Text

Proposed Improved TS Bases Changes & Supporting Info & Final Proposed TS Bases for Section 3.3,including Revised Table of Contents & List of Effective Pages
	ML20199D625
Person / Time
Site:	Zion File:ZionSolutions icon.png
Issue date:	11/10/1997
From:	; COMMONWEALTH EDISON CO.
To:	;
Shared Package
ML20199D615	List: A97062, Suppls Previous Submittals W/Proposed Change to LCO 3.3.1 & 3.3.2,adding Info to Bases to Specifically Identify Refs Used in Determining Allowable Values; ML20199D625;
References
	NUDOCS 9711200378
	Download: ML20199D625 (209)
	v • d • e

.- . - . . . . - . _ _ . . . _ - . . _ . . .-_ . . -. .- . - - - . - . . _ . . . . - .

. - ,t i

t L

t t

t r

b

'I i

)

i I

t 6

I t-1 Ii r

3.

.i i

Zion 113 Changes . BASES 33.1 and 33.2 4

l r

b 1

A. +

t h

.i

'l i

f 5 -

.~

P-

., _. -- . . . . - . , . ,.. ,-# . ~ . - - - , ~ . . ~ .. .. - , - , , , .w., ,.s. ...._.-w~,------~, < - . - , ~ - - . . _ , . - , . . , , - - - . . . . , - - - _ - ~ - - , .. . . - - - . . . . . . ..

RTS Instrumentation B 3.,3.1 I

BASES BACKGROUND Sianal Process Control and Protection System (continued) '

Generally, if a parameter is used for input to the Relay Protection System and a control function, four channels with a two-out-of four logic are sufficient to provide the ;

required relinbility and redundancy. The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Again, a :

single failure will neither cause nor prevent the protection function actuation. These requirements are described in IEEE-279 1963 (Ref. 4). (he actual number of channels required for each unit parameter is specified in Reference 1.

Two logic channels are required to ensure no single random failure of a logic channel will disable the RTS. The logic channels are designed such that testing required while the reactor is at power may be accomplished without causing a trip. Provisions to allow removing logic channels from service during maintenance are unnecessary because of the logic system's designed reliability.

Allowable Values and Trin Setpoints Allowable Values for most RTS functions are derived from the analytical limits contained in the safety analyses.

Allowable Values provide a conservative margin with regards to instrument uncertainties to ensure that SLs are not violated during anticipated operational occurrences and that -

the consequences of DBAs will be acceptable providing the unit is operated from within the LCOs at the onset of the event and required equipment functions as designed. For other RTS functions which do not have anal'tical limits, (functions 3a, 3b, 4, 5, 9, 12, 15, 22a, 22c, 22d and 22e) the Allowable Values are based on a plant specific evaluation of the functional requirement for the instrument channel. A'de t a i l edide ssri pt i dn is fl the~me thodol oyf fu sed i ts i:alcul' ate" Allowable Val _ues!and f Trip;Setpointsiisjprovided;in Refn 5; FoEillt functionsithatihavefas~ Allowable *ValsZsiept Function 22ecTurbine; Impulse Pressure (P 13)Jthe Allowable V,al ue :1 s l ba sed o,n; pl ant - s pec i fi cic al cul at i onsgSpec i fi c (continued)

ZION Units 1 &-2 B 3.3-4 Rev. 00, October, 1997

-- . . . - - ~ _ __

RTS Instrumentation -

B 3.3.1 BASES

~

i 61Eil ationiTthit1roiitdo? A11 oirabW Vil neFfoFeauti ap@cableifunctionijniTab.1el3.3 l}arefas;followsf :

Fskit'tes CaltbletisscNumber ts.Ptb734TStC22c?22d 22$;B2028E-0022 4P22i 22S;B2028E;0026 5 22S;B;028E;0025 6F7 22S;B;004E;0122 8sF86 22S;B;004E;0120 9 22S;B;004E;0119 10 F 10b 22S;B;004E;0121 12 22N;B;024E;0036 13 22N;B;024E;0037 14 22S B;011E;0157

'15 22S;B;011E-0157 225-B OllE-0155 Th.e? Al l owsblJ e Val seloF FunEt16n"22e;

Turbi sE!nipsi si Pressure (P 13)11s based fi Reference 5(

h-either c ue, !!f the measured value of a bistable / contact ,

exceeds the Allow'able Value, then the associated RTS function is considered inoperable. Allowable Values for RTS functions are specified in Table 3.3.1-1.

l (continued)

ZION Units 1 & 2 8 3.3-5 Rev. 00, October, 1997

{ . _ . - _ . _.._-___---- - , - . . - , _ - _ . .

RTS Instrumentation i B 3.3.1 l

BASES BACKGROUND Allowable Values and Trio SetDoints (continued)

Trip Setpoints are the nominal values at which the bist sles, setpoint comparators or contact trip outputs are set. Trip Setpoints are derived from the Allowable Value.

The actual nominal Trip Setpoint entered into the bistable /comparator is more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a CHANNEL OPERATIONAL TEST (C0T). One example of such a change in measurement error is drift during the surveillance interval. Any bistable or trip output is considered to be properly adjusted when the "as left" value is within the band for CHANNEL C/LIBRATION accuracy. If the measured value of a bistable / contact exceeds the Trip Setpoint but is within the Allowable Value, then the associated RTS function is considered OPERABLE.

Trip Setpoints are specified in applicable plant procedures.

Allowable Values and Trip Setpoints are based on a methodology which incorporates all of the known uncertainties applicable for each instrument channel. A detailed description of the methodology used to calculate the Allowable Values and Trip Setpoints, including their explicit uncertainties, is provided in References 5-and-6.

Relav Protection System The Relay Protection System equipment is used for the decision logic processing of setpoint comparator trip outputs, contact outputs and bistables outputs from the -

signal processing equipment, in order to meet the redundancy requirements, two trains of the Relay Protection System each performing the same functions, are provided. If one train is taken out of service for maintenance or test purposes, the second train will provide the reactor trip function for the unit. If both trains are taken out of service or placed in test, a reactor trip will result. Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements. The system has been designed to trip in the event of a loss of power, directing the unit to a safe shutdown condition. *

(continued)

ZION Units 1 & 2 B 3.3-6 Rev. 00, October, 1997

RTS Instrumentation i B 3.3.1 BASES ACTIONS R d (continued)

-* Pressurizer Pressure-High;

SG Water Level-Low Low: and SG Water Level-Low coincident with Steam Flow / ,

Feedwater Flow Mismatch. ;

For the SG Water Level-Low Low and SG Water Level-Low coincident with Steam flow /Feedwater flow Mismatch functions, Condition D may be entered on a per steam generator basis.

A known inoperable channel must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Placing the channel in the tripped condition results in a partial trip condition requiring only one out of-two logic for actuation of the two out of-three trips and one out of three Icgic for actuation of the two-out-of-four trios. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable chan'el n in the tri condition is justified in WCAP-10271-P-A (Ref. 74)pped .

Failure of a component in the Power Range Neutron Flux Channel which renders the High Flux Trip function inoperable may not affect the capability to monitor QPTR.

However, if the Power Range Neutron Flux input to QPTR is inoperable, entry into additional Conditions may be requiredbyLC03.2.4,'QUADRANTPOWERTILTRATIO(QPTR)."

Depending on the cause of inoperability of the channel, additional Required Actions may include reoucing THERMAL POWER to s 75% RTP or monitoring QPTR on an a revised frequency.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routine surveillance testing of other channels.

The Note also allows placing the inoperable channel in the bypass condition to allow setpoint adjustments of other channels when required to reduce the setpoint in accordance with other Technical Specifications. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in Reference 76.

(continued)

ZION Units 1 & 2 B 3.3 41 Rev. 00, October, 1997 '

j

RTS Instrumentaticn B 3.3.1 BASES ACTIONS id (continued)

Undervoltage RCPs;

Underfrequency RCPs;

Turbine Trip on Low Auto Stop 011 Pressure; and

Turbine Trip on Turbine Stop Valve Closure.

For the Reactor Coolant Flow-Low (Two Loops) function, Condition I may be entered on a per loop basis. For the Turbine Trip on Turbine Stop Valve Closure function, Condition I may be entered on a per valve basis.

With one channel inoperable, the inoperable channel must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Placing the channel in the tripped condition results in a partial trio condition requiring only one additional channel to initiate a reactor trip above the P-7 setpoint (for all the listed functions) and below the P-8 setpoint (for the Reactor Coolant Flow Low and RCP Breaker Position functions). These functions do not have to be OPERABLE below the P 7 setpoint because there are no loss of flow trips below the P 7 setpoint. Placing the Turbine Trip Low Auto Stop 011 Pressure function in the tripped condition results in a partial trip condition requiring only one additional Low Auto Stop 011 Pressure channel to initiate a reactor trip. For the Turbinc Trip-Turbine Stop Valve Closure function, all four stop valves must be tripped (not fully open) in order for the reactor trip signal to be generated. Therefore, it is acceptable to ) lace more than one turbine sto) valve closure channel in tie tripped condition. Witi one or more channels in the tripped condition, a partial reactor trip condition exists. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition is justified in Reference 74.

The Required Actions are modified by a Note t;iat allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routine surveillance testing of the other channels.

Installed bypass capability is not provided for the RCP Breaker Position function, Undervoltage RCP function, Underfrequency RCP function, or Turbine Trip function.

' continued) 1 ZION Units 1 & 2 B 3.3-44 Rev. 00, October, 1997 .

RTS Instrumentation .

B 3.3.1 l BASES ACTIONS M (continued)

Therefore,alternatebypassmethods(e.g.,jumpersor lifted leads) must be utilized. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in Reference 74.

L.1 If the Required Actions and associated Completion Time of Condition I are not met for the Turbine Trip on Low Auto Stop 011 Pressure or Turbine Stop Valve Closure functions, then power must be reduced below the P-7 setpoint within the next 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for reducing power is justified in Reference 76.

The Condition is modified by a Note which states the Condition is only applicable to the Turbine Trip on Low '

Auto Stop Oil Pressure or Turbine Stop Valve Closure -

functions.

M If the Required Actions and associated Completion Time of Condition I are not met for functions other than the Turbine Trip on Low Auto Stop 011 Pressure or Turbine Stop Valve Closure functions, an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to reduce THERMAL POWER to below P-7. Allowance of this time interval takes into consideration the redundant capability provided by the remaining redundant OPERABLE channel and the low arobability of occurrence of an event during this period t1at may require the protection afforded by the associated functions.

The Condition is ecdified by a Note whit.h states the Condition is not applicable to the Turbine Trip on Low Auto Stop 011 Pressure or Turbine Stop Valve Closure functions.

L.1 Condition L applies to the Reactor Coolant Flow-Low (Single Loop) reactor trip function and may be entered on a per loo) basis. With one channel inoperable, the inopera)1e channel must be placed in trip within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

(continued)

ZION Units 1 & 2 8 3.3-45 Rev. 00, October, 1997

RTS Instrumantation B 3.3.1 i

BASES !

ACTIONS (d (continued)

The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE i status or place in trip is justified in Reference M.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routine surveillance testing of the other channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in Reference 74.

lid Condition M applies to the RCP Breaker Position (Single Loop) reactor trip function. There is one breaker position device )er RCP breaker. With one channel inoperable, the ino) era)1e channel must be restored to OPERABLE status wit 11n 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status is justified in Reference M.

M If the Reouired Actions and associated Completion Time of Condition L or M are not met, then THERMAL POWER must be reduced below the P 8 setpoint within the next 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

This places the unit in a MODE where the LCO is no longer applicable to this function. This trip function does not have to be OPERABLE below the P-8 setpoint because other RTS trip functions provide core protection below the P 8-setpoint. The 4 additional hours allowed to reduce THERMAL POWER to below the P-8 setpoint is justified in Reference 76.

M Condition 0 applies to the following reactor trip functions in MODES 3, 4 or 5 with the Rod Control System capable of rod withdrawal:

Hanual Reactor Trip;

RTBs; (continued) i ZION Units 1 & 2 -8 3.3-46 Rey, 00, 0ctober, 1997 )

l l

I RTS Instrumentation >

B 3.3.1 i

BASES .

SURVEILLANCE SR 3.3.1.5 (continued) .

REQUIRENENTS >

Note A exempts the performance of logic testing for Source Range Instrumentation until twelve hours after reducing the ;

power below the P 6 setpoint. The delay of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after '

reducing power below P 6 allows a normal shutdown to be completed and the unit to enter the MODE of Applicability for this surveillance without a delay to aerform the r testing required by this surveillance. Tae MODE of '

Applicability for this surveillance is MODE 2 < P-6 for the -

source range channels. The Frequency of 31 days on a Staggered Test Basis applies if the plant remains in the MODE of Applicability after the initial performance of the surveillance, or after reducing power below P 6 for more than 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . If power is to be maintained < P-6 for more '

than 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , then logic testing for Source Range Instrumentation required by this surveillance must be performed prior to the expiration of the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months limit.

Once the unit is in MODE 3 with the Rod Control System not capable of rod withdrawal, this surveillance is no longer required. Prior to entering the Source Range Mode of Applicability, the logic testing for Scurce Range Instrumentation must be current (performed within 31 days STB).

SR 3.3.1.6 SR 3.3.1.6 is the performance of a COT every 92 days. A COT is performed on each requ W d channel to ensure the entire channel will perform the intended function.

Setpoints must be within the Allowable Values specified in Table 3.3.1-1.

The difference between the current "as found" values and the previous test "as.left" values must be consistent with the drift allowance used in the setpoint methodology. Any setpoint adjustments shall be left set consistent with the assumptions of the current unit specific setpoint methodology.

The "as found" and "as left" values must also be recorded and reviewed for consistency with the assumptions of Reference 76 when applicable.

The frequency of 92 days is justified in Reference 74.

(continued)

ZION Units 1 & 2 B 3.3 54 Rev. 00. October, 1997

. _. _ ~ _ _ _ _ _ _ _ _ _ _ _ . _ _ . - . _ . _ . _ _ . _ . _ _ . - . . _

RTS Instrumentation !

B 3.3.1 .

BASES [

SURVEILLANCE SR 3.3.1.16' t

-REQUIREMENTS !'

-(continued)

SR 3.3.1.16 is the performance of a ACTUATION LOGIC TEST of' !

the Intermediate Range Neutron Flux P-6 Reactor Trip System Interlock. Performance of this test will ensure that the P 6 interlock function is OPERABLE. The SR is required to '

be performed once within 31 days prior to entering Mode 2.- i-Above the P 6 interlock, testing cannot be performed.

1he Frequency is based on the known reliability of the i function and has been shown to be acceptable through operating experience. :

REFERENCES- 1. UFSAR, Chapter 7.

2. UFSAR, Chapter 6.

-3. .UFSAR, Chapter 15.

4. IEEE-279-1968.

5. -Westinghouse Setpoint Methodology for Protection Systems Zion Units 1 and 2, Eagle 21 Version, WCAP 12582, MiWitT!!991.

S. It: MSSS htpeint Ev:le:tica, .ar: tecti: Sy:t= ;

Ch::::1:, E:gle 21 ":r:te ":: "::tingh:::: Ch::::1:.

M. WCAP-10271-P-A, Supplement 2, Rev.1, June 1990.

9 ZION Units 1 &'2 B 3.3-59 Rev. 00, October, 1997

ESFAS Instrumentatiot B 3.3.2 BASES ,

i BACKGROUND Allowable Values and Trio Setcoints (continued)

Allowable Values and Trip Sctpoints are based on a methodology which incorporates all of the known uncertainties applicable for each instrument channel. A :

detailed description of the methodology used to calculate the Allowable Values and Trip Setpoints, incledf ag their explicit en:::t:intic:, is provided in Reference 5.

Fo6a117fust16di':that'hsWin Allowabis"ValuCthe Allowable;Value;isl based oniplant-specific 1 calculations?

Specific' calculations:that provide 1 Allowable~ Values ~~' ' ^ " ~ ~

~

fe fach~'

functlonlinJablel3J3itiare_as;follbwsf fun'etisd Calculitiin"NumbeF Jc?2c',73b(3)F45 225 B;006E-0048 IdI76 22S;B!004E;0120 le 22S;B;011E;0156 1f C'4d 22$;B;0llE;0155 22S-B;004E;0122 I

"gT~4a 225;B;011E;0155 22S;B20llE;0156

~

5bF6b 225;B 011E Gi57 6c 22N;B;024E;0036 7s 22S;B;004E!0122 Relav Protection System The Relay Protection System equipment is used for the decision logic processing of bistable outputs, setpoint comparators trip outputs and contact outputs from the signal processing equipment, in order to meet the redundancy requiren. ants, two trains of the Relay Protection System, each performing the sarre functions, are provided, if one train is taken out of service for maintenance or test purposes, the second train will provide ESF actuation for j the unit. Each train is packaged in its own cabinet for l (continued) l ZION Units 1 & 2 8 3.3-63 Rev. 00, October, 1997 i

ESFAS Instrumentation B 3.3.?

1 BASES '

SURVEILLANCE SR 3.?.2.8 REQUIREMENT 5 (continued) SR 3.3.2.8 is the performance of an ACTUATION LOGIC TEST as dcscribed in SR 3.3.2.2, except that it is only performed for the actuation logic associated with ESFAS interlock P 4 and the Turbine Driven Auxiliary Feedwater Pum? start on a SG water level low low condition. The P-4 interlock logic is satisfied trip breake(rs and their associated bypass breakers are opened.i.e., th in order to test the logic combinations for this function, both reactor trip brea (ers and their associated bypass breakers must be opened.

Tbc it;rbine Driven Auxiliary feedwater Pump receives a start signal when two of-three low low levels exist in two of-four SGs. R e Logic Channel Test Panel, which is used to test the various coinbinations of logic necessary to develop the reyttred starting coincidemce, can not develop the SG low '

kvil logic in two-of-feur SGs during unit operations without generating a reactor trip signal.

Therefore, the actuation logic for both the P-4 interlock and the Turbine Driven Auxiliary Feedwater Pump Functions are tested every 18 months during periods when the reactor trip function is not required to be OPERABLE. The Frequency is adequate and is based on operating experience and instrument reliability.

REFERENCES 1. UFSAR, Chapter 6.

2. UFSAR, Chapter 7.

3. UFSAR, Chapter 15.

4. IEEE-279-1968.

5. Westinghouse Setpoint Methodolt gy for Protection _ Systems Zion Units 1 and 2 Eagle 21 Version, WCAP 1258E[' Augustj~ '

1991.

6. NUREG-1218, Regulatory Analysis for Resolution of USI A-47, Safety Implications of Control Systems in LWR Nuclear Power-P1 ants.

7. WCAP-10271-P A, Supplement 2, Rev.1, June 1990.

ZION Units 1 & 2 B 3.3-110 Rev. 00, October, 1997

i s

,6 t

+

f I

DOC Changes a

DISCUSSION OF CHANGES .

SECTION 3.3.): REACTOR TRIP SYSTEM INSTRUMENTATION (RTS)

(continued)

Ulit NA DISCUSSION A. 31. This generic note to place the unit in cold shutdown has been replaced by Conditions specific to the individual instrument functions of the RTS Specification. The Conditions specify the appropriate operator action for each instrument function. This allows the actions applicable to an inoperable Function to specify the appropriate MODE change necessary to place the unit in a condition where the inoperable instrument Function is no longer required to be OPERABLE. These MODE changes are et,nsistent with the applicable safety analyses assumptions, and assure consistency between the MODE of Applicability and the Required Actions.

Although in most cases this change represents a relaxation it does limit unnecessary plant transients by reducing inappropriate and .

excessive MODF. changes.

L-A. 32.- The applicable setpoint document references have been relocated to the Bases. Reference to th4+ese docunients was provided to specify

~

an allowable tolerance for channel calibration "as left values" based on the Current Technical Specifications specifying absolute values. The proposed Technical Specifications specify the Allowable values, as previously addressed, and contain inequalities where necessary (instrument channels). Therefore',i the~cWrect7e feren'ces

' reEnow both7 WCAP-12582Cwhich7providesa the1approvedisetpoint a s methodology,;and,the: Zion specific calculations,nwhich provide'the Allowable _Value~ numbersv As 'such[the J:st .ctd- refcrchcihg Zi-h Sh '- - ' ' ' "-these' referencas provides details of design or process which are not'directly^ pertinent to the actual requirement, i.e., Limiting Condition for Operation or Surveillance Requirement, but rather describe an acceptable method of compliance.

Since these details are not necessary to adequately describe the actral regulatory requirement, they can be moved to licensee controlled documents without an impact on safety. Placing this information in the Bases provides assuram.e the information will be maintained. Changes to the Bases will be controlled using the Bases Control Process stipulated in Section 5.0 of the Technical Specifications.

L 1. 33. Notes regarding OPERABLE channel requirements during testing are incorporated in the individual Conditions for each instrument function. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months time allowed for testing is increased to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months in accordance with NUREG-1431 as justified in WCAP-10271 and its supplements. The elimination of this generic Note and 'the placing of specific Notes in each applicable Condition is consistent with NUREG 1431.

ZION Units 1 & 2 3.3.1-14 .

11/06/97 v ww w yw t we-- p .-- V ----

-_ _ _ . _ _ _ _ _ _ _ _.. _ _ _ _ _ . _ _ . - _ _ _ . _ _ _ ~

DISCUSSION OF CHANGES ,

SECTION 3.3.2: ENGINEEREDSAFETYFEATUREACTUATION(ESFAS) INSTRUMENTATION (continued) l P

FdiG & DISCUSSION L-1. 49. The generic note to place the unit in Cold Shutdown- has been-replaced by Conditions specific to the individual instrument i Functions of the ESFAS Specification. This format is consistent with NUREG-1431 and allows the Actions applicable to an inoperable i function to specify the minimus MODE change necessary to place the unit in a condition where the inoperable Function is no longer required OPERABLE consistent with the applicable safety analyses

~

assumptions and assures consistency between the MODE of Applicability and the Required Actions. Although in most cases this change represents a relaxation, it does limit unnecessary plant transients by reducing inappropriate and excessive MODE changes.

L-A. 50. Th6Esppitsablei:letpointrdsEssi6htTMfeWWcis?haWbeenTre16catoditi !

the:Basash Reference to;these! documents was rovidedito specifytan

'allowableitolerance for?channe1Pealibration as left-valuesNbased

'onithe Current Technicallspecifications'specifying' absolute viluost Tho' proposed 2 Technic 41kspectficationslspectfy the. Allowable yalues!

as iprevious1T addres sed Rand i cont a i n7i nequal i t i e s ; whe re ? neces sary ;

instrument? channels)t 1Therefore,1the~corroct references areTaow b(oth WCAp;12582nwhich)p'rovidesitherapproved setpoint methodolo W andJthe4 Zion; specific calculationsRwhich?provideEthesAllowaMe Value7nuisber:R a z uc.= m o n..

JThi"3,#(1 Eibl5 sEtiefht~Fef6rAEEi Es~ Ed

u. ne References to set)oint information and the refueling outages that are complete have aeen deleted from the Specification. Reference to the Limiting Safety System Settings (LSSS) is not necessary since this information is now shown in the ESFAS Specification as Allowable Values and thus it is redundant.

The footnote provides details which are not directly pertinent to the actual requirement, i.e., limiting Condition for Operation or Surveillance Requirement, but rather describe an acceptable method of compliance. Since these details ve not necessary to adequately describe the actual regulatory requirement, they can be moved to licensee controlled documents without an impact on safety. Placing this information in- the Bases provides assurance the information will be maintained. Changes to the Bases wili be controlled using the Bases Control Process stipulated in Section 5.0 of the Technical Specifications.

ZION Units IL& 2 3.3.2-16 11/08/97 !

Revised NUREG-1431 Markups I

RTS Instrumentation !

B 3.3.1 7 4

i BASES <

BACKGROUND Sional Process Control and Protection System (continued) prevent the protection function actuation.%These requirements are described in IEEE-279-1Hf (Ref. 4). The

, A-b.-

dE._ actual number of channels required for each unit parameter is specified in Reference 1.

Two logic channels are required to ensure no single random failure of a logic channel will disable the RTS. The logic channels are designed such that testing required while the ;

reactor it at power may be accoglished without causing trip. Provisions to allow removing logic channels from !

service during maintenance are unnecessary because of the logic system's designed reliability.

'15 1, ... . a A'

,l u . , - . . b.

M h b..... and ,,.. M... k__._ . ..

bosni comtestabr 6 Canket trit ou#d5 The Trip Setnoin>ts are the nomina' values at which the [or gP bistables /are se .+ Any bistable 4 s considered to be c "*

Tnr m arc 3roperly adjusted when the "as left" value is within the der.a k m m. .) )and for CHANNEL CALIBRATION accuracy,44 M,

r :t Allkiuw J .r.. I

( 3 4: 1!br:ti:n * ::g er:t: ::ttir; ::; r::y k ,

T(e Trip Setpoints used in the bistables are based o the WCa .. .

analytical limits stated in Reference 1. The sel tion on of is these Tri Setpoints is such that adequate p provided w all sensor and processing t delays are taken into acco To allow for cal tion tolerances, instrumentation une inties, i nt drift, and severe environment errors for e hannels that must function in harsh environments as . d by 10 CFR 50.49 (Ref. 5),

the Trip Setpoints an owabl lues specified in Table 3.3.1-1 in accompanying L re conservatively

' adjusted with pect to the analytical its. A detailed descripti f the methodology used to calcu the Trip

. Setpo , including their explicit uncertaintie , s ided iR the 'RTS/ESFAS Setpoint Methodology Stu ?

Ref. 6).1 The actual nominal Trip Setpoint entered ' nto theT bistablesis more conservative than that specified by the T

Allowable Value to account for changes in random measurement cmunos e m ui errQU_deignble by a401). One example of such a change in i

~

measurement error is drift durino the surveillance interval. /

vnt.iFC#vu~,%onnelbahafl1 the measuredit:tpiit does-not exceedithe AHowableVa

~rt,r W , a a e-w h 73 c ,,7 y ,g g g (_ gggg ,gg, yaig, 9, gy py,e,ug , , , , , ,

Ihc A4 , a is 3.3,l. l, (continued)

WOG STS B 3.3-4 Rev. O,09/28/92 1

I 3.3.1 BASES i INSERT 'A" l Allowable Values for most RTS functions are derived from the analytical limits contained in the safety analyses. Allowable Values provide a conservative margin with regards to instrument uncertainties to ensure that SLs are not violated during anticipated operational occurrences and that the consequences .

of DBAs will be acceptable providing the unit is operated from within the LCOs at the onset of the event and required equipment functions as designed. For other RT.', functions which do not have analytical limits, (functions 3a, 3b, 4, 5, 9, 12, 15, 22a, 22c, 22d and 22e) the Allowable Values are based on a plant specific evaluation of the functional requirement for the instrument chknnel.

A detailed' description"of thernethodolo~ey"used ' ~ ~ ~to"calEulate

~~'- ~ ~~ Allowable Va!uis ' ' ' '

and Tri plSet poi nt s ; i si proiided_1.n;Re f f: S c Forf all. functi6ns'thatthaWan"A11osbls; Vallis 7eifipt40 set)6022iETurbi6e Impulse Pressure:(P-13)f the' Allowable Value tisibased on' plant-specific calculations. L Specific calculations that1 provide: Allowable: Values for each '~ ' ' ~

f applicable;functjon in; Table:3.3-1, are as3,o11ows:

Function CalculatibiNumber 2a 2b? 3a N b', 22cF 22d 22S;B;028E40022 4?22a 225;B4028E;0026 ,

5 22S-B;028E-0025 6, 7 225;B-004E 0122

~

Ba, 8b 22S-B;004E-0120 9 22S;B;004E;0119 10a;l10b 22S;B 004ELO121 12 22N;B 024E 0036 13 22N;B;024E-0037 14 22S;B;011E-0157 15 22S-B;011E-0157 22S-B-0llE-0155 The Allowable Value for' Function 22eiTurbine' Impulse Pressufei(P-13)iis

' ' ~

based on Reference 5.

h-e4thee-use -4If r the measured value of a bistable / contact exceeds the Allowable Value, then the associated RTS function is considered inoperable. Allowable Values for RTS functions are specified in Table 3.3.1-1.

,, -- - - , , . . -- - - - - - , , , - - . - . , - ~ v

t 3.3.1 BASES (continued)

INSERT "B" NOT USED.

INSERT "C" Allowable Values and Tri) Setpoints arc based on a methodology which incorporates all of the (nown uncertainties applicable for each 1.istrument channel. A detailed description of the metho logy used to calculate the Allowable Values and Trip Setpoints, including their explicit uncertainties, is provided in References 5 : d 6.

INSERT "D" As such, for the RTBs either the undervoltage coil or the shunt trip mechanism is sufficient to open the RTBs thus providing a diverse trip method. The RTB bypass breakers also contain a shunt trip mechanism. However for these breakers the shunt trip mechanism will not trip the breaker open u)on receipt of a reactor trip signal from the Relay Protection System. As suc1, the RTB bypass breakers do not have a diverse trip feature.

INSERT "E" retained for the overall redundancy and diversity of the RTS as required by the NRC approved licensing basis and may also serve as backups to RTS trip Functions that vere' credited in the acciaent analyses.

6

- ,- e ----r - - , - , , , ,g-,

M . -mL -.-m -a A..J _ _a-- -+d 4 _ . .

_ ..----i3-- - - -

-.A-+p- " " - - " " - "' ' - - ' - " ' -

P RTS Instrumentation 2d B 3.3.1 -

Fx % $b hhhlz.vd. Gulua ad % (m+tr Gst-w c BASES tom S% %/Fu.I& F% nuttud fone.%c, Con & D m't k-( onnrW in

M nie 'Pw cam ACTIONS ed E.2 (continued)

A known inoperable enannel must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Placing the channel in the tripped condition results its a partial trip condition requiring only one-out-of-two logic for actuation of the two-out-of-three trips and one-out-of-three logic for I actuation of the two-out-of-four tri>s. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed b to place the inop e channel in tie ripped condition is gg justifiedirfRef,_ .iteP-tor 7/-

If the operable chann at be placed in the ip condition within th speci ed Completion Ti , the unit must be placed in MODE ere these Funct s are not required OPERABLE An ditional 6 hou is allowed to

) lace the unit in 3. Six hours a reasonable time, sased on operati erience, to ce the unit in rt00E 3

from full po in an erly er and without challenging unit s gt .

e The Required Actions have been modified by a Note that j

(* M8 " allows placing the ino erable channel in the bypassed f

)M'D NdM routine

W condition surveillance for testing up to 4 of ours thewhile otherperfoming"The hannels. 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time

[j{Mfe*$j' t .

limit is justified in Reference ,1 k

ll[NWYn a$$ks >M owe %sut Whakn -

4. : =e u - -

Condition F applies to the diate Range Neutron Flux

[g trip when THERMAL POWER above the P-10 setpoint.and e-channe l is inoperable. Above the the P-6 setpoint and below

P-6 setpoint and bel the P-10 setpoint, the NIS intemediate range tector pe ones the monitoring Functions. If TH L POWER i greater than the P-6 setpoint but les than the P- setpoint, 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is allowed

'g[ to reduce THERMA POWER bel the P-6 setpoint or increase to THERMAL POWEP above th P-10 setpoint. The NIS Intermediate Rar ge Neut n Flux channels must be OPERABLE when the power level above the capability of the source range,P-6,andhel the capability of the power range, P-10. If THERMA ER is greater than the P-10 setpoint, the NIS power r detectors perfom the monitoring and protection f ction d the intermediate range is not requi red. he Complet o s allow for a slow ind controyed power adjustment a Uve4td0 or below P-6 and take (continued)

WOG STS B 3.3-42 Rev. O,09/28/92 l

1

?c i 5 Instrumentation IFor A cu.aa 6d,a Flutw(hM 6,am, Gndh 8 3'3d

\ t est 6, e eknd en a fst (ret botits fx % %bne *?ston Turk

{ STot vals Clears, Corods+m L may k card e a f<r scle s kfd BASES w -,

ACTIONS 1.1 Ju and Le (continued)

Pressurizer Water Level-High;

Reactor Coolant Flow-Low (Two Loops);

RCPBreakerPosition(TwoLoops);

Tur6;ne Mca L 6H W M Ed* '# Undervoltage RCPs: p ,

e %s Tri o., %rs.u mt %^ CitMs ,. ,y 4, ggPm)

-

Underfrequency R S {D pt-. AL y

- With one chanel inoperable, the noperable channel must be n

w 5 i , e ..u.. %.M placed in the tripped condition w thin 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Placing the ce ter o.,%. /a. r pgn, s

s channel in the tripped condition results in a partial trip condition requiring only one additiogal channel to initiate t yrer a trip above the P-7 setpointvand below the P-8 Q_ TetpointhMFunctior6deM not have to be OPERABLE below WNge i the P-7 setpoint because there are no loss of flow trips

. i below the P-7 setpoint.+ The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the IGS channel in trippea condition is justified in Fnm it9* Reference < . M dditient! S heer: i! all1:d te r: duct THEDaiAl Ohum ta halnw D.7 (f +ka (nnnarehle ch3n ;! : ;;t be restered te ODE"MLE status e p12ced i= t-ip -itH- the spect'! d Cr--leti:n Ti:::.

Allowance of this t terval tptes into consideration the gg , . redundant capabili y p ided bgthe remaining redundant 4,7 es not OPERABLE channel, nd e low robability of occurrence of W(raus s f,W. d hm1.

hr /# an event during th s eriod at may require the protection dica hn , u h u .. g I:P afforded by the F sociated with Condition M.

Lklu49.:ra W smm st-

"TM,s Tr.c su d at, ,

The Required Actions have been modified by a Note that GIhh, hp!el oatadt (e.g., Iallows placing the inoperable channel in the bypassed dvrna./ n Errd /c.J mek.

I condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while perfoming routine JN/M iuncilience tesung or tne otner pnannels.N The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time t ir justified in Reference 7 pg '{

L.l

)f1Condition

nd 62 {and tocY k enktul on a Arled h@

Jr applies to the eactor Coolant Flow-Low (Single l { ;Ld \ Loop) reactor trip Functio . With one channel inoperable, the inoperable channel must be placed in trip within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . If th: ch nn:1 ;nnet b ristered te OTETJeLE 7 statur er the channe! phced in trip withi the 5 5: rs,//act

--g Eib The G haua Qllud h rc!4cfc Ot Chanth fu ofuABR /afofor or lx trip (I jvfbfaden (Mer M t;'<) O / _ ~ .

(continued)

WOG STS B 3.3-46 Rev. O, 09/28/92

i

,,e.

RTS Instrumentation B 3.3.1 BASES ACTIONS ' N.1 K l (raati" fC e r thenTHERMAl.POWERmustbereducedbelowtheP-8setpo within the next 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . This places,the unit in a MODE where the LCO is no longer applicabler Inis trip runction does not have to be OPERABLE below the F-8 setpoint because other RTS trip Functions provide core protection below the P-8 setpoint. The 5 h== :ll: :d t n:te n th: :h = =1 to OPE"*"LE :t:t= :r p h = f trip =d th; 4 additional hours allowed to reduce THERMAL' to below the P-8 setpoint are ju:tified in Reference .

'The Required Actions have been modified by a Note that

9 allows placing the inoperable channel in the bypassed f N s, condition for up to 41ours while perfoming routine surveillance testing 6f the otherJhannels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time

.(g)b g i

limit is justified iniReferencef

'. 6 f61.\

0.1 = d 0.2- , _

Condition pplies to the RCP Breaker Position (Single Loop) reactor trip Function. There is one breaker position !

device per RCP breaker. With one channel inoperable, the inoperable channel must be restored to OPERABLE status witiin 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . If th: :hx =1 =: ct h re;tered to enE*ABLE states r!thi- the 6 hee , thr E""f1 aa"Ea =st , !

'- - A.--a 6.io- +k. o a ..+ nin, wi+hin ch, n.,+ a hours, l E4 ;';G;;. E. ... s i. . we a-- .u. ' " ^ " - " - - 1 i'uitEisi.' 'Vi4T'i'.,442. X I. C '6 Z' I" d'aGa y er i c ' - - -' - -

c . . .x= :.x. .... nia runmon proviae

~

b. n._ .u. .._.__m...

7.. ...

ce ;nt::ti r hl= th: N eeti,16t. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed

- to restore the channel to OPERABLE status and-4he 1

' 'dditi^=51 heu~ !!:1:d to cdre ".5""f,'. "10 te telew .

! Q "

retpe!=t We stified in Refe-ge. fl n

The ReAui, red Actipns ve been no ledbyaNoephat alloud placinft i perable e nel in the by assed condi'tionJer up to hours e performing to ine sueve tince tes ng of other channels.jihe time .

limi is justified eference 7. 1

/ /

1 1

1 l

(continued) {

I WOG STS B 3.3-47 Rev. O,09/28/92 i l

1

)

RTS Instrumentation 8 3.3.1 i

That iJ occ.mildd ly luk/li llevCarr5W BASES vicorc Ow % , 3' I

, SURVEILLANCE SR 3.3.1.5 (contittued) { l REQUIREMENTS 'p fer th; testiag, 4 hews, esf ,he I j g ,;5 ]

on a STAGGERED TEST BASIS,tified :r:/j : in Frequency n;f;r;;;; of.7.'every a 31

4 1+ 0 hasd en onddkl. OttairQ esfr.?dnet Censodstiny

~ ' g.7 $ Q \ . th & Mol*V and &+q hollory" dedo..

SR 3 .3 . l S c}

{_wo6 d IE l [3 O}

SR 3.3.1 is a calibration of the excore channels to the it surellancc. ei ini incore c annels. If the measurements do not agree, the per(c< W 6 m fy excore channels are not declared inoperable but must be fhe. f( 40 dri fut calibrated to agree with the incore detector measurementse fe h wt.rbndtt&c. j If the excore channels cannot be adjusted, the channels are of funcken.

{declaredinoperable.p I

f,9 '

A Note modifies SR 3.3.1, . The Note states that this l l

h/d3 l Surv'eillance fs required only if reactor power is >JM RTP

-tedthetJ{286her: 8. 1.h.nd fer ;;;ft--h; th: f'.nt suri;il1 ::: after reding-44% R4. j uI uency of 92 EFPD is justified in-Reference +. t

[A.tymiThee, r

1 en #ndastr/ o cent, den g inpyy j ,,,. o j @s M+ery des trstng

%r 43ktten.,

daiwni drW. gry,a a,mg g{,

7,,, g g

~

SR 3.3.1 }(p otso LlS0lt k i scyt for st2 3.If 1

$R 3 ?,.t.7,WmaMd (/ SR 3.3.1[is the perfonnance of a COT every 92] ays.

a tJob: ; + rpdes a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months klay in h rqvn. A COT is perfonned on each required channel to ensure the med gr hr I hr entire channel will perfona the intended Function.

Leucilhar. 4 vecs, ta 5. Setpoints must be within the Allowable Values specified in int h e 7tnin.. t.o ca enhn M ' 3'3* M '

N3 OA 1- Ih l IWr. all The difference between the current "as found" values and the

' o. O ml W+down previous test 'as left" values must be consistent with the to froce d uat evi a ddo/ drift allowance used in the setpoint methodology, 4he Any for heb ir, pW2 and for setpoint shall be left set consistent with the assumptions

o. chart Mad in McN.3 of the i:1brrent unit specific setpoint methodolegy.

Onfif. u MS; ar,.eftn W'"*

and M j. /g ff no 4 The 'as found' and "as left" values must also be recorded f9yg Q gg ,,df and reviewe& or consistency 7' with the assumptions of 2 P tot un,t /

,3 rs 6t. in m60a Reference 4 /.

taiHith47h ioW Ar> 4 TheFrequencyofd92 ays is justified in Reference / /. h w <s a w . r u .n a + v

.t' & t're ~ 7t Q N$

l*<f r entet on.

(-)

rnout.5.

(continued)

WOG STS B 3.3-54 Rev. O, 09/28/92 1

- . . __ =- _-

-;..% g,..(,

4

~ .

RTS Instrumentation

, B 3.3.1 BASES REFERENCES 3. ljfSAR, Chapterk1 (continued) IEEE-279-19(g'

4. . .

S. 10 OTR 00.43. .

6- "TS/ESFAS S:tpcir,t ".:tt.:d:1:;y Study, WCAP-10271-P-A, Supplement 2. Rev. 1, June 1990.

p.

4. Technicel1Ey i . ..a "e...el, Sectier,15, " Response-(

5, L0cti hat 3dekn1Ris%hleHQ<fededim 31/Skm Zion Unih l a d 2, s [c glt,, 2/ VctJ/jn,

. UCAf IU8? ; f UPU.hh (h}

l* I t

(jf'flAaT - w n ski [tG \

I WOG STS B 3.3-59 Rev. O, 09/28/92 v v

T ESFAS Instrumentation B 3.3.2 BASES Ontrol cd Sken 3})tm BACKGROUND _ Sianal Processino E: i w (continued) actuation. Again, a single failure will neither cause nor t

prevent the protection function actuation].

,N -

hese requirements are described in IEEE-279-19fd (Ref. 4).

(R The actual number of channels required for each unit

- parameter is specified in Reference 2.

, I/ L i*

(Tr ud Allowable Values c )- {or trip dd

exRo.nt Cam %i6

~"" -

7 orcabd kJ wt&61 The Trip Setpoints are the nominal / values at which the listables+'are set.+ Any bistable 4s considered to be

((M7 ensde V

.3 properly aa,lusten when the "as left" value is within the sand for CHANNEL CALIBRATION accuracy (i.:., ; r::k a N'# n!!brette * : trat:r ::ttin; ::: r;;y) .>

oints used in the bistables-are based on ana TripcalSetl $ nits stated in Reference-Er The sele n of i

these T Setpoints is such that adequate pro ion is provided wh 11 sensor and processing til elays are taken into acco To allow for cali ton tolerances, instrumentation unce inties, ins nt drift, and severe environment errors for e ES channels th? ; must function in harsh environne as defined by h CFR 50.49 (Ref. 5), the Trip Setp s an lowable Values specified in Table 3.3.2-1 in e accompanyin. O are' conservatively adjusted with ect to the analyt' cal its.% A detailed description t the methodology used to cale te the Trip Setpoin , including their explicit uncertaint is d 11 the "RTS/ESFAS Sott,oint Methodology Stu "

pro fc6). Jh gpal nomina' Trip Setpoint entered into theT 4M bistabletis 4y'more conservctive than that specified '

1 I

G9/-

1 d h ? Joeasurement bi'the Allowable Value tobyaccount errors detectable COi. .for changes in rando

(

[ C.9 T-3 a change in measurement error is (drift during the 7 su'rveillance interval.I If the measurede: ::::i e r;.

/

exceedsthe 231 = d!: MJ"e( the birt 910StreMt i: 20:%:' ((

.s GPERA9tE. (, cumet Setp ia+< in accordance with the Allowable Value ensu the consequenTiref %:iaa nasis Accident < ' E" ". be acceptable, providin ' uni t -s m2 L.,within the LCOs at t D8A and the equipment funcuena a des .

l (continued)

WOG STS B 3.3-62 Rev. O, 09/28/92

3.3.2 BASES (continued)

INSERT "B" Allowable Values and Trip Setpoints are based on a methodology which incorporates all of the known uncertainties applicable for each instrument channel. A detailed description of the methodology used to calculate the Allowable Values and-Trip Setpoints, including their =plicit uncertaintics, is provided in Reference 5.

FoMil lTfs6ti shiithst7 hiileish"A116EbliijVilnStWAll dsb1 Eval s71 s based ;on" plant 4pecificicalcul' e tionsle$pecificicalculations) that ^ ^

prov i de[ Al l owabl ajyal ues Mode achifunction ;i nj Tabl el3 ; 3 t21 ar,e La s " ,

follows:

Fu'n'c' tion Cilculation Numbe'r if,-2c,13b(3)P4c 22S;B!006E20048 l'd U 7b' '2S;B;004E-0120 2

le 22 stb;011E!0156 If,' '4d 225;BF011E;0155 L~' 22S-B-004E-0122 19,f4e.

^

225;B?011E;0155 22S;B OllE-0156 SbE6b 22S-B;0llE-0157 6c 22N-B1024E 0036 7c 22S;B;004E-0122 INSERT "C" For example, the Safety Injection Containment Pressure-High function is a orimary actuation signal for loss of Coolant Accidents (LOCAs) and a backup actuation signal for feedwater system pipe breaks. ESFAS functions not specifically credited in the accident analyses are retained for the overall LCO, and redundancy and diversity of the ESFAS as required by the NRC approved licensing basis and may also serve as backups to ESFAS trip functions that were credited-in the accident analyses.

ESFAS Instrumentation B 3.3.2 l BASES MS9 mk Scitonf rndWdolff {er ,

REFERENCES 5. 10 SIR 50.4%. l'ivruJss T (continued) g k21:;y e/se,We#

7,/ St:

/y +,S al LenIt,58tM Uny h /c

T:/E:rA: ::tp: int .-.h:

5 J6 If QM(y Ana@ fr 03Mtv 09 USI-A 'll 4 J'. NUREG-1218 -AprH-1988. fqfdy hhcak ef G ntr4 Iy M w s g y 8'. WCAP-10271-P-A, Supplemeb, Nk."'1, $$ni .'

-9. T::Mic:1 "::;;ir. .;;t: ".= :1 :::ti:n 15, ""::p;;;;

- Ti n ; ."

\

WOG STS B 3.3-120 Rev. O,09/28/92

A 7 m B-J -

Attachment 2

ZION STATION l OL & Tech Specs LIST OF EFFECTIVE PAGES Pace No. Rev. or Amend. Pace No. Rev or Amend t List ~of Effective Pages 1.3-4 Amendment Nos. 178/165 1.3-5 Amendment Nos. 178/165 LOEP-1 /mendment Nos. 178/165 1.3-6 Amendment Nos. 178/165 L0EP-2 Amendment Nos. 178/165 1.3-7 Amendment Nos. 178/165 L0EP-3 Amendment Nos. 178/165 1.3-8 Amendment Nos. 178/165 L0EP A Amendment Nos. 178/165 1.3-9 t.mendment Nos. 178/165 1.3-10 Amendment Nos. 178/165 ,

1,3-11 Amendment Nos. 178/165 Composite Operating License DPR-39 1,3-12 Amendment Nos. 178/165 1,3-13 Amendment Nos. 178/165 1 Amendment Nos. 178/165 2 Amendment Nos. 178/165 1.4-1 Amendment Nos. 178/165 3 Amendment Nos. 178/165 1.4-2 Amendment Nos. 178/165 4 Amendment Nos. 178/165 1.4 3 Amendment Nos. 178/165 5 Amendment Nos. 178/165 1.4-4 Amendment Nos. 178/165 1.4-5 Amendment Nos. 178/165 Composite Operating License DPR-48 2.0-1 Amendment Nos. 178/165 2.0-2 Amendment Nos. 178/165 1 Amendment Nos. 178/165 2 Amendment Nos. 178/165 3.0-1 Amendment Nos. 178/165 3 Amendment Nos. 178/165 3.0-2 Amendment Nos. 178/165 4 Amendment Nos. 178/165 3.0-3 Amendment Nos. 178/165 5 Amendment Nos. 178/165 3.0-4 Amendment Nos. 178/165 3.0-5 Amendment Nos. 178/165 TS Table of Contents 3.1-1 Amendment Nos. 178/165 3.1-2 Amendment Nos. 178/165 i Rev. 00, 1/1/97 3,1-3 Amendment Nos. 178/165 ii Rev. 00, 1/1/97 3.1-4 Amendment Nos. 178/165 iii Rev 00, 1/1/97 3.1-5 Amendment Nos. 178/165 iv Rev. 00, 1/1/97 3.1-6 Amendment Nos. 178/165 3.1-7 Amendment Nos. 178/165 3.1-8 Amendment Nos. 178/165 Att A - Technical Specifications 3.1-9 Amendment Nos. 178/165 3.1-10 Amendment Nos. 178/165 1.1-1 Amendment Nos. 178/165 3.1-11 Amendment Nos. 178/165 1.1-2 Amendment Nos. 178/165 3.1-12 Amendment Nos. 178/165 1.1-3 Amendment Nos. 178/165 3.1-13 Amendment Nos. 178/165 1.1-4 Amendment Nos. 178/165 3.1-14 Amendment Nos. 178/165 1.1-5 Amendment Nos. 178/165 3.1-15 Amendment Nos. 178/165 1.1-6 Amendment Nos. 178/165 3.1-16 Amendment Nos. 178/165 1.1-7 Amendment Nos. 178/165 3.1-17 Amendment Nos. 178/165 3.1-18 Amendment Nos. 178/165 1.2-1 Amendment Nos. 178/165 3.1-19 Amendment Nos. 178/165 1.2-2 Amendment Nos. 178/165 3.1-20 Amendment Nos. 178/165 1.2-3 Amendment Nos. 178/165 3.1-21 Amendment Nos. 178/165 3.1-22 Amendment Nos. 178/165 1.3-1 Amendment Nos. 178/165 1.3-2 Amendment Nos. 178/165 1.3-3 Amendment Nos. 178/165 ZION Units 1 & 2 L0EP-1 Amendment No, 178/165

l l

ZION STATION .

OL & Tech Specs l LIST OF EFFECTIVE PAGES Page No. Rev. or Amend. Pace No. Rev. or Amend.

3.2-1 -Amendment Nos. 178/165 3.3-33 Amendment Nos. 178/165 3.2-2 Amendment Nos. 178/165 3.3-34 Amendment Nos. 178/165 3.2-3 Amendment Nos. 178/165 3.3-35 Amendment Ncs. 178/165 3.2-4 Amendment Nos. 178/165 3.3-36 Amendment Nos. 178/165 3.2-5 Amendment Nos. 178/165 3.3-37 Amendment Nos. 178/165 3.2-6 Amendment Nos. 178/165 3.3-38 Amendment Nos. 178/165 3.2-7 Amendment Nos. 178/165 3.3-39 Amendment Nos. 178/165 3.2-8 Amendment Nos. 178/165 3.3-40 Amendment Nos. 178/165 3.2-9 Amendment Nos. 178/165 3.3-41 Amendment Nos. 178/165 3.2-10 Amendment Nos. 178/165 3.3-42 Amendment Nos. 178/165 3.2-11 Amendment Nos. 178/165 3.3-43 Amendment Nos. 178/165 3.2-12 Amendment Nos. 178/165 3.3-44 Amendment Nos. 178/165 3.2-13 Amendment Nos. 178/165 3.3-45 Amendment Nos. 178/165 3.2-14 Amendment Nos. 178/165 3.3-46 Amendment Nos. 178/165 3.2-15 Amendment Nos. 178/165 3.3-47 Amendment Nos. 178/165 3.2-16 Amendment Nos. 178/165 3.3-48 Amendment Nos. 178/165 3.2-17 Amendment Nos. 178/165 3.3-49 Amendment Nos. 178/165 3.2-18 Amendment Nos. 178/165 3.3-50 Amendment Nos. 178/165 3.3-51 Amendment Nas. 178/165 3.3-1 Amendment Nos. 178/165 3.3-2 Amendment Nos. 178/165 3.4-1 Amendment Nos. 178/165 3.3-3 Amendment Nos. 178/165 3.4-2 Amendment Nos. 178/165 3.3-4 Amendment Nos. 178/165 3.4-3 Amendment Nos. 178/165 3.3-5 Amendment Nos. 178/165 3.4-4 Amendment Nos. 178/165 3.3-6 Amendment Nos. 178/165 3.4-5 Amendment Nos. 178/165 3.3-7 Amendment Nos. 178/165 3.4-6 Amendment Nos. 178/165 3.3-8 Amendment Nos. 178/165 3.4-7 Amendment Nos. 178/165 3.3-9 Amendment Nos. 178/165 3.4-8 Amendment Nos. 178/165 3.3-10 Amendment Nos. 178/165 3.4-9 Amendment Nos. 178/165 3.3-11 Amendment Nos. 178/165 3.4-10 Amendment Nos. 178/165 3.3-12 Amendment Nos. 178/165 3.4-11 Amendment Nos. 178/165 3.3-13 Amendment Nos. 178/165 3.4-12 Amendment Nos. 178/165 3.3-14 Amendment Nos. 178/165 3.4-13 Amendment Nos. 178/165 3.3-15 Amendirent Nos. 178/165 3.4-14 Amendment Nos. 178/165 3.3-16 Amendment Nos. 178/165 3.4-15 Amendment Nos. 178/165 3.3-17 Amendment Nos. 178/165 3.4-16 Amendment Nos. 178/165 3.3-18 Amendment Nos. 178/165 3.4-17 Amendment Nos. 178/165 3.3-19 Amendment Nos. 178/165 3.4-18 Amendment Nos. 178/165 3.3-20 Amendment Nos. 178/165 3.4-19 Amendment Nos. 178/165 3.3-21 Amendment Nos. 178/155 3.4-20 Amendment Nos. 178/165 3.3-22 A.w.dment Nos. 178/165 3.4-21 Amendment Nos. 178/165 3.3-23 Amendment Nos. 178/165 3.4-22 Amendment Nos. 178/165 3.3-24 Amendment Nos. 178/165 3.4-23 Amendment Nos. 178/165 3.3-25 Amendment Nos.- 178/165 3.4-24 Amendment Nos. 178/165 3.3-26 Amendment Nos. 178/165 3.4-25 Amendment Nos. 178/165 3.3-27 Amendment Nos. 178/165 3.4-26 Amendment Nos. 178/165 3.3-28 Amendment Nos. 178/165 3.4-27 Amendment Nos. 178/165 3.3-29 Amendment Nos. 178/165 3.4-28 Amendment Nos. 178/165 3.3-30 Amendment Nos. 178/165 3.4-29 Amendment Nos. 178/165 3.3-31 Amendment Nos. 178/165 3.4-30 Amendment Nos. 178/165 3.3-32 Amendment Nos. 178/165 3.4-31 Amendment Nos. 178/165 ZION Units 1 & 2 L0EP-2 Amendment No. 178/165

ZION STATION OL & Tech Specs LIST OF EFFECTIVE PAGES Pace No. Rev. or Amend. Pace No. Rev. or Amend.

3.4-32 Amendment Nos. 178/165 3.7-4 Amendment Nos. 178/165 3.4-33 Amendment Nos._178/105 3.7-5 Amendment Nos. 178/165 3.4-34 Amendment Nos. 178/165 3.7-6 Amendment Nos.- 178/165 3.4-35 Amendment Nos. 178/165 3.7-7 Amendment Nos. 178/165' .

3.4-36 Amendment Nos. 178/165- 3.7-8 Amendment Nos. 178/165 3.4-37 Amendment Nos. 178/165 3.7-9 Amendment Nos. 178/165 3.4-38 Amendment Nos. 178/165 3.7-10 Amendment Nos. 178/165 3.4-39 Amendment Nos. 178/165- 3.7-11 Amendment Nos. 178/165 3.4-40 Amendment Nos.- 178/165 3.7-12 Amendment Nos. 178/165 3.4-41 . Amendment Nos. 178/165 3.7-13 Amendment Nos. 178/165 3.4-42 Amendment Nos. 178/165 3.7-14 Amendment Nos. 178/165 3.4-43 Amendment Nos. 178/165 3.7-15 Amendment Nos. 178/165 3.7-16 Amendment Nos. 178/165 3.5-1 Amendment Nos. 178/165 3.7-17 Amendment Hos. 178/165 3.5-2 Amendment Nos. 178/165 3.7-18 Amendment Nos. 178/165 3.5-3 Amendment Nos. 178/165 3.7-19 Amendment Nos. 178/165 3.5-4 Amendment Nos. 178/165 3.7-20 Amendment Nos. 178/165 3.5-5 Amendment Nos. 178/165 3.7-21 Amendment Nos. 178/165 3.5-6 Amendment Nos. 178/165 3.7-22 Amendment Nos. 178/165 3.5-7 Amendment Nos. 178/165 3.7-23 Amendment Nos. 178/165 3.5-8 Amendment Nos. 178/165 3.7-24 Amendment Nos. 178/165 3.5-9 Amendment Nos. 178/165 3.7-25 Amendment Nos. 178/165 3.5-10 Amendment Nos. 178/165 3.7-26 Amendment Nos. 178/165 3.7-27 Amendment Nos. 178/165 3.6-1 Amendment Nos. 178/165 3.7-28 Amendment Nos. 178/165 3.6-2 Amendment Nos. 178/165 3.7-29 Amendment Nos. 178/165 3.6-3 Amendment Nos. 178/165 3.7-30 Amendment Nos. 178/165 3.6-4 Amendment Nos. 178/165 3.7-31 Amendment Nos. 178/165 w 3.6-5 Amendment Nos. 178/165 3.7-32 Amendment Nos. 178/165 3.6-6 Amendment Nos. 178/165 3.7-33 Amendment Nos. 178/165 3.6-7 Amendment Nos. 178/165 3.7-34 Amendment Nos. 178/165 3.6-8 Amendment Nos. 178/165 3.7-35 Amendment Nos. 178/165 3.6-9 Amendment Nos. 178/165 3.7-36 Amendment Nos. 178/165 3.6-10 Amendment Nos. 178/165 3.7-37 Amendment Nos. 178/165 3.6-11 Amendment Nos. 178/165 3.7-38 Amendment Nos. 178/165 3.6-12 Amendment Nos. 178/165 3.6-13 Amendment Nos. 178/165 3.8-1 Amendment Nos. 178/165 3.6-14 Amendment Nos. 178/165 3.8-2 Amendment Hos. 178/165 3.6-15 Amendment Nos. 178/165 3.8-3 Amendment Nos, 178/165 3.6-16 Amendment Nos. 178/165 3.8-4 Amendment Nos. 178/165 3.6-17 Amendment Nos. 178/165 3.8-5 Amendment Nos. 178/165 3.6-18 Amendment Nos. 178/165 3.8-6 Amendment Nos. 178/165 3.6-19 Amendment Nos. 178/165 3.8-7 Amendment Nos. 178/165 3.6-20 Amendment Nos. 178/165 3.8-8 Amendment Nos. 178/165 3.6-21 Amendment Nos. 178/165 3.8-9 Amendment Nos. 178/165 3.6-22 Amendment Nos. 178/165 3.8-10 Amendment Nos. 178/165 3.6-23 Amendment Nos. 178/165 3.8-11 Amendment Nos. 178/165 3.8-12 Amendment Nos. 178/165 3.7-1 Amendment Nos. 178/165 3.8-13 Amendment Nos. 178/165 3.7-2 Amendment Nos. 178/165 3.8-14 Amendment Nos. 178/165 3.7-3 -Amendment Nos. 178/165 3.8-15 Amendment Nos. 178/165 ZION Units 1 &'2 L0EP-3 Amendment No. 178/165

-. - . . = _ .- .

ZION STATION OL & Tech Specs LIST OF EFFECTIVE PAGES Pace No. Rev or Amend. Pace Na Rev. or Amend.

3.8-16 Amendment Nos. 178/165 5.0-8 Amendment Nos. 178/165 3.8-17 Amendment Nos. 178/165 5.0-9 Amendment Nos. 178/165 3.8-18 Amendment Nos. 178/165 5.0-10 Amendment Nos. 178/165 3.8-19 Amendment Nos. 178/165 5.0-11 Amendment Nos. 178/165 3.8-20 Amendment Nos. 178/165 5.0 12 Amendment Nos. 178/165 3.8-21 Amendment Nos. 178/165 5.0-13 Amendment Nos. 178/165 3.8-22 Amendment Nos. 178/165 5.0-14 Amendment Nos. 173/165 3.8-23 Amendment Nos. 178/165 5.0-15 Amendment Nos. 178/165 3.8-24 Amendment Nos, 178/165 5.0-16 Amendment Nos. 178/165 3.8-25 Amendment Nos. 178/165 5.0-17 Amendment Nos. 178/165 3.8-26 Amendment Nos. 178/165 5.0-18 Amendment Nos. 178/165 3.8-27 Amendment Nos. 178/165 5.0-19 Amendment Nos. 178/165 3.8 28 Amendment Nos. 178/165 5.0-20 Amendment Nos. 178/165 3.8 29 Amendment Nos. 178/165 5.0-21 Amendment Nos. 178/165 3.8-30 Amendment Nos. 178/165 5.0-22 Anendment Nos. 178/165 3.8-31 Amendment Nos. 178/165 5.0-23 Amendment Nos. 178/165 3.8-32 Amendment Nos. 178/165 5.0-24 Amendment Nos. 178/165 3.8-33 Amendment Nos. 178/165 5.0-25 Amendment Nos. 178/165 3.8-34 Amendment Nos. 178/165 5.0-26 Amendment Nos. 178/165 3.8-35 Amendment Nos. 178/165 5.0-27 Amendment Nos. 178/165 3.8-36 Amendment Nos. 178/165 5.0-28 Amencment Nos. 178/165 3.8-37 Amendment Nos. 178/165 5.0-29 Amendment Nos. 178/165 3.8-38 Amendment Nos. 178/165 5.0-30 Amendment Nos. 178/165 3.8-39 Amendment Nos. 178/165 5.0-31 Amendment Nos. 178/1A5 3.8-40 Amendment Nos. 178/165 5.0-32 Amendment Nos. 178/165 3.8 41 Amendment Nos. 178/165 5.0-33 Amendment Nos. 178/165 3.8-42 Amendment Nos. 178/165 5.0-34 Amendment Nos. 178/165 5.0-35 Amendment Nos. 178/165 3.9-1 Amendment Nos. 178/165 5.0-36 Amendment Nos. 178/165 3.9-2 Amendment Nos. 178/165 3.9-3 Amendment Nos. 178/165 3.9-4 Amendment Nos. 178/165 3.9-5 Amendment Nos. 178/165 3.9-6 Amendment Nos. 178/165 3.9-7 Amendment Nos. 178/165 3.9-8 Amendment Nos. 178/165 3.9-9 Amendment Nos. 178/165 3.9 10 Amendment Nos. 178/165 4.0-1 Amendment Nos. 178/165 4.0-2 Amendment Nos. 178/165 4.0-3 Amendment Nos. 178/165 4.0-4 Amendment Nos. 178/165 5.0-1 Amendment Nos. 178/165 5.0-2 Amendment Nos. 178/165 5.0-3 Amendment Nos. 178/165 5.0 4 Amendment Nos. 178/165 5.0-5 Amendment Nos. 178/165 5.0-6 Amendment Nos. 178/165 5.0-7 Amendment Nos. 178/165 ZION Units-1-& 2 L0EP-4 Amendment No. 178/165

ZION STATION Tech Specs BASES LIST OF EFFECTIVE PAGES Pace No. Rev. or Amend. Pace No. Rev. or Amend.

List of Effective Pages B 3.1-3 Rev. 00, October, 1997 8 3.1-4 Rev. 00, October, 1997 L0EP-B 1 Rev. 00, October, 1997 B 3.1-5 Rev. 00, October, 1997 LOEP-B 2 Rev. 00,- October, 1997 8 3.1-6 -Rev. 00, October, 1997 LOEP-B 3 Rev. 00, October, 1997 8 3.1-7 Rev. 00, October, 1997 ,

LOEP-B 4 Rev. 00, October, 1997 B 3.1-8 Rev. 00, October, 1997 LOEP-B 5 Rev. 00, October, 1997 B 3.1-9 Rev. 00, October, 1997 L0EP-B 6 Rev. 00, October, 1997 B 3.1-10 Rev. 00, October, 1997 L0EP-B 7 Rev. 00, October, 1997 B 3.1-11 Rev. 00, October, 1997 LOEP-B 6 Rev. 00, October, 1997 8 3.1-12 Rev. 00, October, 1997 B 3.1-13 Rev. 00, October, 1997 B 3.1-14 Rev. 00, October, 1997 TS Bases Table of Contents B 3.1-15 Rev. 00, .0ctober, 1997 8 3.1-16 Rev. 00, October, 1997 ei Rev. 00, October, 1997 8 3.1-17 Rev. 00, October, 1997 8 11 Rev. 00, October, 1997 B 3.1-18 Rev. 00, October, 1997 8 iii Rev. 00, October, 1997 8 3.1-19 Rev. 00, October, 1997 8 3.1-20 Rev. 00, October, 1997 8 3.1-21 Rey 00, October, 1997 Zion Technical Specification BASES B 3.1-22 Rev. 00, October, 1997 B 3.1-23 Rev. ^0, October, 1997 B 2.0-1 Rev. 00, October, 1997 B 3.1-24 Rev. 00, October, 1997 B 2.0-2 Rev. 00, October, 1997 8 3.1-25 Rev. 00, October, 1997 8 2.0-3 Rev. 00, October, 1997 8 3.1-26 Rev. 00, October, 1997 ,

B 2.0 4 Rev. 00, October, 1997 8 3.1-27 Rev. 00, October, 1997 l B 2.0-5 Rev. 00, October, 1997 B 3.1-28 Rev 00, October, 1997 8 2.0-6 Rev. 00, October, 1997 B 3.1-29 Rev. 00, October, 1997 a B 2.0-7 Rev. 00, October, 1997 B 3.1-30 Rev. 00, October, 1997

. B 2.0-8 Rev. 00, October, 1997 8 3.1-31 Rev. 00, October, 1997 B 2.0-9 Rev. 00, October, 1997 B 3.1-32 Rev. 00, October, 1997 B 2.0-10 Rev. 00, October, 1997 B 3.1-33 Rev. 00, October, 1997 i B 3.1-34 Rev. 00, October, 1997 i B 3.0-1 Rev. 00, October, 1997 B 3.1-35 Rev. 00, October, 1997 8 3.0-2 Rev. 00, October, 1997 0 3.1-36 Rev. 00, October, 1997 B 3.0-3 Rev. 00, October, 1997 8 3.1-37 Rev. 00, October, 1997 B 3.0-4 Rev. 00, October, 1997 B 3.1-38 Rev. 00, October, 1997 B 3.0-5 Rev. 00, October, 1997 B 3.1-39 Rev. 00, October, 1997 B 3.0-6 Rev 00, October, 1997 B 3.1-40 Rev. 00, October, 1997 B 3.0-7 -Rev. 00, October, 1997 8 3.1-41 Rev. 00, October, 1997 8 3.0-8 Rev. 00, October, 1997 B 3.1-42 Rev. 00, October, 1997 B 3.0-9 Rev. 00, October, 1997 B 3.1-43 Rev. 00, October, 1997 B 3.0-10 Rev. 00, October, 1997 B 3.1-44 Rev. 00, October, 1997 8 3.0-11 'Rev. 00, October, 1997 B 3.1-45 Rev 00, October, 1997 1 B 3.0-12 Rev. 00, October, 1997 B 3.1-46 Rev. 00, October, 1997 l B 3.0-13 Rev. 00, October, 1997 B 3.1-47 Rev. 00, October, 1997 ;

B 3.0-14 Rev. 00, October, 199' B 3.1-48 Rev. 00, October, 1997 l B 3.0-15 Rev. 00, October, 1997 B 3.1-49 Rev. 00, October, 1997 j B 3.0-16 Rev. 00, October, 1997 B 3.1-50 Rev. 00, October, 1997 B 3.1-51 Rev. 00, October, 1997 '

B 3.1-1 Rev. 00, October, 1997 B 3.1-52 Rev. 00, October, 1997 B 3.1-2 Rev. 00, October, 1997 B 3.1-53 Rev. 00, October, 1997 l

l ZION Units 1 & 2 L0EP-B 1 Rev. 00, October, 1997 l

710N STATION Tech Specs BASES LIST OF EFFECTIVE PAGES Pane No. Rev. or Amend. Page No. Rev. or Amend.

B 3.1-54 Rev. 00, October, 1997 4 3.2-35 Rev. 00, October, 1997 8 3.1-55 Rev. 00, Ntober,1997 B 3.2-36 Rev. 00, October, 1997 8 3.1-56 Rev. 00, Octoter, 1997 B 3.2-37 Rev. 00, October, 1997 B 3.1-57 Rev. 00, October, 1997 B 3.2-38 Rev. 00, October, 1997 B 3.1-58 Rev. 00, October, 1997 B 3.2-39 Rev. 00, October, 1997 B 3.1-59 Rev. 00, October, 1997 B 3.2-40 Rev. 00, October, 1997 8 3.1-60 Rev. 00, October, 1997 8 3.1-61 Rev. 00, October, 1997 B 3.3-1 Rev. 00, October, 1997 B 3.1-62 Rev. 20, October, 1997 B 3.3-2 Rev. 00, October, 1997 B 3.1-63 Rev. 00, October, 1997 8 3.3-3 Rev. 00, October, 1997 8 3.1-64 Rev. 00, October, 1997 B 3.3 4 Rev. 00, October, 1997 B 3.1-65 Rev. 00, October, 1997 B 3.3-5 Rev. 00, October, 1997 8 3.1-66 Rev. 00, October, 1997 8 3.3-6 Rev. 00, October, 1997 B 3.1 67 Rev. 00, October, 1997 B 3.3-7 Rev. 00, October, 1997 B 3.1-68 Rev. 00, October, 1997 B 3.3-8 Rev. 00, October, 1997 B 3.1-69 Rev. 00, October, 1997 B 3.3-9 Rev. 00, October, 1997 8 3.3-10 Rev. 00, October, 1997 8 3.2-1 Rev. 00, October, 1997 B 3.3-11 Rev. 00, October, 1997 B 3.2-2 Rev. 00, October, 1997 B 3.3-12 Rev. 00, October, 1997

. B 3.2-3 Rev. 00, October, 1997 8 3.3-13 Rev. 00, October, 1997 B 3.2-4 Rev. 00, October, 1997 8 3.3-14 Rev. 00, October, 1997 B 3.2-5 Rev. 00, October, 1997 B 3.3-15 Rev. 00, October, 1997 B 3.2-6 Rev. 00, October, 1997 B 3.3-16 Rev. 00, October, 1997 8 3.2-7 Rev. 00, October, 1997 8 3.3-17 Rev. 00, October, 1997 B 3.2-8 Rev. 00, October, 1997 8 3.3-18 Rev. 00, October, 1997 B 3.2-9 Rev. 00, October, 1997 B 3.3-19 Rev. 00, October, 1997 8 3.2 10 Rev. 00, October, 1997 B 3.3-20 Rev. 00, October, 1997 8 3.2-11 Rev. 00, October, 1997 B 3.3-21 Rev 00, October, 1997 8 3.2-12 Rev. 00, October, 1997 8 3.3-22 Rev. 00, October, 1997 8 3.2-13 Rev. 00, October, 1997 B 3.3-23 Rev. 00, October, 1997 B 3.2-14 Rev 00, October, 1997 8 3.3-24 Rev. 00, October, 1997 B 3.2-15 Rev. 00, October, 1997 B 3.3-25 Rev. 00, October, 1997 B 3.2-16 Rev. 00, October, 1997 B 3.3-26 Rev. 00, October, 1997 8 3.2-17 Rev. 00, October, 1997 B 3.3-27 Rev. 00, October, 1997 B 3.2-18 Rev. 00, October, 1997 B 3.3-28 Rev. 00, October, 1997 B 3.2-19 Rev. 00, October, 1997 B 3.3-29 Rev. 00, October, 1997 8 3.2-20 Rev. 00, October, 1997 B 3.3-30 Rev. 00, October, 1997 B 3.?-21 Rev. 00, October, 1997 B 3.3-31 Rev. 00, October,1997 B 3.2-22 Dev. 00, October, 1997 8 3.3-32 Rev. 00, October, 1997 8 3.2-23 Rev. 00, October, 1997 B 3.3-33 Rev 00, October, 1997 B 3.2-24 Rev. 00, October, 1997 B 3.3-34 Rev. 00, October, 1997 B 3.2-25 Rev 00, October, 1997 B 3.3-35 Rev. 00, October, 1997 B 3.2-26 Rev. 00, October, 1997 B 3.3-36 Rev. 00, October, 1997 8 3.2-27 Rev.-00, October, 1997 B 3.3-37 Rev. 00, October, 1997 B 3.2-28 Rev. 00, October, 1997 8 3.3-38 Rev. 00, October, 1997 8 3.2-29 Rev. 00, October, 1997 B 3.3-39 Rev. 00, October, 1997 B 3.2-30 Rev. 00, October, 1997 B 3.3-40 Rev. 00, October, 1997 B 3.2-31 Rev. 00, October, 1997 B 3.3-41 Rev. 00, October, 1997 B 3.2-32 Rev. 00, October, 1997 B 3.3-42 Rev. 00, October, 1997 R 3.2-33 Rev. 00, October, 1997 B 3.3-43 Rev. 00, October, 1997 B 3.2-34 Rev. 00, October, 1997 B 3.3-44 Rev. 00, October, 1997 ZION Units 1 & 2 L0EP-B 2 Rev. 00, October, 1997

l ZION STATION i

Tech Specs BASES LIST OF EFFECTIVE PAGES Pace No. Rev. or Amend. Pane No. Rey, or Amen,d,,

-B 3.3-45 Rev. 00, October, 1997 8 3.3 96 Rev. 00, October, 1997 B 3.3-46 Rev 00, October, 1997 B 3.3-97 Rev. 00, October, 1997 B 3.3 47 Rev. 00, October, 1997 8 3.3-98 Rev. 00, October, 1997 Rev. 00, October, 1997

.B 3.3-48 Rev. 00, October, 1997 B 3.3 8-3.3-49 Rev. 00, October, 1997 B 3.3-100 Rev. 00, October, 1997 B 3.3-50 Rev. 00, October, 1997 8 3.3-101 Rev. 00, October, 1997 ,

B 3.3 51. Rev. 00, October, 1997 8 3.3-102 Rev. 00, October, 1997 1 B 3.3 52 Rev. 00, October, 1997 8 3.3-103 Rev. 00, October, 1997 !

B 3.3 53 Rev. 00, October, 1997 B 3.3-104 Rev. 00, October, 1997 B 3.3-54 Rev. 00, October, 1997 B 3.3-105 Rev 00, October, 1997 l B 3.3-55 Rev. 00, October, 1997 8 3.3-106 Rev. 00, October, 1997 8 3.3-56 Rev. 00, October, 1997 8 3.3-107 Rev. 00, October, 1997 )

B 3.3-57 Rev. 00, October, 1997 B 3.3-108 Rev. 00, October, 1997 8 3.3-58 Rev. 00, October, 1997 8 3.3-109 Rev. 00, October, 1997 B 3.3-59 Rev. 00, October, 1997 B 3.3-110 Rev. 00, October, 1997 B 3.3-60 Rev. 00, October, 1997 8 3.3-111 Rev. 00, October, 1997 B 3.3-61 Rev 00, October, 1997 8 3.3-112 Rev. 00, October, 1997 B 3.3-62 Rev 00, October, 1997 B 3.3-113 Rev. 00, October, 1997 ,

B 3.3-63 Rev. 00. October, 1997 B 3.3-114 Rev. 00, October, 1997 l B 3.3-64 Rev. 00, October, 1997 B 3.3-115 Rev. 00, October, 1997 '

B 3.3-65 Rev. 00, October, 1997 B 3.3-116 Rev. 00, October, 1997 l B 3.3-66 Rev. 00, October, 1997 B 3.3-117 Rev. 00, October, 1997 B 3.3-67 Rev. 00, October, 1997 8 3.3-118 Rev. 00, October, 1997 8 3.3-68 Rev. 00, October, 1997 8 3.3-119 Rev. 00, October, 1997 B 3.3-69 Rev. 00, October, 1997 B 3,3-120 Rev 00, October, 1997 B 3.3-70 Rev. 00, October, 1997 8 3.3-121 Rev. 00, October, 1997 B 3.3-71 Rev. 00, October, 1037 8 3.3-122 Rev. 00, October, 1997 B 3.3-72 Rev. 00, October, 1997 8 3.3-123 Rev. 00, October, 1997 B 3.3-73 Rev. 00, October, 1997 B 3.3-124 Rev. 00, October, 1997 8 3.3-74 Rev 00, October, 1997 8 3.3-125 Rev. 00, October, 1997 8 3.3-75 Rev. 00, October, 1997 B 3.3-126 Rev. 00, October, 1997 B 3.3-76 Rev. 00, October, 1997 B 3.3-127 Rev. 00, October, 1997 i B 3.3-77 Rev. 00, October, 1997 B 3.3-128 Rev. 00, October, 1997 l B 3.3-78 Rev. 00, October, 1997 8 3.3-129 Rev. 00, October, 1997 ;

B 3.3-79 Rev. 00, October, 1997 8 3.3-130 Rev. 00, October, 1997 l B 3.3-80 Rev. 00, October, 1997 B 3.3-131 Rev. 00, October, 1997 j B 3.3-81 Rev. 00, October, 1997 8 3.3-132 Rev. 00, October, 1997 l B 3.3-82 Rev. 00, October, 1997 B 3.3-133 Rev. 00, October, 1997 B 3.3-83 Rev 00, October, 1997 8 3.3-134 Rev. 00, October, 1997 B 3.3-84 Rev. 00, October, 1997 B 3.3-135 Rev. 00, October, 1997 B 3.3-85 Rev. 00, October, 1997 B 3.3-136 Rev. 00, October, 1997 i B 3.3-86 Rev. 00, October, 1997 B 3.3-137 Rev. 00, October, 1997 :

B 3.3-87 Rev. 00, October, 1997 8 3.3-138 Rev. 00, October, 1997 8 3.3-88 Rev. 00, October, 1997 8 3.3-139 Rev. 00, October, 1997 B'3.3-89 Rev. 00, October, 1997 B 3.3-140 .Rev. 00, October, 1997 8 3.3-90 Rev. 00, October, 1997 B 3.3-141 Rev 00, October, 1997 B 3.3-91 Rev. 00, October, 1997 B 3.3-142 Rev. 00, October, 1997 8 3.3-92 Rev. 00, October, 1997 B 3.3-143 Rev. 00, October, 1997 1 B 3.3 Rev. 00, October, 1997 B 3.3-144 Rev. 00, October, 1997 l B 3.3-94 Rev. 00, October, 1997 8 3.3-145 Rev. 00, October, 1997 I B 3.3-95 Rev. 00, October, 1997 B 3.3-146 Rev. 00, October, 1997 ;

ZION Units-l & 2 LOEP-B 3 Rev. 00, ' October, 1997

)

- - -. , ___.- __ _ _ l

ZION STATION Tech Specs BASES LIST OF EFFECTIVE PAGES Eage No. Rev. or Amend, Page No. Rev. or Amend.

B 3.3-147 Rev. 00, October, 1997 B 3.4-31 Rev. 00, October, 1997 B 3.3-148 Rev. 00, October, 1997 B 3.4-32 Rev. 00, October, 1997 B 3.3-149 Rev. 00, October, 1997 B 3.4-33 Rev. 00, October, 1997 B 3.3-150 Rev. 00, October, 1997 B 3.4-34 Rev. 00, October, 1997 B 3.3-151 Rev. 00, October, 1997 B 3.4-35 Rev. 00, October, 1997 8 3.3-152 Rev. 00, October, 1997 8 3.4-36 Rev. 00, October, 1997 8 3.3-153 Rev. 00, October, 1997 8 3.4-37 Rev. 00, October, 1997 8 3.3-154 Rev. 00, October, 1997 B 3.4-38 Rev. 00, October, 1997 8 3.3-155 Rev. 00, October, 1997 B 3.4-39 Rev. 00, October, 1997 8 3.3-156 Rev. 00, October, 1997 B 3.4-40 Rev. 00, October, 1997 B 3.3-157 Rev. 00, October, 1997 B 3.4-41 Rev. 00, October, 1997 8 3.3-158 Rev. 00, October, 1997 B 3.4-42 Rev. 00, October, 1997 B 3.3-159 Rev. 00, October, 1997 E 3.4-43 Rev. 00, October, 1997 8 3.3-160 Rev. 00, October, 1997 9 3.4-44 Rev. 00, October, 1997 8 3.3-161 Rev. 00, October, 1997 6 3.4-45 Rev 00, October, 1997 B 3.3-162 Rev. 00, October, 1997 8 3.4-46 Rev. 00, October, 1997 B 3.3-163 Rev. 00, October, 1997 8 3.4-47 Rev. 00, October, 1997 8 3.3-164 Rev. 00, October, 1997 8 3.4-48 Rev. 00, October, 1997 B 3.3-165 Rev. 00, 0 tober, 1997 B 3.4-49 Rev. 00, October, 1997 8 3.3-166 Rev. 00, October, 1997 8 3.4-50 Rev. 00, October, 1997 8 3.4-51 Rev. 00, October, 1997 8 3.4-1 Rev. 00, October, 1997 B 3.4-52 Rev. 00, October, 1997 B 3.4-2 Rev. 00, October, 1997 B 3.4-53 Rev. 00, October, 1997 8 3.4-3 Rev. 00, October, 1997 B 3.4-54 Rev. 00, October, 1997 B 3.4-4 Rev. 00, October, 1997 8 3.4-55 Rev. 00, October, 1997 8 3.4-5 Rev. 00, October, 1997 8 3.4-56 Rev. 00, October, 1997 B 3.4-6 Rev. 00, October, 1997 B 3.4-57 Rev. 00, October, 1997 8 3.4-7 Rev. 00, October, 1997 B 3.4-58 Rev. 00, October, 1997 B 3.4 Rev 00, October, 1997 8 3.4-59 Rev. 00, October,1997 B 3.4-9 Rev. 00, October, 1997 B 3.4-60 Rev. 00, October, 1997 8 3.4-10 Rev. 00, October, 1997 B 3.4-61 Rev. 00, October, 1997 8 3.4-11 Rev. 00, October, 1997 B 3.4-62 Rev. 00, October, 1997 B 3.4-12 Rev. 00, October, 1997 B 3.4-63 Rev. 00, October, 1997 B 3.4-13 Rev. 00, October, 1997 B 3.4-64 Rev. 00, October, 1997 B 3.4-14 Rev. 00, October, 1997 B 3.4-65 Rev. 00, October, 1997 B 3.4-15 Rev. 00, October, 1997 B 3.4-66 Rev. 00, October, 1997 8 3.4-16 Rev. 00, October, 1997 B 3.4-67 Rev. 00, October, 1997 B 3.4-17 Rev. 00, October, 1997 8 3.4-68 Rev. 00, October, 1997 8 3.4-18 Rev. 00, October, 1997 B 3.4-69 Rev. 00, October, 1997 B 3.4-19 Rev. 00, October, 1997 8 3.4-70 Rev. 00, October, 1997 B 3.4-20 Rev. 00, October, 1997 B 3.4-71 Rev. 00, October, 1997 B 3.4-21 Rev. 00, October, 1997 B 3.4-72 Rev. 00, October, 1997 8 3.4-22 Rev. 00, October, 1997 B 3.4-73 Rev. 00, October, 1997 B 3.4-23 Rev. 00, October, 1997 8 3.4-74 Rev. 00, October, 1997 B 3.4-24 Rev. 00, October, 1997 8 3.4-75 Rev. 00, October, 1997 B 3.4-25 Rev. 00, October, 1997 B 3.4-76 Rev. 00, October, 1997 8 3.4-26 Rev. 00, October, 1997 8 3.4-77 Rev. 00, October, 1997 B 3.4 27 Rev. 00, October, 1997 B 3.4-78 Rev. 00, October, 1997 B 3.4-28 Rev. 00, October, 1997 B 3.4-79 Rev. 00, October, 1997 B 3.4-29 Rev. 00, October, 1997 B 3.4-80 Rev. 00, October, 1997 B 3.4-30 Rev. 00, October, 1997 B 3.4-81 Rev. 00, October, 1997 ZION Units 1 & 2 L0EP-B 4 Rev. 00, October, 1997 i

l

7 ZION STATION iech 3 pics BASES -

1.IST OF EFFECTIVE PAGES ,

haceNo. Rev. or Amend. E m No. R_eL_or Amend.

-B 3.4 82 Rev 00, October, 1997 8 3.5-28' lev. 00, October, 1997 8 3.4-83 Is,. 00, October, 1997 6 3.5-29 Rev. 00, October, 1997 B 3.4-84 Rev. 00, October, 1997 B 3.5-30 Rev.-00, October,1997 B 3.4-85 Rev. 00,' October, 1997 B 3.5-31 Rev. 00, October, 1997 8 3.4-86 Rev. 00, October, 1997 8 3.5-32 Rev. 00, October, 1997 8 3.4-87 Rev. 00, October, 1997- G 3.5-33 Rev. 00, October, 1997 B 3.4-88 Rev. 00, October, 1997 8 3.4 89 Rev. 00, October, 1997 B 3.6-1 Rev. 00, October, 1997 8 3.4-90 Rev. 00, October, 1997 8 3.6-2 Rev. 00, October, 1997 8 3.4-91 Rev. 00, October, 1997 B 3.6-3 Rev. 00, October, 1997 8 3.4-92 Rev. 00, October, 1997 8 3.6-4 Rev. 00, October, 1997 8 3.4-93 Rev. 00, October, 1997 8 3.6 5 Rev. 00, October, 1997 8 3.4-94 Rev. 00, October, 1997 B 3.6-6 Rev. 00, October, 1997 B 3.4-95 Rev. 00, October, 1997 8 3.6-7 Cev. 00, October, 1997 8 3.4-96 Rev. 00, October, 1997 B 3.6-8 Rev. 00, October, 1997 8 3.4-97 Rev. 00, October, 1997 8 3.6-9 Rev. 00, October, 1997 B 3.4-98 Rev. 00, October, 1997 8 3.6-10 Rev. 00, October, 1997 B 3.4-99 Rev. 00, October, 1997 8 3.6-11 Rev. 00, October, 1997 8 3.4-100 Rev. 00, October, 1997 B 3.6-12 Rev. 00, October, 1997 B 3.4-101 Rev. 00, October, 1997 B 3.6-13 Rev. 00, October, 1997 B 3.4-102 Rev. 00, October, 1997 B 3.6-14 Rev. 00, October, 1997 B 3.4-103 Rev. 00, October, 1997 8 3.6-15 Rev. 00, October, 1997 B 3.4-104 Rev. 00, October, 1997 8 3.6-16 Rev. 00, October, 1997 8 3.6-17 Rev. 00, October, 1997 8 3.5 1 Rev. 00, October, 1997 B 3.6-18 Rev. 00, October, 1997 B 3.5 2 Rev 00, October, 1997 8 3.6-19 Rev. 00, October, 1997 8 3.5-3 Rev. 00, October, 1997 B 3.6-20 Rev. 00, October, 1997 B 3.5-4 Rev. 00, October, 1997 B 3.6-21 Rev. 00, October, 1997 B 3.5 5 Rev. 00, October, 1997 B 3.6-22 Rev. 00, October, 1997 B 3.5-6 R9v. 00, October, 1997 B 3.6-23 Rev. 00, October, 1997 8 3.5-7 Rev. 00, October, 1997 8 3.6-24 Rev. 00, October, 1997 8 3.5-8 Rev. 00, October, 1997 B 3.6-25 Rev. 00, October, 1997 B 3.5-9 Rev. 00, October, 1997 B 3.6-26 Rev. 00, October, 1997 B 3.5-10 Rev. 00, October, 1997 B 3.6-27 Rev. 00, October, 1997 B 3.5-11 Rev. 00, October, 1997 B 3.6-28 Rev. 00, October, 1997 B 3.5-12 Rev 00, October, 1997 8 3.6-29 Rev. 00, October, 1997 B 3.5-13 Rev. 00, October, 1997 B 3.6-30 Rev. 00, October, 1997 Rev. 00, October, 1997 B 3.5-14 Rev 00, October, 1997 B 3.6-31 B 3.5-15 Rev. 00, October, 1997 B 3.6-32 Rev. 00, October, 1997 B 3.5-16 Rev. 00, October, 1997 B 3.6-33 Rev. 00, October, 1997 B 3.5-17 Rev. 00, October, 1997 B 3.6-34 Rev. 00, October,1997 B 3.5-18 Rev. 00, October, 1997 8 3.6-35 Rev. 00, October, 1997 8 3.5-19 Rev. 00, October, 1997 B 3.6-36 Rev. 00, October, 1997 B 3.5-20 Rev. 00, October, 1997 B 3.6-37 Rev. 00, October, 1997 B 3.5-21 Rev. 00, October, 1997 B 3.6-38 Rev. 00, October, 1997 b 3.5-22 Rev 00, October, 1997 B 3.6-39 Rev. 00, October, 1997 B 3.5-23 Rev. 00, October, 1997 8 3.6-40 Rev. 00, October, 1997 B 3.5-24 Rev. 00, October, 1997 B 3.6-41 Rev. 00, October, 1997 8 3.5-25 Rev. 00, October, 1997 B 3.6-42 Rev. 00, October, 1997 8 3.5-26 Rev. 00, October, 1997 B 3.6-43 Rev. 00, October, 1997 B 3.5-27 Rev. 00, October, 1997 B 3.6-44 Rev. 00, October, 1997 ZION Units 1 & 2 L0EP-B 5 Rev. 00, October, 1997

.. - ~ -. - - - - ..

ZION STATION Tech Specs BASES

. LIST OF EFFECTIVE PAGES Pana No. Rey, or Amend. Pace No. Rev. or Amend.

B 3.6-45 Rev. 00, October, 1997 B 3.7-35 Rev. 00, October, 1997 B 3.6-46 Rev. 00, October, 1997 B 3.7-36 Rev. 00, October, 1997.

B 3.6-47 Rev. 00, October, 1997 8 3.7-37 Rev. 00, October, 1997 8 3.6 4B Rev. 00, October, 1997 B 3.7-38 Rev. 00, October, 1997 8 3.6-49 Rev. 00, October, 1997 B 3.7-39 Rev. 00, October, 1997 B 3.6 50 Rev. 00, October, 1997' B 3.7-40 Rev. 00, October, 1997 B 3.6-51 Rev. 00, October, 1997 8 3.7-41 Rev. 00, October, 1997 B 3.6-52 Rev. 00, October, 1997 B 3.7-42 Rev. 00, October, 1997 B 3.6-53 Rev. 00, October, 1997- B 3.7-43 Rev. 00, October, 1997 B 3.6-54 Rev. 00, October, 1997 8 3.7-44 Rev. 00, October, 1997 8 3.6 55 Rev. 00, October, 1997 B 3.7-45 Rev. 00, October, 1997 B 3.6-56 Rev. 00. October, 1997 B 3.7-46 Rev. 00, October, 1997 B 3.6-57 Rev. 00, October, 1997 B 3.7-47 Rev. 00, October, 1997 8 3.6-58 Rev. 00, October, 1997 8 3.7-48 Rev. 00, October, 1997 B 3.6-59 Rev. 00, October ,1997 B 3.7-49 Rev. 00, October, 1997 B 3.6-60 Rev. 00, October, 1997 B 3.7-50 Rev. 00, October, 1997 8 3.7-51 Rev. 00, October, 1997 B 3.7-1 Rev. 00, October, 1997 8 3.7-52 Rev. 00, October, 1997 B 3.7-2 Rev. 00, October, 1997 8 3.7-53 Rev. 00, October, 1997 B 3.7-3 Rev. 00, October, 1997 B 3.7-54 Rev. 00, October, 1997 8 3.7-4 Rev. 00, October, 1997 8 3.7-55 Rev. 00, October, 1997 8 3.7-5 Rev. 00, October, 1997 8 3.7-56 Rev. 00, October, 1997 B 3.7-6 Rev. 00, October, 1997 8 3.7-57 Rev. 00, October, 1997 B 3.7-7 Rev. 00, October, 1997 8 3.7-58 Rev. 00, October, 1997 B 3.7-8 Rev. 00, October, 1997 8 3.7-59 Rev. 00, October, 1997 B 3.7-9 Rev. 00, October, 1997 B 3.7-60 Rev. 00, October, 1997 8 3.7-10 Rev. 00, October, 1997 B 3.7-61 Rev 00, October, 1997 B 3.7-11 Rev. 00, October, 1997 B 3.7-62 Rev. 00, October, 1997 B 3.7-12 Rev. 00, October, 1997 8 3.7-63 Rev. 00, October, 1997 B 3.7-13 Rev. 00, October, 1997 B 3.7-64 Rev. 00, October, 1997 B-3.7-14 Rev. 00, October, 1997 8 3.7-65 Rev. 00, October, 1997 8 3.7-15 Rev. 00, October, 1997 8 3.7-66 Rev. 00, October, 1997 B 3.7-16 Rev. 00, October, 1997 B 3.7-67 Rev. 00, October, 1997 B 3.7-17 Rev. 00, October, 1997 8 3.7-68 Rev. 00, October, 1997 B 3.7-18 Rev. 00, October, 1997 8 3.7-69 Rev. 00, October, 1997 B 3.7-19 Rev. 00, October, 1997 B 3.7-70 Rev. 00, October, 1997 B 3.7-20 Rev. 00, October, 1997 8 3.7-71 Rev. 00, October, 1997 B 3.7-21 Rev. 00, October, 1997 B 3.7-72 Rev. 00, October, 1997 B 3.7-22 Rev. 00, October, 1997 8 3.7-73 Rev. 00, October, 1997 8 3.7-23 Rev. 00, October, 1997 B 3.7-74 Rev. 00, October, 1997 B 3.7-24 Rev. 00, October, 1997 8 3.7-75 Rev. 00, October, 1997 8 3.7-25 Rev 00, October, 1997 8 3.7-76 Rev 00, October, 1997 B 3.7-26 Rev. 00, October, 1997 B 3.7-77 Rev. 00, October, 1997 B 3.7-27 Rev. 00, October, 1997 8 3.7-78 Rev. 00, October, 1997 B-3.7-28 Rev. Or, October, 1997 B 3.7-79 Rev. 00, October, 1997 8 3.7 Rev. 00, October, 1997 B 3.7-80 Rev. 00, October, 1997 B 3.7-30 Rev. 00, October, 1997 8 3.7-81 Rev. 00. October, 1997 8 3.7-31 Rev. 00, October, 1997 B 3.7-82 Rev. 00, October, 1997 8 3.7-32 Rev. 00, October, 1997 B 3.7-83 Rev. 00, October, 1997 B 3.7-33 Rev. 00, October, 1997 8 3.7-84 Rev. 00, October, 1997 B 3.7-34 Rev. 00, October, 1997 8 3.7-85 Rev. 00, October, 1997 ZION Units 1 & 2 L0EP-B 6 Rev. 00, October, 1997

. . .-~ .- . _ . ~. . - -. .. ... -

ZION STATION Tech Specs BASES LIST OF EFFECTIVE PAGES Pace No.- Rev. or Amend. Race No. Rev. or Amend.

B 3.7-86 Rev. 00, October, 1997 B 3.8-34 Rev. 00, October, 1997 8 3.7-87 Rev. 00, October, 1997 B 3.8-35 Rev. 00, October, 1997 8 3.7-88 Rev 00, October, 1997- B'3.8-36 Rev. 00, October, 1997 8 3.7-89 Rev 00, October, 1997 8 3.8-37 Rev. 00, October, 1997 8 3.7-90 Rev. 00, October, 1997 B 3.8-38 Rev. 00, October, 1997 B 3.7-91 Rev. 00, October, 1997 B 3,8-39 Rev. 00, October, 1997 B 3.7-92 Rev. 00, October, 1997 8 3.8-40 Rev. 00, October,.1997 8 3.7-93 Rev. 00, October, 1997 8 3.8-41 Rev. 00, October, 1997 B 3.7-94 Rev 00, October, 1997 B 3.8-42 Rev. 00, October, 1997 8 3.7-95 Rev. 00, October, 1997 8 3.8-43 Rev. 00, October, 1997 8 3.7-96 Rev. 00, October, 1997 8 3.8 44 Rev. 00, October, 1997 8 3.7-97 Rev. 00, October, 1997 B 3.8-45 Rev. 00, October, 1997 B 3.7-98 Rev. 00, October, 1997 B 3.8-46 Rev. 00, October, 1997 B 3.7-99 Rev. 00, October, 1997 B 3.8-47 Rev 00, October, 1997 8 3.7-100 Rev. 00, October, 1997 B 3.8-48 Rev. 00, October, 1997 B 3.7-101 Rev. 00, October, 1997 B 3.8-49 Rev. 00, October, 1997 8 3.7-102 Rev. 00, October, 1997 8 3.8-50 Rev. 00, October, 1997 B 3.8-51 Rev. 00, October, 1997 8 3.8-1 Rev. 00, October, 1997 8 3.8-52 Rev. 00, October, 1997 B 3.8-2 Rev. 00, October, 1997 B 3.8-53 Rev. 00, October,-1997 B 3.8-3 Rev. 00, October, 1997 B 3.8-54 Rev. 00, October, 1997 B 3.8-4 Rev. 00, October, 1997- B 3.8-55 Rev. 00, October, 1997 B 3.8-5 Rev. 00, October, 1997 8 3.8-56 Rev. 00, October, 1997 8 3.8-6 Rev. 00, October, 1997 B 3.8-57 Rev. 00, October, 1997 B 3.8-7 Rev. 00, October, 1997 8 3.8-58 Rev. 00, October, 1997 8 3.8 8 Rev. 00, October, 1997 8 3.8-59 Rev. 00, October, 1997 8 3.8-9 Rev 00, October, 1997 8 3.8-60 Rev. 00, October, 1997 B 3.8-10 Rev. 00, October, 1997 B 3.8-61 Rev. 00, October, 1997 B 3.8 11 Rev 00, October, 1997 8 3.8-62 Rev. 00, October, 1997 8 3.8-12 Rev. 00, October, 1997 B 3.8-63 Rev. 00, October, 1997 8 3.8-13 Rev 00, October, 1997 B 3.8-64 Rev. 00, October, 1997 8 3.8-14 Rev. 00, October, 1997 B 3.8-65 Rev. 00, October, 1997 8 3.8-15 Rev. 00, October, 1997 8 3.8-66 Rev. 00, October, 1997 8 3.8-16 Rev. 00, October, 1997 8 3.8-67 Rev. 00, October, 1997 B 3.8-17 Rev. 00, October, 1997 8 3.8-68 Rev 00, October, 1997 B 3.8-1B Rev. 00, October, 1997 B 3.8-69 Rev. 00, October, 1997 B 3.8-19 Rev. 00, October, 1997 B 3.8-70 Rev. 00, October, 1997 8 3.8-20 Rev. 00, October, 1997 8 3.8-71 Rev. 00, October, 1997 8 3.8-21 Rev. 00, October, 1997 B 3.8 72 Rev. 00, October, 1997 8 3.8 22 Rev. 00, October, 1997 B 3.8-73 Rev. 00, October, 1997 B 3.8-23 Rev 00, October, 1997 6 3.8-74 Rev 00, October, 1997 B 3.8 24 Rev. 00, October, 1997 B 3.8-75 Rev. 00, October, 1997 8 3.8-25 Rev. 00, October, 1997 B 3.8-76 Rev 00, October, 1997 B 3 8-26 Rev 00, October, 1997 B 3.8-77 Rev. 00, October, 1997 B 3.8-27 Rev. 00, October, 1997 B 3.8-78 Rev. 00, October, 1997 B 3.8-28 Rev. 00, October, 1997 B 3.8-79 Rev. 00, October, 1997 B 3.8-29 Rev. 00, October, 1997 B 3.8-80 Rev. 00, October, 1997 B 3.8-30 Rev. 00, October, 1997 8 3.8-81 Rev. 00, -October, 1997 B 3.8-31 Rev. 00, October, 1997 B 3.8-82 Rev. 00, October, 1997 B 3.8-32 Rev. 00, October, 1997 8 *,.8-83 Rev. 00, October, 1997 8 3.8-33 Rev. 00, October, 1997 .B 3.8-84 Rev. 00, October, 1997 ZION Units 1 & 2 L0EP-B 7 Rev. 00, October, 1997

ZION STATION Tech Specs BASES LIST OF EFFECTIVE PAGES Pace No. Rev. or Amend.- Pace No. Rev. or Amend.-

l B 3.8 85 Rev. 00, October, 1997 ,

B 3.8-86 Rev 00, October, 1997 )

Rev. 00, October, 1997 B 3.8-87~

B.3.8-88 Rev. 00, -October, 1997 B 3.8-89 Rev. 00, October, 1997 8 3.8-90 Rev. 00, October, 1997 8 3.8 91 Rev. 00, October. 1997 8 3.8-92 Rev. 00, October,1997 8 3.8-93 Rev. 00, October, 1997 B 3.8-94 Rev. 00, October, 1997 B 3.8-95 Rev. 00, October, 1997 8 3.8-96 Rev. 00, October, 1997 B 3.8-97 Rev 00, October, 1997 B 3.8-98 Rev 00, October, 1997 8 3.8-99 Rev. 00, October, 1997 8 3.8-100 Rev. 00, October, 1997 B 3.8-101 Rev. 00, October, 1997 E 3.8-102 Rev. 00, October, 1997 B 3.9-1 Rev. 00, October,.1997 B 3.9-2 Rev. 00, October, 1997 B 3.9-3 Rev. 00, October, 1997 8 3.0-4 Rev. 00, October, 1997 B 3.9-5 Rev. 00, October, 1997 8 3.9-6 Rev. 00, October, 1997 B 3.9-7 Rev. 00, October, 1997 8 3.9-8 Rev. 00, October, 1997-B 3.9-9 _ Rev. 00, October, 1997 8 3.9-10 Rev. 00, October, 1997 8 3.9-11 Rev. 00, October, 1997 8 3.9-12 Rev 00, October, 1997 B 3.9-13 Rev 00, October, 1997 B 3.9-14 Rev. 00, October, 1997 B 3.9-15 Rev. 00, October, 1997 B 3.9-16 Rev. 00, October, 1997 B 3.9-17 Rev. 00, October, 1997 8 3.9-18 Rev 00,- October, 1997 B 3.9-19 Rev. 00, October, 1997 B 3.9-20 Rev. 00, October, 1997 8 3.9-21 Rev. 00, October, 1997 8 3.9-22 Rev. 00, October, 1997 B 3.9-23 Rev. 00, October, 1997 B 3.9-24 Rev. 00, October, 1997 B 3.9-25 Rev. 00, October, 1997

B 3.9-26 Rev. 00, October, 1997 B 3.9-27 Rev. 00, October, 1997 l

l ZION Units 1 & 2 L0EP-B 8 Rev. 00, October, 1997 l

l l - -.

TABLE OF CONTENTS B 2.0 SAFETY LIMITS (SLs)

B 2.1.1 Rcactor Core SLs . . . . . . . . . . . . . . . . . . B 2.0-1 B 2.1.2 Reactor Coolant System (RCS) Pressure SL , . . . . . B 2.0-7 8 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY . . B 3.0-1 8 3.0 S'JRVEILLANM REQUIREME5'T (SR) APPLICABILITY . . . . . . B 3.0-11 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SH'JTDOWN MARGIN (SDH) - T, > 200* F . . . . . . . . . B 3.1-1 B 3.1.2 SHUTOOWN NARGIN (SDM)-T m s 200'F . . . . . . . . B 3.1-7 8 3.1.3- Core Reactivity . . . . . . . . . . . . . . . . . . B 3.1-11 3.1.4 Moderator Temperature Coefficient (HTC) . . . . . . B 3.1-17 3.1.5 Rod Group Alignment Limits . . . . . . . . . . . . . B 3.1-23 o 3.1.6 thutdown Bank Insertion Limits . . . . . . . . . . . B 3.1-34 8 3.1.7 Control Bank Insertion Limits . . . . . . . . . . . B 3.1-39 B 3.1.8 Rod Position Indication . . . . . . . . . . . . . . B 3.1-47 B 3.1.9 SHUTDOWN MARGIN (SDM) Test Exceptions . . . . . . . B 3.1-54 B 3.1.10 PHYSICS TESTS Exceptions . . . . . . . . . . . . . . B 3.1-61 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 Heat Flux Hot Channel Factor (Fo(Z)) . . . . . . . . B 3.2-1 B 3.2.2 Nuclear Enthalpy Rise Hot Channel Factor (F%) . . B 3.2-13 8 3.2.3 AXIAL FLUX DIFFERENCE (AFD) ... . . . . . . . . B 3.2-21 B 3.2.4 QUADRANT POWEh TILT RATIO (QPTR) . . . . . . . . . . B 3.2-31 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Trip System (RTS) Instrumentation . . . . . B 3.3-1 B 3.3.2 Engineered Safety Feature Actuation System (ESFAS)

Instrumentation . . . . . . . . . . . . . . . . B 3.3-60 8 3.3.3 Post Accident Monitoring (PAM) Instrumentation . . . B 3.3-110 B 3.3.4 Remote Shutdown System . . . . . . . . . . . . . . . B 3.3-132 B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation . . . . . . . . . . . . . . . . B 3.3-138 8 3.3.6 Containment Ventilation Isolation Instrumentation . B 3.3-145 B 3.3.7 Control Room Emergency Filtration System (CREFS)

Actuation Instrumentation . . . . . . . . . . . B 3.3-154 B 3.3.8 Fuel Handling Building Exhaust Filter System (FHBEFS) Actuation Instrumentation . . . B 3.3-159 B 3.3.9 Pipe Tunnel Exhaust Filter System (PTEFS)

Actuation Instrumentation ........ . . B 3.3-163 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits . . . . . . . . . B 3.4-1 B 3.4.2 RCS Minimum Temperature for Criticality . . . . . . B 3.4-8 8 3.4.3 RCS Pressure and Temperature (P/T) Limits . . . . . B 3.4-11 B 3.4.4 RCS Loops - MODES I and 2 . . . . . . . . . . . . . . B 3.4-19 (continued)

ZION Units 1 & 2 Bi Rev. 00, January, 1997 J

i 1

TABLE OF CONTENTS 1

B 3.4 -REACTOR COOLANT SYSTEM (RCS) (continued) l B 3.4.5 F,tS Loops-MODE 3 . . . . . . . . . . . . . . . . . B 3.4-23 j B 3.4.6 RCS Loops-MODE 4 . .-. . . . . . . . . . . . . . . B 3.4-30 -

B 3.4.7 RCS Loops-MODE 5 . . . . . . . . . . . . . . . . . B 3.4-36 l B 3.4.8 RCS Loops-Isolated . . . . ... . . . . . . . . . . B 3.4-42 l B 3.4.9 Pressurizer . . . . . . . . . . . . . . . . . . . . B 3.4-46 B'3.4.10 Pressurizer Safety Valves . . . . . . . . . . . . . B 3.4-51 B 3.4.11 Pressurizsr Power Operated Relief Valves (PORVs) . . B 3.4-56 1 B 3.4.12 Low Temperature Overpressure Protection (LTOP) . . . B 3.4-63 :

B 3.4.13 RCS Operational-LEAKAGE . . . . . . . . . . . . . . B 3.4-77 B 3.4.14 RCS Pressure Isolation Valves (PIVs) . . . . . . . . B 3.4 83 B 3.4.15 RCS Leakage Detection Instrumentation . . . . . . . B 3.4-90 8 3.4.16 RCS Specific Activity . . . . . . . . . . . . . . . B 3.4-95 B.3.4.17 RCS ~ Loop Stop Valves . . . . . . . . . . . . . . . . B 3.4-101 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.1 Accumulators . . . . . . . . . . . . . . . . . . . B 3.5-1 B 3.5.2 ECCS -0)erating . . . . . . . . . . . . . . . . . . B 3.5-10 B 3.5.3 ECCS - 51utdown (Pending) . . . . . . . . . . . . . . B 3.5-23 B 3.5.4 Refueling Water Storage Tank (RWST) . . . . . . . . B 3.5-24 B 3.5.5 Seal Injection Flow . . . . . . . . . . . . . . . . B 3.5-30 B 3.6 COMAINMENT SYSTEMS B 3.f.1 Containment . . . . . . . . . . . . . . . . . . . . B 3.6-1 B 3.h.2 Containment Air Locks . . . . . . . . . . . . . . . B 3.6-6 B 3.6.3 Containment Isolation Valves . . . . . . . . . . . B 3.6-13 B 3.6.4 Containment Pressure . . . . . . . . . . . . . . . B 3.6-23 8 3.6.5 Containment Air Temperature . . . . . . . . . . . . B 3.6-27 B 3.6.6 Containment Spray (CS) and Reactor Containment FanCooler(RCFC) Systems . . . . . . . . . . . B 3.6-31 B 3.6.7 Spray Additive System . . . . . . . . . . . . . . . B 3.6-43 B 3.6.8 Hydrogen Recombiners . . . . . . . . . . . . . . B 3.6-4B B 3.6.9 . Isolation Valve Seal Water (IVSW) System . . . . . B 3.6-55 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs) . . . . . . . . . . B 3.7-1 B 3.7.2 Main Steam Isolation Valves (MSIVs) . . . . . . . . B 3.7-7 B 3.7,3 Main Feedwater Isolation Valves (MFIVs), Main Feedwater Regulation Valves (MFRVs), and MFRV Bypass ValvesB 3.7-13 8 3.7.4 Secondary Specific Activity . . . . . . . . . . . . B 3.7-19 8 3.7.5 Auxiliary Feedwater (AFW) System . . . . . . . . . . B 3.7-23 8 3.7.6 Condensate Storage Tank (CST) . . . . . . . . . . . B 3.7-31 B 3.7.7 Coroponent Cooling Water (CCW) System . . . . . . . . B 3.7-36 B 3.7.0 Service Water System (SWS) . . . . . . . . . . . . . B 3.7-44 8 3.7.9 Control Room Emergency Filtration System (CREFS) . . B 3.7-65 8 3.7.10 Control Room Ventilation System (CRVS) . . . . . . . B 3.7-71 B 3.7.11 Pipe Tunnel Exhaust Filter System (PTEFS) . . . . . B 3.7-75 (continued) l.

! ZION Units 1 & 2 B 11 Rev. 00, January, 1997 l

l l

I - . . .

~. .- ..

TABLE OF CONTENTS B 3.7 PLANT SYSTEMS (continued)

B 3.7.12- Emergency Core Cooling System (ECCS) and Containment Spray (CS) Cubicle Exhaust Filter System (CEFS) B 3.7-80 B 3.7.13 fuel Handling Building Exhaust Filter System (FHBEFS)B 3.7-85 B 3.7.14 Fuel Storage Pool Water Level .-. . . . . . . . . . B 3.7-93

-8 3.7.15 Fuel Storage Pool Boron Concentration . . . . . . . B 3.7-96 8 3.7.16 Spent Fuel Assembly Storage . . . . . . . . . . . . B 3.7-100 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources-Operating . . . . . . . . . . . . . . . B 3.8-1 B 3.8.2 AC Sources - Shutdown . . . . . . . . . . . . . . . . B 3.8-36 B 3.8.3 Diesel Fuel Oil and Starting Air . . . . . . . . . . B 3.8-44 B 3.8.4 DC Sources-0perating . . . . . . . . . . . . . . . B 3.8-54 B 3.8.5 DC Sources - Shutdown . . . . . . . . . . . . . . . . B 3.8-66 B 3.8.6 Battery Cell Parameters . . . . . . . . . . . . . . B 3.8-71 B 3.8.7 Inverters - Operating . . . . . . . . . . . . . . . . B 3.8-78 8 3.8.8 Inverters - Shutdown . . . . . . . . . . . . . . . . B 3.8-82 B 3.8.9 Distribution Systems-Operating . . . . . . . . . . B 3.8-86 B 3.8.10 Distribution Systems - Shutdown . . . . . . . . . . . B 3.8-98 8 3.9 REFUELING OPERATIONS B 3.9.1 Boron Concentration . . . . . . . . . . . . . . . . B 3.9-1 B 3.9.2 Nuclear Instrumentation . . . . . . . . . . . . . . B 3.9-S B 3.9.3 Containment Penetrations . . . . . . . . . . . . . . B 3.9-9 B 3.9.4 Residual Heat Removal (RHR) and Coolant Circulation-High Water Level . . . . . . . . . B 3.9-16 B 3.9.5 Residual Heat Removal (RHR) and Coolant Circulation- Low Water Level . . . . . . . . . . B 3.9-20 B 3.9.6 Refueling Cavity Water Level . . . . . . . . . . . . B 3.9-2S ZION Units 1 & 2 8 iii Rev. 00, January, 1997

RTS Instrumentation-B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Trip System (RTS) Instrumentation BASES BACKGROUND The RTS initiates a unit shutdown, based on the values of selected unit parameters.:to protect against violating the core fuel design limits and Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences and to assist the Engineered Safety Features Actuation Systems (ESFAS) in mitigating accidents. .

The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RTS, as well as specifying LCOs on other reactor system parameters and equipment performance.

The LSSS, defined in this specification as the Allowable Values, in conjunction with the LCOs, establisn the threshold for prottetive system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During anticipated operational occurrences, which are those events expected to occur one or more times during the unit life, the acceptable limits are:

1. The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling (DNB);

2. Fuel centerline melt shall not occur;-and

3. The RCS pressure SL of 2735 psig shall not be exceeded.

Operation within the SLs of Specification 2.0, " Safety Limits (SLs)'," also maintains the above values-and assures that offsite dose will be within the 10 CFR 20 and 10 CFR 100 criteria during anticipated operational occurrences.

Accidents are events that are analyzed even though they are not expected to occur during the unit life. The acceptable limit during accidents is that offsite dose shall be (continued)

ZION Units 1 & 2 8 3.3-1 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES BACKGROUND maintained within an acceptable fraction of 10 CFR 100 (continued) guidelines. Different accident categories are allowed a different fraction of these guidelines, based on probability of occurrence. Meeting the acceptable dose limit for an accident category is considered as having acceptable consequences for that event.

The RTS instrumentation is segmented into four distinct but interconnected modules identified below. The RTS process is also illustrated in UFSAR Chapter 7, figure 7.2-3 (Ref. 1).

1. Field tran.;mitters or process sensors and instrumentation: provide a measurable electronic signal or contact actuation based upon the physical characteristics of the parameter being measured;

2. Signal Process Control and Protection System, including the Eagle 21 Process Protection System, Nuclear Instrumentation System (NIS), field contacts, and protection channel sets: provides analog to digital conversion, signal conditioning, bistable setpoint comparison, process algorithm actuation, compatible electrical signal output to protection system devices, and control board / control room /

miscellaneous indicaticns;

3. Relay Protection System, including input, logic, and output bays: initiates proper unit shutdown in accordance with the defined logic which is based on bistable, setpoint comparators, or contact outputs from the signal process contrei and protection system; and

4. Reactor trip switchgear, including reactor trip breakers (RTBs) and bypass breakers: provides the means to interrupt power to the control rod drive mechanisms (CROMs) and allows the rod cluster control assemblies (RCCAs), or " rods," to fall into the core and shut down the reactor. The bypass breakers allow testing of the RTBs at power.

(continued)

ZION Units 1 & 2 8 3.3-2 Rev. 00, October, 1997

.-- - _ . . . . . - . -. . . ~ . ~ _ - -.- .

RTS Instrumentation B 3.3.1 BASES ,

I BACKGROUND-- Field Transmitters or Sensors (continued)

In order to meet the design demands for redundancy and reliability, more than one,'and often as many as four, field transmitters or sensors are used to measure unit parameters.

To account for the calibration tolerances and instrument-drift, which are assumed to occur between calibrations, statistical allowances are provided in the Trip Setpoint.

The OPERABILITY of each transmitter or sensor can be evaluated when its "as found" calibration data are compared against its documented acceptance criteria.

Sianal Process Control and Protection System Generally, three or four channels of process control equipment are used for the signal processing of unit parameters measured by the field instruments. The process control equipment provides analog to' digital conversion, signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. These setpoints are discussed in UFSAR, Chapter 7 (Ref. 1), Chapter 6 (Ref. 2),

and Chapter 15 (Ref. 3). If the measured value of a unit -

parameter exceeds the predetermined setpoint, an output from-a bistable, setpoint comparator or contact is forwarded to the Relay Protection System for decision evaluation.

Channel- separation is maintained up to and through the input bays. However, not all unit parameters require four channels of sensor measurement and signal processing. Some unit parameters )rovide input only to the Relay Protection System, while ot1ers provide input to the Relay Protection System, the main control board, the unit computer, and one or more control systems.

Generally, if a parameter is used only for input to the protection circuits,_three channels with a two-out-of-three

' logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial function trip, the function is still OPERABLE with a two-out-of-two logic. If one channel fails, such that a partial function trip occurs, a trip will not occur and the function is still 0PERABLE witn a one-out-of-two logic.

(continued)

ZION Units 1 1 2- B 3.3-3 Rev. 00, Octcber, 1997

RTS InstrurGntation B 3.3.1 BASES

. BACKGROUND Sianal Process Control and Protection Svstem (continued)

Generally, if a parameter is used for input to the Relay

-Protection System and a control function, four channels with a two-out-of-four logic are sufficient to provide the required raliability and redundancy. _ The circuit must be able to withstand both an input failure to the control system, which may then require the protection function actuation, and a single failure in the othe channels providing the protection function actuation. Again, a single failure will neither cause nor prevent the protection function actuation. These requirements are described in IEEE-279-1968 (Ref. 4). The actual number of channels required for each unit parameter is specified in Reference 1.

Two logic channels are required to ensure no single random failure of a logic channel will disable the RTS. The logic channels are designed such that testing required while the reactor is at power n.ay be accomplished without causing a trip. Provisions to allow removing logic channels from_

service during maintenance are unnecessary because of the logic system's designed reliability. ,

Allowable Values and Trio Setpoints Allowable Values for most RTS functions are derived from the analytical limits contained in the safety analyses.

Allowable Values provide a conservative margin with regards to instrument uncertainties to ensure that SLs are not violated during anticipated operational occurrences and that the consequences of DBAs will be acceptable providing the unit is operated from within the LCOs at the onset of the

-event and required equipment functions as designed. For other RTS functions which do not have analytical limits, (functions 3a, 3b, 4, 5, 9, 12, 15, 22a, 22c, 22d and 22e) the Allowable Values are based on a plant specific evaluation of the functional requirement for the instrument channel. A detailed description of the methodology used to calculate Allowable Values and Trip Setpoints is provided in Ref 5.

(continued)

ZION Units 1 & 2 B 3.3-4 Rev. 00, October, 1997

. r . .,= .

RTS Instrumentation B 3.3.1 BASES BACKGROUND Allowable Values and Trio Setooints (continued)

For all functions that have an Allowable Value, except Function 22e, Turbine Impulse Pressure (P-13), the Allowable Value is based on plant-specific calculations. Specific calculations that provide Allowable Values for each applicable function in Table 3.3-1 are as follows:

Function Calculation Number 2a, 2b, 3a, 3b, 22e. 22d 22S-B-028E-0022 4, 22a 225-B-028E-0026 ;

5 225-B 028E-0025 6, 7 22S-B-004E-0122 Ba, 8b 22S-B-004E-0120 9 22S-B-004E-0119 10a, 10b 22S-B-004E-0121 12 22N-B-024E-0036 13 22N-B-024E-0037 14 225-B-OllE-0157 15 22S-B-011E-0157 22S-B-OllE-0155 The Allowable Value for Function 22e, Turbine Impulse

~

Pressure (P-13) is based on Reference 5.

If the measured value of a bistable / contact exceeds the Allowable Value, then the associated RTS function is considered inopera' 'e. Allowable Values fur RTS functions are-specified in Table 3.3.1-1.

Trip Setpoints are the nominal values at which the bistables, setpoint comparators or contact trip outputs are set. Trip Setpoints are derived from the Allowable Value.

The actual nominal Trip Setpoint entered into the bistable /comparator is more conservative than that specified

'by the Allowabit Value to acccunt for changes in random measurement errors detectable by a CHANNEL OPERATIONAL TEST (continued)

ZION Units 1 & 2 B 3.3-5 Rev. 00, October. 1997

RTS Instrumentation B 3.3.1 i

BASES BACKGROUND Allowable Values and Trio Setooints (continued) -

(C0T). One example of such a change in measurement error is !

drift during the surveillance interval. Any bistable or trip output is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CAllBRATION accuracy. If the measured value of a bistable / contact i exceeds the Trip Setpoint but is within the Allowable Value, then the associated RTS function is considered OPERACLE.

Trip Setpoints are specified in applicable plant procedures. ,

Allowable Values and Trip Setpoints are based on a ;

methodology which incorporates cil of the known ,

uncertainties applicabla for each instrument channel. A detailed description of the methodology used to calculate the Allowable Values and Trip Setpoints, including their explicit uncertainties, is provided in Reference 5.

Relav Protection System t

~

The Relay Protection System equipment is used for the decision logic processing of setpoint comparator trip.

outputs, contaci outputs and bistables outputs from the signal processing equipment. In order to meet the redundancy requirements, two trains of the Relay Protection System each perfarming the same functions, are provided, if one train is taken out of service for maintenance or test purposes, the second train will provide the reactor trip function for the unit, if both_ trains are taken out of service or placed in tast, a reactor trip will result. Each train is packaged in its own caLinet for physical and electrical separation to satisfy separation and independence requirements. The system has been designed to trip in the '

event of a loss of power, directing the unit to a safe shutdowr, condition.

(continued)

ZION Units 1 & 2 B 3.3 6 Rev. 00, October, 1997 I

l

RTS Instrumentation B 3.3.1 BASES BACKGROUND Relav Protection Systp3 (continued)

The Relay Protection System performs the decision logic for actuating a reactor trip, generates the electrical output signal that will initiate the required trip or actuation, and provides the status, permissive, and annunciator output signals to the main control room.

The bistable outputs, setpoint comparator trip outputs and i contact out)uts from the signal processing equipment are ,

sensed by tie Relay Protection System equipment and combined '

into logic matrices that represent combinations indicative of various unit upset and accident transients. If a required logic matrix combination is completed, the system will initiate a reactor trip. Examples are given in the Applicable Safety Analyses, LCO, and Applicability sections ,

of this Bases.

Reactor Trio Switchant The RTBs are in the electrical power supply line from the control rod drive motor generator set power supply to the CRDMs. Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods and control rods to fall into the core by gravity. Each RTB is equipped with a bypass breaker to allow testing of the RTB while the unit is at power. During normal operation the output from the Relay Protection System is a voltage signal that energizes the undervoltage coils in the RTBs and RTB bypass breakers, if in use. When the required logic matrix combination is completed, the Relay Protection System output voltage signal is removed, the undervoltage coils are de-energized, the breaker trip lever is actuated by the de energized undervoltage coli, and the RTBs and RTB bypass breakers are tripped open. This allows the shutdown rods and control rods to fall into the core.

In addition to the de-energization of the undervoltage coils, each RTB is equipped with a shunt trip device that is energized to trip the breaker open upon receipt of a reactor trip signal from the Relay Protection System. As such, for the RTBs either the undervoltage coil or the shunt trip mechanism is sufficient to open the RTBs thus providing a diverse trip method. The RTB bypass breakers also contain a shunt trip mechanism. However for these (continued)

ZION Units 1 & 2 B 3.3-7 Rev. 00, October, 1997 4

,r' 1 t'-'-*'*-='*-e vr'-*T- - - -'* _~'-***--*---d'w*-- F ' ' - " r ' - " - ' = - - - * ~ ~ ~ - " - ~ - - - - - ' - - - ' - - * - ' - - * ' + -

t RTS Instrumentation B 3.3.1 BASES BACKGROUND Reactor Trio Switchaear (continued) breakers the shunt trip mechanism will not trip the breaker open upon receipt of a reactor trip signal from the Relay Protection System. As such, the RTB bypass breakers do not have a diverse trip feature.

The decision logic matrix functions are described in the ,

functional diagrams included in Reference 1. In addition to the reactor. trip function, various ' permissive interlocks" -

that are associated with unit conditions are also described, t Each train has a Logic Channel Test Panel that facilitates testing of the dectcien logic matrix functions and the actuation devices while the unit is at power. When any one train is taken out of serv)ce for testing, the other train is capable of providing uniN monitoring and protection until the testing has been completed.

t APPLICABLE The RTS functions to maintain the SLs during all SAFETY ANALYSES, anticipated operational occurrences and mitigates the LCO, and consequences of DBAs in all MODES in which the Rod Control APPLICABILITY System is capable of rod withdrawal.

Each of the accidents and transients analyzed for mitigation by the RTS can be detected by one or more RTS functions. ,

The accident analyses described in Reference 3 take credit for most RTS trip functions. RTS trip functions not specifically credited in the accident analyses are retained for the overall redundancy and diversity of the RTS as required by the NRC approved licensing basis and may also serve as backups to RTS trip functions that were credited in the accident analyses.

The LC0 requires all instrumentation performing an RTS function, listed in Table 3.3.1-1 in the accompanying LCO, to be OPERABLE. Failure of any instrument renders the hffected channel (s) inoperable and reduces the redundancy of the affected functions.

The LCO generally requires OPERABILITY of three or four channels in each instrumentation function, two channels of Manual Reactor Trip in each-logic function, and two trains in each Automatic Trip Logic function. Four OPERABLE instrumentatior, channels in a two out-of-four configuration (continued)

ZION Units 1 & 2 8 3.3 8 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES APPLICABLE are required when one RTS channel is also used as a control SAFETY ANALYSES system input. This configuration accounts for the possibility of_the shared channel failing in such a manner LCO, and APPLICABILITY that it creates a transient that requires RTS action. In (continued) this case, the RTS will still provide protection, even with random failure of one of the other three protection channels. Three OPERABLE instrumentation channels in a two out of-three configuration are generally required when there is no potential for control system and protection system interaction that could simultaneously create a need for RTS trip and disable one RTS channel. The two-out of three and two-out-of-four configurations allow one channel to be tripped during maintenance or testing ,

without causing a reactor trip. Specific exceptions to the above general ph!1osophy exist and are discussed below.

Reactor Trio System Functions The safety analyses and OPERABILITY requirements applicable to each RTS function are discussed below:

1. Manual Reactor Trio The Manual Reactor Trip ensures that the control room operator can initiate a reactor trip at any time by using either of two reactor trip switches in the control room. A Manual Reactor Trip accomplishes the same results as any one of the automatic trip functions. It is used by the reactor operator to shut down the reactor whenever any parameter is rapidly trending toward its Trip Setpoint.

The LCO requires two Manual Reactor Trip channels to be OPERABLE. Each channel is controlled by a manual reactor trip switch. Each channel actuates the breakers in both trains. Two independent channels are required to be OPERABLE so that no single random failure will disable-the Manual Reactor Trip function.

In MODES 1 or 2, manual initiation of a reactor trip must be OPERABLE. These are the MODES in which the shutdown rods and/or control rods are partially or fully withdrawn from the core. In MODES 3, 4, or 5, the manual initiation function must also be OPERABLE if the shutdown rods or control rods are withdrawn or

~

(continued)

ZION Units 1 & 2 B 3.3-9 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES APPLICABLE 1. Manual Reactor Trio (continued)

SAFETY ANALYSES, LCO, and the Rod Control System is capable of withdrawing the APPLICABILITY shutdown rods or the control rods, in this condition, inadvertent control rod withdrawal is possible. In MODES 3, 4, or 5, manual initiation of a reactor trip does not have to be OPERABLE if the Rod Control System !

is not capable of withdrawing the shutdown rods or control rods. If the rods cannot be withdrawn from the core, there is no need to be able to trip the !

reactor because all of the rods are inserted. In MODE 6, neither the shutdown rods nor the control rods are permitted to be withdrawn and the CRDMs are disconnected from the control rods and shutdown rods.

Therefore, the manual initiation function is not required.

2. Power Ranoe Neutron Flux The NIS power range detectors are located external to the reactor vessel and measure neutrons leaking from -

the core. The NIS power range detectors provide input to the Rod Control System. Therefore, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation. Note that the NIS power range detectors also provide a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor trip.

Limiting further rod withdrawal may terminate the transient and eliminate the need to trip the reactor,

a. Power Ranae Neutron Flux-Hiah The Power Range Neutron Flux-High trip function ensures that protection is provided, from all power levels, against a positive reactivity excursion leading to DNB during power operations.

These can be caused by rod withdrawal or reductions in RCS temperature.

(continued)

ZION Units 1 & 2 B 3.3-10 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES APPLICABLE a. Power Ranae Neutron Flux ,!{Lqh (continued)

SAFETY ANALYSES LCO, and 1ho LC0 requires all four of the Power Range APPLICABILITY Neutron Flux-High channels to be OPERABLE.

In MODES 1 or 2, when a sositive reactivity excursion could occur, tie Power Range Neutron Flux-High trip must be OPERABLE. This function will terminate the reactivity excursion and shutdown the reactor prior to reaching a power level that could damage the fuel. In MODES 3, 4,

5. or 6, the NIS power range detectors cannot detect neutron levels in this range. In these MODES, the Power Range Neutron Flux-High does not have to be OPERABLE because the reactor is shut down and reactivity excursions into the power range are extremely unlikely. Other RTS functions and administrative controls provide protection against reactivity additions when in MODES 3, 4, 5, or 6.

b. Power Ranae Neutron Flux ,Lgy The LCO requirement for the Power Range Neutron Flux-Low trip function ensures that protection is provided against a positive reactivity excursion from low power or suberitical conditions.

The LCO requires all four of the Power Range Neutron Flux-Low channels to be OPERABLE.

In MODE 1, below the Power Range Neutron Flux e 10 setpoint, and in MODE 2, the Power Range Neutron Flux-Low trip must be OPERABLE. This function may be manually blocked by the operator when two out of four power range channels are greater than approximately 10% RTP (P-10 setpoint). This function is automatically

unblocked when three out of four power range channels are below the P 10 setpoint. Above the P 10 setpoint, positive reactivity additions are mitigated by the Power Range Neutron Flux-High trip-function.

(continued)

ZION Units 1 & 2 B 3.3-11 Rev. 00, October, 1997 2

..rm-- ~- _ - _ - _

i RTS Instrumentation B 3.3.1 BASES APPLICABLE b. Eower Ranae Neutron Flux-W (continued)

- SAFETY ANALYSES LCO, and In MODES 3, 4, 5, or 6, the Power Range Neutron APPLICABILITY Flux-Low trip function does not have to be OPERABLC because the reactor is shut down and the i NIS power rai,ge detectors cannot detect neutron ;

levels in this range. Other RTS trip functions and administrative controls provide protection against positive reactivity additions or power excursions in MODES 3, 4, 5, or 6.

3. Power Ranae Neutron Flux Rate The Power Range Neutron Flux Rate trips use the same channels as discussed for function 2 above.

a. Power Ranae Neutron Flu 2,-Hiah Positive Rate The Power Range Neutron Flux-High Positive Rate trip function ensures that protection is )rovided against rapid increases in neutron flux t1at are characteristic of sn RCCA drive rod housing rupture and the accompanying ejection of the RCCA. This function complements the Power Range Neutron Flux-High and Low trip functions to ensure that the criteria are met for a rod ejection from the power range.

The LCO requires all four of the Power Range Neutron Flux-High Positive Rate channels to be OPERABLE.

In MODES 1 or 2, when there is a potential to add a large amount of positive reactivity from a rod ejection accident (REA), the Power Range Neutron Flux-High Positive Rate trip must be OPERABLE.

In MODES 3, 4, 5, or 6, the Power Range Neutron Flux-High Positive Rate trip function does not have to be OPERABLE because other RTS trip functions and administrative controls will provide protection against positive reactivity additions.

(continued) l ' ZION Units 1 & 2 B 3.3 12 Rev. 00, October, 1997

-"'W Wv

w '

ww + ew -wwvvm-c--' --y*w +-+,v'--- -r- --

RTS Instrumentation B 3.3.1 BASES APPLICABLE b. Power Ranae Neutron Flux-Hiah Neaative Rate SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY The Power Range Neutron Flux-High Negative Rate trip function ensures that protection is provided for multiple rod drop accidents. At high power levels, a multiple rod drop accident could cause local flux peaking that would result in an nonconservative local DNBR. DNBR is defined as the ratio of the heat flux required to cause a DNB at a particular location in the core to the local heat flux. The DNBR is indicative of the margin to DNB. No credit is taken for the operation of this function for those rod drop accidents in which the local DNBRs will be greater than the limit.

The LCO requires all four Power Range Neutron Flux-High Negative Rate channels to be OPERABLE.

In MODES 1 or 2, when there is a potential for a multiple rod drop accident to occur, the Power Range Neutron Flux-High Negative Rate trip must be OPERABLE. In MODES 3, 4, 5, or 6, the Power Range Neutron Flux-High Negative Rate trip function does not have to be OPERABLE because the core is not critical and DNB is not a concern.

4. Intermediate Ranae Neutron Flux The Intermediate Range Neutron Flux trip function ensures that protection is provided against an uncontrolled RCCA bank rod withdrawal accident fr(nn a subcritical condition during startup. This trip function provides redundant protection to the Power Range Neutron Flux-Low trip function. The NIS intermediate range detectors are located external to the reactor vessel and measure neutrons leaking from the core. The NIS intermediate range detectors do not provide any input to control systems. Note that this function also provides a signal to prevent automatic and manual rod withdrawal prior to initiating a reactor tri). Limiting further rod withdrawal may terminate tie transient and eliminate the need to trip the reactor.

(continued)

ZION Units 1 & 2 B 3.3-13 Rev. 00, October, 1997 1

f RTS Instrumentation B 3.3.1 BASES -

APPLICABLE 4. Intermediate Ranae Neutron Flux (continued) i SAFETY ANALYSES, l LCO, and The LCO requires one channel of Intermediate Range APPLICABILITY Neutron Flux to be OPERABLE. One OPERABLE channel is sufficient since the Intermediate Range Neutron Flux !

trip is a backup fonction to the Power Range Neutron !

Flux Low trip and is not credited in the safety !

analysis. -

In MODE 1 below the P-10 setpoint, and in MODE 2, when there is a potential for an uncontrolled RCCA bank rod withdrawal accident during reactor startup, the Intermediate Range Neutron Flux trip must be OPERABLE.

Above the P 10 setpoint, the Power Range Neutron ,

Flux-High trip and the Power Range Neutron Flux-High ,

Positive Rate trip provide core protection for a rod i withdrawal accident. In MODES 3, 4, or 5, the Intermediate Range Neution Flux trip does not have to be OPERABLE because the control rods must be fully inserted and only the shutdown rods may be withdrawn.

The reactor cannot be started up in this condition.

The core also has the required SDN to mitigate the consequences of a positive reactivity addition accident, in MODE 6, all rods are fully inserted and the core has a required increased SDM. Also, the NIS intermediate range detectors cannot detect neutron levels present in this MODE.

5. Source Ranae Neutron Flux The LCO requirement for the Source Range Neutron Flux trip function ensures that protection is )rovided against an uncontrolled RCCA bank rod wit 1drawal accident from a subcritical condition during startup.

This trip function provides redundant protection to '

the Power Range Neutron Flux-Low trip and Intermediate l Range Neutron Flux trip functions, in MODES 3, 4, and 5, administrative controls also prevent the uncontrolled withdrawal of rods. The NIS source range detectors are located external to the reactor vessel ;

and measure neutrons leaking from the core. The NIS source range detectors do not provide any in)uts to control systems. The source range trip is t1e only RTS automatic protection function required in MODES 3, 4, and 5. Therefore, the functional capability at the specified Trip Setpoint is assumed to be available.

(continued)

ZION Units 1 & 2 B 3.3-14 Rev. 00, October, 1997 I

.. . - - - - _ - - _ ..- -- - .- = - . - - -. . -. .

I RTS Instrumentation i B 3.3.1 l RASES ,

APPLICABLE 5. Source Ranae Neutron Flux (continued)

SAFETY ANALYSES, LCO, and The LCO requires one channel of Source Range Neutron APPLICABILITY Flux to be OPERABLE. One OPERABLE channel is sufficient since the Source Range Neutron Flux tria is a backup function to the Power Range Neutron Flux .ow trip function and is not credited in the safety analysis. The LCO also requires one channel of the Source Range Neutron Flux to be OPERABLE in H0 DES 3, 4, or 5 with RTBs open. in this case, the NIS source range detectors provide control room indication.

The output of the Source Range Neutron Flux function to the RTS logic is not required OPERABLE when the Rod Control System is not capable of rod withdrawal.

The Source Range Neutron Flux function provides protection for control rod withdrawal from suberitical conditions and control rod ejection events. The NIS source range detectors also provide visual neutron flux indication in the control room.

In MODE 2 when below the P 6 setpoint during a reactor startup, the Source Range Neutron Flux trip must be OPERABLE. Above the P 6 setpoint, the Intermediate Range Neutron Flux trip and the Power Range Neutron Flux-Low trip will provide core protection for reactivity accidents. Above the P 6 setpoint, the ;

Source Range Neutron Flux trip function is manually blocked. However, the function is automatically reinstated below the P-6 setpoint, in MODES 3, 4, or 5 with the reactor shut down, the Source Range Neutron Flux trip function must also be OPERABLE. If the Rod Control System is capable of rod withdrawal, the Source Range Neutron Flux trip must be OPERABLE to provide core protection against a rod withdrawal accident. if the Rod Control System is not capable of rod withdrawal, the source range detectors are not required to trip the reactor. However, their monitoring function must be OPERABLE to monitor core neutron levels and provide indication of reactivity changes that may occur as a result of events like a boron dilution. The requirements for the NIS source range detectors in MODE 6 are addressed in LCO 3.9.2,

" Nuclear Instrumentation."

(continued)

ZION Units 1 & 2 B 3.3 15 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES i 1

APPLICABLE 6. Overtemperature AT l SAFETY ANALYSES, !

LCO, and The Overtemperature AT trip function is provided to APPLICABILITY ensure that the design limit DNBR is met. This trip (continued) function also limits the range over which the i Overpower AT trip function must provide orotection. l The inputs to the Overtemperature AT trip include pressurizer pressure, reactor coolant temperature, axial power distribution, and reactor power as indicated by loop AT assuming full reactor coolant flow. Protection from violating the DNBR limit is .

assured for those transients that are slow with f respect to delays from the core to the measurement system. The function monitors both variation in power and flow since a decrease in flow has a similar effect on AT as a power increase. The Overtemperature AT trip function uses each loop's AT as a measure of reactor power and is compared with a setpoint that is automatically varied with the following parameters:

reactor coolant average temperature-the Trip Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature

pressurizer pressure-the Trip Setpoint is varied to correct for changes in system pressure; and

axial power distribution-the Overtemperature AT Trip Setpoint is varied to account for imbalances in the axial power distribution as detected by the NIS upper and lower power range detectors.-

If axial peaks are greater than the design limit, as indicated by the difference between the upper and lower NIS power range detectors, the Trip Setpoint is reduced in accordance with Note 1 of Table 3.3.1-1.

Dynamic compensation is included for system piping delays from the core to the temperature measurement system. Lag compensation is also provided for measured AT and measured reactor coolant average temperature. These lag time constants have been accounted for in the safety analysis and provide allowance for RTO response characteristics.

(continued)

ZION Units 1 & 2 B 3.3-16 Rev. 00, October, 1997

__ ~_ _ _ _

RTS Instrumentation B 3.3.1 BASES APPLICABLE 6. Overtemperature AT (continued)

SAFETY ANALYSES, LCO, and The Overtemperature AT trip function is calculated for APPLICABILITY each loop as described in Note 1 of Table 3.3.1 1. A trip occurs if Overtemperature AT is indicated in two loops. Since the pressure and temperature signals are used for other control functions, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.

Note that this function aim provides a signal to generate a turbine runback orlor to reaching the Trip Setpoint. A turbine runbac( will reduce turbine load and reactor power. A reduction in power will normally alleviate the Overtemperature AT condition and may prevent a reactor trip.

The LCO requires all four channels of the Overtemparature AT trip function to be OPERABLE. Note that the Overtemperature AT function receives input from channels shared with other RTS functions.

Failures that affect multiple functions require entry into the Conditioas applicable to all affected functions.

In H0 DES 1 or 2, the Overtemperature AT trip must be OPERABLE to prevent DNB. In MODES 3, 4, 5, or 6, this trip function does not have to be OPERABLE because the reactor is not operating and there is insufficient heat production to be concerned about DNB.

7. Overpower AT The Overpower AT trip function ensures that protection is provided to ensure the integrity of the fuel (i.e.,

no fuel pellet melting and less than 1% cladding strain) under all possible overpower conditions. This trip function also limits the required range of the Overtemperature AT trip function and provides a backup to the Power Range Neutron Flux-High trip. The Overpower AT trip function ensures that the allowable l heat generation rate (kW/ft) of the fuel is not exceeded. It uses the AT of each loop as a measure of reactor power with a setpoint that is automatically varied with the following parameters-l (continued) l ZION Units 1 & 2 B 3.3-17 Rev. 00, October, 1997

- _ _ . _ _ . _ _ _ _ _ __ _ _ _ _ . _ _ . _ . . _ _ _ = _ _ _ _ __ __

RTS Instrumentation '

B 3.3.1 BASES APPLICABLE 7. Overpower AT (continued)

SAFETY ANALYSES, LCO, and

reactor coolant average temperature-the Trip APPLICABILITY Setpoint is varied to correct for changes in coolant density and specific heat capacity with changes in coolant temperature; and

rate of change of reactor coolant average temperature-including dynamic compensation for the delays between the core and the temperature measurement system.

Lag compensation is also provided for measured AT and measured reactor coolant average temperature. These lag time constants have been accounted for in the safety analysis and provide allowance for RTD response characteristics.

The Overpower AT trip function is calculated for each loop as per Note 2 of Table 3.3.1-1. A trip occurs if Overpower AT is indicated in two loops. Since the temperature signals are used for other control functions, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation and a single failure in the remaining channels providing the protection function actuation.

Note that this function also provides a signal to generate a turbine runback )rior to reaching the Trip Setpoint. A turbine runbac( will reduce turbine load and reactor power. A reduction in power will normally alleviate the Overpower AT condition and may prevent a reactor trip.

The LCO requires four channels of the Over)ower AT trip function to be OPERABLE. Note that tie Overpower AT trip function receives input from channels shared with other RTS functions. Failures that affect multiple functions require entry into the Conditions applicable to all affected functions.

In MODES 1 or 2, the Overpower AT trip function must be OPERABLE. These are the only times that enough heat is generated in the fuel to be concerned about the heat generation rates and overheating of the fuel.

In MODES 3, 4, 5, or 6, this trip function does not (continued) l ZION Units 1 & 2 8 3.3-13 Rev. 00, October, 1997 l

RTS Instrumentation !

B 3.3.1 BASES APPLICABLE 7. Overpower AT (continued)

SAFETY ANALYSES, i LCO, and have to be OPERABLE becau2e the reactor is not APPLICABitlTY operating and there is insufficient heat production to i be concerned about fuel overheating and fuel damage.

8. Pressurizer Pressur.t The same sensors provide input to the Pressurizer Pressure-High and -Low trips and the Overtemperature AT trip. Since the Pressurizer Pressure channels are !

also used to provide input to the Pressurizer Pressure Control System, the actuation logic must be able to withstand an input failure to the control system, which may then require the protection function actuation, and a single failure in the other channels providing the protection function actuation.

a. Pressurizer Pressure ,Lg.y The Pressurizer Pressure-Low trip function ensures that protection is provided against violating the DNBR limit due to low pressure.

The LCO requires four channels of Pressurizer Pressure-Low to be OPERABLE.

In MODE 1, when DNB is a major concern, the Pressurizer Pressure-Low trip must be OPERABLE.

This trip function is automatically enabled on incrcising power by the P-7 interlock (NIS power range P 10 or turbine impulse pressure P 13 greater than appror.imately 10% of full load equivalent). On decreasing power, this trip function is automatically blocked below P-7.

Below the P 7 setpoint, no conceivable power distributions can occur that would cause DNB concerns, t

(continued)

ZION Units 1 & 2 -B 3.3-19 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 ,

BASES APPLICABLE b. Pressurizer Pressure ,l[lah SAFETY ANALYSES, ,

LCO, and - The Pressurizer Pressure-High trip function !

APPLICABILITY ensures that protection is provided against (continued) overpressurizing the RCS. This trip function operates in conjunction with the pressurizer relief and safety valves to prevent RCS overpressure conditions.

The LCO requires four channels of the Pressurizer Pressure-High to be OPERABLE. :

The Pressurizer Pressure-High Trip Setpoint is selected to be below the pressurizer safety valve actuation pressure and above the power operated relief valve (PORV) setting. This setting minimizes challenges to safety valves while avoiding an unnS essary reactor trip for those pressure increases that can be controlled by the PORVs.

In MODES 1 or 2, the Pressurizer Pressure-High trip must be OPERABLE to help prevent RCS overpressurization and minimize challenges to the relief and safety valves. In MODES 3, 4, 5 -

or 6, the Pressurizer Pressure-High trip function does not have to be OPERABLE because transients that could cause an overpressure condition will be slow to occur. Therefore, the operator will have sufficient time to evaluate unit conditions and take corrective actions. In addition, the low temperature overpressure protection (LTOP) system provides overpressure protection in MODE 4 (below the LTOP enable temperature), MODE 5 and in MODE 6 with the reactor vessel head on.

(continued)

ZION Units 1 & 2 B 3.3 20 Rev. 00, October, 1997 l

( -. . - .

I RTS Instrumentation B 3.3.1 :

BASES l APPLICABLE 9. Pressurizer Water Level ,Bigh SAFETY ANALYSES, LCO, and The Pressurizer Water Level-High trip function APPLICABILITY provides a backup signal for the Pressurizer (continued) Pressure-High trip and also provides protection against water reitef through the pressurizer safety valves. These valves are designed to pass steam in order to achieve their design energy removal rate. A -

reactor trip is actuated prior to the pressurizer ,

becoming water solid. The LCO requires three channels of Pressurizer Water Level-High to be OPERABLE. The pressurizer level channels are used as input to the Pressurizer Level Control System. A fourth channel is not required to address control / protection interaction concerns. The level channels do not actuate the safety valves, and the high pressure r uctor trip is

, set below the safety valve setting. Therefore, with the slow rate of charging available, pressure overshoot due to level channel failure cannot cause the safety valve to lift before a reactor high pressure trip.

In MODE 1, when there is a potential for overfilling the pressurizer, the Pressurizer Water level-High trip must be OPERABLE. This trip function is automatically enabled on increasing power by the P 7 interlock. On decreasing power, this trip function is automatically blocked below P-7. Below the P-7 setpoint, transients that could r.ise the pressurizer water level will be slow and the operator will have sufficient time to evaluate unit conditions and take corrective actions.

10. Reactor Coolant Flow-h

a. Reactor Coolant Flow-Low (Sinale loop) -

The Reactor Coolant Flow-Low (Single Loop) trip function ensures that protection is provided against violating the DNBR limit due to low flow in one or more RCS loaps, while avoiding reactor trips due to normal variations in loop flow.

Above the P 8 setpoint, which is approximately 28% RTP, a loss of flow in any RCS loop will actuate a reactor trip. Each RCS loop has three ,

flow detectors to monitor flow. The flow signals are not used for any control system input.

(continued)

ZION Units 1 & 2 B 3.3 21 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES APPLICABLE a. Reactor Coolant Flow-Low (Sinale toool SAFETY ANALYSES, (continued) l.C0, and '

APPLICABILITY The LCO requires three Reactor Coolant Flow-Low channels per loop to be OPERABLE.

In MODE I above the P 8 setpoint, a loss of flow in one RCS loop could result in DNB conditions in ;

the core. In i400E 1 below the P 8 setpoint, a ,

loss of flow in two or more loops is required to actuate a reactor trip (function 10.b) because of the lower power level and the greater margin to the design limit DNBR.

b. Egaetor Coolant Flow-Low (Two Loops 1 The Reactor function Coolant ensures thatflow-Low protection (Two Loops)dedtrip is provi against violating the DNBR limit due to low flow in two or more RCS loops while avoiding reactor trips due to normal variations in loop flow.

Above the P-7 setpoint and below the P 8 L setpoint, a loss of flow in two or more loops will initiate a reactor trip. Each loop has three flow detectors to monitor flow. The flow signals are not used for any control system input.

The LCO requires three Reactor Coolant flow-Low channels per loop to be OPERABLE.

In MODE I above the P-7 setpoint and below the P 8 setpoint, the Reactor Coolant flow-Low (Two Loops) trip must be OPERABLE. Below the P-7 setpoint, all reactor trips on low flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P 7 setpoint, the reactor trip on low flow in two or more RCS loops is automatically enabled. Above the P 8 setpoint, a loss of flow in any one loop will actuate a reactor trip because of the higher power level and the reduced margin to the design limit DNBR.

1 (continued)

ZION Units 1 & 2 B 3.3-22 Rev. 00, October, 1997 l

RTS Instrumentation B 3.3.1 BASES APPLICABLE 11. Peactor Coolant Pumo (RCP) Breaker Posillpjl SAFETY ANALYSES, LCO, and Both RCP Breaker Position trip functions operate APPLICABillTY together on two sets of auxiliary contacts, with one (continued) set on each RCP breaker. These functions anticipate the Reactor Coolant Flow-low trips to avoid RCS heatup that would occur before the low flow trip actuates,

a. leact.,r Coolant Pumo Breaker Position (Sinole E Al TheRCPBreakerPosition(SingleLoop) trip function ensures that protection is provided against violating the DNBR limit due to a loss of flow in one RCS loop. 1he position of each RCP breaker is monitored. If one RCP breaker is open above the P 8 setpoint, a reactor trip is initiated. This trip function will generate a reactor trip before the Reactor Coolant Flow-Low (SingleLoop)TripSetpointisreached. ,

The LCO requires four RCP Breaker Position channels (one per RCP) to be OPERABLE.

i One OPERABLE channel per RCP is sufficient for this trip function because the RCS flow-Low trip aloae provides sufficient protection of unit SLs for loss of flow events. The RCP Breaker Position trip serves only to anticipate the low flow trip, minimizing the thermal transient associated with loss of a pump.

This function measures only the discrete position (openorclosed)oftheRCPbreaker,usinga position switch. Therefore, the function has no adjustable trip setpoint with which to associate an LSSS.

In MODE I above the P 8 setpoint, when a loss of flow in any RCS loop could result in DNB conditions in the core, the RCP Breaker Position (Single Loop) trip must be OPEP.ABLE. In MCDE 1 below the P 8 setpoint, a loss of flow in two or more loops is required to actuate a reactor trip because of the louer power level and the greater ;

margin to the design limit DNBR.

(continued)

ZION Units 1 & 2 B 3.3-23 Rev. 00, October, 1997 -

i RTS Instrumentation B 3.3.1 t BASES l l

APPLICABLE b. Reactor Coolant P_ggp Breaker Position fTwo Loons) l SAFETY ANALYSES, ;

LCO, and- TheRCPBreakerPosition(TwoLoops) trip

, APPLICABILITY function ensures that protection is provided !

(continued) tgainst violating the DNBR limit due to a loss of ,

flow in two or more RCS loops. The position of !

each RCP breaker is monitored. Above the P 7 setpoint and below the P B setpoint, a loss of ;

flow in two or more loops will initiate-a reactor ,

trip. 'This trip function will generate a reactor l trip before the Reactor Coolant Flow-Low (Two Loops)'TripSetpointisreached. !

The LCO rervires four RCP Breaker Position l channels (one per RCP) to be OPERABLE. One OPERABLE channel per RCP is sufficient for this function because the MCS Flow-Low trip alone t provides sufficient protection of unit SLs for '

loss of flew events. The RCP Breaker Position trip serves only to anticipate the low flow tri), '

minimizing the thermal transient associated witi loss of an RCP.

This function measures only the discrete position (open or closed) of the RCP breaker, using a position switch. Therefore, the function has no adjustable trip setpoint with which to associate an LSSS.

In MODE I above the P 7 setpoint and below the i P 8 setpoint, the RCP Breaker Position (Two Loops) trip must be OPERABLE. Below the P 7 ;

setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level. Above the P 7 setpoint, the reactor trip on loss of flow in two RCS-loops is automatically enabled. Above the P 8 setpoint, a loss of flow in any onc loop will ,

actuate a reactor trip because of the higher power level and the reduced margin to_ the design limit DNBR. !

(continued)

ZION Units 1 & 2 B 3.3-24 Rev. 00, October, 1997 l

.-a.,-= .- - . - - . - - - . - . - . . _ . - - - _ -

RTS Instrumentation B 3.3.1 CASES APPLICABLE 12. Undervoltaae Reactor Coolant Pumps

, SAFETY ANALYSES, LCO, and The Undervoltage RCPs reactor trip function ensures APPLICABILITY that protection is provided against violating the DNBR (continued) limit due to a loss of flow in two or more RCS loo)s.

The voltage on each RCP bus is monitored. Above tie P-7 setpoint, a loss of voltage detected on two or more RCP buses will initiate a reactor trip. This trip function will generate a reactor trip before the Reactor Coolant flow-Low (Two Loops) Trip Setpoint is reached. Time delays are incorporated into the Undervoltage RCPs channels to prevent reactor trips due to momentary electrical power transiebts.

The LCO requires four Undervoltage RCP channels (one per bus) to be OPERABLE.

In MODE I above the P 7 setpoint, the Undervoitage RCP trip must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power level . Above the P 7 setpoint, the reactor trip on loss of flow in two or more RCS loops is automatically enabled.

13. lLqderfreauency Reactor Coolant Pumos The Underfrequency RCPs reactor trip function ensures that protection is provided against violating the DNBR limit due to a loss of flow in two or more RCS loops from a major network frequency disturbance:. An underfrequency condition will slow down the pumps, thereby reducing their coastdown time following a pump trip. Tis poper coastdown time is required so that reactor heat can be removed immediately after reactor trip. The frequency of each RCP bus is monitored.

Above the P-7 setpoint, a loss of frequency detected on two or more RCP buses will trip all of the RCPs and thus initiate a reactor trip. This trip function will generate a reactor trip before the Reactor Coolant flow-Low (Two Loops) Trip Setpoint is reached. Time delays are incorporated into the Underfrequency RCPs channels to prevent reactor trips due to momentary electrical power transients.

(continued)

ZION Units 1 & 2 B 3.3 25 Rev. 00, October, 1997

RTS Instrumentation ,

B 3.3.1 ,

BASES APPLICABLE 13. 9pderfrecuency Reactor Coolant Pum (continued) i SAFETY ANALYSES, LCO, and The LCO requires four Underfrequency RCPs channels A'LICABILITY (onu per bus) to be OPERABLE. ,

, In MODE I above the P-7 setpoint, the Underfrequency :

RCPs trip must be OPERABLE. Below the P 7 setpoint, all reactor trips on loss of flow are automatically blocked since no conceivable power distributions could occur that would cause a DNB concern at this low power ,

level. Above the P-7 setpoint, the reactor trip on loss of flow in two or more RCS loops is automatically enabled.

14. }1um Generator Water level-Low low 1

The SG Water Level-Low Low trip function ensures that protection is provided against a loss of heat sink and actuates the AFW System 3rior to uncovering the SG tubes. The SGs are the leat sink for the reactor. In order to act as a heat sink, the SGs must contain a minimum amount of water. A narrow range low low level in any SG is indicative of a loss of heat sink for the reactor. The level transmitters provide input to the SG Level Control System. Control and protection interaction is addressed by the use of the diverse Steam flow /Feedwater Flow Mismatch Coincident with SG Water level Low reactor trip function. The two Mditional channels per SG of Steam flow /F;2dwater Flow Mismatch provide diverse protection against a loss of heat sink and are addressed in the Bases discussion for RTS function 15. This function also ,

perform; the ESFAS function of starting the AFW pumps on ' low low SG 1evel.

The C0 requires three channels of SG Water Level-Low Low per SG to be OPERABLE.

In MODES 1 or 2, when the reactor requires a heat sink, the SG Water Level-Low Low trip must be OPERMLE. The normal source of water for the FGs is the Main feedwater (MFW) System (not safety related).

The MFW System is only in operation in H0 DES 1 or 2'.

The AFL' System is the s0fety related backup source of l water to ensure that the SGs remain the heat sink for 1 the reactor. During normal startups and shutdowns, (continued)

ZION Units 1 A 2 B 3.3-26 Rev. 00, October, 1997 j

L , . - _ - _ ... - , _ . . . _ . _ _ _ _ _ . _ _ _ __ _ . - _ _ _ _

RTS Instrumentation ,

B 3.3.1 ,

BASES APPLICABLE 14. Steam Generator Water Level .11w_19w (continued)

SAFETY ANALYSES, LCO, and the AFW System provides feedwater to maintain SG APPLICABILITY level, in MODES 3, 4, 5, or 6, the SG Water Level-Low Low function does not have to be OPERABLE because the MFW System is not in operation and the reactor is not operating or critical. Decay heat removal is accomplished by the AFW System in MODE 3 and by the Residual Heat Removal (RHR) System in MODES 4, 5, or 6. The MFW System is in operation only in MODES 1 or 2 and, therefore, th:s trip function need only be OPEP,ABLE in these MODES.

15. Eteam Generator Wahr level-j,ow. Coincident With Steam !

Flow /Feedwater Flow Mismatch SG Water Level-tow, in conjunction with the Steam Flow /Feedwater Flow Mismatch, ensures that protection is provided against a loss of heat sink. In addition to a decreasing water level in the SG, the difference between feedwater flow and steam flow is evaluated to determine if feedwater flow is significantly less than steam flow. With less feedwater flow than steam flow, SG level will decrease at a rate dependent upon the magnitude of the difference in flow rates. There are two SG 1evel channels and two Steam flow /Feedwater Flow Mismatch channels per SG. One narrow range level channel sensing a low level _ coincident with one Steam Flow /Feedwater Flow Mismatch channel sensing flow mismatch (steam flow greater than feed flow) will actuate a reactor trip.

The LC0 requires two channels of SG Water Level-Low and two channels of Steam Flow /Feedwater Flow Mismatch per S/G to be OPERABLE.

In MODES 1 or 1, when the reactor requires a heat sink, the SG Water level-Low coincident with Steam Flow /Feedwater flow Mismatch trip must be OPERABLE.

The normal source of water for the SGs is the MFW System (not safety related). The MFW System is only in operation in MODES 1 or 2. The AFW System is the safety related backup source of water to ensure that the SGs remain the heat sink for the reactor. During normal startups and shutdowns, the AFW System provides feedwater in maintain SG 1evel. In MODES 3, 4, 5, (continued)

ZION Units : 12 B 3.3 27 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 ,

BASES APPLICABLE 15. St.eam Generator Water Level-Low. Coincident With Steam .

SAFETY ANALYSES, Flow /Feedwater Flow Mismatch (continued)

LCO, and APPLICABILITY or 6, the SG Water Level-Low coincident with Steam I Flow /Feedwater Flow Mismatch function does not have to i be OPERABLE because the MFW System is not in operation and the reactor is not operating or critical. Decay heat removal is accomplished by the AFW System in ;

MODE 3 and by the RHR System in MODES 4, 5, or 6. The MFW System is in operation only in MODES 1 or 2 and, therefore, this trip function need only be OPERABLE in these MODES.

16. Turbine Trio

a. Ig_tht. Trio-Low Auto Stoo Oil Pressure The Turbine Trip-Low Auto Stop 011 Pressure trip function anticipates the loss of heat removal ,

capabilities of the secondary system following a turbine trip. This trip function acts to minimize the pressure / temperature transient (n the reactor and is automatically enabled on increasing power by the P 'l interlock. On decreasing power, this trip function is automatically blocked below P-7. Any turbine trip from a power level below the P-7 setpoint, approximately 10% power, will not actuate a reactor trip. Three pressure switches monitor the auto stop oil pressure in the Turbine Lube Oil System. A low pressure condition sensed by -

two out-of-three pressure switches will actuate a reactor trip. These pressure switches du not provide any input to the control system. The unit is designed to withstand a complete loss of load and not sustain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure-High trip function and RCS integrity is erivired by the pressurizer safety valves.

The LCO requires three channels of Turbine Trip-Low Auto Stop 011 Pressure to be OPERABLE.

(continued)

ZION Units 1 & 2 8 3.3-28 Rev. 00, October, 1997

, ---_..----.-.,--n ,--- - - - . . - , - . - , , . ,

_ - _ - _ = - _ _ - _ -- - -- -. .- - - - _ - -

l RTS Instrumentation B 3.3.1 BASES APPLICABLE a. Turbine Trio-Low Auto Stoo Oil Prestyrj SAFETY ANALYSES, (continued)

LCO, and t APPLICABILITY Below the P-7 setpoint, a turbine trip does not actuate a reactor trip. In MODES 2, 3, 4, 5, or 6, there is no potential for a turbine trip, and the Turbine Trip-Low Auto Stop 011 Pressure trip function does not need to be OPERABLE.

b. Turbine Trio-Turbine Stoo Valve Closura The Turbine Trip-Turbine Stop Valve Closure trip function anticipates the loss of heat removal capabilities of the secondary system following a turbine trip. This trip function acts to minimize the pressure / temperature transient on -

the reactor and is automatically enabled on increasing power by the P-7 interlock.

On decreasing power, this trip function is automatically blocked below P-7. A'y turbine trip fron, a power level below the P-7 setpoint, approximately 10% power, will not &ctuate a reactor trip. The trip function anticipates the loss of secondary heat removal capability that occurs when the stop valves close. Tripping the reactor in anticipation of loss of secondary heat removal acts to minimize the pressure and temperature transient on the reactor. This trip function will not and is not required to operate in the presence of a single channel failure. The hnit is designed to withstand a complete loss of load and not custain core damage or challenge the RCS pressure limitations. Core protection is provided by the Pressurizer Pressure-High trip function, and RCS integrity is ensured by the pressurizer safety valves. This trip function is diverse to the Turbine Trip-Low Auto Stop Oil Pressure trip function. Each turbine stop valve is equipped with one limit switch that inputs to the RTS. If all four limit switches indicate that the stop valves are all closed, a reactor trip is initiated.

(continued)

ZION Units 1 & 2 B 3.3 29 Rev. 00, October, 1997 e -,. -__w. , w_- , . - , _ _.._,i

RTS Instrumentation B 3.3.1 BASES APPLICABLE b. Turbine Trio-Turbine Stoo Valve Closure SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY The LCO requires four Turbine Trip-Turbine Stop Valve Closure channels (one per valve) to be OPERABLE. All four channels must trip to cause a reactor trip.

In MODE 1 below the P 7 setpoint, a load rejection can be accommodated by the Steam Dump System. In MODES 2, 3, 4, 5, or 6, there is no potential for a load rejection, and the Turbine Trip -Stop Valve Closure trip function does not need to be OPERABLE.

17. Safety injection Input from Enoineered Safety Feature Actuation System (ESFAS)

The SI Input from ESFAS ensures that if a reactor trip has not already been generateu by the RTS, the ESFAS automatic actuation logic will initiate a reactor trip upon any signal that initiates St. This is a condition of acceptability for the LOCA. However, other transients and accidents take credit for varying levels of ESFAS performance and rely upon rod insertion, except for the most reactive rod that is assumed to be fully withdrawn, to ensure reactor shutdown. Therefore, a reactor trip is initiated every time an SI signal is present.

Trip Setpoints and Allowable Values are not applicable to this function. The SI Input is provided by a relay in the ESFAS.

The LCO requires two trains of S1 Input from ESFAS to be OPERABLE.

A reactor trip is initiated every time an SI signal is present. Therefore, this trip function must be OPERABLE in MODES 1 or 2, when the reactor is critical, and must be shut down in the event of an accident, in MODES 3, 4, 5, or 6, the reactor is not critical, and this trip function does not need to be OPERABLE.

(continued)

ZION Units-1 & 2 B 3.3-30 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES APPLICABLE 18. Reactor Trio Breakers SAFETY ANALYSES, LCO, and This tri> function applies to the RTBs exclusive of APPLICABILITY the RTB )ypass breakers and the individual trip '

(continued) mechanisms. The LCO requires two OPERABLE RTBs each associated with a singla RTS logic train that is racked in, closed, and cap ble of supplying power to the CRD System. Two OPERABLE RTBs ensure no single random failure can disable the RTS trip capability.

This trip functior must be OPERABLE in MODES 1 or 3 when the reactor is critical, in MODES 3, 4, or 5, the RTS trip function must be OPERABLE when the RTBs are closed, and the Rod Control System is capable of rod withdrawal.

19. Reactor Trio Breaker Undervoltaae and Shunt Trio Mechanisms The LCO requires both the Undervoltage and Shunt Trip Mechanisms to be OPERABLE for each RTB that is closed and OPERABLE. The trip mechanisms are not required to be OPERABLE for trip breakers that are open, racked out, incapable of supplying power to the Rod Contr(,1 System, or declared inoperable under function 18 above. OPERABILITY of both trip mechanisms on each breaker ensures that no single trip mechanism failure !

will prevent opening any breaker on a valid signal.

These trip functions must be OPERABLE in MODES 1 or 2 when the reactor is critical. in MODES 3, 4, or L, these RTS trip functions must ba OPERABLE when the RTBs are closed, and the Rod Control System is capable of rod withdrawal.

20. Reactor Trio Bvoass Breakers and Associated Undervoltaae Trio Mechanism This trip function applies to the RTB bypass breakers exclusive of the RTBs and the RTB Undervoltage and Shunt Trip Mechanisms. The LCO requires one RTB bypass breaker and its associated undervoltage trip mechanism to be OPERABLE whenever a bypass breaker is racked in and closed for bypassing an RTB. Only one "

OPERABLE RTB bypass treaker is required since only one RTB can be bypassed at a time. In this configuration (continued)

ZION Units 1 & 2 B 3.3 31 Rev. 00, October, 1997

_ - _ . - _ . . .- - ~ - _ - - - - - _ - . . _- - -- - --

RTS Instrumentation B 3.3.1 :

BASES APPLICABLE 20. Seactor Trio Bvoass Breaxers and Associated SAFETY ANALYSES, Undervoltaae Trio Mechanism (continued)

LCO, and APPLICI.BILITY the RTS is not single failure proof. As such, restrictions have been established on the length of time an RTB can be bypassed.

This trip function must be OPERABLE in MODES 1, 2, 3, 4 or 5 when an RTB ti, bypassed and the Rod Control System is capable of rod withdrawal.

21. Automatic Trio loaic The LCO requirements for the RTBs (ft...ctions 18 and 19), RTB By) ass Breakers (function 20) and Automatic Trip .ogic (function 21) ensure that means are provided to interrupt the power to allow the rods to f all into the reactor core. Each RTB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed. Each RTB is equipped with a bypass breaker along with its associated undervoltage trip coil to allow testing of the trip breaker while the unit is at power. The reactor trip signals generated by the Automatic Trip Logic cause the RTBs and associated bypass breakers to open and shut down the reactor.

The LCO requires two trains of RTS Automatic Trip Logic to be OPERABLE. Having two OPERABLE trains ensures that random failure of a single logic channel will not prevent a reactor trip.

These trip functions must be OPERABLE in MODES 1 or 2 when the reactor is critical. In MODES 3, 4, or 5, these RTS trip functions must be OPERABLE when the Rod Control System is capable of rod withdrawal.

22. Reactor Trio System Interlocks Reactor protection interlocks are provided to ensure reactor trips are in the correct configuration for the current unit status. They back up operator actions to ensure protection system Functions are not bypassed during unit conditions under which the safety analysis assumes the Functions are not bypassed. Therefore, the interlock Functions do not need tc be OPERABLE (continued)

ZION Units 1 & 2 B 3.3-32 Rev. 00, October, 1997

_=

RTS Instrumentation B 3.3.1 BASES APPLICABLE 22. Reactor Trio System Interlocks (continued)

SAFETY ANALYSES -

LCO, and when the associated reactor trip functions are outside APPLICABILITY the applicable MODES. These are: ;

a. Intermediate Ranae Neutron Flux. P 6 ,

The Intermediate Range he >. con Flux, P 6 ,

interlock is actuated when any NIS intermediate !

range channel goes approximately three decades above the minimum channel reading. If both channels drop below the setpoint, the permissive will automatically be defeated. The LCO requirement for the P 6 interlock ensures that the following Functions are performed: -

on increasing power, the P-6 interlock alleds the manual block of the NIS Source dange Neutron Flux reactor trip. This prevents a premature block of the source range trip and allows the operator to ensure that the intermediate range is OPF.RABLE prior to leaving the source range; and

on decreasing power, the P 6 interlock automatically enables the NIS Source Range Neutron Flux reactor trip.

The LCO requires two trains of Intermediate Range Neutron Flux, P-6 interlock to be OPERABLE in MODE 2 t. hen below the P 6 interlock setpoint.

Above the P 6 interlock setpoint, the NIS Source Range Neutron Flux reactor trip will be blocked, and this function will no longer be necessary.

la 'iiDE 3, 4, 5, or 6, the P 6 interlock does not have to be 0.'ERABLE because the Source Range Neutron Flux reactor trip is providing core protection,

b. Low Power Reactor Trips Block, P-1 The Low Power Reactor Trips Block, P-7 interlock is actuated by input from either the Power Range Neutron Flux, P-lo, or the Turbine Impulse (continued)

ZION Units 1 & 2 8 3.3-33 Rev. 00, October, 1997

't

-r-,,m--=---*n .,w-- - .-- -..+v-=,,- ~ew , e--., ,g -ef,_--,y e----+., -m -

-- w

RTS Instrumentation

-B 3.3.1 BASES APPLICABLE b. Low Power Reactor Trios Block. P-7 (continued)

SAFETY ANALYSES LCO, and Pressure P 13 interlock. The LCO requirement APPLICABILITY for the P-7 interlock ensures that the following functions are performed-T (1) on increasing power, the P-7 interlock automatically enables reactor trips on the following Functions:

Pressurizer Pressure-Low;

Pressurizar Water Level-High;

^

Reactor Coolant Flow-Low (Two Loops);

RCP Breaker Position (Two Loops);

Undervoltage RCPs;

Underfrequency RCPs; and

Turbine Trips.

These reactor trips are only required when operating above the P-7 setpoint (approximately 10% power). The reactor trips provide protection against violating thq DNBR limit. Below the P-7 setpoint, the RCS is capable of providing sufficient natural circulation without any RCPs running.

(?) on decreasing )ower, the P-7 interlock

automatically alocks reactor trips on the following Functions:

Pressurizer Pressure-Low;

Pressurizer Water Level-High;

Reactor Coolant Flow-Low (Two Loops);

RCP Breaker' Position (Two Loops);

a Undervoltage RCPs; (continued)

~

ZION Units 1 & 2 B 3.3-34 Rev. 00, October, 1997

i RTS Instrumentation B 3.3.1 BASES-APPLICABLE b. Low Power Reactor Trios Block. P-7 (continued)

SAFETY ANALYST.S LCO, and

Underfrequency RCPs; and APPLICABILITY

Turbine Trips. ,

The LCO requires two trains of Low Peser Reactor Trips Block, P-7 interlock to o OPD ABLE in MODE 1.

The low power trips are blocked telow the P-7 setpoint and unblocked above the P-7 setpoint.

in MODE 2, 3, 4, 5, or 6, this function does not have to be OPERABLE because the interlock performs its function when power level drops -

below 10% power, which is in MODE 1.

c. Power Ranae Neutron Flux. P-8 The Power Range Neutron Flux, P-8 interlock is actuated at approximately 28% power as determined by two-out-of-four NIS power range detectors.

The P-8 interlock automatically enables the Reactor Coolant Flow-Low (Single Loop) and RCP Breaker Position (Single Loop) reactor trips on low flow in one or more RCS loops on increasing power. The LCO requirement for this trip Function ensures that protection is provided against a loss of flow-in any RCS loop that could result in DNB conditions in the core when greater than approximately 28% power. On decreasing power, the reactor trip on low flow in any loop is automatically blocked.

The LC0 requires two trains of Power Range Neutron Flux, P-8 interlock to be OPERABLE in MODE 1.

In MODE 1, a loss of flow in one RCS loop could result in DNB conditions, so the Power Range-Heutron Flux, P-8 interlock must be OPERABLE. In MODE 2, 3, 4, 5, or 6, this Function does not have to be OPERABLE because the core is not producing sufficient power to be concerned about DNB conditions.

(continued)

- ZION Units 1 & 2 8 3.3-35 Rev. 00, October, 1997 F

RTS Instrumentation B 3.3.1 BASES APPLICABLE d. Power Ranae Neutron Flux. P-10 SAFETY ANALYSES LCO, and The Power Range Neutron Flux, P-10 interlock is APPLICABILITY actuated at approximately 10% power, as (continued) determinM by two-out-of-four N11 power range detecto.s. If power level fwlls below 10% RTP on 3 of 4 channels, the nuc car instrument trips will be automatically unblocked. The LCO requirement for the P-10 interlock ensures that the following Functions are performed:

on increasing power, the P-10 interlock allows the operator to manually block the Intermediate Range Neutron Flux reactor trip. Note that blocking the reactor trip also blocks the signal to prevent rod stop;

on increasing power, the P-10 interlock allows the operator to manually block the Power Range Neutron Flux-Low reactor trip;

on increasing power, the P-10 interlock automatically provides a backup signal to block the Source Range Neutron Flux reactor trip;

the P-10 interlock provides one of the two inputs to the P-7 interlock; and

on decreasing power, the P-10 interlock automatically enables the Power Range Neutron Flux-Low reactor trip and the Intermediate Range Neutron Flux reactor trip (and rod stop).

The LC0 requires two trains of Power Range Neutron Flux, P-10 interlock to be OPERABLE in MODE 1 or 2.

OPERABILITY in MODE 1 ensures the Function is available to perform its decreasing power Functions in the event of a reactor shutdown.

This Function must be OPERABLE in MODE 2 to ensure that core protection is provided during a startup or shutdown by the Power Range Neutron Flux-Low and Intermediate Range Neutron Flux (continued)

ZION Units 1 & 2 B 3.3-36 Rev. 00, October, 1997

RTS II.strumentation B 3.3.1 BASES APPLICABLE d. Power Ranae Neutron Flux. P-10 (continued)

SAFETY ANALYSES LCO, and reactor trips. In MODE 3, 4, 5, or 6, this APPLICABILITY Function does not have to be OPERABLE because the reactor is not at power and the Source Range Neutron Flux reactor trip provides core protection,

e. Turbine Iroulse Pressure. P-13 The Turbine Impulse Pressure, P-13 interlock is actuated when the pressure in the first stage of the high pressure turbine is greater than approximately 10% of the rated full load pressure. This is determined by one-out-of-two pressure detectors. The LC0 requirement for this function ensures that one of the inputs to the P-7 interlock is available.

The LCO requires two trains of Turbine Impulse Pressure, P-13 interlock to be OPERABLE in MODE 1.

In MODE 1, the Turbine Impulse Pressure P-13 interlock must be OPEPABLE to provide one of the inputs to the P-7 inte. lock. In MODES 2, 3, 4, 5, or 6 the P-7 interlock Function is not required to be OPERABLE, therefore the Turbine Impulse Pressure P-13 interlock is not required tu be OPERABLE.

The RTS instrumentation satisfies Criterion 3 of the NRC Policy Statement.

ACTIONS The ACTIONS have been modified by four Notes. Note I has been added to the ACTIONS to clarify the ap)lication of Completion Time rules. The Conditions of t11s Specification may be entered independently for each function listed in Table 3.3.1-1. When the Required Channels in Table 3.3.1-1 are specified on a "per X" basis (e.g., per steam line, per loop, per SG, etc.), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.

(continued)

ZION Units 1 & 2 B 3.3-37 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES ACTIONS In the event a channel's Trip Setpoint is found (continued) nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, setpoint comparator trip output, contact output.or bistable is found inoperable, then all affected functions provided by that channel must be declared inoperable and the LC0 Conditions entered for the protection function affected.

Note 2 states that entry into Conditions and Required Actions for an instrument channel made inoperable solely for the performance of required Surveillances may be delayed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months provided a second channel associated with the same function is inoperable. The purpose of this hote is to allow surveillance testing of an instrument channel when another channel for the same function is inoperable without taking the Required Actions for two inoperable channels. For example, this situation would occur if one of the four Pressurizer Pressure-Low channels was inoperable and a COT was due on an associated Pressurizer Pressure-Low channel. As allowed by the Required Actions of Condition I, the inoperable Pressurizer Pressure-Low channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. It should be noted however, that the channel remains inoperable even though it has been placed in bypass. In order to perform the required COT, the channel being tested would normally be inoperable. However, in order to avoid entering LC0 3.0.3 for two inoperable channels, ACTIONS Note 2 allows a delay for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to complete the required test.

Note 3 states that entry into Conditions and Required Actions for an inoperaule Automatic Trip Logic train, Safety Injection (SI) train, or RTB made inoperable solely for the performance of an ACTUATION LOGIC TEST may be delayed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months provided the other train in '

OPERABLE. The purpose of this Note is to provide an acceptable delay period for placing an Automatic Trip Logic train, SI train or RTB in bypass during the performance of l required surveillance testing without taking the Required Actions for an inoperable Automatic Trip Logic train, SI

=

train or RTB.

Note 4 states that entry into Conditions and Required Actions for an inoperable RTB during maintenance on the undervoltage or shunt trip mechanisms may be delayed for up (continued)

ZION Units 1 & 2 B 3.3-38 Rev. 00, October, 1997

- - . . - - - ~ -.

RTS Instrumentation B 3.3.1 BASES ACTIONS to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided the affected RTB is bypassed and the (continued) other train is OPERABLE. The purpose of this Note is to provide a short period _of time to perform maintent.nce on the trip mechanism without taking the Required Action for an inoperable RTB.

Ad Condition A applies to all RTS protection functions.

Condition A addresses the situation where one Required Channel (channel or train) for one or more functions is inoperable. The Required Action is to refer to Table 3.3.1-1 and to enter the referenced Conditions for the protection functions affected. The Completion Times and Required Actions are those from the referenced Conditions. Note that the applicable Condition specified in the table is function and MODE or other specified condition dependent and may change as plant conditions change.

B.l. B.2 and R.3 Condition B applies with no OPERABLE Source Range Neutron Flux trip channels in MODES 3, 4, or 5 with the Rod Control System not capable of rod withdrawal. With the unit in this Condition, the NIS source range channels perform a monitoring function. With no source range channels OPERABLE, operations involving positive reactivity additions shall be suspended immediately. This will preclude any power escalation. in addition to suspension of positive t eactivity additions, all valves that could add unborated water to the RCS must be closed within I hour.

The Required Action to suspend positive reactivity additions dces not preclude actions to maintain or reduce reactor coolant temperature or provide reactor coolant system makeu) provided the required SDM is maintained. The isolation of unborated water sources will preclude a boron dilution accident.

Also, the SDH must be verified every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months per SR 3.1.1.1, SM verification. With no source range-channels OPERABLE, core protection is severely reduced.

Verifying the SDM every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that the core (continued)

ZION Units 1 & 2 B 3.3-39 Rev. 00, October, 1997

-. . . . . -_. -. .- - ~ . - . - - . - - - - -- ..-. . - . -

RTS Instrumentation B 3.3.1

, - BASES ACTIONS B.I. B.2. and B.3 (continued) reactivity has not changed. Required Action B.1 precludes any positive reactivity _ additions; therefore, core reactivity should not be increasing, and a-12 hour.

Frequency is adequate. The Completion Time of once per

-12 hours is based on o>erating experience in performing the-Required Actions and tie knowledge that unit conditions will change slowly.

The Required Actions are modified by a Note allowing boration flow paths to be unisolated temporarily under administrative controls. This provision is necessary to allow reactor coolant system makeup.- These controls consist of an operator at the controls to monitor for the.

proper operation of the Reactor Make-up Control System.

.C.d

-Condition C applies to the RTBs in MODES 1 and 2 and the RTB Bypass Breakers and their associated-Undervoltage Trip Mechanisms when the-RTB Bypass Breakers are racked-in=and closed for bypassing an RTB. With one breaker inoperable, I hour is allowed to restore the breaker to OPERABLE status. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is equal to the time allowed by LCO 3.0.3 for shutdown actions in the event of a complete loss of RTS function.

D.d Condition 0 applies to the following reactor trip functions:

_ Power Range Neutron Flux-High;

Power Range Neutron Flux-Low;

Power-Range Neutron Flux-High Positive Rate;

Power Range Neutron Flux-High Negative Rate;

Overtemperature AI;

- Overpower AI; l

(continued)

ZION Units 1 & 2: B 3.3-40 Rev. 00, October, 1997

RTS Instrumentation B 3.3.l' BASES

' ACTIONS - Rd '(continued)

Pressurizer Pressure-High;

SG Water Level-Low Low; and SG Water Level-Low coincident with Steam Flow /

Feedwater Flow Mismatch.

For the SG Water Level-Low Low and SG Water Level-Low coincident with Steam flow /Feedwater Flow Mismatch functions, Condition D may be entered on a per steam generator basis.

A known inoperable channel must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Placing the channel in the tripped condition results in a partial trip conditior, requiring only one-out-of-two logic for actuation of the two-out-of-three trips and one-out-of-three logic for actuation of the two-out-of-four trips. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition is justified in WCAP-10271-P-A (Ref. 6).

Failure of a component in the Power Range Neutron Flux Channel which renders the High Flux Trip function inoperable may not affect the capability to monitor QPTR.

However, if the Power Range Neutron Flux input to QPTR is inoperable, entry into additional Conditions may be required by LCO 3.2.4, " QUADRANT POWER TILT RATIO (QPTR)."

Depending on the cause of inoperability of the channel, additional Required Actions may inc' :de reducing THERMAL POWER to s 75% RTP or monitoring QF A on an a revised Frequency.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routine surveillance testing of other channels.

The Note also allows placing the inoperable channel in the bypass condition to allow setpoint adjustments of other channels when required to reduce the setpoint in accordance with other Technical Specifications. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in Reference 6.

(continued)

ZION Units 1 & 2 B 3.3-41 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES ACTIONS LJ (continued)

Condition E applies to the SI Input from ESFAS reactor trip and the RTS Automatic Trip Logic in MODES I and 2. These actions address the train orientation of the RTS for 'hese functions. With one train inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the train to OPERABLE status. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safety function and given the low probability of an event during this interval.

fd

.;ondition F applies to the Manual Reactor Trip, and to the RTB Undervoltage and Shunt Trip Mechanisms in MODES 1 or 2.

This action addresses the train orientation of the Relay Protection System for this function. With one of these required features inoperable, the inoperable channel or mechanism must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

The Completior Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is reasonable for the Manual Reactor Trip function considering that there are two automatic actuation trains and another manual initiation channel (which is adequate to perform the safety function)

OPERABLE, and the low probability of an event occurring during this interval.

The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months for the RTB Undervoltage and Shunt Trip Mechanisms is reasonable considering that in this Condition there is one remaining diverse feature for the affected RTB, one OPERABLE RTB capable of performing the safety function and the low probability of an event occurring during this interval, ftd If the Required Action and associated Completion Time of Condition C, D, E, or F are not met, the unit must be placed in a MODE in which the LC0 does not apply. This is done by placing the unit in MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to reach MODE 3 is reasonable, based on operating experience, to reach MODE 3 in an orderly manner and (continued)

ZION Units 1 & 2 B 3.3-42 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES ACTIONS G.1 (continued) without challenging plant systems. The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is equal to the time allowed by LC0 3.0.3 for shutdown actions in the event of a complete loss of RTS function.

H.1 and H.2 Condition H applies to an inoperable Intermediate Range Neutron Flux trip channel in MODE 2 when THERMAL POWER is above the P-6 setpoint and in MODE 1 below the P-10 setpoint. Above the P-6 setpoint and below the P-10 setpoint, the NIS intermediate range channels perform the monitoring function. With no intermediate range channels OPERABLE, the Required Actions are to suspend operations involving positive reactivity additions immediately. This will preclude any power level increase since there are no OPERABLE Intermediate Range Neutron Flux channels. The Required Action to suspend positive reactivity additions does not preclude actions taken to maintain or reduce reactor coolant temperature, or provide reactor coolant system makeup provided the required SDM is maintained. The operator must also reduce THERMAL POWER below the P-6 setpoint within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Below P-6, the Source Range Neutron Flux channels will be able to perform the protective function. The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months will allow a slow and controlled power reduction to less than the P-6 setpoint and takes into account the low probability of occurrence of an event during this period that may require the protection afforded by the Intermediate Range Neutron Flux trip.

ld Condition I applies to the following reactor trip functions:

Pressurizer Pressure-Low;

Pressurizer Water level-High;

Reactor Coolant Flow-Low (Two Loops);

RCP Breaker Position (Two Loops);

(continued)

ZION Units 1 & 2 B 3.3-43 Rev. 00, October, 1997

RTS Instrumentation I B 3.3.1 l BASES 1

ACTIONS. L1 (continued)

Undervoltage RCPs;

Underfrequency RCPs;

Turbine Trip on Low Auto Stop 011 Pressure; and

Turbine Trip on Turbine Stop Valve Closure.

For the Reactor Coolant Flow-Low (Two Loops) function, Condition I may be entered on a per loop basis. For the Turbine Trip on Turbine Stop Valve Closure function, Condition I may be entered on a per valve basis.

With one channel inoperable, the inoperable channel must be placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Placing the channel in the tripped condition results in a partial trip condition requiring only one additional channel to initiate a reactor trip above the P-7 setpoint (for all the listed functions) and below the P-8 setpoint (for the Reactor Coolant Flow-Low and RCP Breaker Position functions). These functions do not have to be OPERABLE below the P-7 setpoint because there are no loss of flow trips below the P-7 setpoint. Placing the Turbine Trip-Low Auto Stop 011 Pressure function in the tripped condition results in a partial trip condition requiring only one additional Low Auto Stop 011 Pressure channel to initiate a reactor trip. For the Turbine Trip-Turbine Stop Valve closure function, all four stop valves must be tripped (not fully open) in order for the reactor trip signal to be generated. Therefore, it is acceptable to place more than one turbine stop valve closure channel in the tripped condition. With one or more channels in the tripped condition, a partial reactor trip condition exists. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition is justified in Reference 6.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routine surveillance testing of the other channels.

Installed bypass capability is not provided for the RCP Breaker Position function, Undervoltage RCP function, Underfrequency RCP function, or Turbine Trip function.

(continued)

' ZION Units 1 & 2 B 3.3-44 Rev. 00, October, 1997

. -. . - . . -- - .- -= -

RTS Instrumentation B 3.3.1 BASES ACTIONS M (continued)

Therefore, alternate bypass methods (e.g., jumpers or lifted leads) must be utilized. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in Reference 6.

L.1 If the Required Actions and associated Completion Time of Condition I are not met for the Turbine Trip on Low Auto Stop 011 Pressure or Turbine Stop Valve Closure functions, then power must be reduced below the P-7 setpoint within the next 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for reducing power is justified in Reference 6.

The Condition is modified by a Note which states the Condition is only applicable to the Turbine Trip on Low Auto Stop 011 Pressure or Turbine stop Valve Closure functions.

L.1 If the Required Actions and associated Completion Time of Condition I are not met for functions other than the Turbine Trip on Low Auto Stop 011 Pressure or Turbine Stop

. Valve Closure functions, an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to reduce THEPfiAL POWER to below P-7. Allowance of this time interval takes into consideration the redundant capability provided by the remaining redundant OPERABLE channel and the low probability of occurrence of an event during this period that may require the protection afforded by the associated functions.

The Condition is modified by a Note which states the Condition is not applicable to the Turbine Trip on Low Auto Stop 011 Pressure or Turbine Stop Valve Closure functions.

L.1 Condition L applies to the Reactor Coolant Flow-Low (Single Loop) reactor trip function and may be entered on-a per loop basis. With one channel inoperable, the inoperable channel must be placed in trip within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

(continued) l-ZION Units 1 & 2 B 3.3-45 Rev. 00, October, 1997 l

RTS Instrumentation B 3.3.1 BASES-ACTIONS. (21 (continued)

The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to' restore the channel to OPERABLE status or place in trip is justified in Reference 6.

The Required Actions are modified by a Note that allows the inoperable chennel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routine surveillance testing of the other channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in Reference 6.

M Condition M applies to the RCP Breaker Position (Single Loop) reactor trip function. There is one breaker position device ser RCP breaker. With one channel inoperable, the inoperaale channel must be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status is justified in Reference 6.

M If the Required Actions and associated Completion Time of Condition L or M are not met, then THERMAL POWER must be reduced below the P-8 setpoint within the next 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

This places the unit in a MODE where the LC0 is no longer applicable to this function. This trip function does not have to be OPERABLE below the P-8 setpoint because other RTS trip functions provide core protection below the P-8 setpoint. The 4 additional hours allowed to reduce THERMAL POWER to below the P-8 setpoint is justified in Reference 6.

0,1 Condition 0 applies to the following reactor trip functions in MODES 3, 4, or 5 with the Rod Control System capable of rod withdrawal:

Manual Reactor Trip;

RTBs; (continued)

ZION Units 1 & 2 B 3.3-46 Rev. 00, October, 1997 xm -~~ , e, -

l RTS Instrun:ntation B 3.3.1-BASES-ACTIONS Qd (continued)

RTB Undervoltage and Shunt Trip Mechanisms;

Reactor Trip Bypass Breakers and Associated Undervoltage Trip Mechanism; and

Automatic Trip Logic.

This action addresses the train orientation of the Relay Protection System for these functions. With one channel or train inoperable, the inoperable channel or train must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

The Completion Time is reasonable considering that in this Condition, the remaining OPERABLE train is adequate to perform the safaty function and given the low probability of an event occurring during this interval.

P.d If the Required Action and associated Corapletion Time of Condition 0 are not met, the unit must be placed in a MODE in which the LCO dces not apply. This is done by opening the RTBs within the next hour. The additional hour provides sufficient time to accomplish the action in an orderly manner. With the RTBs open the Rod Control System is no longer capable of rod withdrawal and these functions are no longer required.

9.d Condition Q applies to an inoperable Source Range Neutron Flux trip channel in MODE 2 below the P-6 setpoint, or in MODES 3, 4, or 5 with the Rod Control System capable of rod withdrawal. With the unit in this Condition, below P-6, the NIS source range channels perform the monitoring and protection functions. With the source range channel inoperable, the. RTBs must be opened immediately. With the RTBs open, the core is in 3 more stable condition and the unit enters Condition B.

(continued)

. ZION Units 1 & 2 B 3.3-47 Rev. 00, October, 1997

RTS Instrumentation B-3.3.1 BASES ACTIONS Bd (continued)

With one or more RTS interlock trains ino)erable the associated interlock must be verified to >e in its required ,

state for the existing unit condition within I hour.

Verifying the interlock status manually accomplishes the interlock's Function. The Completion Time of I hour is based on operating experience and the minimum amount of -

time allowed for manual operator actions. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is equal to the time allowed by LC0 3.0.3 for preparr, tion of a unit shutdown in the event of a complete loss of an RTS Function.

S,1 and T.1 If the Required Action and associated Completion Time of Condition R is not met, the unit must be placed in a MODE in which the LC0 does not apply. For the P-6 and P-10 interlocks this is done by placing the unit in MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . For the P-7, P-8 and P-13 interlocks this is done by placing the unit in MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach the required MODE from full power in an orderly manner and without challenging plant systems. The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is equal to the time allcwed by LCO 3.0.3 for completion of shutdown actions ic the event of a complete loss of an RTS Function.

U.1 When the number of inoperable channels in a trip function exceed those specified in all related Conditions associated with a trip function, then the automatic capability available to shat down the reactor is significantly reduced, and the unit is outside the safety analysis.

Therefore, LCO 3.0.3 aust be immediately entered if applicable in the current MODE of operation.

The Condition is modified by a Note which states the Condition is not applicable to the Reactor Trip System Interlocks. Required Action R.1 provides the appropriate required action for one or more required Interlock Trains inoperable. If it cannot be placed in its interlock (continued)

ZION Units 1 & 2 B 3.3-48 Rev. 00, October, 1997

RTS Instrume... tion-B 3.3.1 BASES 4 ACTIONS. M (continued)

-condition, Required Actions S.1 and T.1 will place th3 unit in a Mode where the Condition does not' apply. This ensures the interlock'functien _is in its required state within one hour or the plant is shutdown, which is equivalent to Required Action U.l.

i

\

t

(continued)

ZION Units 1 & 2 B 3.3-49 Rev. 00, October, 1997-

RTS Instrumentation B 3.3.1 BASES (continued)

SURVEILLANCE The SRs for each RTS function are identified by the SRs REQUIREMENTS column of Table 3.3.1-1 for that function.

A Note has been added to the SR Table stating that Table 3.3.1-1 determines which SRs apply to which RTS functions.

Note that each channel of process protection supplies both trains of the RTS. When testing Channel I, Train A and Train B must be examined. Similarly, Train A and Train B must be examined when testing Channel II, Channel III, and Channel IV (if applicable). The CHANNEL CALIBRATION and COTS are performed in a manner that is consistent with the assumption:; used in analytically calculating the required channd accuracies.

The protection functions with installed bypass capability, such as those processed through the Eagle 21 Process Protection System, may be tested in the trip or bypass condition. Except where explicitly permitted, administrative controls ensure two channels in the instrument protection set are not placed in the bypass condition at the same time when that instrument function is required to be OPERABLE by the Technical Specifications.

SR 3.3.1.1 Performance of the CHANNEL CHECK m ' every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that gross failure of instimtation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is a key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on

combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the (continued)

ZION Units 1 & 2 B 3.3-50 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.L.l.d (continued)

REQUIREMENTS sensor ir the signal processing equipment has drifted outside its limit. The Frequency is based on operating experienta that demonstrates chtnnel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.1.2 SR 3.3.1.2 compares the calorimetric heat balance calculation to the NIS channel output every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If the calorimetric exceeds the NIS channel output by

> 2% RTP, the NIS is not declared inoperable, but the gain on the NIS power range channel is adjusted to match the results of the calorimetric he .t balance. If the NIS channel output cannot be properly adjusted, the channel is declared inoperable.

SR 3.3.1.2 is modified by a Note which states that this Surveillance is required only if reactor power is a 40% RTP and that 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is allowed for performing the first Surveillance after reaching 40% RTP. At lower power levels, calorimetric data are inaccurate.

The Frequency of every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is adequate. It is based on unit operating experience, considering instrument reliability and operating history data for instrument drift. Together these factors demonstrate the change in the absolute difference between NIS and heat balance calculated powers rarely exceeds 2% in any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period.

In addition, control room operators periodically monitor redundant indications and alarms to detect deviations in channel outputs.

SR 3.3.1.3 SR 3.3.1.3 compares the incore system to the NIS power range channel outputs every 31 EFPD. If the absolute difference is a 3%, the NIS channel is still OPERABLE, but must be calibrated by installing new currents ubtained from the results of'the incore flux map.

-(continued)

ZION Units 1 & 2 B 3.3-51 Rev. 00, October, 1997

-.r , . -s.

l RTS Instrumentation B 3.3.1 l

BASES i

SURVEILLANCE LR 3.3.1.3 (continuad)_ j REQUIREMENTS If the NIS channel cannot be properly readjusted, the i channel is declared inoperable. This surveillance is t performed to verify the f(AI) input to the Overtemperature !

AT function. .

l A Note modifies SR 3.3.1.3. The Note states that this l Surveillance is required only if reactor power is > 90% I RTP.

l The Frequency of every 31 EFPD is adequate. It is based on ;

industry operating experience, t.onsidering instrument reliability and operating history data for instrument drift. Also, the slow changes in neutron flux during the fuel cycle can be detected during this interval.

Performance of SR 3.3.1.9 fulfills the requirement for this surveillance.

i tR 3.3.1.4 SR 3.3.1.4 is the performance of a TA00T every 31 days on a ,

STAGGERED TEST BA515. This test shall verify OPERA 31LITY l' by tripping the actuating devices and verifying required alarms and interlocks as applicable.

The RTB test shall include separate verification of the undervoltage and shunt trip mechanisms. The RTB Bypass ,

Breaker test shall include a verification of the manual i undervoltage trip mechanism only since the shunt trip mechanism for the RTB Bypass Breakers have no automatic trip input signa'. and are not credited as a dive.'se trip mechanism. :

I The Frequency of every 31 days on a STAGGERED TEST BASIS is adequate. It is based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.1.5 )

SR 3.3.1.5 is the performance of an ACTUATION LOGIC TEST. l The logic relays are tested avery 31 days on a STAGGERED TEST BASIS using the Logic Channel Test Panel. The RTB 1

(continued) !

ZION Units 1 & 2 B 3.3-52 Rev. 00, October, 1997 l

i

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE }R 3.3.1.5 (continued)

REQUIREMENTS Bypass Breaker for the train being tested is racked-in and the test panel selector switch placed in the Block Trip position thus preventing an inadvertent actuation. Through the Logic Channel Test Panel, logic combinations are tested for each required protection function.

The Frequency of every 31 days on a STAGGERED TEST BASIS is adequate. It is based on industry operating experience considering instrument reliability and operating history data.

SR 3.3.1.5 is modified by four Notes.

Note 1 exempts performance of the actuation logic interlock associated with the two loop loss of reactor coolant fiow, and two loop RCP breaker position trips when reactor power is above the P-8 interlock. The RPS Logic design precludes testing of these function above the P-8 interlock. Note 1 exempts performance of these functions below P-8 until power has been reduced to less than the P-8 interlock in excess of 7 days while remaining in the MODE of Applicability. If power is to be maintained above the P-7 interlock and below the P-8 interlock for more than 7 days, then the testing required by this surveillance must be performed prior to the expiration of the 7 day limit. The delay of "until 7 days after reducing power below P-8" allows transition into the MODE of Applicability (above the P-7 interlock but below the P-8 interlock) for the two loop loss of reactor coolant flow, and two loop RCP breaker position trips without resulting in an SR 3.0.4 violation.

Note 2 exempts the performance of Reactor Trip Bypass Breaker testing every 31 days on a STAGGERED TEST BASIS.

Actuation logic testing of the Reactor Trip Bypass Breaker cannot be performed without inducing a reactor trip and as such, is performed on an 18 month Frequency.

Note 3 exempts the performance of logic testing for the Safety Injection Input from Engineered Safety Feature Actuation System every 31 days on a STAGGERED TEST BASIS.

Actuation logic testing of the Safety Injection Input from Engineered Safety Feature Actuation System cannot be performed without inducing a reactor trip and as such, is performed on an 18 month Frequency.

(continued)

ZION Units 1 & 2 8 3.3-53 Rev. 00, October, 1997

RTS Instrumentation-B 3.3.1-BASES-SURVEILLANCE SR ~1.3.1.5 (continued)

REQUIREMENTS Note 4 exempts the performance of logic testing for Source i

Range Instrumentation until twelve hours after reducing the power below the P-6 setpoint. The delay of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reducing power balow P-6 allows a normal shutdown to be completed and the unit to enter the MODE of Applicability for this surveillance without a delay to perform the testing required by this surveillance. The MODE of-Applicability for this surveillance is MODE 2 < P-6 for the source range channels. The Frequency of 31 days on a Staggered Test Basis applies if the plant remains in the MODE of Applicability after the initial performance of the surveillance, or after reducing power below P-6 for more than 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . If power is to be maintained < P-6 for more than 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , then logic testing for Source Range Instrumentation required by this surveillance must be performed prior to the expiration of the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months limit.

Once the unit u in MODE 3 with the Rod Control System not capable of rod withdrawal, this sury?illance is no longer required. Prior to entering the Source Range Mode of Applicability, the logic testing for Source Range Instrumentation must be current (performed within 31 days STB).

SR 3.3.1.6 SR 3.3.1.6 is the performance of a COT every 92 days. A COT is performed on each required channel to ensure the entire channel will perform the intended function.

Setpoints must be within the Allowable Values specified in Table 3.3.1-1.

The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology. Any setpoint adjustments shall be left set consistent with the assumptions of the current unit specific setpoint methodology.

The "as found" and "as left" values must also be recorded and reviewed for consistency with the assumptions of Reference 6 when applicable.

The frequency of 92 days is justified in Reference 6.

(continued)

ZION Units 1 & 2 B 3.3-54 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.7 REQUIREMENTS (continued) SR 3.3.1.7 is the performance of a COT as described in SR 3.3.1.6. SR 3.3.1.7 is modified by two Notes that provide a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months delay in the reqbiremer.t to perform this surveillance. The delay of "4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after_ reducing power below P-10" (applicable to intermediate range channels) and.

"4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after reducing power below P-6" (applicable to source ranga channels) allows a normal shutdown to be completed and the unit removed from the MODE of Applicability for this surveillance without a delay to perform the testing required by this surveillance.- The

, MODE of Appilcability for this surveill .nce is MODE 1 < P.-

10 and MODE 2 for the interr.iediate range channels, and MODE 2 < P-6 for the source range channels. The Frequency of 92 days ap) lies if the plant remiins in the MODE of Applica)ility after the initial performance of the surveillance and prior to exceeding P-6 or P-10, or after reducing power below P-10 or P-6 for more than 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . If power is to be maintained < P-10 or < P-6 for more than 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , then the testing required by this surveillance must be performed prior to the expiration of the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months limit. Once the unit is in MODE 3, this surveillance is no longer required.

Four hours is a reasonable time to complete the required testing or place the unit in a MODE where this surveillance is no longer required. This test ensures that the NIS source and intermediate range channels sre OPERAPLE prior to taking the reactor critical and after reducing power into the applicable MODE (< P-10 or < P-6) for periods > 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

SR 3.3.1.8 SR 3.3.1.8 is the performance of a CHANNEL CALIBRATION for the NIS power range channels and is performed every 92 days. A CHANNEL CALIBRATION is a complete check of the instrument loop. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. The SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION.

(continued)

ZION Units l~& 2 B 3.3-55 Rev. 00, October, 1997

RTS Instrmentation U 3.3.1 B/.3ES '

SURVEILLANCE- SR 3.3.1.8 (continued)

REQUIREMENTS CHANNEL CALIBRATION measurement and setpoint error determination and readjustment mutt be performed consistent-with the assumptions of the unit specific setpoint methodology. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology.

The Frequency of 92 days is based on operating experience which has shown these components usually pass the Surveillance when performed on the 92 day Frequency.

SR 3.3.1.9 SR 3.3.1.9 is a calibration of the excore channels to the incore channels. If the measurements do not agree, the excore channels are not declared inoperable but must be-calibrated to agree with the incore detector measurements.

This is accomplished by installing new currents obtained from the results of the incore flux map. If the excore channels cannot be adjusted, the channels are declared inoperable. This surveillance is performed to verify the f(AI) input to the Overtemperature AT function.

A Note modifies SR 3.3.1.9. The Note states that this Surveillance is required only if reactor power is > 90%

RTP.

The Frequency of 92 EFPD is adequate based on industry operating experience considering instrument reliability and operating history data for instrument drift. Performance of this SR also fulfills the requirement for SR 3.3.1.3.

SR 3.3.1.10 A CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor, and is performed every 18 months. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

In addition, the test shall include verification that the time constants are adjusted to the prescribed values where applicable.

(continued)

ZION Units 1 & 2 B 3.3-56 Rev. 00, Octobe'r, 1997

J4 4--- 4.&- J-Am- m e i-s Li I---W --4-44-L- E e+44, A h'-- -+J-d-.

---w-e-- is % _

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.10 (continued)

REQUIREMENTS CHANNEL CALIBRATIONS measurement and setpoint error determination and readjustment must be performed consistent with the assumptions of the unit specific setpoint methodology. The difference between the current "as found" values. and the previous test "as left" values must be consistent with the methodology drift allowance used in the setpoint methodology.

The Frequency of 18 months is based on the assumption of an 18 month calibration interval in the determination of the magnitude of equipment drift in the setpoint methodology.

SR 3.3.1.11 SR 3.3.1.11 is the performance of a CHANNEL CALIBRATION, as described in SR 3.3.1.8, and is applicable to the source and intermediate range channels. This SR is performed every 18 months. The SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION.

The Frequency of 18 months is adequate based on operating experience considering instrument reliability and operating history data for instrument drift.

SR 3.3.1.12 SR 3.3.1.12 is the performance of a CHANNEL CALIBRATION, as described in SR 3.3.1.10 and is performed every 18 months.

This SR is modified by a Note stating that this test shall include verification of the RCS resistance temperature-detector (RTD) bypass loop flow rate.

This test will verify the rate lag compensation for flow from the core te the RTDs. This test will also include verification that the time constants are adjusted to the prescribed values where applicable.

The Frequency is justified by the assumption of an 18 month calibration interval in the determination of the magnitude of' equipment drift in the setpoint analysis.

(continued)

ZION Units 1 & 2 B 3.3-57 Rev. 00, October, 1997

RTS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.13 REQUIREMENTS (continued) SR 3.3.1.13 is the performance of a TADOT of the Manual Reactor. Trip, RCP Breaker Position, and the SI Input from ESFAS. This TADOT is performed every 18 months. The test shall verify the OPERABILITY of the Manual Reactor Trip function by independently testing _ the undervoltage and shunt trip mechanisms for the RTBs and the undervoltage trip mechanism for the RTB Bypass Breakers.

The frequency is based on the known reliability of the functions and the multichannel redundancy available, and has been shown to be acceptable through operating experience.

SR 3.3.1.14 SR 3.3.1.14 is the performance of an ACTUATION LOGIC TEST.

Reactor Protection logic and RTBs are tested avery 31 days on a STAGGERED TEST BASIS using the Logic Chainel Test Panel, as addressed in SR 3.3.1.5. An ACTUATit LOGIC TEST through to the RTB Bypass Breakers cannot be teti.ed without inducing a reactor trip, and as such is performed every 18 months. The Freauency of every 18 months is adequate based on RTB Bypass Breaker testing performed prior to use, and based on the automatic trip logic being common to the RTBs.

SR 3.3.1.15 SR 3.3.1.15 is the performance of a TAD 0T of the Turbine Trip functions. Performance of this test will ensure that the Turbine Trip function is OPERABLE. The SR is required to be performed once within 31 days pr to exceeding P-7 during a unit startup. Above P-7 the Tt. bine Trip function is not blocked and testing would result in a reactor trip.

The Frequency is based on the known reliability of the functions and has been shown to be acceptable through operating experience.

(continued)

ZION Units 1 & 2 B 3.3-58 etev . 00, October, 1997

RTS. Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.16 REQUIREMENTS (continued)

SR 3.3.1.16 is the performance of a ACTUATION LOGIC TEST of the Intermediate Range Neutron Flux P-6 Reactor Trip System Interlock. Performance of this test will ensure that the P 6 interlock function is OPERABLE. The SR is required to be performed once within 31 days prior to entering Mode 2.

Above the P_-6 interlock, testing cannot be performed.

The Frequency is based on the known reliability of the function and has been shown to be acceptable through operating experience.

REFERENCES 1. UFSAR, Chapter 7,

2. UFSAR, Chapter 6.

3. UFSAR, Chapter 15,

4. IEEE-279-1968.

5. Westinghouse Setpoint Methodology for Protection Systems Zion Units 1 and 2, Eagle 21 Version, WCAP 12582, August, 1991.

6. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.

ZION Units 1 & 2 B 3.3-59 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 B 3.3 INSTRUMENTATION B 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation BASES BACKGROUND The ESFAS initiates necessary safety systems, based on the values of selected unit parameters, to protect against violating core design limits and the Reactor Coolant System (RC5) pressure boundary, and to mitigate accidents.

The ESFAS instrumentation is segmented into three distinct but interconnected modules as identified below:

1. Field transmitters or process sensors and instrumentation: provide a measurable electronic signal or contact actuation based upon the physical characteristics of the parameter being measured;

2. Signal Processing Control and Protection System including the Eagle 21 Process Protection System, field contacts, and protection channel sets: provides analog to digital conversion, signal conditioning, bistable setpoi t comparison, process algorithm actuation, comp.tible electrical signal output to protection system devices, and control board / control roam / miscellaneous indications; and

3. Relay Protection System including input, logic, and output bays: initiates the proper unit shutdown or engineered safety feature (ESF) actuation in accordance with the defined logic which is based on bistable, setpoint comparators, or contact outputs from the signal process control and protection system.

Field Transmitters or Sensors In order to meet the design demands for redundancy and reliability, more than one, and often as mhny as four, field transmitters or sensors are used to measure unit parameters.

In many cases, field transmitters or sensors that input to the ESFAS are shared with the Reactor Trip System (RTS). In some cases, the same channels also provide control system inputs. To account for calibration tolerances and instrument drift, which are ascumed to occur between calibrations, statistical allowances are provided in the (continued) 1 ZION Units 1 & 2 B 3.3-60 Rev. 00, October, 1997 l

l

ESFAS Instrumentation B 3.3.2 BASES-BACKGROUND Field Transmitters or Sensors (continued)

Trip Setpoint. The OPERABILITY of each transmitter or sensor can be evaluated when its."as found" calibration data are compared against its documented accepthnce criteria.

Sianal Processina Control and Protection System Generally, three or four channels of process control equipment are used for the signal processing of unit pcrameters measured by the field instruments. The process control equipment provides analog to digital conversions, signal conditioning, comparable output signals for instruments located on the main control board, and comparison of measured input signals with setpoints established by safety analyses. These setpoints are discussed in UFSAR, Chapter 6 (Ref.1), Chapter 7 (Ref. 2),

and Chapter 15 (Ref. 3). If tha measured value of a unit parameter exceeds the predetermined setpoint, an output from a bistable, setpoint comparator, or contact is forwarded to the Relay Protection System for logic evaluation. Channel separation is maintained up to and through the input bays.

However, not cll unit parameters require four channels of sensor measurement and signal processing. Some unit parameters provide input only to the Relay Protection System, while others provide input to the Relay Protection System, the main control board, the unit computer, and one or more control systems.

Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If one channel fails in a direction that would not result in a partial function trip, the function is still OPERABLE with a two-out-of-two logic. If one channel fails such that a partial function trip occurs, a trip will not occur and the function is still OPERABLE with a one-out-of-two logic.

Generally, if a parameter is used for input te the Relay Protection System and a control function, fou' thannels with a two-out-of-four logic are sufficient to provide the required reliability and redundancy. The circuit must be able-to withstand both an input failure to the control system, which may then require the protection function (continued)

ZION Units 1 & 2 B 3.3-61 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 BASES DACKGROUND Sianal Processino Control and Protection System (continued) actuation, and a single failure in the other channels providing the protection function actuation. Again, a single failure will neither cause nor prevent the protection function actuation. Those requirements are described in IEEE-2)9-1968 (Ref. 4). The actual number of channels required for each unit parameter is specified in Reference 2.

Allowable Values and Trio Setpoints

- Allowable Values for most ESFAS functions are derived from the analytical limits contained in the saft,y analyses.

Allowable Values provide a conservative margin with regards to instrument uncertainties to ensure that safety limits (SLs) are not violated during anticipated operational occurrences and that the consequences of Design Basis Accidents (DBAs) will be acceptable providing the unit is operated from within the LCOs at the onset of the event and ret,utied equipment functions as designed. For other ESFAS functions which do not have analytical limits (functions 6d, 7b and 7c), the Allowable Values are based on a plant specific evaluation of the functional requirement for the instrument channel. In either case, if the measured value of a bistable / contact exceeds the Allowable Value, then the

. associated ESFAS function is considered inoperable.

Allowable Values for ESFAS functions are specified in Table 3.3.2 1.

Trip Setpoints are the nominal values at which the bistables, setpoint comparators or contact trip outputs are set. Trip Setpoints are derived from the Allowable Value, lhe actual nominal Trip Setpoint entered into the bistabie/cor.parator is reore conservative than that specified by the AllowWe Value to account for changes in random measurement errors detectable by a CHANNEL OPERATIONAL TEST (C0T). One example of such a change in measurement error is drift during the surveillance interval. Any bistable or trip ov.put is considered to be properly adjusted when the "as lef t" value is within the band for CHANNEL CAllBRATION accuracy. If the measured value of a bistable / contact exceeds the Trip Setpoint but is within the Allowable Value, then the associated ESFAS function is considered OPERABLE.

Trip Setpoints are specified in appitcable plant procedures.

(continued)

ZION Units 1 & 2 B 3.3-62 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 BASES l

BACKGROUND ellowable Values and Trio Setooints (continued)

Allowable Values and Trip Setpoints are based on a methodology which incorporates all of the known uncertainties applicable for each instrument channel. A -

detailed description of the methodology used to calculate i the Allowable Values and Trip Setpoints is provided in !

Reference 5.

i For all functions that have an Allowable Value, the Allowable Value is based on plant specific calculations.

Specific calculations that provide Allowable Values for each function in Table 3.3 2 are as follows: :

Function Calculation Numi'er Ic 2c, 3b(3), 4c 225 B-006E-004B Id. 7J1 225 B 004E 0120 le 225 B 011E-0156 l If, 4d 22S 0 OllE-0155 225 B 004E-0122 19, 4e 225 B OllE-0155 22S-B OllE 0156 Sb 6b 22S B OllE-0157 6c 22N B 024E 0036 7c 22S-B 004E 0122 Relav Protection Systee The Relay Protection System equipment is used for the decision logic processing of bistable outputs, setpoint comparators trip outputs and contact outputs from the signal processing equipment, in order to m o t the redundancy requirements, two trains of the Relai Protection System, (continued) 210N Units 1 & 2 B 3.3-63 Rev. 00, October, 1997

-- - . =.._. - ._- - _ - - . _ _ - _ - - - . - _ _ - - - .

ESFAS Instrumentation ,

B 3.3.2 L

t BASES ,

BACKGROUND Relav Protection System (continued) each performing the same functions, are provided, if one train is thken out of service for maintenance or test purposes, the second train will provide ESF actuation for the unit. Each train is packaged in its own cabinet for physical and electrical separation to satisfy separation and independence requirements. !

The Relay Protection System performs the decision logic for ;

most ESF equipment actuation, generates the electrical output signals that initiate the recuired actuation, and provides the status, permissive, anc annunciator output signals to the main control room.

The bistable outputs, setpoint comparator trip outputs and contact outauts from the signal processing equipment are sensed by tie Relay Protection System equipment and combined into logic matrices that represent combinations indicative of various unit upset and accident transients. If a required logic matrix combination is completed, the sysiem will send actuation signals via master and slave relays to those components whose aggregate function best serves to alleviate the condition and restore the unit to a safe condition. Examples are given in the Applicable Safety Analyses LCO, and Applicability sections of this Bases.

Each train in the Relay Protection System has a built in t.ogic Channel Test Panel that facilitates testing of the decision logic natrix functions and the actuation devices while the unit is at power. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.

Generally ESF component actuation is accomplished through master and slave relays. The RM ay Protection System energizes the master relays appsopriate for the condition of the unit. Each master relay then energizes one or more slave relays which then cause actuation of the end devices.

The master and slave relays are routinely tested to ensure o)eration. The MASTER RELAY TEST energizes the rela / which tien operates the associated contacts. A contact in the circuit betwr m the master relay and the slave relay opens when the Logic Channel Test Panel is placed in test to-prevent actuation of the slave relay. A continuity check from the open test contact through the slave relay is then (continued)

ZION Units 1 & 2 B 3.3 64 Rev. 00, October, 1997

, y , - - - - . ,,-,yu-

- -y

j ESFAS Instrumentation B 3.3.2 BASES BACKGROUND Relav Protection System (continued) performed to demonstrate continuity of the circuit up to the slave relay. The SLAVE RELAY TEST actuates the devices if their operation will not interfere with continued unit operation. if actuation of the device would interfere with continued unit operation, actual component operation is prevented by the SLAVE RELAY TEST circuit and slave relay contact operation is verified by a continuity check of the circuit containing the slave relay.

APPLICABLE Each of the accidents analyzed for mitigation by the ESFAS SAFETY ANALYSES, can be detected by one or more ESFAS functions. One of the LCO, and ESFAS functions is the primary actuation signal for that APPLICABILITY accident. An ESFAS function may be the primary actuation signal for more than one type of accident. An ESFAS function may also be a secor.dary, or backup, actuation signal for one or more other accidents. For example, the Safety injection Containment Pressure High function is a primary actuation signal for loss of Coolant Accidents (LOCAs) and a backup actuation signal for feedwater system '

LCO, and pipe breaks. ESFAS functions not specifically credited in the accident analyses are retained for the overall redundancy and diversity of the ESFAS as required by the NRC approved licensing basis and may also serve as backups to ESFAS trip functions that were credited in the accident analyses.

The LCO requires all instrumentation performing an ESFAS function, listed in Table 3.3.21 in the accompanying LCO, to be OPERABLE. Failure of any instrument renders the affected channel (s) inoperable and reduces the redundancy of the affected functions.

The LC0 generally requires OPERABILITY of three or four channels in each instrumentation function, two channels of manual initiation function and two trains of automatic actuation logic function. The two-out-of-three and the two-out-of-four. configurations allow one channel to be tripped during maintenance or testing without causing an ESFAS initiation. Two logic or manual initiation channels are required to ensure no single random failure disables the ESFAS.

(continued)

ZION Units 1 & 2 B 3.3 65 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and <

APPLICABILITY (continued) ESFAS Functions The safety analyses and OPERABILITY requirements applicable t<: each ESFAS function are discussed as follow:

1. Safety injection Safety injection (SI) provides two primary functions:

1. Primary side water addition to ensure maintenance .

or recovery of reactor vessel water level (coverage of the active fuel for heat removal, clad integrity, and for limiting peak clad i temperatureto<2200'F);and

2. Boration to ensure recovery and maintenance of i SHUIDOWNMARGIN(SDM).

These functions are necessary to mitigate the effects of highenergylinebreaks(HELBs)bothinsideandoutsideof containment. -The Si signt' is also used to initiate other functions such as:

. Phase A Isolation;

Containment Ventilation Isolation;

Reactor Trip;

Turbine Trip;

Feedwater Isolation;

Start of the Auxiliary feedwater (AFW) pumps; and .

Control Room Ventilation Isolation.

These other functions ensure:

Isolation of-nonessential systems through containment penetrations; (continued)

ZION Units 1 & 2 B 3.3 66 Rev. 00, October, 1997

.r. w w., v . , ~ . . . .w,,,,.- , y r -_ _ . . .

- , , , - - ..r .. ~. - . . . _ _ .- - . , . . . , . . - - . - , . - . . . . . . , - . . - --

ESFAS 'nstrumentation .

B 3.3.2 BASES APPLICABLE 1. Safety Injection (continued)

SAFETY ANALYSES, LCO, and

Trip of the turbine and reactor to limit power APPLICABillTY generation;

Isolation of main feedwater (MFW) to limit cooldown of the primary coolantt t

Start of AFW pumps to ensure secondary side cocling capability; and

Isolation of the control room to ensure i habitability,

a. Safety injection-Manual Initiation l The operator can initiate 51 at a'1y time by using either of two switches in the control room. This action viii cause actuation of all components in the sare awde as any of the automatic actuation signals.

The LCO requires two channels to be OPERABLE.

Each channel consists of one switch and the interconnecting wiring to the actuation logic cabinets such that either switch will actuate both trains. This ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual Si initiation capability.

The applicability of the 51 Manual Initiation function is discussed with the Automatic Actuation Logic and Actuation Relay function below.

b. Safety Injection- Automatic Actuation loaic and Actuation Re' avs This LCO requires two trains to be OPERABLE.

Actuation logic consists of all circuitry housed within the Relay Protection System, including the initiating relay contacts responsible for actuating the ESF equipment.

(continued)

ZION Units 1 & 2 B 3.3-67 Rev. 00, October, 1997 l

l- _ _- __ ~ . _ _ . _ . _ _ , _ , _

ESFAS Instrumentation B 3.3.2 BASES APPLICABILITY b. Safety In.iection- Automatic Actuation Loaic and SAFETY ANALYSES, Actuation Rel ays (continued)

LCO, and APPLICABILITY The LCO requires two Manual Initiation channels ;

and two Automatic Actuation Logic and Actuation Relay trains to be OPERASLE in MODES 1, 2, and 3.

In these MODES, there is sufficient energy in the primary and secondary systems to warrant automatic initiation of ESF systems. Manual initiation is also required in MODE 4 even though automatic actuation is not required. in this MODE, adequate time is available to manually actuate required components in the event of a accident, but because of the large number of components actuated on a SI, actuation is simplified by the use of the manual actuation switches. The Automatic Actuation Logic and Actuation Relay function must be OPERABLE in MODE 4 to support system level manual initiation.

These functions are not required to be OPERABLE in MODES 5 and 6 because there is adecuate time '

for the operator to evaluate unit conditions and respond by manually starting individual systems, pumps, and other equipment to mitigate the consequences of an abnormal condition or accident. Unit pressure and temperature are very low and many ESF components are administrative 1y locked out or otherwise prevented from actuating to prevent inadvertent overpressurization of uni'.

systems,

c. Safety Iniection-Containment Pressure-Hiah This signal provides protection against the following accidents:

Main Steam Line Break (MSLB) inside containment; and

LOCA.

(continued)

ZION Units 1 & 2 B 3.3 68 Rev. 00, October, 1997

ISFAS Instrumentation B 3.3.2 BASES APPLICABLE d. Safety injection-Pressurizer Pressure _La SAFETY ANALYSES,

LCO, and The Containment Pressure-High function provides APPLICABILITY no input to any control functions. However fo (continued) OPERABLE channels are provided to satisfy protective requirements with a two-out-of-four logic. The transmitters and electronics are located outside of containment with the sensing line (high pressure side of the transmitter) located inside containment. Thus, the containment pressure high transmitters will not '

experience any adverse environmental conditions and the Trip Setpoint does not contain environmental allowances for instrument uncertainties.

The LCO requires four Containment Pressure-High channels to be OPERABLE in MODES 1, 2, and 3. In these MODES, there is sufficient energy in the primary and secondary systems to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment.

This signal provides protection against the following accidents:

Inadvertent opening of a steam generator (SG) relief or safety valve;

MSLB;-

A spectrum of rod cluster control assembly ejection accidents (rod ejection);

LOCAs; and

SG Tube Rupture.

Pressurizer pressure provides both control and protection functions with inputs to the Pressurizer Pressure Control, Reactor Trip, and SI Systems. Therefore, the actuation logic must be able to withstand both an input failure to the (continued)

ZION Units 1 & 2 B 3.3-69 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 .

i BASES ,

APPLICA0LE d. Safety Injection-Pressurizer Pressure-Low SAFETY ANALYSES (continued)

LCO, and

. APPLICABILITY control system, which may then recuire the i protection function actuation, anc a single failure in the other channels providing the i p'rotection function actuation. Ty)ically four channels are required to satisfy t11s requirement with a two out of-four logic. However for the Pressurizer Pressure-Low function, an Si actuation signal is generated with a two out-of-three logic. The two out-of-three logic is an acceptable design since alternate channels. >

measuring the same variable are available such .

that an OPERABLE channel can be selected to l replace the failed channel. In addition, the signal from the protective system channel to the '

control system passes through an-isolation device. No credible failure at the output of an ;

isolation device is assumed to prevent the associated protection channel from meeting the minimum performance requirements.

The Pressurizer Pressure transmitters are located inside containment and thus may experience adverse environmental conditions during a LOCA or MSLB inside containment. Therefore, the Trip Setpoint contains an environmental allowance for instrument uncertainties.

The LCO requires three Pressurizer Pressure-Low channels to be OPERABLE in MODES 1 and 2, and three Pressurizer Pressure-Low channels to be OPERABLE in MODE 3 above the P-ll setpoint, to mitigate the consequences of a HELB inside containment. The Pressurizer Pressure-Low signal may be manually blocked by the operator below the P 11 setpoint. Automatic Si actuation below this pressure setpoint is then performed by the Containment Pressure-High signal. This function is not required to be OPERABLE in MODE 3 below the P-ll setpoint because other ESF functions are used to detect accident conditions and actuate the ESF systems in this MODE. In MODES 4, 5, and 6, this function is not used for accident (continued)

-ZION Units 1 & 2 B 3.3-70 Rev. 00, October, 1997 .

l

ESFAS Instrumentation B 3.3.2 BASES l

APPLICABLE d. Safety In.iection-Pressurizer Pressure ,Ls l SAFETY ANALYSES, (continued)

LCO, and !

APPLICABILITY detection and mitigation and therefore is not ;

required to be OPERABLE. ;

e. Safety in_iection-Hioh Differential Pressure Betwen Steam .inet The High Differential Pressure Between Steam Lines function provides protection against the following accidents:

MSLB and

Inadvertent opening of an SG relief or an SG safety valve. ,

High Differential Pressure Between Steam Lines provides no input to any control functions. '

Thus, three OPERABLE channels on each steam line are sufficient to satisfy the requirements, with a two out-of three logic on each steam line.

With the transmitters located inside the steam tunnels, it is possible for them to experience adverse environmental conditions during an MSLB event. Therefore, the Trip Setpoint contains an environmental allowance for instrument uncertainties.

The LCO requires three High Differential Pressure Between Steam Line channels to be OPERABLE in MODES 1, 2, and 3. In these MODES, a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s).

This function is not required to be OPERABLE in MODES 4, 5, or 6 because there is not sufficient energy in the secondary side to challenge safety limits.

(continued)

ZION Units l & 2- B 3.3-71 Rev. 00, October, 1997 l

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE f, g. Safety injection-Hiah Steam Flow in Two Steam SAFETY ANALYSES, lines Coincident With T_-Low Low or Coincident LCO, and With Steam line PressureL LqW APPLICABILITY (continued) These functions (l.f and 1.g) provide protection against the following accidents:

MSLBt and

the inadvertent opening of an SG relief or an SG_ safety valve.

Two steam line flow channels per steam line are required OPERABLE for these functions. The steam line flow channels are combined in a one out of-two logic to indicate high steam flow in one steam line. The steam line flow transmitters provide control inputs, but the control function cannot cause the events that the function must protect against. Therefore, two channels are sufficient to satisfy redundancy requirements. The one-out-of-two configuration in one steam line allows online testing because the trip of one high steam flow channel is not sufficient to cause initiation. In the case of a fault in a single steam line, the remaining intact steam lines will either start to blowdown through the break (if downstream of the check valves) or attempt to pick up the turbine load (if the break is upstream of the check valves).

The increased steam flow in the remaining intact lines will actuate the required second high steam flow trip. Additional protection is provided by function 1.e., High Differential Pressure Between Steam Lires.

One channel of T,,, per RCS loop and one channel of low steam line pressure per steam line are required to be OPERABLE. For each parameter, the channels for all 1 cups or steam lines are combined in a logic such that two tripped channels will cause a trip for the parameter.

The T.,, low low channels and the low steam line pressure channels are combined in two-out-of-four logic. Thus, the function trips on one out of-two high flow in any two-out-of-four

, (continued) i ZION Units 1 & 2 8 3.3-72 R'ev . 00, October, 1997

l l

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE f, g. Safety In.iection-Hioh Steam Flow in Two Steam l SAFETY ANALYSES, Lines Coincident With T,-Low Lew or coincident LCO, and With Steam Line Pressure ,Lpw (continued)

APPLICABILITY steam lines if there is one-out-of one low low )

T , trip in any two-out-of-four RCS loops, or if there is a one-out-of one low pressure trip in ;

any two-out-of-four steam lines. Since the accidents that this event protects against cause

, the both low steam line pressure provision of one channel per loop or steam and low low T,line ensures no single random failure can disable both of these functions. The steam line pressure channels provide no control inputs. The T,,

channels provide control inputs, but the cun, trol function cannot initiate events that the function acts to mitigate.

The transmitters associated with the T,.,-Low Low function end the High Steam Flow function are not subject to any adverse environmental conditions.

Therefore, their Trip Setpoints do not contain environmental allowances for instrument uncertainties. The transmitters for the Steam Line Pressure-Low function may experience adverse environmental conditions during an MSLB.

Therefore, the Trip Setpoint contains an environmental allowance for instrument uncertainties.

The LCO requires two High Steam Flow in Two Steam Lines channels (for each steam line), one T.,,-Low Low channel (for each RCS loop) and one Steam Line Pressure-Low channel (for each steam line) to be OPERABLE in MODES 1 and 2, and two High Steam Flow in Two Steam Lines channels (for each steam line), one T,,,-Low Low channel (for each RCS loop) and one Steam Line Pressure-Low channel (for each steam line) to be OPERABLE in MODE 3 above the P-12 setpoint. In these MODES a secondary side break or stuck open valve could result in the rapid depressurization of the steam line(s). This signal may be manually blocked by the operator when below the P-12 setpoint. Above P-12, this function is automatically unblocked.

(continued)

ZION Units 1 & 2 B 3.3-73 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 ,

BASES APPLICABLE f, g. Safety injection.-Hioh steam Flow in Two Steam -

SAFETY ANALYSES, lines Coincident With T_,-Low low or Coincident LCO, and With Steam Line Pressure-h (continued)

APPLICABILITY This function is not required to be OPERABLE below P-12 because it is not assumed in the safety analysis below this temperature. In MODE 3 below P-12, an MSLB may be detected by the Containment Pressure High function (for breaks inside containment) or by High Steam Flow in Two Steam Lines coincident with Steam Line Pressure-Low function for Steam Line Isolation, and subsequently by the High Differential Pressure Between Two Steam Lines function for SI.

This function is not required to be OPERABLE in MODES 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to cause an accident.

2. Containment Spytal Containment Spray provides three primary functions:

1. Lowers containment pressure and temperature after an PELB in containment;

2. Reduces the amount of radioactive iodine in the containment atmosphere; and

3. Adjusts the pH of the water in the containment recirculation sump after a large break LOCA.

These functions are necessary to:

Ensure the pressure boundary integrity of the containment structure;

Limit the release of radioactive iodine to the environment in the event of a failure of the containment structure; and

Minimize corrosion of the components and systems inside containment following a LOCA.

(continued)

ZION Units 1 & 2 B 3.3-74 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 BASES :

APPLICABLE 2. Containment Soray (continued)

SAFETY ANALYSES, The containment spray actuation signal starts the LCO, and APPLICABILITY containment spray > umps and aligns the discharge of i and the pumps to tie containment spray nozzle headers ;

in the upper levels of containment. Water is t initially drawn from the RWST by the containment spray ;

pumps and mixed with a sodium hydroxide solution from ;

the spray additive tank.. If continued containment saray is required after initiating the recirculation '

>1ase of emergency core cooling, a containment spray 1eader is aligned to the discharge header of a residual heat removal pump. Containment spray is actuated manually or by a Containment Pressure-High ,

High signal.

a. Containment Spray-Manual Initiati,93 The operator can initiate containment spray from the control room by simultaneously depressing two containment spray actuation push buttons when an ;

SI signal is present.

~

Because an inadvertent actuation of containment spray could have such ,

serious consequences, two push buttons must be depressed simultaneously to initiate containment spray. Simultaneously depressing the two push buttons when an SI signal is present will actuate containment spray in both trains in the same manner as the automatic actuation signal. The LCO requires one channel consisting of two manual initiation push buttons to be OPERABLE. Note that manual initiation of containment spray also actuates Phase B containment isolation.

The applicability of the Containment Spray Manual Initiation function is discussed with the Automatic Actuation Logic and Actuation Relay function below. -

b. Containment Soray- Automatic Actuation Loaic and Actuation Rolavs Automatic Actuation Logic and Actuation Relays i consist of the same features and operate in the same manner as described for ESFAS function 1.b.

(continued)

ZION Units _l.& 2 B 3.3-75 Rev. 00, October, 1997

. - . - . - - - . - - - _ - - ..=- -- - -- - . . - . - - - --

ESTAS Instrumentation B 3.3.2 BASES i l

APPLICABLE b. Containment Soray- Automatic Actuation loaic and l SAFETY ANALYSES, Actuation Relays (continued)

LCO, and :

APPLICABILITY The LC0 requires one Manual Initiation channel and two Automatic Actuation Logic and Actuation i Relay traias to be OPERABLE in MODES 1, 2, and 3.

In these MODES there is a potential for an :

accident to occur, and sufficient energy in the primary or secondary systems to pose a threat to containment integrity due to overpressure conditions. Manual initiation is also required in MODE 4, even though automatic actuation is not required. In this MODE, adequate time is available to manually actuate required components in the event of an accident. The Automatic Actuation Logic and Actuation Relay function must be OPERABLE in MODE 4 to support system level manual initiation. In MODES 5 and 6, there is insufficient energy in the primary and secondary systems to result in containment overpressure.

In MODES 5 and 6, there is also adequate time for the operators to evaluate unit conditions and respond to mitigate the consequences of abnormal conditions by manually s+arting individual components.

c. Containment Spray-Containment Pressure-Hiah Hiah This signal provides protection against the following accidents:

LOCA; and

MSLB inside containment.

The transmitters are located outside of containment with the sensing line (high pressure side of the transmitter) located inside containment. Therefore, the transmitters do not experience any adverse environmental conditions and the Trip Setpoints do not contain an allowance for instrument uncertainties.

This is the only function that requires the bistable output to energize to perform its required action, it is not desirable to have a (continued)

ZION Units 1 & 2 B 3.3-76 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE c. Containment Sorav-Containment Pressure-Hiah H4h SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY loss of power actuate containment spray since the consequences of an inadvertent actuation of containment spray could be serious. Note that this function also has the inoperable channel placed in bypass rather than trip to decrease the probability of an inadvertent actuation.

Four channels of containment pressure are utilized in a two out of-four logic j configuration. Since containment pressure is not i used for control, this arrangement exceeds the minimum redundancy requirements. Additional redundancy is warranted because this function is energize to trip.

The LCO requires four Containment Pressure-High '

High channels to be OPERABLE in MODES 1, 2, and 3. In these MODES there is sufficient energy in the primary and secondary sides to pressurize the containment following a pipe break. In MODES 4, 5, and 6, there is insufficient energy '

in the primary and secondary sides to pressurize the containment and reach the Containment Pressure-High High setpoint.

3. Containment Isolation Containment Isolation provides isolation of the containment atmosphere, and all process systems that penetrate containment, from the environment. This function is necessary to prevent or limit the release of radioactivity to the environment in the event of a LOCA.

There are two separate Containment Isolation signals, Phase A and Phase B. The Phase A signal isolates all

automatically isolable process lines, except Component Cooling.(CC) water, at a relatively low containment pressure and is-indicative of a primary or secondary system leak. For these types of events, forced circulation cooling using the reactor coolant pumps (RCPs) and SGs is the preferred (but not required) method of decay heat removal. Since CC water is (continued)

ZION Units 1 & 2 B 3.3-77 Rev. 00, October, 1997

. _ _ - - _ - . - - - . . _ - . _ - . ~ . . - - .

l ESFAS Instrumentation B 3.3.2 BASES l APPLICABLE 3. Containment Isolation (continued) l SAFETY ANALYSES, i LCO, and !'

APPLICABILITY required to support RCP operation, not isolating CC water on the low pressure Phase A signal enhances unit safety by allowing operators to use forced RCS ,

circulation to cool the unit. l The Phase B signal isolates CC water. This occurs at a relatively high containment pressure that is ;

indicative of a large break LOCA or an MSLB. For these events, forced circulation using thc RCPs can no longer be assured. Isolating the CC water at the higher pressure does not pose a challenge to the contesnment boundary because the CC system is a closed loop inside containment. Although some system components do not meet all of the ASME Code requirements applied to the containment itself, the system is continuously pressurized to a pressure greater than the Phase B setpoint. Thus, routine operation demonstrates the integrity of the system pressure boundary for pressures exceeding the Phase B setpoint. Furthermore, because system pressure exceeds the Phase B setpoint, any system leakage prior to initiation of Phase B isolation would be into containment. Therefore, the enmbination of CC System '

design and Phase B isolation ensures the CC System is not a potential path for radioactive release from containment.

(continued)

ZION Units 1 & 2 8 3.3-78 Rev. 00, October, 1997 l

l .. - - - . - . - - - . . - - , . . - - - - _ . . - , ,, ., , - . - -

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE a. Containment Isolation-Phase A Isolation SAFETY ANALYSES, LCO, and Phase A containment isolation is actuated APPLICABILITY automatically by an SI signal or manually.

(continued) All process lines penetrating containment, with the exception of CC, are isolated. CC is not isolated at this time to aermit continued o)eration of the RCPs wit 1 cooling water flow to t1e thermal barrier heat exchangers and oil coolers. Process lines not equipped with remote operated iso ktion valves and not required to be in service during post accident conditions are isolated prior to reaching MODE 4.

(1) Phase A Isolation-Manual Initiation The operatur can initiate Phase A Containment Isolation at any time by using either of two switches in the control room.

This action will cause actuation of all components in the same manner as a Safety injection signal.

The LCO requires two channels to be OPERABLE. Each channel consists of one switch and the interconnecting wiring to the actuation logic cabinets such that either switch will actuate both trains.

This ensures the proper amount of redundancy is maintained in the manual ESFAS actuation circuitry to ensure the operator has manual containment isolation capability. Note that manual initiation of Phase A Containment Isolation also ac'.uates Containment Ventilation Isolation.

Manual Initiation of Phase A Containment Isolation must be OPERABLE in MODES 1, 2, 3, and 4. In these MODES there is a potential for an accident to occur which would require containment isolation.- In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase A Containment Isolation.

(continued)

ZION Units 1 & 2 B 3.3-79 Rev. 00, October, 1997 l

i ESFAS Instrumentation B 3.3.2 t

BASES 4 r

APPLICABLE (1) Phase A Isolution-ManJal . Initiation i i

SAFETY ANALYSES, (continued) '

LCO, and APPLICABILITY There also is adequate time for the !

operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.

b. Containment isolation-Phase B Isolation Phase B Containment Isolation is actuated by the automatic actuation logic, as previously ;

discussed. For containment pressure to reach a value high enough to <tuate Containment Pressure-High High. . large break LOCA or MSLB t must have occurred ano containment spray must ,

have been actuated. RCP operation will no longer be required and CC water to the RCPs is, therefore, no longer necessary. The containment :

pressure trip of Phase B Containment Isolation is energized to trip in order to minimize thepotential of spurious trips that may damage the RCPs.

(1) Phase B isolation-Manual Initiation i

Manual Phase B Containment Isolation is accomplished by the same push buttons that actuate Containment Spray. Therefore, the LCO requires one channel consisting of two i manual push buttons to be OPERABLE. When the two push buttons are depressed simultaneously, Phase B Containment Isolation is initiated. In addition, if an SI signal is present, Containment Spray will actuate in both trains, l

The applicability of the Containment Isolation Phase B Manual Initiation function is discussed with the Automatic Actuation Logic and Actuation Relay.

function below.

(continued)

ZION Units 1 1 2 B 3.3-80 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 ,

BASES .

APPLICABLE (2) )hase B Isolation _Automahc Actuation i SAFETY ANALYSES, .oaic and Actuation Relays LCC, and APPLICABILTY The LCO recuires one Manual Initiation (continued) channel anc two Automatic Actuation Logic and Actuation Relay trains to be OPERABLE in MODES 1, 2, and 3. In these MODES there is a potential for a DBA to occur. Manual initiation is also required in MODE 4 even though automatic actuation is not required.

In this MODE, adequate time is available to manually actuate required components in the '

event of an accident. However, because of the large number of components actuated on a Phase B Containment Isolation signal, actuation is simplified by the use of the manual actuation push buttons.

Automatic Actuation Logic and Actuation Relays must be OPERABir in MODE 4 to support system level runual initiation. In MODES 5 and 6, there is insufficient energy in the primary or secondary systems to pressurize the containment to require Phase B containment isolation. There also is adequate time for the operator to evaluate unit conditions and manually actuate individual isolation valves in response to abnormal or accident conditions.

(3) Phase B Isolation-Containment Pressure The basis for the Containment Pressure-High High function is as discussed for ESFAS function 2.c.

4. Steam line Isolation isolation of the main steam lines provides protection in the event of an MSLB inside or outside containment.

Rapid isolation of the steam lines will limit the steam line break accident to the blowdown from one SG.

For an MSLB upstream of the main steam isolation (continued) l ZION Units 1 & 2 8 3.3-81 Rev. 00, October, 1997 l

l

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 4. Steam Line isolation (continued) r SAFETY ANALYSES, LCO, and valves (MSIVs), inside or outside of containment, APPLICABILITY closure of the MSIVs limits the accident to the t'9wdown from onl: the affected SG. For an MSLB 8

d 1 stream of the MSIVs, closure of the MSIVs tei;inates the accident as soon as the steam lines ,

depressurize.

a. Steam Line Isolation-Manual Initiation The Manual Initiation function for steam line isolation must be OPERABLE when there is sufficient energy in the RCS and SGs to have an MSLB. An MSLB could result in the release of significant quutities of energy and cause a cooldown of the primary system. Each MSIV has its own push button and each MSly bypass valve has its own control switch to provide manual initiation of steam line isolation from the control room.

The LCO requires one channel per MSiv and MSly bypass valve to be OPERABLE in MODE 1, and one channel per MSIV and MSIV bypass valve to be OPERABLE in MODES 2 and 3 except for steam lines with their associated MSIVs and MSly bypass valves closed and deactivated. Steam lines with their associated MSIVs and MSIV bypass valves closed fulfill the isolation function. Thus, maintaining manual initiation capability is no longer required. In MODES 4, 5, and 6, there it insufficient energy in the RCS and SGs to

' experience an MSLB releasing significant quantities of energy.

b. Ste1m line Isolation- Automatic Actuation Loaic and Actuation Relays Automatic Actuation Logic and Actuation Relays consist of the same features and operate in a manner as described for ESFAS function-l.b.

However, tha Steam Line isolation Automatic Actuation i.ogic actuates a master relay that (continued)

ZION Units 1 & 2 B 3.3-82 Rev. 00, October, 1997 '

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE b. Steam Line Isolrion,- Automatic Actuation Loaic SAFETY ANALYSES, and Actuation Re'avs (continued)

LCO, and APPLICABillTY directly actuates the MSIV. Therefore, only a master relay test is required. Automatic initiation of steam line isolation must be ,

OPERABLE when there is sufficient energy in the RCS and SGs to have an MSLB. An MSLB could result in the release of significant quantities of energy and cause a cooldown of the primary system.

The LC0 requires two Automatic Actuation Logic and Actuation Relry trains to be OPERABLE in MODE I and two Automatic Actuation Logic and Actuation Relay trains in MODES 2 and 3 except when all MSIVs and MSIV bypass valves are closed and deactivated. With all MSIVs and MSly bypass valves closed and deactivated the isolation function is fulfilled and maintaining automatic actuation is no longer required.

In MODES 4, 5, and 6, there is insufficient energy in the RCS and SGs to experience an MSLB releasing significant quantities of energy, c, Steam line Isolation-Containment Pressure-31gh '

lllah The Containment Pressure-High High function actuates closure of the HSIVs in the event of a LOCA or an MSLB inside containment to maintain at least one nonfaulted SG as a heat sink for the reactor and to limit the mass and energy release to containment. The Containment Pressure-High High function provides no input to any control functions. Thus, three OPERABLE channels are sufficient to satisfy protective requirements with a two out of three logic. However, for-enhanced reliability, this function was designed with four channels and a two out of-four logic.

~

-The containraent pressure transmitters are 'ocated outsidecontainmentwiththesensingline(high pressure side of the transmitter) locatei insi#

(continuea)

ZION Units-1 & 2 B 3.3 83 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 r

BASES !

APPLICABLE c. Steam line Isolation-Containment Pressure-RLgh SAFETY ANALYSES, ELgh (continued)

LCO, and APPLICABILITY containment. Since the transmitters and electronics are located outside of containment they will not experience any adverse environmental conditions. Therefore, the Trip Setpoints do not contain environmental allowances for instrument uncertainties.

The Containment Pressure-High High function must 1 be OPERABLE when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection and closure of the MSIVs.

The LCO requires four Containment Pressure High High channels to be OPERABLE in MODE 1 and four Containment Pressure High High channels to be OPERABLE in MODES 2 and 3 except when all MSIVs and MSIV bypass valves are closed and deactivated. With all MSIVs and MSIV bypass valves closed and deactivated the isolation function is fulfilled and maintaining automatic actuation-is no longer required. In MODES 4, 5, and 6, there is not enough energy in the primary and secondary systems to Iressurize the containment to the Containment Pressure-High High setpoint, -

d, e. Steam Line Isolation-Hioh Steam Flow in Two Steam lines Coincident with T 3 -Low Low or Coincident With Stee? Line Pressure-Lgw These functions (4.d and 4.e) provide closure.of the MSIVs during an MSLB or inadvertent opening of an SG relief or safety valve to maintain at least one nonfaulted SG as a heat sink for the reactor-and to limit the mass and energy release to a single SG.

(continued)

ZION Units 1 & 2 B 3.3-84 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE d, e. Steam Line Isol ation-Hioh iltam Flow in Two SAFETY ANALYSES, Steam Lines Co< nc! jent with T,,,-Low Low or LCO, and Coincident With Steam Line Pressure-(g l APPLICABILITY (continued) :

These functions were discussed previously as functions 1.f. and 1.g.

The LC0 requires two High Steam Flow in Two Steam ,

Lines channels (for each steam line), one T,,,-Low Low channel (for each RCS loop) and one Steam Line Pressure Low channel (for each steam line) to be OPERABLE in MODE I and two High Steam Flow in Two Steam Lines channels (for each steam line), one Low Low channel (for each RCS loop) and oneT,., Steam Line Pressure Low channel (for each steam line) to be OPERABLE in MODES 2 and 3 except when all MSIVs and MSIV bypass valves are closed and deactivated. In these MODES a secondary side break or stuck open valve could result in the rapid depressurization of the steam lines. With all MSIVs and MSIV bypass valves closed and deactivated the isolation function is fulfilled and the function is no longer required. These functions are not required to be OPERABLE in MODES 4, 5, and 6 because there is insufficient energy in the secondary side to challenge safety limits.

5. Turbine Trio and Feedwater Isolation The primary functions of the Turbine Trip and Feedwater Isolation signals are to prevent damage to the turbine due to water in the steam lines and to stop the excessive flow of feedwater into the SGs.

These functions are necessary to mitigate the effects of a high water level in the SGs which could result in >

carryover of water into the steam lines and excessive cooldown of the primary system. The SG high water level is typically due to excessive feedwater flows.

This function is actuated by Ed Water Level-High High, or by an SI signal. The RTS also initiates a turbine trip signal whenever a reactor trip (P 4) is generated. In the event of an SI signal, the reactor (continued)

ZION Units 1 & 2 B 3.3-B5 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE 5. Turbine Trio and Feedwater Isolation (continued)

SAFETY ANALYSES, LCO, and trip breakers are opened and the turbine generator is APPLICABILITY tripped. The MFW System is isolated and the AFW System is automatically started.

a. Turbine Trio and Feedwater Isolation- Automatic Actuation Loaic and Actuation Relavs Automatic Actuation Logic and Actuation Relays consist of the same features and operate in the same manner as described for ESFAS function 1.b.

However, for the SG Water Level-High High ftnction, relay and contact actuation is duveloped in the~ circuitry for the individual a:tuated components (i.e., MFIV control circuit).

As such, this function do not have separate master and slave relay tests.

The LCO requires two Automatic Actuation Logic and ActJation Relay trains to be OPERABLE in MODE 1, and two Automatic Actuation Logic and Actuation Relay trains to be OPERABLE in MODES 2 and 3 except when all MFIVs MFRVs, and MFRV bypass valves are closed and deactivated or isolated by a closed manual valve. With all MFIVs, MFRVs, and MFRV bypass valves closed and deactivated or isolated by a closed manual valve the feedwater isolation function is fulfilled and this function is no longer required. In MODES 4, 5, and 6, the MFW System and the turbine generator are not in service and this function is not required to be OPERABLE.

b. Turbine Trio anf, Feedwater Isolation - Steam Generator Water level - Hiah High (P-14)

This signal provides protection against excessive feedwater flow. The SG water level- high high channels provide input to the SG Water Level Control System. Therefore, the actuation logic must be able to withstand both an input failure to the control system (which may then require the protection function actuation) and a single failure in the other channels providing the protection function actuation.

(continued)

ZION Units 1 & 2 B 3.3-86 Rev. 00, October, 1997 1

ESFAS Instrumentation ,

3 3.3.2 BASES APPLICABLE b. Turbine Trio and Feedwater Iscilation - Steam ~

SAFE 1Y ANALYSES, GeneraSor dater level - Hiah diah (P-14)

LCO, and (contlnuec)

APPLICABILITY However, the two out-of three logic does not neet the IEEE 279 criteria in that this function is unable to withstand two failures. This design is acceptable since the Steam Generator Water level-High High function is not credited in the safety analysis and serves only to protect equipment. Justification for this design is provided in NUREG-1218 (Ref. 6). The transmitters are located inside containment.

However, the events that this function protects against cannot cause a severe environment in containment. Therefore, the Trip Setpoint does not contain an environmental allowance tor instrument uncertainties.

The LCO requires three SG Water Level- High High to be OPERABLE in MODE 1, and channels two SG Water (per SG)l- High High channels ()er SG)

Leve to be OPERABLE in MODES 2 and 3 except w1en all MFIVs, MFRVs, and MFRV bypass valves are closed and deactivated or isolated by a closed manual valve. With all MFIVs, MFRVs, and MFRV by) ass valves closed and deactivated or isolated )y a closed manual valve the feedwater isolation function is fulfilled and this function is no longer required. in MODES 4, S, and 6, the MFW Qttem and the turbine cenerator are not in s wrice and this functivii is not required to be GFDMBLE.

6. Auxiliary Feedwater The AFW System is designed to 3rovide a secondary side heat sink for the reactor in t1e event that the MFW System is not available. The system has two motor driven pumps and a turbite driven pump, making it available during normal unit operation, during a loss of AC power, and a loss of MFW. The normal source of water for the AFW System is the condensate storage tank (CST) not safety related). If the CST is unavailable (, the operator may manually realign the AFW-pump suction to the Service water-System (safety related).

(continued)

'l10N Units 1 & 2 B 3.3-87 -Rev. 00, October, 1997

ESFAS Instrumentatio.9 8 3.3.2 BASES APPLICABLE 6. Auxiliary feedwater (continued)

SAFETY ANALYSES, LCO, and The AFW System is aligned so that upon a pump start, !

APPLICABILITY flow is initiated to the respective SGs immediately,

a. Auxiliary Feedwater- Automatic Actuation Lqgig and Actuation Relays System Automatic Actuation Logic and Actuation Relays !

consist of the same features and operate in the same manner as described for ESFAS function 1.b.

However, for the SG Water Level-Low Low function and the Undervoltage RCP Bus function, relay and contact actuation is developed in the circuitry for the individual actuated components (i.e., AFW pump control circuit). As such, these functions do not have separate master and slave relay tests.

The LCO requires two Automatic Actuation Logic and Actuation Relay trains to be OPERABLE in MODES 1, 2 for the Undervoltage Reactor Coolant Pump Bus functicn and two Automatic Actuation Logic and Acto *. tion Relay trains to be OPERABLE '

in MODES 1 2 and 3 for the SG Water Level-Low Low and ':4fety injection functions. In these MODES the AFW System must be available to provide a source of cooling water to the SGs in the event of an accident involving a loss of normal feedwater. In MODES 4, 5 and 6 AFW actuation does not need to be OPERABLE because either AFW or residual heat removal will already be in operation to remove decay heat or sufficient time is available to manually place either system in operation. ,

b. Auxiliary Feedwater-SG Water Level Low - low SG Water Level-Low Low provides protection against a loss of heat sink. A loss of MFW would result in a loss of SG water level. The'SG water level-low low channels provide input to the SG ,

level Control System. Therefore, the actuation logic must be able to withstand both an input (continued)

ZION Units 1 & 2 B 3.3-88 Rev. 00, October, 1997

ESFAS instrumentation B 3.3.2 BASES APPLICABLE b. Auxiliary Feedwater-SG Water level low - Low SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY failure to the control system which may then require a protection function actuation and a single failure in the other channels providing the protection function actuation. Since the motor driven AFW pumps are started on a two out-of-three low low water level logic in any SG and the turbine driven AFW pump is started on a two-out-of-three low-low water level in any two out-of four SGs, IEEE 279 is not met for a loss of SG water level in a single loop. However, for a loss of feedwater to all SGs, IEEE-279 is met through a two out of three logic for each SG with two out of four SGs to actuate the AFW system.

In this case, the failure of a single SG two out-of-three logic will not prevent AFW actuation.

This is acceptable since a loss of MFW will affect all SGs and ensure AFW actuation.

The transmitters are located inside containment.

However, the events that this function protects against cannot cause a severe environment in containment. Therefore, the Trip Setpoint does not contain an environmental allowance for instrument uncertainties.

The LCO requires three SG Water Level-Low Low channels to be OPERABLE in MODES 1, 2 and 3. In these MODES, the SGs are the primary heat sink for the reactor, in H0 DES 4, 5 and 6 this function is not needed to be OPERABLE because either the AFW or residual heat removal pumps will already be in operation to remove decay heat.

c. Auxiliary Feedwater-Undervoltaae Reactor Coolant Pumo A loss of power on the buses that provide power to the RCPs provides indication of a pending loss of RCP forced flow in the RCS.

(continued)

ZION Units 1 & 2 B 3.3 89 Rev. 00, October, 1997

ESFAS Instrumentation a 3.3.2 CASES APPLICABLE c. Auxiliary Feedwater-Undervoltaae Reactor Coola.n_t SAFETY ANALYSES, Eust(continued)

LCO,-and APPLICABILITf A loss of power on two or more RCP buses, will start the turbine driven AFW ) ump to ensure a source of feedwater is availa)1e to the SGs.

The LCO requires one Undervoltage Reactor Coolant Pum.9 Bus channel (per RCP Bus) to be OPERABLE in MODES I and 2. This ensures that at least one SG is provided with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident. In MODES 3, 4, and 5, the RCPs nay be shut down, and thus a loss of pouer to the RCP buses may not be indicative of a condition requiring automatic AFW initiation.

7. Enaineered Safety Feature Actuation System Interlocks To allow some flexibility in unit operations, several interlocks are included as part of the ESFAS. These interlocks permit the operator to block some signals, automatically enable other signals, prevent some actions from occurring, and cause other actions to occur. The interlock functions back up manual actions to ensure bypassable functions are in operation under the conditions assumed in the safety analyses,

a. Enaineered Safety Feature Actuation System Interlocks-Reactor TriD. P-4 The P-4 interlock is enabled when both reactor trip breaker (RTBs) and their associated bypass

-breakers are open. Or.ce the P-4 interlock is enabled, autonatic SI ir.itiation may be blocked after a 1 minute time delay. This function allows operators to take manual control of SI systems after the initial phase of injection is complete. Once SI is blocked, automatic actuation of SI cannot occur until the RTBs have been manually closed.

(continued)

ZION Units 1 & 2 B 0.3-90 Rev. 00, October, 1997 l

l

ESFAS Instrumentation B 3.3.2 BASES APPLICABLE a. Fagj_ net _ red Safety Feature Actuation System SAFET( ANALYSES, nter!qs.k.L-Reactor Trio. P-4 (continued)

LCO, end APPLICABILITY The functions of the P-4 interlock are:

Trip the main turbine;

Isolate MFW with coir.:ident loe T ,;

Prevent re-actuation of automatic ci ,=fter a manual reset of an SI signal; at..!

Prevent opening of the MFRV and MFRV bypass valves if the Water Level y were closed on SI or SG High High, Each of the above Functions is interlocked with P-4 to avert or reduce the continued cooldown of the RCS following a reactor trip. An excessive cooldown of the RCS #ollowing a reactor trip could cause an insertion of positive reactivity with a subsequent increase in generated power.

To avoid such a situation, the noted Functions have been interlocked with P-4 as part of the design of the unit control and protection system.

None of the noted Functions serves a mitigation function in the unit licensing basis safety andyses. Only the turbine trip Function is explicitly assumed since it is an immediate consequence of the reactor trip Function.

Neither turbine trip, nor any of the other three functions associatec with the reactor trip signal, is required to show that the unit licensing basis safety analysis acceptance criteria are not exceeded. The position switches for the RTBs and their associated bypass c eakers provide input to the P-4 interlock and function only to energize or de-energize contacts.

Therefore, this Function has no adjustable trip setpoint with which to associate a Trip Setpoint and Allowable Value.

This Function must be OPERABLE in MODES 1, 2, and 3 when the reactor may-be critical or approaching critic 0ity and an inadvertent cooldown of the RCL would cause the addition of positive reactivity. This Function does not have (continued)

ZION Units 1 & 2 B 3.3-91 Rev. 00, October, 1997

ESFAS Instrumentation-B 3.3.2 BASES APPLICARLE a. Enaineered Safety Feature Actuation System SAFETY ANALYSES, jnterlocka-Reactor Trio. P-4 (continued)-

LCO, and APPLICABILITY to be OPERABLE in MODES 4, 5 or 6 because the turbine and the MFW System are not in operation and can not cause an inadvertent cooldown of the RCS.

b. Enaineered Safety Feature Actuation System Interlocks-Pressurizer Pressure. P-ll The P-11 interlock permits a normal unit cooldown and depressurization without actuation of SI or main steam line isolation. With two-out-of-three pressurizer pressure channels (discussed previously) less than the P-11 setpoint, the operator can manually block the Pressurizer Pressure-Low SI signal.

With two-out-of-three pressurizer pressure channels above the P-ll setpoint, the Pressurizer Pressure-Low SI signal is automatically enabled.

The operator can also enable this trip by use of two manual reset switches.

This Function must be OPERABLE in MODES 1, 2, and 3 to allow an orderly cooldown and depressurization of the unit without an SI actuation signal. This Function does not have to be OPERABLE in MODE 4, 5, or 6 because system pressure must already be below the P-11 setpoint for the requirements of the heatup and cooldown curves to be met,

c. Enaineered Safety Feature Actuation System Interlocks _T,,,- Low low. P-12 On increasing reactor cociant temperature, the P-12 interlock reinstates SI actuation capability on High Steam Flow Coincident With Steam Line Pressure-Low or Coincident With T.,-Low Low and provides an arming signal to the steam dumps. On decreasing reactor coolant temperature, the P-12 interlock allows the operator tc manually block S! actuation on High. Steam flow Coincident With Steam Line Pressure-Low or Coincident with (continued)

ZION Units 1 & 2 B 3.3-92 Rev. 00, October, 1997

i l

ESFAS Instrumentation l B 3.3.2 ,

l BASES APPLICA0LE c. Enaineered Safety Feature Actuation System SAFETY ANALYSES, Interlocks-h-Low Low. P-12 (continued)

LCO, and '

APPLICABILITY T - Low Low. On a decreasing temperature, the PD interlock also removes the arming signal to the steam dumps to prevent an excessive cooldown of the RCS due to a malfunctioning steam dump.

Since T, is used as an indication of bulk RCS temperature, this Function meets redundancy requirements with one OPERABLE channel in each loop and is used in a two out-of-four logic.

This Function must be OPERABLE in M9 DES 1, 2, and 3 when a secondary side break or stuck open valve could result in the rapid depresst.rization of the steam lines. This Function does not have to be OPERABLE in MODE 4, 5, or 6 because there is insufficient energy in the secondary side of the unit to have an accident.

ACTIONS The ACTIONS have been modified by three Notes. Note 1 has been added in the ACTIONS to clarify the application of Completion Time rules, The conditions of this Specification '

may be entered independently for each function listed on Table 3.3.2-1. Whea the Required Channels ir Table 3.3.2-1 are specified on a "per X" basis (e.g., per steam line, per loop, per SG, etc.), then the Condition may be entered separately for each steam line, loop, SG, etc., as appropriate.

In the event a channel's Trip-Setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing clectronics, setpoint comparators trip outputs, contact outputs or bistable is found inoperable, then all affected functions provided by that channel must be declared inoper able and the LCO Condition (s) entered for the protection functions affected.

Note 2 states that entry into Conditions and Required Actions for an instrument channel made inoperable solely for the performance of required Surveillances may be delayed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months provided a second channel associated with the (continued)

.ZI @ Units 1 & 2 B 3.3-93 :Rev. 00, October, 1997

r ESFAS Instrumentation B 3.3.2 BASES ,

ACTIONS same function is inoperable. The purpose of this Note is to (continued) allow surveillance testing of an instrument channel when another channel for the same function is inoperable without taking the Required Actions for-two inoperable channels.

For example, this situation would occur if one of the three Pressurizer Pressure-Low channels was inoperable ar.d a COT was due on an associated Pressurizer Pressure-Low channel.

As allowed by the Required Actions of Ccndition F, the inoperable Pressurizer Pressure-Low channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. It should be noted however, that the channel-remains inoperable even though it has been ) laced in bypass.

In order to perform the required COT, the clannel being tested would normally be inoperable. However, in order to avoid' entering LC0 3.0.3 for two inoperable channels, ACTIONS Note 2-allows a delay for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to complete the required test.

Note 3 states that entry into Conditions and Required Actions for an Automatic Actuation Logic train made inoperable solely for the performance of surveillances may be delayed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months during actuation logic testing and master relays testing, and 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months during slave relay testing, provided the other train in OPERABLE. The purpose of this Note is to provide an acceptable delay period for placing an Automatic Actuation Logic train in bypass during the performance of required surveillance testing without taking the Required Actions for an inoperable Automatic Logic train.

A.1 Condition A applies to all ESFAS protection functions.

Condition A addresse; the situation where one Required Channel (channel or train) for one or more functions is inoperable. The Required Action is to refer to Table 3.3.2-1 and to enter the referenced Conditions for the protection functions affected. The Completion Times and Required Actions are those from the referenced Conditions.

Note that the applicable Condition specified in the table is function and MODE or other specified condition dependent and may change as plant conditions change.

(continued)

ZION Units 1 & 2- B 3.3-94 Rev. 00, October, 1997 l --

l l

ESFAS Instrumentation ,

B 3.3.2 i BASES ACTIONS Rd (continued)

Condition B applies to the following SI functions:

Containment Pressure-High; and

High Differential Pressure Between Steam Lines.

Condition B also applies to the following Auxiliary Feedwater functions:

-* SG Water Level-Low Low; and

Undervoltage Reactor Coolant Pump.

For the High Differential Pressure Between Steam Lines function, Condition B may be entered separately for each steam line.

For the SG Water Level-Low Low function, Condition B may be entered separately for each steam generator.

For the Undervoltage Reactor Coolant Pump function, Condition B may be entered separately for each bus.

If one channel is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the channel to OPERABLE status or to place it in the tripped condition. Generally this Condition applies to functions that operate oa logic that requires two channels to initiate the required action, and failure of one channel places the function in an undesirable configuration. One channel must be tripped to place the function in a configuration that satisfies redundancy requirements. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status or to place the inoperable channel in the tripped condition is justified in '

Reference 7.

The Required Actions are modified by a Note that allows the iimerable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routine surveillance testing of other channels.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time _ limit is justified in Reference 7.

(continued)

ZION Units 1 & 2 B 3.3-95 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2-BASES ACTIONS (d (continued)

Condition C applies to Containment Spray function, Containment Phase B function and the Steam Line Isolation function for:

Containment Pressure-High High.

The Containment Pressure-High High channels do not provide input to a control function. Thus, two-out-of-three logic is necessary to meet acceptable protective requirements.

However, a two-out-of-three design would require tripping a failed channel. This is undesirable because a single failure would then cause spurious containment spray initiation. Spurious spray actuation is undesirable because of the cleanup problems presented. Therefore, these channels are designed with two-out-of-four logic so that a failed channel may be bypassed rather than tripped. Note that one channel may be bypassed and still satisfy the single failure criterion. Furthermore, with one channel bypassed, a single instrumentation channel failure will not spuriously initiate containment spray.

To avoid the inadvertent actuation of containment spray, Phase B containment isolation and steam line isolation, the inoperable channel should not be placed in the tripped condition. Instead it is bypassed. Restoring the channel P OPERABLE status, or placing the inoperable channel in the bysss condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , is sufficient to assure that the function renia.ns OPERABLE and minimizes the time that the function may be in a partial trip condition (assuming the inoperable channel has failed high). The Completion Time is further justified based on the low probability of an event occurring during this interval.

The Required Actions are modified by a Note that allows one additional channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing. Placing a second channel in the bypass condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for testing purposes is acceptable based on the results of Reference 7.

D.d Condition D applies to the Automatic Actuation logic and Actuation Relay function for the AFW System.

(continued)

ZION Units 1 & 2 B 3.3-96 Rev. 00, October, 1997

ESFAS Instrumentation 'l B 3.3.2 '

-l BASES ACTIONS Rd (continued)

The action addresses the train orientation of the Relay Protection System. If one train is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the train to OPERABLE status. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.

E.1 and E.2 If the Required Action and associated Completion Time of Condition B, C or D, are not met, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.

Placing the unit in MODE 4 removes all requirements for OPERABILITY of the required functions. In this MODE, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.

Required Action E.2 is modified by a Note that indicates the Recuired Action is not applicable to the Auxiliary Feedwater Uncervoltage Reactor Coolant Pump functions (functional units 6.a.2 and 6.c) since the applicable MODES for these items are only MODES 1 and 2.

f_d Condition F applies to the following SI functiors:

Pressurizer Pressure-Low; and

High Steam Flow in Two Steam Lines Coincident With T.,-Low Low or Coincident With Steam Line Pressure - Low.

(continued)

ZION Units 1 & 2 B 3.3-97 Rev. 00, October, 1997 l

1 ESFAS Instrumentation B 3.3,2 BASES

. ACTIONS- L1 (continued)

Condition F also applies to the following Steam Line Isolation functions:

High Steam Flow in Two Steam Lines Coincident With T -Low Low or Coincident With Steam Line Pres sure - Low. - )

Finally, Condition F also applies to the following Turbine Trip and Feedwater Isolation function:

SG Water Level-High High.

For the High Steam Flow and Steam Line Pressure-Low functions, Condition F may be entered separately for each steam line. For the T m -Low Low function, Condition F ma) be entered separately for each loop. )

For the SG Water Level-High High function, Condition F may be entered separately for each steam generatcr.

If one channel is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the channel to OPERABLE status or to place it in the tripped condition. Generally this Condition applies to functions that operate on logic that requires two channels to initiate the required action, and failure of one channel places the function in an undesirable configuration. One channel must be tripped to place the function in a configuration that satisfies redundancy requirements. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the charnel to OPERABLE status or to place the inoperable channel in the tripped condition is justified in Reference 7.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing routine surveillance testing of other channels.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is justified in Reference 7.

-(continued)

7. ION Units 1 & 2 B 3.3-98 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 BASES ACTIONS Gd l

.(continued)

Condition G applias to the Automatic Actuation Logic and H Actuation Relay function for:

Steam Line Isolation; and

- Turbine Trip and Feedwater Isolation.

The action addresses the train orientation of the Relay Protection System. If one train is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore-the. train to OPERABLE status. The Completion Time for restoring a train to OPERABLE status is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval. ;

H.l. H.2.1 and H.2.2 If the Required Action and associated Completion Time of Condition F is not met for the Pressurizer Pressure-Low function, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . In addition, the unit must be placed in a MODE in which the inoperable function is i.ot required within the l following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This can be accomplished by either i placing the unit in MODE 4 or by reducing the pressurizer pressure below the P-11 setpoint. The allowed Completion i Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems. Placing the unit in either of these l conditions removes all requirements for OPERABILITY of the '

required functions. In these conditions, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above. ;

This Condition is modified by a Note that indicates the Condition is only applicable to the Pressurizer Pressure-Low function.

I.1. I.2.I and 1.2.2 If the Required Action and associated Completion Time of Condition F is not met for the High Steam Flow in Two Steam

- Lo LinesCoincidentWithT, Line Pressure-Low funct ions,wLoworCoincidentWithSteam the unit must be placed in (continued)

ZION Units 1 & 2 B 3.3-99 Rev. 00, October, 1997

ESFAS-Instrumentation B 3.3.2 l

BASES l ACTIONS I.1. I.2.1 and I.2.2 (continued)

MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . In addition, the unit must be J. laced in a MODE in which the inoperable function is not ,

required within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This can be l accomplished by either placing the unit in MODE 4 or by reducing the T., below the P-12 setpoint. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power cor.ditions in an orderly manner and without challenging plant systems. Placing the unit in either of these conditions removes all requirements for OPERABILITY of the required functions. In these conditions, the unit does not have analyzed transients or conditions that require the explicit use of t e protection functions noted above.

This Condition is modified by a Note that indicates the Condition is only applicable to the High Steam Flow in Two

- Lo SteamLinesCoincidentWithTfons.wLoworCoincidentWi Steam Line Pressure-Low funct J.1. J.2.1 and J.2.2 If the Required Action and associated Completion Time of Condition F or G are not met for the High Steam How in Two

-Low Low or Coincident With SteamLinesCoincidentWithTfonsortheAutomatic Steam Line Pressure-Low funct Actuation Logic and Actuation Relay function for Steam Line Isolation, respectively, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . In addition, the unit must be placed in a MODE in which the inoperable function is not required within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This can be accomplished by either placing the unit in MODE 4 or by closing and deactivating all main steam isolation valves and their associated bypass valves. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems. Placing the unit in either of these conditions removes all requirements for OPERABILITY of the required functions. In these conditions, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.

(continued)

ZION Units 1 & 2 B 3.3-100 Rev. 00, October, 1997

. - - . ~ .. - .. .- - - - -

ESFAS Instrumentation ;

B 3.3.2 1 l

BASES ACTIONS J.l. J.2.1 and J.2.2 (continued)

This Condition is modified by a Note that indicates the Condition is only applicable to the identified Steam Line Isolation functions: High Steam Flow in Two Steam Lines Coincident With T o -Low Low or Coincident-With Steam Lirr Pressure-Low functions and the Automatic Actuation Logic and Actuation Relays.

K.l. K.2.1 and K.2.2 If the Required Action and associated Completion Time of Condition F or G are not met for either the Steam Generator Water Level-High High or the Automatic Actuation Logic and Actuation Relay functions for Turbine Trip and Feedwater Isolation, respectively, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . In addition, the unit must be placed in a MODE in which the inoperable function is not required within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This can be accoaplished by placing the unit in MODE 4. Alternatively, this can also be accomplished by closing and deactivating, or isolating with a closed manual valve, all _MFIVs, MFRVs and the MFRV bypass valves. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit c:,nditions from full power conditions in an orderly manner and without challenging plant systems.

i Placin., the unit in either of these conditions removes all requirements for OPERABILITY of the required functions. In these conditions, the unit does not have analyzed transients or conditions that require the explicit use of the protection functions noted above.

i This Condition is modified by a Note that indicates the Condition is only applicable to the Steam Generator Water Level-High High and the Automatic Actuation Logic and Actuation Relay functions for Turbine Trip and Feedwater Isolation.

l l

l I (continued)

ZION Units 1 & 2 B 3.3-101 Rev. 00, October, 1997 l

ESFAS Instrumentation B 3.3.2 BASES ACTIONS L1, (continued)

Condition L applies to the Automatic Actuation Logic and Actuation Relays for the following functions:

Sl;

Containment Spray;

Phase A Isolation; and

Phase B Isolation.

This action addresses the train orientation of the Relay Protection System and the master and slave relays. If one train is inoperable, 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months are allowed to restore the train to OPERABLE status. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.

L.1 Condition M applies to the P-4 interlock and to the Manual Initiation functions of:

3 SI;

Containment Spray;

Phase A Isolation;

> + Phase B Isolation; and

. Steam Line Isolation.

This action addresset the train orientation of the Relay Protection System for the functions listed above. If a channel is inoperable, 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is allowed to return it to an OPERABLE status.

For the P-4 interlock, the specified Completion Time is reasonable considering the nature of the function (i.e., it is not credited in the safety analysis), the available redundancy, and the low probability of an event occurring during this interval.

t (continued)

ZION Units 1 & 2 B 3.3-102 Rev. 00, October, 1997

__ . _ . _ . _ . _ _ . . ~ . _ _ _ _ _ . _ _ _ _ . _ _- __ _ __ _____m 1

ESFAS Instrumentation ~

B 3.3.2 t

BASES

c. +

ACTIONS lL1 (continued): .

For Containment S) ray and Phase B' Isolation, failure of one_ .

channel renders tie respective Manual Initiation function ~!

inoperable. Also, for each MSIV'and MSIV bypass valve, failure of one channel renders the Manual Initiation '

function inoperable for the affected MSIV or MSIV-bypass valve. The specified Completion Times for these functions is acceptable because manual initiation is not credited in the safety analyses and these functions only provide backup capability to the automatic actuation functions only. j For the SI and-Phase A Isolation, the specified Completion Time is reasonable considering that there are two automatic actuation trains which remain.0PERABLE in the same MODES as-

the Manual Initiation- functions, the Manual Initiation-funtion is not credited in the safety analysis and the low i probability of an event occurring during this interval.

N.1 and N.2 If the Required Action and associated Completion Time of Condition L or M are not met, the unit must be placed in a MODE in which the LCO does not apply. This is done by-placing the unit in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within an additional 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months (36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months total time).

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions ,

from full power conditions -in an orderly' manner and without challenging plant systems.

o This Condition is modified by a Note which indicates the ,

Condition is not applicable to the Steam Line Isolation Manual Initiation function.-

0.1. 0.2.1 and 0.2.2 l

If the Required Action and associated Completion Time of i Condition M are not met for the Steam Line Isolation Manual Initiation function, the unit must be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months either be in MODE _4, or close and deactivate the MSIV or MSIV-bypass valve on the affected main steam line. The allowed Completion Times are reasonable, based on operating experience, to reach-the required unit conditions from full t

(continued)

~

l l ZION Units 1 & 2' B 3.3-103 Rev. -00,_0ctober, 1997

-- . - .- ~- .a . -. -_ _ - . . ., - _ _.

ESFAS Instrumentation B 3.3.2 BASES ACTIONS 0.1. 0.2.1 and 0.2.2 (continued) power in an orderly manner and without challenging plant systems. In MODE 4, the unit does not have any analyzed transients or conditions that require the explicit use of this protection function.

This Condition is modified by a Note which indicates the Condition is applicable only to the Steam t.ine Isolation Manual Initiation function.

P.1 and P.2 If the Required Action and associated Completion Time of Condition M are not met for the P-4 interlock, the unit must be ) laced in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 wit 11n the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging plant systems. In MODE 4, all requirements for OPERABILITY of this interlock are removed, This Condition is modified by a Note which indicates the Condition is applicable only to the P-4 interlock.

L.1 With one or more RTS interlock trains inoperable the associated interlock must be verified to be in its required state for the existing unit condition within I hour.

Verifying the interlock status manually accomplishes the interlock Function. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on operating experience and the minimum amount of time allowed for manual operator action. The I hour Completion Time is equal to the time allowed by LCO 3.0.3 for preparation of a unit shutdown in the event of a complete loss of an RTS Function.

R.1 and R.:

If the Req. ired Action and associated Completion Time of Condition , are not met for the P-11 and P-12 interlocks, 4

the unit nist be placed in MODE 3 within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

In additio1, the unit must be placed in a MODE in which the inoperable function is not required within the following (continued)

ZION Units 1 & 2 B 3.3-104 Rev. 00, October, 1997

I ESFAS Instrumentation B 3.3.2 BASES 1

ACTIONS R.1 and R.2 (continued) 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This can be accomplished by placing the unit in MODE 4. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems'. Placing the unit in MODE 4 removes all requirements for OPERABILITY of these interlocks.

S_d When the number of inoperable channels in a trip function exceed those s)ecified in one or more related Conditions associated wit 1 a trip function, then the unit is outside the safety analysis. Therefore, LC0 3.0.3 should be immediately entered if applicable in the current MODE of operation.

The Condition is modified by a Note which states that the Condition is not applicable to the P-11 and P-12 ESFAS InterlocL. Required Action Q.1 provides the appropriate required action for one or more required Interlock Trains inoperable. If the plant cannot be placed in its interlock condition, Required Actions R.1 and R.2 will place the unit in a Mode where the condition des not apply. This ensures the interlock function is in its required state within one hour or the pla,t is shutdown, which is equivalent to Required Action S.I.

SURVEILLANCE The SRs for each ESFAS function are identified b,$ the SRs REQUIREMENTS column of Table 3.3.2-1.

A Note has been added to the SR Table to clarify that Table 3.3.2-1 determines which SRs apply to which ESFAS functions.

Note that each channel of process protection supplies both trains cf the ESFAS. When testing Channel I, Train A and -

Train B must be examined. Similarly, Train A and Train B must be examined when testing Channel II, Channel III, and Channel IV (if applicable). The CHANNEL CALIBRATION and COTS are performed in a manner that is consistent with the assumptions used in analytically calculating the required channel accuracies.

(continued)

ZION Units 1 & 2 B 3.3-105 Rev. 00, October, 1997 l

- -- - - . _. .~ . . . --.

ESFAS Instrumentation

.B:3.3.2-BASES-SURVEILLANCE SR 3.3.2.1 !

REQUIREMENTS- .

(continued) The protection functions with installed bypass capability, such as those processed through the Eagle 21 Process Protection System, may be tested in the trip or bypass condition. Except where explicitly permitted (e.g.,

Containment Pressure) administrative controls ensure two channels in the instrument protection set are not placed in the bypass condition at the same time when that instrument function is required to be OPERABLE by the Technical Specifications. Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures.that a gross failure of instrumentation has not occurred. - A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels ronitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is a key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff, based on a combination of the chennel instrument uncertainties, including indication aid reliability. If a channel is outside the criteria,x;t may be an indication that the sensor or the signal f rocessing equipment has drifted outside its limit. N The Frequency is based on perating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LC0 required channels.

SR 3.3.2.2 SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST.

The logic relays are tested every 31 days on a STAGGERED TEST BASIS using the Logic Channel Test Panel. The train being tested is placed in the bypass ccndition thus preventing inadvertent actuation. Through the Logic Channel Test Panel all possible logic combinations are tested for

'each protection function specified. In addition, the master relay coil is energized. This verifies that the logic modules are OPERABLE and that there is an intact voltage signal path to the master relay coils. The Frequency of (continued)

ZION Units 1 & 2 8 3.3-106 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.2.2 (continued)

REQUIREMENTS every 31 days on a STAGGERED TEST BASIS is adequate. It is based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.2.3 SR 3.3.2.3 is the performance of a MASTER PELAY TEST. The MASTER RELAY TEST is the energizing of the master relay, verifying contact operation and a continuity check of the slave relay coil. During master relay contact operation, a test lamp is used to demonstrate the continuity of the circuit including the master relay contact and slave relay coil. This test is performed every 31 days on a STAGGERED TEST BASIS. The Frequency is adequate, based on industry operating experience, considering instrument reliability and operating history data.

SR 3.3.2.4 SR 3.3.2.4 is the 3erformance of a COT. A COT is performed on each required c1annel to ensure the entire channel will perform the intended function. Setpoints must be within tha Allowable Values specified in Table 3.3.2-1.

The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology. Any setpoint shall be left set consistent with the assumptiens of the current unit specific setpoint methodology.

The "as found" and "as left" values must also be recorded and' reviewed for consistency with the assumptions of Reference 7 when applicable.

The Frequency of 92 days is justified in Reference 7.

SR 3.3.2.5 SR 3.3.2.5 is the performance of a SLAVE RELAY TEST. The SLAVE RELAY TEST is the energizing of the slave relays.

Contact operation is verified in one of two ways. Actuation equipment that may be operated in the design mitigation MODE is either allowed to function, or is olaced in a condition where the relay contact operation can' be verified without operation of the equipment. Actuation equipment that may not be operated in the design mitigation MODE is prevented from operation by the SLAVE RELAY TEST circuit. in this (continued)

ZION Units 1 & 2 B 3.3-107 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 BASES' i

l SURVEILLANCE SR 3.3.2.5(continued)~ '

REQUIREMENTS case, contact operation is verified by a continuity check of i the circuit containing the slave relay. This test is performed every 92 days. The Frequency is adequate, based ,

on industry operating experience, considering instrument I reliability and operating history data.

This surveillance is modified by a note which excludes inoperable equipment that is actuated by a slave relay and equipment that is locked, sealed, or otherwise secured in its required position. This note is required to preclude failure of this surveillance when the actuated equipment is inoperable or secured in position, as actuation or continuity testing may not be possible in this condition.

SR 3.3.2.6 SR 3.3.2.6 is the performance of a TAD 0T. This test is a check of the Manual Actuation functions. It is performed every 18 months. Each Manual Actuation function is tested up to, and including, Une master relay coils. In some instances, the test includes actuation of the end device (i.e., pump starts, valve cyc1 ". etc.). The Frequency is based on industry operating experience and is consistent with the typical refueling cycle.

SR 3.3.2.7 SR 3.3.2.7 is the performance of a CHANNEL CALIBRATION. A CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor and is performed every 18 months.

The test verifies that the channel responds to the measured parameter within the necessary range and accuracy. In addition, this SR should include verification that the time constants are adjusted to the prescribed values where applicable.

CHANNEL CALIBRATIONS must be performed consistent with the assumptions of the unit specific setpoint methodology. The difference between the current "as found" values and the previous test "as left" values must be consistent with the drift allowance used in the setpoint methodology.

The Frequency of 18 months is based on the assumption of an 18 month calibration interval in the determination of the magnitude of equipment drift in the setpoint methodology.

(continued)

ZION Units 1 & 2 B 3.3-108 Rev. 00, October, 1997

ESFAS Instrumentation B 3.3.2 BASES SURVEILLANCE SR 3.3.P.8 REQUIREMENTS (continued) SR 3.3.2.8 is the performance of an ACTUATION LOGIC TEST as described in SR 3.3.2.2, except that it is only performed for the actuation logic associated with ESFAS interlock P-4 and the Turbine Driven Auxiliary feedwater Pump start on a SG water level low low condition. The P-4 interlock logic is satisfied (i.e., the circuit is complete) when both reactor trip breakers and their associated bypass breakers are opened.

In order to test the logic combinations for this . function, both reactor trip breakers and their associated bypass breakers must be opened.

The Turbine Driven Auxiliary Feedwater Pump receives a start signal when two-of-three low low levels exist in two-of-four SGs. The Logic Channel Test Panel, which is used to test the various combinations of logic necessary to develop the required starting coincidence, can not develop the SG low level logic in two-of-four SGs during unit operations without generating a reactor trip signal.

Therefore, the actuation logic for both the P-4 interlock and the Turbine Driven Auxiliary Feedwater Pump Functions are tested every 18 months during periods when the reactor trip function is not required to be OPERABLE. The Frequency is adequate and is based on operating experience and instrument reliability.

REFERENCES 1. UFSAR, Chapter 6,

2. UFSAR, Chapter 7.

3. UFSAR, Chapter 15,

4. IEEE-279-1968.

5. Westinghouse Setpoint Methodology for Protection Systems Zion Units 1 and 2, Eagle 21 Version, WCAP 12582, August, 1991.

6. NUREG-1218, Regulatory Analysis for Resolution of USI A-47, Safety Implications of Control Systems in LWR Nuclear Power Plants.

7. WCAP-10271-P-A, Supplement 2, Rev.1, June 1990.

ZION Units 1 & 2 B 3.3-109 Rev. 00, October, 1997

P PAM Instrumentation B 3.3.3 8 3.3 INSTRUMENTATION B 3.3.3 Post Accident Monitoring (PAM) Instrumentation BASES a

BACKGROUND The primary purpose of the PAM instrumentation is to display unit variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Accidents (DBAs).

The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected unit parameters to monitor and to assess unit status and behavior following an accident.

The availability of accident monitoring instrumentation is important so that responses to corrective actions can be observed and the need for, and magnitude of, further actions can be determined. These essential instruments are identified by unit specific documents (Ref.1) addressing the recommendations of Regulatory Guide 1.97 (Ref. 2) as required by Supplement I to NUREG-0737 (Ref. 3).

The instrument channels required to be OPERABLE by this LC0 include two classes of parameters identified during unit specific implementation of Regulatory Guide 1.97 as Type A and Category I variables. As such, the instruments listed in Table 3.3.3-1 of the accompanying LC0 consist of Type A and Category I variables.

Type A variables are included in this LCC because they provide the primary information required for the control room operator to take specific manually controlled actions for which no automatic control is provided, and that are required for safety systems to accomplish their safety functions for DBAs.

(continued)

ZION Units 1 & 2 B 3.3-110 Rev. 00, October, 1997

PAM Instrumentation B 3.3.3 BASES BACKGROUND Category I variables are the key variables deemed risk (continued) significant because they are needed to:

Determine whether other systems important to safety are performing their intended functions;

Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release; and

Provide information regarding the release of radioactive materials to allow for early indication of the need to initiate action necessary to protect the public, and to estimate the magnitude of any impending threat.

Tt.ese key variables are identified by the unit specific Regulatory Guide 1.97 analyses (Ref.1). These analyses identify the unit specific Type A and Category I variables and provide justification for deviating from the requirements of Regulatory Guide 1.97.

The specific instrument functions listed in Table 3.3.3-1 are discussed in the LC0 section.

APPLICABLE The PAM instrumentation ensures the operability of SAFETY ANALYSES Regulatory Guide 1.97 Type A and Category I variables so that the control room operating staff can:

Perform the diagnosis specified in the Emergency Operating Procedures (these variables are restricted to pre-planned actions for the primary success path of D3f.s, e.g., loss of coolant accident (LOCA));

Take the specified, pre-planned, manually controlled actions, for which no automatic control is provided, and that are required for safety systems to accomplish their safety function;

Determine whether systems important to safety are performing their intended functions;

Determine the likelihood of a gross breach of the barriers to radioactivity release; (continued) l ZION Units 1 & 2 B 3.3-111 Rev. 00, October, 1997 i

PAM Instrumentation B 3.3.3 BASES APPLICABLE

Determine if a gross breach of a barrier has occurred; SAFETY ANALYSES and (continued)

Initiate action necessary to protect the aublic and to estimate the magnitude of any impending tireat.

PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of the NRC Policy Statement. Category I, non-Type A, instrumentation must be retained in Technical Specifications because it is intended to assist operators in minimizing the consequences of accidents. Therefore, Category I, non-Type A, variables are important for reducing public risk and satisfies Criterion 4 of the NRC Policy Statement.

LCO The PAM instrumentation LC0 provides OPERABILITY requirements for Regulatory Guide 1.97 Type A instruments, which provide information required by the control room operators to perform certain manual actions specified in the Emergency Operating Procedures. These manual actions ensure that a :;ystem can accomplish its safety function, and are credited in tht: safety analyses. Additionally, this LC0 addresses Regulatory Guide 1.97 instruments that have been designated Category I, non-Type A.

The OPERABILITY of the PAM instrumentation ensures there is sufficient information available on selected unit parameters to monitor and assess unit status following an accident.

This capability is consistent with the recommendations of Reference 1.

LC0 3.3.3 requires two OPERABLE channels for most functions.

Two OPERABLE channels ensure no single failure prevents operators from getting the information necessary for them to determine the safety status of the unit, and to bring the unit to and maintair, it in a safe condition following an accident.

Furthermore, OPERABILITY of two channels llows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information. The exception to the two channel requirement is Containment Isolation Valve (CIV) Position.

In this case, the important information is the status of the containment penetrations. The LC0 requires one position (continued) l ZION Units 1 & 2 B 3.3-112 Rev. 00, October, 1997 l

l

{

PAM Instrumentation B 3.3.3 BASES LCO indicator for each active CIV. This is sufficient to ;

(continued) redundantly verify the isolation status of each isolable I penetration either via indicated status of the active valve and prior knowledge of a passive valve, or via system boundary status. If a normally active CIV is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for a 4 valve in this state is not required to be OPERABLE. l Table 3.3.3-1 lists all Type A and Category I variables identified by the unit specific Regulatory Guide 1.97 analyses, as amended by the NRC's Safety Evaluation Report (Ref. 1).

Type A and Category I variables are required to meet Regulatory Guide 1.97 Category I design and qualification requirements for seismic and environmental qualification, single failure criterian, utilization of emergency standby power, immediately accessible display, continuous readout, and recording of display.

Listed below are discussions of the specified instrument functions listed in Table 3.3.3-1.

1. Intermediate Ranae Neutron Flux Intermediate Range Neutron Flux indication is a Category I, Type B variable and is provided to verify reactor shutcown. The Intermediate Range instruments are capable of providing indication to cover the full range of flux that may occur post accident.

Neutron flux is indication used for accident diagnosis, verification of subcriticality, and diagnosis of positive reactivity insertion.

2, 3. Reactor Coolant System (RCS) Hot and Cold Lea Temperatures RCS Hot and Cold Leg Temperatures are Category I, Type A variables provided for verification of core cooling and long term surveillance.

l (continued)

ZION Units 1 & 2 B 3.3-113 Rev. 00, October, 1997 l

PAM Instrumentation B 3.3.3 BASES LCO 2, 3. Reactor Coolant System (RCS) Hot and Cold tea Temoeratures (continued)

RCS hot and cold leg temperatures can be used to calculate RCS subcooling margin. RCS subcooling margin will allow termination of safety injection (SI), if still in progress, or re-initiation of Si if it has been stopped. RCS subcooling margin is also used for unit stabilization and cooldown control.

> In addition, RCS hot and cold leg temperature can be used to monitor the cooldown rate and to verify the unit conditions necessary to establish natural circulation in the RCS.

All RCS hot leg temperature instruments have a common power supply and the resistance temperature detectors (RTDs) pass though a common containment electrical penetration. All RCS cold leg temperature. instruments have a common power supply and the RTDs pass though a common electrical penetration. Since these variable-are Category I, they require redundancy subject to the single failure criteria. The RCS hot and cold leg temperature instrumentation power supplies and electrical containment penetrations are separate from each other; however, both the RCS hot leg and cold leg temperature measurements are subject to failure of their respective power supply or containment electrical penetration which does not meet the single failure criterion for Category I channels.

The design of the RCS hot and cold leg temperature instrumentation is such that two channels of the RCS hot leg instruments and two channels of the RCS cold leg instruments have dual element RTDs. The second element provides indication on the Remote Shutdown Panel. These channels are electrically independent of the channels displayed in the control room. In addition, core exit thermocouple temperature, displayed in the control room, may be used as diverse indication to the RCS hot leg RTDs. Steam Generator Pressure, also displayed in the control room, may be used as diverse indication to determine the approximate value of RCS cold leg temperature (i.e.,

saturation temperature for steam generator pressure).

(continued)

ZION Units 1 & 2 B 3.3-114 Rev 00, October, 1997

1 l

1 PAM Instrumentation l B 3.3.3 l

l BASES LCO 2, 3. Reactor Coolant System (RCS) Hot and Cold Lea Temperatures (continued)

Although the RCS hot and cold leg temperature variables do not meet the single failure criteria, their design has been found acceptable because independent measurements can be monitored at the remote shutdown panel and diverse channels are available.

4. Reactor Coolant System Pressure (Wide Ranae)

RCS wide range pressure is a Category I, Type A variable provided for verification of core cooling and RCS integrity long term surveillance.

RCS pressure is used to verify delivery of SI flow to RCS from at least one train when the RCS pressure is below the pump shutoff head. RCS pressure is also used to verify closure of syray line valves and pressurizer power operated relief valves (PORVs).

In addition to these verifications, RCS pressure is used for determining RCS subcooling margin. RCS pressure can also be used:

to determine whether to terminate SI or to re-initiate SI;

to determine when to reset SI and shut off low head SI; i a to manually restart low head SI;

as reactor coolant pump (RCP) trip critme.; ard

to make a determination on the nature of the accident in progress and where to go next in the procedure.

(continued)

ZION Units 1 & 2 B 3.3 '15 Rev. 00, October, 1997

PAM Instrumentation B 3.3.3 BASES LCO 4. Reactor Coolant System Pressure (Wide Rance)

(continued)

RCS pressure is also related to three decisions about depressurization. They are:

to determine whether to proceed with primary system depressurization; e to verify termination of depressurization; and

to determine whether to close accumulator isolation valves during a controlled cooldown/depressurization.

A final use of RCS pressure is to determine whether to operate the pressurizer heaters.

RCS pressure is a Type A variable because the operator uses this indication to monitor the cooldown of the RCS following a steam generator tube rupture (SGTR) or small break LOCA. Operator actions to maintain a controlled cooldown, such as adjusting steam g9nerator (SG) pressure or level, would use this indicatt.1.

Furthermore, RCS pressure is one factor that may N used in decisions to terminate RCP operation.

RCS wide range pressure indication is displayed on the Reactor Control Panel by two nonsafety-related, O to 3000 psig pen recorders. Each pen is fed by a separate channel. Also provided on the Reactor Coolant Panel is a nonsafety-related, O to 1800 psig pressure indicator and a nonsafety-related, O to 600 psig pressure indicator. Each of these indicators are fed from one of the RCS wide range pressure instruments. The pressure recorder is nonsafety-related, therefore certain types of failures within the recorder could cause the failure of all of the wide range pressure indicators on the Reactor Control Panel. However, existing isolators protect the input of the RCS wide range pressure signals to the Incore Thermocouple Panel where both channels are also displayed. As such, if a failure of the pressure recorder (such as an internal short) were to occur and cause the failure of all main control board indicators (cortinued)

ZION Units 1 & 2 B 3.3-116 Rev. 00, October, 1997

PAM Instrumentation B 3.3.3 BASES LCO- 4. Reactor Coolant System Pressure (Wide Ranae)

(continued) and computer points, the operator would be able to display pressure from both instrument t.hannels on the Incore Thermocouple Panel.

Failure of the RCS pressure recorder would cause the operator to lose a recorded trend of RCS wide range pressure from the redundant pressure channels. The pressure recorder, therefore. does nat meet the single failure requirements of Regulatory Guide 1.97.

However, Regulatory Guide 1.97 only requires the recording of a ringle channel of a parameter unless direct and immediate trend or transient information is essential for operator information or action, in which case the recording should be continuously available on redundant dedicated recorders. Since direct and immediate trend or transient information is not essential for operator information or action, the use of a single recorder for recording RCS pressure for redundant instrument channels is acceptable.

5, 6. Reactor Vessel Water level (Wide and Narrow Range)

Reactor Vessel Water Level is a Category I, Type B variable and is provided for verification and long term surveillance of core cooling. It is also used for accident diagnosis and to determine reactor coolant inventory adequacy.

The Reactor Vessel Level Indicating System (RVLIS) provides a direct measurement of the collapsed liquid level above the lower core plate. The collapsed level represents the amount of liquid mass that is in the reactor vessel above the core. Measurement of the collapsed water level is selected because it is a direct indication of the water inventory.

RVLIS derives reactor vessel level from differential pressure measurements taken on the reactor vessel.

Inputs to control room indication are supplied by two wide range level transmitters and two narrow range level transmitters installed in separate instrument (continued)

ZION Units-l & 2 B 3.3-117 Rev. 00, October, 1997

. . = .

PAM instrumentation !

- B 3.3.3 i BASES :

LC0 5, 6. Reactor Vessel Water Level (Wide and Narrow Range)

(continued) t loops. The indications include two narrow range indicators, two wide range indicators and a two pen level recorder. The narrow range channels are used to '

monitor reactor vessel level while the reactor coolant pumps are off. The wide range channels monitor :

reactor vessel level while any of the reactor coolant pumps are running, t

7. Containment Water Level (Wide Ranae)

Containment Water Level is a Category 1 Type B ,

variable and is provided for verification and long :

teta surveillance of RCS integrity. .

Containment Water Level is used to determine:

containment recirculation sump tavel accident diagnosis; and e as a confirmatory indication to begin the recirculation procedure.

Containment Water Level is pro /ided by two wide range instrument channels. Each channel is capable of measuring a water level of 6 inches above the containment floor to 10 foot 6 inches above the containment floor. The water level in the containment building during the recirculation phase will be 5.06 feet off the floor elevation based on the volume of the RCS, accumulators, and the RWST. Therefore, the range ,nrovided by the Containment Water Level instruments is adequate for accident operations.

8. E2ntainment Pressure (Wide Ranael Containment Pressure (Wide Range) is a Category I, '

Type A variable and is provided for verification of RCS and containment OPERABILITY. ,

(continued)

ZION Units 1 1 2 B 3.3-118 Rev. 00, October, 1997

PAM Instrumentation i B 3.3.3 BASES LCO 8. Containment Pressure (Wide Ranae) (continued) l Containment wide range pressure is provided via two <

separate instrument channels with indication displayed on the Engineered Safegu wd Panel. One chcnnel also related recorder on provides the back of anthe input main to acontrol nonsafety board.

9. Containment Isolation Valve Positts.n CIV Position is t Category 1, Type B variable and is provided for verification of Containment OPERABILITY, and Phase A and Phase B isolation. 1 When used to verify Phase A and Phase B S 1ation, the important information is 4.0 isolatica status of *1e containment penetrations. The LCO reautres one channel of valve position indication in the control room to be operable for each active C1'l in a containment penetration flow path, i.e., two total channels of CIV position indication foi a penetration flow path with two active valves. For u ntainment penetrations with only one active CIV having control room indication, Note (b) require; a single channel of valve position indication to be OPERABLE. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve, prior knowledge of a passive valve, or via system boundary status.

Therefore, the position indication for valves in this state is not required to be OPERABLE. Note (a) to the Required Channels states that the function is not required for isolation valves whose associated penetration flow path is isolated by at least one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured.

10. Containment Area Radiation (Hiah Ranael Containment Area Radiation is a Category 1, Type A variable and is provided to monitor for the pntential of significant radiation reletsea and to provide (continued)

ZION Units 1 & 2 B 3.3-119 Rev. 00, October, 1997

PAM Instrumentation B 3.3.3 BASES LCO 10. Containment Area Radiation (Hioh Ranae) (continued) release assessment for use by operstors in determining the need to invoke site emergency plans.

Containment radiation level is used to determine if a highenergylinebreak(HELB)hasoccurredinside containment.

11. Hvdroaen Monitors The Hydrogen Monitors are a Category I, Type C variable and are provided to detect high hydrogen concentration conditions that represent a potential for containment breach from a hydrogen explosion.

This variable is also important in verifying the adequacy of mitigating actions.

12. Pressurirer level Pressurizer level is a Category 1 Type A variable and is used to determine whether to terminate 51, if still in progress, or to re initiate Si if it has been stopped. Knowledge of pressurizer water level is also used to verify the unit conditions necessary to establish natural circulation in the RCS and to verify that the unit is maintained in a safe shutdown condition.

13, 14. }1g.am Genera. tor _ Water level (Wide and Ncrrow Range)

SG Water Level is 4 Category I, Type A variable and is provided to monitor operation of decay heat removal via the SGs. The Category I indication of SG level extends from approximately 18 inches above the tube sheet (wide range only) to slightly above the lower portion of the cyclone separator (wide range and narrow range).

Redundant monitoring capability of the SG narrow range water level is provided by two required trains of instrumentation. The level signal is input to the unit corn, t** a centrol room indicator, SG water 1

(continued)

ZION Units 1 & 2 B 3.3-120 Rev. 00, October, 1997

1 PAM Instrumentation B 3.3.3 BASES LCO 13, 14. Steam Generator Water level (Wide and Narrow Range)

(continued) <

1evel control, and Reactor Trip System and Engineered Safety Features Actuation System instrumentation.

SG Water Level is used to:

> identify the ruptured SG following a tube rupturel ,

verify that the intact SGs are an adequate heat sink for the reactor; and e determine the nature of the accident in progress (e.g., verify an SGTR).

15. - S eam Generator Pressure SG pressure is a Category 1, Type A variable and is used to diagnose a faulted SG. SG pressure 31so

provides information required to mitigate an ,GTR event, verify natural circulation and to maintain ti.o unit in a safe shutdown condition. Each SG is provided with three pressure transmitter channels two of which are fully qualified. As such, only the two qualified pressure transmitters can be used to meet the LCO.

The required range for SG pressure instruments in Regulatory Guide 1.97 is from 0 to 120% of the lowest safety valve setting (1050 psig). Therefore, the required range is 0 to 1260 psig. The actual instrument range is 0 to 1200 psig. However, since the Technical Specifications require twenty ASME code valycs to be OPERABLE for full power operation, safet{e and t.. set pressure of these valves range from 1050 psig to 1100 psig, the actual SG pressure range of 0- "

1200 psig is sufficient to monitor all expected SG pressure conditions.

(continued)

ZION Units 1 & 2 B 3.3-121 Rev. 00, October, 1997

l PAM Instrumentation !

B 3.3.3 ;

i BASES l LCO 16. RCS Subcoolina Marain (continued)

The RCS subcooling margin monitors are a Category I, Type A variable and display degrees of subcooling in i the control room. The monitors use inputs from the i Core Exit Thermocouples and RCS wide range pressure.

The RCS pressure is used to determine the saturation temperature of the RCS. Saturation temperature minus actual temperature, determined using the incore thermocouples, equals the subcooling margin. Both f redundancy and single failure criteria are met by having two trains (channels) with each train of i instrumentation supplied by a separate instrument power supply bus. ,

Subcooling Margin is used to:

determine Si termination or re initiation

control unit cooldown and depressurization;

reactor coolant pump starting criteria; and

control charging flow.

17. Refuelina Water Storaae Tank (RWST) level RWST is a Category I, Type A variable. The RWST provides a water source and net positive suction head for the emergency core cooling pumps during the injection phase of a large breac loss of coolant accident. The RWST instrumentation together with the containment water level instrumentation provide the information necessary for evaluatir.: the conditions to

initiate the recirculation mode of emergency core cooling.

18. Condensate Storaae Tank (CST) level CST Level is a Category 1, Type A variable. Two fully qualified level transmitters provide CST level indication in the control room, The CST is the '

initial source of water for the auxiliary feedwater (AFW) System. A minimum volume of 170,000 gallons is (continued)

ZION Units 1 & 2 B 3.3-122 Rev 00, 0(.tober, 1997

PAM Instrumentation B 3.3.3 ;

BASES i

LCO 18. Condensate Storaae Tank (CST) level (continued) provided to ensure an adequate supply of water is available to the AFW pu:aps to maintain the unit in MODE 3 for two hours followed by four hours of cooldown at 50'F per hour. As the CST is depleted, '

manual operator action is necessary to replenish the CST or align suction to the AFW pumps from the Service Water System. Therefore, CST level indication is considered the primary method used by the operator to determine the CST inventory and thus establish the time remaining before manual o)erator action is required to either replenish t1e CST or realign the AFW pump suction.

19. Core Exit Temperature Core Exit Temperature is a Category I. Type A variable and is provided for verification and long term surveillance of core cooling.

An evaluation was made of the minimum number of valid core exit thermocouples (CETs) necessary for measuring core cooling. The evaluation determined the reduced complement of CETr necessary to detect initial core recovery and trend the ensuing core heatup. The evaluations account for core non-uniformities, including incore effects of the radial decay power distribution, excore effects of condensate runback in the hot legs, and nonuniform inlet temperatures.

Based on these evaluations, adequate measurement of core cooling is ensured with two valid Core Exit Temperature channels each containing two CETs per quadrant.

For Unit I, sixty five thermocouples are used to measure core exit tem)erature. Thirty four thermocouples, distri)uted among each of the four reactor quadrants, provide Channel A inputs. Thirty one thermocouples, distributed among each of the four reactor quadrants, provide Channel B inputs. For Unit 2, there are 62 thermocouples total, 31 in each Channel. The CETs are oriented radially to permit evaluation of core radial decay power distribution.

The average of ten hattest thermocouples is displayed (continued)

ZION Units 1 & 2 B 3.3-123 Rev. 00, October, 1997

. _ . _ _ ~ __. . _ _. . , .

PAM Instrumentation B 3.3.3 BASES LCO 19. Core Exit Temperature (continued) in the control room on the Incore Thermocouple Panel, in addition, individual thermocouple readings are also available by manual point selection. Core Exit Temperature is used to determine whether to terminate SI, if still in progress, or to re initiate 51 if it has been sto) ped. Core Exit Temperature is also used for unit sta)tlization and cooldown control.

20. Auxiliary Feedwater Flow AFW Flow is a Category I, Type A variable and is provided to monitor operation of decay heat removal via the SGs.

The AFW Flow to each SG is determined from a differential pressure measurement calibrated for a t range of 0 gpm to 300 gpm ser SG. There is one auxiliary feedwater flow clannel per SG. The instrument channels have redundant power supplies so that with the loss of one power supply, t'.vo channels of indication remain available, in ordtr to dissipate RCS residual heat, auxiliary feedwater flow is required to only two of the four SGs. Furthermore, SG narrow range level indication serves as a backup indication to the effectiveness of providing auxiliary feedwater to the SGs. The maximum expected flow under design conditions is 900 gpm (total). The total flow monitoring capability for auxiliary feedwater is 1200 gpm. Therefore, the existing auxiliary feedwater flow instrumentation exceeds the 0-110% dosign flow range specified in Regulatory Guide 1.97.

(continued)

ZION Units 1 & 2 8 3.3-124 Rev. 00, October, 1997

PAM Instrumentation B 3.3.3 !

BASES i LCO 20. Auxiliary Feedwater Flow (continued) i Each differential pressure transmitter )rovides an input to a control room indicator and tie unit ,

computer. Since the primary indication used by the operator during an accident is the control room ,

indicator, the PAM specification deals specifically with this portion of the instrument channel. AFW flow is used three ways:

to verify delivery of AFW flow to the SGs;

to determine whether to terminate SI if still in progress, in conjunction with SG water level (narrow range); and

to regulate AFW flow so that the SG tubes remain covered.

As previously stated, AFW flow is also used by the o)erator to verify that the AFW System is delivering tie correct flow to each SG. However, the primary indication used by the operator to ensure an adequate inventory is SG 1evel.

APPLICABILITY The PAM instrumentation LCO is applicable as specified on Table 3.3.3 1. All listed functions are required to be OPERABLE in MODES 1, 2, and 3 except the Hydrogen Monitors which are only required in MODES I and 2. These variables <

are related to the diagnosis and pre-planned actions required to mitigate DBAs. The applicable DBAs are assured to occur in MODES 1, 2, and 3. In MODE 3, the Hydrogen Moni_toring function is not required since the hydrogen production rate and the total hydrogen produced would be less than that calculated for the DBA LOCA. In MODES 4, 5, and 6, unit conditions are such that the likelihood of an event that would require any PAM instrumentation is low; therefore, PAM instrumentation is not required to be OPERABLE in these MODES.

(continued)

ZION Units 1 & 2 B 3.3-125 Rev. 00, October, 1997 ;

~

PAM Instrumentation B 3.3.3 j

BASES (continued)

ACTIONS A Note has been added in the ACTIONS to clarify the aaplication of Completion Time rules. The Conditions of tais Specification may be entered independently for each The Completion Time (s) of function listed on Table 3.3.3-1.

the inoperable channel (s) of a function will be tracked separately for each function starting fromWhenthe time the the Required Condition was entered for that function.

Channels in Table 3.3.3-1 are specified on a per penetration or per SG basis, then the Condition may be entered 'his separately for each penetration or SG as appropriate.

is appropriate since multiple penetrations and/or SGs may have an inoperable channel.

M Condition A applies when one or more functions have one required channel that is inoperable. Required Action A.!

requires restoring the inoperable channel to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel, the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.

A Note has been added in the ACTIONS to exclude the MODE change restriction of LCO 3.0.4. This exception allows entry into the applicable MODE while relying on the ACTIONS even though the ACTIONS may eventually require unit shutdown. This exception is acceptable due to the passive function of the instruments, the operator's ability to respond to an accident using alternate instruments and methods, and the low probability of an event requiring these instruments.

M Condition B applies when the Required Actions and associated The Required Completion Times for Condition A are not met.

Action specifies initiation of action in accordance with Specification 5.6.7, "PAM Report," which requires This report a written discusses report to be submitted to the NRC.

the results of the root cause evaluation of the inoperability and identifies proposed restorative actions.

(continued)

B 3.3-126 Rev. 00, October, 1997 ZION Units 1 & 2

PAM Instrumentation B 3.3.3 BASES ACTIONS M (continued)

This action is appropriate in lieu of a shutdown requirement since alternative actions are identified before loss of functional capability, and given the icw likelihood of unit conditions that would require information provided by this instrumentation, j i

L.1 Condition C applies to all PAM instrument functions.

Condition C is entered when one or more of the functions listed on Table 3.3.31 have two required channels inoperable. The Requ' red Action is to enter the applicable -

Condition for the inoperable function, as referenced on Table 3.3.3 1, and to take the Required Actions for the affected function. The Completion Times are those from the referenced Condition and Required Actions.

M

'dhan two channels of function 5, 6, or 10 are inoperable, actions must be initiated immediately per Specification 5.6.7, "PAM Re) ort." which requires a written report to be submitted to tie NRC. This re) ort discusses the results of the root cause evaluation of tie inoperability and identifies proposed restorative actions. This action is appropriate in lieu of a shutdown requirement since alternative actions are identified before loss of functional capability, and given the low likelihood of unit conditions that would require information provided by this instrumentation.

L.1 Condition E applies to functions 1-4, 7-9, and 12-20 on Table 3.3.3-1. Condition E is entered when one or more functions have two inoperable required channels (i.e., two channels inoperable in the same function). Required Action E.1 requires restoring one channel in the function (s) to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the (continued)

ZION Units 1 & 2 B 3.3 127 Rev. 00, October, 1997

--. - - - _ - -. - . - = _ - _ _ - . _ _ _ - _ - . . - - . - - _ . . - . - - -

PAM instrumentation B 3.3.3 BASES ACTIONS [.d (continued) availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of th, function limits the risk that the PAM function will be in a degraded condition should an accident occur.

A Note has been added in the ACTIONS to exclude the MODE change restriction of LCO 3.0.4. This exception allows entry into the applicable MODE while relying on the ACTIONS '

even though the ACTIONS may eventually require unit shutdown. This exception is acceptable due to the passive function of the instruments, the operator's ability to res)ond to an accident using alternate instruments and met 1ods, and the low probability of an event requiring these ;

instruments, fd If the Required Action and associated Complation Time of '

Condition E are not met the unit must be , aced in a MODE where the requirements of this LC0 do not apply. To achieve this status, the unit must be placed in MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

- 9_d Condition G applies when two hydrogen monitor channels (function 11) are. inoperable. Required Action G.1 requires restoring one hydrogen monitor channel to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable based on the backup capability of the Post Accident Sampling System to monitor the hydrogen concentration for evaluation of core damage and to provide information for operator ,

(continued)

ZION Units 1 & 2 B 3.3-128 Rev. 00, October, 1997

PAM Instrumentation B 3.3.3 BASES ACTIONS 9.d (continued) deci tons. Also, it is unlikely that a LOCA (which would cause core damage) would occur during this time.

1 A Note has been added in the ACTIONS to exclude the MODE change restriction of LC0 3.0.4. This exception allows entry into the applicable MODE while relying on the ACTIONS even though the ACTIONS may eventually require unit shutdown. This exception is acceptable due to the passive function of the instruments, the operator's ability to res)ond to an accident using alternate instruments and met 1ods, and the low probability of an event requiring these instruments.

H.d if the Required Action and associated Completion Time of Condition G are not met the unit must be placed in a MODE where the requirements of this LC0 do not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The allowed Completion Time is reasonable, based on l operating experience, to reach the required unit conditions 4 from full power conditions in an orderly manner and without challenging plant systems. P SURVEILLANCE A Note has been added to the SR Table to clarify that REQUIREMENTS SR 3.3.3.1 and SR 3.3.3.2 apply to each PAM instrumentation function in Table 3.3.3-1.

SR 3.3.3.1 Performance of the CHANNEL CHECK once every 31 days ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication (continued)

ZION Units 1 & 2 B 3.3-129 Rev. 00, October, 1997 I _ _ -

PAM Instrumentation B 3.3.3 BASES SURVEILLANCE SR 3.3.3.1 (continued)

REQUIREMENTS of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CAllBRATION.

Agreement criteria are detemined by the plant staff, based on a combination of the channel instrumeist uncertainties, including isolation, indication, and readability. If a channel is outside the match criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the :

channels are OPERABLE.

l The frequency of 31 days is based on operating experience that demonstrates that channel failure is rare. The CHANNEL ,

CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays

associated with the LCO required channels.

i 1

SR 3.3.3.2

^

A CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor and is performed every 18 months.

The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. This SR is modified by a Note that excludes neutron detectors. The calibration method for neutron detectors is specified in the BasesofLCO3.3.1,"ReactorTripSystem(RTS)

Instrumentation." The Frequency is based on operating experience and consistency with the typical industry refueling cycle.

I (continued)

ZION Units 1 & 2 B 3.3-130 Rev. 00, October, 1997 x-;.-..-.-.-.--- . - . - - . - - , .

i l

PAM Instrumentation B 3.3.3 BASES (continued)

REFERENCES 1. Zion Station Units 1 and 2 Regulatory Guide 1.97 Compliance,LetterfromS.F.Stimac(CECO)-tot.E.

Murley (NRC), dated April 15, 1991, and associated Safety Evaluations.

2. Regulatory Guide 1.97, Revision 3. " Instrumentation for Light Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and following an 1 Accident," May 1983.

3. NUREG0737, Supplement 1-(GenericLetter82-33),"TMI Action Items, Requirements for Emergency Response .

Capability," December 17, 1982. I s

i J

t i

ZION Units 1 & 2 B 3.3 131 Rev. 00, October, 1997 e--y 7 y--w.-p*.qa-..-.y- .r+y>p y g m g g '-pg- -.mmae-, m. y.m-ys- .5e--aw-gg y-g. -g- g gig.-->py-- ewap.-...wr-* - e avam wy ww -mm --t-N

i R: mote Shutdtwn System B 3.3.4 f

B 3.3 INSTRUMENTATION ,

8 3.3.4 Remote Shutdown System BASES BACKGROUND The Remote Shutdown System provides the control room !

operator with sufficient instrumentation and controls to place and maintain the unit in a safe shutdown condition from a location other than the control room. This capability is necessary to protect against the possibility (

that the control room becomes inaccessible. A safe shutdown condition is defined as MODE 3. With the unit in MODE 3, theAuxiliaryFeedwater(AFW)Systemandthesteamgenerator (SG) safety valves or the SG atmospheric relief valves (ARVs) can be used to remove core decay heat and meet all safety requirements. The long term su> ply of water for the AFW System and the ability to borate tie Reactor Coolant System (RCS) from outside the control room allows extended operation in MODE 3.

If the control room becomes uninhabitable, the operators can establish control at the remote shutdown panels, to place and maintain the unit in MODE 3. Not all controls and necessary transfer switches are located at the remote '

shutdown panels. Some controls and transfer switches will have to be operated locally at the switchgear, motor control panels, or other local stations. The unit automatically i reaches MODE 3 following a unit shutdown and can be maintained safely in MODE 3 for an extended period of time.

The OPERABILITY of the Remote Shutdown System control and instrumentation functions provides sufficient information on selected unit parameters to place and maintain the unit in MODE 3 should the control room become uninhabitable.

APPLICABLE The Remote Shutdown System is required to provide equipment SAFETY ANALYSES at a)propriate locations outside the control room with a capa)ility to promptly shut down and maintain the unit in a safe condition in MODE 3.

1 (continued)

ZION Units 1 & 2 8 3.3-132 Rev. 00, October, 1997 I

RGeote Shutdown System B 3.3.4 BASES ,

APPLICABLE The criteria governing the design and specific system SAFETY ANALYSES requirements of the Remote Shutdown System are located in <

(continued) 10 CFR bO, Appendix A, GDC 19 (Ref. 1). The Zion Station i design conforms with the intent of GDC 19 (Ref. 2).

The Remote Shutdown System is considered an important contributor to the reduction of unit risk to accidents and as such it has been retained in the Technical Specifications

~

as satisfying Criterion 4 of the NRC Policy Statement.

LC0 The Remote Shutdown System LCO provides the OPERABILITY requirements of the instrumentation and controls necessary to place and maintain the unit in MODE 3 from a location other than the control room. The required instrumentation and controls are listed in Bases Table B 3.3.4-1.

The controls, instrumentation, and transfer switches are required for:

Core reactivity control (initial and long term);

RCS pressure control;

Decay heat removal via the AFW System and the SG safety valves or SG ARVs;

RCS inventory control via charging flow; and

Safety support' systems for the above functions, including service water, component cooling water, and onsite power.

A function of a Remote Shutdown System is OPERABLE if all instrument and control channels needed to support the Remote Shutdown System function are OPERABLE. In some cases; the required information or control capability is available from several alternate sources, in these cases, the function is OPERABLE as long as one channel of any of the alternate information or control sources is OPERABLE.

(continued)

ZION Units l & 2 B 3.3-133 Rev. 00, October, 1997

Remote Shutdown Systen B 3.3.4 BASES l

LCO The Remote Shutdown System instrument and control circuits '

(continued) covered by this LCO do not need to be energized to be considered OPERABLE. This LCO is intended to ensure the instruments and control circuits will be OPERABLE if unit conditions require that the Remote Shutdown System be placed in operation.

APPLICABILITY The Remo e Shutdown System LCO is applicable in MODES 1, 2, and 3. This is required so that the unit can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room.

This LC0 is not applicable in MODE 4, 5, or 6. In these ,

MODES, the facility is already suberitical and in a condition of reduced RCS energy. Under these conditions, considerable time is available to restore necessary instrument control functions if control room instruments or controls become unavailable.

ACTIONS Note 1 is included which excludes the MODE change restriction of LCO 3.0.4. This exception allows entry into an applicable MODE while relying on the ACTIONS even though the ACTIONS may eventually require a unit shutdown. This exception is acceptable due to the low probability of an event requiring the Remote Shutdown System and because the equipment can generally be repaired during operation without significant risk of spurious trip.

Note 2 has been added to the ACTIONS to clarify the application of Completion Time rules. Separate Condition entry is allowed for each function listed on Table B 3.3.4 1. The Completion Time (s) of the inoperable channel (s)/ train (s) of a function will be tracked separately for each function starting from the time the condition was entered for that function.

A.1 Condition A addresses the situation where one or more >

required functions of the Remote Shutdown System are inoperable. This includes the control and transfer switches.

(continued)

ZION Units 1 & 2 B 3.3-134' Rev. 00, October, 1997

Remote Shutdown System B 3.3.4 BASES ACTIONS M (continued)

The Required Action is to restore the required function to OPERABLE status within 30 days. The Completion Time is based on operating experience and the law probability of an event that would require evacuation of the control room.

S.1 and B.2 i If the Required Action and associated Completion Time of Condition A is not met, the unit must be placed in a MODE in which the LCO does not apply. This is done by alacing the unit in MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 wit 11n 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on i operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without I challenging plant systems.

SURVEILLANCE SR 3.3.4.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 31 days ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations '

between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CAllBRATION.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If the channels are within the match criteria, it is an indication that the channels are OPERABLE. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

(continued)

ZION Units 1 & 2 B 3.3-135 Rev. 00, October, 1997

e Remote Shutdown System B 3.3.4 '

BASES SURVEILLANCE SR 3.3.4.1 (continued) r L

REQUIREMENTS As specified in the Survoillance, a CHANNEL CHECK is only required for those channels which are normally energized.

The Frequency of 31 days is based upon operating experience which demonstrates that channel failure is rare.

SR 3.3.4.2 SR 3.3.4.2 verifies each required Remote Shutdown System control circuit and transfer switch performs the intended function. This verification is performed from the remote shutdown panels and locally, as appropriate. Operation of the equipment from the remote shutdown panels is not necessary. The surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the unit can be placed and maintained in MODE 3 from the remote shutdown panels and the local control stations. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance was performed with the reactor at power. (However, this Surveillance is not required to be performed only during a unit outage.)

Operating experience demonstrates that remote shutdown control channels usually pass the Surveillance test when performed at the 18 month Frequency.

SR 3.3.4.3 CHANNEL CAllBRATION is a complete check of the instrument loop and the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. The frequency of 18 months is based upon operating experience and consistency with the typical industry refueling cycle.

REFERENCES 1. 10 CFR 50 Appendix A, CDC 19.

2. UFSAR, Section 3.1 i

ZION Units 1 & 2 B 3.3-136 Rev 00, October, 1997

Remote Shutdswn System B 3.3.4 Table B 3.3.4 1 (pose 1 of 1)

Remote Shutdown System Instrumentetten and Centrole FUNC110N/INSTRUNfNT -REQUIR(D i OR CONTROL PARAMETER WJ4BER OF FUNCil0N$

1. Reactivity Control s .. Reector Trip Brooker Poettlon(e) g (per trip breeter)

b. Manuel Reactor trip (*I 1 (per trip breaker) 1

2. Reactor Coolant System (RCS) Pressure Control

s. RCS Wide Renee Pressure 1

3. Decay Neet Removet via steen Generators (SGs)

e. RCS Not Leg feaperature 2

b. RC$ Cold Les Temperature 1

c. AFW Pump control 1

d. SG Pressure (per SG) 1

e. SG Level (per SG) 1 or AFW flou (per $G) 4 RCS Inventory Control

e. Pressurlaer level 1

b. Cherking Pump Control 1 (e) This (metton is performed locally at the breaker and applies to Reactor Trip Breakers and Reactor frlp Rpes tree 6ere that are rockhl in and closed.

ZION Units l'& 2 B 3.3-137 Rev. 00, October, 1997

LOP DG Start Instrumentation B 3.3.5 B 3.3 INSTRUMENTATION B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation BASES BACKGROUND The DGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation. Voltage monitoring relays will generate an LOP DG start if a loss of voltage or degraded voltage condition occurs (Ref. 1).

Undervoltage protection on the 4.16 kV ESF buses consists of two relays on each bus configured in a two-out-of-twn logic.

Upon the loss of ESF bus voltage, as sensed by the ESF bus undervoltage relays, the DG associated with the respective ESF bus starts. The DG attains rated speed and voltage and the DG output breaker closes, then the loads associated with the affected ESF bus sequence on the bus through the safe shutdown sequencer. Automatic actuation of the Service Water (SW) pumps by the sequever will also result in automatic closure of the respective buses associated Turbine Building Supply Isolation Valve (MOV SWO100 or MOV-SWO115) and the Service Water System Booster Pump Suction and Strainer Backwash Header Isolation Valve (OH0V-SW0005, OMOV.

SW0006,or0FCV-SW54).

Degraded voltage protection on the 4.16 kV ESF buses consists of two relays on each bus configured in a two out-of-two logic. When bus voltage drops below a preset value for longer than 8 (i 2) seconds, a 5 ( 5%) minute timer is initiated. When the timer times out, a safe shutdown sequence is initiated for the affected bus. If a Safety injection (SI) signal is generated concurrent with a degraded voltage condition, or at any time during the time delay, then a safeguard sequence is initiated.

The 8 (i 2) second time delay is provided to minimize the effects of short duration disturbances on the bus. For example, the starting of a large safety related pump during a loss of coolant accident will result in a momentary drop in ESF bus voltage. The drop in voltage is expected to be short in duration and it would be undesirable for this expected condition to result in separation of the ESF bus from the offsite AC power souce and initiation of a DG start with sequenced loading.

(continued)

ZION Units 1 & 2 8 3.3-138 Rev. 00, October, 1997

LOP DG Start instrumentation i B 3.3.5 BASES BACKGROUND Therefore, a time delay of adequate duration to prevent (continued) system actuation for such expected occurrences is provided.

minute time delay is of sufficient duration to The 5 (ispur prevent 5%)ious operation of the degraded voltage relays ;

during short bus voltage dips that may result from starting large motors, or from short duration grid disturbances. In addition, the time delay will allow operator response to the i-degraded voltage condition before automatic system actuation occurs. The 5 (+ 5% minute time delay is short enough to ensure that the Begra)ded voltage condition will not result in failure of a safety system or components.

, Allowable Values and Trio Setooints Allowable Values are derived from the analytical limits contained in plant specific calculations. Allowable Values .

provide a conservative margin with regards to instrument uncertainties to ensure analytical limits are not violated' 4 during anticipated operational occurrences and that the consequences of Design Basis Accidents (DBAs) will be acceptable providing the unit is operated from within the LCOs at the onset of the event and required equipment functions as designed.

Trip Setpoints are the nominal values at which the relays are set. Trip Setpoints are derived from the Allowable :

Value. The actual nominal Trip Setpoint entered into the relay is more conservative than that specified by the Allowable Value to account for changes in random and non-random measurement errsrs. One example of such a change in measurement error is drift during the surveillance interval, ,

Any relay is considered to be properly adjusted when the "as left" value is within the band for CHANNEL CAllBRATION accuracy. If the measured value of a relay exceeds the Trip Setpoint but is within the Allowable Value, then the '

associated LOP DG Start Instrumentation function is considered OPERABLE. Trip Setpoints are specified in applicable plant procedures, for the Degraded Voltage function, the analytical limit is established to ensure all safety loads fed from a 4.16 kV ESF bus will have an actual voltage greater than the worst case minimum voltage postulated for that bus during a DBA (Ref. 2).

(continued) i ZION Units 1 & 2 B 3.3 139 Rev. 00, October, 1997 i

.,,..--v.c-- , - .,~.--w...v. -- . . . , , , , - - , - . . . , ,,.- ,., - ,,-m-...-,,._,.!-.y,, -,,,,,.-v-,,,r

LOP DG Start Instrumentation B 3.3.5 1

PASES Background if the measured value of a degraded voltage relay exceeds (continu6d) the Allowable Valuo, then the associated LOP DG Start i instrumentation function is considered inoperable. !

For the Undervoltage functions, an analytical limit does not i exist since the purpose of the function is to detect a total ,

loss of voltage. As such, the Allowable Value is based on a )

plant specific evaluation of the functional requirement for l the instrument channel (Ref. 3).

The Allowable Values contained in the CHANNEL CAllBRATION surveillance for the Degraded Voltage function are provided on a 0 to 120 volt scale. This is because the degraded voltage relays are attached to 4.16 kV to 120 V potential transformers which lack a specific method needed to account for transformer uncertainties. Although the Undervoltage function also uses a potential transformer, the Allowable Values for the undervoltage relays are provided on a 0 V to 4.16 kV scale. This is because any uncertainties associated with the transformers have been accounted for in the determination of the Allowable Values for the undervoltage relays.

The potential transformers associated with the Degraded !

Voltage function have a ratio of approximately 35 to 1. As !

such, the approximate allowable value is 3895.5 volts. '

APPLICABLE The LOP DG Start Instrumentation is required for the SAFETY ANALYSES Engineered Safety Features (ESF) Systems to function in any accident with a loss of offsite power. In addition, the LOP Start Instrumentation is required to function in the event of a loss of Offsite Power (LOOP) to provide DG autostart, Service Water pump loading, and automatic closure of the Service Water Turbine Building Supply, and the Service Water System Booster Pump Suction and Strainer Backwash Header Isolation Valves so that the SW System flow rates are maintained within the capacity of the operating pumps. The LOP DG Start Instrmentation design basis is that of the ESF Actuation System (ESFAS).

For a loss of >ower event occurring-in Modes 1, 2, 3, or 4, concurrent wit 1 an ESF actuation which initiates an 51 (continued)

ZION Units 1 & 2 B 3.3-140 Rev. 00, October, 1997

LOP DG Start Instrumentation B 3.3.5 BASES APPLICABLE signal, the accident analyses assume the DGs on the affected i SAFETY ANALVES unit start from the signal which is generated by the ESFAS.

(continued) DG loading is included in the delay time associated with each safety system component requiring DG sup)11ed >ower. )

The accident analyses bounds the loading of tie DG )ased on a loss of offsite power concurrent with a loss of coolant accident. For a loss of power event without a concurrent ESF actuation which initiates an SI signal, the accident analyses assume the DG start signal is generated by the LOP .

Start Instrumentation.

The required channels of LOP DG Start Instrumentation, in conjunction with the ESF systems powered from the DGs, provide Gnit protection for the analyzed accidents discussed in Reference 3 In which a loss of offsite power is assumed.

The LOP DG Start Instrumentation channels satisfy Criterion 3 er the NRC Policy Statement.

LCO The LCO for LOP DG Start Instrumentation requires two channels of undervoltage for each required 4.16 kV ESF bus, and two channels of degraded voltage for each required 4.16 kV ESF bus to be OPERABLE whenever a DG is required to be OPERABLE.

An OPERABLE channel consists of the required relays, contacts and wiring necessary to ensure that the automatic start and subsequent loading of the DG is available. 1 APPLICABillTY The LOP DG Start Instrumentation functions are required in support of their associated DGs. Therefore the LOP DG Start instrumentation is on1' quired when its associated DG is required to be OPERABLl, ) Refer to the Applicability discussions in the Bases for LCO's 3.8.1, 3.B.2, and 3.7.8.

ACTIONS In the event a channel's Trip Set)oint is found nonconservative with respect to tie Allowable Value, or the channel is found otherwise inoperable, then the function that channel provides must be declared inoperable and the LCO Condition entered for the particular protection function affected.

(continued)

=

ZION Units 1 & 2 B 3.3 141 Rev 00, October, 1997

LOP DG Start Instrumentation l B 3.3.5 !

BASES ,

ACTIONS A Note has been added in the ACTIONS to clarify the (continued) a) plication of Completion Time rules. The Conditions of t11s Specification may be entered se)arately for each function listed in the LCO on a per aus basis. This is because the required channels are s)ecified on a per bus '

basis. The Completion Time (s) of t1e innperable channel s of a function will be tracked separately for aach functio (n) starting from the time the Condition was entered for that function.

M Condition A applies to an LOP DG start instrument function ,

with one channel on one or more buses inoperable.

If one channel is inoperable, Required Action A.1 requires that channel to be placed in trip within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . With a channel in trip, the LOP DG Start Instrumentation channels are configured to provide a one out of-one logic to initiate an undervoltage or degraded voltage signal for that bus. A Note is added to allow bypassing an inoperable channel for u) to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for survelliance testing of other channels.

Tits allowance is made where bypassing the channel does not cause an actuation.

The specified Completion Time is reasonable considering the low probability of an event occurring during these intervals.

M ,

Condition B applies to an LOP DG start instrument function with two channels on one or more buses inoperable.

Required Action B.1 requires restoring one channel of the affected function to OPERABLE status. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time takes into account the low probability of an event requiring an LOP start occurring during this interval.

(continued)

ZION Units 1 & 2 .B 3.3 142 Rev. 00, October, 1997

- ~ - - - . - . - - . . . _ .

LOP DG Start Instrumentation '

B 3.3.5 i

BASES ACTIONS M (continued) '

Condition C applies to each of the LOP DG start instrument functions when the Required Action and associated Completion Time for Condition A or B are not met.

In these circumstances the Conditions s)ecified in LCO 3.8.1, "AC Sources-0)erating," or .00 3.8.2, "AC Sources-Shutdown," for tie DG made inoperable by failure of the LOP DG Start Instrumentation are required to be entered immediately. The actions of those LCOs provide for adequate .

compensatory actions to assure unit safety. l SURVEILLANCE SR 3.3.5.1 REQUIREMENTS-SR 3.3.5.1 is the performance of a TADOT for the required degraded voltage functions and is performed every 31 days.

The test shall verify the OPERABillTY of the degraded voltage channels by independently testing each degraded voltage relay associated with its respective ESF bus.

The frequency is based on the known reliability of the functions and has been shown to be acceptable through operating experience.

SR 3.3.5.2 SR 3.3.5.2 is the performance of an ACTUATION LOGIC TEST.

Performance of the ACTUATION LOGIC TEST demonstrates the OPERABILITY of the channels associated with each LOP DG start instrument function by testing all possible logic combinations.

The 18 month frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an un)lanned transient if the Surveillance were performed with t1e reactor at power.

0)erating experience has shown these components usually pass tie Surveillance when performed at the 18 month Frequency.

(continued)

ZION Units 1 & 2 B 3.3-143 Rev. 00, October, 1997

LOP DG Start Instrumentation B 3.3.5 BASES SURVEILLANCE SR 3.3.5.3 REQUIREMENTS (continued) SR 3.3.5.3 is the performance of a CHANNEL CAllBRATION of the undervoltage and degraded voltage channels.

The degraded voltage portion of the test shall include a single point verification that the trip occurs within the required time delay, as described in Reference 1.

A CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor and is performed every 18 months.

The test verifies that the channel responds to a measured parameter within the necessary range and au.uracy.

The Frequency of 18 months is based on operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an 18 month calibration interval in the determination of the magnituoe of equipment drift in the setpoint analysis.

REFERENCES 1. UFSAR, Section 8.3.

2. Comed Calculation No. 22S B-024E-010

3. Comed Letter, Chron #310803.

ZION Units 1 & 2 B 3.3-144 Rev. 00, October, 1997

1 Containment Ventilation Isolation Instrumentation B 3.3.6 ,

B 3.3 INSTRUMENTATION B 3.3.6 Containment Ventilation Isolation Instrumentation BASES BACKGROUND Containment ventilation isolation instrumentation closes the containment purge supply and exhaust valves and the containment pressure and vacuum relief v Cves. This action isolates the containment atmosphere from the environment to minimize the release of radioactivity in the event of an accident. A discussion of the containment purge supply and exhaust valves and the containment pressurc and vacuum relief valves is provided in the Bases of Specification 3.6.3, " Containment Isolation Valves.

Four separate radiation monitors provide inputs to the containment ventilation isolation instrumentation. These four monitors consist of one containment atmosphere radiation monitor RIA PR40), one con ainment purge radiation monitor RT-PR09), and two containment fuel handling area radi tion monitors (RT AR04A and RT-AR048).

Containment ventilation isolation is also initiated on an automatic safety injection (SI) signal through the Containment Isolation-Phase A function, or by manual actuation of Phase A Isolation. The Bases for LCO 3.3.2,

" Engineered Safety Feature Actuation System (ESFAS)

Instrumentation," discuss these modes of initiation.

The containment atmosphere radiation monitor is comprised of a gaseous channel (5), particulate channel (1) and an iodine channel (3). The containment purge radiation monitor is also comprised of a gaseous channel (A), particulate channel (C) and an iodine channel (B). The gaseous, particulate and iodine channels will respond so most events that release radiation to containment. However, analyses have hot been conducted to demonstrate that all credible events will be detected by more than one channel. Therefore, for the purposes of this LCO the gaseous, particulate and iodine channels are not considered redundant. Instead, they are treated as three one-out-of-one channels. The two fuel handling area monitors each have one gamma detection channel. Both channels are required to provided redundant detection capability to the containment atmosphere radiation monitor and the containment purge radiation monitor during CORE ALTERATIONS or during movement of irradiated fuel (continued)

ZION Units 1 & 2 B 3.3-145 Rev. 00, October, 1997

Containment Ventilation Isolation Instrumentation B 3.3.6 BASES BACKGROUND assemblies within containment when the containment purge '

(continued) supply and exhaust valves, or containment pressure and vacuum relief valves are open.

The Containment Purge System has inner and outer containment

- isolation valves in its supply and exhaust )enetrations. A high radiation signal from any one of the tiree channels associated with the containment atmosphere radiation monitor or the containment purge radiation monitor, or from either

' of the conteinment fuel handling area radiation monitor channels, will initiate containment purge isolation which closas both tne inner and outer containment isolation valves.

The pressure and vacuum relief penetration has two outer isolation valves. A high radiation signal- from any one of the three channels associated with the containment atmosphere radiation monitor, or from either of the containment fuel handling area monitor. channels, will .

initiate a close signal to these valves. A high radiation signal from the containment purge radiation monitor will not initiate closure of the pressure and vacuum relief valves.

Durino containment purging operations, the containment ventilation isolation function can be fulfilled by either the containment atmosphere radiation monitor or the containment purge radlation monitor. Either monitor provides an acceptable level of containment isolation capability. For containment pressure and vacuum relief control, the containment ventilation isolation function can only be fulfilled by the containment atmosphere radiation monitor.

The containment fuel handling area radiation monitor is designad to detect a fuel handling accident quickly enough to isolate the containment ventilation before the resultant radioactive gas bubble could escape containment. As such, this monitor is only required during CORE ALTERATIONS-or movement of' irradiated fuel assemblies within containment when the ccntainment purge supply and exhaust valves or the centainment pressure and vacuum relief valves are open.

m (continued)

ZION Units 1 & 2 B 3.3-146 Rev. 00, October, 1997

Containment _ Ventilation Isolation Instrumentation B 3.3:6 n ~

BASES (continued)

APPLICABLE -The safety analyses assume that the containment remains SAFETY ANALYSES intact with penetrations unnecessary for core cooling isolated early in the event (i.e., within approximately 60 seconds). The containment atmosphere radiation monitor acts as backup to the SI signal in MODES 1, 2, 3, and 4 to ensure closure of the containment ventilation valves.

During CORE ALTERATIONS or movement of irradiated fuel assemblies within containment the containment atmosphere radiation monitor, containment purge radiation monitor and l,

the containment fuel handling area radiation monitor are the primary means for automatically isolating containment in the event of a fuel handling accident. Containraent ventilation

! isolation instrumentation is provided to support kee)ing the containment leakage rate within the assumptions of tie safety analyses and the calculated accidental offsite radiological doses below the 10 CFR 100 (Ref.1) guidelines.

The containment ventilation isolation instrumentation satisfies Criterion 3 of the NRC Policy Statement.

LC0 The LCO requires the instrumentation necessary to initiate containment ventilation isolation, listed in Table 3.3.6-1, to be OPER/3LE.

1. Manu.: Initiation The LCO requires one manual initiation channel per containment purge supply and exhaust valve, and one manual initiation channel per containment pressure and vacuum relief valve, to be OPERAELE. The operator can initiate containment ventilation isolation at any time by using the valve control switches in the control room. Each switch actuates its associated containment ventilation valve. This action will cause actuation in the same manner as an automatic actuation signal.

(continued)

ZION Units 1 & 2 B 3.3-147 Rev. 00, October, 1997

Containment Ventilation Isolation Instrumentation B 3.3.6 BASES

LCO 2, 3. Containment Atmosohere Radiation Monitor and (continued) Containment Purae Radiation Monitor The LCO requires three OPERABLE channels of the containment atmosphere radiation monitor and three OPERABLE channels of the containment purge radiation monitor to provide the necessary radiation monitoring instrumentation to initiate containment ventilation isolation for design basis events which result in the release of radioactivity to containment. .

Channel OPERABILITY includes OPERABILITY of the channel electronics (including contacts and interlocks), correct valve-lineups, sample pump and

motor operation, as well as detector OPERABILITY.

These supporting features are necessary to proviue containment ventilation isolation under the conditions assumed by the safety analyses.

4. Containment Fuel Handlina Area Radiation Monitor The LCO requires two OPERABLE channels of the containment fuel handling are2 radiation monitor to provide redundant radiation monitoring instrumentation to initiate containment vent ation isolation in the event of a fuel handling acc xent.

Channel OPERABILITY includes OPERABILITY of the channel electronics (including contacts and interlocks), as well as detector OPERABILITY to provide containment ventilation ' solation under the conditions assumed by the safety analyses.

5. Containment Isolation rnase A Refer to LC0 3.3.2, function 3.a., for all initiating functions and requirements.

APPLICABILITY The containment ventilation isolation instrumentation must be OPERABLE in MODES 1, 2, 3, and 4 when the containment pressure and vacuum relief valves or the containment purge supply and exhaust valves are open, and during CORE (continued) 710N Units ' & 2 B 3.3-148 Rev 00, October, 1997 L .

Containment Ventilation Isolation Instrumentation B 3.3.6 BASES APPLICABILITY ALTERATIONS or movement of irradiated fuel assemblies within (continued) containment when the containment pressure and vacuum relief valves or the containment purge supply and exhaust valves are open. Under these conditions, the potential exists for an accident that could release fission product radioactivity 3 into containment which could subsequently be released to the environment.

While in MODE 5 and in MODE 6 with no CORE AllERATIONS or movement of irradiated fuel assemblies within containment in progress, the containment ventilation isolation instrumentation need not be OPERABLE since the potential for ey radioactive releases is minimized and operator action is '

V sufficient to ensure post accident offsite doses are

{j maintained within the limits of Reference 1.

Inf %

ACTIONS Channel inoperability may be caused by drift of the instrument electronics sufficient to exceed the tolerance allowed by specific calibration procedures. Typically, the

?

drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a COT, when the 3rocess instrumentation is :;et up for adjustment to bring it within saecification. If the trip setpoint is less conservative tian the tolerance specified by the calibration procedure, the channel must be declared inoperable immediately and the appropriate Condition entered.

A Note has been added to the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each function listed in Table 3.3.6-1. The Completion Time (s) of the inoperable channel (s) of a function will be tracked separately for each function starting from the time the Condition was entered for that function. For the Manual Initiation function, the Required Channel in Table 3.3.6-1 is specified on a "per valve" basis. As such, the Condition may be entered separately for each valve as appropriate.

(continued)

ZION Units 1 & 2 B 3.3-149 Rev. 00, October, 1997 I

Containnnt Ventilation Isolation Instrumentation B 3.3.6 BASES-ACTIONS M (continued)

Condition A applies to the failure of one containment atmosphere radiation monitor or one containment purge radiation monitor channel. Since each of the three channels associated with a monitor measure different parameters, failure of a single channel may result in the loss of monitoring function for certain events. Consequently, the failed channel must be restored to OPERABLE status. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed to restore the affected channel is justified by the low likelihood of events occurring during this interval, and recognition that one or more of the remaining channels will respond to most events.

M Condition B applies to the manual initiation capability of the containment purge supply and exhaust valves, and the containment pressure and vacuum relief valves, on a per valve basis (since the function is specified on a per valve basis). If manual initiation is lost, operation may continue as long as the Required Actions for the applicable Conditions of LCO 3.6.3 are met for each valve made inoperable by failure of isolation instrumentation.

Condition B is modified by a Note stating that the condition is only applicable in MODE 1, 2, 3, or 4.

C.1 Condition C applies to the manual initiation capability of the containnient purge supply and exhaust valves, and the containment pressure and vacuum relief valves, on a per valve basis (since the function is specified on a per valve basis). If manual initiation is lost, operation may continue as long as the Required Actions for the applicable Conditions of LCO 3.9.3 are met for each valve made inoperable by failure of the manual initiation function.

Condition C is modified by a Note stating that the condition is not applicable in MODE 1, 2, 3, or 4.

(continued) i ZION Units 1 & 2_ B 3.3-150 Rev. 00, October, 1997 l

1 Containment Ventilation Isolation Instrumentation B 3.3.6 BASES ACTIONS QJ (continued)

Condition D addresses the failure of a single fuel handling area radiation monitor channel, the failure of two or more containment atmosphere radiation monitor or containment purge radiation monitor channels, or the inability to meet the Required Action and associated Completion Time for Condition A. Upon entry into Condition D, operations may continue as long as the Required Action to isolate the containment purge supply, containment purge exhaust and containment pressure and vacuum relief penetrations by use of one closed valve in each penetration is met. With the ,

specified penetrations isolated the containment ventilation instrumentation is no longer required since the potential pathway for radioactivity to escape to the environment has been removed.

The Completion Time for this Required Action is commensurate with the importance of maintaining the centainment atmosphere isolated from the outside environment when the containment ventilation isolation instrumentation is in a degraded condition.

SURVEILLANCE A Note has been added to the SR Table to clarify that REQUIREMENTS Table 3.3.6-1 determines which SRs apply to which containment ventilation isolation instrumentation functions.

SR 3.3.6.1 Performance of the CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that a gross failure of instrumentation has not occurred.

A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channel s . It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations.

between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of

-something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continuer, to operate properly between each CHANNEL CALIBRATION.

(continued) l ZION Units 1 & 2 B 3.3-151 Rev. 00, October, 1997

Containment Ventilation Isolation Instrumentation B 3.3.6 BASES SURVEILLANCE ~ SR 3.3.6.1 (continued)

REQUIREMENTS Agreement criteria are determined by the plant staff, based on a combination of-the channel-instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK-supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.6.2 A COT is performed every 92 days to ensure the entire channel will perform the intended function. The Frequency is based on the staff recommendation for increasing the avail' ability of radiation monitors according to NUREG-1366 (Ref. 2). This test verifies the capability of the-instrumentation to provide the containment ventilation system isolation. The setpoint shall be left consistent with the current unit specific calibration procedure tolerance.

SR 3.3.6.3 SR 3.3.6.3 is the performance of a TADOT. This test is a check of the manual initiation function and is performed every 18 months. The manual initiation function is tested up to and including actuation of the valve.

The Frequency is based on the known reliability of the function and the redundancy available, and has been shown to be acceptable through operating -experience.

(continued)

ZION Units l'& 2 8 3.3-152 Rev. 00, October, 1997

Containment Ventilation Isolation Instrumentation

B 3.3.6 BASES SURVE1LLANCE- 'SR 3.3.6.4 REQUIREMENTS (continued) A CHANNEL CAllBRATION11s a complete check of the instrument loop, including the sensor and is performed every 18 months.

The test verifies that the channel responds to a measured parameter within tha necessary range and accuracy.-

The Frequency is based on operating experience and is consistent with the typicai industry refueling cycle.

REFERENCES 1. 10 CFR 100.

2. NUREG-1366, " Improvements to Technical Specifications Surveillance Requirements," December 1992.

t ZION Units 1-& 2 B 3.3-153 Rev. 00, October, 1997

CREFS Actuation Instrumetation l 8 3.3.7 83.3 INSTRUMENTATION-B 3.3.7 Control Room Emergency filtration System (CREFS) Actuation Instrumentation BASES BACKGROUND The CREFS is a shared system which provides a filtered makeup air source for an enclosed control room environment from which the unit can be operated following an uncontrolled release of radioactivity. During normal operation, the Control Room Ventilation System provides control room ventilation. Upon receipt of an actuation signal, the CREFS initiates filtered ventilation and 1 supports pressurization of the control room. This system is described in the Bases for LC0 3.7.9, " Control Room Emergency Filtration System." The control room envelope is also shared by both units.

The actuation instrumentation consists of a shared SPING i radiation monitor in the normal makeup air intake. A high radiation signal will initiate CREFS. CREFS can also be initiated by a manual switch; however, this switch is

' located outside of the control room. The CREFS is also actuated by a safety injection (SI) signal from either unit.

The SI Function is discussed in LCO 3.3.2, " Engineered Safety Feature Actuation System (ESFAS) Instrumentation."

APPLICABLE The control room must be kept habitable for the operators SAFETY ANALYSES stationed there during accident recovery and post accident operstions.

r The CREFS acts to terminate thc supply of unfiltered outside air to the control room,- initiate filtration, and support pressurization of the control room. These actions are necessary to ensure the control room is kept habitable for the operators stationed there during accident recovery and post accident operations by minimizing the radiation exposure of control room personnel.

In MODES 1, 2, 3, and 4, the radiation monitor actuation of the CREFS is a backup for the SI signal actuation. This ensures initiation of the CREFS during a loss of coolant-accident or any other event with a significant release of-radioactivity.

l (continued)

ZION Units 1 & 2 B 3.3-154 Rev. 00, October, 1997 l-

CREFS Actuation'Instrumsntation B 3.3.7 BASES APPLICABLE- The radiation monitor actuation of the CREFS during rA nment

-SAFETY ANALYSES of irradiated fuel assemblies and during CORE ALTERATICWS, (continued) is the primary means to ensure control room habitability in the event of a fuel handling accident.

The CREFS Actuation Instrumentation satisfies Criterion 3 of .!

the NRC Policy Statement. !

LCO- The LCO requirements ensure that Control Room Air. Intake Radiation instrumentation necessary to initiate the CREFS is OPERABLE. The LC0 specifies fo"r required Control Room Air Intake Radiation Monitor channels (shared by the two units) to ensure that the radiation monitoring instrumentation necessary to initiate the CREFS remains OPERABLE. These four channels (of OR PR29) include one each for particulate channel 1), iodine (channel 3), low range gaseous channel 5), and mid range gaseous (channel 7) radiation.

For the gaseous monitors (which include sampling systems),

channel OPERABILITY involves more than OPERABILITY of channel electronics. For these channels, OPERABILITY also requires correct valve lineups, sample pump operation, and filter motor operation, as well as detector OPERABILITY, since these supporting features are necessary for actuation to occur under the-conditions assumed by the safety-analyses.

For Safety Injection, refer to LC0 3.3.2, Function 1, for all initiating Functions and requirements.

. APPLICABILITY The CREFS Actuation Instrumentation Functions must be

. OPERABLE in MODES 1, 2, 3, and 4, and during CORE ALTERATIONS and during movement of irradiated fuel assemblies .in the containment or fuel handling buildings.

(continued)

' ZION Units 1 & 2 B 3.3 155 Rev. 00, October, 1997 l

I i

CREFS Actuation Instrumentation B 3.3.7 BASES (continued)

ACTIONS A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each Function. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.7-1 in the accompanying LCO. The Completion Time (s) of the inoperable channel (s)/ train (s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 During operation in MODES 1, 2, 3, and 4, if one radiation monitor channel is inoperable in one or more Functions, 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months are permitted to restore it to OPERABLE status. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time provides prompt restoration of the protection capability while providing adequate time to determine the ca.use of the inoperability and implement any minor repair of the system. If the channel cannot be restored to OPERABLE status, CREFS must be placed in the emergency mode of operation. This accomplishes the actuation instrumcntation Function and places the unit in a conservative mode of operation.

The Required Action is modified by a Note which indicates that if CREFS is inoperable for any reason other than actuation instrumentation, the Required Action is not applicable. This prevents being required to place the system in operation when CREFS is already in an ACTION with a 7 day Completion Time for the system being inoperable.

B.1 and B.2 Condition B applies when tM Required Action and associated Completion Time for Condition A has not been met and the unit is in MODE 1, 2, 3, or 4. The .init must be brought to a MODE in which the LCO requirements are not applicable.

To achieve this status, the unit must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

ZION Units 1 & 2 B 3.3-156 Rev, 00, October, 1997

CREFS Actuation Instrumentation B 3.3.7 BASES l

l ACTIONS C.I. C.2.1 and C.2.2 (continued)

Condition C applies if one radiation monitor channel is I inoperable in one or more functions during CORE ALTERATIONS l or when irradiated fuel assemblies are being moved in the containment or fuel handling buildings. In this condition, the CREFS mul; be placed in operation immediately. This '

accomplishes the actuation instrumentation function and places the unit in a conservative mode of operation.

Alternatively, movement of irradiated fuel assemblies and CORE ALTERATIONS must be suspended immediately to reduce the risk of accidents that would require CREFS actuation.

Since movement of irradiated fuel assemblies in the fuel handling building can occur with either or both units in MODES 1, 2, 3, or 4, Required Actions C.1 and C.2 have been modified by a Note stating that LC0 3.0.3 is not applicable.

If moving irradiated fuel during MODE 5 or 6 or during CORE ALTERATIONS, LC0 3.0.3 would not specify any required action. If moving irradiated fuel in the fuel handling building in HvDE 1, 2, 3, or 4, the fuel movement is independent of reactor opera,tions. Therefore, inability to complete the Required Actiors within the specified Completion Times would not te sufficient reason to require a reactor shutdown.

SURVEILLANCE A Note has been added to the SR Table to clarify that REQUIREMENTS Table 3.3.7-1 determines which SRs apply to which CREFS Actuation Functions.

SR 3.3.7.1 Performance of the CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that a gross failure of instrumentation has not- occurred.

A CHANNEL' CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assv.ption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious.

(continued)

ZION Units 1 & 2- B 3.3-157 Rev. 00, October, 1997

CREFS Actub+ ion Instrumentation B 3.3.7 BASES SURVEILLANCE SR 3.3.7.1 (continued)

REQUIREMENTS A CHANNEL CHECK should detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff,. based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with tho LC0 required channels.

SR. 3.3.7.2 A COT is performed once every 92 days on each required channel to ensure the entire channel will perform the intended function. This test verifies the capability of the instrumentation to provide the CREFS actuation.. Any setpoint adjustments shall be left consistent with the unit specific calibration procedure tolerance. The Frequency is based on the known reliability of the monitoring equipment and has been shown to be acceptable through operating experience.

SR 3.3.7.3 A CHANNEL CALIBRATION is performed every 18 months. CHANNEL CALIBRATION is a complete including the sensor. check The test of thethat verifies instrument loop, l the channe responds to a measured parameter within the necessary range and accuracy.

The Frequency is based on operating experience and is consistent with the typical industry refueling cycle.

REFERENCES None.

ZION Units 1 & 2 8 3.3-158 Rev. 00, October, 1997

FH3EFS Actuation Instrumentation B 3.3.8 B 3.3 INSTRUMENTATION 1

-B 3.3.8 Fuel Handling Building Exhaust Filter System (FHBEFS) Actuation- i Instrumentation I

%SES l I

BACKGROUND The FHBEFS is a shared system which ensures that radioactive materials in the fuel handling building atmosphere (and in the containment if the equipment hatch is not installed)

-following a fuel handling accident are filtered and adsorbed prior to exhausting to the environment. The system is described in the Bases for LCO 3.7.13, " Fuel Handling Building Exhaust Filter System." The system initiates filtered ventilation automatically following receipt of a high radiation signal from a single area radiation monitor shared by the two units. High radiation detected by the monitor actuates the post accident mode of the FHBEFS to prevent the release of unfiltered contaminated air by initiating filtered ventilaticn, which imposes a negative pressure on the fuel handling building relative to atmosphere. The post accident mode of operation includes; initiation of the FHBEFS, and isolation of the FHB by closing the supply damper.

APPLICABLE The FHBEFS ensures that radioactive materials that may be SAFETY ANALYSES produced by a fuel handling accident in the fuel handling building are filtered and adsorbed prior to being exhausted to the environment. This action reduces the radioactive content in the fuel handling building exhaust following a fuel handling accident so that offsite doses remain within the limits specified in 10 CFR 100 (Ref. 1).

The FHBEFS also ensures that radioactive materials that may be produced by a fuel handling accident in containment, when the equipment hatch is not installed, are filtered and adsorbed prior to-being exhausted to the environment. This action also reduces the radioactive content in the fuel handling building exhaust following a fuel handling accident so that offsite doses remain within the limits specified in 10 CFR 100 (Ref. 1).

The FHBEFS actuation instrumentation satisfies Criterion 3 of the NRC Policy Statement.

_(continued)

-ZION Units 1 & 2 B 3.3-159 Rev. 00, October, 1997 l

FHBEFS Actuation Instrumentation B 1.3.8 BASES (continced)

LCO The LC0 requirements ensure that instrumentation necessary to initiate the FHBEFS in the post accident mode is OPERABLE.

During movement of irradiated fuel assemblies which have been recently removed from the reactor in either the fuel handling building,-or in the containment with the equipment hatch is not installed, and during CORE ALTERATIONS if the equipment hatch is not installed, LCO 3.7.13 requires the FHBEFS to be in operation. During the movement of irradiated fuel assemblies with sufficient decay time the FHBEFS is not required to be in operatten to ensure offsite ,

dass limits are not exceeded. Automatic initiation of the FHBEFS minimizes the potential for radioactive release to exceed offsite dose limits.

Automatic initiation of the FHBEFS in the post accident mode is initiated on high radiation by the Fuel Handling Building Pool Area Radiation Monitor (OR-AR03) which is shared by the two units. Single failure protection is not provided by this initiation design.

APPLICABII.ITY The automatic actuation function of the FHBEFS must be OPERABLE, during movement of irradiated fuel assemblies in the fuel handling building and when moving irradiated fuel assemblies in containment with the equipment hatch not installed and during CORE ALTERATION with the equipment hatch not installed, to ensure automatic initiation of the FHBEFS when the potential for a fuel handling accident exists and the FHBEFS is not already in operation .

Without fuel handling or CORE ALTERATIONS in progress, the FHBEFS actuation instrumentation need not be OPERABLE since a fuel handling accident cannot occur.

ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. The inoperability of the FHBEFS Actuation Instrumentation does not impact the safe operation of the plant, nor the analyzed response to operational events.

Therefore, inoperable FHBEFS Actuation Instrumentation is not sufficient reason to require a reactor shutdown.

(continued)

ZION Units 1 & 2 B 3.3-160 Rev. 00, October, 1997

l FHBEFS Actuation Instrumentation B 3.3.8 BASES ACTIONS A.1 and A.2 (contined)

Condition A applies to the failure of the automatic actuation function of the FHBEFS upon high area radiation during movement of irradiated fuel assemblies in the fuel handling building. If the function is inoperable, the FHBEFS must be ) laced in the post accident mode of operation immediately. Tie FHBEFS is placed in the post accident mode of operation using the hand switch in the control room and by locally failing tha fuel Handling Building supply damper closed. This accomplishot the actuation instrumentation function and places the unit in the post accident mode of operation.

Alternatively, movement of irradiated fuel assemblies in the fuel handling building must be suspended immediately to eliminate the potential for events that could require FHBEFS actuation.

B.l. B.2. C.1 and C.2 Condition B ap)1ies to the failure of the automatic actuation of tie FHBEFS upon high area radiation function during movement of irradiated fuel assemblies in containment with the equipment hatch not intact. Condition C applies to the failure of the automatic actuation of the FHBEFS upon high area radiation function during CORE ALTERATIONS with the equipment hatch not intact. With the function inoperable, mode the FHBEFS of operation must beThis immediately. placed in the p;ost accomplis 1es accident the -(

actuation instrumentation function and places the unit in the post accident mode of operation.

Alternatively, movement of irradiated fuel assemblics in the containment and CORE ALTERATIONS must be suspended immediately to eliminate the potential for events that could require FHBEFS actuation.

SURVEILLANCE 1R 3.3.8.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that a gross failure of instrumentation has not occurred. A

, CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels, it is based on the assumption that instrurrent channels monitoring the same parameter should read approximately the same value. Significant deviations (continued)

Il0N Units 1 & 2 B 3.3-161 Rev. 00, October, 1997 l

\

FHBEFS Actuation Instrumentation B 3.3.8 BASES SURVEILLANCE SR 3.3.8.1 (continued)

REQUIREMENTS between the two instrument channels could be an indication of excessive instrument drift.in one of the channels or of something even more serious. A CHANNEL CHECK should detect groes channel failure; thus, it is key to verifying the-instrumentation continues to operate properly between each CHANNEL CAllBRATION.

Agreement criteria are determined '; . the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3. 3. 8d A COT is performed once every 92 days on each required channcl to ensure the entire channel will perform the intended function. This test verifies the capability of the instrumentation to provide the FHBEFS actuation. Any setpoint adjustments shall be left consistent with the unit specific calibration )rocedure tolerance. The Frequency of 92 days is based on tie known reliability of t L monitoring equipment and has been shown to be acceptable through operating experience.

SR 3.3.8.3 A CHANNEL CALIBRATION is performed every 18 months. CHANNEL CALIBRATION is a complete including the sensor. check The test of the that verifies instrument loop, l the channe responds to a measured parameter within the necessary range and accuracy. The Frequency is based on operating experience and is consistent with the typical industry refueling cycle.

REFERENCES 1, 10 CFR 100,11.

ZION Units 1 & 2 B 3.3-162 Rev. 00, October, 1997

PTEFS Actuation Instrumentation B 3.3.9 )

B 3.3 INSTRUMENTATION l B 3.3.9 Pipe Tunnel Emergency Filtration System (PTEFS) Actuation Instrumentation BASES BACKGROUND The PTEFS is a shared system which filters airborne !

radioactive particles from the area of the pipe tunnels i following a loss of coolant accident (LOCA). The PTEFS is a subsystem of the normally operating Auxiliary Building Ventilation System which provides environmental control of temperature and humidity in the auxiliary building and the fuel handling building, includin )ipe tunnels. Upon receipt of an actuation signal, theg the PTEFS initiates filtering of the pipe tunnel exhaust. This system is described in the Br.ses for LC0 3.7.11 " Pipe Tunnel Exhaust Filtration System.' The PTEFS is shared by the two units.

The actuation instrumentation consists of a radiation monitor in the discharge of the pipe tunnel connecting the containment with the auxiliary building for each unit. A high radiation signal (either ) articulate or iodine) in either unit will initiate the )TEFS for both units.

APPLICABLE The PTEFS design basis is established by the large break SAFETY ANALYSES LOCA. The system evaluation assumes a limited amount of leakage of contaminated fluid into the pipe tunnels from sources such as components and joints during the ECCS racirculation phase of a Design Basis Accident (DBA). Such leakage is controlled through preventive maintenance, periodic visual inspection, and leakage testing (see Administrative Control 5.5.2, " Primary Coolant Sources Outside Containment.") In such a case, the system restricts the total radioactive release-to within the 10 CFR 100 (Ref. 1) limits. The analysis of the effects and consequences of a large break LOCA are presented in Reference 2.

The PTEFS Actuation Instrumentation satisfies Criterion 3 of the NRC Policy Statement.

(continued)

ZION U11ts 1 & 2 8 3.3-163 Rev. 00, October, 1997 l

PTEFS Actuation Instrumentation

( B 3.3.9 BASES (continued)

-LCO The LCO requirements ensure that instrumentation necessary to initiate the PTEFS is OPERABLE.

The LCO specifies two required Pi>e Tunnel Exhaust Radiation Monitor channels to ensure that tie radiation monitoring instrumentation ntcessary to initiate the PTEFS remains-OPERABLE. -These two channels include one each for particulate and iodine.

APPLICABILITY The PTEFS Actuation Instrumentation Functions must be OPERABLE in MODES 1, 2, 3, and 4, consistent with the OPERABILITY requirements of the PTEFS and the ECCS.

In MODE 5 or 6, the PTEFS Actuation Instrumentation is not required to be OPERABLE since neither the PTEFS nor the ECCS is required to be OPERABLE.

ACTIONS A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each Function. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.9-1 in the accompanying LCO. The Com inoperable channel (s)/ train (s)pletion of a Function Timewill(s) beoftracked the separately for each Function starting from the time the Condition was entered for that Function. -

A.1 If one radiation monitor channel is inoperable in one or more Functions, 'i days are permitted to restore it to OPERABLE status. The 7 day Completion Time is the same as is allowed if the mechanical portion of the system is inoperable. The basis for this Completion Time is the same as provided in LCO 3.7.11. If the channel canntt be restored to OPERABLE status, PTEFS must be placed in operation. This accomplishes the actuation instrumentation Function and places the unit in a conservative mode of

-operation.

(continued)

ZION Units 1 & 2 B 3.3-164 Rev. 00, October, 1997 i

. _ - _ . . . _ . _ . _ _ . _ _ _ _ _ . _ _ _ . _ _ _ _ _ _ _ _ _ . _ _ - _ _ _ - - - - - - - - - _ _ _ _ - - - - - - _ . _ . - _ _ _ _ _ . - - _ - - . . . - - - _ _ _ - - - - - - - _ - - - _ - _ - _ J

PTEFS Actuation Instrumentation B 3.3.9 _

l BASES ACTIONS .

B.1 and 8.2

-(continued)

-Condition B applies when the Required Action and-associated Completion Time for Condition A has not been met. The unit must be brought to a MODE in which the LCO requirements are not applicable. To achieve this status, the unit must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable,- based on ,

operating experience, to reach the required unit conditions frce full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE A Note has been added to the SR Table to clarify that REQUIREMENTS Table 3.3.9 1 determines which SRs apply to which P1EFS Actuation Functions.

_JR '3.3.9.1 Performance of the CHANNEL CHECK once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other

. channels. It'is based on the assumption that instrument channels monitoring the same-parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the-channels or of something even more serious. A CHANNEL CHECK should detect gross channel failure;' thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

' Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, incidding indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipt. ant has drifted outside its limit.

(continued)

ZION Units 1 & 2 B 3.3-165 Rev. 00, October, 1997 e-- )

PTEFS Actuation Instrumentation B 3.3.9 i

BASES SURVEILLANCE SR 3.3.9.1 (continued)

REQUIREMENTS The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of l channels during normal operational use of the displays 1 associated with the '.00 required channels. !

SR 3.3.9.2 A COT is performed once every 92 days on each required channel to ensure the entire channel will perform the intended function. This test verifies the capability of the instrumentation to provide the PTEFS actuation. Any setpoint adjustments shall be left consistent with the unit specific calibration procedure tolerance. The Frequency is based on the known reliability of the monitoring equipment and has been shown to be acceptable through operating experience.

SR 3.3.9.3 A CHANNEL CALIBRATION is performed every 18 months. CHANNEL CALIBRATION is a complete including the sensor. check The test of thethat verifies instrument loop, l the channe responds to a measured parameter within the necessary range and acetracy. $

The Frequency is based on operating experience and is consister.t with the typical industry refueling cycle.

REFERENCES 1. 10 CFR 100, " Reactor Site Criteria."

2. UFSAR, Section 15.6.5.5.

ZION Units 1 & 2 B 3.3-166 Rev. 00, October, 1997

.)

,

ML20199D625

Text

Navigation menu

Search