam Line Isolation. If a train or channel is inoperable, 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> are allowed to return it to OPERABLE status. The specified Completion Time is reasonable considering the nature of this Function and the low probability of an event occurring during this interval. If the Function cannot be returned to OPERABLE status, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions Erom full power in an orderly manner and without challenging unit systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of the protection functions noted above.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-34

ESFAS Instrumentation B 3.3.2 BASES ACTIONS G.l, G.2.1, and G.2.2 (continued)

Condition G applies to the automatic actuation relay logic for the Steam Line Isolation and Feedwater Isolation Functions. The action addresses the train orientation of the ESF relay logic for these functions. If one train is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore the train to OPERABLE status. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. If the train cannot be returned to OPERABLE status, the unit must be brought to MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. Placing the unit in MODE 4 removes all requirements for OPERABILITY of the actuation function. In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the Functions noted above.

The Required Actions are modified by a Note that allows one train to be bypassed for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for surveillance testing provided the other train is OPERABLE. This allowance is based on the reliability analysis (Ref. 5) assumption that 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is the average time required to perform relay logic train surveillance.

H.l and H.2 Condition H applies to High High SG Water Level.

If one channel is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore one channel to OPERABLE status or to place it in the tripped condition.

If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-two logic will result in actuation.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-35

ESFAS Instrumentation B 3.3.2 BASES ACTIONS H.l and H.2 (continued)

The 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Completion Time is justified in Reference 5. Failure to restore the inoperable channel to OPERABLE status or place it in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, this Function is no longer required OPERABLE.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing of other channels. The.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowed to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> allowed for a second channel to be in the bypassed condition for testing, are justified in Reference 5.

1.1 and 1.2 Condition I applies to Undervoltage on Buses 1 1 and 12 (21 and 22).

If one or both channel(s) on one bus is inoperable, 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> are allowed to restore the channel(s) to OPERABLE status or to place it in the tripped condition. If placed in the tripped condition, the Function is then in a partial trip condition where one-out-of-two channels on the other bus will result in actuation. The 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Completion Time is justified in Reference 5. Failure to restore the inoperable channel(s) to OPERABLE status or place it in the tripped Prairie Island Units 1 and 2

~~

Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-36

ESFAS Instrumentation B 3.3.2 BASES ACTIONS 1.1 and 1.2 (continued) condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> requires the unit to be placed in MODE 3 within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, this Function is no longer required OPERABLE.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing of other channels. The 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowed to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> allowed for a second channel to be in the-bypassed condition for testing, are justified in Reference 5.

J.l and K.l Conditions J and K apply to the AFW automatic actuation relay logic function and to the AFW pump start on trip of both MFW pumps function.

The OPERABILITY of the AFW System must be assured by allowing automatic start of the AFW System pumps. If a logic train or channel is inoperable, the applicable Condition(s) and Required Action(s) of LCO 3.7.5, Auxiliary Feedwater (AFW) System, are entered for the associated AFW Train or pump.

Required Action J. 1 is modified by a note that allows placing a train in the bypass condition for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for surveillance testing provided the other train is OPERABLE. This is necessary to allow testing reactor trip system logic which is in the same cabinet with AFW logic. This is acceptable since the other AFW system train is OPERABLE and the probability for an event requiring AFW during this time is low.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-37

ESFAS Instrumentation B 3.3.2 BASES (continued)

SURVEILLANCE REQUIREMENIS column of Table 3.3.2-1.

The SRs for each ESFAS Function are identified by the SRs A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS Functions.

Note that each channel of reactor protection analog system supplies both trains of the ESFAS. When testing Channel I, Train A and Train B must be examined. Similarly, Train A and Train B must be examined when testing Channel 11, Channel 111, and Channel IV (if applicable). The CHANNEL CALIBRATION and COTS are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.

Prairie Island Units 1 and2 SR 3.3.2.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations.between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-3 8

ESFAS Instrumentation B 3.3.2 BASES (continued)

SURVEILLANCE SR 3.3.2.1 (continued)

REQUIREMENTS indication and reliability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.2.2 SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST.

The ESF relay logic is tested every 3 1 days on a STAGGERED TEST BASIS. The train being tested is placed in the test condition) thus preventing inadvertent actuation. All possible logic combinations are tested for each ESFAS function. The test includes actuation of master and slave relays whose contact outputs remain within the relay logic. The test condition inhibits actuation of the master and slave relays whose contact outputs provide direct ESF equipment actuation. Where the relays are not actuated) the test circuitry provides a continuity check of the relay coil. This verifies that the logic is OPERABLE and that there is a signal path to the output relay coils.

Functions which do not test the master and slave relays with the logic specify separate master and slave relay tests in Table 3.3.2-1.

The Frequency of every 3 1 days on a STAGGERED TEST BASIS is adequate. It is based on industry operating experience, considering instrument reliability and operating history data.

Prairie Island Units 1 and2 B 3.3.2-39 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

ESFAS Instrumentation B 3.3.2 BASES (continued) suRvEIL;LANcE SR 3.3.2.3 w-(continued)

SR 3.3.2.3 is the performance of a COT.

A COT is performed on each required channel to ensure the entire channel will perform the intended Function. Setpoints must be found within the Allowable Values specified in Table 3.3.2-1. A successful test of the required contact(s) of a channel (logic input) relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL, TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The difference between the current as-found values and the previous test as-left values must be consistent with the drift allowance used in the setpoint methodology. The setpoint shall be left set consistent with the assumptions of the current unit specific setpoint methodology.

The as-found and as-left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis (Ref. 5) when applicable.

The Frequency of 92 days is justified in Reference 5.

SR 3.3.2.4 SR 3.3.2.4 is the performance of a TADOT. This SR is a check of the following ESFAS Instrumentation Functions:

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-40

ESFAS Instrumentation B 3.3.2 BASES (continued)

SURVEILLANCE SR 3.3.2.4 (continued)

REQulREMENTs

1. CS Manual Initiation;

2. CI Manual Initiation;

3. Manual isolation of the steam lines;

4. AFW pump start on Undervoltage on Buses 11 and 12 (21 and 22); and

5. AFW pump start on trip of both MFW pumps.

This SR is performed every 24 months. A successful test of the required contact(s) of a channel (logic input) relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Frequency is adequate, based on industry operating experience and is consistent with the typical refueling cycle. The SR is modified by a Note that excludes verification of setpoints during the TADOT. The Functions, except the undervoltage start of the AFW pumps, have no associated setpoints. For the undervoltage start of the AFW pumps, setpoint verification is covered by other SRs.

SR 3.3.2.5 This SR is the performance of a TADOT to check the Safety Injection Manual Initiation Function. It is performed every 24 months on a STAGGERED TEST BASIS. The Frequency is adequate, based on industry operating experience and is consistent with a typical refueling cycle.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-41

ESFAS Instrumentation B 3.3.2 BASES (continued)

SURVEILLANCE SR 3.3.2.5 (continued) w-The SR is modified by a Note that excludes verification of setpoints during the TADOT. The manual initiation Function has no associated setpoints.

SR 3.3.2.6 SR 3.3.2.6 is the performance of a CHANNEL CALIBRATION.

A CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to measured parameter within the necessary range and accuracy.

Prairie Island Units 1 and 2 CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology. The difference between the current as-found values and the previous test as-left values must be consistent with the drift allowance used in the setpoint methodology.

The Frequency of 24 months is based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint methodology.

This SR is modified by a Note stating that this test should include verification that the time constants are adjusted to the prescribed values where applicable.

Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-42

ESFAS Instrumentation B 3.3.2 BASES (continued)

S U R.. C E SR 3.3.2.7 REQulREMENTs (continued)

SR 3.3.2.7 is the performance of a MASTER RELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation. This test is performed every 24 months.

SR 3.3.2.8 SR 3.3.2.8 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays. Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is placed in a condition where the relay contact operation can be verified without operation of the equipment. This test is performed every 24 months.

REFERENCES

1. AEC General Design Criteria for Nuclear Power Plant Construction Permits, Criterion 15, issued for comment July 10, 1967, as referenced in USAR Section 1.2.

2. USAR, Section 7.

3. USAR, Section 14.

4. Engineering Manual Section 3.3.4.1, Engineering Design Standard for Instrument SetpointKJncertainty Calculations.

5. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.

Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 B 3.3.2-43 Prairie Island Technical Specification 3.7.5 (AFW System) 5 Pages Follow

i AFW System 3.7.5 3.7 PLANT SYSTEMS 3.7.5 Auxiliary Feedwater (AFW) System LCO 3.7.5 Two AFW trains shall be OPERABLE.

NOTES-------------------------------------

1. AFW train(s) may be considered OPERABLE during alignment and operation for steam generator level control, if it is capable of being manually realigned to the AFW mode of operation.

2. Only the AFW train which includes the motor driven pump is required to be OPERABLE in MODE 4.

APP~CABKJTF MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.

Prairie Island Units 1 and2 3.7.5-1 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

AFW System 3.7.5 CONDITION REQUIRED ACTION I

pump inoperable.

OR

---

NOTE-----------

Only applicable if MODE 2 has not been entered following refueling.

B. OneAFWtrain inoperable in MODE 1,2, One turbine driven AFW pump inoperable in MODE 3 following refueling.

B.l Restore AFW train to OPERABLE status.

I COMPLETION TIME 7 days AND 10 days from discovery of failure to meet the LCO 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> 10 days from liscovery of Failure to meet the JCO Prairie Island Units 1 and2 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149 3.7.5-2

AFW System 3.7.5 REQUIRED ACTION ACTIONS (continued)

COMPLETION TIME CONDITION C.l Be in MODE 3.

AND C.2 Be in MODE 4.

C. Required Action and associated Completion Time for Condition A or B not met.

6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours D. Two AFW trains inoperable in MODE 1,2, or 3.

Initiate action to restore one AFW train to OPERABLE status.

E. Required AFW train inoperable in MODE 4.

Immediately E.1 Initiate action to restore AFW train to OPERABLE Immediately D.1 __----_-_----

NOTE------------

LCO 3.0.3 and all other LCO Required Actions requiring MODE changes are suspended until one AFW train is restored to OPERABLE status.

Prairie Island Units 1 and2 3.7.5-3 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

AFW System 3.7.5 SURVEILLANCE REOUIREMENTS SURVEILLANCE Verify each AFW manual, power operated, and automatic valve in each water flow path, and in both steam supply flow paths to the steam turbine driven pump, that is not locked, sealed, or otherwise secured in position, is in the correct position.

SR 3.7.5.2 NOTE----------------------------

Not required to be performed for the turbine driven AFW pump until prior to exceeding 10% RTP or within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after RCS temperature > 350°F.

Verify the developed head of each AFW pump at the flow test point is greater than or equal to the required developed head.

FREQUENCY 31 days In accordance with the Inservice Testing Program Prairie Island Units 1 and2 3.7.5-4 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149

AFW System 3 -7.5 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE SR 3.7.5.3............................ NOTE----------------------------

AFW train(s) may be considered OPERABLE during alignment and operation for steam generator level control, if it is capable of being manually realigned to the AFW mode of operation.

Verify each AFW automatic valve that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or simulated actuation signal.

SR 3.7.5.4............................ NOTES---------------------------

1. Not required to be performed for the turbine driven AFW pump until prior to exceeding 10% RTP or within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after RCS temperature > 350°F.

2. AFW train(s) may be considered OPERABLE during alignment and operation for steam generator level control, if it is capable of being manually realigned to the AFW mode of operation.

Verify each AFW pump starts automatically on an actual or simulated actuation signal.

FREQUENCY 24 months 24 months Prairie Island Units 1 and2 3.7.5-5 Unit 1 - Amendment No. 158 Unit 2 - Amendment No. 149