Text

Proposed Tech Specs Reflecting Results of Numerous Meetings Re Improved TS
	ML20059A448
Person / Time
Site:	Crystal River
Issue date:	10/15/1993
From:	; FLORIDA POWER CORP.
To:	;
Shared Package
ML20059A437	List: 3F1093-12, Proposed Tech Specs Reflecting Results of Numerous Meetings Re Improved TS; ML20059A434;
References
	3F1093-12, NUDOCS 9310260334
	Download: ML20059A448 (800)
	v • d • e

.

l .

l

. l

)

I Attachment 2 3F1093-12 ;

Page 1 of 1 '

I l

i 2.C. (2) Technical Specifications l l

The Technical Specifications contained in Appendices A and B, as I

revised through Amendment No. 148, are hereby incorporated.in the l i license. Florida Power Corporation shall operate the facility in l accordance with the Technical Specifications.

Effective immediately upon implementation of Amendment 148, the Surveillance Requirements contained in the Appendix A Technical Specifications and listed below are not required to be performed.

The Surveillance Requirements shall be successfully demonstrated i prior to the time and condition specified below for each.

l a) SR 3.3.8.2.b shall be successfully demonstrated prior to entering ,

MODE 4 on the first plant start-up following Refuel Outage 9. j l

b) SR 3.3.11.2, Function 2, shall be successfully demonstrated no later than 31 days following the effective implementation date of the ITS.

c) SR 3.3.17.1, Functions 1,2,6,10,14, & 17 shall be successfully demonstrated no later than 31 days following the effective ;

implementation date of the ITS. !

d) SR 3.3.17.2, Function 10 shall be successfully demonstrated prior d to entering MODE 3 on the first plant start-up following Refuel l Outage 9. l e) SR 3.6.1.2 shall be successfully demonstrated prior to entering MODE 2 on the first plant start-up following Refuel Outage 9.

I f) SR 3.7.12.2 shall be successfully demonstrated prior to entering !

MODE 2 on the first plant start-up following Refuel Outage 9.

g) SR 3.8.1.10 shall be successfully demonstrated prior to entering MODE 2 on the first plant start-up following Refuel Outage 9.

h) SR 3.8.3.3 shall be successfully demonstrated prior to entering i MODE 4 on the first plant start-up following Refuel Outage 9. !

i) SR 3.8.4.S shall be successfully demonstrated prior to entering l MODE 4 on the first plant start-up following Refuel Outage 9.

j) SR 3.8.7.1 shall be successfully demonstrated no later than 7 days following the effective implementation date of the ITS.

k) SR 3.8.8.1 shall be successfully demonstrated no later than 7 days following the effective date of the ITS.

9310260334 931015 PDR Y

P ADOCK 05000302 fi PDR M

t t

O b

O ATTACHMENT 1 l i

. i i

a t

t

1 TABLE OF CONTENTS-0 1.0 1.1 USE AND APPLICATION Definitions 1.1-1 1.1-1 1.2 Logical Connectors . . . . . . . . . . . . . . . . . . . 1.2-1 '

1.3 Completion Times . . . . . . . . . . . . . . . . . . . . 1.3-1 1.4 Frequency ....................... 1,4-1 2.0 SAFETY LIMITS (SLs) .................... 2.0-1 2.1 SLs .......................... 2 . 0 - 1.

2.2 SL Violations . . . . . . . . . . . . . . . . . . . . . 2.0-2 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY . . . . 3.0-1 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY ........ 3.0-4 3.1 REACTIVITY CONTROL SYSTEMS . . . . . . . . . . . . . . . 3.1-1 3.1.1 SHUTDOWN MARGIN (SDM) ............... 3.1-1 3.1.2 Re activity Bal ance . . . . . . . . . . . . . . . . . 3.1-2 3.1.3 Moderator Temperature Coefficient (MTC) ...... 3.1-4 3.1.4 CONTROL ROD Group Alignment Limits . . . . . . . . . 3.1-6 3.1.5 Safety Rod Insertion Limits ............ 3.1-10. .

3.1.6 AXIAL POWER SHAPING R0D (APSR) Alignment Limits .. 3.1-12 3.1.7 Position Indicator Channels ............ 3.1-14 3.1.8 PHYSICS TESTS Exceptions--MODE 1. . . . . . . . . . 3.1-17 3.1.9 PHYSICS TESTS Exceptions--MODE 2 . . . . . . . . . . 3.1-20 -

3.2 3.2-1

() POWER DISTRIBUTION LIMITS ........ ......

3.2.1 Regulating Rod Insertion Limits .. ...... 3.2-1 3.2.2 AXIAL POWER SHAPING R00 (APSR) Insertion Limits .. 3.2-4 3.2.3 AXIAL POWER IMBALANCE Operating Limits . . . . . . . 3.2-5 t 3.2.4 QUADRANT POWER TILT (QPT) ............. 3.2 3.2.5 Power Peaking Factors ............... 3.2 3.3 INSTRUMENTATION .................... 3.3-1 3.3.1 Reactor Protection System (RPS)-Instrumentation .. 3.3-1 i 3.3.2 Reactor Protection System (RPS) Manual Reactcr Trip ...................... 3.3-6 3.3.3 Reactor Protection System (RPS)--Reactor Trip Module (RTM) .................. 3.3-8.

3.3.4 CONTROL R0D Drive (CRD) Trip Devices . . . . . . . . 3.3-10 3.3.5 Engineered Safeguards Actuation System (ESAS) Instrumentation ............. 3.3-12 '

3.3.6 Engineered Safeguards Actuation System *

(ESAS) Manual Initiation ............ 3.3-16 3.3.7 Engineered Safeguards Actuation System-(ESAS) Automatic Actuation Logic ........ 3.3-18 3.3.8 Emergency Diesel Generator (EDG) Loss of Power i Start (LOPS) .................. 3.3-20 3.3.9 Source Range Neutron Flux ............. 3.3-22 .!

3.3.10 Intermediate Range Neutron Flux ........,. 3.3-24

}

(continued)

O ,

Crystal River Unit 3 v Final Draft 10/15/93 i

TABLE OF CONTENTS i

/'

3.3 INSTRUMENTATION (continued) 3.3.11 Emergency Feedwater Initiation and Control (EFIC) System Instrumentation . ......... 3.3 3.3.12 Emergency Feedwater Initiation and Control ;

(EFIC) Manual Initiation- ............ 3.3-30 ,

3.3.13 Emergency Feedwater Initiation and Control (EFIC) Automatic Actuation Logic ........ 3.3-32 3.3.14 Emergency Feedwater Initiation and Control (EFIC)-Emergency Feedwater (EFW)--Vector Valve Logic . . . . . . . . . . . . . . . . . . . 3.3-34 3.3.15 Reactor Building (RB) Purge Isolation--High Radiation . . . . . . . . . . . . . . . . . . . . 3.3-35 3.3.16 Control Room Isolation--High Radiation . . . . . . . 3.3-36. .

3.3.17 Post Accident Monitoring (PAM) Instrumentation . . . 3.3-38 3.3.18 Remote Shutdown System . . . . . . . . . . . . . . . 3.3-42 ,

3.4 REACTOR COOLANT SYSTEM (RCS) . . . . . . . . . . . . . . 3.4-1 3.4.1 RCS Pressure, Temperature, and Flow Departure '

from Nucleate Boiling (DNB) Limits .. . . .. . 3.4-1 3.4.2 RCS Minimum Temperature for Criticality . . . . . 3.4-3 o 3.4.3 RCS Pressure and Temperature (P/T) Limits . . . . . 3.4 l 3.4.4 RCS Loops--MODE 3 ................. 3.4-6 :

3.4.5 RCS Loops--MODE 4 ................. 3.4-8 !

3.4.6 RCS Loops-MODE 5, Loops Filled .......... 3.4-10 g 3.4.7 RCS Loops--MODE 5, Loops Not Filled ........ 3.4-13

) 3.4.8 3.4.9 Pressurizer . . . . . . . . . . . . . . . . . . . .

Pressurizer Safety Valves .............

3.4-15 3.4-17 3.4.10 Pressurizer Power Operated Relief Valve (PORV) . . . 3.4-19 3.4.11 Not Used . . . . . . . . . . . . . . . . . . . . . . 3.4-21 3.4.12 RCS Operational LEAKAGE .............. 3.4-22 3.4.13 RCS Pressure Isolation Valve (PIV) Leakage . . . . . 3.4-24 3.4.14 RCS Leakage Detection Instrumentation . .. .. . . 3.4-27 ,

3.4.15 RCS Specific Activity ............... 3.4-30 t

3.5 EMERGFNCY CORE COOLING SYSTEMS (ECCS) ......... 3.5-1 3.5.1 Core Flood Tanks (CFTs) .............. 3.5-1 3.5.2 ECCS--Operating .................. 3.5-4 -;

. 5.3 EC CS --S h u td own . . . . . . . . . . . . . . . . . . . 3.5-7 3.5.4 Borated Water Storage Tank (BWST) ......... 3.5-9 3.6 CONTAINMENT SYSTEMS .................. 3.6-1 l 1

3.6.1 Containment .................... 3.6-1 3.6.2 Containment Air Locks ............... 3.6-3 ,

Containment Isolation Valves . . . . . . . . . . . . 3.6-8 3.6.3 3.6.4 Containment Pressure . . . . . . . . . . . . . . . . 3.6-15 3.6.5 Containment Air Temperature ............ 3.6-16 (continued) 1 C.ystal River Unit 3 vi Final Draft 10/15/93 i I

)

I

TABLE OF CONTENTS ,

O 3.6 3.6.6 CONTAINMENT SYSTEMS (continued)

Reactor Building Spray and Containment Cooling Systems . . . . . . . . . . . . . . . . . 3.6-17 3.6.7 Containment Emergency Sump pH Control System (CPCS) . . . . . . . . . . . . . . . . . . 3.6-21 3.7 PLANT SYSTEMS ..................... 3.7-1 '

3.7.1 Main Steam Safety Valves (MSSVs) . . . . . . . . . . 3.7-1 3.7.2 Main Steam Isolation Valves (MSIVs) ........ 3.7-4 ,

3.7.3 Main Feedwater Isolation Valves (MFIVs) ...... 3.7-6 3.7.4 Turbine Bypass Valves (TBVs) . . . . . . . . . . . . 3.7-8 3.7.5 Emergency Feedwater (EFW) System . . . . . . . , . . . 3.7-9 3.7.6 Emergency Feedwater (EFW) Tank. .......... 3.7-13 .

3.7.7 Nuclear Services Closed Cycle Cooling Water (SW) System . ............... 3.7 3.7.8 Deacy Heat Closed Cycle Cooling Water (DC) System . . . . . . . . . . . . . . . . . . . 3.7-17 3.7.9 Nuclear Services Seawater System . . . . . . . . . 3.7-19 ,

3.7.10 Decay Heat Seawater System . . . . . . . . . . . . . 3.7-21 3.7.11 Ultimate Heat Sink (UHS) . . . . . . . . . . . . . . 3.7-23 3.7.12 Control Room Emergency Ventilation <

System (CREVS) ................. 3.7-24 3.7.13 Fuel Storage Pool Water Level ........... 3.7-27 :

3.7.14 Spent Fuel Pool Boron Concentration ... ..... 3.7-28 l 3.7.15 Spent Fuel Assembly Storage ............ 3.7-30 O 3.7.16 3.7.17 Secondary Specific Activity Steam Generator Level 3.7-34 3.7-35 3.8 ELECTRICAL POWER SYSTEMS . . . . . . . . . . . . . . . . 3.8-1 3.8.1 AC Sources--Operating ............... 3.8-1 3.8.2 AC Sources --Shutdown . . . . . . . . . . . . . . . . 3.8-11 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air .... 3.8-14 3.8.4 DC Sources--Operating ............... 3.8-17 i 3.8.5 DC Sources--Shutdown . . . . . . . . . . . . . . . . 3.8 3.8.6 Battery Cell Parameters .............. 3.8-23 3.8.7 Inverters--Operating . . . . . . . . . . . . . . . . 3.8-27 3.8.8 Inverters--Shutdown ................ 3.8-29 3.8.9 Distribution Systems--Operating .......... 3.8-31 3.8.10 Distribution Systems--Shutdown . . . . . . . . . . . 3.8-33 3.9 REFUELING OPERATIONS . . . . . . . . . . . . . . . . . . 3.9-1 3.9.1 Boron Concentration ................ 3.9-1 3.9.2 Nuclear Instrumentation .............. 3.9-2 3.9.3 Containment Penetrations . . . . . . . . . . . . . . 3.9-4 3.9.4 Decay Heat Removal (DHR) and Coolant Circulation--High Water Level . . . . . . . . . . 3.9-6 (continued)

Crystal River Unit 3 vii Final Draft 10/15/93

TABLE OF CONTENTS t

3.9 REFUELING OPERATIONS (continued) 3.9.5 Decay Heat Removal (DHR) and Coolant Circulation-Low Water ~ Level .......... 3.9-8 3.9.6 Refueling Canal Water Level ............ 3.9-11 4.0 DESIGN FEATURES ...................... 4.0-1 5.0 ADMINISTRATIVE CONTROLS . ................. 5.0-1 P

l O ,

P O .

Crystal River Unit 3 viii Final Draft 10/15/93

.w-,,

J TABLE-0F CONTENTS O B 2.0 B 2.1.1 SAFETY LIMITS (SLs) ................

Reactor Core Sts . . . . . . . . . . ... . . . . .

.. B 2.0-l=

B 2.0-1 B 2.1.2 Reactor Coolant Systen. (RCS) Pressure SL . . . . . B 2.0-7 -

B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICAb?LITY . . . B 3.0-1 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY ....... B 3.0-15 B 3.1 REACTIVITY CONTROL SYSTEMS . . . . . . . . . . . . . . B 3.1 i B 3.1.1 SHUTDOWN MARGIN (SDM) .............. B 3.1-1 r B 3.1.2 Reactivity Bal ance . . . . . . . . . . . . . . . . B 3.1-6 i B 3.1.3 Moderator Temperature Coefficient (MTC) ..... B 3.1-12 B 3.1.4 CONTROL R00 Group Alignment Limits . . . . . . . . B 3.1-17 ,

B 3.1.5 Safety Rod Insertion Limit . . . . . . . . . . . . B 3.1-27 8 3.1.6 AXIAL POWER SHAPING R0D (APSR) Alignment Limits . B 3.1-31 B 3.1.7 Position Indicator Channels ........... B 3.1-35 8 3.1.8 PHYSICS TESTS Exceptions Systems-MODE 1. . . . . B 3.1-41 :

B 3.1.9 PHYSICS, TESTS Exceptions-MODE 2 . . . . . . . . . B 3.1-48 8 3.2 POWER DISTRIBUTION LIMITS .............. B 3.2-1 B 3.2.1 Regulating Rod Insertion Limits ......... B 3.2 -

B 3.2.2 AXIAL POWER SHAPING R00 (APSR) Insertion Limits . B 3.2-11 B 3.2.3 AXIAL POWER IMBALANCE Operating Limits . . . . . . B 3.2-17 i B 3.2.4 QUADRANT POWER TILT (QPT) .......... . B 3.2-26 .i:

B 3.2.5 Power Peaking Factors .............. B 3.2-38 B 3.3 INSTRUMENTATION ................... B 3.3-1 B 3.3.1 Reactor Protection System (RPS)

Instrumentation . . . . . . . . . . . . . . . . -B 3.3-1 B 3.3.2 Reactor Protection System (RPS) Manual Reactor Trip ..................... B 3.3.-31 B 3.3.3 Reactor Protection System (RPS)-Reactor Trip Module (RTM) ................. B 3.3-34 B 3.3.4 CONTROL R0D Drive (CRD) Trip Devices . . . . . . . B 3.3-38 B 3.3.5 Engineered Safeguards Actuation System (ESAS) Instrumentation . . . . . . . . . . . . B 3.3 B 3.3.6 Engineered Safeguards Actuation System (ESAS) Manual Initiation ........... B 3.3-57 B 3.3.7 Engineered Safeguards Actuation System l (ESAS) Automatic Actuation Logic ....... B 3.3-61 i B 3.3.8 Emergency Diesel Generator (EDG) Loss of Power !

Start (LOPS) ................. B 3.3-65 l B 3.3.9 Source Range Neutron Flux ............ B 3.3-73 B 3.3.10 Intermediate Range Neutron Flux ......... B 3.3-7B B 3.3.11 Emergency Feedwater Initiation and Control (EFIC) Instrumentation ............ B 3.3 1 (continued).

O ;

Crystal River Unit 3 ix Final Draft 10/15/93 l

1 i

TABLE OF CONTENTS 3.3 INSTRUMENTATION (continued) )

B 3.3.12 Emergency Feedwater Initiation and Control !

(EFIC) Manual Initiation ........... B 3.3-100 8 3.3.13 Emergency Feedwater Initiation and Control (EFIC) Logic ................. B 3.3-105 B 3.3.14 Emergency Feedwater Initiation and Control (EFIC)-Emergency feedwater (EFW)-Vector Valve Logic . . . . . . . . . . . . . . . . . . B 3.3-110 B 3.3.15 Reactor Building (RB) Purge Isolation-High Radiation . . . . . . . . . . . . . . . . . . . B 3.3-114 B 3.3.16 Control Room Isolation-High Radiation . . . . . . B 3.3-119 B 3.3.17 Post Accident Monitoring (PAM) Instrumentation . . B 3.3-124 8 3.3.18 Remote Shutdown System . . . . . . . . . . . . . . B 3.3-145 B 3.4 REACTOR COOLANT SYSTEM (RCS) . . . . . . . . . . . . . . B 3.4-1 B 3.4.1 RCS Pressure, Temperature, and flow Departure from Nucleate Boiling (DNB) Limits . . . . . . . B 3.4-1 B 3.4.2 RCS Minimum Temperature for Criticality . . . . . B 3.4-6 B 3.4.3 RCS Pressure and Temperature (P/T) Limits . . . . . B 3.4-9 8 3.4.4 RCS Loops-MODE 3 . . . . . . . . . . . . . . . . . B 3.4-17 B 3.4.5 RCS Loops-MODE 4 . . . . . . . . . . . . . . . . . B 3.4-22 8 3.4.6 RCS Loops-MODE 5, Loops Filled . . . . . . . . . . B 3.4-27 8 3.4.7 RCS Loops-MODE 5, Loops Not Filled . . . . . . . . B 3.4-33 B 3.4.8 Pressurizer . . . . . . . . . . . . . . . . . . . . B 3.4-37 O B 3.4.9 B 3.4.10 8 3.4.11 Pressurizer Safety Valves . . . . . . . . . . . . .

Pressurizer Power Operated Relief Valve (PORV) . . . B 3.4-47 Not Used . . . . . . . . . . . . . . . . . . . . . . B 3.4-52 B 3.4-43 B 3.4.12 RCS Operational LEAKAGE . . . . . . . . . . . . . . B 3.4-53 8 3.4.13 RCS Pressure Isolation Valve (PIV) Leakage . . . . . B 3.4-5B ,

B 3.4.14 RCS Leakage Detection Instrumentation . . . . . . . B 3.4-65 8 3.4.15 RCS Specific Activity . . . . . . . . . . . . . . . B 3.4-71 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) . . . . . . . . . B 3.5-1 B 3.5.1 Core Flood Tanks (CFTs) . . . . . . . . . . . . . . B 3.5-1 B 3.5.2 ECCS-Operating . . . . . . . . . . . . . . . . . . B 3.5-9 B 3.5.3 ECCS--Shutdown . . . . . . . . . . . . . . . . . . . B 3. 5- 19 8 3.5.4 Borated Water Storage Tank (BWST) . . . . . . . . . B 3.5-23 B 3.6 CONTAINMENT SYSTEMS . . . . . . . . . . . . . . . . . . B 3.6-1 B 3.6.1 Containment . . . . . . . . . . . . . . . . . . . . B 3.6-1 B 3.6.2 Containment Air Locks . . . . . . . . . . . . . . . B 3.6-7 B 3.6.3 Containment Isolation Valves . . . . . . . . . . . . B 3.6-16 B 3.6.4 Containment Pressure . . . . . . . . . . . . . . . . B 3.6-30 B 3.6.5 Containment Air Temperature . . . . . . . . . . . . B 3.6-33 B 3.6.6 Reactor Building Spray and Containment Cooling Systems . . . . . . . . . . . . . . . . . B 3.6-36 (continued)

Crystal River Unit 3 x Final Draft 10/15/93

I l~

L TABLE OF CONTENTS lM l

%/ B 3.6 CONTAINMENT SYSTEMS (continued)

B 3.6.7 Containment Emergency Sump pH Control (CPCS) . . . . B 3.6-47 B 3.7 PLANT SYSTEMS . . . . . . . . . . . . . . . . . . . . . B 3.7-1 B 3.7.1 Main Steam Safety Valves (MSSVs) . . . . . . . . . . B 3.7-1 ,

B 3.7.2 Main Steam Isolation Valves (MSIVs) . . . . . . . . B 3.7-7 B 3.7.3 Main Feedwater Isolation Valves (MFIVs) . . . . . . B 3.7-13 ,

B 3.7.4 Turbine Bypass Valves (TBVs) . . . . . . . . . . . . B 3.7-19 B 3.7.5 Emergency Feedwater (EFW) System . . . . . . . . . . B 3.7-23 ;

B 3.7.6 Emergency Feedwater Tank (EFT-2) . . . . . . . . . . B 3.7-32 B 3.7.7 Nuclear Services Closed Cycle Cooling i Water System (SW) . . . . . . . . . . . . . . . . B 3.7-36 B 3.7.8 Decay Heat Closed Cycle Cooling Water System . . . . B 3.7-41 B 3.7.9 Nuclear Services Seawater System . . . . . . . . . B 3.7-46 B 3.7.10 Decay Heat Seawater System . . . . . . . . . . . . B 3.7-51 l B 3.7.11 Ultimate Heat Sink (VHS) . . . . . . . . . . . . . . B 3.7-56 !

B 3.7.12 Control Room Emergency Ventilation System (CREVS) . . . . . . . . . . . . . . . . . B 3.7-60 l B 3.7.13 Fuel Storage Pool Water Level . . . . . . . . . . . B 3.7-66 B 3.7.14 Spent Fuel Pool Boron Concentration . . . . . . . . B 3.7-69 8 3.7.15 Spent Fuel Assembly Storage . . . . . . . . . . . . B 3.7-72 B 3.7.16 Secondary Specific Activity . . . . . . . . . . . . B 3.7-77 B 3.7.17 Steam Generator Level . . . . . . . . . . . . . . . B 3.7-81 B 3.8 ELECTRICAL POWER SYSTEMS . . . . . . . . . . . . . . . . B 3.8-1 i B 3.8.1 AC Sources--Operating . . . . . . . . . ,, . . . . . B 3.8-1 l B 3.8.2 AC Sources.-Shutdown . . . . . . . . . . . . . . . . B 3.8-24 B 3.8.3 Diesel fuel Oil, Lube Oil, and Starting Air . . . . B 3.8-30 !

B 3.8.4 DC Sources--Operating . . . . . . . . . . . . . . . B 3.8-39 B 3.8.5 DC Sources--Shutdown . . . . . . . . . . . . . . . . B 3.8-49 8 3.8.6 Battery Cell Parameters . . . . . . . . . . . . . ..B 3.8-52 B 3.8.7 Inverters--Operating . . . . . . . . . . . . . . . . B 3.8-59 B 3.8.8 Inverters--Shutdown . . . . . . . . . . . . . . . . B 3.8-64 i

B 3.8.9 Distribution Systems--Operating . . . . . . . . . . B 3.8-67 i l B 3.8.10 Distribution Systems--Shutdown . . . . . . . . . . . B- 3.8-77 B 3.9 REFUELING OPERATIONS . . . . . . . . . . . . . . . . . . B 3.9-1 B 3.9.1 Boron Concentration . . . . . . . . . . . . . . . . B 3.9-1 B 3.9.2 Nuclear Instrumentation . . . . . . . . . . . . . . B 3.9-5 l B 3.9.3 Containment Penetrations . . . . . . . . . . . . . . B 3.9-9 B 3.9.4 Decay Heat Removal (DHR) and Coolant Circulation--High Water Level . . . . . . . . . . B 3.9-14 B 3.9.5 Decay Heat Removal (DHR) and Coolant Circulation--Low Water Level . . . . . . . . . . B 3.9-18 i

B 3.9.6 Refueling Canal Water Level . . . . . . . . . . . . B 3.9-23 l l

Crystal River Unit 3 xi Final Draft 10/15/93 1

l l

4

Definitions 1.1 1.0 USE AND APPLICATION 1.1 Definitions i

NOTE-------------------------------------

The defined terms of this section appear in capitalized type and are applicable throughout these Technical Specifications and Bases.

. Term Definition ACTIONS ACTIONS shall be that part of a Specification that prescribes Required Actions to be taken under designated Conditions within specified Completion Times.

ALLOWABLE THERMAL POWER ALLOWABLE THERMAL POWER shall be the maximum reactor core heat transfer rate to the reactor 4

coolant permitted by consideration of the number 4 and configuration of reactor coolant pumps (RCPs) in operation.

AXIAL POWER IMBALANCE AXIAL POWER IMBALANCE shall be the power in the top half of the core expressed as a percentage of RATED THERMAL POWER (RTP) minus the power in the O. bottom half of the core expressed as a percentage of RTP.

AXIAL POWER SHAPING APSRs shall be the part length control components RODS (APSRs) used to control the axial power distribution of the reactor core. The APSRs are positioned manually by the operator and are not trippable.

CHANNEL CALIBRATION A CHANNEL CALIBRATION shall be the adjustment, as necessary, of the channel output such that it responds within the necessary range and accuracy to known values of the parameter that the channel monitors. The CHANNEL CALIBRATION shall encompass the entire channel, including the required sensor, ,

alarm, display, and trip functions, and shall !

include the CHANNEL FUNCTIONAL TEST. Calibration of instrument channels with resistance temperature ,

detector (RTD) or thermocouple sensors may consist of an inplace qualitative assessment of sensor behavior and normal calibration of the remaining adjustable devices in the channel. Whenever a sensing element is replaced, the next required ,

inplace assessment consists of comparing (continued)

(}

Crystal River Unit 3 1.1-1 Final Draft 10/01/93

Definitions i 1.1 I

1.1 Definitions CHANNEL CALIBRATION the other sensing elements with the recently (continued) installed sensing element. The CHANNEL CALIBRATION may be performed by means of any !

series of sequential, overlapping, or total '

channel steps so that the entire channel is calibrated.

The CHANNEL CALIBRATION shall also include testing !

of safety related Reactor Protection System (RPS),

Engineered Safeguards Actuation System (ESAS), and Emergency Feedwater Initiation and Control (EFIC) bypass functions for. each channel affected by the bypass operation. ;

CHANNEL CHECK A CHANNEL CHECK shall be the qualitative .

. assessment, by observation, of channel behavior :

during operation. This determination shall '

include, where possible, comparison of the channel ,

indication and status to other indications or '

status derived from independent instrument channels measuring the same parameter. ,

I CHANNEL FUNCTIONAL TEST A CHANNEL FUNCTIONAL TEST shall be:

a. Analog channels-the injection of a simulated or actual signal into the channel as close to the sensor as practicable to verify OPERABILITY, including required alarms, interlocks, display, and trip functions.

b. Bistable channels (e.g., pressure switches and switch contacts)-the injection of a simulated or actual signal into the channel as close to_ ,

the sensor as practicable to verify OPERABILITY, including required alarm and trip functions. ,

c. The ESAS CHANNEL FUNCTIONAL TEST shall also include testing of ESAS safety related bypass functions for each channel affected by bypass operation. .:

i (continued)

Crystal River Unit 3 1.1-2 Final Draft 10/01/93 ,

Definitions 1.1 1.1 Definitions (continued)

O CONTROL RODS CONTROL RODS shall be all full length safety and I

regulating rods that are used to shut down the ]

reactor and control power level during maneuvering operations.

CORE ALTERATION CORE ALTERATION shall be the movement of any fuel, sources, or other reactivity control components, within the reactor vessel with the vessel head removed and fuel in the vessel. Suspension of CORE ALTERATIONS shall not preclude completion of' movement of a component to a safe position.

CORE OPERATING LIMITS The COLR is the unit specific document that J REPORT (COLR) provides cycle specific parameter limits for the '

current reload cycle. These cycle specific limits shall be determined for each reload cycle in accordance with Specification 5.6.2.18. Plant operation within these limits is addressed in individual Specifications.

DOSE EQUIVALENT I-131 DOSE EQUIVALENT I-131 shall be that concentration of I-131 (microcuries/ gram) that alone would produce the same thyroid dose as the quantity and isotopic mixture of I-131, I-132, 1-133, I-134, O and I-135 actually present. The thyroid dose conversion factors used for this calculation shall be those listed in International Committee on Radiation Protection (ICRP) 30, Supplement to Part 1, page 192-212, Table titled, " Committed Dose Equivalent in Target Organs or Tissues per Intake i of Unit Activity."

E-AVERAGE E shall be the average (weighted in proportion DISINTEGRATION ENERGY to the concentration of each radionuclide in the <

reactor coola.nt at the time of sampling) of the J sum of the average beta and gamma energies per disintegration (in MeV) for isotopes, other than ,

iodines, with half lives > 15 minutes, making up at least 95% of the total non-iodine activity in 1 the coolant. )

l l EFFECTIVE FULL POWER EFPD shall be the ratio of the number of hours DAY (EFPD) of production of a given THERMAL POWER to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , multiplied by the ratio of the given ,

THERMAL POWER to the RTP. One EFPD is equivalent-l to the tharmal energy produced by operating the (continued)

Crystal River Unit 3 1.1-3 Final Draft 10/01/93 I

r Definitions 1.1 1.1 Definitions EFFECTIVE FULL POWER reactor core at RTP for one full day. (One EFPD is DAY (EFPD) 2544 MWt times 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or 61,056 MWhr.)

(continued)

EMERGENCY FEEDWATER The EFIC RESPONSE TIME shall be that time INITIATION AND CONTROL interval from when the monitored parameter (EFIC) RESPONSE TIME exceeds its EFIC actuation setpoint at the channel sensor until the emergency feedwater equipment is capable of performing its safety function (i.e.,

valves travel to their required positions, pump discharge pressures reach their required values, etc.) Times shall include diesel generator starting and sequence loading delays, where applicable. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire response time is measured.

ENGINEERED SAFETY The ESF RESPONSE TIME shall be that time interval FEATURE (ESF) RESPONSE from when the monitored parameter exceeds its ESF TIME actuation setpoint at the channel sensor until the ESF equipment is capable of performing its safety function (i.e., the valves travel to their required positions, pump discharge pressures reach O their required values, etc.). Times shall include diesel generator starting and sequence loading delays, where applicable. The response time may be measured by means of any series of sequential, overlapping, or total steps so that the entire i response time is measured.

LEAKAGE LEAKAGE shall be:

a. Identified LEAKAGE

l. LEAKAGE, such as that from pump seals or valve packing, that is captured and conducted to collection systems or a sump or collecting tank; or

2. LEAKAGE into the containment atmosphere from sources that are both specifically located and quantified and known not to interfere with the operation of leakage detection systems and not to be pressure boundary LEAKAGE; or (continued)

O Crystal River Unit 3 1.1-4 Final Draft 10/01/93

Definitions 1.1 1.1 Definitions i V

LEAKAGE 3. Reactor Coolant System (RCS) LEAKAGE .

(continued) through a steam generator (OTSG) tube to 1 the secondary system. ,

b. Linidentified LEAKAGE All LEAKAGE that is not identified LEAKAGE.

c. Pressure Boundary LEAKAG1 LEAKAGE (except OTSG tube leakage) through a non-isolable fault in an RCS component body, pipe wall, or vessel wall.

MODE A MODE shall correspond to any one inclusive combination of core reactivity condition, power level, average reactor coolant temperature, and reactor vessel head closure bolt tensioning '

specified in Table 1.1-1.

NUCLEAR HEAT FLUX HOT Fo (Z) shall be the maximum local linear power CHANNEL FACTOR (Fo (Z))

density in the core divided by the core average fuel rod linear power density, assuming nominal A fuel pellet and fuel rod dimensions.

V Fig shall be the ratio of the integral of linear NUCLEAR ENTHALPY RISE HOTCHANNELFACTOR(Fig) power along the fuel rod on which minimum departure from nucleate boiling ratio occurs to the average fuel rod power.

OPERABLE-0PERABILITY A system, subsystem, train, component, or device shall be OPERABLE when it is capable of performing its specified safety function (s) and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication, and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified safety function (s) are also capable >

of performing their related support function (s).

PHYSICS TESTS PHYSICS TESTS shall be those tests performed to measure the fundamental nuclear characteristics of '

the reactor core and related instrumentation.

(continued)

Crystal River Unit 3 1.1-5 Final Draft 10/01/93 i

Definitions l.1 1.1 Definitions PHYSICS TESTS These tests are: '

(continued)

a. Described in Chapter 13, " Initial Tests and ,

Operation" of the FSAR;

b. Authorized under the provisions of >

10 CFR 50.59; or l

c. Otherwise approved by the Nuclear Regulatory .

Commission. !

PRESSURE AND The PTLR is the unit specific document that TEMPERATURE LIMITS provides the reactor vessel pressure and REPORT (PTLR) temperature limits, including heatup and cooldown '

rates, for the current reactor vessel fluence period. These pressure and temperature limits shall be determined for each fluence period in :

accordance with Specification 5.6.2.19. Plant operation within these operating limits is addressed in LC0 3.4.3, "RCS Pressure and' Temperature Limits."

QUADRANT POWER TILT QPT shall be defined by the following equation and (QPT) is expressed as a percentage.

=

Power In Any Core Quadrant QPT 100 ( Average Power of all Quadrants -1)

RATED THERMAL POWER RTP shall be a total reactor core heat transfer (RTP) rate to the reactor coolant of 2544 MWt.

~

REACTOR PROTECTION The RPS RESPONSE TIME shall be that time interval SYSTEM (RPS) RESPONSE from when the monitored parameter exceeds its RPS TIME trip setpoint at the channel sensor until electrical power is interrupted at the- control rod drive trip breakers. The response time may be measured by means of any series of sequential, '

overlapping, or total steps so that the entire .

response time is measured.

SHUTDOWN MARGIN (SDM) SDM shall be the instantaneous amount of ,

reactivity by which the reactor is subcritical or >

(continued)

Crystal River Unit 3 1.1-6 Final Draft 10/01/93

J

Definitions

-1.1 1.1 Definitions SHUTDOWN MARGIN (SDM) would be subcritical from its present condition (continued) assuming:

a. All CONTROL RODS (safety and regulating) are fully inserted except for the single. CONTROL ,

R00 of highest reactivity worth, which is assumed to be fully withdrawn; and

b. In MODES 1 and 2, the fuel and muderator temperatures are changed to the post-trip RCS average temperature.

With any CONTROL RODS not capable of being fully inserted, the reactivity worth of these CONTROL RODS must be accounted for in the determination of SDM.

STAGGERED TEST BASIS A STAGGERED TEST BASIS shall consist of the testing of one of the systems, subsystems, channels, or other designated components during the interval specified by the Surveillance Frequency, so that all systems, subsystems, J channels, or other designated components are !

tested during n Surveillance Frequency intervals, where n is the total number of systems, v subsystems, channels, or other designated components in the associated function.

THERMAL POWER THERMAL POWER shall be the total reactor core heat transfer rate to the reactor coolant.

i l

l l

O Crystai River Unit 3 1.1-7 Final Draft 10/01/93 j 1

i l

Definitions 1.1 i

O Table 1.1-1 (pp,qe 1 of 1)

MODES -

% RATED AVERAGE REACTIVITY THERMAL REACTOR COOLANT MODE TITLE CONDITION POWER (b) TEMPERATURE ,

(K,ff) (*F) 1 Power Operation 2 0.99 >5 NA 2 Startup 2 0.99 s5 NA 3 Hot Standby < 0.99 NA 2 280 4 Hot < 0.99 NA 280 > T*vo > 200 Shutdown (c) 5 Cold Shutdown (c) < 0.99 NA s 200 6 Refueling (d) NA NA NA O

(a) With fuel in the reactor vessel.

(b) Excluding decay heat. l (c) All reactor vessel head closure bolts fully tensioned.

(d) One or more reactor vessel head closure bolts less than fully tensioned.

1 i

l l

O Crystal River Unit 3 1.1-8 Final Draft 10/01/93 l

Logical Connectors 1.2 1.0 USE AND APPLICATION 1.2 Logical Connectors PURPOSE The purpose of this section is to explain the meaning of logical connectors.

Logical connectors are used in Technical Specifications (TS) to discriminate between, and yet connect, discrete Conditions, Required Actions, Completion Times, Surveillances, and Frequencies. The only logical connectors that appear in TS are AND and 98 The physical arrangement of these connectors constitutes logical conventions with specific meanings.

BACKGROUND Several levels of logic may be used to state Required Actions. These levels are identified by the placement (or nesting) of the logical connectors and by the number assigned to each Required Action. The first level of logic is identified by the first digit of the number assigned to a Required Action and the placement of the logical connector /

in the first level of nesting (i.e., left justified with the number of the Required Action). The successive levels of O logic are identified by additional digits of the Required Action number and by successive indentions of the logical connectors. \

When logical connectors are used to state a Condition, Completion Time, Surveillance, or Frequency, only the first level of logic is used, and the logical connector is left justified with the statement of the Condition, Completion Time, Surveillance, or Frequency.

O (continued)

Crystal River Unit 3 1.2-1 Final Draft 10/01/93

Logical Connectors 1.2 1.2 Logical Connectors (continued)

EXAMPLES The following examples illustrate the use of logical connectors.

EXAMPLE 1.2-1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME I A. LCO not met. A.1 Verify . . . !

AND A.2 Restore . . . .

In this example the logical connector AND is used to indicate that both Required Actions A.1 and A.2 must be completed when in Condition A.

l 1

(continued)

Crystal River Unit 3 1.2-2 Final Draft 10/01/93

Logical Connectors 1.2 1.2 Logical Connectors V

EXAMPLES EXAMPLE 1.2-2 (continued)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. LC0 not met. A.1 Trip . . . l M

A.2.1 Verify . . .

AND A.2.2.1 Reduce . . .

93 A.2.2.2 Perform . . .

i A.3 Align . ..

This example represents a more complicated use of logical connectors. Required Actions A.1, A.2, and A.3 are alternative choices, only one of which must be performed as indicated by the use of the logical connector M and the left justified placement. Any one'of these three Actions may be chosen. If A.2 is chosen, then both A.2.1 and A.2.2 must be performed as indicated by the logical connector AND. .

Required Action A.2.2 is met by performing either A.2.2.1 or A.2.2.2. The indented position of the logical connector ;

E indicates that A.2.2.1 and A.2.2.2 are alternative choices, only one of which must be performed. '

O Crystal River Unit 3 1.2-3 Final Draft 10/01/93 i

Completion Times i 1.3 1.0 USE AND APPLICATION 1.3 Completion Times i PURPOSE The purpose of this section is to establish the Completion '

Time convention and to provide guidance for its use. .

BACKGROUND Limiting Conditions for Operation (LCOs) specify minimum ;

requirements for ensuring safe operation of the unit. The ACTIONS associated with an LC0 state Conditions that :

typically describe the ways in which the requirements of the i LCO can fail to be met. Specified with each stated l Condition are Required Action (s) and Completion Time (s).

DESCRIPTION The Completion Time is the amount of time allowed for completing a Required Action. It is referenced to the time of discovery of a situation (e.g., inoperable equipment or variable not within limits) that requires entering an ;

ACTIONS Condition unless otherwise specified, providing the unit is in a MODE or specified condition stated in the :

Applicability of the Specification. Required Actions must O be completed prior to the expiration of the specified Completion Time. An ACTIONS Condition remains in effect and i the Required Actions apply until the Condition no longer i exists or the unit is not within the Specification Applicability.

If situations are discovered that require entry into more than one Condition at a time within a single Specification ;

(multiple Conditions), the Required Actions for each i Condition must be performed within the associated Completion l Time. When in multiple Conditions, separate Completion j Times are tracked for each Condition starting from the time j of discovery of the situation that required entry into the !

Condition. -l Once a Condition has been entered, subsequent trains, I subsystems, components, or variables expressed in the '

Condition discovered to be inoperable or not within limits, will not result in separate entry into the Condition, unless specifically stated. The Required Actions of the Condition continue to apply to each additicnal failure, with Completion Times based on initial entry into the Condition.

(continued)

O Crystal River Unit 3 1.3-1 Final Draf t 10/01/93 I

Completion Times 1.3 1.3 Completion Times DESCRIPTION However, when a subseouent train, subsystem, component, or (continued) variable, expressed in the Condition, is discovered to be inoperable or not within limits, the Completion Time (s) may be extended. To apply this Completion Time' extension two criteria must first be met. The subsequent inoperability:

a. Must exist concurrent with the first inoperability; 4 I

and

b. Must remain inoperable or not within limits after the first inoperability is resolved. ;

The total Completion Time allowed for completing a Required ;

Action to address the subsequent inoperability shall be limited to the more restrictive of either:

a. The stated Completion Time, as measured from the .

initial entry into the Condition, plus an additional ,

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or -

b. The stated Completion Time as measured from discovery of the subsequent inoperability.

The above Completion Time extensions do not apply to those O Specifications that have exceptions that allow completely separate re-entry into the Condition (for each train, subsystem, component or variable expressed in the Condition) !

and separate tracking of Completion Times based on this re-entry. These exceptions are stated in individual Specifications.

The above Completion Time extension does not apply to a Completion Time with a modified " time zero." This modified

" time zero" may be expressed as a repetitive time (i.e.,

"once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ," where the Completion Time is referenced from a previous completion of the Recuired Action versus the time of Condition entry) or as a time modified by the phrase "from discovery . . ." Example 1.3-3 illustrates one use of this type of Completion Time. The 10 day Completion Time specified for Condition A and B in Example 1.3-3 may not be extended.

(continued)

Crystal River Unit 3 1.3-2 Final Draft 10/01/93

__- _ _ ._ . m Completion Times 1.3 l.3 Completion Times (contirued)

-s EXAMPLES The following examples illustrate the use of Completion Times with different types of Conditions and changing Conditions.

EXAMPLE 1.3-1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME I

B. Required B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action and ,

~

associated AND Completion Time not B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months ,

met.

Condition B has two Required Actions. Each Required Action '

O has its own separate Completion Time. Each Completion Time is referenced to the time that Condition B is entered.

The Required Actions of Condition B are to be in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND in MODE 5 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . A total of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed for reaching MODE 3 and a total of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months (not 42 hours4.861111e-4 days 0.0117 hours 6.944444e-5 weeks 1.5981e-5 months ) is allowed for reaching MODE 5 from the time that Condition B was entered. If MODE 3 is reached in 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months , the time allowed for reaching MODE 5 is the next 33 hours3.819444e-4 days 0.00917 hours 5.456349e-5 weeks 1.25565e-5 months because the total time allowed for reaching MODE 5 is 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

If Condition B is. entered while in M0&E 3, the time allowed for reaching MODE 5 is the next 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

(continued)

Crystal River Unit 3 1.3-3 Final Draft 10/01/93

f Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-2 (continue <i)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One pump A.1 Restore pump to 7 days inoperable. OPERABLE status.

B. Required B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action and associated AND Completion Time not B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months met.

I When a pump is declared inoperable, Condition A is entered.

If the pump is not restored to OPERABLE status within O 7 days, Condition B is also entered and the Completioa Time clocks for Required Actions B.1 and B.2 start. If the inoperable pump is restored to OPERABLE status after !

Condition B is entered, Condition A and B are exited, and therefore, the Required Actions of Condition B may be terminated.

When a second pump is declared inoperable while the first pump is still inoperable, Condition A is not re-entered for the second pump. LC0 3.0.3 is entered, since the ACTIONS do not include a Condition for more than one inoperable pump.

The Completion Time clock for Condition A does not stop after LCO 3.0.3 is entered, but continues to be tracked from the time Condition A was initially entered.

While in LC0 3.0.3, if one of the inoperable pumps is restored to OPERABLE status and the Completion Time for Condition A has not expired, LCO 3.0.3 may be exited and operation continued in accordance with Condition A.

While in LCO 3.0.3, if one of the inoperable pumps is restored to OPERABLE status and the Completion Time for Condition A has expired, LCO 3.0.3 may be exited and (continued)

O Crystal River Unit 3 1.3-4 Final Draft 10/01/93

- = . _-

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-2 (continued) operation continued in accordance with Condition B. The Completion Time for Condi?. ion B is tracked from the time the Condition A Completion Time expired.

On restoring one of the pumps to OPERABLE-status the Condition A Completion Time is not reset, but continues from ,

the time the first pump was declared inoperable. This Completion Time may be extended if the pump restored to OPERABLE status was the first inoperable pump. A 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months extension to the stated 7 days is allowed, provided.this ,

does not result in the second pump being inoperable for

> 7 days.

O (continued)

Crystal River Unit 3 1.3-5 Final Draft 10/01/93 !

s

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-3 (continued)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Restore 7 days function X Function X train train to OPERABLE MD inoperable. status.

10 days from discovery of failure to meet the LC0 B. One B.1 Restore 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Function Y Function Y train train to OPERABLE N A_ND inoperable. I status.

10 days from discovery of O failure to meet the LCO C. One C.1 Restore 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Function X Function X train train to OPERABLE inoperable. status.

AND QB One C.2 Restore 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months function Y Function Y train train to OPERABLE inoperable. status.

(continued)

Crystal River Unit 3 1.3-6 Final Draft 10/01/93

~ . ~ , . ~~ , -- - . - - - - - - - - _ - - - - - - - - -

Completion Times 1.3 ,

1.3 Complotion Times EXAMPLES EXAMPLE 1.3-3 (continued)

When one Function X train and one Function Y train are inoperable, Condition A and Condition B are concurrently applicable. The Completion Times for Condition A and ,

Condition B are tracked separately for each train starting from the time each train was declared inoperable and the Condition was entered. A separate Completion Time is established for Condition C and tracked from the time the second train was declared inoperable (i.e., the time the situation described in Condition C was discovered).

If Required Action C.2 is completed within the specified Completion Time, Conditions B and C are exited. If the Completion Time for Required Action A.1 has not expired, '

operation may continue in accordance with Condition A. The remaining Completion Time in Condition A is measured from the time the affected train was declared inoperable (i.e.,

initial entry into Condition 4). ,

The Completion Times of Conditions A and B are modified by a logical connector with a separate 10 day Completion Time measured from the time it was discovered the LC0 was not met. In this example, without the separate Completion Time, O it would be possible to alternate between Conditions A, B, and C in such a manner that operation could continue indefinitely without ever restoring systems to meet the LCO.

The separate Completion Time modified by the phrase "from discovery of failure to meet the LC0" is designed to prevent indefinite continued operation while not meeting the LCO.

This Completion Time allows for an exception to the normal

" time zero" for beginning the Completion Time " clock." In this instance, the Completion Time " time zero" is specified as commencing at the time the LC0 was initially not met, ,

instead of at the time the associated Condition was entered.

l i

(continued)

Crystal River Unit 3 1.3-7 Final Draft 10/01/93 l

l

Completion Times .

1.3 1.3 Completion Times O EXAMPLES EXAMPLE 1.3-4 i

(continued) ,

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME <

A. One or more A.1 Restore valve (s) 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months valves to OPERABLE inoperable. status.

4 B. Required B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action and associated AND Completion Time not B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months met.

A single Completion Time is used for any number of valves O inoperable at the same time. The Completion Time associated with Condition A is based on the initial entry into Condition A and is not tracked on a per valve basis.

Declaring subsequent valves inoperable, while Condition A is still in effect, does not trigger the tracking of separate Completion Times.

Once one of the valves has been restored to OPERABLE status, the Condition A Completion Tin,e is not reset, but continues from the time the first valve was declared inoperable. The Completion Time may be extended if the valve restored to OPERABLE status was the first inoperable valve. The '

Condition A Completion Time may be extended for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months provided this does not result in any subsequent valve being inoperable for > 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

If the Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (including the extension) expires while one or more valves are still inoperable, Condition B is entered.

(continued)

Crystal River Unit 3 1.3-8 Final Draft 10/01/93 t- r

Completion-Times 1.3 ,

j

, 1.3 Completion Times i EXAMPLE EXAMPLE 1.3-5 (continued)

ACTIONS

NOTE-------------------- ------

Separate Condition entry is allowed for each inoperaDie valve. '

CONDIfl0N REQUIRED ACTION COMPLETION TIME A. One or more A.1 Restore valve to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months valves OPERABLE status, inoperable. '

B. Required B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action and associated AND Completion :

Time not B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

~

met.

l The Note above the ACTIONS table is a method of modifying how the Completion Time is tracked. If this method of modifying how the Completion Time is tracked was applicable only to a specific Condition, the Note would appear in that Condition, rather than at the top of the ACTIONS Table.

The Note allows Condition A to be entered separately for each inoperable valve, and Completion Times tracked on a per valve basis. When a valve is declared inoperable, ;

Condition A is entered and its Completion Time starts. If <

subsequent valves are declared inoperable, Condition A is ,

entered for each valve and separate Completion Times start )

and are tracked for each valve.

If the Completion Time associated with a valve in Condition A expires, Condition B is entered for that valve.

If the Completion Times-associated with subsequent valves in (continued)

O 1

I Crystal River Unit 3 1.3-9 Final Draft 10/01/93

)

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-5 (continued)

Condition A expire, Condition B is entered separately for each valve and separate Completion Times start and are tracked for each valve. If a valve that caused entry into Condition B is restored to OPERABLE status, Condition B is i exited for that valve.

Since the Note in this example allows multiple Condition entry and tracking of separate Completion Times, Completion i Time extensions do not apply.

EXAMPLE 1.3-6 i ACTIONS .

CONDITION REQUIRED ACTION COMPLETION TIME A. One channel A.1 Perform Once per inoperable. SR 3.x.x.x. 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months

^

O A.2 Reduce THERMAL 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months POWER to 5 50% RTP.

B. Required B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months :

Action and associated Completion i Time not -)

met. l l

1 J

l Entry into Condition A offers a choice between Required Action A.1 or A.2. Required Action A.1 has a "once per" .i Completion Time, which qualifies for the 25% extension, per !

SR 3.0.2, to each performance after the initial performance.

If Required Action A.1 is followed and the Required Action (continued)

Crystal River Unit 3 1.3-10 Final Draft 10/01/93 H 1

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1,3-6 (continued) is not met within the Completion Time (including the 25%

extension allowed by SR 3.0.2), Condition B is entered. If Required Action A.2 is followed and the Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is not met, Condition B is entered.

If after entry into Condition B, Required Action A.1 or A.2 is met,. Condition B is exited and operation may then continue in Condition A.

EXAMPLE 1.3-7 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Verify affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months subsystem subsystem inoperable. isol ated. AND Once per O 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter.

3 AND A.2 Restore subsystem 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months +

to OPERABLE status.

i B. Required B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action and associated AND Completion .

Time not B.2 Be in MODE 5. 36 hour4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months s-met.

}

(continued)

Crystal River Unit 3 1.3-11 Final Draft 10/01/93

Completion Times 1.3 1.3 Completion Times (G

EXAMPLES EXAMPLE 1.3-7 (continued)

Required Action A.1 has two Completion Times. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time begins at the time the Condition is entered and each "Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter" interval begins upon completion of Required Action A.1.

If after Condition A is entered, Required Action A.1 is not met within either the initial I hour or any subsequent .

8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months interval from the previous performance (including the 25% extension allowed by SR,3.0.2), Condition B is entered.

The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered. Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired.

IMMEDIATE When "Immediately" is used as a Completion Time, the COMPLETION flME Required Action should be pursued without delay and in a controlled manner.

Crystal River Unit 3 1.3-12 Final Draft 10/01/93

Frequency 1.4 1.0 USE AND APPLICATION 1.4 Frequency PURPOSE The purpose of this section is to define the proper use and application of Frequency requirements.

DESCRIPTION Each Surveillance Requirement (SR) has a specified Frequency in which the Surveillance must be met in order to meet the associated 1.C0. An understanding of the correct application of the specified Frequency is necessary for compliance with the SR.

The "specified Frequency" is referred to throughout this section and each of the Specifications of Section 3.0,

" Surveillance Requirement (SR) Applicability." The "Specified Frequency" consists of the requirements of the Frequency column of each SR, as well as certain Notes in the Surveillance column that modify performance requirements.

Situations where a Surveillance could be required (i.e., its Frequency could expire), but where it is not possible or not desired that it be performed until sometime after the associated Specification is within its Applicability,

s O represent potential SR 3.0.4 conflicts. To avoid these conflicts, the SR (i.e., the Surveillance or the Frequency) is stated such that it is only " required" when it can be and should be performed. With an SR satisfied, SR 3.0.4 imposes no restriction.

(continued)

Crystal River Unit 3 1.4-1 Final Draft 10/01/93 l I

Frequency 1.4 1.4 Frequency (continued)

EXAMPLES The following examples illustrate the various ways that Frequencies are specified. In these examples, the Applicability of the Specification (not shown) is MODES 1, 2, and 3.

EXAMPLE 1,4-1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Example 1.4-1 contains the type of SR most often encountered in the Technical Specifications ITS). The Frequency.

specifies an interval (12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ) during which the associated Surveillance must be performed at least one time.

Completion of the Surveillance initiates the subsequent '

interval. Although the-Frequency is stated as 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , an O extension of the time interval to 1.25 times the stated Frequency is allowed by SR 3.0.2 for operational flexibility. The measurement of this interval continues at all times, even when the SR is not required to be met per SR 3.0.1 (such as when the equipment is inoperable, a variable is outside specified limits, or the unit is outside the Applicability of the Specification). If the interval specified by SR 3.0.2 is exceeded while the unit is in a MODE or other specified condition in the Applicability of the Specification, and the performance of the Surveillance is not otherwise modified (refer to Example 1.4-3), then SR 3.0.3 becomes applicable. ,

if the interval as specified by SR 3.0.2 is exceeded while the unit is not in a MODE or other specified condition in the Applicability of the Specification for which performance of the SR is required, the Surveillance must be performed within the Frequency requirements of SR 3.0.2 prior to entry into the MODE or other specified condition. Failure to do so would result in a violation of SR 3.0.4.

(continued)

Crystal River Unit 3 1.4-2 Final Draft 10/01/93

Frequency 1.4 1.4 Frequency EXAMPLES EXAMPLE 1.4-2 i (continued) i SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY r

Verify flow is within limits. Once within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after

> 25% RTP AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter +

Example 1.4-2 has two Frequencies. The first is a one time performance Frequency, and the second is of the type shown ;

in Example 1.4-1. The logical connector "&ND" N indicates that both Frequency requirements must be met. Each time i reactor power is increased from a power level < 25% RTP to 2 25% RTP, the Surveillance must be performed within O 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The use of "once" indicates a single performance will satisfy the specified Frequency (assuming no other Frequencies are connected by "AND"). This type of Frequency does not qualify for the 25% extension allowed by SR 3.0.2.

"Thereafter" indicates future performances must be established per SR 3.0.2, but only after a specified condition is first met (i.e., the "once" performance in this example) . If reactor power decreases to < 25% RTP, the measurement of both intervals stops. New intervals start upon reactor power reaching 25% RTP.

t i

(continued)

O .

Crystal River Unit 3 1.4-3 Final Draft 10/01/93

Frequency

1.4 1.4 Frequency EXAMPLES EXAMPLE 1.4-3 (continued)

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY

NOTE------------------

Not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after 2 25% RTP.

Perform channel adjustment. 7 days t

The interval continues whether or not the unit operation is

< 25% RTP between performances.

As the Note modifies the required performance of the Surveillance, it is construed to be part of the "specified Frequency." Should the 7 day interval be exceeded while operation is < 25% RTP, this Note allows 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after O power reaches 2 25% RTP to perform the Surveillance.

Surveillance is still considered to be within the "specified The Frequency." Therefore, if the Surveillance was not performed within the 7 day (plus 25% per SR 3.0.2) interval, but operation was < 25% RTP, it would not constitute a i failure of the SR or failure to meet the LCO. Also, no '

violation of SR 3.0'.4 occurs when changing MODES, even with the 7 day Frequency not met, provided operation does not ,

exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months with power 2 25% RTP.

Once the unit reaches 25% RTP,12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months would be allowed for completing the Surveillance. If the Surveillance was not '

performed within this 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval, there would then be a failure to perform a Surveillance within the specified Frequency, and the provisions of SR 3.0.3 would apply.

O Crystal River Unit 3 1.4-4 Final Draf t 10/01/93

SLs 2.0 ,

2.0 SAFETY LIMITS (SLs) 2.1 SLs 2.1.1 Reactor Core SLs 2.1.1.1 In MODES I and 2, the maximum local fuel pin centerline temperature shall be s 5080 - (6.5 E-3) X (Burnup, MWD /MTU)*F. Operation within this limit is ensured by compliance with the AXIAL POWER IMBALANCE protective limits preserved by the Reactor Protection System setpoints in LCO 3.3.1, " Reactor Protection System (RPS)

Instrumentation," as specified in the COLR.

2.1.1.2 In MODES 1 and 2, the departure from nucleate boiling ratio (DNBR) shall be maintained greater than the limits of 1.3 for the BAW-2 correlation and 1.18 fcr the BWC correlation. Operation within this limit is ensured by compliance with SL 2.1.1.3 and with the AXIAL POWER IMBALANCE protective limits preserved by the RPS setpoints in LCO 3.3.1, as specified in the COLR.

2.1.1.3 In MODES 1 and 2, Reactor Coolant System (RCS) core outlet temperature and pressure shall be maintained above and to the left of the SL shown in Figure 2.1.1-1.

2.1.2 RCS Pressure SL In MODES 1, 2, 3, 4, and 5, the RCS pressure shall be maintained s 2750 psig.

2.2 SL Violations The following actions shall be completed:

2.2.1 In MODE 1 or 2, if SL 2.1.1.1, SL 2.1.1.2 or SL 2.1.1.3 is violated, be in MODE 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

2.2.2 In MODE 1 or 2, if SL 2.1.2 is violated, restore compliance and be in MODE 3 within I hour.

(continued)

O Crystal River Unit 3 2.0-1 Final Draft 10/01/93

SLs 2.0 2.0 SLs 2.2 SL Violations (continued) 2.2.3 In MODES 3, 4, and 5, if SL 2.1.2 is violated, restore compliance within 5 minutes.

2.2.4 With any SL violation, within I hour, notify the NRC Operations Center, in'accordance with 10 CFR 50.72.

2.2.5 With any SL violation, within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ,. notify the Senior Vice President, Nuclear Operations and the offsite reviewers specified in the Quality Assurance Plan.

2.2.6 With any SL violation, within 30 days, a Licensee Event Report (LER) shall be prepared pursuant to 10 CFR 50.73. The LER shall be submitted to the NRC, the offsite reviewers specified in the Quality Assurance Plan, the Director, Nuclear Plant Operations and the Senior Vice President, Nuclear Operations.

, 2.2.7 With any SL violation, operation of the plant shall not be resumed

- until authorized by the NRC.

O Crystal River Unit 3 2.0-2 Final Draft 10/01/93

SLs 2.0 0 2400 ,

2300 F1 0N

/

2 I.

2100 g b

1 3 2000 h SWETY UMIT 1900

/

UNACCl:PTABLE OPERATION 1800 s

1700 580 590 600 610 620 630 640 Reactor Outlet Temperature,'F Figure 2.1.1-1 (page 1 of 1)

Reactor Coolant System DNB Safety Limits Q

v Crystal River Unit 3 2.0-3 Final Draft 10/01/93

LCO Applicability 3.0

() 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY LCO 3.0.1 LCOs shall be met during the MODES or other specified conditions in the Applicability, except as provided in LCO 3.0.2.

LCO 3.0.2 Upon discovery of a failure to meet an LCO, the Required Actions of the associated Conditions shall be met, except as provided in LC0 3.0.5 and 3.0.6.

If the LCO is met or is no longer applicable prior to expiration of the specified Completion Time (s), completion of the Required Action (s) is not required, unless otherwise stated.

LCO 3.0.3 When an LCO is not met, except as provided in the associated ACTIONS, and an associated ACTION is not met or provided, the unit shall be placed in a MODE or other specified condition in which the Specification is not applicable.

Action shall be initiated within I hour to place the unit, as applicable, in:

,O a. MODE 3 within 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months ;

b. MODE 4 within 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months ; and

c. MODE 5 within 37 hours4.282407e-4 days 0.0103 hours 6.117725e-5 weeks 1.40785e-5 months .

Exceptions to this Specification are stated in the individual Specifications.

Where corrective measures are completed that permit operation in accordance with the LCO or ACTIONS, completion ,

of the actions required by LC0 3.0.3 is not required.

LC0 3.0.3 is only applicable in MODES 1, 2, 3, and 4.

LCO 3.0.4 When an LC0 is not met, entry into a MODE or other specified condition in the Applicability shall not be made except when i the associated ACTIONS to be entered permit continued j (continued)

O Crystal River Unit 3 3.0-1 Final Draft 10/01/93

-l 1

LCO Applicability 3.0 i /~T 3.0 LC0 APPLICABILITY d

LC0 3.0.4 operation in the MODE or other specified condition in the (continued) Applicability for an unlimited period of time. This Specification shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS.

Exceptions to this Specification are stated in the individual Specifications. These exceptions allow entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered allow unit operation in the MODE or other specified condition in the Applicability only for a limited period of time.

LC0 3.0.5 Equipment removed from service or declared inoperable to comply with ACTIONS may be returned to service under administrative control solely to perform testing required to demonstrate its OPERABILITY, the OPERABILITY of other equipment, or variables to be within limits. This is an exception to LC0 3.0.2 for the system returned to service under administrative control to perform the required testing.

LC0 3.0.6 When a supported system LCO is not met solely due to a support system LC0 not being met, the Conditions and Required Actions associated with this supported system are not required to be entered. Only the support system-Specification ACTIONS are required to be entered. This is an exception to LC0 3.0.2 for the supported system. In this event, additional evaluations and limitations may be required in accordance with Specification 5.6.2.16, " Safety Function Determination Program." If a loss of safety .

function is determined to exist by this program, the appropriate Conditions and Required Actions of the Specification in which the loss of safety function exists are required to be entered.

(continued)

O ;

Crystal River Unit 3 3.0-2 Final Draft 10/01/93 E

l

l LC0 Applicability i 3.0

() 3.0 LC0 APPLICABILITY i

LCO 3.0.6 When a support system's Required Action directs a supported (continued) system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.

LCO 3.0.7 PHYSICS TESTS Exception LCOs (Specification 3.1.8 and 3.1.9) allow specified Technical Specifications (TS) requirements .

to be suspended to permit performance of special tests and operations. Unless otherwise specified, all other TS requirements remain unchanged. Compliance with PHYSICS TESTS Exception LCOs is optional. When a PHYSICS TEST Exception LC0 is desired to be met but is not met, the ACTIONS of the PHYSICS TESTS Exception LC0 shall be met. '

When a PHYSICS TEST Exception LCO is not desired to be met, entry into a MODE or other specified condition in the Applicability shall only be made in accordance with other applicable Specifications.

O l

1 r

+

(v-~

Crystal River Unit 3 3.0-3 Final Draft 10/01/93

SR Applicability i 3.0 '

3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY SR 3.0.1 SRs shall be met during the MODES or other specified ,

conditions in the Applicability for individual !

Specifications, unless otherwise stated in the SR. Failure to meet a Surveillance, whether such failure is experienced during the performance of the Surveillance or between performances of the Surveillance, shall be failure to meet !'

the LCO. Failure to perform a Surveillance within the specified Frequency shall be failure to meet the LC0 except as provided in SR 3.0.3. Surveillances do not have to be performed on inoperable equipment or variables outside specified limits.

SR 3.0.2 The specified Frequency for each SR is met if the Surveillance is performed within 1.25 times the interval specified in the Frequency, as measured from the previous performance or as measured from the time a specified condition of the Frequency is i,et.

For Frequencies specified as "once," the above interval extension does not apply.

If a Required Action requires performance of a Surveillance or its Completion Time requires periodic performance on a t "once per . . ." basis, the above Frequency extension ;

applies to each performance after the initial performance.

Exceptions to this Specification are stated in the ,

individual Specifications.

SR 3.0.3 If it is discovered that a Surveillance was not performed within its specified Frequency, then compliance with the requirement to declare the LC0 not met may be delayed, from the time of discovery, up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or up to the limit of the specified Frequency, whichever is less. This delay- .

period is permitted to allow performance of the

Surveillance.

If the Surveillance is not performed within the delay '

period, the LC0 must immediately be declared not met, and the applicable Condition (s) must be entered.

(continued)

O Crystal River Unit 3 3.0-4 Final Draft 10/01/93 3

SR Applicability 3.0

() 3.0 SR APPLICABILITY SR 3.0.3 When the Surveillance is performed within the delay period (continued) and the Surveillance is not met, the LC0 must immediately be declared not met, and the applicable Condition (s) must be entered.

SR 3.0.4 Entry into a MODE or other specified condition in the Applicability of a Specification shall not be made unless

.the Specification's Surveillances have been met within their specified Frequency. This provision sh:11 not prevent entry into MODES or other specified conditions in the Applicability that are required to comply with ACTIONS.

i 1

I a

Crystal River Unit 3 3.0-5 Final Draft 10/01/93 1

i i

SDM 3.1.1

() 3.1 REACTIVITY CONTROL SYSTEMS 3.1.1 SHUTDOWN MARGIN (SDM)

LC0 3.1.1 The SDM shall be greater than or equal to the limit specified in the COLR. The minimum limit shall be 2 1.0% Ak/k.

APPLICABILITY: MODES 3, 4, and 5.

ACTIONS CONDITION REQUIRED ACTION COMPLETION _ TIME .

A. SDM not within limit. A.1 Initiate boration to 15 minutes restore SDM to within limit.

O SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY-SR 3.1.1.1 Verify SDM is greater than or equal to the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months limit specified in the COLR.

O Crystal River Unit 3 3.1-1 Final Draft 10/01/93

Reactivity Balance 3.1.2 1

3.1 REACTIVITY CONTROL SYSTEMS 3.1.2 Reactivity Balance LCO 3.1.2 The measured core reactivity balance shall be within i 1% Ak/k of predicted values.

APPLICABILITY: MODES 1 and 2.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Measured core A.1 Re-evaluate core 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months reactivity balance not design and safety within limit. analysis and '

determine that the reactor core is acceptable for continued coeration.'

AND A.2 Establish appropriate 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months operating restrictions and SRs.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met.

r P

O Crystal River Unit 3 3.1-2 Final Draft 10/01/93 1

Reactivity Balance 3.1.2

() SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.1.2.1 -------------------NOTES-------------------

1. The predicted reactivity values may be adjusted (normalized) to correspond to the measured core reactivity prior to exceeding a fuel burnup of 60 effective full power days (EFPD) after each fuel loading.

2. This Surveillance is not required to be performed prior to entry into MODE 2.

Verify measured core reactivity balance is Prior to within i 1% Ak/k of predicted values. entering MODE I after each fuel loading AND f-s ..---NOTE------

' Only required after 60 EFPD 31 EFPD thereafter

.(

Crystal River Unit 3 3.1-3 Final Draft 10/01/93

}l _. - _ ___ __ -__

MTC 3.1.3 3.1 REACTIVITY CONTROL SYSTEMS 3.1.3 Moderator Temperature Coefficient (MTC) i LC0 3.1.3 The MTC shall be maintained within the limits specified in ,

the COLR. The maximum positive limit shall be s 0.0 Ak/k/*F ,

at 2 95% RTP and 10.9 E-4 Ak/k/*F at < 95% RTP.

APPLICABILITY: MODES 1 and 2.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. MTC not within limits. A.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.1.3.1 Verify MTC is within the upper limit Prior to specified in the COLR. entering MODE I after each fuel loading (continued) t Crystal River Unit 3 3.1-4 Final Draft 10/01/93

MTC 3.1.3 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY.

SR 3.1.3.2 -------------------NOTES-------------------

1. This SR is not required to be performed prior to entry into MODE 1 or 2.

2. If the MTC is more negative than the COLR limit when extrapolated to the end of cycle, this SR may be repeated prior to exceeding the minimum allowable boron concentration at which MTC is projected to exceed the lower limit. ,

Verify extrapolated MTC is within the lower Each fuel cycle limit specified in the COLR. within 7 EFPD after reaching an equilibrium boron concentration equivalent to 300 ppm l

l l

Crystal River Unit 3 3.1-5 Final Draft 10/01/93 i

CONTROL R00 Group Alignment Limits 3.1.4 '

() 3.1 REACTIVITY CONTROL SYSTEMS 3.1.4 CONTROL R0D Group Alignment Limits LC0 3.1.4 Each CONTROL ROD shall be OPERABLE and aligned to within 6.5% of its group average height.

APPLICABILITY: MODES I and 2.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One trippable CONTROL A.1 Align all CONTROL 1 hour-R00 inoperable, or not RODS in the group to aligned to within 6.5% within 6.5% of the of its group average group average height, height, or both. while maintaining the rod insertion, group sequence, and group overlap limits in O accordance with LC0 3.2.1,

" Regulating Rod Insertion Limits."

08 A.2.1.1 Verify SDM is I hour 2 1% Ak/k.

AND Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter 08 A.2.1.2 Initiate boration to I hour restore SDM to within limit.

AND (continued)

O Crystal River Unit 3 3.1-6 Final Draft 10/01/93 ,

I

CONTROL R00 Group Alignment Limits 3.1.4

( ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2.2 Reduce THERMAL POWER- 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to s 60% of the ALLOWABLE THERMAL POWER.

AND A.2.3 Reduce the nuclear 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months overpower trip setpoint to s 70% of the ALLOWABLE THERMAL POWER.

AND A.2.4 Verify the potential 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ejected rod worth is within the assumptions of the rod ejection analysis.

O AND A.2.5 Perform SR 3.2.5.1. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time for Condition A not met.

C. More than one C.l.1 Verify SDM is I hour trippable CONTROL R00 ;t 1% Ak/k.

inoperable, or not aligned within 6.5% of QB its group average height, or both.

(continued)-

O Crystal River Unit 3 3.1 'I Final Draft 10/01/93

g CONTROL ROD Group Alignment Limits' 3.1.4

, ~( f ACTIONS CONDITION REQUIRED ACTION ' COMPLETION TIME C. (continued) C.I.2 Initiate boration to I hour.

restore SDM to within limit.

AND C.2 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months D. One or more CONTROL D.I.1 Verify SDM is I hour RODS untrippable. 2 1% Ak/k.

QB D.1.2 Initiate boration to I hour '

restore SDM to within limit. .

AND 01

(_,/ D.2 Be in MODE 3. 6' hours h

C O

Crystal River Unit 3 3.1-8 Final Draft 10/01/93

CONTROL R0D Group Alignment Limits 3.1.4

SUPVEILLANCE REQUIREMENTS SURVEILLANCE FREQUEi1CY SR 3.1.4.1 Verify individual CONTROL R00 positions are 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months when within 6.5% of their group average height. the asymmetric CONTROL R00 alarm is inoperable bND 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when the asymmetric -

CONTROL R0D alarm is OPERABLE SR 3.1.4.2 Verify CONTROL ROD freedom of movement 92 days (trippability) by moving each individual CONTROL R0D that is not fully inserted 2 3% '

in any direction.

SR 3.1.4.3 -------------------NOTE--------------------

With rod drop times determined with less than four reactor coolant pumps operating, operation may proceed provided opention is restricted to the pump combination operating during the rod drop time determination.

Verify the rod drop time for each CONTROL Prior to R00, from the fully withdrawn position, is reactor

5; 1.66 seconds from power interruption at criticality the CONTROL ROD drive breakers to after each :

2 removal of the i" insertion

' 2 525'F. (25% withdrawn position) with reactor vessel head O

Crystal River Unit 3 3.1-9 Final Draft 10/01/93

i Safety Rod Insertion Limits 3.1.5 i

i 3.1 REACTIVITY CONTROL SYSTEMS 3.1.5 fafety Rod Insertion Limits LCO 3.1.5 Each safety rod shall be fully withdrawn.

APPLICABILITY: MODES 1 and 2.

NOTE----------------------------

This LC0 is not applicable while performing SR 3.1.4.2. .

r i

~

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One safety rod not A.1 Withdraw the rod I hour fully withdrawn. fully. 2 0_R A.2.1.1 Verify SDM. is I hour 2 1% Ak/k.

i 9.8 A.2.1.2 Initiate boration to I hour restore SDM to within limit.

AND A.2.2 Declare the rod I hour inoperable.

. (continued) ,

i

[

O :

Crystal River Unit 3 3.1-10 Final Draft 10/01/93

Safety Rod Insertion Limits 3.1.5 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. More than one safety B.1.1 Verify SDM is 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months rod not fully 2 1% Ak/k.

withdrawn.

0.8 B.I.2 Initiate boration to I hour restore SDM to within limit, blLQ B.2 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.1.5.1 Verify each safety rod is fully withdrawn. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months i

b i

O Crystal River Unit 3 3.1-11 Final Draft 10/01/93

APSR Alignment Limits 3.1.6 O

\J 3.1 REACTIVITY CONTROL SYSTEMS 3.1.6 AXIAL POWER SHAPING ROD (APSR) Alignment Limits ,

LC0 3.1.6 Each APSR shall be OPERABLE and aligned within 6.5% of the group average height.

APPLICABILITY: MODES 1 and 2, when the APSRs are not fully withdrawn.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One APSR inoperable, A.1 AiigntheAPSRgroup 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months not aligned within its to within 6.5% of the limits, or both. inoperable or misaligned rod, while maintaining the APSR insertion limits in the COLR.

O B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met.

l l

~

1 l

O Crystal River Unit 3 3.1-12 Final Draft 10/01/93

APSR Alignment Limits-3.1.6

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY l SR 3.1.6.1 Verify position of each APSR is within 6.5% 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months when of the group average height. the asymmetric CONTROL R0D alarm is inoperable MR 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when the asymmetric CONTROL R0D alarm is OPERABLE O

O Crystal River Unit 3 3.1-13 Final Draft 10/01/93

E Position Indicator Channels 3.1.7 3.1 REACTIVITY CONTROL SYSTEMS

(}

3.1.7 Position Indicator Channels LC0 3.1.7 The absolute position indicator channel and the relative position indicator channel for each CONTROL R00 and APSR shall be OPERABLE.

APPLICABILITY: MODES 1 and 2.

ACTIONS

...________________...___________..--NOTE-------------------------------------

Separate Condition entry is allowed for each inoperable position indicator channel.

CONDITION REQUIRED ACTION COMPLETION TIME f- A. The relative position A.1 Determine the 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months indicator channel absolute position inoperable for one or indicator channel for AND more rods. the rod (s) is OPERABLE. Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter B. The absolute position B.1 Determine position of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months indicator channel the rods with inoperable for one or inoperable absolute more rods. position indicator by actuating any of the affected rod's zone position reference indicators.

AND (continued) r

(

Crystal River Unit 3 3.1-14 Final Draft 10/01/93

_ _ _j

Position Indicator Channels 3.1.7-

/~'l ACTIONS U COMPLETION TIME CONDITION REQUIRED ACTION B. (continued) B.2 Determine rods with 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months inoperable position-indicators are ANQ maintained at the zone reference Once per 12 indicator position hours and within the limits- thereafter specified in LC0 3.1.5, " Safety ,

Rod Insertion Limit";

LCO 3.2.1,

" Regulating Rod Insertion Limits"; or LCO 3.2.2, " AXIAL POWER SHAPING R0D (APSR) Insertion Limits," as applicable.

() C. The absolute position indicator channel and C.1 Declare the rod (s) inoperable.

Immediately the relative position ,

indicator channel '

inoperable for one or more rods.

08 Required Action and associated Completion i Time not met. ;

l I

l l

Crystal River Unit 3 3.1-15 Final Draft 10/01/93 l

l

1 Position Indicator Channels 3.1.7 '

() SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.1.7.1 Verify the absolute position indicator 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months channels and the relative position indicator channels agree within the limit specified in the COLR.

3 1

O Crystal River Unit 3 3.1-16 Final Draft 10/01/93

_- . - .- ~

PHYSICS TESTS Exceptions-MODE 1 3.1.8 3.1 REACTIVITY CONTROL SYSTEMS 3.1.8 PHYSICS TESTS Exceptions-MODE I LC0 3.1.8 During the performance of PHYSICS TESTS, the requirements of LC0 3.1.4, " CONTROL R0D Alignment Limits";

LCO 3.1.5, " Safety Rod Insertion Limits";

LCO 3.1.6, " AXIAL POWER SHAPING R0D (APSR) Alignment Limits";

LCO 3.2.1, " Regulating Rod Insertion Limits," for the restricted operation region only; LC0 3.2.3, " AXIAL POWER IMBALANCE Operating Limits"; and LC0 3.2.4, " QUADRANT POWER TILT (QPT)"

may be suspended, provided:

a. THERMAL POWER is maintained $; 85% RTP;

b. Reactor trip setpoints on the nuclear overpower channels are set 5 10% RTP higher than the THERMAL POWER at which the test is performed, with a maximum setting of 90% RTP;

c. En (Z) and Fig are maintained within the limits specified O in the COLR; and

d. SDM is 21.0% Ak/k.

APPLICABILITY: MODE 1 during PHYSICS TESTS.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. SDM not within limit. A.1 Initiate boration to 15 minutes restore SDM to within limit.

AND A.2 Suspend PHYSICS TESTS I hour exceptions.

(continued)

Crystal River Unit 3 3.1-17 Final Draft 10/01/93

- -~

PHYSICS TESTS Exceptions-MODE 1 3.1.8 -

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. THERMAL POWER B.1 Suspend PHYSICS TESTS I hour

> 85% RTP. exceptions.

M Nuclear overpower trip setpoint > 10% higher x 'N s ,

than PHYSICS TESTS N power level. -

M Nuclear overpower trip

setpoint > 90% RTP.

M Fn (Z) or Fig not within limits. ,

O SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY P

SR 3.1.8.1 Verify THERMAL POWER is s 85% RTP. I hour SR 3.1.8.2 Perform SR 3.2.5.1. 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months SR 3.1.8.3 Verify nuclear overpower trip setpoint is 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months s 10% RTP higher than the THERMAL POWER at which the test is performed, with a maximum ,

setting of 90% RTP.

(continued)

O ,

Crystal River Unit 3 3.1-18 Final Draft 10/01/93

PHYSICS TESTS Exceptions-MODE 1 3.1.8 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.1.8.4 Verify SDM is 2 1.0% Ak/k. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months l

l O

O Crystal River Unit 3 3.1-19 Final Draft 10/01/93

I PHYSICS TESTS Exceptions-MODE 2 3.1.9 l

3.1 REACTIVITY CONTROL SYSTEMS 3.1.9 PHYSICS TESTS Exceptions-MODE 2 LCO 3.1.9 During performance of PHYSICS TESTS, the requirements of 1.C0 3.1.3, " Moderator Temperature Coefficient (MTC)";

LC0 3.1.4, " CONTROL ROD Group Alignment Limits";

LC0 3.1.5, " Safety Rod Insertion Limits";

LC0 3.1.6, " AXIAL POWER SHAPING R00 (APSR) Alignment Limits";

LCO 3.2.1, " Regulating Rod Insertion Limits," for the restricted operation region only; and i LC0 3.4.2, "RCS Minimum Temperature for Criticality" may be suspended, provided:

a. THERMAL POWER is s 5% RTP;

b. Reactor trip setpoints on the nuclear overpower channels are set to s 25% RTP; and

c. SDM is 2 1.0% Ak/k.

O APPLICABILITY: MODE 2 during PHYSICS TESTS.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. THERMAL POWER not A.1 Open control rod Immediately within limit. drive trip breakers.

(continued)

O Crystal River Unit 3 3.1-20 Final Draft 10/01/93

l 1

PHYSICS TESTS Exceptions-MODE 2 l 3.1.9 l l

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME l l

B. SDM not within limit. B.1 Initiate boration to 15 minutes restore SDM to within limit.

AR B.2 Suspend PHYSICS TESTS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months exceptions.

C. Nuclear overpower trip C.1 Suspend PHYSICS TESTS 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months setpoint not within exceptions.

limit.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.1.9.1 Verify THERMAL POWER is s 5% RTP. I hour SR 3.1.9.2 Verify nuclear overpower trip setpoint is 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months s 25% RTP.

SR 3.1.9.3 Verify SDM is 2 1.0% Ak/k. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months t.

O Crystal River Unit 3 3.1-21 Final Draft 10/01/93

Regulating Rod Insertion Limits 3.2.1

.( ) 3.2 POWER DISTRIBUTION LIMITS

-3.2.1 Regulating Rod Insertion Limits LC0 3.2.1 Regulating rod groups shall be within the physical insertion, sequence, and overlap limits specified in the .

COLR.

APPLICABILITY: MODES 1 and 2.

..._______...--NOTE----------------------------

This LCO is not applicable while performing SR 3.1.4.2.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Regulating rod groups A.1 Perform SR 3.2.5.1. Once per inserted in restricted 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months operational region, or AND Os sequence or overlap, or any combination, A.2 Restore regulating 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from i

not met. rod groups to within discovery of limits. failure to meet the LC0 B. Required Action and 8.1 Reduce THERMAL POWER 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months associated Completion to less than or equal Time of Condition A to THERMAL POWER not met. allowed by regulating rod group insertion limits.

(continued)

O Crystal River Unit 3 3.2-1 Final Draft 10/01/93

Regulating Rod Insertion Limits 3.2.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. Regulating rod groups C.1 Initiate boration to 15 minutes .

inserted in restore SDM to unacceptable 2 1%'Ak/k.

operational region.

AND C.2.1 Restore regulating 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months rod groups to within 7 restricted operating region.

E C.2.2 Reduce THERMAL POWER 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to less than or equal i

to the THERMAL POWER allowed by the regulating rod group insertion limits.

O D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of-Condition C not met.

l l

O Crystal River Unit 3 3.2-2 Final Draft 10/01/93

Regulating Rod Insertion Limits 3.2.1 SURVEILLANCE REQUIREMENTS

(

SURVEILLANCE FREQUENCY SR 3.2.1.1 Verify regulating rod groups are within the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months when sequence and overlap limits as specified in the CONTROL ROD the COLR. drive sequence alarm is inoperable AND 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when the CONTROL R0D drive sequence alarm is OPERABLE SR 3.2.1.2 Verify regulating rod groups meet the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months when insertion limits as specified in the COLR the regulating rod insertion limit alarm is inoperable AND 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when the regulating rod insertion limit alarm is OPERABLE SR 3.2.1.3 Verify SDM 2 1% Ak/k. Within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months prior to achieving criticality O

Cry:tal River Unit 3 3.2-3 Final Draft 10/01/93 ,

APSR Insertion Limits 3.2.2 3.2 POWER DISTRIBUTION LIMITS ,

3.2.2 AXIAL POWER SHAPING R0D (APSR) Insertion Limits i

LCO 3.2.2 APSRs shall be positioned within the limits specified in the '

COLR.

1 APPLICABILITY: MODES 1 and 2.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. APSRs not within A.1 Perform SR 3.2.5.1. Once per limits. 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months AND A.2 Restore APSRs to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months within limits. ,

O B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY ,

SR 3.2.2.1 Verify APSRs are within limits specified in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months the COLR.

O Crystal River Unit 3 3.2-4 Final Draft 10/01/93

AXIAL POWER IMBALANCE Operating Limits 3.2.3

( 3.2 POWER DISTRIBUTION LIMITS 3.2.3 AXIAL POWER IMBALANCE Operating Limits LCO 3.2.3 AXIAL POWER IMBALANCE shall be maintained within the acceptable operating limits specified in the COLR.

APPLICABILITY: MODE 1 with THERMAL POWER > 40% RTP.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. AXIAL POWER IMBALANCE A.1 Perform SR 3.2.5.1. Once per not within acceptable 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months operating limits. a!LQ A.2 Restore AXIAL POWER 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months IMBALANCE within acceptable operating limits.

B. Required Action and B.I Reduce THERMAL POWER 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months associated Completion to s 40% RTP.

Time not met.

O Crystal River Unit 3 3.2-5 Final Draft 10/01/93

AXIAL POWER IMBALANCE Operating Limits 3.2.3 f SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.2.3.1 Verify AXIAL POWER IMBALANCE is within I hour when acceptable operating limits as specified in AXIAL POWER the COLR. IMBALANCE alarm '

is inoperable AliQ 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when AXIAL POWER IMBALANCE alarm is OPERABLE i

l 1

l l

1 l

4 01 LJ Crystal River Unit 3 3.2-6 Final Draft 10/01/93

QPT 3.2.4 >

/ 3.2 POWER DISTRIBUTION LIMITS 3.2.4 QUADRANT POWER TILT (QPT) i LC0 3.2.4 QPT shall be maintained less than or equal to the steady state limits specified in the COLR.

APPLICABILITY: MODE 1 with THERMAL POWER > 20% RTP.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. QPT greater than the A.1.1 Perform SR 3.2.5.1. Once per steady state limit and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months less than or equal to QR the transient limit.

A.1.2.1 Reduce THERMAL POWER 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 2 2% RTP from the ALLOWABLE THERMAL QB POWER for each 1% of .

t

( QPT greater than the 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after -

steady state limit. last-performance of SR 3.2.5.1. ;

aliQ A.I.2.2 Reduce nuclear 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months ,

overpower trip-setpoint and nuclear- QR overpower based on-Reactor Coolant 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months after System flow and AXIAL last POWER IMBALANCE trip performance of setpoint 2 2% RTP SR 3.2.5.1 from the ALLOWABLE THERMAL POWER for each 1% of QPT greater than the steady state limit.

AND (continued)

O Crystal River Unit 3 3.2-7 Final Draft 10/01/93

QPT 3.2.4

' ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 Restore QPT to less 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from than or equal to the discovery of steady state limit. failure to meet the LCO.

B. QPT greater than the B.1 Reduce THERMAL POWER 30 minutes transient limit and 2 2% RTP from less than or equal to ALLOWABLE THERMAL the maximum limit due POWER for each 1% of to misalignment of a QPT greater than the CONTROL R0D or an steady state limit.

APSR.

AND B.2 Restore QPT to less 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months than or equal to the transient limit.

C. Required Action and C.1 Reduce THERMAL POWER 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months associated Completion to < 60% of the Time of Condition A ALLOWABLE THERMAL or B not met. POWER.

AND C.2 Reduce nuclear 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months overpower trip setpoint to s 65.5%

of the ALLOWABLE THERMAL POWER.

(continued)

Crystal River Unit 3 3.2-8 Final Draft 10/01/93

QPT 3.2.4 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. QPT greater than the D.1 Reduce THERMAL POWER 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months transient limit and to < 60% of the less than or equal to ALLOWABLE THERMAL the maximum limit due POWER.

to causes other than the misalignment of SQ either CONTROL R00 or APSR. D.2 Reduce nuclear 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months overpower trip setpoint to s 65.5%

of the ALLOWABLE THERMAL POWER.

Y E. Required Action and E.1 Reduce THERMAL POWER 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months associated Completion to s 20% RTP.

Time for Condition C or D not met.

O F. QPT greater than the F.1 Reduce THERMAL POWER 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months maximum limit. to s 20% RTP.

l i

l l

1 O

Crystal River Unit 3 3.2-9 Final Draft 10/01/93 i

i QPT 3.2.4

,Q SURVEILLANCE REQUIREMENTS l v i SURVEILLANCE FREQUENCY SR 3.2.4.1 Verify QPT is within steady state limits as 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when l specified in the COLR. the QPT alarm is inoperable ;

bEQ 7 days when the !

QPT alarm is i OPERABLE j AND l

When QPT has been restored to less than or ,

equal to the ,

steady state limit, I hour for 12 consecutive hours, or until verified acceptable at

t 95% RTP l

l O 1 Crystal River Unit 3 3.2-10 Final Draft 10/01/93 I l

Power Peaking Factors 3.2.5

' 3.2 POWER DISTRIBUTION LIMITS 3.2.5 Power Peaking Factors LC0 3.2.5 Fo(Z)andFla shall be within the limits specified in the COLR.

L APPLICABILITY: MODE 1.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME P

A. Fo(Z) not within A.1 Reduce THERMAL POWER 15 minutes limit. 2 1% RTP for each 1%

that F 0(Z) exceeds limit AND ,

A.2 Reduce nuclear 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months O overpower trip setpoint and nuclear overpower based on Reactor Coolant System (RCS) flow and AXIAL POWER IMBALANCE trip setpoint 2 1% RTP for each 1%

that F n(Z) exceeds limit AND A.3 Restore Fo (Z) to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months within limit.

(continued)

O I Crystal River Unit 3 3.2-11 Final Draft 10/01/93

Power Peaking Factors 3.2.5 ACTIONS (continued) ;

CONDITION REQUIRED ACTION COMPLETION TIME j B. Fls not within limit. B.1 Reduce THERMAL-POWER 15 minutes 2 RH(%) RTP (specified in the COLR) for each 1%thatFls exceeds limit. ;

AND 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months B.2 Reduce nuclear overpower trip setpoint and nuclear overpower based on !

RCS flow and AXIAL POWER IMBALANCE trip setpoint 2 RH(%) RTP '

(specified in the '

for each 1%

COLR)la that F exceeds limit.

AND B.3 Restore Fls to within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months limit.

C. Required Action and C.1 Be in MODE 2. 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months associated Completion Time not met.

O Crystal River Unit 3 3.2-12 Final Draft 10/01/93

Power Peaking Factors i 3.2.5 SURVEILLANCE RE0VIREMENTS

(

SURVEILLANCE FREQUENCY SR 3.2.5.1 -------------------NOTE--------------------

Only required to be performed when specified in LCO 3.1.8, " PHYSICS TESTS Exceptions-MODE 1," or when complying with Required Actions of LC0 3.1.4, " CONTROL R0D Group Alignment Limits"; LC0 3.2.1,

" Regulating Rod Insertion Limits";

LCD 3.2.2, " AXIAL POWER SHAPING R0D (APSR)

Insertion Limits"; LC0 3.2.3, " AXIAL POWER IMBALANCE Operating Limits"; LCO 3.2.4,

" QUADRANT POWER TILT

_______________..____________ (QPT)."_______________

i Verify F (Z) and FIs are within limits by As specified by using the Incore Detector System to obtain the applicable a power distribution map. LC0(s)

O l

O Crystal River Unit 3 3.2-13 Final Draft 10/01/93

- . .. ~. - _ . . =

RPS Instrumentation 3.3.1 ;

-3.3 INSTRUMENTATION 3.3.1 Reactor Protection System (RPS) Instrumentation LC0 3.3.1 Four channels of RPS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1-1.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One channel A.1 Place channel in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. bypass or trip.

B. Two channels B.1 Place one channel in ~1 hour inoperable. trip.

AND B.2 Place second channel I hour ,

I in bypass.

C. One or more RCPPMs for C.1 Trip the RCPPM(s). 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months one RCP inoperable.

D. Required Action and D.1 Enter the Condition Immediately .

l associated Completion referenced in Time of Condition A Table 3.3.1-1 for the or B not met. Function.

(continued) .)

l O ,

Crystal River Unit 3 3.3-1 Final Draf t 10/01/93

. .. - =.

RPS Instrumentation '

3.3.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Required Action and E.1.1 Verify 4 RCPs in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months associated Completion operation.

Time of Condition C not met. AND E.1.7 Reduce THERMAL POWER- I hour

<2475 MW,3 98 E.2 Enter Condition F 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months F. As required by F.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Required Action D.1 and referenced in AND Table 3.3.1-1 or by '

Required Action E.2. F.2 Open all CONTROL R0D 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months drive (CRD) trip breakers.

G. As required by G.1 Open all CRD trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Required Action 0.1 breakers.

and referenced in Table 3.3.1-1.

H. As required by H.1 Reduce THERMAL POWER 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Required Action D.1 < 45% RTP.

and referenced in Table 3.3.1-1.

-I. As required by I.1 Reduce THERMAL POWER S hours -

Required Action D.1 < 20% RTP.

and referenced in Table 3.3.1-1. ,

O Crystal River Unit 3 3.3-2 Final Draft 10/01/93 :

RPS Instrumentation 3.3.1

() SURVEILLANCE REQUIREMENTS

- -_--_----_-------------------------NOTE-------------------------------------

Refer to Table 3.3.1-1 to determine which SRs apply to each RPS Function.

SURVEILLANCE FREQUENCY SR 3.3.1.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.1.2 --------- ---------NOTE--------------------

i Not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after THERMAL POWER is 2 15% RTP.

Verify calorimetric heat balance is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ,

s 2% RTP greater than power range channel output. Adjust power range channel output !

if calorimetric exceeds power range channel .

output by > 2% RTP, l

() ~'

SR 3.3.1.3 -------------------NOTE--------------------

4 Not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after THERMAL POWER (TP) is 2 30% RTP.

Compare out of core measured AXIAL POWER 31 days IMBALANCE (API n ) to incore measured AXIAL l POWER IMBALANCE (API 3 ) as follows:

(RTP/TP)(API n - API ) = imbalance error 3

Perform CHANNEL CALIBRATION if the absolute '

value of the imbalance error is 2 2.5% RTP.

I SR 3.3.1.4 Perform CHANNEL FUNCTIONAL TEST. 45 days on a STAGGERED TEST -!

BASIS (continued) i Crystal River Unit 3 3.3-3 Final Draft 10/01/93 i

4 RPS Instrumentation ,

-3.3.1 1

() SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.3.1.5 -------------------NOTES---- --------------

1. Neutron detectors and RC flow sensors <

are excluded from this Surveillance.

2. Verification of bypass function it excluded from this Surveillance. .

Perform CHANNEL CALIBRATION. 92 days !

SR 3.3.1.6 -------------------NOTE--------------------

Neutron detectors and RCPPM current and voltage sensors are excluded from CHANNEL :

CALIBRATION.

Perform CHANNEL CALIBRATION, 18 months SR 3.3.1.7 -------------------NOTE-------------------- >

Neutron detectors and RCPPM current and voltage sensors and the watt transducer are !

excluded from RPS RESPONSE TIME. testing.

Verify RPS RESPONSE TIME is within limits. 24 months on a STAGGERED TEST BASIS i J

Crystal River Unit 3 3.3-4 Final Draft 10/01/93 .

1 1

RPS' Instrumentation 3.3.1 Table 3.3.1-1 (page 1 of 1)

O\ Reactor Protection System Instrunentation APPLICABLE CONDITIONS MODES OR REFERENCED OTHER FROM SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION C0hDITIONS ACTION D.1 REQUIREMENTS VALUE

1. Nuclear Overpower -

a. High Setpoint 1,2(a) f SR 3.3.1.1 s 104.9% RTP SR 3.3.1.2 SR 3.3.1.5 SR 3.3.1.7

b. Low setpoint 2(b) 3(b)

, G SR 3.3.1.1 s 5% RTP 4(b) 5(b)

2. RCS High Outlet Temperature 1,2 F SR 3.3.1.1 5 618'F SR 3.3.1.4 SR 3.3.1.6

3. RCS Hlgh Pressure 1,2 F SR 3.3.1.1 s 2M5 psig SR 3.3.1.4 SR 3.3.1.6 SR 3.3.1.7

4. RCS Low Pressure 1,2I *) F SR 3.3.1.1 a 1800 psig SR 3.3.1.4 SR 3.3.1.6 SR 3.3.1.7

5. RCS Variable Low Pressure 1,2(a) F SR 3.3.1.1 m (11.59

That "

s SR 3.3.1.4 5037.8) psig SR 3.3.1.6

6. Reactor Building High 1,2,3(c) F SR 3.3.1.1 ~ s 4 psig Pressure SR 3.3.1.4 SR 3.3.1.6

7. Reactor Coolant Pump Power 1,2(a) F SR 3.3.1.1 More than one pung Monitor (RCPPM) SR 3.3.1.4 drawing i 1152 or SR 3.3.1.6 1 14,400 kW SR 3.3.1.7

8. Nuclear Overpower RCS Flow 1,2(a) F SR 3.3.1.1 Nuclear Overpower RCS and Measured AXIAL POWER SR 3.3.1.3 Flow and AX1AL POWER IMBALANCE SR 3.3.1.5 IMBALANCE setpoint SR 3.3.1.6 envelope in COLR SR 3.3.1.7

9. Main Turbine Trip (Control 2 45% RTP H SR 3.3.1.1 2 45 psig Oil Pressure) SR 3.3.1.4 SR 3.3.1.6

10. Loss of Both Main Feedwater a 20% RTP 1 SR 3.3.1.1 2 55 psig Punps (Control Oil SR 3.3.1.4 Pressure) SR 3.3.1.6

11. Shutdown Bypass RCS High 2(D) 3(b)

, G SR 3.3.1.1 s 1720 psig Pressure SR 3.3.1.4 I 4(b) 5(b)

, SR 3.3.1.6 {

1 (a) When not in shutdown bypass operation.

(b) During shutdown bypass operation with any CRD trip breakers in the closed position and the CRD Control System (CRDCS) capable of rod withdrawal.

(c) With any CRD trip breaker in the closed position and the CRDCS capable of rod withdrawal.

Crystal River Unit 3 3.3-5 Final Draft 10/01/93

'l I

l i

RPS Manual Reactor Trip ,

3.3.2 3.3 INSTRUMENTATION 3.3.2 Reactor Protection System (RPS) Manual Reactor Trip LCO 3.3.2 The RPS Manual Reactor Trip Function shall be OPERABLE.

APPLICABILITY: MODES I and 2, MODES 3, 4, and 5 with any CONTROL R00 drive (CRD) trip breaker in the closed position and the CRD Control System capable of rod withdrawal. ,

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Manual Reactor Trip A.1 Restore Function to I hour Function inoperable. OPERABLE status.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months pd associated Completion Time not met in AND MODE 1, 2, or 3.

B.2 Open all CRD trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months breakers.

C. Required Action and C.1 Open all CRD trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion breakers.

Time not met in MODE 4 or 5.

i O

Crystal River Unit 3 3.3-6 Final Draft 10/01/93 l

i l

Ji' Manual Reactor Trip 3.3.2' SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.2.1 Perform CHANNEL FUNCTIONAL TEST. Once prior to each reactor startup if not performed within the previous 7 days e

i O

Crystal River Unit 3 3.3-7 Final Draft 10/01/93

e RPS--RTH 3.3.3

() 3.3 INSTRUMENTATION 3.3.3 Reactor Protection System (RPS)--Reactor Trip Module (RTM)

LC0 3.3.3 Four RTMs shall be OPERABLE. ,

APPLICABILITY: MODES 1 and 2, MODES 3, 4, and 5 with any CONTROL R00 drive (CRD) trip breaker in the closed position and the CRD Control System (CRDCS) capable of rod withdrawal.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RTM inoperable. A.I.1 Trip the associated I hour CRD trip device (s).

08 A.1.2 Remove power from the I hour associated CRD trip device (s).

AND A.2 Physically remove the I hour inoperable RTM.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met in AND >

MODE 1, 2, or 3.

B.2.1 Open all CRD trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months breakers.

Q3 .

B.2.2 Remove all power to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ,

the CRDCS.

(continued) ,

( '

Crystal River Unit 3 3.3-8 Final Draft 10/01/93 1

- .m -

RPS--RTM 3.3.3

() ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Open all CRD trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion breakers.

Time not met in MODE 4 or 5. 03 C.2 Remove all power to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months the CRDCS.

E SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.3.1 -------------------NOTE-------------------- ,

When an RTM is placed in an inoperable status solely for performance of this O Surveillance, entry into associated Conditions and Required Actions may be delayed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , provided at least two RTMs are OPERABLE. ,

Perform CHANNEL FUNCTIONAL TEST. 31 days i

( -

Crystal River Unit 3 3.3-9 Final Draft 10/01/93 ;

1 me.. -c. - - -

_ _ - ___..___ _ __-- * -

. ~. . . . - - _ _ _ _ _ _ _ _

CR0 Trip Devices 3.3.4 3.3 INSTRUMENTATION 3.3.4 CONTROL R00 Drive (CRD) Trip Devices LCO 3.3.4 The following CRD trip devices shall be_ OPERABLE:

a. Two AC CRD trip breakers;

b. Two DC CRD trip breaker pairs; and

c. Eight electronic trip assembly (ETA) relays.

1 APPLICABILITY: MODES I and 2, MODES 3, 4, and 5 when any CRD trip breaker is in the closed position and the CRD Control System (CRDCS) is capable ;

of rod withdrawal.

i ACTIONS

..___......_____.__________._______--NOTE-------------------------------------

Separate Condition entry is allowed for each CRD trip device.

CONDITION REQUIRED ACTIDN COMPLETION TIME A. One or more CRD trip A.1 Trip the CRD trip 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months -

breaker (s) breaker (s).

undervoltage or shunt i' trip mechanism M inoperable.

A.2 Remove power from the 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months CRD trip breaker (s).

B. One or more CRD trip B.1 Trip the CRD trip 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

breaker (s) inoperable breaker (s). i for reasons other than M those in Condition A. '

B.2 Remove power from the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months CRD trip breaker (s).

(continued)

Crystal River Unit 3 3.3-10 Final Draft 10/01/93

~~.

CRD Trip Devices 3.3.4 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One or more ETA relays C.1 Transfer affected I hour inoperable. CONTROL R0D group to power supply with :

OPERABLE ETA relays.

E ;

C.2 Trip corresponding AC 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months CRD trip breaker. ,

D. Required Action and 0.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months

. associated Completion Time not met in AND MODE 1, 2, or 3.

D.2.1 Open all CRD trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months breakers.

E D.2.2 Remove all power to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months the CRDCS.

E. Required Action and E.1 Open all CRD trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion breakers.

Time not met in MODE 4 or 5. M E.2 Remove all power to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months the CRDCS. .

i SURVEILLANCE REQUIREMENTS-SURVEILLANCE FREQUENCY ;

SR 3.3.4.1 Perform CHANNEL FUNCTIONAL TEST. 31 days O

Crystal River Unit 3 3.3-11 Final Draft 10/01/93- .

ESAS Instrumentation 3.3.5 3.3 INSTRUMENTATION 3.3.5 Engineered Safeguards Actuation System (ESAS) Instrumentation LC0 3.3.5 Three channels of ESAS RCS Pressure instrumentation and two channels of ESAS RB Pressure instrumentation in each actuation train shall be OPERABLE.

APPLICABILITY: According to Table 3.3.5-1.

ACTIONS B

NOTE-------------------------------------

Separate Condition entry is allowed for each Parameter.

CONDITION REQUIRED ACTION COMPLETION TIME-l A. One or more RCS A.1 Place channel in I hour Pressure Parameters trip. !

O with one channel inoperable.

B. One or more RB B.1 Place channel in 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Pressure Parameters trip.

with one required channel inoperable in one actuation train. o i

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. A_!LD i (continued)

O Crystal River Unit 3 3.3-12 Final Draft 10/01/93

ESAS Instrumentation 3.3.5 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME I

C. (continued)- C.2 --------NOTE--------- i Only required for RCS-Pressure - Low Parameter.

Reduce RCS pressure 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

< 1700 psig, i

bE3 C.3 --------NOTE---------

Only required for RCS Pressure-Low Low Parameter. i Reduce RCS pressure 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

< 900 psig.

AND C.4 --------NOTE---------

Only required for l Reactor Building Pressure High setpoint and High High Parameter.

Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

.)

)

Crystal River Unit 3 3.3-13 Final Draft 10/01/93

ESAS Instrumentation I 3.3.5 i l

S_URVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.5.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.5.2 -------------------NOTE--------------------

When an ESAS channel is placed in an i inoperable status solely for performance of this Surveillance, entry into associated Conditions and Required Actions may be delayed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , provided the associated ES Function is maintained.

Perform CHANNEL FUNCTIONAL TEST. 31 days i SR 3.3.5.3 Perform CHANNEL CALIBRATION. 18 months O

SR 3.3.5.4 Verify ESF RESPONSE TIME within limits. 24 months on a ,

STAGGERED TEST BASIS -

l i

O Crystal River Unit 3 3.3-14 Final Draft 10/01/93 f

ESAS' Instrumentation i 3.3.5 l l

I Table 3.3.5-1 (page 1 of 1)

) Engineered Safeguards Actuation System Instrumentation v i l

APPLICABLE MODES OR OTHER SPECIFIED ALLOWABLE PARAMETER CONDITIONS VALUE

1. Reactor Coolant System . essure - Low a 1700 psig a 1500 psig

2. Reactor Coolant System Pressure - Low Low a 900 psig a 500 psig

3. Reactor Building Pressure - High 1,2,3 s 4 psig

4. Reactor Building Pressure - High High 1,2,3 s 30 psig 3

Crystal River Unit 3 3.3-15 Final Draft 10/01/93

ESAS Manual Initiation 3.3.6 3.3 INSTRUMENTATION 3.3.6 Engineered Safeguards Actuation System (ESAS) Manual Initiation .

LCO 3.3.6 Two manual initiation channels for each of the following ESAS Functions shall be OPERABLE:

a. High Pressure Injection;

b. Low Pressure Injection; and

c. Reactor Building (RB) Isolation and Cooling.

APPLICABILITY: MODES 1, 2, and 3, MODE 4 when associated Engineered Safeguards equipment is required to be OPERABLE.

ACTIONS

NOTE------ ------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more ESAS A.1 Restore channel to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months >

Functions with one OPERABLE status, manual initiation channel inoperable.

B. Required Action and 8.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. &N_D B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months O

Crystal River Unit 3 3.3-16 Final Draft 10/01/93

. _. ~ - . ..

ESAS Manual Initiation :

3.3.6 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.6.1 Perform CHANNEL FUNCTIONAL TEST. 18 months i

h t

t O

1 l

r i

3 i

Crystal River Unit 3 3.3-17 Final Draft 10/01/93

)

ESAS Automatic Actuation Logic 3.3.7 3.3 INSTRUMENTATION f)

Ns 3.3.7 Engineered Safeguards Actuation System (ESAS) Automatic Actuation .

Logic LC0 3.3.7 The ESAS automatic actuation logic matrices shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, MODE 4 when associated Engineered Safeguards (ES) equipment is required to be OPERABLE.

ACTIONS

NOTE-------------------------------------

Separate Condition entry is allowed for each automatic actuation lcgic matrix.

CONDITION REQUIRED ACTION COMPLETION TIME

() A. One or more automatic actuation logic A.1 Place associated component (s) in ES I hour matrices inoperable. configuration.

08 A.2 Declare the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months associated component (s) inoperable.

O Crystal River Unit 3 3.3-18 Final Draft 10/01/93

i ESAS Automatic Actuation Logic 3.3.7 i l

(f SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.7.1 -------------------NOTE--------------------

When an ESAS automatic actuation logic matrix is placed in an inoperable status solely for performance of this Surveillance, entry into associated Conditions and Required Actions may be delayed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , provided the associate'd ES function is maintained.

Perform automatic actuation logic CHANNEL 31 days on a FUNCTIONAL TEST. STAGGERED TEST BASIS u

'f O t

)

t O

Crystal River Unit 3 3.3-19 Final Draft 10/01/93

1 EDG LOPS i 3.3.8 O

V 3.3 INSTRUMENTATION 3.3.8 Emergency Diesel Generator (EDG) Loss of Power Start (LOPS)

LC0 3.3.8 Three channels of loss of voltage Function and three channels of degraded voltage Function EDG LOPS instrumentation per EDG shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4, When associated EDG is required to be OPERABLE by LC0 3.8.2 '

"AC Sources-Shutdown."

ACTIONS

-NOTE------------------------------------- i Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME ,

A. One or more Functions A.1 Place channel in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months with one channel per trip.

EDG inoperable.

l B. One or more Functions B.1 Restore all but one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months with two or more channel to OPERABLE channels per EDG status.

inoperable.

C. Required Action and C.1 Enter applicable Innediately associated Completion Condition (s) and Time not met. Required Action for EDG made inoperable by EDG LOPS. ;

I O

Crystal River Unit 3 3.3-20 Final Draft 10/01/93 i

EDG LOPS 3.3.8 '

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.8.1 -------------------NOTE--------------------

When EDG LOPS instrumentation is placed in an inoperable status solely for performance of this Surveillance, entry into associated >

Conditions and Required Actions may be delayed as follows: (a) up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for the degraded voltage Function, and (b) up-to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for the loss of voltage Function, provided the two channels monitoring the Function for the bus are OPERABLE or tripped.

Perform CHANNEL FUNCTIONAL' TEST. 31 days SR 3.3.8.2 -------------------NOTE--------------------

Voltage sensors may be excluded from CHANNEL CALIBRATION. ,

Perform CHANNEL CALIBRATION with setpoint 18 months Allowable Value as follows:

a. Degraded voltage 2 3933 and s 3970 V with a time delay-of 5.0 seconds 1 0.5 seconds; and

b. Sudden loss of voltage from full voltage to 0.0 V with a time delay of 7.8 seconds 1 0.55 seconds at 0.0 V.

t O

Crystal River Unit 3 3.3-21 Final Draft 10/01/93

. . = _ .

Source Range Neutron Flux-3.3.9 3.3 INSTRUMENTATION 3.3.9 Source Range Neutron Flux LCO 3.3.9 Two source range neutron flux channels shall be OPERABLE.

APPLICABILITY: MODE 2 with each intermediate range channel 1 SE-10 amps or NI-5 or NI-6, and NI-7 or NI-8 s 5% RTP, MODES 3, 4 and 5.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One source range A.1 Restore channel to Prior to neutron flux channel OPERABLE status, increasing inoperable. THERMAL POWER B. Two source range B.1 Suspend operations Immediately O,- neutron flux channels involving positive inoperable. reactivity changes.

AND B.2 Initiate action to Immediately insert all CONTROL RODS.

AND B.3 Open CRD trip 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months breakers.

AND (continued) i Crystal River Unit 3 3.3-22 Final Draft 10/01/93

Source Range Neutron Flux 3.3.9 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.4 Verify SDM is I hour 2 1% Ak/k.

oliD Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.9.1 Ferform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months O SR 3.3.9.2 -------------------NOTE--------------------

Neutron detectors are excluded from CHANNEL CALIBRATION.

Perform CHANNEL CALIBRATION. 18 months SR 3.3.9.3 Verify at least one decade overlap with Once each intermediate range neutron flux channels. reactor startup prior to source range counts exgeeding

- 10 cps if not performed within the previods 7 days l

)

l Crystal River Unit 3 3.3-23 Final Draft 10/01/93 1 g ---

Intermediate Range Neutron Flux 3.3.10 3.3 INSTRUMENTATION 3.3.10 Intermediate Range Neutron Flux LC0 3.3.10 Two intermediate range neutron flux channels shall be OPERABLE.

APPLICABILITY: MODE 2, MODES 3, 4, and 5 when any CONTROL R00 drive (CRD) trip breaker.is in the closed position and the CRD Control System is capable of rod withdrawal.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One channel A.1 Restore channel to Prior to entry inoperable. OPERABLE status, into MODE 1 B. Two channels B.1 Suspend operations Immediately inoperable. involving positive reactivity changes.

AND ,

8.2 Open CRD trip I hour breakers.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.10.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months *

(continued)

Crystal River Unit 3 3.3-24 Final Draft 10/01/93

Intermediate Range Neutron Flux

-3.3.10

( SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.3.10.2 -------------------NOTE--------------------

Neutron detectors are excluded from CHANNEL CALIBRATION.

Perform CHANNEL CALIBRATION. 18 months SR 3.3.10.3 Verify at least one decade overlap with Once each power range neutron flux channels. reactor startup prior to

- intermediate range indication exceeding IE-6 amp if not performed within the previous 7 days O

O ,

Crystal River Unit 3 3.3-25 Final Draft 10/01/93

EFIC System Instrumentation 3.3.11

[ 3.3 INSTRUMENTATION 3.3.11 Emergency Feedwater Initiation and Control (EFIC) System Instrumentation LCO 3.3.11 The EFIC System instrumentation channels for each Function in Table 3.3.11-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.11-1.

ACTIONS

NOTE-------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Emergency A.1 Place channel (s) in I hour Feedwater (EFW) bypass or trip.

g Initiation, Main Steam Line Isolation, or AND Main Feedwater (MFW)

Isolation Functions A.2 Place channel (s) in 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months listed in trip.

Table 3.3.11-1 with one channel inoperable.

B. One or more EFW B.1 Place one channel in I hour Initiation, Main Steam bypass.

Line Isolation, or MFW Isolation Functions AND listed in Table 3.3.11-1 with B.2 Place second channel I hour two channels in trip.

inoperable.

AND -)

(continued)

O Crystal River Unit 3 3.3-26 ~ Final Draft 10/01/93 i

l

f -

l 1

EFIC System Instrumentation I 3.3.11

() ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME

]

l B. (continued) B.3 Restore one channel 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months i to OPERABLE status, i C. One EFW Vector Valve C.1 Restore channel to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Control channel OPERABLE status, inoperable. >

D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met for AND Functions 1.a or 1.b.

D.2 --------NOTE---------

Only required for Function 1.a.

O Open CONTROL R00 drive trip breakers.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND D.3 --------NOTE---------

Only required for Function 1.b.

Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months E. Required Action and E.1 Reduce THERMAL POWER 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion to < 10% RTP.

Time not met for -

Function 1.d. ,

(continued)

Crystal River Unit 3 3.3-27 Final Draft 10/01/93 E

EFIC System Instrumentation 3.3.11 ACTIONS (continued)'

CONDITION REQUIRED ACTION COMPLETION TIME F. Required Action and F.1 Reduce once through 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion steam generator Time not met for (OTSG) pressure to Functions 1.c, 2, 3, < 750 psig.

or 4.

SURVEILLANCE REQUIREMENTS

--------------NOTE-------------------------------------

Refer to Table 3.3.11-1 to determine which SRs shall be performed for each EFIC Function.

SURVEILLANCE FREQUENCY SR 3.3.11.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.11.2 Perform CHANNEL FUNCTIONAL TEST. 31 days SR 3.3.11.3 Perform CHANNEL CALIBRATION. 18 months 4

....._____.._______...__... NOTE---------------------------

Only required to be performed in MODES I and 2. '

f SR 3.3.11.4 Verify EFIC RESPONSE TIME is within limits. 24 months on a

. STAGGERED TEST BASIS i

4 O

Crystal River Unit 3 3.3-28 Final Draft 10/01/93

EFIC System Instrumentation 3.3.11 O Table 3.3.11-1 (page 1 of 1)

Emergency feedwater Initiation and Control System Instrunentation APPLICABLE MODES OR OTHER REQUIRED SURVEILLANCE ALLOWABLE FUNCTION SPECIFIED CONDITIONS CHANNELS REQUIREMENTS VALUE

1. EFW Initiation

a. Loss of MFW Pums 1,2("),3(') 4 SR 3.3.11.'1 1 55 psig (Control Oil Pressure) SR 3.3.11.2 SR 3.3.11.3

b. OTSG Level - Low 1,2,3 4 per OTSG SR 3.3.11.1 a 0 inches SR 3.3.11.2 SR 3.3.11.3 SR 3.3.11.4

c. OTSG Pressure - Low 1,2,3(b) 4 per OTSG SR 3.3.11.1 a 600 psig.

SR 3.3.11.2 SR 3.3.11.3

d. RCP Status a 10% RTP 4 SR 3.3.11.1 NA SR 3.3.11.2

SR 3.3.11.3

2. EFW Vector Valve Control

a. OTSG Pressure - Low 1,2,3(b) 4 per OTSG SR 3.3.11.1 .a 600 psig SR 3.3.11.2 SR 3.3.11.3

b. OTSG Differentist 1,2,3(b) 4 SR 3.3.11.1 s 125 psid Pressure - High SR 3.3.11.2 SR 3.3.11.3

3. Main Steam Line Isolation

a. OTSG Pressure - Low 1,2,3(b)(c) 4 per OTSG SR 3.3.11.1 a 600 psig SR 3.3.11.2 >

SR 3.3.11.3 SR 3.3.11.4 4 MFW Isolation

a. OTSG Pressure - Low 1,2,3(b)(d) 4 per OTSG SR 3.3.11.1 a 600 psig SR 3.3.11.2 SR 3.3.11.3 "

SR 3.3.11.4 (a) When the RPS is not in shutdown bypass.

(b) When OTSG pressure a 750 psig. i (c) Except when att MSIVs are closed and deactivated. >

(d) Except when all MFIVs are closed and deactivated.

t Crystal River Unit 3 3.3-29 Final Draft 10/01/93

~,,-+;

.i EFIC Manual Initiation 3.3.12

() 3.3 INSTRUMENTATION 3.3.12 Emergency Feedwater Initiation and Control (EFIC) Manual Initiation LC0 3.3.12 Two manual initiation switches per actuation channel for -

each of the following EFIC Functions shall be OPERABLE: ,

a. Steam generator (OTSG) A Main Feedwater (MFW) Isolation; !

b. OTSG B MFW Isolation;

c. OTSG A Main Steam Line Isolation;

d. OTSG B Main Steam Line Isolation; and

e. Emergency feedwater (EFW) Actuation. t APPLICABILITY: MODES I, 2, and 3.

ACTIONS

..___________________._______ ..-----NOTE-------------------------------------

O Separate Condition ent t, is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME >

A. One or more EFIC A.1 Place trip module for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Function (s) with one the associated EFIC manual initiation Function (s) in trip.

switch inoperable in i one actuation channel.

B. One or more EFIC B.1 Restore one manual 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Function (s) with both initiation switch to manual initiation OPERABLE status.

switches inoperable in one actuation channel.

(continued) ,

O Crystal River Unit 3 3.3-30 Final Draft 10/01/93

EFIC Manual Initiation -

3.3.12

() ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One of more EFIC C.1 Place trip modules I hour l Functions with one for the associated.

manual initiation EFIC Function (s) in switch inoperable in trip.

both actuation channels. <

D. One or more EFIC D.1 Restore one actuation 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months '

Function (s) with both channel for the '

manual initiation associated EFIC switches inoperable in Function (s) to both actuation OPERABLE status.

channel s .

E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND E.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

(}

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY ,

SR 3.3.12.1 Perform CHAN,NEL FUNCTIONAL TEST. 31 days

-i

( I Crystal River Unit 3 3.3-31 Final Draft 10/01/93 l

4 n , - - , , - -

i EFIC Automatic Actuation Logic )

3.3.13 ,

I

( 3.3 INSTRUMENTATION 3.3.13 Emergency Feedwater Initiation and Control (EFIC) Automatic Actuation Logic LC0 3.3.13 Channel A and B EFIC Automatic Actuation logic shall be OPERABLE for each Function' listed below:

a. Main Feedwater Isolation; I

b. Main Steam Line Isolation;

c. Emergency Feedwater Actuation; and

d. Vector Valve Enable Logic.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS

____..........._______...________._--NOTE-------------------------------------

Separate Condition entry is allowed for each Function.

Q(s _____........_____.________________ ..........______ ____.. ............______

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channel A A.1 Restore affected 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Functions inoperable channel to OPERABLE with all channel B status.

Functions OPERABLE: or one or more channel B Functions inoperable with all channel A Functions OPERABLE.

t B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ,

O .

Crystal River Unit 3 3.3-32 Final Draft 10/01/93

EFIC Automatic Actuation Logic 3.3.13 i

' SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.13.1 Perform CHANNEL FUNCTIONAL TEST. 31 days :

-)

l i

j i

i i

l l

l O

1 I

l l

O Crystal River Unit 3 3.3-33 Final Draft 10/01/93

EFIC-EFW-Vector Valve Logic 3.3.14 3.3 INSTRUMENTATION 3.3.14 Emergency Feedwater Initiation and Control (EFIC)- ,

Emergency Feedwater (EFW)-Vector Valve Logic LC0 3.3.14 Four channels of vector valve logic shall-be OPERABLE.

i APPLICABILITY: MODES 1, 2, and 3.

l ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One vector valve logic A.1 Restore channel to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months channel inoperable. OPERABLE status.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. A_NJ1 B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY ;

i SR 3.3.14.1 Perform a CHANNEL FUNCTIONAL TEST. 31 days l

l i

O Crystal River Unit 3 3.3-34 Final Draft 10/01/93

RB Purge Isolation-High Radiation 3.3.15 I 3.3 INSTRUMENTATION (l J -

3.3.15 Reactor Building (RB) Purge Isolation-High Radiation LC0 3.3.15 One channel of Reactor Building Purge Isolation-High Radiation shall be OPERABLE.

APPLICABILITY: When containment purge or mini-purge valves are required to be OPERABLE by LCO 3.9.3, " Containment Penetrations."

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One channel A.1 Enter the applicable Immediately inoperable. Conditions and Required Actions of LC0 3.9.3.

O)

\_

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.15.1 Perforn CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.3.15.2 Perform CHANNEL FUNCTIONAL TEST. 92 days SR 3.3.15.3 Perform CHANNEL CALIBRATION. 18 months r

Crystal River Unit 3 3.3-35 Final Draft 10/01/93

l Control Room Isolation-High Radiation 3.3.16 I

3.3 INSTRUMENTATION 3.3.16 Control Room Isolation-High Radiation j LCO 3.3.16 One channel of Control Room Isolation-High Radiation shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, 4, During movement of irradiated fuel assemblies, l

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One channel inoperable A.1 Place an OPERABLE 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months in MODE 1, 2, 3, or 4. Control Room '

Emergency Ventilation ~

System (CREVS) train -

in the emergency -

recirculation mode.

O B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A AND not met.

B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C. One channel inoperable C.1 Place an OPERABLE Immediately during movement of CREVS train in the irradiated fuel emergency assemblies. recirculation mode.

0_8 C.2 Suspend movement of Immediately irradiated fuel-assemblies.

l O 1 Crystal River Unit 3 3.3-36 Final Draft 10/01/93 l 1

~

l

Control Room Isolation-High Radiation >

-3.3.16 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.16.1 Perform CHANNEL CHECK. 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months s-SR 3.3.16.2 -------------------NOTE--------------------

When the Control Room Isolation-High Radiation instrumentation is placed in an inoperable status solely for performance of ,

this Surveillance, entry into associated Conditions and Required Actions may be delayed for up to 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . l Perform CHANNEL FUNCTIONAL TEST. 92 days SR 3.3.16.3 Perform CHANNEL CALIBRATION with setpoint 18 months Allowable Value less than or equal to two times background.

O O

Crystal River Unit 3 3.3-37 Final Draft 10/01/93

PAM Instrumentation 3.3.17 t' 3.3 INSTRUMENTATION

)

3.3.17 Post-Accident Monitoring (PAM) Instrumentation LC0 3.3.17 The PAM instrumentation for each Function in Table 3.3.17-1 i shall be OPERABLE. .

APPLICABILITY: MODES 1, 2, and 3. -

ACTIONS

NOTES------------------------------------

1. LCO 3.0.4 is not applicable.

2. Separate Condition entry is allowed for each Function.

f CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions A.1 Restore required- 30 days O, with one required channel inoperable.

channel-to OPERABLE status.

i B. Required Action and B.1 Initiate action in Immediately associated Completion accordance with Time of Condition A Specification >

not met. 5.7.2.a.

C. One or more Functions C.1 Restore one channel 7 days '

with two required to OPERABLE status.

channels inoperable.

(continued)

O Crystal River Unit 3 3.3-38 Final Draft 10/01/93

I PAM Instrumentation .I

'3.3.17 l l

() ACTIONS (contir.ued)

CONDITION REQUIRED ACTION COMPLETION TIME j

D. Required Action and D.1 Enter the Condition Immediately associated Completion referenced in Time of Condition C Table 3.3.17-1 for not met. the Function.

E. As required .y E.1 Be in MODE 3. 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months s-Required Action 0.1 and referenced in AND Table 3.3.17-1. '

E.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months F. As required by F.1 Initiate action in Immediately Required Action D.1 accordance with and referenced in Specification '

Table 3.3.17-1. 5.7.2.a.

O t

O Crystal River Unit 3 3.3-39 Final Draft 10/01/93

PAM Instrumentation 3.3.17 s

SURVEILLANCE REQUIREMENTS

NOTE-------------------------------------

These SRs apply to each PAM instrumentation Function in Table 3.3.17-1.

SURVEILLANCE FREQUENCY 8

SR 3.3.17.1 -------------------NOTE--------------------

Not required for Function 4. ,

.. ___________..___......___.......________ i Perform CHANNEL CHECK for each required 31 days instrumentation channel that is normally energized.

SR 3.3.17.2 -------------------NOTE--------------------

Neutron detectors are excluded from CHANNEL ,

CALIBRATION.

Perform CHANNEL CALIBRATION. 18 months O

O Crystal River Unit 3 3.3-40 Final Draft 10/01/93

PAM Instrumentation 3.3.17 Table 3.3.17-1 (page 1 of 1)

( Post Accident Monitoring Instrunentation .

CONDITIONS REFERENCED FROM FUNCTION REQUIRED CHANNELS REQUIRED ACTION 0.1

1. Wide Range Neutron Flux 2 E

2. RCS Hot Leg Tenperature 2 E

3. RCS Pressure (Wide Range) 2 E

4. Reactor Coolant Inventory 2 F

5. Borated Water Storage Tank Level 2 E

6. High Pressure Injection Flow 2 per injection line E

7. Containment Su@ Water Level (flood Level) 2 E

8. Conteirunent Pressure (Narrow Range) 2 E

9. Containment Pressure (Wide Range) 2 E 10 Contairvnent Isolation valve Position 2 per penetration (a)(b) E

11. Containment Area Radiation (High Range) 2 F

12. Contairunent Hydrogen concentration 2 E

13. Pressurizer Level 2 E

14. Steam Generator Water Level (Start-up Range) 2 per OTSG E

15. Steam Generator Water Level (Operating Range) 2 per OTSG E

16. Steam Generator Pressure 2 per OTSG E

17. Emergency Feedwater Tank Level 2 E

18. Core Exit Tenperature (Backup) 2 sets of 5 E

19. Emergency Feedwater flow 2 per OTSG E (a) Only one position indication is required for penetrations with one Control Room indicator.

(b) Not required for isolation valves whose associated penetration is isolated 'J, at least one closed ard deactivated automatic valve, closed manual valve, blind flange, or check valve ulth flow through the valve secured.

s Crystal River Unit 3 3.3-41 Final Draft 10/01/93

Remote. Shutdown System 3.3.18

() 3.3 INSTRUMENTATION 3.3.18 Remote Shutdown System LC0 3.3.18 The Remote Shutdown System Functions in Table 3.3.18-1 shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS

__..____________________.____.-------NOTES----------------------------------.-

1. LCO 3.0.4 is not applicable.

2. Separate Condition entry is allowed for each Function. ,

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Restore required 30 days ,

O Functions inoperable. Function to OPERABLE status.

l 1

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months i

Crystal River Unit 3 3.3-42 Final Draft 10/01/93

Remote Shutdown System 3.3.18 SURVEILLANCE REQUIREMENTS

.....................____........----NOTE-------------------------------------

These SRs apply to each Remote Shutdown System Instrumentation Function in Table 3.3.18-1. .;

1 SURVEILLANCE FREQUENCY SR 3.3.18.1 Perform CHANNEL CHECK for each required 31 days instrumentation channel that is normally energized.

SR 3.3.18.2 -------------------NOTE--------------------

Not required for Function 1.a.

Perform CHANNEL CALIBRATION for each 18 months required instrumentation channel.

I i

i i

1 i

l l

l 1

1 l

l l

Crystal River Unit 3 3.3-43 Final Draft 10/01/93 i

)

l Remote Shutdown System l 3.3.18 O

i Table 3.3.18-1 (page 1 of 1) I Remote Shutdown System Instrtmentation j l

J FUNCTION / INSTRUMENT REQUIRED i NUMBER OF CHANNELS

1. Reactivity Control

a. Reactor Trip Breaker (RTB) Position 1 per trip breaker

2. Reactor Coolant System (RCS) Pressure Control

a. RCS Wide Range Pressure 1

3. Decay Heat Removal via steam Generators (OTSGa)

a. Reactor Coolant Hot Leg Tenperature 1 per loop

b. Decay Heat Removal Tenperature 1 per loop

c. OTSG Pressure 1 per OTSG

d. OTSG Level 1 per OTSG

e. Motor-driven EFW Ptsnp Discharge 1 Pressure

f. SV Cooler outlet Tenperature 1 per cooler

g. SW Punp Discharge Pressure 1

4. RCS Inventory Control

s. Pressurizer Level 1 A

Crystal River Unit 3 3.3-44 Final Draft 10/01/93

RCS Pressure, Temperature, and Flow DNB Limits 3 4.1

/^)

'%)

3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits LC0 3.4.1 RCS DNB parameters for loop pressure, hot leg temperature, .

and RCS total flow rate shall be within limits for the number of reactor coolant pumps (RCPs) in operation.

APPLICABILITY: MODE 1.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more RCS DNB A.1 Restore RCS DNB 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months parameters not within parameter (s) to .

[

limits. within limit.

B. Required Action and B.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion .:

Time not met.

O Crystal River Unit 3 3.4-1 Final Draft 10/01/93 i

RCS Pressure, Temperature, and Flow DNB Limits 3.4.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.1.1 -------------------NOTE--------------------

With three RCPs operating, the limit is applied to the loop with two RCPs in operation. '

Verify RCS loop pressure 2 2061.6 psig with 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months four RCPs operating or 2 2057.2 psig with three RCPs operating.

s SR 3.4.1.2 -------------------NOTE--------------------

With three RCPs operating, the limit is applied to the loop with two RCPs in operation.

Verify RCS hot leg temperature s 604.6*F. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.4.1.3 Verify RCS total flow rate 2139.7 E6 lb/hr 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months with four RCPs operating or 2 104.4 E6 lb/hr with three RCPs operating. ,

SR 3.4.1.4 -------------------NOTE--------------------

Only required to be performed when stable thermal conditions are established > 90% of ALLOWABLE THERMAL POWER.

Verify RCS total flow rate is within limit 24 months by measurement.

O

~

Crystal River Unit 3 3.4-2 Final Draft 10/01/93

RCS Minimum Temperature for Criticality 3.4.2 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.2 RCS Minimum Temperature for Criticality LC0 3.4.2 Each RCS loop average temperature (T,,,) shall be 2 525'F.

.i APPLICABILITY: MODE 1, MODE 2 with k,ff 2 1.0.

ACTIONS ,

CONDITION REQUIRED ACTION COMPLETION TIME A. T in orse or more RCS A.1 Be in MODE 3. 30 minutes 1El8psnotwithin .

limit.

SURVEILLANCE REQUIREMENTS --

SURVEILLANCE FREQUENCY SR 3.4.2.1 Verify RCS T,,, in each loop 2 525'F. Within 15 minutes prior to achieving ,

criticality AND

NOTE-----

Only required if any RCS loop T,,,<

530*F 30 minutes thereafter ,

O Crystal River Unit 3 3.4-3 Final Draft 10/01/93

RCS P/T Limits -)

3.4.3 i

() 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.3 RCS Pressure and Temperature (P/T) Limits LC0 3.4.3 RCS pressure, RCS temperature, and RCS heatup and cooldown rates shall be maintained within the limits specified in the PTLR.

APPLICABILITY: At all times.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. ---------NOTE--------- A.1 Restore parameter (s) 30 minutes Required Action A.2 to within limits.

shall be completed whenever this AND Condition is entered.

A.2 Determine RCS is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months acceptable for O Requirements of LC0 not met in MODE 1, 2, continued operation.

3, or 4.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A AND not met.

B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C. ---------NOTE--------- C.1 Initiate action to Immediately Required Action C.2 restore parameter (s) shall be completed to within limit. ;

whenever this Condition is entered. AND ;

.........-............ i C.2 Determine RCS is Prior to ,

Requirements of LCO acceptable for entering MODE 4 l not met in other than continued operation. l MODE 1, 2, 3, or 4. l Crystal River Unit 3 3.4-4 Final Draft 10/01/93 l

l l

RCS P/T Limits 3.4.3 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3'.4.3.1 -------------------NOTE--------------------

Only required to be performed during RCS heatup and cooldown operations and RCS inservice leak and hydrostatic testing.

Verify RCS pressure, RCS temperature, and 30 minutes RCS heatup and cooldown rates are within the limits specified in the PTLR.

O O

Crystal River Unit 3 3.4-5 Final Draft 10/01/93

RCS Loops--MODE 3

'3.4.4

/~'% 3.4 REACTOR COOLANT SYSTEM (RCS)

V 3.4.4 RCS Loops--MODE 3 LCO 3.4.4 Two RCS loops shall be OPERABLE and at least one RCS loop shall be in operation.

NOTE----------------------------

All reactor coolant pumps (RCPs) may be de-energized for s I hour per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period provided: .

I

a. No operations are permitted that would cause reduction of the RCS baron concentration; and

b. Core outlet temperature is maintained so as to assure subcooling throughout the RCS, APPLICABILITY: MODE 3.

ACTIONS O- ------------------------------------NOTE--------------------------------------

LC0 3.0.4 is not applicable, i CONDITION REQUIRED ACTION COMPLETION TIME A. One RCS loop A.1 Restore RCS loop to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

B. Required Action and B.1 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A ,

not met.

l I

(continued) l O

Crystal River Unit 3 3.4-6 Final Draf t 10/01/93 4

RCS Loops-H0DE 3 3.4.4

( ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. No RCS loop OPERABLE. C.1 Suspend all Immediately operations involving DB a reduction of RCS boron concentration.

No RCS loop in operation. AND C.2 Initiate action to Immediately restore one RCS loop to OPERABLE status and operation.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY O SR 3.4.4.1 Verify one RCS loop is in operation. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.4.4.2 Verify correct breaker alignment and 7 days indicated power available to the required pump that is not in operation.

O Crystal River Unit 3 3.4-7 Final Draft 10/01/93 i

RCS Loops-MODE 4 3.4.5 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.5 RCS Loops-MODE 4 LCO 3.4.5 Two loops consisting of any combination of RCS loops and decay heat removal (DHR) loops shall be OPERABLE and at least one loop shall be in operation.

NOTE----------------------------

All reactor coolant pumps (RCPs) may be de-energized for s 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months per 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period for the transition to or from the DHR System, and all RCPs and DHR pumps may.be de-energized for s I hour per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period for any other reason, provided:

a. No operations are permitted that would cause reduction ,

of the RCS boron concentration; and

b. Core outlet temperature is maintained so as to assure subcooling throughout the RCS.

i APPLICABILITY: MODE 4.

I ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RCS loop A.1 Initiate action to Immediately inoperable. restore a second loop to OPERABLE status.

AND Two DHR loops -

inoperable. ;

I (continued)

O Crystal River Unit 3 3.4-8 Final Draft 10/01/93

RCS Loops-MODE 4 3.4.5

( ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. One DHR loop B.1 Initiate action to Immediately inoperable, restore a second loop to OPERABLE status.

AN_Q E

Two RCS loops inoperable. B.2 Be in MODE 5. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months C. All RCS and DHR loops C.1 Suspend all Immediately inoperable. operations involving a reduction in RCS '

E boron concentration.

No RCS or DHR loop in AND operation.

C.2 Initiate action to Immediately '

restore one loop to OPERABLE status and !

operation.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY- l l

SR 3.4.5.1 Verify one DHR or RCS loop is in operation. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.4.5.2 Verify correct breaker alignment and 7 days ,

indicated power available to the required pump that is not in operation.

i i

O ,

Crystal River Unit 3 3.4-9 Final Draft 10/01/93

RCS Loops-MODE 5, Loops Filled 3.4.6

~

() 3.4 REACTOR COOLANT SYSTEM (RCS)

LJ 3.4.6 RCS Loops-MODE 5, Loops filled LC0 3.4.6 One decay heat removal (DHR) loop shall be OPERABLE and in operation, and either:

a. One additional DHR loop shall be OPERABLE; or

b. One steam generator (OTSG) shall be OPERABLE.

__________________________--NOTES---------------------------

1. The DHR pump of the loop in operation may be de-energized for s I hour per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period provided:

a. No operations are permitted that would cause reduction of the RCS boron concentration; and

b. Core outlet temperature is maintained so as to assure subcooling throughout the RCS.

2. One required DHR loop may be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing provided that the other %

DHR loop is OPERABLE and in operation.

/m

( ) 3. All DHR loops may be removed from operation during planned heatup to MODE 4 provided at least one RCS loop is in operation.

APPLICABILITY: MODE 5 with RCS loops filled.

/*

Crystal River Unit 3 3.4-10 Final Draft 10/01/93

RCS Loops-MODE 5, Loops Filled 3.4.6 CONDITION REQUIRED ACTION COMPLETION TIME A. One DHR loop A.1 Initiate action to Imediately inoperable. restore a second DHR loop to OPERABLE A_ND status.

M Required OTSG inoperable. A.2 Initiate action to Imediately restore an OTSG to OPERABLE status.

B. Required DHR loop B.1 Suspend all Imediately inoperable. operations involving a reduction in RCS E boron concentration.

No DHR loop in AND operation.

B.2 Initiate action to Imediately restore one DHR loop to OPERABLE status O and operation.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.6.1 Verify one DHR loop is in operation. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.4.6.2 Verify required OTSG capability to act as a 7 days heat sink.

(continued)

O Crystal River Unit 3 3.4-11 Final Draft 10/01/93

RCS Loops-MODE 5 Loops Filled 3.4.6.

SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.4.6.3 Verify correct breaker alignment and 7 days

indicated power available to the required DHR pump that is not in operation.

1 O

o Crystal River Unit 3 3.4-12 Final Draft 10/01/93

1 RCS Loops-MODE 5, Loops Not Filled I 3.4.7 !

i 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.7 RCS Loops-MODE 5, Loops Not Filled LC0 3.4.7 Twa decay heat removal (DHR) loops shall be OPERABLE and at '

least one DHR loop shall be in operation.

.______ .....___.____.....__N0TES---------------------------

1. All DHR pumps may be de-energized for 1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period provided:

a. Core outlet temperature is maintained so as to assure subcooling throughout the RCS.

b. No operations are permitted that would cause reduction of the RCS baron concentration; and

c. No draining operations to further reduce the RCS '

water volume are permitted.

2. One DHR loop may be inoperable for s 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing provided that the other DHR loop is OPERABLE and in operation.

APPLICABILITY: MODE 5 with RCS loops not filled.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more DHR A.1 Initiate action to Immediately loop (s) inoperable, restore DHR loop (s) to OPERABLE status. -

(continued)

O .

Crystal River Unit 3 5.4-13 Final Draft 10/01/93

RCS Loops-MODE 5, Loops Not Filled 3.4.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. No DHR loop in B.1 Suspend all Immediately operation. operations involving reduction in RCS boron concentration.

AND B.2 Initiate action to Immediately restore one DHR loop to operation.

. - = . - -

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.7.1 Verify one DHR loop is in operation. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.4.7.2 Verify correct breaker alignment and 7 days .

indicated power available to the required f DHR pump that is not in operation.

t

.i O :

Crystal River Unit 3 3.4-14 Final Draft 10/01/93

t Pressurizer j 3.4.8 .

(/

s_ -

) 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.8 Pressurizer LCO 3.4.8 The pressurizer shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Pressurizer water A.1 Restore level to I hour level not within within limit.

limit.

B. Capacity of B.1 Restore pressurizer 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months pressurizer heaters heater capability.

(~'}-

\s- capable of being powered by emergency power supply less than l i r.i t.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. ANQ ,

I C.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months -

t 1

I i

Crystal River Unit 3 3.4 Final Draft 10/01/93

)

I

~ Pressurizer 3.4.8 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.8.1 Verify pressurizer water level 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months s 290 inches. .

SR 3.4.8.2 Verify 2 252 kW of pressurizer heaters 24 months are capable of being powered from each emergency power supply.

r i

P 1

i i

O Crystal River Unit 3 3.4-16 Final Draft 10/01/93

\

Pressurizer Safety Valves 3.4.9 3.4 REACTOR COOLANT SYSTEM (RCS)

(}

3.4.9 Pressurizer Safety Valves -

LC0 3.4.9 Two pressurizer safety valves shall be OPERABLE. ;

APPLICABILITY: MODES 1, 2, and 3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME ,

A. One pressurizer safety A.1 Restore valve to 15 minutes-valve inoperable. OPERABLE status. ,

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion ;

Time not met. AND QB B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Two pressurizer safety valves inoperable. !

F

'l 0*

\- / ,

Crystal River Unit 3 3.4-17 Final Draft 10/01/93 1

1 Pressurizer Safety Valves 3.4.9 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.9.1 -----------------NOTE----------------------

Not required to be performed prior to entry into MODE 3 for the purpose of setting the pressurizer safety valves under ambient (hot) conditions. This exception is allowed for 36_ hours following entry into MODE 3 provided a preliminary cold setting was made prior to heatup.

Verify each pressurizer safety valve lift In accordance setpoint is 1 2450 psig and s 2550 psig in with the accordance with the Inservice Testing Inservice Program. Valves removed for testing shall Testing Program be reset to 1% of the nominal setpoint.

O l

I

)

O Crystal River Unit 3 3.4-18 Final Draft 10/01/93

Pressurizer PORV 3.4.10 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.10 Pressurizer Powei Operated Relief Valve (PORV)

LCO 3.4.10 The PORV and associated block valve shall be OPERABLE.

l APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME ,

A. PORV inoperable. A.1 Close block valve. I hour .

AND A.2 Remove power from I hour :

block valve.

B. Block valve B.1.1 Close block valve. I hour inoperable.

AND B.1.2 Remove power from I hour block valve.

98 B.2.1 Close PORV. I hour AND B.2.2 Remove power from I hour PORV solenoid valve.

a (continued)

O Crystal River Unit 3 3.4-19 Final Draft 10/01/93

Pressurizer PORV-3.4.10 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. ANS C.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.10.1 -------------------NOTE--------------------

Not required to be performed with block valve closed in accordance with the Required Actions of this Specification.

Perform one complete cycle of the block 92 days valve.

SR 3.4.10.2 -------------------NOTE--------------------

Only required to be performed in MODES I and 2.

Perform one complete cycle of the PORV. 24 months O

Crystal River Unit 3 3.4-20 Final Draft 10/01/93

(

Not Used I 3.4.11 3.4 REACTOR COOLANT SYSTEM (RCS) i 3.4.11 Not Used.

i f

6 T

O l

I 1

O Crystal River Unit 3 3.4-21 Final Draft 10/01/93 l

i

i RCS Operational LEAKAGE 3.4.12 -

3.4 REACTOR COOLANT SYSTEM (RCS)

(}

3.4.12 RCS Operational LEAKAGE LC0 3.4.12 RCS operational LEAKAGE shall be limited to: .

a. No pressure boundary LEAKAGE;

b. I gpm unidentified LEAKAGE;

c. 10 gpm identified LEAKAGE; and

d. I gpm total primary to secondary LEAKAGE through all steam generators (OTSGs). .

Two OTSGs shall be OPERABLE.

l APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME O A. RCS LEAKAGE not within A.1 Reduce LEAKAGE to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months limits for reasons within limits.

Other than pressure boundary LEAKAGE.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months tissociated Completion Time not met. AND QB B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Pressure boundary LEAKAGE exists.

i O

Crystal River Unit 3 3.4-22 Final Draft 10/01/93 H

I

RCS Operational LEAKAGE 3.4.12 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.12.1 -------------------NOTE--------------------

Not required to be performed in MODE 4.

Not required in MODE 3 until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of steady state operation.

Perform RCS water inventory balance during 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months steady state operation.

SR 3.4.12.2 Verify steam generator tube integrity is in In accordance accordance with the Steam Generator Tube with the Steam Surveillance Program. Generator Tube Surveillance Program.

O I

O Crystal River Unit 3 3.4-23 Final Draft 10/01/93 l

1

)

.-. - - - _ _ _ _ _ _ _ -1

RCS PIV Leakage 3.4.13 1

3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.13 RCS Pressure Isolation Valve (PIV) Leakage ;

l LCO 3.4.13 Leakage from each RCS PIV shall be s 5 gpm and the Automatic Closure and Interlock System (ACIS) shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, MODE 4, except valves in the decay heat removal -(DHR) flow path when in, or during the transition to or from the DHR mode of operation.

ACTIONS

NOTES------------------------------------

1. Separate Condition entry is allowed for each flow path.

2. Enter applicable Conditions and Required Actions for systems made '

inoperable by an inoperable PIV.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more flow paths ------------NOTE-------------

with leakage from one Each valve used to satisfy or more RCS PIVs not Required Action A.1 and within limit. Required Action A.2 must have been verified to meet SR 3.4.13.1 and be on the high pressure portion of the system.

(continued) i l

1 O

Crystal River Unit 3 3.4-24 Final Draft 10/01/93

RCS P!V Leakage 3.4.13 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME t

A. (continued) A.1 Isolate the high 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months pressure portion of the affected system from the low pressure portion by use of one elosed_ manual, deactivated automatic, or check valve.

AND A.2 Isolate the 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months high pressure portion ;

of the affected system from the low pressure portion :

by use of a second closed manual, deactivated automatic, or check valve.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time for Condition A AND not met.

B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C. ACIS inoperable. C.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months penetration by use of one closed manual or deactivated automatic !

valve. I O

Crystal River Unit 3 3.4-25 Final Draft 10/01/93

RCS PIV Leakage-3.4.13 ;

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.13.1 -------------------NOTE--------------------

!!ot required to be performed in MODES 3 and 4.

Verify equivalent leakage from each RCS PIV In accordance is within limit at an RCS pressure of 2155 with the psig. Inservice. '

Testing Program A_tLQ 4 Prior to '

entering MODE _2 whenever the unit has been in MODE 5 for 7 days or more, if leakage testing has not been performed O in the previous 9 months SR 3.4.13.2 Verify ACIS prevents the valves from being 24 months opened with a simulated or actual RCS pressure signal of 284 psig (nominal).

i SR 3.4.13.3 Verify ACIS causes the valves to close 24 months automatically with a simulated or actual RCS pressure signal of 284 psig (nominal).

O Crystal River Unit 3 3.4-26 Final Draft 10/01/93

. - _ _ . _- . . =.

RCS Leakage Detection Instrumsntation- ,

3.4.14 ,

( 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.14 RCS Leakage Detection Instrumentation LCO 3.4.14 The following RCS leakage detection instrumentation shall be -

OPERABLE:

a. One containment sump monitor; and

b. One containment atmosphere radioactivity monitor (gaseous or particulate).

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Containment sump ------------NOTE-------------

monitor inoperable. LC0 3.0.4 is not applicable.

A.1 Perform SR 3.4.12.1. Once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months AND A.2 Restore containment 30 days suinp monitor to -

OPERABLE status.

B. Required containment ------------NOTE-------------

atmosphere LC0 3.0.4 is not applicable, radioactivity monitor ----------------------------- i inoperable.

B.1.1 Analyze grab samples Once per of the containment 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months atmosphere.

OB j (continued)

O Crystal River Unit 3 3.4-27 Final Draft 10/01/93

RCS Leakage Detection Instrumentation 3.4.14 ]

i

'/ ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.I.2 Perform SR 3.4.12.1. Once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months AND i B.2 Restore required 30 days containment atmosphere radioactivity monitor to OPERABLE status.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months A

( D. Both required monitors inoperable.

D.1 Enter LC0 3.0.3. Immediately

~

t i

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.14.1 Perform CHANNEL CHECK of required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months containment atmosphere radioactivity monitor.

SR 3.4.14.2 Perform CHANNEL FUNCTIONAL TEST of required 92 days containment atmosphere radioactivity monitor.

(continued)

Crystal River Unit 3 3.4-28 Final Draft 10/01/93 ,

- ~- ,r .

. = .

I RCS Leakage Detection Instrumentation 3.4.14

()

i SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.4.14.3 Perform CHANNEL CALIBRATION of containment 18 months sump monitor.

SR 3.4.14.4 Perform CHANNEL CALIBRATION of required 18 months containment atmosphere radioactivity monitor.

l O

1 I

1

)

I i

l l

I I

O Crystal River Unit 3 3.4-29 Final Draft 10/01/93

RCS Specific Activity 3.4.15 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.15 RCS Specific Activity LC0 3.4.15 The specific activity of the reactor coolant shall be within limits.

APPLICABILITY: MODES 1 and 2, MODE 3 with RCS average temperature (T,,,) 2 500*F.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. DOSE EQUIVALENT I-131 ------------NOTE-------------

> 1.0 Ci/gm. LCO 3.0.4 is not applicable.

A.1 Verify DOSE Once per 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months EQUIVALENT I-131 within the acceptable region of O Figure 3.4.15-1.

MD A.2 Restore DOSE 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months EQUIVALENT I-131 to within limit.

B. Required Action and B.1 Be in MODE 3 with 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A T < 500*F.

not met.

. 93 DOSE EQUIVALENT I-131 in the unacceptable region of Figure 3.4.15-1.

(continued)

O Crystal River Unit 3 3.4-30 Final Draft 10/01/93 ,

4

l RCS Specific Activity l 3.4.15 i l

r

( ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME ;

C. Gross specific C.1 Perform SR 3.4.15.2. 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months activity of the coolant not within ANJ N

limit.

C.2 Be in MODE 3 with 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months T,y < 500*F.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY .

SR 3.4.15.1 Verify reactor coolant gross specific 7 days activity 5 100/E Ci/gm.

SR 3.4.15.2 -------------------NOTE--------------------

Only required to be performed in MODE 1.

Verify reactor coolant DOSE EQUIVALENT 14 days ;

I-131 specific activity s 1.0 pCi/gm. '

AND Between 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after THERMAL POWER change of ;t 15% -

RTP within a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months period (continued)

O Crystal River Unit 3 3.4-31 Final Draft 10/01/93

-)

RCS Specific Activity '

3.4.15

() SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.4.15.3 -------------------NOTE--------------------

Not required to be performed until 31 days after a minimum of 2 EFPD and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for '

2 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

Determine E. 184 days i

O 4

i l

-)

Crystal River Unit 3 3.4-32 Final Draft 10/01/93

RCS Specific Activity 3.4.15 O

\

v \

3 250 \

\

s3 \x

? \x s UNACCEPTABLE p 200 \x

$ OPERATION

$ (

S \

% \

$ 150 \x 5

g \X -

o

= \X S

C 100 \ \

a \

2 \

ACCEPTABLE \

, OPERATION .

y 50 8

w S

0 PERCENT hk RAThb THEkhAAL POWER Figure 3.4.15-1 (page 1 of 1)

Reactor Coolant DOSE EQUIVALENT l-131 Spe_cific Activity Limit Versus Percent of RATED THERMAL POWER With Reactor Coolant Specific Activity >1.0 pCilgm DOSE EQUIVALENT l-131 O

Crystal River Unit 3 3.4-33 Final Draft 10/01/93

CFTs l

3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Core Flood Tanks (CFTs)

LC0 3.5.1 Two CFTs shall be OPERABLE.

APPLICABILITY: MODES 1 and 2, MODE 3 with Reactor Coolant System (RCS) pressure

> 750 psig.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. CFT inoperable due to A.1 Restore boron 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months boron concentration concentration to not within limits. within limits.

I B. CFT inoperable for B.1 Restore CFT(s) to I hour reasons other than OPERABLE status.

Condition A.

DE Two CFTs inoperable. .

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. A_HQ C.2 Reduce RCS pressure 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to s 750 psig.

O Crystal River Unit 3 3.5-1 Final Draft 10/01/93

CFTs 3.5.1

() SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.1.1 Verify each CFT isolation valve is fully 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months open. -

SR 3.5.1.2 Verify borated water volume in each CFT. is 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 2 7255 gallons and s 8005 gallons.

SR 3.5.1.3 Verify nitrogen cover pressure in each CFT 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is 2 577 psia and s 653 psia. .

SR 3.5.1.4 Verify boron concentration in each CFT is 31 days 2 2270 ppm and s 3500 ppm.

AR

'~

Uniy~0qIred

([]) to be performed for affected -

CFT Once within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after each solution volume increase of 2 80 gallons that is not the result of addition from .

the borated water storage tank (continued) l Crystal River Unit 3 3.5-2 Final Draft 10/01/93

CFTs 3.5.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.5.1.5 Verify power is removed from each CFT 31 days isolation valve operator.

O i

O Crystal River Unit 3 3.5-3 Final Draft 10/01/93

1 ECCS-Operating 1 3.5.2 i J

3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.2 ECCS-Operating !

LCO 3.5.2 Two ECCS trains shall be OPERABLE.

l APPLICABILITY: MODES 1, 2, and 3.

ACTIONS -

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more trains A.1 Restore train (s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

AND ,

At least 100% of the ECCS flow equivalent O to a single OPERABLE ECCS train available.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND ,

B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months l

i

\

O Crystal River Unit 3 3.5-4 Final Draft 10/01/93 1

.- = - _

ECCS-Operating 3.5.2 SURVEILLANCE REQUIREMENTS ,

SURVEILLANCE FREQUENCY SR 3.5.2.1 Verify each ECCS manual, power operated, 31 days and automatic valve in the flow path, that is not locked, sealed, or otherwise secured in position, is in the correct position.

SR 3.5.2.2 Verify each ECCS pump's developed head at In accordance the test flow point is greater than or with the equal to the required developed head. Inservice Testing Program SR 3.5.2.3 Verify each ECCS automatic valve in the 24 months flow path that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or i simulated actuation signal.

O SR 3.5.2.4 Verify each ECCS pump starts automatically 24 months on an actual or simulated actuation signal.

SR 3.5.2.5 Verify the correct settings of stops for 24 months the following HPI stop check valves:

a. MUV-2

b. MUV-6

c. MUV-10 (continued) 1 1

O Crystal River Unit 3 3.5-5 Final Draft 10/01/93

ECCS--Operating '

3.5.2

() SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.5.2.6 Verify the flow controllers for the 24 months following LPI throttle talves operate properly: ,

a. DHV-110

b. DHV-111 SR 3.5.2.7 Verify, by visual inspection, each ECCS 24 months train reactor building emergency sump suction inlet is not restricted by debris and suction inlet trash racks and screens .

show no evidence of structural distress or abnormal corrosion. <

l O

P l

l Crystal River Unit 3 3.5-6 Final Draft. 10/01/93 d

r r

ECCS--Shutdown 3.5.3

() 3.5 EMERGENCY CORE COOLING SYSTEMSL(ECCS) 3.5.3 ECCS-Shutdown LC0 3.5.3 One ECCS train shall be OPERABLE.

NOTE-----------------_-------

High pressure injection (HPI) may be deactivated in accordance with Low Temperature Overpressure Protection (LTOP) administrative controls.

APPLICABILITY: MODE 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Required low pressure A.1 Initiate action to Immediately injection (LPI) restore required LPI subsystem inoperable. subsystem to OPERABLE O status.

B. Required HPI subsystem B.1 Restore required HPI 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. subsystem to OPERABLE status.

C. Required Action and C.1 Be in MODE 5. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months associated Completion Time not met.

O Crystal River Unit 3 3.5-7 Final Draft 10/01/93

ECCS -Shutdown 3.5.3 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.3.1 -----------------NOTE---------------------

An LPI subsystem may be considered OPERABLE during alignment and operation for decay heat removal if capable of being manually re-aligned to the ECCS mode of operation.

For all equipment required to be OPERABLE; In accordance the following SRs are applicable, with applicable SRs SR 3.5.2.1 SR 3.5.2.6 SR 3.5.2.2 SR 3.5.2.7 SR 3.5.2.5

'i O

Crystal River Unit 3 3.5-8 Final Draft 10/01/93

BWST.

3.5.4 3.S EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.4 Borated Water Storage Tank (BWST)

LCO 3.5.4 The BWST shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. BWST boron A.1 Restore BWST to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months concentration not OPERABLE status, within limits.

QB BWST water temperature not within limits.

O B. BWST inoperable for B.1 Restore BWST to I hour reasons other than OPERABLE status.

Condition A.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months O

Crystal River Unit 3 3.5-9 Final Draft 10/01/93

BWST 3.5.4 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.4.1 -------------------NOTE--------------------

Only required to be performed when ambient air temperature is < 40*F or > 100*F. ,

Verify BWST borated water temperature is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 2 40*F and s 100*F.

SR 3.5.4.2 Verify BWST borated water volume is 7 days 2 415,200 gallons and s 449,000 gallons.

SR 3.5.4.3 Verify BWST boron concentration is 31 days 2 2270 ppm and s 3000 ppm.

AND Once within 12 O

v hours after each solution volume increase of 1 4000 gallons O

Crystal River Unit 3 3.5-10 Final Draft 10/01/93

Containment "

1 3.6.1 3.6 CONTAINMENT SYSTEMS

(} I 3.6.1 Containment r

LC0 3.6.1 Containment shr'l be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME- ,

^

A. Containment inoperable A.1 Restore containment I hour for reasons other than to OPERABLE status. .

Conditions B or C. ,

B. Average of measured B.1 Restore containment 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

prestress forces in a to the required level group below the mini- of integrity as ;

O,, mum required prestress specified in the '

force of the Containment Tendon Containment Tendon Surveillance Program.

Surveillance Program.

C. Abnormal degradation C.1 Restore containment 15 days identified under the to the required level r Containment Tendon of integrity as Surveillance Program specified in the other than covered by Containment Tendon Condition B. Surveillance Program. ,

D. Required Action and 0.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months l

i Crystal River Unit 3 3.5 1 Final Draft 10/01/93 l

-1 i

Containment 3.6.1 SURVEILLANCE RE0VIREMENTS _

SURVEILLANCE FREQUENCY SR 3.6.1.1 Perform required visual examinations and -----NOTE------ '

leakage rate testing except for containment SR 3.0.2 is not air lock testing, in accordance with applicable >

10 CFR 50, Appendix J, as modified by --------------- ,

approved exemptions. -

In accordance The maximum allowable leakage rate, L,, is with 10 CFR 50, .

0.25% of containment air weight per day at Appendix J, as-the calculated peak containment pressure, modified by P,. approved exemptions SR 3.6.1.2 Verify containment structural integrity In accordance in accordance with the Containment Tendon with the Surveillance Program. Containment Tendon Surveillance Program O

4 O

Crystal River Unit 3 3.6-2 Final Draft 10/01/93

1 Containment Air Locks 3.6.2-i

~'N 3.6 CONTAINMENT SYSTEMS

[O 3.6.2 Containment Air Locks LCO 3.6.2 Two containment air locks shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

J ACTIONS

_____._______________________________ NOTES------------------------------------

1. Entry and exit is pennissible to perform repairs on the affected air lock components or for emergencies involving personnel safety.

2. Separate Condition entry is allowed for each air lock.

3. Enter applicable Conditions and Required Actions of LCO 3.6.1,

" Containment," when air lock leakage results in exceeding the overall containment leakage rate acceptance criteria.

() CONDITION REQUIRED ACTION COMPLETION TIME A. One or more ------------NOTES------------

containment air locks 1. Required Actions A.1, i with one containment A.2, and A.3 are not air lock door applicable if both doors inoperable. in the same air lock are -

inoperable and .

Condition C is entered.

2. Entry and exit is permissible for 7 days under administrative controls if both air locks are inoperable.

A.1 Verify the OPERABLE 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months door is closed in the affected air lock.

AND (continued)

Crystal River Unit 3 3.6-3 Final Draft 10/01/93 i

I

Containment Air Locks.

3.6.2

() ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 Lock the OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months door closed in the affected air lock.

MQ A.3 Verify the OPERABLE Once per 31 days door is locked closed in the affected air lock.

.i B. One or more ------------NOTES------------

containment air locks 1. Required Actions B.1, with containment air B.2, and B.3 are not lock interlock applicable if both doors mechanism inoperable. in the same air lock are

inoperable and Condition C is entered.

t

(,_f 2. Entry and exit of containment is permissible under the control of a dedicated individual.

B.1 Verify an OPERABLE 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months door is closed in the affected air lock.

AND (continued) i

~

i l

l l

l O

Crystal River Unit 3 3.6-4 Final Draft 10/01/93 i

i

' Containment Air Locks 3.6.2

() ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME i

B. (continued) B.2 Lock an OPERABLE door 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months closed in the affected air lock.

AE B.3 Verify an OPERABLE Once per 31 days-door is locked closed in the affected air lock.

f C. One or more -------------NOTE------------ ,

containment air locks Successful performance of an inoperable for reasons overall leakage rate test of other than Condition A the affected air lock may be or B. used to satisfy Required .

Actions C.1 and C.3 wbcn Condition C is entered as a result of a failure of the O\ door seal leakage rate test.

C.1 Initiate action to Immediately evaluate overall ;

containment leakage ;

rate, j AND C.2 Verify a door is I hour closed in the affected air lock.

AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months l OPERABLE status. -l (continued) l l

1 Crystal River Unit 3 3.6-5 Final Draft 10/01/93 l

i Containment Air Locks 3.6.2 l ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and 0.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ;

associated Completion I Time not met. .A_!iQ l D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months

-I I

I i

i 1

1

)

O Crystal River Unit 3 3.6-6 Final Draft 10/01/93 i

~- 4 Containment Air Locks !

3.6.2 I SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY i SR 3.6.2.1 -------------------NOTES-------------------

1. An inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test.

2. Results shall be evaluated against acceptance criteria of SR 3.6.1.1 in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions.

Perform required air lock leakage rate -----NOTE-----

testing in accordance with 10 CFR 50, SR 3.0.2 is not Appendix J, as modified by approved applicable exemptions. --------------

The acceptance criteria for air lock In accordance testing are: with 10 CFR 50, Appendix J, as '

a. Overall air lock leakage rate is modified by O. s 0.05 L, when tested at 2 P,. approved exemptions i

b. For each door, leakage rate is s 0.01 L, when tested at 2 8.0 psig.

SR 3.6.2.2 -------------------NOTE--------------------

Only required to be performed when an air lock is used for entry into containment.

Verify only one door in the air lock can be 184 days opened at a time.

O Crystal River Unit 3 3.6-7 Final Draft 10/01/93 1 l

Containment Isolation Valves 3.6.3 3.6 CONTAINMENT SYSTEMS l 3.6.3 Containment Isolation Valves LCO 3.6.3 Each containment isolation valve shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4. j ACTIONS !

___.___________________________ -----NOTES------------------------------------ 1

1. Penetration flow paths except for 48 inch purge valve penetration flow paths may be unisolated intermittently under administrative controls.

2. Separate Condition entry is allowed for each penetration flow path. .

3. Enter applicable Conditions and Required Actions for system (s) made inoperable by containment isolation valves.

4. Enter applicable Conditions and Required Actions of LC0 3.6.1,

" Containment," uhen purge valve leakage results in exceeding the overall containment leakage rate acceptance criteria.

CONDITION REQUIRED ACTION COMPLETION TIME A. --------NOTE--------- A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Only applicable ta penetration flow path penetration flow paths by use of at least with two containment one closed and isolation valves. de-activated

automatic valve, '

closed manual valve, One or more blind flange, or .

penetration flow paths check valve with flow with one containment through the valve isolation valve secured. .

inoperable (except for purge valve leakage AND not within limit).

(continued)

O Crystal River Unit 3 3.6-8 Final Draft 10/01/93

Containment Isolation Valves 3.6.3

(~ \ ACTIONS

%) COMPLETION TIME CONDITION REQUIRED ACTION A. (continued) A.2 --------NOTE---------

Valves and blind flanges in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path for isolation is isolated. devices outside containment AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days

-- for isolation devices inside containment (continued)

O Crystal River Unit 3 3.6-9 Final Draft 10/01/93

Containment Isolation Valves 3.6.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. --------NOTE--------- B.1 Isolate the affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Only applicable to penetration flow path penetration flow paths by use of at least with two containment one closed and isolation valves or de-activiated penetration flow paths automatic valve, with one containment closed manual valve, isolation valve and no or blind flange, closed system.

AND One or more 8.2 --------NOTE---------

penetration flow paths Valves and blind with all containment flanges in high isolation valves radiation areas may inoperable (except for be verified by use of purge valve leakage administrative means, not within limit). ---------------------

Verify the affected Once per 31 days penetration flow path for isolation O is isolated. devices outside containment MD Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside containment (continued) 1 Crystal River Unit 3 3.6-10 Final Draft 10/01/93 l

Containment Isolation Valves 3.6.3 =)

b V

ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. --------NOTE--------- C.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Only applicable to penetration flow nath penetration flow paths by use of at least with only one one closed and ;

containment isolation de-activated i valve and a closed automatic valve, system. closed manual valve,

or blind flange.

One or more AND !

penetration flow paths with one containment C.2 --------NOTE---------

isolation valve Valves and blind inoperable or the flanges in high closed system radiation areas may breached, be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path O is isolated.

D. One or more D.1 Restore purge valve 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months penetration flow paths leakage to within with one or more limits.

containment purge valves not within purge valve leakage limits.

E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND E.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months O

Crystal River Unit 3 3.6-11 Final Draft 10/01/93

I Containment Isolation Valves 3.6.3 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY

)

SR 3.6.3.1 Verify each 48 inch purge valve is sealed 31 days l closed except for one purge valve in a '

penetration flow path while in Condition 0 of the LCO.

SR 3.6.3.2 Verify each 6 inch purge valve is closed 31 days except when the 6 inch purge valves are open for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open.

SR 3.6.3.3 ------------------ -NOTE-------------------

Valves and blind flanges in high radiation areas may be verified by use of administrative means.

( ...........................................

Verify each containment isolation manual 31 days.

valve and blind flange that is located outside containment and is required to be closed during accident conditions is closed, except for containment isolation- :

valves that are open under administrative controls.

(continued) i l

)

O Crystal River Unit 3 3.6-12 Final Draft 10/01/93 i

Containment Isolation Valves 3.6.3 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY l

SR 3.6.3.4 ------------------NOTE-------------------

Valves and blind flanges in hich radiation areas may be verified by use of i administrative means.

Verify each containment isolation manual Prior to valve and bl.ind flange that is located- entering MODE 4 inside containment and required to be from MODE 5 if closed during accident conditions is not performed closed, except for containment isolation within the valves that are open under administrative previous controls. 92 days SR 3.6.3.5 Verify the isolation time of each power In accordance operated and each automatic containment with the i isolation valve that is not locked, sealed. Inservice or otherwise secured in the isolation Testing Program position, is within limits.

SR 3.6.3.6 ------------------NOTE-------------------- I Results shall be evaluated against acceptance criteria of SR 3.6.1.1 in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions. j Perform leakage rate testing for each 48 Within 92 days inch containment purge valve. after opening the valve bid 24 months (continued)

O Crystal River Unit 3 3.6-13 Final Draft 10/01/93

Containment Isolation Valves 3.6.3 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.6.3.7 ------------------NOTE--------------------

Not applicable in MODE 4.

Verify each automatic containment isolation 24 months valve that is not locked, sealed, or otherwise secured in the isolation position, actuates to the isolation position on an actual or simulated actuation signal.

i O

O Crystal River Unit 3 3.6-14 Final Draft 10/01/93

l l

Containment Pressure 1 3.6.4 l l

O v 3.6 CONTAINMENT SYSTEMS 3.6.4 Containment Pressure .;

LC0 3.6.4 Containment pressure shall be 2 -2.0 psig and s +3.0 psig.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Containment pressure A.1 Restore containment I hour not within limits. pressure to.within limits.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND

(}

B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.4.1 Verify containment pressure is 2 -2.0 psig 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and 5 +3.0 psig.

1 J

Crystal River Unit 3 3.6-15 Final Draft 10/01/93

a l

Containment Air Temperature 3.6.5 3.6 CONTAINMENT SYSTEMS l

3.6.5 Containment Air Temperature LCO 3.6.5 Containment average air temperature shall 'be s 130*F.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIREu ?CT!0'; COMPLETION TIME A. Containment average A.1 Restore containment 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months air temperature not average air within limit. temperature to within limit. ,

B. Required Action and B,1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion O. Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.5.1 Verify containment average air temperature 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is s 130*F.

O Crystal River Unit 3 3.6-16 Final Draft 10/01/93

Reactor Building Spray and Containment Cooling _ Systems 3.6.6-3.6 CONTAINMENT SYSTEMS 3.6.6 Reactor Building Spray and Containment Cooling Systems -

LCO 3.6.6 Two reactor building spray trains and two containment cooling trains shall be 07ERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

~

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One reactor building A.1 Restore reactor 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months spray train building spray train inoperable. to OPERABLE status. AND 10 days from discovery of failure to meet the LCO B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A AND not met.

B.2 Be in MODE 5. 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months C. One required C.1 Restore required 7 days containment cooling containment cooling train inoperable. train to OPERABLE AND status.

- 10 days from discovery of failure to meet the LCO (continued) 1 O 1 l

Crystal River Unit 3 3.6-17 Final Draft 10/01/93 ;

1

Reactor Building Spray and Containment Cooling Systems 3.6.6 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Two required D.1 Restore one required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months containment cooling containment cooling trains inoperable. train to OPERABLE status.

E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition C BiQ or D not met.

F.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months F. Two reactor building F.1 Enter LCO 3.0.3 Immediately spray trains inoperable.

98 Any combination of three trains inoperable.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.6.1 Verify each reactor building spray manual, 31 days power operated, and automatic valve in the flow path that is not locked, sealed, or otherwise secured in position is in the correct position.

(continued)

O Crystal River Unit 3 3.6-18 Final Draft 10/01/93 i

Reactor Building Spray and Containment Cooling Systems 3.6.6 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.6.6.2 Operate each required containment cooling 31 days train fan unit for 2 15 minutes.

s SR 3.6.6.3 Verify each reactor building spray pump's In accordance developed head at the flow test point is with the greater than or equal to the required Inservice developed head. Testing Program SR 3.6.6.4 Verify each required containment cooling 24 months train cooling water flow rate is

> 1780 gpm.

SR 3.6.6.5 ------------------NOTE--------------------

Not applicable in MODE 4.

O ________ ........ .._________.._________ __

Verify each automatic reactor building 24 months spray valve in the flow path that is not locked, sealed, or secured in the correct position, actuates to the correct position on an actual or simulated actuation signal.

SR 3.6.6.6 ------------------NOTE-------------------- .

Not applicable in MODE 4.

Verify each reactor building spray pump 24 months starts automatically on an actual or simulated actuation signal.

(continued)

O '

Crystal River Unit 3 3.6-19 Final Draft 10/01/93 i

Reactor Building Spray and Containment Cooling Systems 3.6.6

. SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.6.6.7 ------------------NOTE-------------------- '

Not applicable in MODE 4.

Verify each required containment cooling 24 months train starts automatically on an actual or simulated actuation signal.

SR 3.6.6.8 Verify each spray nozzle is unobstructed. 10 years O

O Crystal River Unit 3 3.6-20 Final Draft 10/01/93

i l

Containment Emergency Sump pH Control System (CPCS) l 3.6.7 -

i rO 3.6 CONTAINMENT SYSTEMS

.()

3.6.7 Containment Emergency Sump pH Control System (CPCS)

LC0 3.6.7 The CPCS shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. CPCS inoperable. A.1 Restore CPCS to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Tima not met. AND B.2 Be in MODE 5. 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY 3

SR 3.6.7.1 VepifyTSP-Cvolumeis2246ft and s 254 24 months ft SR 3.6.7.2 Verify TSP-C density is 1 53 lb/ft , 3 24 months SR 3.6.7.3 Verify TSP-C solubility is within limits. 24 months O

Crystal River Unit 3 3.6-21 Final Draft 10/01/93 ,

MSSVs .

3.7.1 3.7 PLANT SYSTEMS 3.7.1 Main Steam Safety Valves (MSSVs)

LCO 3.7.1 The MSSVs shall be OPERABLE as specified in Table 3.7.1-1.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS

NOTE-------------------------------------

Separate Condition entry is allowed for each MSSV.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Reduce THERMAL POWER 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

MSSVs inoperable. to less than the reduced power (RP) limit of O Table 3.7.1-1.

E!LQ .

A.2 Reduce the nuclear 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months overpower trip '

setpoint (SP) in accordance with Table 3.7.1-1.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND 08 B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months No OPERABLE MSSV on one or more steam generators with a nominal lift setpoint of 1050 psig.

Crystal River Unit 3 3.7-1 Final Draft 10/01/93

MSSVs 3.7.1

{') SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.1.1 -------------------NOTE--------------------

Only required to be performed in MODES 1 and 2.

Verify each required MSSV lift setpoint in In accordance accordance with the Inservice Testing with the Program. Valves removed for testing shall Inservice .;

be reset to 1% of the nominal setpoint. Testing Program O

~

l

\

O Crystal River Unit 3 3.7-2 Final Draft 10/01/93

l MSSVs 3.7.1 l hs/ Table 3.7.1-1 (page 1 of 1)

MSSV OPERABILITY Requirements A. Two MSSVs per OTSG shall be OPERABLE with a nominal lift setpoint of 1050 psig.

t B. Maximum nominal MSSV lift setpoint shall be $ 1100 psig.

C. Allowed THERMAL POWER and Nuclear Overpower Trip Setpoint versus OPERABLE Main Steam Safety Valves.

RP - 1 x 100% SP - 1 x W ,

Z Z SP = Nuclear overpower trip setpoint (not to exceed W). .

RP = Reduced power requirement (not to exceed RTP).

W - Nuclear overpower trip setpoint for four pump operation as specified in Table 3.3.1-1.

Y - Total OPERABLE MSSV relieving capacity per steam generator based on summation of individual 0PERABLE MSSV relief capacities per steam generator (lb/ hour).

Z - Required relieving capacity per steam generator of 6,160,000 lb/ hour. ,

D. Maximum allowable tolerance on lift setpoints is 3%.

7 O

Crystal River Unit 3 3.7-3 Final Draft 10/01/93

i i

MSIVs i 3.7.2 4 3.7 PLANT SYSTEMS 3.7.2 Main Steam Isolation Valves (MSIVs)

LCO 3.7.2 Each MSIV shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS

NOTE--------------------------------------

Enter applicable Conditions and Required Actions for Turbine Bypass Valves (TBVs) made inoperable by MSIV(s). ,

CONDITION REQUIRED ACTION COMPLETION TIME

NOTE-----------

Separate Condition entry A.1 Close inoperable 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months

, is allowed for each MSIV. MSIV(s).

( ____...__.________..._____

AND A. One or more MSIV inoperable on one A.2 Verify inoperable Once per 7 days steam generator. MSIV(s) is closed. ,

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion '

Time not met. AhD _

B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months O

Crystal River Unit 3 3.7-4 Final Draft 10/01/93

MSIVs 3.7.2

[ SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.2.1 -------------------NOTE--------------------

Only required to be performed in MODES 1 and 2.

Verify closure time of each MSIV is in In accordance accordance with the Inservice Testing with the Program. Inservice Testing Program l

I i

O Crystal River Unit 3 3.7-5 Final Draft 10/01/93 1

MFIVs-3.7.3 3.7 PLANT SYSTEMS 3.7.3 Main Feedwater Isolation Valves (MFIVs)

LC0 3.7.3 Two MFIVs in each MFW flow path shall be OPERABLE with at least one MFIV capable of isolating MFW within the required isolation time.

APPLICABILITY: M0CES 1, 2, and 3.

ACTIONS

NOTES------------------------------------

1. Separate Condition entry is allowed for each MFW flow path.

2. MFW flow paths may be unisolated under administrative control.

3. Operation with affected MFW flow paths isolated s!,all not result in isolation of the MFW startup flow path for more than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

4 CONDITION REQUIRED ACTION COMPLETION TIME .

O A. One or more MFW flow A.1 Isolate affected flow 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months paths with one MFIV path (s).

inoperable.

AND A.2 Verify affected flow Once per 7 days path (s) is isolated.

l Isolate affected flow

,B. One or more MFW flow B.1 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months paths not capable of path (s).

isolating within required isolation AND time. . l B.2 Verify affected flow Once per 7 days l path (s) is isolated.

l l

(continued)

O Crystal River Unit 3 3.7-6 Final Draft 10/01/93 1

L MFIVs 3.7.3 1

() ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One or more MFW flow C.1 Isolate affected flow 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ,

paths with two MFIVs path (s). '

inoperable.

D. One or more MFW flow D.1 Restore MFIV(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months paths with the MFW OPERABLE status. ,

start-up block valve v inoperable.

E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion "

Time not met. AND E.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months O B SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.3.1 -------------------NOTE--------------------

Only required to be performed in MODES 1 and 2.

Verify MFIV closure time in accordance with In accordance the Inservice Testing Program. with the :

Inservice Testing Program O

Crystal River Unit 3 3.7-7 Final Draft 10/01/93

TBVs 3.7.4 3.7 PLANT SYSTEMS

,s

-- 3.7.4 Turbine Bypass Valves (TBVs)

LC0 3.7.4 Each TBV shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more TBVs A.1 Restore TBV(s) to 7 days inoperable. OPERABLE status.

93 A.2 Verify by 7 days administrative means OPERABILITY of associated steam <

generator atmospheric

(" dump valve (ADV).

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ,

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.4.1 Perform one complete cycle of each TBV. 24 months l

Crystal River Unit 3 3.7-8 Final Draft 10/01/93

EFW System 3.7.5 3.7 PLANT SYSTEMS 3.7.5 Emergency Feedwater (EFW) System LCO 3.7.5 Two EFW trains shall be OPERABLE.

NOTE----------------------------

Only one EFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 3 with steam generator pressure < 200 psig.

APPLICABILITY: MODES 1, 2, and 3.

l l

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One steam supply to A.1 Restore steam supply 7 days the turbine driven EFW to OPERABLE status.

pump inoperable. AND 10 days from discovery of failure to !

meet the LC0

'l 1

B. One EFW train B.1 Restore EFW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons OPERABLE status.

Other than AND '

Condition A.

10 days from discovery of failure to meet the LC0 l

(continued)

O Crystal River Unit 3 3.7-9 Final Draft 10/01/93

l EFW System 3.7.5

-i

( A_CTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C . '. Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A AND or B not met.

C.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

^

D. Two EFW trains D.1 Initiate action to Immediately inoperable. restore one EFW train to OPERABLE status. ,

O i

1 O I Crystal River Unit 3 3.7-10 Final Draft 10/01/93

EFW System i 3.7.5 l

)

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.5.1 Verify each EFW manual, power operated, and 45 days automatic valve in each water flow path and !

in both steam supply flow paths to the ;

turbine driven pump, that is not locked, '

sealed, or otherwise secured in position, is in the correct position. .

[

l SR 3.7.5.2 -------------------NOTE--------------------

Not required to be performed for the turbine driven EFW pump, until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after reaching 200 psig in the steam generators.

Verify the developed head of each EFW pump 45 days on a at the flow test point is greater than or STAGGERED TEST equal to the required developed head. BASIS j O !

SR 3.7.5.3 -------------------NOTE--------------------- ,

Not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after reaching 200 psig in the steam l generators.

____.__________________________..._________ i Verify each EFW automatic valve that is not 24 months l locked, sealed, or otherwise secured in 1 position, actuates to the correct position l on an actual or simulated actuation signal.

(continued) l O

O 1' Crystal River Unit 3 3.7-11 Final Draft 10/01/93

EFW System 3.7.5 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.7.5.4 -------------------NOTE--------------------

Not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after reaching 200 psig in the steam generators.

Verify each EFW pump starts automatically 24 months on an actual or simulated actuation signal.

SR 3.7.5.5 Verify proper alignment of the EFW flow Prior to paths by verifying flow from the EFW tank entering MODE 2 to each steam generator. whenever plant has been in MODE 5 or 6-for

> 30 days O

O Crystal River Unit 3 3.7-12 Final Draft 10/01/93

EFW Tank 3.7.6 3.7 PLANT SYSTEMS 3.7.6 Emergency Feedwater (EFW) Tank LCO 3.7.6 EFW tank water volume shall be ;t 150,000 gal.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. EFW tank water volume A.1 Verify by 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months not within limit, administrative means OPERABILITY of backup AND water supply.

Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter AND A.2 Restore EFW tank 7 days water volume to within limit.

B. Required Action and 8.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months l

O Crystal River Unit 3 3.7-13 Final Draft 10/01/93

r EFW Tank 3.7.6 l}

'A SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.6.1 Verify EFW tank water volume is 7 days 2 150,000 gal .

Crystal River Unit 3 3.7-14 Final Draft 10/01/93

SW System 3.7.7 3.7 PLANT SYSTEMS 3.7.7 Nuclear Services Closed Cycle Cooling Water (SW) System LCO 3.7.7 The SW System shall be OPERABLE with:

a. Two OPERABLE emergency SW pumps; and

b. Three OPERABLE SW heat exchangers.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One emergency SW pump A.1 Restore SW System to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

QB One required SW heat exchanger inoperable.

B. Required Action and 8.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months O

Crystal River Unit 3 3.7-15 Final Draft 10/01/93 l

SW System 3.7.7

[3

%J SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.7.1 -------------------NOTE--------------------

Isolation of SW flow to individual components does not render the SW System inoperable.

Verify each SW manual, power operated, and 31 days automatic valve in the flow path servicing essential equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

SR 3.7.7.2 -------------------NOTE--------------------

Not applicable in MODE 4.

Verify each SW automatic valve in the flow 24 months path that is not locked, sealed, or

/N otherwise secured in position, actuates to

(,,) the correct position on an actual or simulated actuation signal.

SR 3.7.7.3 -------------------NOTE--------------------

Not applicable in MODE 4.

Verify each SW pump starts automatically on 24 months an actual or simulated actuation signal.

l O

Crystal River Unit 3 3.7-16 Final Draft 10/01/93

DC System 3.7.8 3.7 PLANT SYSTEMS 3.7.8 Decay Heat Closed Cycle Cooling Water (DC) System LCO 3.7.8 Two DC trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS .

CONDITION REQUIRED ACTION COMPLETION TIME A. One DC train A.1 --------NOTE--------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.5, "RCS Loops-MODE 4,"

for required decay heat removal loops made inoperable by O DC train inoperability.

Restore DC train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months O

Crystal River Unit 3 3.7-17 Final Draft 10/01/93

DC System 3.7.8 O-/ SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.8.1 -------------------NOTE--------------------

Isolation of DC flow to individual components does not render the DC System inoperable.

Verify each DC manual and power operated 31 days valve in the flow path servicing safety related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

SR 3.7.8.2 -------------------NOTE--------------------

Not applicable in MODE 4.

Verify each DC pump starts automatically on 24 months

() an actual or simulated actuation signal.

l l

( l Crystal River Unit 3 3.7-18 Final Draft 10/01/93

Nuclear Services Seawater System 3.7.9 3.7 PLANT SYSTEMS 3.7.9 Nuclear Services Seawater System l

LCO 3.7.9 Two Nuclear Services Seawater System trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Nuclear Services A.1 Restore Nuclear 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Seawater System train Services Seawater inoperable. System train to OPERABLE status.

B. Required Action and 8.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months O' associated Completion Time not met. N LN.Q B.2 Be in MODE S. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months

~%

O V

Crystal River Unit 3 3.7-19 Final Draft 10/01/93

i Nuclear Services Seawater System.

3.7.9 .

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.9.1 -------------------NOTE--------------------

Isolation of Nuclear Services Seawater System flow to individual components does not render the Nuclear Services Seawater System inoperable.

Verify each Nuclear Services Seawater 31 days System manual valve in the flow path servicing safety related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

SR 3.7.9.2 -------------------NOTE--------------------

Not applicable in MODE 4.

Verify each Emergency Nuclear Services 24 months O Seawater System pump starts automatically on an actual or simulated actuation signal.

O Crystal River Unit 3 3.7-20 Final Draft 10/01/93

Decay Heat Seawater System 3.7.10

, 3.7 PLANT SYSTEMS :

3.7.10 Decay Heat Seawater System ,

LC0 3.7.10 Two Decay Heat Seawater System trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4. l ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One Decay Heat A.1 --------NOTE---------

Seawater System train Enter applicable inoperabic. Conditions and Required Actions of

!.C0 3.4.5, "RCS Loops-MODE 4," for required decay heat ,

removal loops made inoperable by Decay O Heat Seawater System train inoperability. ;

I Restore Decay Heat. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

> Seawater System train -

to OPERABLE status. ,

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion ,

Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months ;

.}

i O

Crystal River Unit 3 3.7-21 Final Draft 10/01/93

Decay Heat Seawater System 3.7.10 t

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.10.1 Verify each Decay Heat Seawater System 31 days i manual valve in the flow path servicing safety related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

SR 3.7.10.2 -------------------NOTE--------------------

Not applicable in MODE 4.

Verify each Decay Heat Seawater System pump 24 months starts automatically en an actual or simulated actuation signal.

O :

Crystal River Unit 3 3.7-22 Final Draft 10/01/93

J UHS 3.7.11 3.7 PLANT SYSTEMS 3.7.11 Ultimate Heat Sink (VHS)

'LCO 3.7.11 The UHS shall be OPERABLE.

I APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. UHS inoperable. . A.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND A.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months O

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.11.1 Verify water level of VHS is 2 79 ft. plant 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months datum.

SR 3.7.11.2 Verify average water temperature of UHS is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s 95'F.

O Crystal River Unit 3 3.7-23 Final Draft 10/01/93 i

1 CREVS 3.7.12 1

3.7 PLANT SYSTEMS 3.7.12 Control Room Emergency Ventilation System (CREVS) ;

LCD 3.7.12 Two CREVS trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4, During movement of irradiated fuel assemblies.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One CREVS train A.1 Restore CREVS train 7 days-inoperable. to OPERABLE status.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A AND not met in MODE 1, 2, O. 3 or 4. B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months (continued)

O Crystal River Unit 3 3.7-24 Final Draft 10/01/93

l

. CREVS l 3.7.12 !

[ ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 --------NOTE---------

associated Completion Place in emergency Time of Condition A recirculation mode if not met during automatic transfer to movement of irradiated emergency

. fuel assemblies, recirculation mode is inoperable.

Place OPERABLE CREVS Immediately train in emergency recirculation mode.

QB C.2 Suspend movement of Immediately irradiated fuel assemblies.

D. Two CREVS trains D.1 Enter LC0 3.0.3. Immediately inoperable during MODE 1, 2, 3, or 4.

E. Two CREVS trains E.1 Suspend movement of Immediately inoperable during irradiated fuel movement of irradiated assemblies.

fuel assemblies.

O ,

Crystal River Unit 3 3.7-25 Final Draft 10/01/93

CREVS 3.7.12 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.12.1 Operate each CREVS train for 31 days 1 15 minutes.

SR 3.7.12.2 Perform required CREVS filter testing in In accordance accordance with the Ventilation Filter with the Testing Program. Ventilation Filter. Testing Program SR 3.7.12.3 Verify each CREVS train actuates to the 24 months emergency recirculation mode on an actual or simulated actuation signal.

O O ,

Crystal River Unit 3 3.7-26 Final Draft 10/01/93 1

-,+

Fuel Storage Pool Water Level 3.7.13

~_ 3.7 PLANT SYSTEMS

\~- 3.7.13 fuel Storage Pool Water Level ,

LCO 3.7.13 The fuel storage pool water level shall be 2156 ft Plant Datum.

APPLICABILITY: During movement of irradiated fuel assemblies in fuel storage pool.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Fuel storage pool A.1 --------NOTE---------

water level not within LCO 3.0.3 is not limit. applicable.

Suspend movement of Immediately irradiated fuel assemblies in fuel 0- storage pool.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.13.1 Verify the fuel storage pool water level is 7 days

> 156 ft Plant Datum.

O Crystal River Unit 3 3.7-27 Final Draft 10/01/93

l Spent Fuel Pool Boron Concentration -l 3.7.14 <

3.7 PLANT SYSTEMS 3.7.14 Spent Fuel Pool Boron Concentration LCO 3.7.14 The spent fuel pool boron concentration shall be ;t 1925 ppm.

APPLICABILITY: When fuel assemblies are stored in the spent fuel pool and a spent fuel pool verification has not been performed since the last movement of fuel assemblies in the spent fuel pool.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Spent fuel pool boron ------------NOTE-------------

concentration not LC0 3.0.3 is not applicable, within limit. -------------------------- --

A.1 Suspend movement of Immediately .

fuel assemblies in the spent fuel pool.

A.2.1 Initiate action to Immediately restore spent fuel pool baron concentration to within limit.

0,_8 A.2.2 Verify by Immediately administrative means a Storage Pool A and Storage Pool B, Region 2, spent fuel pool verification has been performed since the last movement of fuel assemblies in-the spent fuel pool.

O Crystal River Unit 3 3.7-28 Final Draft 10/01/93 i

Spent Fuel Pool Boron Concentration 3.7.14 O

v SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.14.1 Verify the spent fuel pool boron 7 days i concentration is 1 1925 ppm.

O O

Crystal River Unit 3 3.7-29 Final Draft 10/01/93

Spent Fuel Assembly Storage 3.7.15 3.7 PLANT SYSTEMS 3.7.15 Spent Fuel Assembly Storage LCO 3.7.15 The combination of initial enrichment and burnup of each spent fuel assembly stored in Storage Pool A and St;orage Pool B, Region 2, shall be within the acceptable region of Figure 3.7.15-1, Figure 3.7.15-2, or stored in accordance with the FSAR.

APPLICABILITY: Whenever any fuel assembly is stored in Storage Pool A or >

Storage Pool B, Region 2 of the spent fuel pool.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Requirements of the A.1 --------NOTE---------

LCO not met. LC0 3.0.3 is not applicable.

Initiate action to Immediately move the noncomplying.

fuel assembly from Storage Pool A, or Storage Pool B, Region 2. ,

I O

Crystal River Unit 3 3.7-30 Final Draft 10/01/93

i Spent Fuel Assembly Storage 3.7.15 .

i

() SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.15.1 Verify by administrative means the initial Prior to c enrichment and burnup of the fuel assembly storing the '

is in accordance with Figure 3.7.15-1, fuel assembly Figure 3.7.15-2, or in accordance with the in Storage Pool FSAR. A, or Storage Pool B, Region 2 O l l

l i

i l

1

. l O

Crystal River Unit 3 3.7-31 Final Draft 10/01/93

Spent Fuel Assembly Storage

~3.7.15 O MINIMUM EUANUP AEQUIRED FCR 'A POOL STORAGE ,

Minimum Burnup vs initial Enr i chment B

7 6

9 B'

B g5 v ACCEPTABLE FOR STORAGE s WHEN ABOVE AND TO THE 5 LEFT OF CURVE o 4 O :

'S

/

u_ '

>- 3 tu 2

1 g - , , , , ,

O 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 5.5 iNi T I AL FUEL ENAICHMENT CW / % U-235) l l

l Figure 3.7.15-1 (page 1 of 2)

Burnup versus Enrichment Curve for Spent Fuel Storage Pool A Crystal River Unit 3 3.7-32 Final Draft 10/01/93

Spent Fuel Assembly Storage 3.7.15 O

MINIMUM BURNUP REQUIRED FOR REGION 2 OF "B" POOL ,

Minimum Burnup vs Initial Enrichment 35 30

/

ACCEPTABLE FOR

/

g . REGION 2 STORAGE j .

25

? 7 ,

/

P3 20 e i /

o a3 15

~

e

/

b u 10 r 5 / -

l o '

s b ,S 4 g

4 g ."

g 9 g .S S

g4 3 ." 3 9 34 *

,4 ,.

INITIAL FUEL ENA1CHENT (W / % U-235')

1 i

Figure 3.7.15-2 (page 2 of 2) ,

Burnup versus Enrichment Curve for Spent Fuel Storage Pool B, Region 2 Crystal River Unit 3 3.7-33 Final Draft 10/01/93

Secondary Specific. Activity 3.7.16 fs 3.7 PLANT SYSTEMS 3.7.16 Secondary Specific Activity LC0 3.7.16 The specific activity of the secondary coolan't shall be s 4.5E-4 Ci/gm DOSE EQUIVALENT I-131.

APPLICASILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Specific activity not A.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months within limit.

AND A.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months O

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.16.1 Verify the specific activity of the 31 days secondary coolant is s 4.5E-4 pCi/gm DOSE EQUIVALENT I-131.

O Crystal River Unit 3 3.7-34 Final Draft 10/01/93 l

Steam Generator Level 3.7.17 3.7 PLANT SYSTEMS 3.7.17 Steam Generator Level LC0 3.7.17 Water level in each steam generator shall be less than or equal to the maximum allowable water level shown in Figure 3.7.17-1.

APPLICABILITY: MODES 1 and 2.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Water level in one or A.1 Restore steam 15 minutes more steam generators ger.erator level to ,

greater than maximum within limit.

allowable water level '

in Figure 3.7.17-1.

O B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met.

SURVEILLANCE REQUIRCMENTS SURVEILLANCE FREQUENCY SR 3.7.17.1 Verify steam generator water level is less 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months than or equal to the maximum allowable water level in Figure 3.7.17-1.

O Crystal River Unit 3 3.7-35 Final Draft 10/01/93

Steam Generator Level 3.7.17 0

100--

(43,96) 90--

7

] UNACCEPTABLE g OPERATION -

0 SE Q 80- -

5 E

3: ACCEPTABLE 3

a 70- -

OPERATION O :

a 2

E

s 60- -

(0,53) 50 ; ; ,

; l 10 20 30 40 50 60 STEAM SUPERHEAT ('F)

Figure 3.7.17-1 (page 1 of 1)

Maximum Allowable Steam Generator Level Crystal River Unit 3 3.7-36 Final Draft 10/01/93

AC Sources-Operating 3.8.1 3.8 ELECTRICAL POWER SYSTEMS 3.8.1 AC Sources-Operating LCO 3.8.1 The following AC electrical power sources shall be OPERABLE:

a. Two qualified circuits betWEen the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System; and

b. Two emergency diesel generators (EDGs) each capable of supplying one train of the onsite Class IE AC Electrical Power Distribution System.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required offsite A.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months circuit inoperable. for OPERABLE required offsite circuit. AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND A.2 Declare required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from feature (s), with no discovery of no offsite power offsite power available, inoperable to one train when its redundant concurrent with required feature (s) inoperability are inoperable. of redundant required feature (s)

AND (continued)

)

l O

Crystal River Unit 3 3.8-1 Final Draft 10/01/93 l

1

-. - - - - - _ _ _ _ - - _ _ _ - - - _ - - - - - - - - - - - - - . - - - - - - - b

AC Sources-Operating -

3.8.1

() ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.3 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months offsite circuit to OPERABLE status. ANQ ,

6 days from discovery of failure to meet LCO B. One EDG inoperable. B.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for OPERABLE offsite circuit (s). AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from s_, feature (s), supported discovery of ,

by the inoperable Condition B EDG, inoperable when concurrent with its redundant inoperability required feature (s) of redundant ,

are inoperable. required s feature (s)

AND B.3.1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months EDG is not inoperable due to common cause failure.

QB B.3.2 Perform SR 3.8.1.2 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for OPERABLE EDG.

ARQ (continued)

O Crystal River Unit 3 3.8-2 Final Draft 10/01/93

AC Sources--Operating 3.8.1

'( ) ACTIONS COMPLETION TIME CONDITION REQUIRED ACTION B. (continued) B.4 Restore EDG to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months -

OPERABLE status.

b_N_Q 6 days from discovery of failure to meet

. LCO C. Two required offsite C.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable. feature (s) inoperable discovery of when its redundant Condition C required feature (s) concurrent with are inoperable. inoperability of redundant required feature (s)

() C.2 Restore one required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months offsite circuit to OPERABLE status.

(continued) i d

O '

Crystal River Unit 3 3.8-3 Final Draft 10/01/93 l

l l

AC Sources-Operating 3.8.1

() ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. One required offsite ------------NOTE-------------

circuit inoperable. Enter applicable Conditions and Required Actions of AND LC0 3.8.9, " Distribution Systems--Operating," when One EDG inoperable. Condition D is entered with no AC power source to one train.

D,1 Restore required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months offsite circuit to OPERABLE status. ,

OR D.2 Restore EDG to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OPERABLE status.

Os E. Two EDGs inoperable. E.1 Restore one EDG to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OPERABLE status.

F. Required Action and F.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A, AND B, C, D, or E not met.

F.2 Be in MODE 5. 35 hours4.050926e-4 days 0.00972 hours 5.787037e-5 weeks 1.33175e-5 months G. Three or more required G.1 Enter LCO 3.0.3. Immediately AC sources inoperable.

( ;

Crystal River Unit 3 3.8-4 Final Draft 10/01/93 i

l i

l l

1 1

AC Sources-0perating-3.8.1 1 I SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY 1

l SR 3.8.1.1 Verify correct breaker alignment and 7 days )

indicated power availability for each required offsite circuit.

SR 3.8.1.2 -------------------NOTES-------------------

1. Performance of SR 3.8.1.6 satisfies this SR.

2. All EDG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading.

3. A modified EDG start involving idling and gradual acceleration to synchronous speed may be used for this SR as recommended by the manufacturer. When modified start procedures are not used, the time, voltage, and frequency tolerances of O- SR 3.8.1.6 must be met. ,

Verify each EDG starts from standby 31 days conditions and achieves steady state voltage 2 3933 V and s 4400 V, and frequency 2 58.8 Hz and s 61.2 Hz.

(continued)

P O

Crystal River Unit 3 3.8-5 Final Draft 10/01/93

AC Sources-Operating :

3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY l

l SR 3.8.1.3 _------------------NOTES----- -------------

l. EDG loadinas may include gradual loading as recunended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.

3. This Surveillance shall be conducted on only one EDG at a time.

4. This SR shall be preceded by and immediately follow, without shutdown, ;

a successful performance of SR 3.8.1.2 or SR 3.8.1.6.

Verify each EDG operates for 2 60 minutes 31 days at a load 2 2600 kW and s 2850 kW.

O SR 3.8.1.4 Verify each day tank contains 2 245 gal of 31 days fuel oil. <

SR 3.8.1.5 Verify the fuel oil transfer system 31 days operates to automatically transfer fuel oil from the storage tank to the day tank.

(continued)

O -

Crystal River Unit 3 3.8-6 Final Draft 10/01/93

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY' SR 3.8.1.6 -------------------NOTE------------ -------

All EDG starts may be preceded by an engine prelube period. g Verify each EDG starts from standby 184 days condition and achieves, in s 10 seconds, voltage 2 3933 V and s 4400 V, and ,

frequency 2 58.8 Hz and s 61.2 Hz.

i SR 3.8.1.7 Verify manual transfer of AC power sources 24 months from the normal offsite circuit to the ,

alternate offsite circuit.

(continued)

O I

i i

O i Crystal River Unit 3 3.8-7 Final Draft 10/01/93 )

I

AC Sources--Operating 3.8.1 1

() SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.8 -------------------NOTES-----------------

1. This Surveillance shall not be performed in MODE 1 or 2. However, credit may be taken for unplanned events that satisfy this SR.

2. Power factor limit only applicable when Surveillance is performed with EDG paralleled with offsite power.

Verify each EDG operating at a power factor 24 months s 0.9 rejects a load greater than or equal to the single largest post-accident load, and:

a. Following load rejection, the frequency is s 66.75 Hz;

b. Within 3 seconds following load rejection, the voltage is 2 3744 V and O s 4576 V; and

c. Within 4 seconds following load rejection, the frequency is 2 58.8 Hz and s 61.2 Hz. ,

.4 SR 3.8.1.9 Verify interval between each sequenced load 24 months block is within i 10% of design interval for each emergency load sequencing relay.

(continued)

()

Crystal River Unit 3 3.8-8 Final Draft 10/01/93 l

'l l

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.10 -------------------NOTES-------------------

1. All EDG starts may be preceded by an engine prelube period.

2. This Surveillance shall not be performed in MODES 1, 2 or 3. However, credit may be taken for unplanned events that satisfy this SR.

3. Only required to be performed prior to entry into MODE 3.

Verify on'an actual or simulated loss of 24 months offsite power signal in conjunction with an actual or simulated ES actuation signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses;

c. EDG auto-starts from standby condition and:

1. energizes permanently connected loads in s 10 seconds,

2. energizes auto-connected emergency loads through load sequencing relays,

3. achieves steady-state voltage 2 3933 V and s 4400 V, -

4. achieves steady-state frequency 2 58.8 Hz and s 61.2 Hz, and

5. supplies permanently connected and auto-connected emergency loads for 2 5 minutes.

(continued)

O Crystal River Unit 3 3.8-9 Final Draft- 10/01/93

i l

AC Sources--Operating i 3.8.1

() SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FRE*'JENCY ;

SR 3.8.1.11 -----------------NOTES---------------

1. Momentary transients outside the load range do not invalidate this test.

2. This Surveillance shall not be performed in MODE 1 or 2.

However, credit may be taken for unplanned events that satisfy this SR.

Verify each EDG operates for 160 24 months minutes at a load 2 3100 kW and 1 3250 kW.

t O :

O Crystal Ris:.r Unit 3 3.8-10 Final Draft 10/01/93

AC Sources-Shutdown 3.8.2 l

O 3.8 ELECTRICAL POWER SYSTEMS V

3.8.2 AC Sources-Shutdown LCO 3.8.2 The following AC electrical power sources shall be OPERABLE:

a. One qualified circuit between the offsite transmission network and the onsite Class IE AC electrical power distribution subsystem (s) required by LCO 3.8.10, .

" Distribution Systems-Shutdown"; and

b. One emergency diesel generator (EDG) capable of supplying one train of the onsite Class IE AC electrical power distribution subsystem (s) required by LCO 3.8.10.

APPLICABILITY: MODES 5 and 6.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Required offsite ------------NOTE-------------

circuit inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.10, with one required train de-energized as a result of Condition A.

A.1 Declare affected Immediately required feature (s) with no offsite power available inoperable.

0_B A.2.1 Suspend CORE Immediately ALTERATIONS.

AND (continued)

O Crystal River Unit 3 3.8-11 Final Draft 10/01/93 i

AC Sources-Shutdown 3.8.2 ACTIONS l CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2.2 Initiate action to Immediately suspend operations involving positive reactivity additions. -

AND A.2.3 Initiate action to Immediately restore required offsite power circuit to OPERABLE status.

B. Required EDG B.1 Suspend CORE Immediately inoperable. ALTERATIONS.

ANQ B.2 Initiate action to Immediately

^

suspend operations

\ < involving positive reactivity additions.

AND B.3 Initiate action to Immediately restore required EDG to OPERABLE status. >

O Crystal River Unit 3 3.8-12 Final Draft 10/01/93

i

^l AC Sources--Shutdown 3.8.2 l

] ) SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.2.1 -------------------NOTE--------------------

The following SRs are not required to be performed: SR 3.8.1.3, SR 3.8.1.8, and SR 3.8.1.11.

For AC sources required to be OPERABLE, the In accordance SRs of Specification 3.8.1, "AC with applicable Sources--Operating," except SR 3.8.1.7, SRs SR 3.8.1.9, and SR 3.8.1.10, are applicable, i

O i

1 I

I i

i i

O Crystal River Unit 3 3.8-13 Final Draft 10/01/93

Diesel Fuel Oil, Lube Oil, and Starting Air- ;

3.8.3. ,

3.8 ELECTRICAL POWER SYSTEMS

(}

3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air LC0 3.8.3 The stored diesel fuel oil, lube oil, and starting air ,

subsystem shall be within limits for each required emergency diesel generator (EDG). ,

t APPLICABILITY: When associated EDG is required to be OPERABLE.

ACTIONS

..... ........... _...__......______.N0TES------------------------------------

1. Separate Condition entry is allowed for each EDG.

2. LCO 3.0.4 is not applicable.

a CONDITION REQUIRED ACTION COMPLETION TIME !

i A. One or more EDGs with A.1 Restore fuei oil 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months O stored fuel oil level

< 18,589 gal and level to within limits.

> 15,933 gal in storage tank.

AND Combined stored fuel !

oil level < 37,177 gal. ;

B. One or more EDGs with B.1 Restore lube oil 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months stored lube oil inventory to within inventory < 233 gal limits.

and > 200 gal.

1 (continued) 1 Crystal River Unit 3 3.8-14 Final Draft 10/01/93 l

l i

J

Diesel Fuel Oil, Lube Oil, and Startin' g Air 3.8.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One or more EDGs with C.1 Restore fuel oil 7 days stored fuel oil total total particulates to particulates not within limits, within limit.

D. One or more EDGs with D.1 Restore stored fuel 30 days new fuel oil oil properties to properties not within within limits, limits.

E. One or more EDGs with E.1 Restore starting air 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months starting air receiver receiver pressure to pressure < 225 psig within limits.

and 2 160 psig.

O F. Required Action and F.1 Declare associated EDG inoperable.

Immediately associated Completion Time not met.

QB One or more EDGs with diesel fuel oil, lube oil, or starting air subsystem not within limits for reasons other than Condition A, B, C, D, or E.

O Crystal River Unit 3 3.8-15 Final Draft 10/01/93

+__

8- *E a +2 Diesel Fuel Oil, Lube Oil, and Starting Air .

3.8.3 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY-SR 3.8.3.1 Verify each fuel oil storage tank contains 31 days 2 18,589 gal of fuel and combined fuel oil storage level 1 37,177 gal. _

SR 3.8.3.2 Verify each EDG lube oil inventory is 31 days 2 233 gal.

SR 3.8.3.3 Verify fuel oil properties of new and In accordance stored fuel oil are tested in accordance with the Diesel with, and maintained within the limits of, Fuel Oil the Diesel Fuel Oil Testing Program. Testing Program SR 3.8.3.4 Verify each EDG air start receiver pressure 31 days is 2 225 psig.

1 O

Crystal River Unit 3 3.8-16 Final Draft 10/01/93

DC Sources-Operating -

3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources-0perating ,

LC0 3.8.4 The Train A and Train B DC electrical power subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME :

A. One DC electrical A.1 Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months power subsystem power subsystem to inoperable. OPERABLE status. ,

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion O Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE PEQUIREMENTS :

SURVEILLANCE FREQUENCY SR 3.8.4.1 Verify battery terminal voltage is 7 days 2 125/250 V on float charge.

(continued) .

O Crystal River Unit 3 3.8-17 Final Draft 10/01/93

DC Sources-Operating 3.8.4

SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.4.2 Verify no visible corrosion at battery 92 days terminals and connectors.

0_3 Verify battery connection resistance is maintained such that the voltage drop at the, maximum expected service discharge ,

current is s 25 mV for inter-cell connections, s 80 mV for inter-rack connections, s 80 mV for inter-tier connections, and s 25 mV for terminal connections.

SR 3.8.4.3 Verify battery cells, cell plates, and 18 months racks show no visual indication of physical damage or abnormal deterioration.

O

~

SR 3.8.4.4 Verify battery cell to cell and terminal 18 months connections are coated with anti-corrosion material.

SR 3.8.4.5 Verify battery connection resistance is 18 months maintained such that the voltage drop at the maximum expected service discharge current is s 25 mV for inter-cell connections, s 80 mV for inter-rack connections, s 80 mV for inter-tier connections, and s 25 mV for terminal connections.

SR 3.8.4.6 Verify each battery charger supplies 18 months 2 200 amps at 2125 V for 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months .

(continued)

O Crystal River Unit 3 3.8-18 Final Draft 10/01/93

DC Sources-Operating 3.8.4 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.4.7 -------------------NOTES-------------------

1. SR 3.8.4.8 may be performed in lieu of SR 3.8.4.7 once per 60 months.

2. This Surveillance shall not be performed in MODE 1, 2, 3, or 4.

However, credit may be taken for-unplanned events that satisfy this SR.

Verify battery capacity is adequate to 24 months supply, and maintain in OPERABLE status, the required emergency loads for the design duty cycle when subjected to a battery service test.

(continued)

O O

Crystal River Unit 3 3.8-19 Final Draft 10/01/93

DC Sources--Operating 3.8.4 c

(.) SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY l

SR 3.8.4.8 -------------------NOTE--------------------

This Surveillance shall not be performed in MODE 1, 2, 3, or 4. However, credit may be taken for unplanned events that satisfy this SR.

Verify battery capacity is 2 80% of the 60 months manufacturer's rating when subjected to a performance discharge test. AND 12 months when battery shows degradation or-has reached 85%

of the expected life with capacity < 100%

of manufacturer's rating sa 24 months when battery has reached 85% of the expected life with capacity 2 100%

of manufacturer's rating l

l l

Crystal River Unit 3 3.8-20 Final Draft 10/01/93 l

DC Sources--Shutdown 3.8.5 3.8 ELECTRICAL POWER SYSTEMS 3.8.5 DC Sources--Shutdown LC0 3.8.5 DC electrical power subsystem (s) shall be OPERABLE to support the DC electrical power distribution subsystem (s) required by LC0 3.8.10, " Distribution Systems--Shutdown."

APPLICABILITY: MODES 5 and 6.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Declare affected Immediately DC electrical power required feature (s) subsystems inoperable. inoperable.

03 A.2.1 Suspeno CORE Immediately O ALTERATIONS.

AND A.2.2 Initiate action to Immediately suspend operations involving positive reactivity ~ additions.

AND A.2.3 Initiate action to Immediately restore required DC .

electrical power subsystems to OPERABLE status.

O Crystal River Unit 3 3.8-21 Final Draft 10/01/93

DC Sources-Shutdown 3.8.5 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.5.1 -------------------NOTE--------------------

The following SRs are not required to be .

performed: SR 3.8.4.6, SR 3.8.4.7, and !

SR 3.8.4.8.

For DC subsystems required to be OPERABLE, In accordance the following SRs are applicable: with applicable-SRs '

$R 3.8.4.1 SR 3.8.4.4 SR 3.8.4.7 SR 3.8.4.2 SR 3.8.4.5 SR 3.8.4.8.

SR 3.8.4.3 SR 3.8.4.6 l

i

+

1 O

Crystal River Unit 3 3.8-22 Final Draft 10/01/93 I

Battery Cell Parameters 3.8.6 3.8 ELECTRICAL POWER SYSTEMS 3.8.6 Battery Cell Parameters LCO 3.8.6 Battery cell parameters for the Train A and Train B batteries shall be within the limits of Table 3.8.6-1.

APPLICABILITY: When associated DC electrical power subsystems are required to be OPERABLE.

ACTIONS

___________..___________.______.-----NOTES------------------------------------

1. Separate Condition entry is allowed for each battery.

2. LC0 3.0.4 is not applicable.

_________________________ __________...__.__ ._____.________...__________..... 7 CONDITION REQUIRED ACTION COMPLETION TIME A. One or more batteries A.1 Verify pilot cell (s) I hour N with one or more electrolyte level and required battery cell float voltage meet parameters not within Table 3.8.6-1 limits. Category C values. i AND A.2 Verify required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months battery cell parameters meet Table 3.8.6-1 Category C values. ,

b.N_.D A.3 Restore required 31 days ;

battery cell parameters to t Category A and B limits of Table 3.8.6-1.

-(continued) l O l Crystal River Unit 3 3.8-23 Final Draft 10/01/93 i j

l

Battery Cell Parameters 3.8.6

() ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action and B.1 Declare associated Immediately associated Completion battery inoperable.

Time of Condition A not met.

QB One or more batteries with average electrolyte temperature of the representative cells

< 70*F. ,

08 One or more batteries with one or more required battery cell parameters not within Category C values.

O SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.6.1 Verify required battery cell parameters 7 days meet Table 3.8.6-1 Category A limits.

(continued)

-l i

l O

Crystal River Unit 3 3.8-24 Final Draft -10/01/93

Battery Cell Parameters 3.8.6 i SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.6.2 Verify required battery cell parameters 92 days meet Table 3.8.6-1 Category B limits.

eM1 Once within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a battery discharge

< 105 V PND Once within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a battery overcharge

> 150 V i

SR 3.8.6.3 Verify average electrolyte temperature of 92 days

\ representative cells is 2 70*F.

O Crystal River Unit 3 3.8-25 Final Draft 10/01/93

Battery Cell Parameters-3.8.6 O Table 3.8.6-1 (page 1 of 1)

Battery Cell Surveillance Requirements CATEGORY A: CATEGORY C:

LIMITS FOR EACH CATEGORY B: ALLOWABLE VALUC DESIGNATED PILOT LIMITS FOR EACH FOR EACH PARAMETER CELL CONNECTED CELL CONNECTED CELL Electrolyte Level > Minimum level > Minimum level Above top of indication mark, indication _ mark, plates, and not and s % inch and s \ inch overflowing above maximum above maximum level :ndication levei ;ndication mark',a? mark'.ar Float Voltage 2 2.13 V 2 2.13 V > 2.07 V Specifi 2 1.200 2 1.195 Not more than Gravitytb )(c) 0.020 below O BM Average of all average connected cells connected cells AND

> 1.205 Average of all connected cells 2 1.195 (a) It is acceptable for the electrolyte level to temporarily increase _ above the specified maximum during equalizing charges provided it is not overflowing.

(b) Corrected for electre'yte temperature and level. Level correction is not required, howeve , when battery charging is < 2 amps when on float charge.

(c) A battery charging current of < 2 amps when on float charge is acceptable for meeting specific gravity Surveillance Requirements. For Category C allowable values, this is acceptable only during a maximum of 7 days following a battery recharge. For Category A and B limits, this ,

is acceptable for a maximum of 31 days.

O Crystal River Unit 3 3.8-26 Final Draft 10/01/93

Inverters--Operating '

3.8.7

() 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters--Operating 1

~

LC0 3.8.7 Two Train A and two Train B inverters shall be OPERABLE.

NOTE----------------------------

Two inverters may be disconnected from their associated DC ,

bus for s 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform an equalizing charge on their associated common battery, provided:

a. The associated AC vital buses are energized: and

b. Both AC vital buses for the other train are energized from their associated OPERABLE inverters.

i APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETICN. TIME A. One or two inverters ------------NOTE------------- >

on one train Enter applicable Conditions i inoperable. and Required Actions of LCO 3.8.9, " Distribution ,

Systems-0perating," when any AC vital bus is de-energized.

i A.1 Restore inverter (s) 7 days i to OPERABLE status.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months :

1

() ,

Crystal River Unit 3 3.8-27 Final Draft 10/01/93 P

t

i.. ,

Inverters-Operating 3.C.7 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.7.1 Verify correct inverter voltage, frequency, 7 days and alignment to required AC vital buses.

O i

?

O Crystal River Unit 3 3.8-28 Final Draft 10/01/93

,ei, -

.m .-,,s. . - - . .

y - ,,

t Inverters--Shutdown 3.8.8 3.8 ELECTRICAL POWER SYSTEMS

(}

3.8.8 Inverters--Shutdown LCO 3.8.8 Inverters shall be OPERABLE to support the onsite Class IE ,

AC vital bus electrical power distribution subsystem (s) required by LCO 3.8.10. " Distribution Systems--Shutdown."

APPLICABILITY: MODES 5 and 6.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Declare affected Immediately inverters inoperable. required feature (s) inoperable.

OR A.2.1 Suspend CORE Immediately O ALTERATIONS.

bND A.2.2 Initiate action to Immediately suspend operations involving positive reactivity additions.

AND A.2.3 Initiate action to Immediately restore required inverters to OPERABLE status.

(

Crystal River Unit 3 3.8-29 Final Draft 10/01/93 1

Inverters-Shutdown 3.8.8 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY 3R 3.8.8.1 Verify correct inverter voltage, frequency, 7 days and alignments to required AC vital buses.

k i

O 1

i O -i Crystal River Unit 3 3.8-30 Final Draft 10/01/93 i i

Distribution Systems-0perating ,

3.8.9 '

3.8 ELECTRICAL POWER SYSTEMS 3.8.9 Distribution Systems-Operating LCO 3.8.9 Train A and Train B AC, DC, and AC vital bus electrical power distribution subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One AC electrical A.1 Restore AC electrical 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months power distribution power distribution subsystem inoperable. subsystem to OPERABLE AND status.

16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months from discovery of failure to meet LCO B. One AC vital bus B.1 Restore AC vital bus 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months subsystem inoperable. subsystem to OPERABLE status. AND 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months from -

discovery of failure to meet LC0 C. One DC electrical C.1 Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months power distribution power distribution ;

subsystem inoperable. subsystem to OPERABLE b]@ .'

status.

16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months from discovery of-failure to meet LCO l

(continued)

Crystal River Unit 3 3.8-31 Final Draft 10/01/93

-l i

1 Distribution Systems-Operating -

3.8.9 '

ACTIONS (continued) l CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and 0.1 Be in MODE 3. -6 hours associated Completion .

Time not met. 6,N3 N

D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months i

E. Two trains with E.1 Enter LCO 3.0.3 Immediately inoperable distribution subsystems that result in a loss of fuction. -!

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments and 7 days voltage to required AC, DC, and AC vital bus electrical power distribution subsystems.

O Crystal River Unit 3 3.8-32 Final Draft 10/01/93

a Distribution Systems--Shutdown 3.8.10- '

() 3.8 ELECTRICAL POWER SYSTEMS 3.8.10 Distribution Systems--Shutdown LC0 3.8.10 The necessary portion of AC, DC, and AC vital bus electrical power distribution subsystems shall be OPERABLE to support equipment required to be OPERABLE. ,

APPLICABILITY: MODES 5 and 6.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Declare affected Immediately AC, DC, or AC vital required feature (s) bus electrical power inoperable.

distribution subsystems inoperable. QB A.2.1 Suspend CORE Immediately O ALTERATIONS.

AND A.2.2 initiate action to Immediately suspend operations involving positive reactivity additions.

AND ,

J (continued)

(

Crystal River Unit 3 3.8-33 Final Draft 10/01/93 g

Distribution Systems--Shutdown 3.8.10

\ ACTIONS

(~'/

\_

COMPLETION TIME CONDITION REQUIRED ACTION A. (continued) A.2.3 Initiate actions to Immediately restore required AC, DC, and AC vital bus electrical power distribution subsystems to OPERABLE status.

AND A.2.4 Declare associated Immediately required decay heat removal (DHR) loop -

inoperable and not in operation.

() SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.10.1 Verify correct breaker alignments and 7 days voltage to required AC, DC, and AC vital bus electrical power distribution subsystems.

i O

Crystal River Unit 3 3.8-34 Final Draft 10/01/93

Boron Concentration l 3.9.1 j O 3.9 REFUELING OPERATIONS U

3.9.1 Boron Concentration LC0 3.9.1 Boron concentrations of the Reactor Coolant System and the refueling canal shall be maintained within the limit specified in the COLR.

APPLICABILITY: MODE 6.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Boron concentration A.1 Suspend CORE Immediately not within limit. ALTERATIONS.

AND A.2 Suspend positive Immediately reactivity additions.

A.3 Initiate action to Immediately restore boron concentration to within limit.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY-SR 3.9.1.1 Verify boron concentration is within the 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months limit specified in the COLR.

O Crystal River Unit 3 3.9-1 Final Draft 10/01/93

l Nuclear Instrumentation' 3.9.2 3.9 REFUELING OPERATIONS 3.9.2 Nuclear Instrumentation LCO 3.9.2 Two source range neutron flux monitors shall be OPERABLE.

APPLICABILITY: MODE 6. ;

ACTIONS ,

CONDITION REQUIRED ACTION' COMPLETION TIME A. One required source A.1 Suspend CORE Immediately range neutron flux ALTERATIONS.

monitor inoperable. -

AND A.2 Suspend positive Immediately -

reactivity additions.

O B. Two required source B.1 Initiate action to Immediately range neutron flux restore one source monitors inoperable. range neutron flux monitor to OPERABLE status.

AND B.2 Perform SR 3.9.I.I. 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 8N_Q Once per 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .s thereafter .

O Crystal River Unit 3 3.9-2 Final Draft 10/01/93.

Nuclear Instrumentation .

3.9.2 .l.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.9.2.1 Perform CHANNEL CHECX. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.9.2.2 -------------------NOTE--------------------

Heutron detectors are excluded from CHANNEL

-t CALIBRATION.

Perform CHANNEL CALIBRATION. 18 months O ,

l I

O Crystal River Unit 3 3.9-3 Final Draft 10/01/93

Containment Penetrations 3.9.3 3.9 REFUELING OPERATIONS 3.9.3 Containment Penetrations LC0 3.9.3 The containment penetrations shall be in the following status:

a. The equipment hatch closed and held in place by four bolts;

b. One door in each air lock closed; and l

c. Each penetration providing direct access from the containment atmosphere to the outside atmosphere either:

1. closed by a manual or automatic. isolation valve, blind flange, or equivalent. These penetrations'may.

be open provided the total calculated flow rate out of the open penetration (s) is less than or equal to the equivalent flow rate through a 48 inch containment purge line penetration; or

2. capable of being closed by an OPERABLE containment purge or mini-purge valve.

lO APPLICABILITY: During CORE ALTERATIONS, During movement of irradiated fuel assemblies within containment.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more

A.1 Suspend CORE Immediately c.ontainment ALTERATIONS.

penetrations not in required status. AND ,

A.2 Suspend movement of Immediately irradiated fuel assemblies within containment.

O Crystal River Unit 3 3.9-4 Final Draft 10/01/93

'l 1

. Containment Penetrations 3.9.3 ,

l SURVE!LLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.9.3.1 Verify each required containment 7 days penetration is in the required status.

SR 3.9.3.2 Verify each required containment purge and 24 months :

mini-purge valve actuates to the isolation position on an actual or simulated actuation signal.

O O :

Crystal River Unit 3 3.9-5 Final Draft 10/01/93

DHR and Coolant Circulation-High Water Level 3.9.4 3.9 REFUELING OPERATIONS 3.9.4 Decay Heat Removal (DHR) and Coolant Circulation-High Water Level LC0 3.9.4 One DHR loop shall be in operation.

............................N0TE----------------------------

The required DHR loop may be removed from operation for s I hour per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period, provided no operations are permitted that would cause reduction of the Reactor Coolant System boron concentration.

APPLICABILITY: MODE 6 with the refueling canal water level 2156 ft Plant Datum.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME

/~N A. No DHR loop in A.1 Suspend operations Immediately V operation. involving a reduction in reactor coolant boron concentration.

MD A.2 Suspend loading Immediately irradiated fuel assemblies in the core.

MD A.3 Initiate action to Immediately restore DHR loop to operation.

MD (continued) -

I i

O Crystal River Unit 3 3.9-6 Final Draft 10/01/93

DHR and Coolant Circulation-High Water Level 3.9.4 l

l g ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.4 Close all containment 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months penetrations providing direct access from containment atmosphere to outside atmosphere.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.9.4.1 Verify required DHR loop is in operation 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and circulating reactor coolant at a flow rate of 2 2700 gpm.

O O

Crystal River Unit 3 3.9-7 Final Draft 10/01/93

DHR and Coolant Circulation-Low Water Level 3.9.5 3.9 REFUELING OPERATIONS 3.9.5 Decay Heat Removal (DHR) and Coolant Circulation-Low Water Level LC0 3.9.5 Two DHR loops shall be OPERABLE and at least one DHR loop shall be in operation.

APPLICABILITY: MODE 6 with the refueling canal water level < 156 ft Plant Datum.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME i

A. One DHR loop A.1 Initiate action to Immediately inoperable. restore DHR loop to OPERABLE status. .

DE A.2 Initiate action to Immediately O establish water level 2156 ft Plant Datum.

t

~

(continued)

O Crystal River Unit 3 3.9-8 Final Draft. 10/01/93 e.

DHR and Coolant Circulation--Low Water Level 3.9.5

() ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. No DHR loop OPERABLE B.1 Suspend operations Immediately or in operation. involving a reduction in reactor coolant boron concentration.

AND B.2 Initiate action to Immediately restore one DHR loop to OPERABLE status-and to operation.

AMD ,

B.3 Close all containment 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months penetrations providing direct access from containment atmosphere Lc cutside atmosphere.

O O

Crystal River Unit 3 3.9-9 Final Draft 10/01/93

DHR and Coolant Circulation--Low Water Level .

3.9.5

() SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.9.5.1 Verify required DHR loop is in operation. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SR 3.9.5.2 Verify correct breaker alignment and 7 days indicated power available to the required ,

DHR pump that is not in operation.

O O

Crystal River Unit 3 3.9-10 Final Draft 10/01/93

l l

Refueling Canal Water Level 1 3.9.6 l

() 3.9 REFUELING OPERATIONS 3.9.6 Refueling Canal Water Level I

LC0 3.9.6 Refueling canal water level shall be maintained 2156 ft Plant Datum.

APPLICABILITY: During CORE ALTERATIONS, During movement of irradiated fuel assemblies within

. containment.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Refueling canal water A.1 Suspend CORE Immediately level not within ALTERATIONS.

limit.

AND A.2 Suspend movement of Immediately Os irradiated fuel assemblies within containment.

AND A.3 Initiate action to Immediately restore refueling canal water level to within limit.

O Crystal River Unit 3 3.9-11 Final Draft 10/01/93

i Refueling Canal Water Level l 3.9.6 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.9.6.1 Verify refueling canal water level is 2156 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ft Plant Datum.

3 i

V O

I O :

Crystal River Unit 3 3.9-12 Final Draft 10/01/93

,e -

Design Features 4.0 4.0 DESIGN FEATURES 4.1 Site The 4,738 acre site is characterized by a 4,400 foot minimum exclusion radius centered on the Reactor Building; isolation from nearby population centers; sound foundation for structures; an abundant supply of cooling water; an ample supply of emergency power; and favorable conditions of hydrology, geology, seismology, and meteorology.

4.2 Reactor Core 4.2.1 Fuel Assemblies The reactor shall contain 177 fuel assemblies. Each fuel assembly i

shall consist of a matrix of Zircaloy-4 clad fuel rods with an I

initial composition of natural or slightly enriched uranium dioxide (U0 as fuel material, with a maximum enrichment of 4.2 weight perc,)nt e U-235. Limited substitutions of stainless steel filler rods for fuel rods, in accordance with approved applications of fuel rod configurations, may be used. Fuel assemblies shall be limited to those fuel designs that have been analyzed with applicable NRC staff approved codes and methods and shown by tests or analyses to comply with all fuel safety design O bases. Each fuel rod shall have a nominal active fuel length of 144 inches and shall contain a maximum total weight of 2253 grams uranium.

4.2.2 CONTROL RODS The reactor core shall contain 60 safety and regulating (including extended life CONTROL RODS) and 8 AXIAL POWER SHAPING (APSR) rods.

Except for the extended life CONTROL RODS, the CONTROL RODS shall

~

contain a nominal 134 inches of absorber material. The extended life CONTROL RODS shall contain a nominal 1 - inches of absorber material. The nominal values of absorber mi evial shall be 80 percent silver, 15 percent indium, and 5 percent cadmium. Except for extended life CONTROL RODS, all CONTROL RODS shall be clad with stainless steel tubing. The extended life CONTROL RODS shall be clad with Inconel. The APSRs shall contain a nominal 63 inches -

of absorber material at their lower ends. The absorber material for the APSRs shall be 100 % Inconel.

(continued)

Crystal River Unit 3 4.0-1 Final Draft 10/01/93

- -. _ = _ , -.

- - ~~- .

Design Features 4.0 4.0 DESIGN FEATURES (continued) 4.3 fuel Storage 4.3.1 Criticality 4.3.1.1 The spent fuel storage racks are designed and shall be maintained with:

a. Fuel assemblies having a maximum U-235 enrichment of 4.2 weight percent in Region 1 of the B pool, ,

b. k s 0.95 if fully flooded with unborated water, wf((ch includes an allowance for uncertainties as described in Section 9.6 of the FSAR;

c. A nominal 10.6 inch center to center distance between fuel assemblies placed in Region 1 of the B pool;

d. A nominal 9.17 inch center to center distance between fuel assemblies placed in Region 2 of the B pool; and

e. A nominal 10.5 inch center to center distance between fuel assemblies placed in the A pool.

4.3.1.2 The new fuel storage racks are designed and shall be maintained with:

a. Fuel assemblies having a maximum U-235 enrichment of 4.5 weight percent;

b. k s 0.95 is fully flooded with unborated water, wY[ch includes an allowance for uncertainties as described in Section 9.6 of the FSAR;

c. k s 0.98 if inoderated by aqueous foam, which iNcludesanallowanceforuncertaintiesas described in Section 9.6 of the FSAR; and

d. A nominal 21.125 inch center to center distance between fuel assemblies placed in the storage racks.

(continued)

Crystal River Unit 3 4.0-2 Final Draft 10/01/93

Design Features i 4.0 4.0 DESIGN FEATURES (continued)

(}

4.3.2 Drainaae The spent fuel storage pool is designed and shall be maintained to l prevent inadvertent draining of the pool below elevation 138 feet .

4 inches. )

4.3.3 [aoacity The spent fuel storage pool is designed and shall be maintained with a storage capacity limited to no more than 1357 fuel assemblies and six failed fuel containers.

i l

l

[

I i

i l

l 1

I 1

O Crystal River Unit 3 4.0-3 Final Draft 10/01/93 1

Responsibility '

5.1 1

() 5.0 ADMINISTRATIVE CONTROLS 5.1 Responsibility 5.1.1 The Director, Nuclear Plant Operations (DNP0) shall be responsible for overall unit operation and shall delegate in writing the .

succession to this responsibility during his absence.

The DNP0 or his designee shall approve, prior to implementation, each proposed test, experiment or modifications to systems or equipment that affect nuclear safety. ;

5.1.2 The Nuclear Shift Supervisor (NSS) shall be ' responsible for the control room command function. During any absence of the NSS from the control room while the unit is in MODE 1, 2, 3, or 4, an individual with an active Senior Reactor Operator (SRO) license shall be designated to assume the control rcom command function.

During any absence of the NSS from the control room while the unit is in MODE 5 or 6, an individual with an active SR0 license or Reactor Operator license shall be designated to assume the control room command function.

O 8

I l

Crystal River Unit 3 5.0-1 Final Draft 10/12/93 l l

Organization 5.2 ,

f 5.0 ADMINISTRATIVE CONTROLS [

5.2 Organization 5.2.1 Onsite and Offsite Oraanizations Onsite and offsite organizations shall be established for unit operation and corporate management, respectively. The onsite and offsite organizations shall include the positions responsible for ,

activities affecting safety of the nuclear power plant.

a. Lines of authority, responsibility, and communication shall ,

be defined and established for management levels, including intermediate levels, and all operating organization positions. These relationships shall be documented, and updated as appropriate, in organization charts, functional ,

descriptions of departmental responsibilities and ,

relationships, and job descriptions for key personnel positions, or in equivalent forms. These shall be .

documented in the FSAR;

b. The Senior Vice President, Nuclear Operations shall have corporate responsibility for overall plant nuclear safety and shall take any measures needed to ensure acceptable performance of the staff in operating, maintaining, and O providing technical support to the plant to ensure nuclear safety;

c. The Vice President, Nuclear Production shall be responsible for overall safe operation of the plant and shall have control over those onsite activities necessary for safe operation and maintenance of the plant; and

d. The individuals who train the operating staff, carry out health physics, or perform quality assurance functions shall have sufficient organizational freedom to ensure their independence from operating pressures.

5.2.2 Unit Staff The unit staff organization shall include the following:

a. Each on duty shift shall be composed of at least the minimum shift crew composition shown in Table 5.2.2-1.

(continued)

O Crystal River Unit 3 5.0-2 Final Draft 10/12/93

1 Organization 5.2 5.2 Organization 5.2.2 Unit Staff (continued) ,

b. At least one licensed Reactor Operator (RO) shall be present in the control room when fuel is in the reactor. In addition, while the unit is in MODE 1, 2, 3, or 4, at least one licensed Senior Reactor Operator (SRO) shall be present in the control room.

c. An individual qualified in Radiation Protection procedures shall be on site when fuel is in the reactor. The position may be vacant for not more than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , in order to provide for unexpected absence, provided immediate action is taken to fill the required position.

d. The amount of overtime worked by unit staff members performing safety related functions shall be limited and controlled in accordance with approved administrative procedures.

O O

Crystal River Unit 3 5.0-3 Final Draft 10/12/93 i

Organization 5.2 -

Table 5.2.2-1 (page 1 of 1) i Minimum Shift Crew Composition (a)

POSITION (b) MINIMUM CREW NUMBER UNIT IN MODE UNIT IN MODE ,

1, 2, 3, OR 4 5 OR 6 SS 1 1 SR0 1 None R0 2 1 2 1 NLO(c)

STA 1 None 1

(a) The shift crew composition may be one less than the minimum requirements of Table 5.2.2-1 for not more than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to accommodate unexpected -

absences of on-duty shift crew members provided immediate action is -

taKen to restore the shift crew composition to within the minimum i equirements of Table 5.2.2-1. This provision does not permit any shift crew position to be unmanned upon shift change due to an oncoming shift crewman being late or absent.

(b) Table Notation:

SS - Shift Supervisor with a Senior Reactor Operator license; SR0 - Individual with a Senior Reactor Operator license; '

R0- - Individual with a Reactor Operator license; NLO - Non-licensed Operator; STA - Shift Technical Advisor.

(c) The STA position may be filled by an on-shift SS or SR0 provided the individual meets the Commission Policy Statement on Engineering ,

Expertise on Shift. <

I l

O Crystal River Unit 3 5.0-4 Final Draft 10/12/93 I

l

Unit Staff Qualifications 5.3 5.0 ADMINISTRATIVE CONTROLS 5.3 Unit Staff Qualifications 5.3.1 Each member of the unit staff shall meet or exceed the minimum qualifications of ANSI N18.1,1971 for comparable positions, except for the Radiation Protection Manager, who shall meet or exceed the qualifications of Regulatory Guide 1.8, September 1975, '

and the Shift Technical Advisor who shall have a Bachelor's degree, or the equivalent, in a scientific or engineering.

, discipline with specific training in plant design and response and analysis of the plant transients and accidents.

i l

O .

Crystal River Unit 3 5.0-5 Final Draft 10/12/93 l

i Not Used 5.4 5.0 ADMINISTRATIVE CONTROLS 5.4 Not Used ,

4 5

i 1

O Crystal River Unit 3 5.0-6 Final Draft 10/12/93 1

Not Used 5.5 5.0 ADMINISTRATIVE CONTROLS 5.5 Not Used i

e h

t I

O l

s O

Crystal River Unit 3 5.0-7 Final Draft 10/12/93

Procedures, Programs, and Manuals -

5.6 5.0 ADMINISTRATIVE CONTROLS 5.6 Procedures, Programs, and Manuals 5.6.1 frocedures 5.6.1.1 Scope Written procedures shall in established, implemented, and maintained covering the following activities:

a. The applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978;

b. Quality assurance for effluent and environmental monitoring;

c. Fire Protection Program implementation; and

d. All programs specified in Specification 5.6.2.

5.6.2 Procrams and Manuals The following programs shall be established, implemented, and maintained. Programs and Manuals may be titled as Reports.

5.6.2.1 Not Used 5.6.2.2 Not Used 5.6.2.3 Offsite Dose Calculation Manual (0DCM):

This Manual contains offsite dose calculation methodologies, radioactive effluent controls, and radiological environmental monitoring activities. The ODCM shall contain:

1. The methodologies and parameters used in the calculation of offsite doses resulting from radioactive gaseous and liquid effluents;

2. The methodologies and parameters used in the calculation of gaseous and liquid effluent monitoring alarm and trip setpoints;

3. The controls for maintaining the doses to members of the public from radioactive effluents as low as reasonably achievable in accordance with 10 CFR 50.36a. These include:

(continued)~

O Crystal River Unit 3 5.0-8 Final Draft 10/12/93

Procedures, Programs- and Manuals 5.6 :

5.6 Procedures, Programs and Manuals 5.6.2.3 ODCH (continued)

a. Limitations on the functional capability of radioactive liquid and gaseous monitoring instrumentation including surveillance tests and setpoint determination;

b. Limitations on the concentrations of radioactive material released in liquid effluents to unrestricted areas, conforming to ten times the concentration values of 10 CFR 20.1001 - 20.2401, Appendix B, Table II, Column 2 (Radioactive noble gases released in liquids shall be limited to concentrations in water equivalent to 500 mrem /yr);

c. Monitoring, sampling, and analysis of radioactive liquid and gaseous effluents in accordance with 10 CFR 20.1302;

d. Limitations on the annual and quarterly doses or dose commitment to a member of the public from radioactive materials in liquid effluents released from each unit to unrestricted areas, conforming to 10 CFR 50, -

Appendix I;

e. Determination of cumulative and projected dose contributions from radioactive effluents for the current calendar quarter and current calendar year at least every 31 days;

f. Limitations on the functional capability and use of the liquid and gaseous effluent treatment systems to ensure that appropriate portions of these systems are used to reduce releases of radioactivity when the projected doses in a period of 31 days would exceed 2% of the guidelines for the annual dose or dose commitment,

- conforming to 10 CFR 50, Appendix I;

g. Limitations on the dose rate resulting from radioactive material released in gaseous effluents to areas beyond the site boundary conforming to 500 mrem /yr total body;

h. Limitations on the annual and quarterly air doses resulting from noble gases released in gaseous ,

effluents from each unit to areas beyond the site boundary, conforming to 10 CFR 50, Appendix I; (continued)

O Crystal River Unit 3 5.0-9 Final Draft 10/12/93

Procedures, Programs and Manuals 5.6 5.6 Procedures, Programs and Manuals 5.6.2.3 ODCM (continued) ,

Limitations on the annual and quarterly doses to. a i.

member of the public from iodine-131, iodine-133, tritium, and all radionuclides in particulate form with half lives > 8 days in gaseous effluents released from ,

each unit to areas beyond the site boundary, conforming to 10 CFR 50, Appendix I; and .

J. Limit.tions a on the annual dose or dose commitment to any member of the public beyond the site boundary due to releases of radioactivity and to radiation from uranium fuel cycle sources, conforming to 40 CFR 190.

4. The methodologies and parameters for monitoring, sampling, '

and analyzing radiation and radionuclides in the environs of the plant.

Licensee Initiated Changes to the ODCM:

1. Shall be documented and records of reviews performed shall be retained,

2. Shall become effective after review and acceptance by the on-site review function and the approval of the Director, Nuclear Plant Operations; and

3. Shall be submitted to the Commission as a part of or concurrent with the Radioactive Effluent Release Report for the period in which the change (s) was made effective.

5.6.2.4 Not Used 5.6.2.5 Not Used 5.6.2.6 Post Accident Sampling This program provides controls that ensure the capability to obtain and analyze reactor coolant, radioactive gases, and particulates in plant gaseous effluents and containment atmosphere samples under accident conditions. The program shall include the following:

a. Training of personnel; (continued)

Crystal River Unit 3 5.0-10 Final Draft 10/12/93 l

Procedures, Programs and Manuals 5.6 ,

I

5.6 Procedures, Programs and Manuals 1

5.6.2.6 Post Accident Sampling (continued)

b. Procedures for sampling and analysis; and

c. Provisions for maintenance of sampling and analysis equipment.

5.6.2.7 Containment Tendon Surveillance Program This program provides controls for monitoring any tendon degradation in concrete containments, including effectiveness of' <

its corrosion protection medium, to ensure containment structural integrity. The program shall include baseline measurements prior to initial operations. The Containment Tendon Surveillance Program, inspection frequencies, and acceptance criteria shall be in accordance with Regulatory Guide 1.35, Revision 3, 1989.

The provisions of SR 3.0.2 and SR 3.0.3 are applicable to the Containment Tendon Surveillance Program inspection frequencies.

5.6.2.8 Inservice Inspection Program This program provides controls for inservice inspection of ASME :

Code Class 1, 2, and 3 components, including applicable supports.

The program shall include the following:

a. Provisions that inservice inspection of ASME Code Class 1, 2, and 3 components shall be performed in accordance with Section XI of the ASME Boiler and Pressure Vessel Code and.

applicable Addenda as required by 10 CFR 50.55a;

b. The provisions of SR 3.0.2 are applicable to the frequencies for performing inservice inspection activities;

c. Inspection of each reactor coolant pump flywheel per the recommendation of Regulation Position c.4.b of Regulatory Guide 1.14, Revision 1, August 1975; and

d. Nothing in the ASME Boiler and Pressure Vessel Code shall be construed to supersede the requirements of any TS.

/

k (continued)

Crystal River Unit 3 5.0-11 Final Draft 10/12/93

Procedures, Programs and Manuals 5.6 5.6 Procedures, Programs and Manuals (continued) 5.6.2.9 Inservice Testing Program This program provides controls for inservice testing of ASME Code Class 1, 2, and 3 components, including applicable supports. The :

program shall include the following: >

a. Provisions that inservice testing of ASME Code Class 1, 2, and 3 pumps, valves, and snubbers--shall be performed in accordance with Section XI of the ASME Boiler and Pressure i

Vessel Code and applicable Addenda as required by 10 CFR 50.55a;

b. Testing frequencies specified in Section XI of the ASME Boiler and Pressure Vessel Code and applicable Addenda;

c. The provisions of SR 3.0.2 are applicable to the above required Frequencies for performing inservice testing activities;

d. The provisions of SR 3.0.3 are applicable to inservice testing activities; and

e. Nothing in the ASME Boiler and Pressure Vessel Code 'shall be construed to supersede the requirements of any TS.

5.6.2.10 Steam Generator (OTSG) Tube Surveillance Program Each OTSG shall be demonstrated OPERABLE by performance of the following augmented inservice inspection program.

1. Each OTSG shall be determined OPERABLE during shutdown by selecting and inspecting at least the minimum number of OTSGs specified in Table 5.6.2-1.

2. The OTSG tube minimum sample size. inspection result classification, and the corresponding action required shall be as specified in Table 5.6.2-2. The inservice inspection of 0TSG tubes shall be performed at the frequencies specified in Specification 5.6.2.10.3 and the inspected tubes shall be verified acceptable per the acceptance criteria of Specification 5.6.2.10.4. The tubes selected for each inservice inspection shall include at least 3% of the total number of tubes in all OTSGs. The tubes selected i

(continued) l O

Crystal River Unit 3 5.0-12 Final Draft 10/12/93

'l

Procedures, Programs and Manuals 5.6 5.6 Procedures, Programs and Manuals 5.6.2.10 OTSG Tube Surveillance Program (continued) for these inspections shall be selected on a random basis except:

a. Where experience in similar plants with similar water -

chemistry indicates critical areas to be inspected, then at least 50% of the tubes inspected shall be from these critical areas.

b. The first inservice inspection (subsequent to the preservice inspection) of each OTSG shall include:

1. All nonplugged tubes that previously had detectable wall penetrations (>20%), and '

2. Tubes in those areas where experience has indicated potential problems,

c. The second and third inservice inspections may be less than a full tube inspection by concentrating (selecting at least 50% of the tubes to be inspected) the inspection on those areas of the tube sheet array and on those portions of the tubes where tubes with imperfections were previously found.

d. Tubes in specific limited areas which are distinguished by unique operating conditions or physical construction may be excluded from random samples if all such tubes in the specific area of an OTSG are inspected with the ,

inspection result classification and the corresponding action required as specified in Table 5.6.2-3. No credit will be taken for these tubes in meeting minimum sample size requirements. Degraded or defective tubes found in these areas will not be considered in determining the inspection results category as long as the mode of degradation is unique to that area and not

random in nature. ,

(continued)

O Crystal River Unit 3 5.0-13 Final Draf t 10/12/93

L Procedures, Programs and Manuals 5.6 5.6 Procedures, Programs and Manuals 5.6.2.10 OTSG Tube Surveillance Program (continued)

The results of each sample inspection shall be classified into one of the following three categories:

........................------N0TE----- --------------------------

In all inspections, previously degraded tubes whose degradation has not been spanned by a sleeve must exhibit significant (>10%)

further wall penetrations to be included in the below percentage calculations. .

Cateaory Insoection Resulti C-1 Less than 5% of the total tubes inspected are degraded tubes and none of the inspected tubes are defective.

C-2 One or more tubes, but not more than 1%

of the total tubes inspected are.

defective, or between 5% and 10% of the total tubes inspected are degraded .

tubes.

O" C-3 More than 10% of the total tubes inspected are degraded tubes or more than 1% of the inspected tubes are defective.

3. The above-required inservice-inspections of OTSG tubes shall be performed at the following frequencies:

a. Inservice inspections shall be performed at intervals of not less than 12 nor more than 24 calendar months after the previous inspection. If two consecutive inspections following service under all volatile treatment (AVT) conditions, not including the preservice inspection, result in all inspection results falling into the C-1 category, or if two consecutive inspections demonstrate that previously observed degradation has not continued and no additional degradation has occurred, the inspection interval may.

, be extended to a maximum of once per 40 months.

(continued)

O Crystal River Unit 3 5.0-14 Final Draft 10/12/93

.i

Procedures, ' Programs and Manuals 5.6 5.6 Procedures, Programs and Manuals 5.6.2.10 OTSG Tube Surveillance Program (continued)

b. If the inservice inspection of an ATSG, conducted in accordance with Table 5.6.2-2 or Table 5.6.2-3 requires a third sample inspection whose results fall in Category C-3, the inspection frequency shall be reduced to at least once per 20 months. .The reduction in inspection frequency shall appl / until a subsequent inspection demonstrates that a third sample inspection .

is not required. ;

c. Additional unscheduled inservice inspections shall be performed on each OTSG in accordance with the first sample inspection specified in Table 5.6.2-2 or Table 5.6.2-3 during the shutdown subsequent to any of the .

following conditions:

1. Primary-to-secondary tube leaks (not including.

leaks originating from tube-to-tube sheet welds) in excess of the limits of Specification 3.4.12,

2. A seismic occurrence greater than the Operating Basis Earthquake,

3. A loss-of-coolant accident requiring actuation of the engineered safeguards, or

4. A main steam line or feedwater line break.

4. Acceptance criteria:

a. Vocabulary as used in this Specification:

1. Tubing or Tube means that portion of the tube or sleeve which forms the primary system to secondary >

system pressure boundary. .]

l

2. Imperfection means an exception to the dimensions, ;

finish or contour of a tube from that required by j fabrication drawings or specifications. Eddy- !

current testing indications below 20% of the nominal tube wall thickness, if detectable, may be considered as imperfections.

(continued)

O Crystal River Unit 3 5.0-15 Final Draft 10/12/93

Procedures, Programs and Manuals 5.6 5.6 Procedures, Programs and Manuals 5.6.2.10 OTSG Tube Surveillance Program (continued)

3. Degradation means a service-induced cracking, wastage, wear, or general corrosion occurring on either inside or outside of a tube.

4. Degraded Tube means a tube containing .

imperfections 2 20% of the nominal wall thickness caused by degradation except where all such degradation has been spanned by the installation of a sleeve.

5. % Degradation means the percentage of the tube wall thickness affected or removed by degradation.

6. De^fect means an imperfection of such severity that-it exceeds the plugging / sleeving limit except where the imperfection has been spanned by the installation of a sleeve. A tube containing a defect in its pressure boundary is defective. Any tube which does not permit the passage of the eddy-current inspection probe shall be deemed a defective tube.

7. Plugging / Sleeving Limit means the imperfection depth at or beyond which the tube shall .be restored to serviceability by the installation of a sleeve or removed from service because. it may '

become unserviceable prior to the next inspection and is equal to 40% of the nominal tube or sleeve wall thickness. No more than five thousand sleeves may be installed in each OTSG.

8. Unserviceable describes the condition of a tube if it leaks or contains a defect large enough to affect its structural integrity in the event of an Operating Basis Earthquake, a loss-of-coolant accident, or a main steam line or feedwater line break, as specified in 5.6.2.10.3.c, above.

9. Tube Inspection means an inspection of the entire OTSG tube as far as possible.

(continued) ,

o-Crystal River Unit 3 5.0-16 Final Draft 10/12/93 l

l

Procedures, Programs and Manuals 5.6 5.6 Procedures, Programs and Manuals 5.6.2.10 OTSG Tube Surveillance Program (continued)

b. The OTSG shall be determined OPERABLE after completing I the corresponding actions (plug or sleeve all tubes exceeding the plugging / sleeving limit and all tubes containing through-wall cracks) required by Table 5.6.2-2 (and Table 5.6.2-3 if the provisions of Specification 5.6.2.10.2.d are utilized). Defective tubes may be repaired in accordance with the B&W process (or method) equivalent to the method described in report BAW-2120P.

5.6.2.11 Secondary Water Chemistry Program l

This program provides controls for monitoring secondary water chemistry to inhibit steam generator tube degradation and low pressure turbine disc stress corrosion cracking. The program shall include: ;

I

a. Identification of a sampling schedule for the critical variables and control points for these variables;

b. Identification of the procedures used to measure the values of the critical variables;

c. Identification of process sampling points, which shall include monitoring the discharge of the condensate pumps for evidence of condenser in leakage;

d. Procedures for the recording and management of data;

e. Procedures defining corrective actions for all off control point chemistry conditions; and

f. A procedure identifying the authority responsible for the interpretation of the data and the sequence and timing of administrative events, which is required to initiate corrective action.

5.6.2.12 Not Used (continued)

Crystal River Unit 3 5.0-17 Final Draft 10/12/93

Procedures, Programs and Manuals 5.6 5.6 Procedures, Programs a1d Manuals (continued) 5.6.2.13 Explosive Gas and Storage Tank Radioactivity Monitoring Program This program provides controls for potentially explosive gas mixtures contained in the Radioactive Waste Disposal (WD) System, the quantity of radioactivity contained in gas storage tanks or fed into the offgas treatment system. The gaseous radioactivity quantities shall be determined following the methodology in Branch Technical Position (BTP) ETSB 11-5, " Postulated Radioactive Release due to Waste Gas System Leak or Failure". The liquid radwaste quantities shall be determined in accordance with Standard Review Plan, Section 15.7.3, " Postulated Radioactive Release due to Tank Failures".

The program shall include:

a. The limits for concentrations of hydrogen and oxygen in the Radioactive Waste Disposal (WD) System and a surveillance program to ensure the limits are maintained.

b. A surveillance program to ensure that the quantity of radioactivity contained in each gas storage tank and fed into the offgas treatment system is less than the amount that would result in a whole body exposure of 2 0.5 rem to O any individual in an unrestricted area, in the event of an uncontrolled release of the tanks' contents.

The provisions of SR 3.0.2 and SR 3.0.3 are applicable to the Explosive Gas and Storage Tank Radioactivity Monitoring Program surveillance frequencies.

5.6.2.14 Not Used 5.6.2.15 Not Used 5.6.2.16 Safety Function Determination Program (SFDP)

This program ensures loss of safety function is detected and appropriate actions taken. Upon entry into LC0 3.0.6, an evaluation shall be made to determine if loss of safety function exists. Additionally, other appropriate limitations and remedial or compensatory actions may be identified to be taken as a result of the support system inoperability and corresponding exception to entering supported system Condition and Required Actions. This program implements the requirements of LCO 3.0.6.

(continued)

Crystal River Unit 3 5.0-18 Final Draft 10/12/93 l

Procedures, Programs and Manuals -

5.6 5.6 Procedures, Programs and Manuals 5.6.2.16 SFDP (continued) ,

The SFDP shall contain the following:

a. Provisions for cross train checks to ensure a loss of the '

capability to perform the safety function assumed in the accident analysis does not go undetected;

b. Provisions for ensuring the plant is maintained in a safe condition if a loss of function condition exists;

c. Provisions to ensure that an inoperable supported system's Completion Time is not inappropriately extended as a result ,

of multiple support system inoperabilities; and

d. Other appropriate limitations and remedial or compensatory actions.

A loss of safety function exists when, assuming no concurrent single failure, a safety function assumed in the accident analysis cannot be performed. For the purpose of this program, a loss of safety function may exist when a support system is inoperable, and: ,

a. A required system redundant to the system (s) supported by the inoperable support system is also inoperable); or ,

b. A required system redundant to the system (s) in turn supported by the inoperable supported system is also inoperable; or ,

c. A required system redundant to the support system (s) for the supported systems (a) and (b) above is also inoperable.

The SFDP identifies where a loss of safety function exists. If a loss of safety function is detennined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

i (continued)

Crystal River Unit 3 5.0-19 Final Draft 10/12/93 i l

l 1

Procedures, Programs and Manuals 5.6 5.6 Procedures, Programs and Manuals (continued) 5.6.2.17 Technical Specifications (TS) Bases Control Program Changes to the Bases of the TS shall be made under appropriate administrative controls and reviewed according to the review process specified in the Quality Assurance Plan.

Licensees may make changes to Bases without prior NRC approval-provided the changes do not involve either of the following:

a. A change in the TS incorporated in the license; or

b. A change to the updated FSAR or Bases that involves an unreviewed safety question as defined in 10 CFR 50.59.

The Bases Control Program shall contain provisions to ensur,e that the Bases are maintained consistent with the FSAR.

Proposed changes that meet the criteria of Specification 5.6.2.17.a or Specification 5.6.2.17.b above shall be reviewed and approved by the NRC prior to implementation. Changes to the Bases-implemented without prior NRC approval shall be provided to the NRC on a frequency consistent with 10 CFR 50.71.

O 5.6.2.18 CORE OPERATING LIMITS REPORT (COLR)

a. Core operating limits shall be established prior to each reload cycle, or prior to any remaining portion of a reload cycle, and shall be documented in the COLR for the following:

SL 2.1.1.3 API Protective Limit LCO 3.1.1 SHUTDOWN MARGIN SR 3.1.7.1 API /RPI Position Indication Agreement LCO 3.1.3 Moderator Temperature coefficient (MTC)

LCO 3.2.1 Regulating Rod Insertion Limits LC0 3.2.2 AXIAL POWER SHAPING R00 (APSR) Insertion Limits (continued)

Crystal River Unit 3 5.0-20 Final Draft 10/12/93

Procedures, Programs and Manuals 5.6 I

5.6 Procedures, Programs and Manuals 5.6.2.18 COLR (continued)

LCO 3.2.3 AXIAL POWER IMBALANCE Operating Limits LC0 3.2.4 QUADRANT POWER TILT LCO 3.2.5 Power Peaking Factors LC0 3.3.1 Reactor Protection System (RPS) Instrumentation LC0 3.9.1 Boron Concentration ,

b. The analytical methods used to determine the core operating limits shall be those previously reviewed and approved by the NRC:

BAW-10179P-A, " Safety Criteria and Methodology for Acceptable Cycle Reload Analyses" (the approved revision at the time the reload analyses are performed) and License Amendment 144, SER dated June 25, 1992.

The approved revision number for BAW-10179P-A shall be identified in the COLR.

c. The core operating limits shall be determined such that all applicable limits (e.g., fuel thermal mechanical limits, core thermal hydraulic limits, Emergency Core Cooling System (ECCS) limits, nuclear limits such as SDM, transient analysis limits, and accident analysis limits) of the safety analysis are met.

d. The COLR, including any midcycle revisions or supplements, shall be provided upon issuance for each reload cycle to the NRC.

5.6.2.19 Reactor Coolant System (RCS) PRESSURE AND TEMPERATURE LIMITS REPORT (PTLR)

RCS pressure and temperature limits, including heatup and cooldown '

rates, criticality, and hydrostatic and leak test limits, shall be established and documented in the PTLR. The analytical methods used to determine the pressure and temperature limits including the heatup and cooldown rates shall be those previously reviewed and approved by the NRC in BAW-10046A, Rev. 2, " Methods of Compliance With Fracture Toughness and Operational Requirements of 10 CFR 50, Appendix G", June 1986. The reactor vessel pressure and temperature limits, including those for heatup and cooldown rates, shall be determined so that all applicable limits (e.g.,

heatup limits, cooldown limits, and inservice leak and hydrostatic testing limits) of the analysis are met. The PTLR, including revisions or supplements thereto, shall be provided upon issuance for each reactor vessel fluency period.

O Crystal River Unit 3 5.0-21 Final Draft 10/12/93

- Procedures, Programs and Manuals 5.6 D (page 1 of 1)

[d TABLE 5.6.2-1 MINIMUM NUMBER OF STEAM GENERATORS (OTSGs) TO BE INSPECTED DURING INSERVICE INSPECTION i

Preservice Inspection Yes Number of OTSGs Two l First Inservice Inspection One Second and Subsequent Inservice l

Inspections One 1

The inservice inspection may be limited to one OTSG on a rotating schedule encompassing 6% of the tubes if the results of the first or previous inspections indicate that both OTSGs are performing in a like manner. Note that under some circumstances, the operating conditions in one OTSG may be found to be more severe than those in the other OTSG. Under such circumstances the sample sequence shall be modified to inspect the most severe conditions.

l l

O '

l Crystal River Unit 3 5.0-22 Final Draft 10/12/93

Procedures, Programs and Manuals 5.6 TABLE 5.6.2-2 (page 1 of 1)

C OTSG TUBE INSPECTION 1st Sa mle Inspection 2nd Sample Inspection 3rd samle Inspection Sample Size Result Action Result Action Result Action Required Required Required A minimum of C-1 None N/A N/A N/A N/A S tubes per OfSG C-2 Plug or C-1 None N/A N/A sleeve defective tubes and C2 Plug or C1 None inspect an sleeve additional defective 2S tubes in tubes and C-2 Plug or this OTSG. inspect sleeve ,

additional defective 45 tubes in tubes.

this OTSG.

C-3 Perform action for C 3 result of first sa mle.

C3 Perform N/A N/A action for C-3 result of first sample.

C-3 Inspect all All other None N/A N/A tubes in OTSGs are this OTSG, C-1 plug or sleeve defective Some OTSGs Perform N/A N/A tubes, C 2 but no action for inspect 25 additional C 2 result tubes in OTSGs are of second each other C3 sample.

OTSG, and notify NRC per Additional Inspect all N/A N/A 10CFR50.72 OTSG is C-3 tubes in each OTSG, plug or sleeve defective tubes, and notify NRC per 10CFR50.72.

S = 3 N/n % Where N i6 the nunber of OTSGs in the unit and n is the tuber of OTSGs inspected during inspection period.

Crystal River Unit 3 5.0-23 Final Draft 10/12/93

Procedures,; Programs and Manuals 5.6

(' TABLE 5.6.2-3 (page 1 of 1) ;

SPECIFIC LIMITED AREA-INSPECTION 1st Sanple Inspection of a 2nd Sample Inspection of a

" Specific Limited Area" " Specific Limited Area" Sample Site Result Action Result. Action Required Required 100% of area C1 None N/A N/A in both .

01SGs &

C-2 Plug or N/A N/A sleeve defective tubes.

C3 Plug or N/A N/A sleeve defective '

tubes.

100% of area C-1 None N/A N/A in one OTSG C2 Plug or C-1 None sleeve defective ,

tubes and g.2 Plug or inspect 100% .g,,y, Of defective '

correspond' tubes.

ing area in other OTSG C-3 Plug or sleeve defective tubes. >

C-3 Plug or C1 None sleeve defective ,

tubes and C2 Plug or inspect 100% .g ,y, Of defective correspond

tubes.

frg area in other otSG.

C3 Plug or ,

sleeve '

defective tubes.

t i

.l i

Crystal River Unit 3 5.0-24 Final Draft 10/12/93 1

i Reporting Requirements !

5.7 5.0 ADMINISTRATIVE CONTROLS 5.7 Reporting Requirements a 5.7.1 Routine Reports 5.7.1.1 Reports required on an annual basis include:

a. Occupational Radiation Exposure Report.

The report shall contain the results of individual monitoring for each individual for whom monitoring was required by 10 CFR 20.1502 during the year. Form NRC 5 or electronic media containing all the information required by Form NRC 5 shall be used.

The report required by 10 CFR 20.2206(b) covering the .

preceding year, shall be filed on or before April 30 of each year, i

b. Radioactive Effluent Release Report The Radioactive Effluent Release Report covering the operation of the unit shall be submitted in accordance with 10 CFR 50.36a. The report shall include a summary of the O quantities of radioactive liquid and gaseous effluents and solid waste released from the unit. The material provided shall be consistent with the objectives outlined in the ODCM a,1d Process Control Program, and in conformance with 10 CFR ,

50.36a and 10 CFR 50, Appendix I, Section IV.B.1.

5.7.1.2 Monthly Operating Reports Routine reports of operating statistics and shutdown experience, including documentation of all challenges to the pressurizer power operated relief valves or pressurizer safety valves, shall be submitted on a monthly basis no later than the 15th of each month following the calendar month covered by the report. .

(continued)

Crystal River Unit 3 5.0-25 Final Draft 10/12/93

Reporting Requirements 5.7-5.7 Reporting Requirements (continued) 5.7.2 Soecial Reports Special Reports shall be submitted in accordance with 10 CFR 50.4 within the time period specified-for each report.

The following Special Reports shall be submitted:

a. When a Special Report is required by Condition B or F of LCO 3.3.17, " Post Accident Monitoring (PAM)

Instrumentation," a report shall be submitted within the following 14 days. The report shall outline the preplanned alternate method of monitoring, the cause of the inoperability, and the plans and schedule for restoring the instrumentation channels of the Function to OPERABLE status.

b. Any abnormal degradation of the containment structure detected during the tests required by the Containment Tendon i Surveillance Program shall be reported to the NRC within 30 days. The report shall include a description of the tendon condit':on, the condition of the concrete (especially at tendon anchorages), the inspection procedures, the tolerances on cracking, and the corrective action taken.

c. Following each inservice inspection of steam generator (OTSG) tubes, the number of-tubes plugged and sleeved in each OTSG shall be reported to the NRC within 15 days.

The complete results of the OTSG tube inservice inspection shall be submitted to the NRC within 12 months following the completion of the inspection. The report shall include:

1. Number and extent of tubes inspected,

2. Location and percent of wall-thickness penetration for each indication of an imperfection, and

3. Identification of tubes plugged and tubes sleeved.

Results of 0TSG tube inspections that fall into Category C-3 shall be reported to the NRC prior to resumption of plant operation. This report shall provide a description of investigations conducted to determine cause of the tube degradation and corrective measures taken to prevent recurrence.

O :

Crystal River Unit 3 5.0-26 Final Draft 10/12/93 I

I

Reactor Core SLs B 2.1.1 B 2.0 SAFETY LIMITS (SLs)

B 2.1.1 Reactor Core SLs BASES BACKGROUND Crystal River Unit 3 FSAR Section 1.4 (Ref.1) Criterion 6 requires that acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences (A00s). The reactor core SLs are established to preclude violation of the following fuel design criteria:

a. There must be at least 95% probability at a 95%

confidence level (95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB; and

b. The hot fuel pellet in the core must not experience fuel centerline melting.

The restrictions of this SL provide a high degree of protection against overheating of the fuel and cladding that r would result in possible cladding perforation. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate (LHR) below the level at which fuel O centerline melting occurs. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime, where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature, Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel is high enough to cause the l fuel centerline temperature to reach the melting point of the fuel. Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the point of l failure, allowing an uncontrolled release of activity to the ;

reactor coolant. The melting point of uranium dioxide l varies slightly with burnup. As urar,ium is depleted and fission products produced, the net ef'ect is a decrease in l the melting point. However, depletir,n of the uranium also i reduces the power produced in the foel such that the closest the plant comes to the centerline melt SL is at the beginning of the fuel cycle. The formula presented is on a per fuel pin basis.

(continued)

Crystal River Unit 3 B 2.0-1 Final Draft 10/01/93 l

Reactor Core SLs B 2.1.1 BASES BACKGROUND Operatier, above the boundary of the nucleate boiling regime (continued) could result in excessive cladding temperature because of the onset of DNB and the resultant sharp reduction in heat ,

transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.

The proper functioning of the Reactor Protection System (RPS) prevents violation of the reactor core SLs.

APPLICABLE The RPS setpoints (Ref. 2), in combination with the DNB SAFETY ANALYSES operating limits LC0 (LC0 3.4.1), are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System (RCS) temperature, pressure, and THERMAL POWER level that would result in a departure from nucleate boiling ratio (DNBR) of less than the DNBR limit and preclude the existence of flow instabilities.

Automatic enforcement of these reactor core SLs is provided by the following:

a. RCS High Pressure trip;

b. RCS Low Pressure trip;

c. Nuclear Overpower trip;

d. RCS Variable Low Pressure trip;

e. Reactor Coolant Pump to Power trip; and

f. Nuclear Overpower RCS Flow and AXIAL POWER IMBALANCE trip.

The SL represents a design requirement for establishing the RPS trip setpoints identified previously.

Safety Limits that preclude fuel cladding failure are required to be included in the Technical Specifications pursuant to 10 CFR S0.36 (Ref. S).

I O (continued) i Crystal River Unit 3 B 2.0-2 Final Draft 10/01/93 l

l

Reactor Core SLs B 2.1.1 BASES (continued)

SAFETY LIMITS SL 2.1.1.1, SL 2.1.1.2, and SL 2.1.1.3 ensure that the minimum DNBR is not less than the safety analyses limit and that fuel centerline temperature stays below the melting point, or the average enthalpy in the hot leg is less than l or equal to the enthalpy of saturated liquid, or the exit l quality is within the limits defined by the DNBR !

correlation. In addition, SL 2.1.1.3 addresses the pressure / temperature operating region that keeps the reactor from reaching an SL when operating up to design power. l l

Examination of the limit curve in Figure 2.1.1-1 reveals l that the temperatures corresponding to the pressures vary l between 20 and 30*F below the saturation temperature of the coolant at that pressure, thus ensuring an even greater margin to DNB.

The fuel centerline melt and DNBR SLs are not directly monitorable by installed plant instrumentation. Inctead, the SLs are preserved by monitoring the process variable AXIAL POWER IMBALANCE to ensure that the core operates within the fuel design criteria. With AXIAL POWER IMBALANCE within the protective limits, fuel centerline temperature and DNBR are also within limits. AXIAL POWER IMBALANCE O protective limits are provided in the COLR.

The AXIAL POWER IMBALANCE protective limits are preserved by their corresponding RPS setpoints in LC0 3.3.1, " Reactor Protection System (RPS) Instrumentation," as specified in ,

the COLR. The trip setpoints are derived by adjusting the measurement system independent AXIAL POWER IMBALANCE protective limit giver, in the COLR to allow for measurement system observability (the fact there are a finite number of detectors) and instrumentation errors. The AXIAL POWER l IMBALANCE protective limits are separate and distinct from ;

the AXIAL POWER IMBALANCE operating limits defined by LCO 3.2.3, " AXIAL POWER IMBALANCE Operating Limits." The AXIAL POWER IMBALANCE operating limits in LCO 3.2.3, also specified in the COLR, preserve initial conditions of the safety analyses but are not reactor core SLs.

RCS pressure, temperature and flow DNB operating limits are defined by LCO 3.4.1.

(continued)

Crystal River Unit 3 B 2.0-3 Final Draft 10/01/93

Reactor Core SLs B 2.1.1 BASES (continued)

APPLICABILITY SL 2.1.1.1, SL 2.1.1.2, and SL 2.1.1.3 only apply in MODES I and 2 because these are the only MODES in which the reactor is critical. Automatic protection functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The automatic protection actions serve to prevent RCS heatup to reactor core SL conditions by .

initiating a reactor trip which forces the plant into MODE 3. Setpoints for the reactor trip functions are specified in LC0 3.3.1.

In MODES 3, 4, 5, and 6, Applicability is not required, since the reactor is not generating significant THERMAL POWER.

SAFETY LIMIT The following SL violation responses are applicable to the VIOLATIONS reactor core SLs.

2.2.1 If SL 2.1.1.1, SL 2.1.1.2, or SL 2.1.1.3 is violated, the requirement to go to MODE 3 places the plant in a MODE in O which these SLs can not be violated.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of placing the plant in a MODE of operation where these SLs are not applicable and reduces the probability of fuel damage.

2.2.4 If SL 2.1.1.1, SL 2.1.1.2, or SL 2.1.1.3 is violated, the NRC Operations Center must be notified within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , in accordance with 10 CFR 50.72 (Ref. 3).

The 10 CFR 50.72 part against which a Safety Limit violation would be reported is the declaration of any of the Emergency Classes specified in the Emergency Plan (10 CFR 50.72(a)(1)(1)).

l i

(continued)

Crystal River Unit 3 B 2.0-4 Final Draft 10/01/93 l

l Reactor Core SLs B 2.1.1 l

BASES SAFETY LIMIT 2.2.5 VIOLATIONS (continued) If SL 2.1.1.1, SL 2.1.1.2, or SL 2.1.1.3 is violated, the appropriate Nuclear Operations senior management and the Nuclear General Review Committee (NGRC) shall be notified !

within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period provides time for the plant operators and staff to take the appropriate immediate :

action and assess the condition of the plant before reporting to senior management.

2.2.6 If SL 2.1.1.1, SL 2.1.1.2, or SL 2.1.1.3 is violated, a Licensee Event Report shall be prepared and submitted within 30 days to the NRC in accordance with 10 CFR 50.73 (Ref. 4).

A copy of the report shall also be provided to the NGRC, the Director, Nuclear Plant Operations, and the Senior Vice President, Nuclear Operations.

The 10 CFR 50.73 part against which a Safety Limit violation would be reported is: 1) completion of a plant shutdown required by Technical Specifications, (10 CFR t 50.73(a)(2)(1)(A)), 2) an event which resulted in an unanalyzed condition that significantly compromised plant safety, (10 CFR 50.73(a)(2)(ii)(A)), 3) any condition i outside the design basis for the plant (10 CFR ;

50.73(a)(2)(ii)(B)), and 4) an event which resulted in an RPS actuation (10 CFR 50.73(a)(2)(iv)).

2 2.7 If SL 2.1.1.1, SL 2.1.1.2, or SL 2.1.1.3 is violated, operation of the plant shall not be resumed until authorized by the NRC. This requirement ensures the NRC that all necessary reviews, analyses, and actions are completed before the plant enters the applicable MODES for these SLs (MODES 1 and 2).

REFERENCES 1. FSAR, Section 1.4.

2. FSAR, Table 7-2.

(continued)

Crystal River Unit 3 8 2.0-5 Final Draft 10/01/93

Reactor Core SLs B 2.1.1

[ BASES REFERENCES 3. 10 CFR 50.72.

(continued)

4. 10 CFR 50.73. .

5. 10 CFR 50.36.

O l

O Crystal River Unit 3 B 2.0-6 Final Draft 10/01/93

RCS Pressure SL B 2.1.2 B 2.0 SAFETY LIMITS (SLs)

B 2.1.2 Reactor Coolant System (RCS) Pressure SL BASES BACKGROUND According to FSAR Section 1.4, Criterion 9, " Reactor Coolant Pressure Boundary," is designed and constructed so as to have an exceedingly low probability of gross rupture or significant leakage throughout its design lifetime (Ref.1),

l the reactor coolant pressure boundary (RCPB). Criterion 33, RCPB Capability" (Ref.1), specifies that reactivity accidents including rod ejection do not result in damage to the RCPB greater than limited local yielding.

The design pressure of the RCS is 2500 psig. During normal operation and anticipated operational oc urrences (A00s),

the RCS pressure is kept from exceeding the design pressure by more than 10% in order to remain in accordance with Section III of the ASME Code (Ref. 2). Hence, the safety limit is 2750 psig. To ensure system integrity, all RCS components were hydrostatically tested at 125% of design pressure (3125 psig) prior to initial operation, according to the ASME Code requirements. Inservice operational O. hydrotesting in accordance with the ASME Code is also required whenever the reactor vessel head has been removed or if other pressure boundary joint alterations have occurred. Following inception of plant operation, RCS components are pressure tested in accordance with the requirements of ASME Code,Section XI (Ref. 3).

APPLICABLE The RCS pressurizer safety valves, operating in conjunction SAFETY ANALYSES with the Reactor Protection System trip settings, ensure that the RCS pressure SL will not be exceeded.

The RCS pressurizer safety valves are sized to prevent system pressure from exceeding the design pressure by more than 10%, in accordance with Section III of the ASME Code for Nuclear Power Plant Components (Ref. 2). The trans'.ent that is most influential for establishing the required ,

relief capacity, and hence the valve size requirements and -I lift settings, is a rod withdrawal from low power. Both pressurizer safety valves may be required for protection (continued)

Crystal River Unit 3 8 2.0-7 Final Draft 10/01/93

RCS Pressure SL B 2.1.2 A

Q BASES APPLICABLE from this event. During the transient, no control actions SAFETY ANALYSES are assumed except that the Reactor Protection System (RPS)

(continued) trips the reactor on high flux, and nominal feedwater supply is maintained. Main Steam Safety Valver, while not specifically modelled as part of the analysis, are qualitatively assumed to function to fix secondary side pressures and temperatures (and thus, RCS cold leg temperature).

It is important to emphasize that when the operating characteristics of the safety valves were selected, it was assumed that the reactor protection system provided the first overpressure protection. The safety valves alone cannot prevent overpressure; they act in conjunction with l the RPS to prevent overpressure. A single fai'.are in the RPS will not result in a failure to trip the aactor. RPS will not result in a failure to trip the rec.ctor. Failure of the RPS to trip the reactor was not assumed to be credible when the operating characteristics of the safety valves were specified. The single failure criterion is not considered to be applicable to pressurizer safety valves since the ASME code allows the use of the rated capacity of all OPERABLE spring-loaded safety valves. This allows the O total relieving capacity of both valves to be credited to overpressure protection.

The overpressure protection analyses (Ref. 4) and the safety analyses (Ref. 5) are performed using conservative assumptions relative to pressure control devices. More specifically, no credit is taken for operation of the following: i

a. Pressurizer power operated relief valves (PORVs);

b. Steam line turbine bypass valves;

c. Control system runback of reactor and turbine power; and

d. Pressurizer spray valve.

P SAFETY LIMITS The maximum transient pressure allowed in the RCS pressure vessel under the ASME Code,Section III, is 110% of design 1

(continued)

Crystal River Unit 3 8 2.0-8 Final Draft 10/01/93 l l

RCS Pressure SL l B 2.1.2 I m i BASES SAFETY LIMITS pressure. The maximum transient pressure allowed in the RCS (continued) piping, valves, and fittings under USAS, Section B31.7 .

(Ref. 6), is also 110% of design pressure. Therefore, the l SL on maximum allowable RCS pressure of 2750 psig is !

consistent with the design criteria and associated code l' requirements.

Overpressurization of the RCS can result in a breach of the RCPB. If such a breach occurs in conjunction with a fuel cladding failure, fission products could enter the containment atmosphere, raising concerns relative to limits on radioactive releases specified in 10 CFR 100, " Reactor Site Criteria" (Ref. 7).

APPLICABILITY SL 2.1.2 applies in MODES 1, 2, 3, 4, and 5 because this SL' could be approached or exceeded in these MODES during overpressurization events. The SL is not applicable in MODE 6 because the reactor vessel head closure bolts are not fully tightened, making it unlikely that the RCS can be pressurized.

O SAFETY LIMIT The following SL violation responses are applicable to the VIOLATIONS RCS pressure SL.

2.2.2 If the RCS pressure SL is violated when the reactor is in MODE 1 or 2, the requirement is to restore esmpliance and be in MODE 3 within I hour.

Exceeding the RCS pressure SL may causr' immediate RCS failure and create a potential for racioactive releases in excess of 10 CFR 100, " Reactor Site Criteria," limits (Ref 7).

The allowed Completion Time of I hour is based on the importance of reducing power level to a MODE of operation 1 where the potential for challenges to safety systems is minimized.

(continued)

Crystal River Unit 3 8 2.0-9 Final Draft 10/01/93

l RCS Pressure SL B 2.1.2 ;

BASES SAFETY LIMIT 2.2,3 VIOLATIONS (continued) If the RCS pressure SL is exceeded in MODE 3, 4, or 5, RCS pressure must be restored to within the SL value within 5 minutes.

Exceeding the RCS pressure SL in MODE 3, 4, or 5 is potentially more severe than exceeding this SL in MODE 1 or 2, :;ince the reactor vessel temperature may be lower and the vessel material, consequently, less ductile. As such, pressure must be reduced to less than the SL within 5 minutes. This action does not require reducing MODES, since this would require reducing temperature, which would compound the problem by adding thermal gradient stresses to the existing pressure stress. ,

2.2.4 If the RCS pressure SL is violated, the NRC Operations Center must be notified within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , in accordance with 10 CFR 50.72 (Ref. 8).

The 10 CFR 50.72 part against which a Safety Limit violation would be reported is the declaration of any of the Emergency Classes specified in the Emergency Plan (10 CFR 50.72(a)(1)(1)).

2.2.5 If the RCS pressure SL is violated, the appropriate Nuclear Operations senior management and the Nuclear General Review Committee (NGRC) shall be notified within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period provides time for the plant operators and staff to take the appropriate immediate acti m and assess ,

the condition of the plant before reporting .; the senior management.

l (continued)

Crystal River Unit 3 B 2.0-10 Final Draft 10/01/93 l

)

i i RCS Pressure SL l

B 2.1.2 BASES SAFETY LIMIT 2,2,6 VIOLATIONS (continued) If the RCS pressure SL is violated, a Licensee Event Report shall be prepared and submitted within 30 days to the NRC in accordance with 10 CFR 50.73 (Ref. 9). A copy of the report shall also be provided to the NGRC, the Director, Nuclear Plant Operations, and the Senior Vice President , Nuclear Operations.

The 10 CFR 50.73 part against which a Safety Limit violation would be reported is: 1) completion of a plant shutdown required by Technical Specifications, (10 CFR 50.73(a)(2)(1)(A)), 2) an event which resulted in an unanalyzed condition that significantly compromised plant safety, (10 CFR 50.73(a)(2)(iv)).

2.2.7 If the RCS pressure SL is violated, operation of the plant shall not be resumed until authorized by the NRC. This requirement ensures the NRC that all necessary reviews, analyses, and actions are completed by establishing O limitations on ascending MODES or other specified conditions in the Applicability until the NRC review is complete.

REFERENCES 1. FSAR, Section 1.4.

2. ASME Boiler and Pressure Vessel Code,Section III, Article NB-7000.

t

3. ASME Boiler and Pressure Vessel Code,Section XI, Articles IWA-5000 and IWB-5000.

4. BAW-10043, May 1972.

5. FSAR, Section 14.

6. ASME USAS B31.7, Code for Pressure Piping, Nuclear Power Piping, February 1968 Draft Edition, i

(continued)

Crystal River Unit 3 B 2.0-11 Final Draft 10/01/93 l

l l

- , , - - - . ~ - - - - . -, -c

RCS Pressure SL' B 2.1.2 BASES REFERENCES 7. 10 CFR 100.

(continued)

8. 10 CFR 50.72.

9. 10 CFR 50.73.

O O

Crystal River Unit 3 B 2.0-12 Final Draft 10/01/93

LCO Applicability B 3.0 B 3.0 LIMITING CONDITI0f/ FOR OPERATION (LCO) APPLICABILITY BASES 1 '

LC0 3.0.1 through LCO 3.0.7 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.

LC0 3.0.1 LC0 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when .

the LCO is required to be met (i.e., when the unit is in the MODE or other specified conditions of the Applicability statement of each Specification). .;

LC0 3.0.2 LC0 3.0.2 establishes that upon discovery of a failure to ,

meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an '

ACTIONS Condition is entered. The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LC0 are not met. This Specification establishes that:

a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and !

b. Completion of the Required Actions is not required .

when an LC0 is met within the specified Completion Times, unless otherwise specified.

There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the l LC0 must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status .

or to restore variables to within specified limits. If this type of Required Action is not completed within the specifie 'ompletion Time, a shutdown may be required to place the unit in a MODE or condition in which the ;

Specificatic is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition ,

is an action that may always be considered upon entering ACTIONS. The second type of Required Action specifies the ;

i (continued)

Crystal River Unit 3 8 3.0-1 Final Draft 10/01/93

LC0 Applicability i

B 3.0 BASES LC0 3.0.2 remedial measures that permit continued operation of the (continued) unit that is not further restricted by the Completion Time.

In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation.

Completing the Required Actions is not required when an LCO is met or is no longer applicable within the associated Completion Time, unless otherwise stated in the individual Specifications.

The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Conditions no longer exist. The individual ,

Specification's ACTIONS specify the Required Actions where this is the case. An example of this is in LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits."

The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. Reasons for intentionally relying on the ACTIONS include, but are not limited to, performance of Surveillances, preventive. maintenance, corrective

( maintenance, or investigation of operational problems.

Entering ACTIONS for these reasons must be done in a manner '

that does not compromise safety. Intentional entry into ACTIONS should not be made for operational convenience.

Alternatives that would not result in redundant equipment being inoperable should be used instead. Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of tb % quired Actions are applicable when this time limit exp % ' the equipment remains removed from service or bypassed.

When a change in MODE or other, specified condition is required to comply with Required Actions, the unit could enter a MODE or other specified condition in which arother Specification becomes applicable. In this case, the Completion Times of the associated Required Actions would apply from the point in time that the new Specification becomes applicable and the ACTIONS Condition (s) is entered.

f --

(continued)

Crystal River Unit 3 8 3.0-2 Final Draft 10/01/93

LCO Applicability l B 3.0 !

l BASES (continued)

LCO 3.0.3 LC0 3.0.3 establishes the actions that must be implemented when an LC0 is not met and:

a. An associated Required Action and Completion Time is not met and no other Condition applies; or

b. The condition of the unit is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes, possible i combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered ,

immediately.

This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LC0 and its ACTIONS. It is not intended to be used as an operational convenience that permits routine voluntary removal of redundant systems or O components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable.

Upon entering LCO 3.0.3, I hour is allowed to prepare for an orderly shutdown before initiating a change in unit operation. This includes time to permit the operator to i coordinate the reduction in electrical generation with the .

load dispatcher to ensure the stability and availability of the electrical grid.

The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit, assuming that only the minimum required equipr.ent is OPERABLE. This reduces thermal stresses on :.omponents of the Reactor Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification' applies. The use and interpretation of ,

specified times to complete the actions of LCO 3.0.3 are >

consistent with the discussion of Section 1.3, Completion Times.

(continued)

Crystal River Unit 3 8 3.0-3 Final Draft 10/01/93 I

LC0 Applicability B 3.0 BASES LCO 3.0.3 A unit shutdown required in accordance with LCO 3.0.3 may be (continued) terminated and LC0 3.0.3 exited if any of the following occurs:

a. The LC0 is now met. .

b. A Condition exists for which the Required Actions have now been performed,

c. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the .

point in time that the Condition is' initially entered and not from the time LC0 3.0.3 is exited.

The time limits of Specification 3.0.3 allow 37 hours4.282407e-4 days 0.0103 hours 6.117725e-5 weeks 1.40785e-5 months for the unit to be in MODE 5 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE applies. If a lower MODE is reached in less time than allowed, however, the total-allowable time to reach MODE 5, or other applicable MODE, is not reduced. For example, if MODE 3 is reached in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , ,

then the time allowed for reaching MODE 4 is the next O 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months , because the total time for reaching MODE 4 is not reduced from the allowable limit of 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months . Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to reach a lower MODE of operation in less than the total time allowed.

In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in'other Specifications. The-requirements of LC0 3.0.3 do not apply in-MODES 5 and 6 because the unit is already in the most restrictive Condition required by LCO 3.0.3. The requirements of LC0 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the .

ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.

Exceptions to LCO 3.0.3 are provided in instances where .

requiring a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in Specification 3.7.13, " Fuel ' Storage Pool Water Level."

Specification 3.7.13 has an Applicability of "During :

l (continued)

Crystal River Unit 3 B 3.0-4 Final Draft 10/01/93 i

LC0 Applicability B 3.0 BASES LCO 3.0.3 movement of irradiated fuel assemblies in fuel storage (continued) pool." Therefore, this Specification can be applicable in any or all MODES. If the LC0 and the Required Actions of Specification 3.7.13 are not met while in MODE 1, 2, 3, or 4, there is no safety benefit to be gained by placing the urit in a shutdown condition. The Required Action of Specification 3.7.13 of " Suspend movement of irradiated fuel assemblies in fuel storage pool" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3.

These exceptions are addressed in the individual

, Specifications.

LCO 3.0.4 LC0 3.0.4 establishes limitations on changes in MODES or .

other specified conditions in the Applicability when an LCO is not met. It precludes placing the unit in a different MODE or other specified condition when the following exist:

a. The requirements of an LCO,.in the MODE or other specified condition to be entered, are not met; and 1

b. Continued noncompliance with these LC0 requirements O would result in the unit being required to be placed in a MODE or other specified condition in which the Specification does not apply to comply with the Required Actions.

Compliance with Required Actions that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change. Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made in accordance with the provisions of the Required Actions.

The provisions of LC0 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability ,

that are required to comply with ACTIONS. l l

Exceptions to LC0 3.0.4 are stated in the individual '

l Specifications. Exceptions may apply to all the ACTIONS or to a specific Required Action of a Specification.

(continued)

Crystal River Unit 3 B 3.0-5 Final Draft 10/01/93

.j

- - + + e -<v- ,-r- , , , _ ,. -. ,

LC0 Applicability ,

B 3.0 l l

BASES LC0 3.0.4 Surveillances do not have to be performed on the associated (continued) inoperable equipment (or on variables outside the specified !

limits), as permitted by SR 3.0.1. Therefore, changing 1 MODES or other specified conditions while in an ACTIONS Condition, in compliance with LCO 3.0.4 or where an exception to LCO 3.0.4 is stated, is not a violation of SR 3.0.1 or SR 3.0.4 for those Surveillances that do not have to be performed due to the associated inoperable equipment. However, SRs must be met to demonstrate OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO.

LC0 3.0.5 LC0 3.0.5 establishes the allowance of restoring equipment '

to service under administrative controls when it has been removed from service to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LC0 3.0.2 to allow the performance of SRs to demonstrate:

a. The OPERABILITY of the equipment being returned to service;

b. The OPERABILITY of other equipment; or

c. That variables are within limits.

The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allowed SRs. This Specification does not provide time to perform any other preventive or corrective maintenance.

An example of demonstrating the OPERABILITY of the equipment "

being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions, and must be reopened to perform the SRs.

An example _of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and

indicate the appropriate response during the performance of an SR on another channel in the same trip system.

(continued)

Crystal River Unit 3 8 3.0-6 Final Draft 10/01/93

,l

-f

LC0 Applicability B 3.0 BASES (continued)

LC0 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that have a Specification specified in the Technical 1 Specifications (TS). This exception is necessary because i LC0 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system Specification be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the unit is maintained in a safe condition are specified in the support system Specification's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions.

When a support system is inoperable and there is an LCO specified for it in the TS, the supported system (s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability.

However, it is not necessary to enter into the supported systems' Conditions and Required Actions unless directed to do so by the support system's Required Actions. The confusion and inconsistency of interpretation of requirements related to the entry into multiple Specification's Conditions and Required Actions are O eliminated by providing all the actions that are necessary to ensure the unit is maintained in a safe condition in the support system's Required Actions.

However, there are instances where a support system's Required Action may either direct a supported system to be ,

declared inoperable or direct entry into Conditions and )

Requiied Actions for the supported system. This may occur i immediately or after some specified delay to perform some l other Required Action. Regardless of whether it is 4 immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry in Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2. j Specification 5.6.2.16, " Safety Function Determination !

Program (SFDP)," ensures loss of safety function is detected !

and appropriate actions are taken. Upon failure to meet two l or more LCOs at the same time, an evaluation shall be made j (continued)

Crystal River Unit 3 8 3.0-7 Final Draft 10/01/93 l

i LCO Applicability l B 3.0 j

)

BASES LC0 3.0.6 to determine if loss of safety function exists.

(continued) Additionally, other limitations, remedial actions, or i compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions.

The SFDP implements the requirements of LC0 3.0.6.

Cross train checks to verify a loss of safety function for those support systems that support multiple and redundant safety systems are required. The cross train check verifies that the supported systems of the remaining OPERABLE support systems are OPERABLE, thereby ensuring safety function is retained. If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the Specification in which the loss of safety function exists are required to be entered.

When a support system becomes inoperab'le, its associated LC0 ACTIONS are entered. Supported system LCO ACTIONS are not required to be entered when the supported system becomes inoperable solely due to the support system being inoperable. While the support system is inoperable the Completion Time for the support system defines the operating window. Should another system become inoperable that supports the same supported system, then its LCO ACTIONS are also entered, however, the most recent inoperable support system LC0 ACTIONS may not receive the full benefit of its Completion Time. This is because the most restrictive Completion Time is associated with the supported system, ,

even though its LC0 ACTIONS were not formally entered. '

Therefore, operation must be limited in accordance with the limiting Completion Time, regardless of entering the ACTIONS of a LCO.

The following examples are provided for clarification.

(continued)

Crystal River Unit 3 B 3.0-8 Final Draft 10/01/93 l l

-r :.<-m9 m

LCO Applicability B 3.0 BASES LC0 3.0.6 (continued) SUPPORT - SUPPORTED A

\

A, (A 2

/u lG A ,,

3 A,, A, 2 Ay Above is a graphical representation of the .elationships for support and supported SSCs and related LCOs for a single train. SSC A1.1 and A1.2 support SSC Ai, which in turn supports SSC A. SSC Ar.1 and A2.2 support SSC A2, which in turn supports SSC A. For the purpose of the following examples each support SSC is required to be OPERABLE in order to declare its associated supported SSC OPERABLE.

l I

i

-l i

l (continued)

O Crystal River Unit 3 B 3.0-9 Final Draft 10/01/93

LC0 Applicability B 3.0 BASES LC0 3.0.6 Example 1 (continued)

SSC/LCO TIME UNE A v A, e J

A2 o ---

TO T1 T2 TU T4 O

When At is declared inoperable, then the ACTIONS for that SSC are entered (@To). The ACTIONS for A are not entered even though that SSC is determined inoperable (no cascading). In the event that A2 becomes inoperable (OT1) prior to exiting the Action Statement for A1 (@T2), then A2 does not get the full benefit of its own Completion Time

(@T4). Furthermore, A is still inoperable from the time that Ai was initially declared inoperable (9To). A2 must be restored to OPERABLE prior to exceeding the Completion Time associated with A (0T3).

(continued)

Crystal River Unit 3 B 3.0-10 Final Draft 10/01/93 l

l

LC0 Applicability B 3.0 BASES LC0 3.0.6 Example 2 (continued)

SSQLCO TIME UNE A y A, o v :

t A,. e __-

TO T1 T2 T3 T4 O

When A1 is declared inoperable then the ACTIONS for that SSC are entered (OTo). The ACTIONS for'A are not entered even though that SSC is determined inoperable (no cascading). In the event that Ai.1 becomes inoperable (OT1) prior to ;

exiting the ACTIONS for A1 (OT2), then Ai.1 does not get the full benefit of its own Completion Time (OT4.). Furthermore, A is still inoperable from the time that Ai was initially declared inoperable (OTo). The ACTIONS for A1 are exited (OTz), even though Ai.1 being inoperable results in the SSC for Ai inoperable, because of no cascading. A1.1 must be restored to OPERABLE prior to exceeding the Completion Time-associated with A (OTs).

l l

)

l l

1 (continued) l Crystal River Unit 3 8 3.0-11 Final Draft 10/01/93 l

LC0 Applicability B 3.0 BASES LC0 3.0.6 Example 3 (continued) ,

SSCACO TIME UNE A y A, o t

A2 o - - -+

To T1- T2 T3 T4 O

When Ai is declared inoperable then the ACTIONS for that SSC are entered (OTo). The ACTIONS for A are not entered even though that SSC is determined inoperable (no cascading). In the event that A2.2 becomes inoperable (OTi) prior to exiting the ACTIONS for A1 (0T2), then A2.2 does not get the full benefit of its own Completion Time (0T4). Furthermore, A is still inoperable from the time that A1 was initially i declared inoperable (OTo). The ACTIONS for A2 are not entered even though that SSC is determined inoperable (no cascading). A2.2 must be restored to OPERABLE prior to exceeding the Completion Time associated with A (0T3).

i l

(continued)

Crystal River Unit 3 B 3.0-12 Final Draft 10/01/93 l

l i

i

LC0 Applicability B 3.0 BASES LC0 3.0.6 Example 4 (continued)

SSC/LCO TIME UNE A o v___

n A, o TO T1 T2 T3 T4 O

When A1 is declared inoperable then the ACTIONS for that SSC are entered (OTo). The ACTIONS for A are not entered even though that SSC is determined inoperable (no cascading). In the event that A becomes inoperable (OTi) prior to exiting the ACTIONS for A1 (OT2), then A does not get the full benefit of its own Completion Time (0T4). Furthermore, A is still inoperable from the time that At was initially declared inoperable (OTo). A must be restored to OPERABLE prior to exceeding its Completion Time associated (OT3).

4 (continued)

Crystal River Unit 3 8 3.0-13 Final Draft 10/01/93

LC0 Applicability B 3.0 -

BASES (continued)

LCO 3.0.7 There are certain special tests and operations required to be performed at various times over the life of the unit.

These special tests and operations are necessary to demonstrate select unit performance characteristics.

PHYSICS TESTS Exceptions LCOs (Specification 3.1.8 and 3.1.9) allow specified TS requirements to be suspended to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS. Unless otherwise '

specified, all other TS requirements remain unchanged. This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect.

Compliance with PHYSICS TESTS Exception LCO is optional. A special operation may be performed either under the provisions of the appropriate PHYSICS TESTS Exception LC0 or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the PHYSICS TESTS Exception LCO, the requirements of the PHYSICS TESTS Exception LC0 shall be followed. The surveillances of the other LC0 are not required to me met, unless specified in the PHYSICS TESTS Exception LCO.

O Crystal River Unit 3 8 3.0-14 Final Draft 10/01/93 s

SR Applicability ,

B 3.0 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.

SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LC0 apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance-with SR 3.0.2, constitutes a failure to-meet an LCO.

Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that-systems or components are OPERABLE when:

a. The systems or components are known to be inoperable, although still meeting the SRs; or O b. The requirements of the Surveillance (s) are known not' to be met between required Surveillance performances.

Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LC0 are not applicable, ,

unless otherwise specified. The SRs associated with a '

PHYSICS TEST Exception LC0 are only applicable when the .

PHYSICS TEST Exception LCO is used as an allowable exception i to the requirements of a Specification. l Surveillances, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. SRs have to be met in accordance with SR 3.0.2 prior to returning equipment to OPERABLE status.

Upon completion of maintenance, appropriate post maintenance testing is required to declare equipment .

OPERABLE. This includes meeting applicable SRs in l accordance with SR 3.0.2. Post maintenance testing may not ;

be possible in the current MODE or other specified (continued)

Crystal River Unit 3 8 3.0-15 Final Draft 10/01/93 l

l l

l

SR Applicability B 3.0 BASES SR 3.0.1 conditions in the Applicability due to the necessary unit (continued) parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed.

SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic .

performance of the Required Action on a "once per..."

interval.

SR 3.0.2 permits a 25% extension of the interval specified in the frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).

The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications. An example of where SR 3.0.2 does not apply is a Surveillance with a Frequency of "in "

accordance with 10 CFR 50, Appendix J, as modified by approved exemptions." In this case, the requirements of the regulation take precedence over the TS and the TS cannot in and of themselves extend a test interval specified in the regulations. Therefore, there would be a Note in the <

Frequency stating, "SR 3.0.2 is not applicable."

As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per..." basis. The (continued)

O Crystal River Unit 3 B 3.0-16 Final Draft 10/01/93

SR Applicability B 3.0 BASES SR 3.0.2 25% extension applies to each performance after the initial (continued) performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25% extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.

The provisions of SR 3.0.2 are not intended to be used repeatedly merely as an operational- convenience to extend Surveillance intervals or periodic Completion Time intervals beyond those specified. .

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified Frequency. A delay 1

- period of up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or up to the limit of the specified Frequency, whichever is less, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met. -i This delay period provides an adequate time limit to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with Required Actions or other remedial measures that might preclude completion of the Surveillance. The -

basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs.

When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions or operational ,

situations, is discovered not to have been performed when specified, SR 3.0.3 allows the full delay period of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform the Surveillance.

(continued)

O Crystal River Unit 3 B 3.0-17 Final Draft 10/01/93

SR Applicability B 3.0 BASES i

SR 3.0.3 Failure to comply with specified Frequencies for SRs is l (continued) expected to be an infrequent occurrence. Use of the delay l period established by SR 3.0.3 is a flexibility which is not 1 intended to be used as an operational convenience to extend j Surveillance intervals.

If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable Specification Conditions begin immediately upon expiration i of the delay period. If a Surveillance is failed within-the i delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable Specification Conditions begin immediately upon the failure of the Surveillance.

Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.

SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.

This Specification ensures that system and component ,

OPERABILITY requirements and variable limits are met before !

entry into MODES or other specified conditions in the l Applicability for which these systems and components ensure i safe operation of the unit. This Specification applies to '

changes in MODES or other specified conditions in the Applicability associated with unit shutdown as well as startup. However, in certain circumstances, failing to meet .,

an SR will not result in SR 3.0.4 restricting a M07L change l or other specified condition change. When a system, subsystem, train, component,. device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed (per SR 3.0.1).

Surveillances do not have to be. performed on inoperable '

equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed.

(continued).

O l l

Crystal River Unit 3 B 3.0-18 Final Draft 10/01/93

SR Applicability B 3.0 BASES SR 3.0.4 Therefore, failing to perform the Surveillance (s) within the (continued) specified Frequency does not result in an SR 3.0.4 ,

restriction to changing MODES or other specified conditions of the Applicability. However, since the LCO is not met in this instance, LC0 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition ,

changes.

The provisions of SR 3.0.4 shall not prevent entry into MODES or other specified conditions in the Applicability r that are required to comply with ACTIONS.

The precise requirements for performance of SRs are specified-such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs in accordance with the requirements of SR 3.0.4 are specified in the Frequency, in -

the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition (s) specified in a Surveillance procedure require entry into the MODE or-other specified condition in the Applicability of the ;

associated Specification prior to the performance or completion of a Surveillance. A Surveillance that could not O be performed until after entering the Specification Applicability would have its Frequency specified such that it is not "due" until the specific conditions needed are 1

met. Alternately, the Surveillance may be stated in the ;

form of a Note, as not required to be performed until a ;

particular event, condition, or time has been reached. The i SRs are annotated consistent with the requirements of Section 1.4, Frequency.

i i

l i

l A

U l Crystal River Unit 3 8 3.0-19 Final Draft 10/01/93 l 1

I

SDM B 3.1.1 l

B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.1 SHUTDOWN MARGIN (SDM) l BASES BACKGROUND CR-3 FSAR Section 1.4, Criteria 27 and 28 state the reactivity control systems must be independent and capable of holding the reactor core subcritical from any hot standby i or hot operating condition (Ref.1). SDM requirements !

provide sufficient reactivity margin to ensure that acceptable fuel design limits will not be exceeded for normal shutdown and anticipated operational occurrences (A00s). The SDM defines the degree of subtriticality that would be obtained immediately following the insertion of all safety and regulating rods, assuming the single CONTROL R0D assembly of highest reactivity worth is fully withdrawn.

The system design requires that two independent reactivity-control systems be provided. One of these systems is capable of maintaining the core subcritical under cold-conditions. These requirements are provided by the use of ,

movable control assemblies and soluble boric acid in the Reactor Coolant System (RCS). The CONTROL RODS can compensate for the reactivity effects of the fuel and water temperature changes accompanying power level changes over O the range from full load to no load. In addition, the CONTROL RODS, together with the Chemical Addition and Makeup and Purification Systems, provide SDM during power operation and are capable of making the core subcritical rapidly enough to prevent exceeding acceptable fuel damage limits, assuming that the rod of highest reactivity worth remains fully withdrawn.

The Chemical Addition and Makeup and Purification Systems can compensate for fuel dealetion during operation and all xenon burnout reactivity c1anges, and maintain the reactor subcritical under cold conditions.

During power operation, SDM control is ensured by operating with the safety rods fully withdrawn (LCO 3.1.5, " Safety Rod Insertion Limits") and the regulating rods within the limits of LC0 3.2.1, " Regulating Rod Insertion Limits." When the unit is in the shutdown and refueling modes, the SDM requirements are met by means of adjustments to the RCS boron concentration. fdjusted SDM limits defined in the COLR preclude recriticality in the event of a main steam line break (MSLB) in MODE 3, 4, or 5 when high steam generator levels exist.

(continued)

Crystal River Unit 3 B 3.1-1 Final Draft 10/01/93

SDM B 3.1.1 BASES (continued)

APPLICABLE The minimum required SDM is assumed as an initial condition SAFETY ANALYSES in safety analysis. The safety analysO (Ref. 2) establishes an SDM that ensures specified acceptable fuel design limits are not exceeded for normal operation and A00s, with assumption of the highest worth rod stuck out following a reactor trip.

The acceptance criteria for SDM requirements are established to ensure specified acceptable fuel design limits are maintained. The SDM requirements must ensure that:

a. The reactor can be made subcritical from all operating conditions, transients, and Design Basis Events;

b. The reactivity transients associated with postulated accident conditions are controllable with acceptable limits (departure from nucleate boiling ratio (DNBR),

fuel centerline temperature limits for A00s, and s 280 cal /gm fuel enthalpy for the rod ejection accident); and

c. The reactor will be maintained sufficiently subcritical to preclude inadvertent criticality in the O shutdown condition.

The most limiting accident for the SDM requirements is based on an MSLB as described in the accident analysis (Ref. 2).

In addition to the limiting MSLB transient, the SDM requirement was an initial condition assumption in' the analysis of the following:

a. Inadvertent boron dilution;

b. An uncontrolled rod withdrawal from a subcritical or low power condition;

c. Rod ejection; and

d. Return to criticality if an'MSLB occurs during high !

steam generator level operations in MODE 3, 4, or 5.

]

To compensate for the potential heat removal associated with I an MSLB accident when high steam generator levels exist j l

l 1

(continued)

Crystal River Unit 3 B 3.1-2 Final Draft 10/01/93

SDM B 3.1.1 BASES APPLICABLE during secondary system chemistry control and steam SAFETY ANALYSIS generator cleaning, the initial SDM in the core must be (continued) adjusted. The basis for the SDM shutdown requirement when high steam generator levels exist is the heat removal potential in the secondary system fluid and the negative reactivity added via MTC. At any given initial primary system temperature and its associated secondary system pressure, the secondary system liquid levels can be equated to a final primary system temperature assuming the entire mass is boiled. The resulting RCS temperature determines the required SDM.

SDM satisfies Criterion 2 of the NRC Policy Statement.

LC0 SDM requirements assume the highest worth rod is stuck in the fully withdrawn position to account for a postulated untrippable rod prior to reactor shutdown.

The figure in the COLR is used to define the SDM when high steam generator levels exist during secondary system chemistry control and steam generator cleaning in MODES 3, 4, and 5 and represents a series of initial conditions that

' ensure the core will remain subcritical following an MSLB accident initiated from those conditions.

APPLICABILITY In MODES 3, 4, and 5, the SDM requirements ensure sufficient i negative reactivity to meet the assumptions of the safety.

analysis discussed above. In MODES 1 and 2, SDM is ensured by complying with LCO 3.1.5 and LCO 3.2.1. In MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, ,

" Boron Concentration."

ACTIONS A.1 i f

If the SDM requirements are not met, boration must be initiated promptly. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. It is assumed that 1 boration to restore SDM will be continued until the SDM requirements are met. If the SDM is less than the limit (continued)

Crystal River Unit 3 B 3.1-3 Final Draft 10/01/93 i

1

SDM B 3.1.1 BASES ACTIONS El (continued) for the steam generator level and RCS temperature specified i in the COLR or 1% A k/k, RCS boration must be continued until the applicable limit is met.

In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied. Since it is imperative to raise the boron concentration of the RCS as soon as possible, the boron concentration should be a highly concentrated solution, such as that normally found in the boric acid storage tank or the borated water storage tank.

l The operator should borate with the best source available gisen the existing plant conditions.

In determining the boration flow rate, the time in core life-must be considered. For instance, the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle, when the boron concentration may approach or exceed 2000 ppm. For example, pumping a boric acid solution with 11,600 ppm boron at 10 gpm will result in the addition of 1% A k/k negative reactivity in approximately 90 minutes at typical BOC conditions.

Slightly shorter times can be achieved when the same l

O negative reactivity addition is made later in the fuel cycle when the initial RCS boron concentration is lower. Other flowrates and boric acid rupply concentrations can be used to provide equivalent results.

SURVEILLANCE SR 3.1.1.1 REQUIREMENTS The SDM is verified by performing a reactivity balance calculation, considering the following reactivity effects:

a. RCS boron concentration;

b. Regulating rod position;

c. RCS average temperature;

d. Fuel burr % b ed on gross thermal energy generation;

e. Xenon con . ' u ion; and

~

f. Samarium cen > . ration.

(continued)

Crystal River Unit 3 B 3.1-4 Final Draft 10/01/93

SDM B 3.1.1

, BASES SURVEILLANCE SR 3.1.1.1 (continued)

REQUIREMENTS The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on the generally slow change in required boron concentration, and also allows sufficient time for the operator to collect the required data, which includes performing a baron concentration analysis, and complete the calculation.

REFERENCES 1. FSAR, Section 1.4.

2. FSAR, Chapter 14.

1 I

O i

1 l

l O

Crystal River Unit 3 8 3.1-5 Final Draft 10/01/93 1 1

I

Reactivity Balance B 3.1.2 B 3.1 REACTIVITY CONTROL SYSTEMS t

B 3.1.2 Reactivity Balance BASES BACKGROUND According to GDC 26, GDC 28, and GDC 29 (Ref. 1), reactivity '

shall be controllable, such that subcriticality is maintained under cold conditions, and acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences. Therefore, the reactivity balance is used as a measure of the predicted versus measured core reactivity during power operation. The periodic confirmation of core reactivity is necessary to ensure that safety analyses of design basis transients and accidents remain valid. A large reactivity difference could ;

be the result of unanticipated changes in fuel, CONTROL R00, or burnable poison worth, or operation ct conditions not ,

consistent with those assumed in the predictions of core reactivity. These could potentially result in a loss of SDM or violation of acceptable fuel design limitt Comparing predicted versus measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LC0 3.1.1, " SHUTDOWN MARGIN (SDM)") in .

O ensuring the reactor can be brought safely to cold, subcritical conditions.

When the reactor core is critical or in normal power operation, a reactivity balance exists and the net reactivity is zero. A comparison of predicted and measured reactivity is convenient under such a balance, since parameters are being maintained relatively stable under steady state power conditions. The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons, such as burnable absorbers, producing zero net reactivity. Excess reactivity can be inferred from the boron letdown curve (or critical boron curve), which provides an indication of the soluble boron concentration in the Reactor Coolant System (RCS) versus cycle burnup.

Periodic measurement of the RCS boron concentration for comparison with the predicted value with other variables fixed. (ruch as rod height, temperature, pressure, and power), provides a convenient method of ensuring that core reactivity is within design expectations, and that the (continued)

O Crystal River Unit 3 B 3.1-6 Final Draft 10/01/93 1

l l

Reactivity Balance l B 3.1.2.

t BASES BACKGROUND calculational models used to generate the safety analysis I (continued) are adequate. ,

In order to achieve the required fuel cycle energy output, l the uranium enrichment in the new fuel loading and the fuel H remaining from the previous cycle provides excess positive reactivity beyond that required to sustain steady state operation throughout the cycle. When the reactor is critical at RTP and moderator temperature, the excess positive reactivity is offset by burnable absorbers (if any), CONTROL R0DS, whatever neutron poisons (mainly xenon ,

and samarium) are present in the fuel, and the RCS boron '

concentration.

When the core is producing THERMAL POWER, the fuel is being depleted and excess reactivity 'is decreasing. As the fuel ;

depletes, the RCS boron concentration is reduced to decrease <

negative reactivity and maintain constant THERMAL POWER.

The boron letdown curve is based on steady state operation at RTP. Therefore, deviations from the predicted boron ;

letdown curve may indicate deficiencies in the design ;

analysis, deficiencies in the calculational models, or abnormal core conditions, and must be evaluated.

APPLICABLE The acceptance criteria for core reactivity are the SAFETY ANALYSES establishment of the reactivity balance limit to ensure that plant operation is maintained within the assumptions of-the safety analyses.

Accurate prediction of core reactivity is either an explicit :

or implicit assumption in every accident analysis (Ref. 2). l In particular, SDM and reactivity transients, such as CONTROL R00 withdrawal accidents or rod ejection accidents, are very sensitive to accurate prediction of core reactivity. These accident analysis evaluations rely on computer codes which have been qualified against available test data, operating plant data, and analytical benchmarks.

Monitoring reactivity balance ensures that the nuclear methods-provide an accurate representation of the core reactivity.

Design calculations and safety analyses are performed for each fuel cycle for the purpose of pre-determining (continued)

O Crystal River Unit 3 B 3.1-7 Final Draft 10/01/93 l

Reactivity Balance -l B 3.1.2 ]

BASES _ i APPLICABLE reactivity behavior and the RCS boron concentration SAFETY ANALYSES requirements for reactivity control during fuel depletion.

(continued)

The comparison between measured and predicted initial core reactivity provides a normalization for the calculational models used to predict core reactivity. If the measured and predicted RCS boron concentrations for identical core .

conditions at beginning of cycle (B0C) do not agree, then l the assumptions used in the reload cycle design analysis or the calculat!onal models used to predict soluble boron requirements may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at B0C, then the prediction may be normalized to the measured boron concentration. Thereafter, any significant deviations in the measured boron r wcentration from the predicted boron letdown curve, which is developed during fuel depletion, may be an indication that the calculational model is not adequate for core burnups beyond B0C, or that an unexpected change in core conditions has occurred.

The normalization of predicted RCS boron concentration to the measured value is typically performed after reaching RTP following startup from a refueling outage, with the CONTROL ~

O RODS in their normal positions for power operation. The normalization is performed at B0C conditions, so that core reactivity relative to predicted values can be continually monitored and evaluated, as core conditions change during ;

the cycle.

Reactivity balance satisfies Criterion 2 of the NRC Policy Statement.

4 LCO long term core reactivity behavior is a result of the core i physics design and cannot be easily controlled, once the .

core design is fixed. During operation, therefore, the conditions of the LC0 can only be ensured through measurement and tracking, and appropriate actions taken as I necessary. Large differences between actual and predicted core reactivity may indicate that the assumptions of the Design Basis Accident (DBA) and transient analyses are no longer valid, or that the uncertainties in the nuclear <

design methodology are larger than expected. A limit on the !

reactivity of i 1% Ak/k has been established, based on engineering judgment. A 1 1% Ak/k deviation in reactivity l

(continued)

Crystal River Unit 3 8 3.1-8 Final Draft 10/01/93

Reactivity Balance B 3.1.2 -

BASES LC0 from that predicted is larger than expected for normal (continued) operation and should therefore be evaluated.

When measured core reactivity is within 1% Ak/k of the predicted value at steady state thermal conditions, the core is considered to be operating within acceptable design limits. Since deviations from the limit are normally detected by comparing predicted and measured steady state RCS critical baron concentrations, the difference between measured and predicted values would be approximately 100 ppm (depending on the boron worth) before the limit is reached.

These values are well within the uncertainty limits for analysis of boron concentration samples, so that spurious violations of the limit due to uncertainty in measuring the RCS boron concentration are unlikely.

APPLICABILITY In MODES 1 and 2 with k 2 1, the limits on core reactivitymustbemainYa'inedbecauseareactivitybalance must exist when the reactor is critical or producing THERMAL POWER. As the fuel depletes, core conditions are changing, and confirmation of the reactivity balance ensures the core O is operating as designed.

This Specification does not apply in MODES 3, 4, and 5, because the reactor is shutdown and changes to core reactivity due to fuel depletion cannot occur.

In MODE 6 during fuel loading, core reactivity is continually changing. Baron concentration requirements (LC0 3.9.1, " Baron Concentration") ensure that fuel movements are performed within the bounds of the safety analysis, and a SDM demonstration is required during the first startup following operations that could have altered core reactiv'ty (e.g., fuel movement or CONTROL ROD replacement or shuffling).

ACTIONS A.1 and A.2 Should an anomaly develop between measured and predicted !

core reactivity, an evaluation of the core design and safety analysis must be performed. Core conditions are evaluated to determine their consistency with input to design (continued)

O Crystal River Unit 3 B 3.1-9 Final Draft 10/01/93

i Reactivity Balance-B 3.1.2-BASES ACTI0riS A.1 and A.2 (continued) calculations. Measured core and process parameters are evaluated to determine that they are within the bounds of the safety analysis, and safety analysis calculational models are reviewed to verify that they are adequate for representation of the core conditions. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is based on the low probability of a DBA occurring during this period, and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.

Following evaluations of the core design and safety analysis, the cause of the reactivity anomaly may be .,

resolved. If the cause of the reactivity anomaly is a ,

mismatch in core conditions at the time of RCS boron concentration sampling, then a recalculation of the RCS boron concentration requirements may be performed to demonstrate that core reactivity is behaving as expected.

If an unexpected physical change in the condition of the core has occurred, it must be evaluated and corrected, if possible. If the cause of the reactivity. anomaly is in the calculation technique, then the calculational models must be O revised to provide more accurate predictions. If it is concluded that the reactor core is acceptable for continued ,

operation, then the boron letdown curve may be renormalized, and power operation may continue. If operational restrictions or additional surveillance requirements are ;

necessary to ensure the reactor core is acceptable for continued operation, then they must be defined.

The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is adequate for preparing operating restrictions or surveillances that may be required to allow continued reactor operation.

Ikl If the Required Actions and associated Completion Times of Condition A are not mets the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Following plant shutdown, if the SDM for MODE 3 is not met, then action required by Required Action A.1 of LC0 3.1.1 would occur. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is (continued)

O Crystal River Unit 3 B 3.1-10 Final Draft 10/01/93

Reactivity Balance B 3.1.2 j BASES ACTIONS L1 (continued) reasonable, based on operating experience to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.2.1 REQUIREMENTS Core reactivity is verified by periodic comparisons of measured and predicted RCS boron concentrations. The comparison is made considering that other core conditions are fixed or stable, including CONTROL R00 positions, moderator temperature, fuel temperature, fuel depletion, xenon concentration, and samarium concentration. An estimated critical position (ECP) and subsequent criticality within the allowed band satisfies this requirement. The Surveillance is performed once prior to entering H0DE I after each fuel loading as an initial check on core conditions and design calculations at BOC. The next required performance of the SR is at 60 EFPD ( 25% of 31 EFPD). The required subsequent Frequency of 31 EFPD, O following the initial 60 EFPD after entering MODE l-is acceptable, based on the slow rate of core reactivity changes due to fuel depletion and the presence of other indicators (QPT, etc.) for prompt indication of an anomaly.

A Note is included in the SR to indicate that the normalization (if necessary) of predicted core reactivity to the measured value must take place within the first 60 effective full power days (EFPD) after each fuel loading.

This allows sufficient time for core conditions to reach steady state, but prevents operation for a large fraction of the fuel cycle without establishing a benchiark for the design calculations. Another Note is incit.ded in the SRs to indicate that the performance of the Surveillance is not required for entry into MODE 2.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26, GDC 28, and GDC 29.

2. FSAR, Chapter 14 O

Crystal River Unit 3 B 3.1-11 Final Draft 10/01/93

MTC B 3.1.3 8 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.3 Moderator Temperature Coefficient (MTC)

BASES BACKGROUND According to GDC 11 (Ref. 1), the reactor core and its interaction with the Reactor Coolant System (RCS) must be designed for inherently stable power operation, even in the possible event of an accident. In particular,.the net reactivity feedback in the system must compensate for any unintended reactivity increases.

The MTC relates a change in core reactivity to a change in reactor coolant temperature (a positive MTC means that reactivity increases with increasing moderator temperature; conversely, a negative MTC means that reactivity decreases -

with increasing moderator temperature). The reactor is designed to operate with a negative MTC over the largest possible range of fuel cycle operation. Therefore, a coolant temperature increase will cause a reactivity decrease, so that the coolant temperature tends to return toward its initial value. Reactivity-increases that cause a coolant temperature increase will thus be self limiting, and Oi stable power operation will result. Conversely, when the MTC is positive and coolant temperature decreases, power decreases, causing further temperature and power decreases in turn. This causes coolant temperature to spiral downward.

MTC values are predicted at selected burnups during the safety evaluation analysis and are confirmed to be acceptable by measurements. Both initial and reload cores are designed so that the beginning of cycle (B0C) HTC is less than zero when THERMAL POWER is 95% RTP or greater.

The actual value of the MTC is dependent on core charactcristics, such as fuel loading and reactor coolant ,

soluble boron concentration. The core design may require additional burnable absorbers to yield an MTC at BOC within the range analyzed in the plant accident analysis. The end of cycle (E0C) HTC is also limited by the requirements of the accident analysis. Fuel cycles that are designed to achieve high burnups or that have changes to other characteristics are evaluated to ensure the MTC does not exceed the EOC limit.

(continued)

Crystal River Unit 3 B 3.1-12 Final Draft 10/01/93

MTC .

B 3.1.3 BASES (continued)

APPLICABLE Reference 2 contains analyses of accidents that result in SAFETY ANALYSES both overheating and overcooling of the reactor core. MTC is one of the controlling parameters for core reactivity in these accidents. Both the most positive value and most negative value of the MTC are initial conditions in the safety analyses, and both values must be bounded. Values used in the analyses consider worst case conditions, such as '

very large soluble boron concentrations, to ensure the accident results are bounding.

The acceptance criteria for the specified MTC are:

a. The MTC values must remain within the bounds of those used in the accident analysis (Ref. 2); and i b. The MTC must be such that ir.herently stable power operations result during normal operation and accidents, such as overheating and overcooling events.

Accidents that cause core overheating (either decreased-heat removal or increased power production) must be evaluated for results when the HTC is positive. The limiting overheating event relative to plant response is based on the maximum O difference between core power and steam generator heat removal during a transient. The most limiting event with respect to positive MTC are the rod withdrawal accident from zero power, also referred to as a startup accident (Ref. 3) and the rod ejection accident (Ref. 4). ;

1 Accidents that cause core overcooling must be evaluated for l results when the MTC is most negative. The event that produces the most rapid cooldown of the RCS, and is therefore the most limiting event with respect to the .

negative HTC, is a steam line break (SLB) event.- Following l the reactor trip for the postulated E0C SLB event, the large l moderator temperature reduction, combined with the negative ;

MTC, may produce reactivity increases that are as much as 1 the shutdown reactivity. In this case, a substantial I fraction of core power is produced with all CONTROL R0D '

assemblies inserted, except the most reactive one which is assumed to be fully withdrawn. Even if the reactivity ,

increase produces slightly subcritical conditions, a large l fraction of core power may be produced through the effects -l of subcritical neutron multiplication.

1 (continued) !

O ;

Crystal River Unit 3 B 3.1-13 Final Draft 10/01/93

MTC B 3.1.3 l BASES APPLICABLE MTC values are bounded in reload safety evaluations, SAFETY ANALYSES assuming steady state conditions at B0C and E0C. A near E0C (continued) measurement is conducted at conditions when the RCS boron concentration reaches approximately 300 ppm. The. measured value is extrapolated to project the E0C value, or the Surveillance repeated, in order to confirm reload design predictions.

MTC satisfies Criterion 2 of the NRC Policy Statement.

LC0 LCO 3.1.3 requires the MTC to be within specified limits in the COLR to ensure the core operates within the assumptions of the accident analysis. During the reload core safety evaluation, the MTC is analyzed to determine that its values remain within the bounds of the original accident analysis during operation. The LCO establishes a maximum positive value that can not be exceeded. The limit of +0.9E-4 Ak/k/*F on positive MTC, when THERMAL POWER is < 95% RTP, ensures that core overheating accidents will not violate the accident analysis assumptions. The requirement for a negative MTC, when THERMAL POWER is 2 95% RTP, ensures that steady state core operation will be stable at higher power levels. The negative MTC limit for E0C specified in the COLR ensures that core overcooling accidents will not violate the accident analysis assumptions.

MTC is a core physics parameter determined by the fuel and fuel cycle design and cannot be easily controlled once the core design is fixed during operation. Therefore, the LCO can only be ensured through measurement. The B0C and E0C surveillance checks on MTC provide confirmation that the MTC is behaving as anticipated, and the acceptance criteria of the reload safety analysis are met.

APPLICABILITY In MODE 1, the limits on MTC must be maintained to en'sure that any accident initiated from THERMAL POWER operation will not violate the design assumptions of the accident analysis. In MODE 2, the limits must also be maintained to ensure that startup and subtritical accidents, such as the uncontrolled CONTROL R00 assembly or group withdrawal, will not violate the assumptions of the accident analysis. In MODES 3, 4, 5, and 6, this LC0 is not applicable, since no Design Basis Accidents (DBAs) using the MTC as an analysis (continued)

Crystal River Unit 3 8 3.1-14 Final Draft 10/01/93 l

l

)

MTC B 3.1.3 BASES APPLICABILITY assumption are initiated from these MODES. However, the (continued) variation of MTC with temperature in MODES 3, 4, and 5 for DBAs initiated in MODES 1 and 2 is accounted for in the subject accident analysis. The variation of MTC with temperature assumed in the safety analysis is accepted as valid once the B0C measurement is used for normalization.

ACTIONS Ad MTC is a function of the fuel and fuel cycle designs, and cannot be controlled directly once the designs have been implemented in the core. If MTC exceeds its limits, the

, reactor must be p1 c.ed in MODE 3. This eliminates the potential for vir a: lon of the accident analysis bounds.

The associated Cc -

- tion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, considering the ,.cnability of an accident occurring during the tima period that would require an MTC value within the LC0 limits, for reaching MODE 3 conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The following two SRs for measurement of the MTC at the ,

REQUIREMENTS beginning and end of each fuel cycle provide for confirmation-of the limiting MTC values. The MTC changes slowly from most positive (least negative) to most negative value during fuel cycle operation, as the RCS boron concentration is reduced with fuel depletion.

SR 3.1.3.1 The requirement for measurement, once prior to initial o)eration above 5% RTP after each fuel loading, satisfies tie confirmatory check on the most positive (least negative)

HTC value. The measured value is extrapolated from the measurement power level to 95% RTP to ensure MTC is negative at these high power levels. In this way, the positive MTC val .e is verified to be within limits for all MODE 1 and 2 opera.ing conditions. If the extrapolated MTC is within the limit spccified in the COLR but is predicted to be positive at >95% RTP, this measurement may be repeated prior to exceeding 95% RTP.

(continued)

Crystal River Unit 3 B 3.1-15 Final Draft 10/01/93

1 HTC l B 3.1.3 l BASES SURVEILLANCE SR 3.1.3.2 REQUIREMENTS (continued) The requirement for measurement, once within 7 effective full power days (EFPD) after reaching a RTP equilibrium .

boron concentration of 300 ppm, satisfies the confirmatory '

check on the most negative (lecst positive) MTC value. The measurement is performed at any THERMAL POWER equivalent to an RCS boron concentration of 300 ppm (for steady state operation at RTP with all CONTROL RODS fully withdrawn) so that the projected E0C MTC may be evaluated before the reactor actually reaches the E0C condition. MTC values are extrapolated from the measurement burnup to the E0C EFPD and compensated to permit direct comparison to the specified MTC limits.

The SR is modified by two Notes. Note 1 indicates .

performance of SR 3.1.3.2 is not required prior to entering MODE 1 or 2. Since the reactor must be critical in order to obtain meaningful data from the Surveillance, entry into MODE 1 prior to performing the Surveillance is necessary and allowed.

Note 2 indicates that SR 3.1.3.2 may be repeated if MTC is projected to exceed the lower limit prior to the end of the O operating cycle. This subsequent performance must occur prior to exceeding the minimum allowable boron concentration at which MTC is projected to exceed the lower limit. The minimum allowable boron concentration is obtained from the E0C MTC versus boron concentration slope with appro)riate conservatisms. Thus, the extrapolated E0C MTC nay 3e much more conservative than the actual measured value. In any case, shutdown must occur upon exceeding the lower MTC limit (be it projected or measured).

REFERENCES 1. 10 CFR 50, Appendix A, GDC 11.

2. FSAR, Chapter 14.

3. .'5AR, Section 14.1.2.2.

4. FSAR, Section 14.2.2.4.

O Crystal River Unit 3 B 3.1-16 Final Draf t 10/01/93 l

CONTROL R00 Group Alignment Limits i B 3.1.4 8 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.4 CONTROL R00 Group Alignment Limits ,

BASES BACKGROUND The OPERABILITY of the CONTROL RODS (safety rods and is an initial condition assumption in all regulating rods)that assume rod insertion upon reactor trip.

safety analyses Rod alignment is a qualitative initial condition assumption' in the safety analysis that directly affects core power distributions and assumptions of available SDM.

The applicable criteria for these design requirements are FSAR, Section 1.4 Criterion 6 " Reactor Core Design" and Criterion 29 " Reactivity Shutdown Capability" (Ref. 1), and 10 CFR 50.46, " Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plants" (Ref. 2).

Mechanical or electrical failures may cause a CONTROL R00 to -

become inoperable or to become misaligned from its group. l CONTROL R0D inoperability or misalignment may cause increased power peaking, due to the asymmetric reactivity distribution and a reduction in the total available rod O worth for reactor shutdown. Therefore, limits on CONTROL U R00 alignment and OPERABILITY have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.

CONTROL RODS are moved by their CONTROL R0D drive mechanisms (CRDMs). The control rod drive output element is a non-rotating translating lead screw coupled to the CONTROL ROD. :

The screw is driven by anti-friction roller nut assemblies ,

attached to segment arms which are rotated magnetically by a motor stator located outside the pressure boundary. Control rod speed varies (3 in/ min cr 30 in/ min) depending on the signal output from the Control Rod Drive Control System (CRDCS).

The CONTROL RODS are arranged into rod groups that are radially symmetric. Therefore, movement of the CONTROL RODS does not introduce radial asymmetries in the core power distribution. The safety rods and the regulating rods provide required reactivity worth for immediate reactor (continued)

Crystal River Unit 3 B 3.1-17 Final Draft 10/01/93 l

l

CONTROL R0D Group Alignment Limits B 3.1.4 BASES BACKGROUND shutdown upon a reactor trip. The regulating rods provide (continued) RCS temperature and core reactivity (power level) control during normal operation and transients, and their m'.vement is normally dictated by the Integrated Control System.

The axial position of CONTROL RODS is indicated by two separate and independent systems. These are the relative position indicator transducers and the absolute position indicator transducers (see LCO 3.1.7, " Position Indicator Channels and associated Bases").

The relative position indicator transducer is a ;

potentiometer that is driven by a small pulse stepping motor within the CRDCS. There is one counter for each CONTROL R0D drive. Individual rods in a group all receive the same signal to move; therefore, the counters for all rods in a group should indicate the same position. The Relative Position Inoicator System is considered highly precise (A typical single RPI (calibrated after trip) has an indication loop accuracy (at the panel meter) of 1.0%) but is potentially less reliable. If for some reason a rod does not move for each demand pulse, the counter will still count the pulse and incorrectly reflect the position of the rod.

O The Absolute Position Indicator System provides a more reliable indication of actual CONTROL R0D position, but at a lower arecision than relative position indicators. This dual ciannel system is based on inductive analog signals from two parallel series networks of reed switches spaced along the motor tube extension.

4 APPLICABLE CONTROL ROD misalignment accidents are analyzed in the SAFETY ANALYSES safety analysis (Ref. 3). The acceptance criteria for addressing CONTROL R0D inoperability or misalignment are that:

a. Specified acceptable fuel design limits shall not be violated.

b. There shall be no damage to the Reactor Coolant System (RCS) pressure boundary; and

c. The core must remain subcritical after accidents and transients.

(continued)

Crystal River Unit 3 B 3.1-18 Final Draft 10/01/93 I

CONTROL ROD Group Alignment Limits B 3.1.4 D-V BASES APPLICABLE Three types of misalignment are distinguished. During SAFETY ANALYSES movement of a CONTROL R00 group, one rod may stop moving, (continued) while the other rods in the group continue. This condition may cause excessive power peaking. The second type of misalignment occurs if one rod fails to insert upon a reactor trip and remains stuck fully withdrawn. This condition requires an evaluation to determine that sufficient reactivity worth is held in the CONTROL RODS to meet the SDM requirement with the maximum worth rod stuck fully withdrawn. If a CONTROL R0D is stuck in the fully withdrawn position, its worth must be accounted for in the calculation of SDM, in addition to that of the most worthy rod. While this condition is bounded by the SDM calculational conservatisms, the actual stuck rod must be accounted for as well in order to restore the margin inherent to the S0M. The third type of misalignment occurs when one rod drops partially or fully into the reactor core.

This event causes an initial power reduction followed by a return towards the original power due to positive reactivity feedback from the negative moderator tem)erature coefficient. Increased peaking during tie power increase may result in excessive local linear heat rates (LHRs).

The accident analysis and reload safety evaluations define regulating rod insertion limits that ensure the required SDM will be achieved if the maximum worth CONTROL R0D is stuck fully withdrawn (Ref. 4). If a CONTROL ROD is not aligned within 6.5% of its group average' height, continued operation is permitted if the increase in local LHR is within the design limits. .

Continuedoperationofthereactorwithamisalignedpr dropped CONTROL R0D is allowed if the Fo(Z) and the Fi s are verified to be within their limits in the COLR. When a CONTROL R0D is misaligned, the assumptions that are used to determine the regulating rod insertion limits, APSR insertion limits, AXIAL POWER IMBALANCE limits, and QPT limits are not preserved. Therefore, the limits may not preserve the design peaking factors, and Fo(Z) and F"s 6 must be verified directly by incore mapping. Bases Section 3.2, Power Distribution Limits, contains a mory complete discussion of the relation of Fo(Z) and Fan to the operating limits.

(continued)

Crystal River Unit 3 B 3.1-19 Final Draft 10/01/93 .

l I

CONTROL R0D Group Alignment Limits B 3.1.4 BASES

\

APPLICABLE The CONTROL R0D group alignment limits satisfy Criterion 2 SAFETY ANALYSES of the NRC Policy Statement.

(continued)

LC0 The limit for individual CONTROL R0D misalignment is 6.5%

(9 inches) deviation from the group average aosition. This value i., established, based on the distance aetween reed switches, with additional allowances for uncertainty in the absolute position indicator amplifiers, group average amplifier, and asymmetric alarm or fault detector outputs.

The position of an inoperable or misaligned rod is not included in the calculation of the rod group average position.

CONTROL R00 OPERABILITY consists of the rod's ability to insert into the core on a manual or automatic reactor trip signal within the time assumed in the accident analysis.

Additionally, CONTROL ROD position must be known in order to consider the rod to be OPERABLE. The ability to move the rods to respond to reactivity transients is not a credited safety function and is not required for purposes of OPERABILITY.

. O Failure to meet the requirements of this LC0 may produce unacceptable power peaking factors and LHRs, or unacceptable SDM or ejected rod worth, all of which may constitute initial conditions inconsistent with the safety analysis.

APPLICABILITY The requirements on CONTROL R00 OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which neutron (or fission) power is generated, and the OPERABILITY (i.e., trippability) and alignment of rods have the potential to affect the safety of the plant. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the CONTROL RODS are typically bottomed, and the reactor is shut down and not producing fission power. In the shutdown MODES, the OPERABILITY of the safety and regulating rods has the potential to affect the required SDM, but this effect can be compensated for by an increase (continued)

Crystal River Unit 3 B 3.1-20 Final Draft 10/01/93 4

CONTROL R0D Group Alignment Limits B 3.1.4 BASES APPLICABILITY in the boron concentration of the RCS. See LC0 3.1.1, (continued) " SHUTDOWN MARGIN (SDM)," for SDM in MODES 3, 4, and 5, and LCO 3.9.1, " Boron Concentration," which ensures SDM during refueling.

ACTIONS ad Alignment of the inoperable or misaligned CONTROL R0D may be accomplished by either moving the single CONTROL R00 to the group, or by moving the remainder of the group to the position of the single inoperable or misaligned CONTROL ROD.

Either action can be used to restore the CONTROL RODS to a radially synnetric 3attern. However, this must be done without violating tle CONTROL R0D group sequence, overlap, and insertion limits of LC0 3.2.1, " Regulating Rod Insertion Limits," given in the COLR. This may necessitate THERMAL POWER must also be reduced, to maintain compliance with the insertion limits of LCO 3.2.1. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is acceptable because local xenon redistribution during this short interval will not cause a significant increase in LHR. Moving the remainder of the group to meet Required Action A.1 is not allowed if a safety rod is O misaligned, since the limits of LCO 3.1.S, " Safety Rod Insertion Limits," would be violated.

A.2.1.1 and A.2.1.2 If realignment of the CONTROL R00 to the group average or alignment of the group to the misaligned CONTROL R00 cannot be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , SDM must be evaluated. Ensuring the SDM meets the minimum requirement within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is adequate to determine that further degradation of the SDM is not occurring.

If SDM is < 1% A k/k, RCS boration must occur as described in the Bases for Specification 3.1.1. Increasing the RCS boron concentration will restore SDM to within limit and is necessary since the CONTP0L R0D may remain misaligned and not be providing its normal negative reactivity on tripping.

The Completion Time of I hour to initiate boration is reasonable, based on the time required for potential _ xenon redisi.ribution, the low probability of an accident occurring, and the steps required to complete the action.

This allows the operator sufficient time for aligning the chosen boration source injection. Boration will continue until the required SDM is restored.

(continued)

Crystal River Unit 3 B 3.1-21 Final Draft 10/01/93

CONTROL ROD Group Alignment Limits B 3.1.4 BASES ACTIONS A.2.2. A.2.3. A.2.4 and A.2.5 (continued)

Reduction of THERMAL POWER to s 60% of the ALLOWABLE THERMAL POWER ensures that local LHR, due to a misaligned rod, will not cause the core design criteria to be exceeded. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months allows the operator sufficient time for reducing THERMAL POWER.

Reduction of the nuclear overpower trip setpoint to s 70% of the ALLOWABLE THERMAL POWER, after THERMAL POWER has been reduced to 60% of the ALLOWABLE THERMAL POWER, maintains both core protection and an operating margin at reduced power similar to that at RTP. The Completion Time of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months allows a minimum of 8 additional hours after completion of the THERMAL POWER reduction in Required Action A.2.2 to adjust the trip setpoint.

The existing CONTROL R0D configuration must be evaluated to verify the potential ejected rod worth is within the assumption of the rod ejection analysis. The rod worths assumed for this accident are 0.65% Ak/k at RTP or 1.00%

Ak/k at zero power (Ref. 5). This evaluation may require a computer calculation of the maximum ejected rod worth based on nonstandard configurations of the CONTROL R0D groups.

O The evaluation must determine the ejected rod worth for the remainder of the fuel cycle to ensure a valid evaluation.

Should fuel cycle conditions at some later time become more bounding than those at the time of the rod misalignment this verification should be reviewed to ensure its continued ;

validity. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is acceptable because LHRs are limited by the THERMAL POWER reduction and sufficient time is provided to perform the required evaluation.

Performance of SR 3.2.5.1 provides a determination of the power peaking factors using the Incore Detector System.

Verification of Fo(Z) and F,,n from an incore power distribution map ensures that excessive local LHRs will not 4 occur due to CONTROL R0D misalignment. This is necessary l because the assumption that all CONTROL RODS are aligned (used to determine the regulating rod insertion, AXIAL POWER l' IMBALANCE, and QPT limits and bound power peaking limits) is not valid when the CONTROL RODS are not aligned. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is acceptable because LHRs are limited by the THERMAL POWER reduction. The Frequency also allows adequate time to obtain an incore power distribution j map. ,

1 m

(continued) j Crystal River Unit 3 B 3.1-22 Final Draft 10/01/93

)

I

CONTROL R0D Group Alignment Limits i B 3.1.4 '

BASES ACTIONS fL1 (continued)

With the Required Action and associated Completion Time for Condition A not met, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . 'The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power conditions ;n an orderly manner and without challenging plant systems.

C.1.1. C.l.2. and C.2 More than one trippable CONTROL R0D inoperable or not aligned within 6.5% of their group average position, or both, may potentially violate the minimum SDM requirement.

Therefore, SDM must be evaluated. Ensuring the SDM meets the minimum requirement within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allows the operator adequate time to determine the SDM.

If SDH is < 1% A k/k, RCS boration must occur as described in Bases Section 3.1.1. Increasing the RCS boron concentration provides negative reactivity. The Completion >

Time of I hour for initiating boration is reasonable, based O- on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to complete the action. This allows the operator sufficient time for aligning the chosen boration source and beginning injection. Boration will continue until the required SDM is restored.

Continued operation of the reactor in this condition may cause the misalignment to increase, as the regulating rods insert or withdraw to control reactivity. If the CONTROL R00 misalignment increases, local power peaking may also increase, and local LHRs will also increase if the reactor continues operation at THERMAL POWER. The SDM is decreased when one or more CONTROL RODS become inoperable at a given THERMAL POWER level, or if one or more CONTROL RODS become misaligned by insertion from the group average position.

Therefore, it is prudent to place the reactor in MODE 3.

The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

Crystal River Unit 3 8 3.1-23 Final Draft 10/01/93 l

l i

CONTROL R0D Group Alignment Limits B 3.1.4

( BASES ACTIONS D.l.l. D.l.2. and D.2 (continued)

When one or more rods are untrippable, the plant is in a condition outside the accident analysis. Under these conditions, it is important to determine the SDM and, if it is less than the required value, initiate boration until the required SDM is recovered. The Completion Time of I hour is adequate for determining SDM and, if necessary, for initiating emergency boration to restore SDM.

In this condition, SDM verification must include the worth of the untrippable rods as well as the rod of maximum worth.

If the untrippable rod (s) cannot be restored to trippable status, the plant must be placed in a MODE or condition in which the LC0 requirements are not applicable. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

b) b SURVEILLANCE REQUIREMENTS SR 3.1.4.1 Verification that individual rods are aligned within 6.5% of their group average height limits at a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency allows the operator to detect a rod that is beginning to deviate from its expected position. If the asymmetric CONTROL R0D alarm is inoperable, a Frequency of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is necessary considering the reduced monitoring capability.

The specified Frequency takes into account other rod position information that is continuously available to the operator in the control room, so that during actual rod i motion, deviations can immediately be detected. '

SR 3.1.4.2 Verifying each CONTROL ROD is OPERABLE would require that each rod be tripped. However, in MODES 1 and 2, tripping each CONTROL R0D could result in radial tilts. Instead, j exercising each CONTROL ROD every 92 days provides increased confidence that all rods continue to be OPERABLE without exceeding the alignment limit, even if they are not tripped.

Moving each CONTROL R0D by 3% will not cause radial or axial l power tilts, or oscillations, to occur. The 92 day Frequency takes into consideration other information available to the operator in the control room and (continued) v Crystal River Unit 3 3 3.1-24 Final Draft 10/01/93

I CONTROL R00 Group Alignment Limits B 3.1.4 O BASES V

SURVEILLANCE SR 3.1.4.2 (continued)

REQUIREMENTS SR 3.1.4.1, which is performed more frequently and augments the determination of OPERABILITY of the rods. Between required performances of SR 3.1.4.2 (determination of CONTROL R00 OPERABILITY by movement), if a CONTROL ROD (S) is discovered to be immovable, but is determined to be trippable and aligned, the CONTROL ROD (S) is considered to be OPERABLE. At any time, if a CONTROL ROD (S) is immovable, a determination of the tri nability (OPERABILITY) of the CONTROL ROD (S) must be n.idt wd appropriate action taken..

SR 3.1.4.3 Verification of rod drop time ensures that the measured rod drop times are consistent with the assumed rod drop time used in the safety analysis. The rod drop time given in the safety analysis is 1.4 seconds to % insertion. Using the identical rod drop curve gives a value of 1.66 seconds to %

insertion. The latter value is used in the Surveillance because the zone reference lights are located at 25%

insertion intervals. The zone reference lights will activate at % insertion to give an indication of the rod drop time and rod location. Measuring rod drop times, prior Os to reactor criticality after reactor vessel head removal ensures that the reactor internals and CRDM will not interfere with CONTROL R00 motion or rod drop time. This Surveillance is performed prior to reactor criticality, due to the plant conditions needed to perform the SR and the potential for an unplanned plant transient if the Surveillance were performed with the reactor at power.

This testing is normally performed with all reactor coolant pumps operating and average moderator temperature ;t 525'F to simulate to the extent possible, reactor trip under actual conditions. However, if the rod drop times are determined with less than four reactor coolant pumps operating, a Note allows power operation to continue, provided operation is restricted to the pump combination utilized during the rod drop time determination. ,

l l

(continued)

Crystal River Unit 3 B 3.1-25 Final Draft 10/01/93 l

CONTROL R00 Group Alignment' Limits B 3.1.4 BASES (continued)

REFERENCES 1. FSAR, Section 1.4

2. 10 CFR 50.46.

3. FSAR, Chapter Section 14.1.2.7.

4. FSAR, Section 3.1.2.2.

5. FSAR, Section 14.2.2.4.

O !

\

O !

Crystal River Unit 3 B 3.1-26 Final Draft 10/01/93

I Safety Rod Insertion Limit j B 3.1.5 <

B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.5 Safety Rod Insertion limit ,

BASES !

BACKGROUND The insertion limits of the safety and regulating rods are initial condition assumptions in all safety analyses that assume rod insertion upon reactor trip. They ensure negative reactivity is available to shutdown the reactor upon receipt of a reactor trip signal. The insertion limits directly affect core power distributions and assumptions of available SDM, ejected rod worth, and initial reactivity insertion rate.

The ap)licable criteria for the reactivity and power distri aution design requirements are 10 CFR 50, Appendix A, GDC 10, " Reactor Design," GDC 26, " Reactivity Control System Redundancy and Capability", and GDC 28, " Reactivity Limits" (Ref. 1), and 10 CFR 50.46, " Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power P,eactors" (Ref. 2).

Limits on safety rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the reactivity limits, ejected rod O worth, and SDM limits are preserved.

The safety groups are fully withdrawn prior to making the reactor critical. Witndrawal of these rod groups provides available negative reactivity for SDM in the event the reactor must be quickly shutdown and is accomplished manually by the control coom operator. The safety groups remain in the fully withdrawn position until the reactor is shut down.

APPLICABLE On a reactor trip, all rods (safety groups and regulating SAFETY ANALYSES groups), except the most reactive rod, are assumed to insert into the core. The safety groups shall be at their fully withdrawn limits and available to insert the maximum amount of negative reactivity on a reactor trip signal. The regulating groups may be partially inserted in the core as allowed by LC0 3.2.1, " Regulating Rod Insertion Limits."

The safety group and regulating rod insertion limits are established to ensure that a sufficient amount bf negative reactivity is available to shut down the reactor and (continued)

Crystal River Unit 3 B 3.1-27 Final Draft 10/01/93 i

f mal xs s # , l' i3 4~

2 \\\\g <.,

IMAGE EVAL.UATION 4%

\ ' .' 'b ['[z / Ah

\ /o7

,/

TEST TARGET (MT-3) [' ']?

x s

na

,. c .

,///// p

'"2' [{m%

!P y .

l.0 T" F22

"$]j;;2.0 l,l A

?l=la u1 1.25 I I.4 1.6 llse- ll1 1 um n 0,, ,,, _ _

f4 6" - - - - - - - - - - - - - - - - - -

+

r 4

y, g , A / ,s $ s

+

,r,/ ; ,

s,es gNN pW ? y -, .

// r . ,

vHE) l}

^

/

if q3 4

//

x j !

/j/ \/ c I s

[f' IMAGE EVALUATION '7 NO

. e, 4

4 TEST TARGET (MT-3)

\\/// * %? %

Q>h)g

gg

'T l.0 c ,,

pq

!lll 1.8 k5i I.2 5 g =i ;

[

, = = = u =

q ,.3 w

I

'M - - - - - -

- 150mm - - - - - - - _ _ .

f4 6" - - - - - - - - - _ _ _ _ _ _ _ . _ _ .

l

/

';cy

'4g , .,w $ pA,

^c lE !L f'$ f , /////g \ .

^

p' ' ,

Oy ,y 3 g ;..

~ ' ) t

?Mi

a t

% Q+ %)4IMAGE ' ppEVALUATION \\\\\o A<;4&

3

//o//'t,1 [+, %. ?(k TEST TARGET (MT-3) \/ / 'f? /(g

'f ///

v s i- . k5 y:fM

, m g==

p 1.1 J - lg =2.0 4

f.8 l.25 1.4 ;

j J.6 i !

a T

d~ 150mm > ;

4 -_ . -

6" >

t i

6 db

//,oN i

400'

, *N'&p sp& .

@e a /f% _- , __ _ 4g, .

g. ,g/ y- ;g% //,f l r I-s g

e.A d$%

-.;- - - - _ _ . _ . -.- w*" %w.

. .. _ _ _g__ _

. p g g g Q p f k) __ _

O' Y

&e IO

9, *$ 9 g W MF. IMAGE EVALUATION f 4tdtf kf77 ghf* TEST TARGET (MT-3) k eft Y+ &+ %"(4 'k he tk 4

, i' 2 8 [2;5, ;

1,O a 4

_me C hfb l 2.2 )

..===

l

{

b IC ll]=23 l.1 L ;

l.8 l

== <

a 1.25 1.4 1.6 l

I 4- 150mm -> L i

l >

4 6" i i

I

'N

((//

& ")&p 4& f l Es ,%4p 4 >

%,f9j /

~4 9 '/ x' ,

,g

.l. fff (g$>w% o//A .

\\ :: s !

/ r p .y q

e a ,. . . - - --.._ .. - _

$h&'& : ~ & :- = &&On@YbE - - .-a . _ 1 0

f Safety Rod. Insertion Li::;it B.3.1.5 j f).

.u BASES-APPLICABLE maintain the required SDM (see LCO-3.1.1,~" SHUTDOWN MARGIN SAFETY ANALYSES (SDM)") following a reactor trip from full power. The ;

'(continued) combination of regulating groups and safety groups (less the :

most reactive rod, which is assumed.to be fully withdrawn)_ !

~

is sufficient to take the reactor from full power conditions- ,

at rated temperature to zero power and to maintain the required SDM at~the post-reactor trip RCS temperature.

(approximately 555'F). The safety group insertion limit j also limits the reactivity worth of an ejected safety r:

The acceptance criteria for addressing safety and regulating a' rod group insertion limits and inoperability or misalignment are that:

a. Specified acceptable fuel design limits shall not be ,

violated; l

b. There shall be no damage to the RCS pressure boundary integrity; and

c. The core must remain subcritical after accidents and transients.

The safety rod insertion limits satisfy Criteria!2 and 3 of 1 the NRC Policy Statement.

i LCO The safety groups must be fully withdrawn any time the !

reactor is critical or approaching criticality. This ;

! ensures that a sufficient amount.of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip.

i APPLICABILITY The safety groups must be within their insertion. limits with l the reactor in MODES 1 and 2. This ensures that a sufficient amount of negative reactivity is available to shut down!the reactor and maintain the required SDM following a reactor trip. Refer to LC0 3.1.1 for SDM requirements in MODES 3, 4, and 5. LCD 3.9.1, " Boron Concentration," ensures adequate SDM in MODE 6.

t i

(continued).

1 Crystal River Unit 3 B 3.1-28 Final Draft 10/01/93 L

Safety Rod Insertion LLnit B 3.1.5

,m

( ) BASES APPLICABILITY This LC0 has been modified by a Note indicating the LCO (continued) requirement is suspended during SR 3.1.4.2. This SR verifies the freedom of the rods to move, and requires the safety group to move below the LC0 limits, which would normally violate the LCO. This is considered acceptable because the need to perform SR 3.1,4.2 has been judged to take precedence over temporary violation of this LCO.

l ACTIONS A.I. A.2.1.1. A.2.1.2. and A.2.2 With one safety rod not fully withdrawn, I hour is allowed l to fully withdraw the rod. This is necessary because the available SDM may be reduced with one of the safety rods not within insertion limits.

Alternatively, the rod may be declared inoperable within the same 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months time frame. This requires entry into LC0 3.1.4,

" CONTROL R0D Group Alignment Limits." In addition, since the rod may be inserted farther than the group average insertion for a long time, SDM must be evaluated. Ensuring the SDM meets the minimum requirement within I hour is adequate to determine that further degradation of the SDM is not occurring.

Restoration of the required SDM may require increasing the RCS boron concentration, since the CONTROL R0D may remain misaligned and not be providing its normal negative reactivity on tripping. RCS boration must occur as described in Bases Section 3.1.1. The Completion Time of I hour for initiating boration is reasonable, based on the time required for potential xenon redistribution, the low probability of an accident occurring, and the steps required to complete the action. This allows the operator sufficient time for aligning the chosen boration source and beginning injection. Boration will continue until the required SDM is restored. -

The allowed Completion ' Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months provides an acceptable time for evaluating and repairing minor prcblems while restricting plant aperation in an unacceptable condition for an extended period of tfme.

(continued)

Crystal River Unit 3 B 3.1-29 Final Draft 10/01/93 1

I Safety Rod Insertion Limit B 3.1.5 (v~') BASES

-ACTIONS B.1.1. B.1.2 and B.2 (continued)

With more than one safety rod inoperable, there is a possibility that the required SDM may not be within limit.

Under these conditions, it is important to determine the SDM, and if it is less than the required value, initiate boration until the required SDM it recovered. The Completion Time of I hour is adequate for determining SDM and, if necessary, for initiating emergency boration to restore SDM. In this situation, SDM verification must account for the worth of all untrippable rods as well as the rod of maximum worth.

Additionally, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The -

allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power

~

conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.5.1 -

O' REQUIREMENTS Verification that each safety rod is fully withdrawn ensures the rods are available to provide reactor shutdown capability.

Verification that individual safety rod positions are fully withdrawn at a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Freouency allows the operator to detect a rod beginning to aeviate from its expected position. Also, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency takes into account other information available in the control room for the purpose of monitoring the status of the safety rods.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10, GDC 26, and GDC 28,

2. 10 CFR 50.46.

I I

(

Crystal River Unit 3 B 3.1-30 Final Draft 10/01/93

APSR Alignment Limits B 3.1.6 8 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 AXIAL POWER SHAPING R00 (APSR) Alignment Limits BASES BACKGROUND The OPERABILITY of the APSRs and their alignment are initial condition assumptions in the safety analysis that- directly affect core power distributions. The applicable criteria for these power distribution design renuirements are 10 CFR 50, Appendix A, GDC 10, " Reactor Design," and GDC 12

" Suppression of Reactor Power Oscillations" (Ref. 1), and 10 CFR 50.46, " Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors" (Ref. 2).

Mechanical or electrical failures may cause an APSR to become inoperable or to become misaligned from its group. '

APSR inoperability or misalignment may cause increased power peaking, due to.the asymmetric reactivity distribution.

Therefore, APSR alignment and OPERABILITY are related to. ,

core operation within design power peaking limits. '

Limits on APSR alignment and OPERABILITY have been established,.and all rod positions are monitored and controlled during power operation to ensure that the power O distribution limits defined by the design peaking limits are preserved.

CONTROL RODS and APSRs are moved by their CONTROL R0D drive mechanisms (CRDMs). Each CRDM moves its rod % inr5 for one revolution of the leadscrew at varying rates depending on ,

the signal output from the Control Rod Drive Control System.

The APSRs are arranged such that they are radially symmetric. Therefore, movement of the APSRs does not introduce radial asymmetries in the core power distribution.

The function of the AFSRs, is to control the axial power distribution. The rod group is posi,tioned manually and does not trip.

LCO 3.1.6 is conservatively based on use of black (Ag-In-Cd)

APSRs and bounds use of gray (Inconel) APSRs. The reactivity worth of black APSRs is greater than that of gray APSRs; thus the impact of black APSR misalignment on the core power distribution is significantly greater than that of the gray.

l l

(continued) 1 Crystal River Unit 3 B 3.1-31 Final Draft 10/01/93

APSR Alignment Limits '

B 3.1.6 i

BASES (continued)

APPLICABLE There are no explicit safety analyses associated with mis-SAFETY ANALYSES aligned APSRs. However, alignment of the APSRs is required to prevent inducing a QUADRANT POWER TILT. The LCOs governing APSR misalignment are provided because the power ,

distribution analysis supporting LC0 3.2.1, LCO 3.2.2, LCO 3.2.3, and LC0 3.2.4 assumes the rods are aligned. '

Two types of misalignment are distinguished. During .

movement of an APSR group, one rod may stop moving while the other rods in the group continue. This condition may cause excessive power peaking. The reload safety evaluations define APSR alignment limits that allow APSRs to be '

positioned anywhere within the operating band and the increase in local LHR is within the design limits. The Required Actions provide a conservative approach to ensure that continued operation remains within tie bounds of the safety analysis.

No safety analysis take credit for movement of the APSRs.

The APSR alignment limits satisfy Criterion 2 of the NRC Policy Statement.

O LCO The only requirement necessary to consider an APSR OPERABLE is the ability to determine position of the rod (API or RPI).

The limit for individual APSR misalignment is 6.5Y.

(9 inches) deviation from the group average position. This value is established based on the distance between reed switches, with additional allowances for uncertainty in the

, absolute position indicator amplifiers, group maximum or minimum synthesizer, and asymmetric alarm or fault detector outputs. The position of an inoperable or misaligned rod is not included in the calculation of the rod group's average position.

Failure to meet the requirements of this LCO may result in unacceptable power peaking factors, and LHRs, which may constitute initial conditions inconsistent with the safety analysis.

(continued)

Crystal River Unit 3 B 3.1-32 Final Draft 10/01/93

APSR Alignment Limits B 3.1.6 I BASES (continued) l 2

APPLICABILITY The requirements on APSR OPERABILITY and alignment are applicable in MODES I and 2, when the APSRs are not fully l withdrawn because these are the only MODES in which THERMAL POWER is generated, and the OPERABILITY and alignment of rods have the potential to affect the safety of the plant.

OPERABILITY and alignment of the APSRs are not required when they are fully withdrawn because they do not influence core power peaking. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the reactor is shut down and not producing fission power, and excessive local LHRs cannot occur from APSR misalignment. ,

ACTIONS A.1 An alternate to realigning a single misaligned APSR to the group average position is to align the remainder of the APSR group to the position of the misaligned or inoperable APSR, while maintaining APSR insertion in accordance with the limits in the COLR. This restores the alignment requirements. Deviations up.to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months will not cause significant xenon redistribution to occur. Required Action A.1 requires that APSR group movement does not cause O the limits of LC0 3.2.2, " AXIAL POWER SHAPING R00 (APSR)

Insertion Limits," to be exceeded.

fL1 The plant must be placed in a MODE in which the LC0 does not apply if the Required Actions and associated Completion i Times cannot be met. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power conditions '

in an orderly manner and without challenging plant systems.

(continued)

Crystal River Unit 3 B 3.1-33 Final Draft 10/01/93 '

APSR Alignment Limits B 3.1.6 BASES (continued) l SURVEILLANCE SR 3.1.6.1 Verification at a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency that individual APSR Sositions are aligned within 6.5% of the group average 1eight allows detection of an APSR beginning to deviate from ;

its expected position. If the anymmetric CONTROL R00 alarm is inoperable, a 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Frequency is necessary considering the reduced monitoring capability. The specified Frequency ,

takes into account other APSR position information that is ;

continuously available to the operator in the control room l so that during actual rod motion, deviations can immediately l be detected.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10 and GDC 12.

2. 10 CFR 50.46.

O t

s i

O ;

Crystal River Unit 3 0 3.1-34 Final Draft 10/01/93 I

Position Indicator Channels B 3.1.7 83.1 REACTIVITY CONTROL B 3.1.7 Position Indicator Channels BASES BACKGROUND Criterion 12, FSAR Section 1.4 requires (Ref.1),

instrumentation be provided to monitor variables within prescribed operating ranges.

Rod position indication is needed to assess CONTROL R0D &

APSR OPERABILITY and alignment. Refer to the Bases for LC0 3.1.4, 3.1.5, and LC0 3.1.6 for a more detailed discussion on why these parameters and attributes are monitored and controlled.

Two methods of CONTROL R00 and APSR position indication are provided in the CONTROL R0D Drive Control System. The two means are by absolute position indicator and relative position indicator transducers. The absolute position indicator transducer consists of a series of magnetically operated reed switches mounted in a tube parallel to the CONTROL R00 drive mechanism (CRDM) motor tube extension.

Switch contacts close when a permanent magnet mounted on the upper end of the CONTROL R0D assembly JRA) leadscrew O extension comes near. As the leadscrew and CRA move, the switches operate sequentially, adding / removing resistors from a ' bridge' arrangement and producing an analog voltage proportional to position. Other reed switches included in the same tube with the position indicator matrix provide full in and full out limit indications, and absolute position indications at 0%, 25%, 50%, 75%, and 100% travel (called zone reference indicators). The relative position indicator transducer is a potentiometer, driven by a step motor that produces a signal proportional to CONTROL R0D position, based on the electrical pulse steps that drive the CRDM.

The type A-R4C (redundant four channel) absolute position indicator transducer has two parallel sets of voltage divider circuits made up of 36 resistors each, connected in series (channel A and B). One end of 36 reed switches is connected at a junction between each of the resistors of the two parallel circuits. The reed switches making up each circuit are offset, such that the switches for channel A are staggered with the switches for channel B. The type A-R4C is designed such that either two or three reed switches are (continued)

Crystal River Unit 3 8 3.1-35 Final Draft 10/01/93

Position Indicator Channels

.B 3.1.7 BASES w

BACKGROUND closed in the vicinity of the magnet. By its design, the (continued) type A-R4C absolute position indicator provides redundancy, with the two-three-two sequence of pickup and drop out of ,

reed switches to enable a continuity of position signal when a single reed switch fails to close.

The API design allows for bypass of one channel (by means of a toggle switch on the arplifier card) in the event a reed switch fails. :

CONTROL R0D position indicating readout devices located in the control room consist of single CRA position meters and four group average position meters on the Diamond Control Panel Section of the Main Control Board. A selector switch permits either relative or absolute position indication to ,

be displayed on all 68 of the single rod meters. Indicator lights are provided on the single CRA meter panel to indicate when each CRA is fully withdrawn, fully inserted, enabled, or transferred, and whether a CRA position asymmetry alarm condition is present. Indicators on the console show full insertion, full withdrawal, and enabled for motion for each CONTROL R0D group. Identical instrumentation and devices exist for the APSR group. The consequence of continued operation with an inoperable absolute position indicator or relative position indicator channel is a decreased reliability in determining CONTROL R0D position.

APPLICABLE CONTROL R00 and APSR position accuracy is essential during SAFETY ANALYSES power operation. Power peaking, ejected rod worth, or SDM limits may be violated.in the event of a Design Basis Accident (Ref. 2) with CONTROL RODS or APSRs operating outside their limits undetected. Regulating rod, safety rod, and APSR positions must be known in order to verify the core is operating within the group sequence, overlap, design peaking limits, ejected rod worth, and with minimum SDM (LC0 3.1.5, " Safety Rod Insertion Limits"; LCO 3.2.1,

" Regulating Rod Insertion Limits"; and LCO 3.2.2, " AXIAL POWER SHAPING ROD (APSR) Insertion Limits"). The rod positions must also be known in order to verify the alignment limits are preserved (LC0 3.1.4, " CONTROL R0D :

Group Alignment Limits," and LCO 3.1.6, " AXIAL POWER SHAPING (continued)

Crystal River Unit 3 B 3.1-36 Final Draft- 10/01/93

Position Indicator Channels B 3.1.7 BASES APPLICABLE R0D (APSR) Alignment Limits"). CONTROL R00 and APSR SAFETY AWALYSES positions are continuously monitored to provide (continued) operators with information that ensures the plant is operating within the bounds of the accident analysis assumptions. The CONTROL R0D and APSR position indicator .

channels satisfy Criterion 2 of the NRC Policy Statement.

t LC0 LCO 3.1.7 specifies that one absolute position indicator

. channel and one relative position indicator channel be ;

OPERABLE for each CONTROL R0D and APSR.

The agreement between the relative position indicator channel and the absolute position indicator channel, within ,

the limit given in the COLR, provides assurance that relative position indicators are adequately calicrated and can be used for indication of the measuremei.., of CONTROL R00 group position. A deviation of less than the allowable limit, given in the COLR, in position indication for a single CONTROL R0D or APSR, ensures the ability to determine CONTROL R00 group or APSR group average position within 1.5%. This is the value assumed in the reload safety analysis to account for the uncertainty between indicated O and true group average position. An API with one channel bypassed is still capable of determining group average position within the required accuracy and is therefore, still OPERABLE.

These requirements ensure that CONTROL R0D position :

indication during power operation and PHYSICS TESTS is accurate, and that design assumptions are not challenged.

OPERABILITY of the position indicator channels ensures that inoperable, misaligned, or mispositioned CONTROL RODS or APSRs can be detected. Therefore, power peaking and SDM can be controlled within acceptable limits.

APPLICABILITY In MODES 1 and 2, OPERABILITY of position indicator channels is required since CONTROL RODS are withdrawn and the reactor is, or is capable of, generating THERMAL POWER. In MODES 3, 4, 5, and 6, Applicability is not required because the reactor is shut down and is not generating THERMAL POWER.

(continued)

Crystal River Unit 3 B 3.1-37 Final Draft 10/01/93

Position Indicator Channels B 3.1.7 BASES (continued)

ACTIONS A.1 If the relative position indicator channel is inoperable for one or more rods, the position of the rod (s) is still monitored by the absolute position indicator channel for each affected rod. The absolute position indicator channel may be used once it is verified to be OPERABLE. The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable to determine position indicator channel status. Continuing the verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter is acceptable, based on the fact that during normal power operation excessive movement of the groups is not required. Also, if the rod is out of position during this 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period, the probability of a simultaneous occurrence of an event sensitive to the rod position is small.

B.1 and B.2 If the absolute position indicator channel is inoperable for one or more rods, the position of the rod (s) is monitored by the relative position indicator channel for each affected rod. However, the relative position indicator channel is not as reliable a method of monitoring rod position as the O. absolute position indicator because it counts electrical pulse steps driving the CRDM motor rather than actuating a switch located at a known elevation. Therefore, the affected rod's position must be determined with more certainty by actuating one of its zone reference indicator switches. The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months provides the operator adequate time for adjusting the affected rod's position to an appropriate zone reference indicator location. If the rod is out of position during this 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period, the proabability of a simultaneous occurrence of an event sensitive to the rod position is small.

To allow continued operation, the rods with inoperable absolute position indicator channels are maintained at the zone reference indicator position. All other LC0 limits continue to be in effect. This Required Action ensures the rods are maintained at a known core location (as verified by the more reliable reed switch position indication). The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable to determine the (continued)

O Crystal River Unit 3 8 3.1-38 Final Draft 10/01/93

Position Indicator Channels B 3.1.7 BASES ACTIONS B.1 and B.2 (cottinued) affected rods are being maintainec at the zone reference location. Continuing to verify the rod positions every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter is reasonable for ensuring that rod '

position are not changing. The periodic verification is acceptable, based on the fact that during normal power operation excessive movement of the groups is not required. I Also, if the rod is out of position during this 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period, the probability of a simultaneous occurrence of an i event sensitive to the rod position is small. ,

L1 If both the absolute position indicator charnel and relative position indicator channel are inoperable for one or more rods, or if the Required Action and associated Completion ,

Time are not met, the position of the rod (s) is not known with certainty. Therefore, each affected rod must be declared inoperable, and the limits of LC0 3.1.4 or LCO 3.1.6 apply. The Completion Time for declaring the rod (s) inoperable is immediately. Therefore LCO 3.1.4 or O LCO 3.1.6 is entered immediately, and the Completion Times for the appropriate Required Actions in those LCOs apply without delay.

1 SURVEILLANCE SR 3.1.7.1 REQUIREMENTS Verification is required that the Absolute Position Indicator channels and Relative Position Indicator channels agree within the limit given in the COLR. This verification ensures that the Relative Position Indicator channels, which are regarded as the potentially less reliable means of position indication, remain OPERABLE and accurate. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is adequate for verifying that no degradation in system OPERABILITY has occurred.

l l

i I

(continued)

Crystal River Unit 3 8 3.1-39 Final Draft 10/01/93

_=-. -- _ _- - - . - . . . . .

Position Indicator Channels 8 3.1,7 BASES (continued) -

REFERENCES 1. FSAR, Section 1.4

2. FSAR, Section 14.1.2.2, Section 14.1.2.3, Section 14.1.2.6, Section 14.1.2.7, Section 14.2.2.4, and Section 14.2.2.5.

i O :

f 1

i I

O Crystal River Unit 3 8 3.1-40 Final Draft 10/01/93 l

l

PHYSICS TESTS Exceptions-MODE 1 i B 3.1.8 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.8 PHYSICS TESTS Exceptions Systems-MODE 1 BASES BACKGROUND The purpose of this LC0 is to permit PHYSICS TESTS to be conducted by providing exemptions from the requirements of certain other LCOs. The PHYSICS TESTS requirements for reload fuel cycles ensure that the operatii.g characteristics of the core are consistent with the design predictions, and that the core can be operated as designed (Ref. 1).

PHYSICS TESTS procedures are written and approved in i accordance with established guidelines. The procedures include all information necessary to permit a detailed '

execution of testing required to ensure the design intent is met. PHYSICS TESTS are performed in accordance with these procedures, and test results are approved prior to continued power escalation and long term power operation. Examples of PHYSICS TESTS include determination of critical boron concentration, CONTROL R00 group worths, reactivity coefficients, flux symmetry, and core power distribution.

t 1 APPLICABLE It is acceptable to suspend certain LCOs for PHYSICS TESTS SAFETY ANALYSES because reactor protection criteria are preserved by this and other LCOs still in effect and by the SRs. Even if an accident occurs during PHYSICS TESTS with one or more LCOs suspended, fuel damage criteria are preserved because the limits on nuclear hot channel factors, ejected rod worth, ;

and shutdown capability are maintained during the PHYSICS TESTS.

Reference 2 defines requirements for initial testing of the ,

facility, including PHYSICS TESTS. Tables 13-3 and 13-4 (Ref. 3) summarize the zero, low power, and power tests.

Requirements for reload fuel cycle PHYSICS TESTS are given !

in Table 1 ANSI /ANS-19.6.1-1985 (Ref.1). Although these PHYSICS TESTS are generally accomplished within the limits of all LCOs, one or more LCOs must sometimes be suspended to ,

make completion of PHYSICS TESTS possible or practical. 1 (continued)

Crystal River Unit 3 B 3.1-41 Final Draft 10/01/93

i PHYSICS TESTS Exceptions-MODE 1 B 3.1.8 BASES APPLICABLE This is accepttble as long as the fuel design criteria are )

SAFETY ANALYSES not violated. When one or more of the limits specified in: l (continued)

LC0 3.1.4, " CONTROL R00 Group Alignment Limits"; i LCO 3.1.5, " Safety Rod Insertion Limits"; )

LC0 3.1.6, " AXIAL POWER SHAPING R0D_(APSR) Alignment Limits";

LC0 3.2.1, " Regulating Rod Insertion Limits," for the restricted operation region only; LCO 3.2.3, " AXIAL POWER IMBALANCE Operating Limits"; or LC0 3.2.4, " QUADRANT POWER TILT (QPT)"

are suspended for PHYSICS TESTS, the fuel design criteria are preserved by maintaining the nuclear hot channel factors within their limits, maintaining ejected rod worth within limits by restricting regulating rod insertion to within the acceptable operating region or the restricted operating region, by limiting maximum THERMAL POWER, resetting the nuclear overpower trip setpoint and by maintaining SDM

t 1.0% Ak/k. Therefore, surveillance of Fa(Z), Fan, and SDM i is required to verify that their limits are not exceeded.

The limits for the nuclear hot channel factors are specified in the COLR. Refer to the Bases for LC0 3.2.5 for a complete discussion of Fo(Z) and Fis. During PHYSICS TESTS, one or more of the LCOs that normally preserve the Fo(Z) and FIs limits may be suspended. However, the results of the safety analysis are not adversely impacted if verification that Fo(Z) and FIs are within their limits is obtained, while one or more of the LCOs is suspended. Therefore, SRs are placed on Fo(Z) and FIs during MODE 1 PHYSICS TESTS to verify that these factors remain within their limits.

Periodic verification of these factors allows PHYSICS TESTS to be conducted while continuing te maintain the design criteria.

PHYSICS TESTS include measurement of core nuclear parameters i and exercise of control components that affect process '

variables. Among the process variables involved are AXIAL POWER IMBALANCE and QPT, which represent initial condition input (power peaking) for the accident analysis. Also )

involved are the movable control components, i.e., the :

regulating rods and the APSRs, which affect power peaking j and shutdown of the reactor. The limits for these variables are specified for each fuel cycle in the COLR.

(continued)

O Crystal River Unit 3 B 3.1-42 Final Draft 10/01/93

PHYSICS TESTS Exceptions-MODE 1 B 3.1.8 BASES APPLICABLE PHYSICS TESTS satisfy Criteria 2 and 3 of the NRC Policy SAFETY ANALYSES Statement.

(continued)

LC0 This LCO permits individual CONTROL RODS to be positioned outside of their specified group alignment and withdrawal '

limits and to be assigned to other than specified CONTROL ROD groups, and permits AXIAL POWER IMBALANCE and QPT limits to be exceeded during the performance of PHYSICS TESTS. In addition, this LC0 permits verification of the fundamental core characteristics and nuclear instrumentation operation.

~

The requirements of LC0 3.1.4, LCO 3.1.5, LCO 3.1.6, ,

LCO 3.2.1 (for the restricted operation region only), '

LC0 3.2.3, and LC0 3.2.4 may be suspended during the performance of MODE 1 PHYSICS TESTS provided:

a. THERMAL POWER is maintained s 85% RTP;

b. Nuclear overpower trip setpoint on the nuclear power range channels is s 10% RTP higher than the THERMAL POWER at which the test is performed, with a maximum setting of 90% RTP;

c. Fo(Z) and F5s are maintained within the limits specified in the COLR; and

d. SDM is maintained ;t 1.0% Ak/k.

Operation with THERMAL POWER s 85% RTP during PHYSICS TESTS provides an acceptable thermal margin when one or mare of the applicable LCOs is out of specification. Eighty-five percent RTP is consistent with the maximum power level for conducting the intermediate core power distribution test specified in Reference 1. The nuclear overpower trip setpoint is reduced so that a similar margin exists between the steady state condition and trip setpoint as exists during normal operation at RTP.

(continued)

O Crystal River Unit 3 B 3.1-43 Final Draft 10/01/93

PHYSICS TESTS Exceptions-MODE 1 ,

B 3.1.8 BASES (continued)

APPLICABILITY .This LCO is applicable in MODE 1, when the reactor has completed low power testing and is in power ascension, or ,

during power operation with THERMAL POWER > 5% RTP but s 85% RTP. This LCO is applicable for power ascension testing, as defined by Regulatory Guide 1.68 (Ref. 4). In MODE 2, Applicability of this LC0 is not required because- :

LC0 3.1.9, " PHYSICS TESTS Exceptions-MODE 2," addresses PHYSICS TESTS exceptions in MODE 2. In MODES 3, 4, 5, and 6, Applicability is not required because PHYSICS TESTS are not performed in these MODES. ;

ACTIONS A.1 and A.2 If the SDM requirement is not met, boration must be ;

~

initiated within 15 minutes. The Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. The operator should begin boration with the best source available for the plant conditions. Boration will be continued until SDM is ;

within limit. In the determination of the required combination of boration flow rate and boron concentration, !

there is no unique requirement that must be satisfied.

Suspension of PHYSICS TESTS exceptions is also required within one hour. This Action requires restoration of each of the applicable LCOs to within specification. This ,

Completion Time is consistent with, or more conservative l than, those specified for the individual LCOs addressed by PHYSICS TESTS exceptions. ,

lld i If THERMAL POWER exceeds 85% RTP, then I hour is allowed for the operator to reduce THERMAL POWER to within limits or to suspend PHYSICS TESTS exceptions. If the nuclear overpower trip setpoint is not within the specified limits, then l 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed for restoration of the nuclear overpower trip setpoint within limits or to suspend PHYSICS TESTS ;

exceptions.

i i

(continued) ;

O Crystal River Unit 3 B 3.1-44 Final Draft 10/01/93

PHYSICS TESTS Exceptions-MODE 1 B 3.1.8 BASES ACTIONS IL1 (continued)

If the results of the incore flux map indicate that either Fo(Z) or FIs has exceeded its limit, then PHYSICS TESTS exceptions are suspended within one hour. -This action is required because of direct indication that the core peaking factors, which are fundamental initial conditions for the safety analysis, are excessive. Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification.

SURVEILLANCE SR 3.1.8.1 REQUIREMENTS .i Verification that THERMAL POWER is s 85% RTP ensures that additional thermal margin has been established prior to and ,

while invoking PHYSICS TESTS exceptions. The required Frequency of once per hour is reasonable based on i engineering judgment and allows adequate time to determine any degradation of the established thermal margin while invoking PHYSICS TESTS exceptions.

O SR 3.1.8.2 Verification that Fo(Z) and FIs are within their limits ensures that core local linear heat rate and departure from nucleate boiling ratio will remain within their limits.

This is required since one or more of the LCOs that normally control these design limits could potentially be out of specification. The Frequency of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months allows adequate time for collecting a flux nap and for performing the hot channel factor verifications, based on operating experience.

If SR 3.2.5.1 is not met, PHYSICS TESTS exceptions are suspended and the Required Actions of LCO 3.2.5 apply.

1 (continued)

0 t

Crystal River Unit 3 B 3.1-45 Final Draft 10/01/93 1

PHYSICS TESTS Exceptions-MODE 1 B 3.1.8 BASES SURVEILLANCE SR 3.1.8.3 REQUIREMENTS (continued) Verification that the nuclear overpower trip setpoint is within the limit specified for each PHYSICS TEST ensures that core protection at the reduced power level is established and will remain in place while invoking the PHYSICS TESTS exceptions. Performing the verification once every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months allows adequate time for determining any degradation of the established trip setpoint margin while invoking PHYSICS TESTS exceptions.

SR 3.1.8.4 The SDM is verified by performing a reactivity balance calculation, considering the following reactivity effects:

a. Reactor Coolant System (RCS) boron concentration;

b. CONTROL ROD position; '

c. RCS average temperature; ,

d. Fuel burnup based on gross thermal energy generation; and

e. Xenon concentration.

The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on the generally slow ,

change in required baron concentration and on the low ;

probability of an accident occurring without the required SDM.

t i

(continued)

O Crystal River Unit 3 B 3.1-46 Final Draft 10/01/93

PHYSICS TESTS Exceptions-MODE 1 B 3.1.8

, BASES (continued)

REFERENCES 1. ANSI /ANS-19.6.1-1985, December 13, 1985. j

2. FSAR, Section 13.4.8.

3. FSAR, Tables 13-3 and 13-4. 1

4. Regulatory Guide 1.68, Revision 2, August 1978 )

O i

O Crystal River Unit 3 B 3.1-47 Final Draft 10/01/93 l l

i

PHYSICS TESTS Exceptions-MODE 2 ,

B 3.1.9 B 3.1 REACTIVITY CONTROL 8 3.1.9 PHYSICS TESTS Exceptions-MODE 2 BASES BACKGROUND The purpose of this LC0 is to permit PHYSICS TESTS to be conducted by providing exemptions from the requirements of certain other LCOs. The PHYSICS TESTS requirements for reload fuel cycles ensure that the operating characteristics i of the core are consistent with the design predictions, and that the core can be operated as designed (Ref. 1).

PHYSICS TESTS procedures are written and approved in' accordance with established guidelines. The procedures include all information necessary to permit a detailed execution of testing required to ensure that the design intent is met. PHYSICS TESTS are performed in accordance with these procedures, and test results are approved prior to continued power escalation and long term power operation.

Examples of MODE 2 PHYSICS TESTS include determination of critical boron concentration, CONTROL R0D group worth, and reactivity coefficients.

O APPLICABLE Reference 2 defines requirements for initial testing of the SAFETY ANALYSES facility, including PHYSICS TESTS. Tables 13-3 and 13-4 (Ref. 3) summarize the zero, low power, and power tests.

Requirements for reload fuel cycle PHYSICS TESTS are given in Table 1 of ANSI /ANS-19.6.1-1985 (Ref. 1). Although these PHYSICS TESTS are generally accomplished within the limits of all LCOs, conditions may occur when one or more of the LCOs must be suspended to make completion of PHYSICS TESTS possible or practical.

It is acceptable to suspend the following LCOs for PHYSICS TESTS because reactor protection criteria are pre;erved by this and other LCOs still in effect and by the SRs:

LC0 3.1.3, " Moderator Temperature Coefficient (MTC)"; !

LC0 3.1.4, " CONTROL R00 Group Alignment Limits"; ;

LC0 3.1.5, " Safety Rod Insertion Limits"; '

LC0 3.1.6, " AXIAL POWER SHAPING R0D (APSR) Alignment Limits";

LC0 3.2.1, " Regulating Rod Insertion Limits" for the restricted operation region only; and (continued)

Crystal River Unit 3 B 3.1-48 Final Draft 10/01/93

i PHYSICS TESTS Exceptions--MODE 2 B 3.1.9

() BASES APPLICABLE LC0 3.4.E, "RCS Minimum Temperature for Criticality."

SAFETY ANALYSES (continued) Even if an accident occurs during PHYSICS TESTS with one or more LCOs suspended, fuel damage criteria are preserved because the limits on THERMAL POWER and shutdown _ capability are maintained during the PHYSICS TESTS. ,

Shutdown capability is preserved by limiting maximum obtainable THERMAL POWER and maintaining adequate SDM, while invoking MODE 2 PHYSICS TESTS exceptions.

PHYSICS TESTS include measurement of core nuclear parameters or exercise of control components that affect process variables.

PHYSICS TESTS satisfy Criteria 2 and 3 of the NRC Policy Statement.

LCO This LC0 permits individual CONTROL RODS to be positioned outside of their specified group alignment and withdrawal limits and to be assigned to other than specified CONTROL O R0D groups during the performance of PHYSICS TESTS.

addition, this LCO permits verification of the fundamental In core characteristics. -

This LC0 also allows suspension of LLO 3.1.3, LCO 3.1.4, LCO 3.1.5, LC0 3.1.6, LCO 3.2.1, and LC0 3.4.2, provided:

a. THERMAL POWER is s 5% RTP;

b. Nuclear overpower trip setpoints on the nuclear power range channels are set to s 25% RTP; and

. c. SDM is maintained 2 1.0% Ak/k.

1 l

I

APPLICABILITY This LCO is applicable in MODE 2 when the reactor is either sub-critical or THERMAL POWER is s 5% RTP. This LC0 is

, applicable for initial criticality or low power testing, as

defined by Regulatory Guide 1.68 (Ref. 4). In MODE 1, I i (continued)

Crystal River Unit 3 8 3.1-49 Final Draft 10/01/93 i

l

PHYSICS TESTS Exceptions-MODE 2-B 3.1.9 BASES

' APPLICABILITY Applicability of this LC0 is not required because LCO 3.1.8,-

(continued) " PHYSICS TESTS Exceptions," addresses PHYSICS TESTS _

exceptions in MODE 1. In MODES 3, 4, 5, and 6, Applicability is not required because physics testing is not performed in these MODES.

ACTIONS A.1 If THERMAL POWER exceeds 5% RTP, a positive reactivity addition could be occurring, and a nuclear excursion could result. To ensure that local LHR, DNBR, and RCS pressure limits are not violated, the reactor is tripped. The requirement for immediate manual operator action to open the >

CONTROL R00 drive trip breakers without attempts to reduce THERMAL POWER by actuating the control system (i.e., CONTROL R0D insertion or RCS boration underscores the need to quickly terminate the nuclear excursion).

B.1 and B.2 -

If the SDM requirements are not met, boration must be initiated within 15 minutes. A Completion Time of 15 minutes is adequate for an operator to correctly align and start the required systems and components. The operator should begin boration with the best source available for the plant conditions. Boration will be continued until SDM is within limit. In the determination of the required combination of boration flow rate and boron concentration, there is no unique requirement that must be satisfied.

In addition, the PHYSICS TESTS exceptions must be suspended within one hour. Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification. This Completion Time is consistent :

with, or more conservative than, those specified for the ;

individual LCOs addressed by PHYSICS TESTS exceptions.

(continued)

Crystal River Unit 3 B 3.1-50 Final Draft 10/01/93

PHYSICS TESTS Exceptions-MODE 2 B 3.1.9 BASES ACTIONS L1 (continued)

If the nuclear overpower trip setpoint is > 25% RTP, then I hour is allowed to restore the nuclear overpower trip setpoint within limits or to suspend PHYSICS TESTS exceptions. Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable individual LCOs to within specification, in order to ensure that continuity of reactor operation is within initial condition limits. This Completion Time is consistent with, or more conservative than, those specified for the individual LCOs addressed by PHYSICS TESTS exceptions.

SURVEILLANCE SR 3.1.9.1 REQUIREMENTS Verification that THERMAL POWER is s 5% RTP ensures that an adequate margin is maintained between the test THERMAL POWER level and the nuclear overpower trip setpoint. Hourly verification is adequate to determine any change in core conditions, such as xenon redistribution occurring after a THERMAL POWER reduction, that could cause THERMAL POWER to exceed the specified limit.

SR 3.1.9.2 Verification that the nuclear overpower trip setpoint is within the limit specified while invoking PHYSICS TESTS exceptions ensures that core protection at the reduced power level is established and will remain in place while invoking PHYSICS TESTS exceptions. Performing the verification once ,

per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months allows adequate time for determining any degradation of the established trip setpoint margin prior to

, and while invoking PHYSICS TESTS exceptions.

(continued)

O.

Crystal River Unit 3 B 3.1-51 Final Draft 10/01/93

PHYSICS TESTS Exceptions-MODE 2 B 3.1.9 BASES SURVEILLANCE SR 3.1.9.3 REQUIREMENTS (continued) The SDM is verified by performing a reactivity balance calculation, considering the following reactivity effects:

a. RCS boron concentration;

b. CONTROL R0D position;

c. RC5 average temperature;

d. Fuei burnup based on gross thermal energy generation; and

e. Xenon concentration.

The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on the generally slow change in required boron concentration and on the low probability of an accident occurring without the required SDM.

REFERENCES 1. ANSI /ANS-19.6.1-1985, December 13, 1985.

2. FSAR, Section 13.4.8.

3. FSAR, Table 13-3 and Table 13-4.

4. Regulatory Guide 1.68, Revision 2, August 1978.

O Crystal River Unit 3 B 3.1-52 Final Draft 10/01/93 1

l

Regulating Rod Insertion Limits B 3.2.1 B 3.2 POWER DISTRIBUTION LIMITS l B 3.2.1 Regulating Rod Insertion Limits i BASES BACKGROUND The insertion limits of the regul? ing rods are initial condition assumptions used in all dety analyses that assume rod insertion upon reactor trip. The insertion limits directly affect the core power distributions, the worth of a potential ejected rod, the assumptions of available SDM, and the initial reactivity insertion rate. ;

The applicable criteria for these reactivity and power distribution design requirements are described in FSAR ,

Section 1.4, Criterions 6, " Reactor Core Design" and 29, .

" Reactivity Shutdown Capability", (Ref.1), and in 10 CFR !

50.46, " Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plants" (Ref. 2).

Limits on regulating rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are not violated.

The regulating rod groups operate with a predetermined amount of position overlap, in order to approximate a linear relation between rod worth and rod position (integral rod worth). To achieve this approximately linear relationship, the regulating rod groups are withdrawn and operated in a predetermined sequence. The automatic control system i controls reactivity by moving the regulating rod groups in q sequence within analyzed ranges. The group sequence and j overlap limits are specified in the COLR. -

The regulating rods are used for precise reactivity control of the reactor. The positions of the regulating rods are normally controlled automatically by the Integrated Control System (ICS) but can also be controlled manually. They are l capable of adding reactivity quickly compared with borating or diluting the Reactor Coolant System (RCS).

The power density at any point in the core must be limited to maintain specified acceptable fuel design limits, including limits that ensure that the criteria specified in 10 CFR 50.46 (Ref. 2) are not violated. Together, (continued)

O Crystal River Unit 3 B 3.2-1 Final Draft 10/01/93 1

Regulating Rod Insertion Limits .

B 3.2.1 BASES BACKGROUND LCO 3.2.1, " Regulating Rod Insertion Limits," LCO 3.2.2, (continued) "AX1AL POWER SHAPING ROD (APSR) Insertion Limits,"

LC0 3.2.3, " AXIAL POWER IMBALANCE Operating Limits," and LCO 3.2.4, " QUADRANT POWER TILT (QPT)," provide limits on control component operation and on monitored process variables to ensure that the core operates within the Fo(Z) and FIs limits in the COLR. Operation within the Fo(Z) limits given in the COLR prevents power peaks that would exceed the loss of coolant accident (LOCA) limits derived from the analysis of the Emergepcy Core Cooling Systems (ECCS). Operation within the Fu limits given in the COLR prevents departure from nucleate boiling (DNB) during a loss of forced reactor coolant flow accident. In addition to the Fo(Z) and Fis limits, certain reactivity limits are met by regulating rod insertion limits. The regulating rod insertion limits also restrict the ejected CONTROL ROD worth to the values assumed in the safety analysis and maintain the minimum required SDM in MODES I and 2.

This LCO is rquired to minimize fuel cladding failures that breach the primary fission product barrier and release fission products into the reactor coolant in the event of a LOCA, loss of flow accident, ejected rod accident, or other O postulated accidents requiring termination by a Reactor Protection System trip function.

APPLICABLE The fuel cladding must not sustain damage as a result of SAFETY ANALYSES normal operation (Condition I) or anticipated operational occurrences (Condition II). The LCOs governing regulating rod insertion, APSR position, AXIAL POWER IMBALANCE, and QPT preclude core power distributions that violate the following fuel design criteria:

a. During a large break LOCA, the peak cladding temperature must not exceed 2200'F (Ref. 2);

b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95%

confidence level (the 95/95 DNB criterion) that the hot feel rod in the core does not experience a DNB condition (Ref. 7); and

c. During an ajected rod accident, the fuel enthalpy must not exceed 280 cal /gm (Ref. 3).

(contir.ued)

Crystal River Unit 3 B 3.2-2 Final Draft 10/01/93

Regulating Rod Insertion Limits B 3.2.1

() BASES APPLICABLE Fuel cladding damage does not occur when the core is SAFETY ANALYSES operated outside the conditions of these LCOs during normal (continued) operation. However, fuel cladding damage could result if an accident occurs with the simultaneous violation of one or more of the LCOs limiting the regulating rod position, the APSR position, the AXIAL POWER IMBALANCE, and the QPT. This l' potential for fuel cladding damage exists because changes in the power distribution can cause increased power peaking and ,

correspondingly increased local linear heat rates (LHRs).

The SDM requirement is met by limiting the regulating and safety rod insertion limits such that sufficient inserted

reactivity is available in the rods to shut down the reactor to hot zero power with a reactivity margin that assumes that ,

the maximum worth rod remains fully withdrawn upon trip (Ref. 4). Operation at the SOM based regulating rod insertion limit may also indicate that the maximum ejected ,

rod worth could be equal to the limiting value.

i Operation at the regulating rod insertion limits may cause ,

the local core power to approach the maximum allowed linear haat generation rate or peaking factor with the maximum allowed QPT and maximum allowable AXIAL POWER IMBALANCE present.

O. ,

The regulating rod and safety rod insertion limits ensure that the safety analysis assumptions for ejected rod worth, SDM, and power distribution peaking factors remain valid (Refs. 3, 5, and 6).

The regulating rod insertion limits LCO satisfies Criterion 2 of the NRC Policy Statement.

1 LC0 The limits on CONTROL R0D sequence, including group overlap, and insertion positions as defined is the COLR, must be :

maintained because they ensure that the resulting power 3 distribution is within the range of analyzed power distributions and that the SDM and ejected rod worth are maintained.

(continued) ,

Crystal River Unit 3 8 3.2-3 Final Draft 10/01/93 l

l

Regulating Rod Insertion Limits B 3.2.1 O BASES G

LCO The overlap between regulating groups provides more uniform (continued) rates ci reactivity insertion and withdrawal and is imposed to maintain acceptable power peaking during regulating rod motion.

Error adjusted maximum allowable setpoints for regulating rod insertion are provided in the COLR. The setpoints are derived by an adjustment of the measurement system independent limits to allow for THERMAL POWER level uncertainty and rod position errors.

Actual alarm setpoints are more restrictive than the maximum allowable setpoint values to provide additional conservatism between the actual alarm setpoint and the measurement system independent limit.

APPLICABILITY The regulating rod sequence, overlap, and physical insertion limits shall be maintained with the reactor in MODES I and 2. These limits maintain the validity of the assumed power distribution, ejected rod worth, SDM, and reactivity e rate insertion assumptions used in the safety analyses.

t Applicability in MODES 3, 4, and 5 is not required, because neither the power distribution nor ejected rod worth assumptions are exceeded in these MODES. SDM in MODES 3, 4, and 5 is governed by LCO 3.1.1, " SHUTDOWN MARGIN (SDM)."

LC0 3.2.1 has been modified by a Note that suspends the LCO requirement during the performance of SR 3.1.4.2, which verifies the freedom of the rods to move. Dependent on the rod group, this SR results in violation of the LCO limit on sequence and insertion. This is considered acceptable since temporary insertion and withdrawal, in accordance with SR 3.1.4.2, will not impact the core power distribution or shutdown capability significantly.

In MODES 1 and 2, it may be necessary to suspend the Regulating Rod Insertion Limits (for the restricted operation region only) during PHYSICS TESTS per LC0 3.1.8,

" PHYSICS TESTS Exceptions - Mode 1" and LC0 3.1.9, PHYSICS

. TEST Exception: - Mode 2." Suspension of these limits is permissible because the reactor protection criteria are maintained by the remaining LC0(s) governing the three dimensional power distribution and by the Surveillance Requirements of LC0 3.1.8 and LCO 3.1,9.

(continued)

Crystal River Unit 3 B 3.2-4 Final Draft 10/01/93

Regulating Rod Insertion Limits.

B 3.2.1 BASES (continued)

ACTIONS The regulating rod insertion alarm setpoints provided in the-COLR are based on both the initial conditions assumed in the accident analyses and on the SDM. Specifically, separate insertion limits are specified to determine whether the unit is operating in violation of the initial conditions (e.g.,

the range of power distributions) assumed in the accident analyses or whether the unit is in violation of the SDM or ejected rod worth limits. Separate insertion limits are provided because different Required Actions and Completion Times apply, depending on which insertion limit has been violated. The area between the boundaries of acceptable operation and unacceptable operation, illustrated on the regulating rod insertion limit figures in the COLR, is the restricted region. The actions required when operation occurs in the restricted region .are described under Condition A. The actions required when operation occurs in the unacceptable region are described under Condition C.

A.1 and A.2 Operation with the regulating rods in the restricted region shown on the regulating rod insertion figures specified in the COLR or with any group sequence or overlap outside the-limits specified in the COLR potentially violates the LOCA limits), or the loss of flow accident DNB LHR limits (Fo(Z)ln limits).

peaking limits (F The design calculations assume no deviation in nominal overlap between regulating rod groups. However, deviations of 5% of the core height above or below the nominal overlap may be typical and do not cause 1 sienificant differences in core reactivity, in power di aribution, or in rod worth, relative to the design

, calculations. The group sequence must be maintained because j design calculations assune the regulating rods withdraw and l insert in a predetermined ork.r.

For verification that Ft ') a:e fln are within their limits, SR 3.2.5.1 is performed ing .he incore Detector System to obtain a three dimension ,.swer distribution map.

Verification that Fo(Z) and FIs are within their limits ensures that operation with the regulating rods inserted into the restricted region does not violate the ECCS or DNB (continued)

O Crystal River Unit 3 8 3.2-5 Final Draft 10/01/93

1 Regulating Rod Insertion Limits l B 3.2.1 i

BASES l

ACTIONS A.1 and A.2 (continued) )

criteria. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is acceptable in that it allows sufficient time for obtaining a power ,

distribution map and for verifying the power peaking factors. Repeating SR 3.2.5.1 every 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is required to ensure that continued verification of the power peaking factors is performed as core conditions (primarily regulating rod insertion and induced xenon redistribution) change.

Since Required Action A.1 only specifies a " perform", a failure of SR 3.2.5.1 acceptance criteria does not result in ,

a Required Action not met (Condition B of this ;

Specification). However, when SR 3.2.5.1 is not met, the ;

Required Actions of LCO 3.2.5 are applicaole. The conservative power reductions specified by the Required Actions for LC0 3.2.5 ensure the core continues to operate within an acceptable region for the duration of the Completion Time.

Monitoring the power peaking factors Fo(Z) and Fh does not provide verification that the reactivity insertion rate on O the rod trip or the ejected rod worth limit is maintained, because worth is a reactivity parameter rather than a power However, if the COLR figures do not show peaking parameter.

that a rod insertion limit is ejected rod worth limited, then the ejected rod worth is no more limiting than the SDM based rod insertion limit in the core design (Ref. 6).

Ejected rod worth limits are independently maintained by the Required Actions of Conditions A and C.

Indefinite operation with the regulating rods inserted in the restricted region, or in violation of the group sequence or overlap limits, is not prudent. Even if power peaking monitoring per Required Action A.1 is continued, reactivity limits may not be met and the abnormal regulating rod '

insertion or group configuration may cause an adverse xenon redistribution, may cause the limits on AXIAL POWER IMBALANCE to be exceeded, or may adversely affect the long term fuel depletion pattern. Therefore, power peaking ,

monitoring is allowed for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after discovery of failure to meet the requirements of this LCO. This required (continued)

Crystal River Unit 3 B 3.2-6 Final Draft 10/01/93

Regulating Rod Insertion Limits- ;

B 3.2.1 BASES ACTIONS A.1 and A.2 (continued)

Completion Time is reasonable based on the low probability of an event occurring simultaneously with the limit out of specification in this relatively.short time period. In addition, it precludes long term depletion with abnormal group insertions or configurations, thereby limiting the potential for an adverse xenon redistribution.

Ed If the regulating rods cannot be restored within the acceptable operating limits shown on the figures in the COLR .

within the associated Completion Time (i.e., Required Action A.2 not met), then the limits can be restored by redurJag the THERMAL POWER to a value allowed by the regulating rod insertion limits in the COLR. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is sufficient to allow the operator to complete the power reduction in an orderly manner and without challenging the plant systems. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is acceptable, based on the low probability of an event occurring simultaneously with the limit out of O specification in this relatively short time period.

addition, it precludes long term depletion with abnormal In '

group insertions or configurations and limits the potential for an adverse xenon redistribution.

5 C l. C.2.1 and C.2.2 Operation in the unacceptable region shown on the figures in the COLR corresponds to power operation with an SDM less than the minimum required value or with the ejected rod worth greater than the allowable value. The regulating rods may be inserted too far to provide sufficient negative reactivity insertion following a reactor trip and the ejected rod worth may exceed its initial condition limit.

Therefore, the RCS boron concentration must be increased to restore the regulating rod insertion to a value'that preserves the SDM and ejected rod worth limits. The RCS boration must occur as described in Section B 3.1.1. The Completion Time of 15 minutes to initiate boration is (continued)

O - - .

Crystal River Unit 3 B 3.2-7 Final Draft 10/01/93 3 l

Regulating Rod Insertion Limits B 3.2.1 BASES ACTIONS C.I. C.2.1 and C.2.2 (continued) reasonable, based on limiting the potential xenon redistribution, the low probability of an accident occurring in this relatively short time period, and the number of steps required to complete this Action. This period allows the operator sufficient time for aligning the required valves for starting pump (s) in the chosen boration flowpath.

Boration continues until the regulating rod group positions are restored to at least within the restricted operational region, which restores the minimum SDM capability and reduces the potential ejected rod worth to within its limit.

The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for restoring the regulated rod groups to within the restricted operating region shown on the figures in the COLR allows sufficient time for borated water to enter the RCS from the Chemical Addition and Makeup and Purification Systems, thereby allowing the regulating rods to be withdrawn to the restricted region.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is reasonable, based on limiting the potential for an adverse xenon redistribution, the low probability of an accident occurring in this relatively O short time period, and the number of steps required to complete this Action.

In the event that the regulating rod position indication system is found to be inoperable, it is overly conservative to assume the regulating rod insertion licits are not met.

Instead, the affected regulating rods are considered to be inoperable, and the applicable Required Action (s) of LCO 3.1.4, " CONTROL R00 Group Alignment Limits," apply.

The SDM and ejected rod worth limit can also be restored by reducing the THERMAL POWER to a value allowed by the regulating rod insertion limits in the COLR. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is sufficient to allow the operator to complete the power reduction in an orderly manner and without challenging the plant systems. The ?. hour Completion Time is acceptable, based on the low probability of an event occurring simultaneously with the limit out of specification in this relatively short time period. In addition, it precludes long term depletion with abnormal group insertions or configurations and limits the potential for an adverse xenon redistribution.

O (continued)

Crystal River Unit 3 B 3.2-8 Final Draft 10/01/93

Regulating Rod Insertion Limits B 3.2.1

() BASES ACTIONS Q21 (continued)

If the regulating rods cannot be restored to within the acceptable operating limits for the original THERMAL POWER, or if the power reduction cannot be completed within the associated Completion Time, then the plant must be is placed in a MODE in which this LC0 does not apply. This Action ensures that the reactor does not continue operating in violation of the peaking limits, the ejected rod worth, the reactivity insertion rate assumed as initial conditions in the accident analyses, or the required minimum SDM assumed in the accident analyses. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions in an orderly manner and without challenging plant systems. ,

1 SURVEILLANCE SR 3.2.1.1 REQUIREMENTS This Surveillance ensures that the sequence and overlap limits are not violated. A Surveillance Frequency of-Os 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is required depending on whether or not the CONTROL R0D drive sequence alarm is OPERABLE.

Verification that the sequence and overlap are within limits at a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is sufficient to ensure these limits are preserved. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion time is acceptable because little rod motion occurs in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months due to fuel ,

burnup, and the probability of a deviation occurring '

simultaneously with an inoperable sequence monitor in this relatively short time frame is low. Both Frequencies take into account the level of information available in the control room for monitoring the status of the regulating rods.

i SR 3.2.1.2 With an OPERABLE regulating rod insertion limit alarm, verification of the regulating rod insertion limits as specified in the COLR at a Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is 3 sufficient to detect regulating rod banks that may be approaching the group insertion limits, because little rod (continued)

(}

Crystal River Unit 3 B 3.2-9 Final Draft 10/01/93

Regulating Red Insertion Limits B 3.2.1

/ I BASES V

SURVEILLANCE SR 3.2.1.2 (continued)

REQUIREMENTS l motion due to fuel burnup occurs in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . If the insertion limit alarm becomes inoperable, verification of the regulating rod group position at a Frequency of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is sufficient to detect whether the regulating rod groups j may be approaching or exceeding their group insertion i limits. Both Frequencies take into account the level of I information available in the control room for monitoring the ;

status of the regulating rods. l SR 3.2.1.3 Prior to achieving criticality, an estimated critical position for the CONTROL RODS or estimated critical boron concentration is determined. Verification that SDM meets the minimum requirements ensures that sufficient SDM capability exists with the CONTROL RODS at the estimated critical position if it is necessary to shut down or trip the reactor after criticality. The Frequency of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months prior to criticality provides sufficient time to verify SDM fa capability and make the reactor critical.

()

REFERENCES 1. FSAR, Section 1.4.

2. 10 CFR S0.46.

3. FSAR, Section 14.2.2.4.

4. FSAR, Section 3.1.2.2.

5. FSAR, Section 14.

6. CR-3 COLR.

7. BAW-10143P-A, Rev. 1, "BWC Correlation of Critical Heat Flux", April 1985.

( )

'w !

Crystal River Unit 3 B 3.2-10 Final Draft 10/01/93 L

l

APSR Insertion Limits B 3.2.2 O

v B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 AXIAL POWER SHAPING R0D (APSR) Insertion Limits BASES BACKGROUND The insertion limits of the APSRs are initial condition ,

assumptions in all safety analyses that are affected by core power distributions. The applicable criterion for these power distribution design requirements are FSAR Section 1.4, Criterion 6, " Reactor Core Design", (Ref. 1), and 10 CFR 50.46, " Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plants" (Ref. 2).

Limits on APSR insertion have been established, and all APSR positions are monitored and controlled during power operation to ensure that the power distribution defined by the design power peaking limits is maintained. -

The power density at any point in the core must be limited to maintain specified acceptable fuel design limits, including limits that meet the criteria specified in '

Reference 2. Together, LC0 3.2.1, " Regulating Rod Insertion O* Limits," LC0 3.2.2. " AXIAL POWER SHAPING R0D (APSR)

Insertion Limits," LCO 3.2.3, " AXIAL POWER IMBALANCE Operating Limits," and LC0 3.2.4, " QUADRANT POWER TILT (QPT)," provide limits on control component operation and on ,

monitored process variables to ensure that the core operates within the Fo(Z) and Fin limits in the COLR. Operation within the Fo(Z) limits given in the COLR prevents power peaks that exceed the loss of coolant accident (LOCA) limits ;

derived from the analysis of the Emergency Core Cooling Systems (ECCS). Operation within the Fag limits given in .

the COLR prevents departure from nucleate boiling (DNB) during a loss of forced reactor coolant flow accident. The APSRs are not required for reactivity insertion rate on trip or SDM and, therefore, they do not trip upon a reactor trip.

This LCO is required to minimize fuel cladding failures that would breach the primary fission product barrier and release fission products to the reactor coolant in the event of a LOCA, loss of flow accident, ejected rod accident, or other ,

postulated accident requiring termination by a Reactor Protection System trip function.

(continued)

Crystal River Unit 3 B 3.2-11 Final Draft 10/01/93

APSR~ Insertion Limits B 3.2.2 BASES (continued)

APPLICABLE The fuel cladding must not sustain damage.as a result of SAFETY ANALYSES normal operation (Condition I) or anticipated operational occurrences (Condition II). Acceptance criteria for the :

safety and regulating rod insertion, APSR position, AXIAL POWER IMBALANCE, and QPT LCOs preclude core power distributions that violate the following fuel design criteria:

a. During a large break LOCA, the peak cladding temperature must not exceed 2200*F (Ref. 2);

b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95%

confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a DNB l condition (Ref. 4); and

c. During an ejected rod accident, the fuel enthalpy must -

not exceed 280 cal /gm (Ref. 3). ,

Fuel cladding damage does not occur when the core is operated outside these LCOs during normal operation.

However, fuel cladding damage could result should an O,' accident occur simultaneously with violation of one or more of these LCOs. This potential for fuel cladding damage exists because changes in the power distribution can cause increased power peaking and corresponding increased local linear heat rates.

Operation at the APSR insertion limits may approach the maximum allowable linear heat generation rate or peaking !

factor with the allowed QPT present.

The APSR insertion limits satisfy Criterion 2 of the NRC ]

Policy Statement.

l l

LCO The limits on APSR physical insertion as defined in the COLR must be mai ?ained because they serve the function of controlling i.he power distribution within an acceptable l range. l Error adjusted maximum allowable setpoints for APSR insertion are provided in the COLR. The setpoints are derived by adjustment of the measurement system independent (continued)

Crystal River Unit 3 8 3.2-12 Final Draft 10/01/93 l

APSR Insertion Limits l B 3.2.2 i BASES LC0 limits to allow for THERMAL POWER level uncertainty and rod (continued) position errors.

Actual alarm setpoints are more restrictive than the maximum allowable setpoint values to allow for additional conservatism between the actual alarm setpoints and the measurement system independent limits.

APPLICABILITY The APSR physical insertion limits shall be maintained with the reactor in MODES 1 and 2. These limits maintain the power distribution within the range assumed in the accident analyses. In MODE 1, the limits on APSR insertion specified by this LCO maintain the axial fuel burnup design conditions assumed in the reload safety evaluation analysis. In MODE 2, applicability is required because k,,, it 0.99.

Applicability in MODES 3, 4, and 5 is not required, because the power distribution assumptions in the accident analyses would not be exceeded in these MODES.

ACTIONS For steady state power operation, a normal position for APSR insertion is specified in the station operating procedures.

The APSRs may be positioned as necessary for transient AXIAL POWER IMBALANCE control until the fuel cycle design requires them to be fully withdrawn. (Not all CR-3 fuel cycles incorporate APSR withdrawal.) If the fuel cycle design incorporates an APSR withdrawal (usually near end of cycle (E0C)), the APSRs may not be maintained in the fully withdrawn position prior to the fuel cycle burnup for the APSR withdrawal. If this occurs, the APSRs must be restored to their normal inserted position. Conversely, after the fuel cycle burnup for the APSR withdrawal occurs, the APSRs may not be reinserted for the remainder of the fuel cycle. ,

These restrictions ensure the axial burnup distribution that accumulates in the fuel will be consistent with the expected (as designed) distribution.

1 (continued)

Crystal River Unit 3 8 3.2-13 Final Draft 10/01/93

APSR Insertion Limits B 3.2.2 BASES ACTIONS A.1 and A.2 (continued)

For verification that the core parameters Fo(Z) and FIs are within their limits, SR 3.2.5.1 is performed using the Incore Detector System to obtain a three dimensional power distribution map. Successful verification that Fo(Z) and FIs are within their limits ensures that operation with the APSRs inserted or withdrawn in violation of the times specified in plant pr9cedures does not violate either the ECCS or DNB criteria, f6 Gompletion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is reasonable to obtain a powee distribution map and to verify the power peaking factors. Repeating SR 3.2.5.1 every 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is reasonable to ensure that continued verification of the power peaking factors is obtained as core conditions (primarily the regulating rod insertion and induced xenon redistribution) change.

Since Required Action A.1 only specifies a " perform", a failure of SR 3.2.5.1 acceptance criteria does not result in a Required Action not met (Condition B of this Specification). However, when SR 3.2.5.1 is not met, the Required Actions of LCO 3.2.5 are applicable. The conservative power reductions specified by the Required O Actions for LC0 3.2.5 ensure the core continues to operate within an acceptble region for the duration of the Completion Time.

In the event that the APSR position indication system is found to be inoperable, it is overly conservative to assume the APSR insertion limits are not met. Instead, the APSR is considered to be inoperable and the Required Actions of LCO 3.1.6, "APSR Alignment Limits," apply.

Indefinite operation with the APSRs inserted or withdrawn in violation of the times specified in the COLR is not prudent.

Even if power peaking monitoring per Required Action A.1 is continued, the abnormal APSR insertion or withdrawal may cause an adverse xenon redistribution, may cause the limits on AXIAL POWER IMBALANCE to be exceeded, or may affect the long term fuel depletion pattern. Therefore, power peaking monitoring is allowed for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This Completion Time is reasonable based on the low probability of an event occurring simultaneously with the APSR limit out of specification. In addition, it precludes long term (continued)

Crystal River Unit 3 8 3.2-14 Final Draft 10/01/93

i APSR Insertion Limits B 3.2.2 O BASES G

ACTIONS A.1 and A.2 (continued)

I depletion with the APSRs in positions that have not been !

analyzed, thereby limiting the potential for an adverse xenon redistribution. This time limit also ensures that the intended burnup distribution is maintained, and allows the operator sufficient time to reposition the APSRs to correct their positions.

I Because the APSRs are not operated by the automatic control system, manual action by the operator is required to restore ,

the APSRs to the positions specified in the COLR.

L.1 If the APSRs cannot be restored to their intended positions I within the associated Completion Time, then the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This action ensures that the fuel does not continue to be depleted in an unintended burnup distribution. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions in an orderly manner and without challenging plant systems.

i SURVEILLANCE SR 3.2.2.1 i REQUIREMENTS i Verification that the APSRs are within their insertion !

limits at a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is sufficient to ensure that the APSR insertion limits are preserved. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency required for performing this verification is sufficient because APSRs are positioned by manual control and are normally moved infrequently. The probability of a ,

deviation occurring simultaneously with a non-functioning APSR position computer alarm is low in this relatively short time frame. Also, the Frequency takes into account other information available in the control room for monitoring the <

axial power distribution in the reactor core. ]

i REFERENCES 1. FSAR, Section 1.4.

2. 10 CFR 50.46.

1 (continued) .

A Crystal River Unit 3 B 3.2-15 Final Draft 10/01/93 l

APSR Insertion Limits >

B 3.2.2 BASES REFERENCES 3. FSAR, Section 14.2.2.4.

(continued)

4. BAW-10143P-A, Rev. 1, "BWC Correlation of Critical Heat Flux", April 1985.

t O ,

O Crystal River Unit 3 8 3.2-16 Final Draft 10/01/93 l

AXIAL POWER IMtIALANCE uperating Limits B 3.2.3 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.3 AX1AL POWER IMBALANCE Operating Limits BASES BACKGROUND This LC0 is required to limit the core power distribution based on accident initial condition criteria.

The power density at any point in the core must be limited-to maintain specified acceptable fuel design limits, including limits that satisfy the criteria specified in 10 CFR 50.46 (Ref. 1). This LC0 provides limits on AXIAL POWER IMBALANCE to ensure that the core operates within the Fo(Z) and Fls limits given in the COLR. Operation within the Fo(Z) limits given in the COLR prevents power peaks that exceed the loss of coolant accident (LOCA) limits derived from the analysis of the Emergency Core Cooling Systems (ECCS). Operation within the FIs limits given in the COLR prevents departure from nucleate boiling (DNB) during a loss of forced reactor coolant flow accident.

This LC0 is required to limit fuel cladding failures that breach the primary fission product barrier and release O fission products into the reactor coolant in the event of a LOCA, loss of forced reactor coolant flow accident, or other postulated accident requiring termination by a Reactor Protection System trip function. This LCO limits the amount of damage to the fuel cladding during an accident by maintaining the validity of the assumptions in the safety analyses related to the initial power distribution and reactivity.

Fuel cladding failure during a postulated LOCA is limited by restricting the maximum linear heat rate (LHR) so that the peak cladding temperature does not exceed 2200*F (Ref. 1).

Peak cladding temperatures > 2200'F cause severe cladding failure by oxidation due to a Zircaloy water reaction.

Other criteria must also be met (e.g., maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long term cooling). However, peak cladding temperature ,

is usually most limiting. l Proximity to the DNB condition is expressed by the departure from nucleate boiling ratio (DNBR), defined as the ratio of the cladding surface heat flux required to cause DNB to the actual cladding surface heat flux. The minimum DNBR value (continued)

Crystal River Unit 3 B 3.2-17 Final Draft 10/01/93 ;

i I

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 BASES BACKGROUND during both normal operation and anticipated transients is (continued) limited to the DNBR correlation limit for the particular fuel design in use and is accepted as an appropriate margin to DNB. The DNB correlation limit ensures that there is at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB.

The measurement system independent limits on AXIAL POWER IMBALANCE are determined directly by the reload safety '

evaluation analysis without adjustment for measurement system error and uncertainty. Operation beyond these limits could invalidate the assumptions used in the accident analyses regarding the core power distribution.

Core protection from the effects of excessive AXIAL POWER IMBALANCE is accomplished in a tiered approach. The operating envelope limits addressed by this Specification form the first line of defense, are monitored by the operator and compensatory actions initiated when AXIAL POWER ,

IMBALANCE is not within the acceptable region. The AXIAL POWER IMBALANCE' operating limit envelope contained in the

(, COLR represents the setpoint for which the core power g' distribution would either exceed the LOCA LHR limits or cause a reduction in the DNBR below the Safety Limit during :

the loss of flow accident with the maximum allowable QPT present and with the APSR positions consistent with the limitations on APSR withdrawal determined by the fuel cycle design and specified by LCO 3.2.2.

The next line of defense is the Reactor Protection System (RPS) Flux / Delta Flux / Flow trip setpoints. The trip setpoints are addressed in LCO 3.3.1 and are developed by conservatively adjusting the AXIAL POWER IMBALANCE operating limits to account for measurement system inaccuracies and other potential errors. The trip setpoints ensure the >

reactor will be automatically shutdown prior to exceeding a Safety Limit.

The last line of defense is the Safety Limit itself (Reference Section 2.0). If the AXIAL POWER IMBALANCE protective limit specified in the COLR is exceeded, then the operator must take additional actions to preclude conditions .

under which DNB could occur. Even with AXIAL POWER IMBALANCE at the Safety Limit, damage to the fuel will not occur.

(continued)

Crystal River Unit 3 8 3.2-18 Final Draft 10/01/93

AXIAL POWER IMBALANCE Operating Limits ,

B 3.2.3 I BASES BACKGROUND Actual alarm setpoints are more restrictive than the maximum l (continued) allowable setpoint values to provide additional conservatism I between the actual alarm setpoints and the measurement i syr, tem independent (operating) limit.

APPLICABLE The fuel cladding must not sustain damage as a result of SAFETY ANALYSES ermal operation (Condition I) and anticipated operational occurrences (Condition II). The LCOs based on power distribution, LC0 3.2.1, " Regulating Rod Insertion Limits,"

LC0 3.2.2, " AXIAL POWER SHAPING R00 (APSR) Insertion Limits," LCO 3.2.3, " AXIAL POWER IMBALANCE Operating Limits," and LC0 3.2.4, " QUADRANT POWER TILT (QPT),"

preclude core power distributions that would violate the following fuel design criteria:

a. During a large break LOCA, peak cladding temperature must not exceed 2200*F (Ref. 1);

b. During a loss of forced reactor coolant flow accident, there must be at least a 95% probability at the 95%

confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a DNB condition (Ref. 2).

The regulating rod positions, the APSR positions, the AXIAL POWER IMBALANCE, and the QPT are process variables that characterize and control the three dimensional power distribution of the reactor core.

Fuel cladding damage does not occur when the core is operated outside this LC0 during normal operation. However, fuel cladding damage could result should an accident occur with simultaneous violation of one or more of the LCOs governing the four process variables cited above. This potential for fuel cladding damage exists because changes in the power distribution can cause increased power peaking and corresponding increased local LHRs.

The regulating rod insertion, the APSR positions, the AXIAL POWER IMBALANCE, and the QPT are monitored and controlled during power operation to ensure that the power distribution is within the bounds set by the safety analyses. The axial P

(continued)

Crystal River Unit 3 B 3.2-19 Final Draft 10/01/93

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 ,

BASES APPLICABLE power distribution is maintained primarily by the AXIAL SAFETY ANALYSES POWER IMBALANCE and the APSR position limits; and the radial (continued) power distribution is maintained primarily by the QPT limits. The regulating rod insertion limits affect both the radial and axial power distributions.

The dependence of the core power distribution on burnup, regulating rod insertion, APSR position, and spatial xenon distribution is taken into account when the reload safety evaluation analysis is performed.

Operation at the AXIAL POWER IMBALANCE limit must be interpreted as operating the core at the maximum allowable Fa(Z) or FL peaking factors assumed as initial conditions for the accident analyses wit,h the allowed QPT present.

AXIAL POWER IMBALANCE satisfies Criterion 2 of the NRC Policy Statement.

LCO The power distribution LC0 limits have been established c based on correlations between power peaking and easily

( measured process variables: regulating rod position, APSR position, AXIAL POWER IMBALANCE, and QPT. The AXIAL POWER IMBALANCE operating limit envelope contained in the COLR represents the setpoint for which the core power distribution would either exceed the LOCA LHR limits or cause a reduction in the DNBR below the Safety Limit during the loss of flow accident with the allowable QPT present and with the APSR positions consistent with the limitations on APSR withdrawal determined by the fuel cycle design and specified by LC0 3.2.2. ,

APPLICABILITY In MODE 1, the limits on AXIAL POWER IMBALANCE must be maintained when THERMAL POWER is > 40% RTP to prevent the core power distribution from exceeding the LOCA and loss of flow assumptions used in the accident analyses.

Applicability of these limits at < 40% RTP in MODE 1 is not required because the combination of AXIAL POWER IMBALANCE with the maximum ALLOWABLE THERMAL POWER level will not 1

I (continued)

Crystal River Unit 3 B 3.2-20 Final Draft 10/01/93 i

1 l

AXIAL POWER IMBALANCE Operating Limits j B 3.2.3 BASES APPLICABILITY result in LHRs sufficiently large to violate the fuel design (continued) limits. In MODES 2, 3, 4, 5, and 6, this LC0 is not applicable because the reactor is not generating sufficient THERMAL POWER to produce fuel damage.

In MODE 1, it may be necessary to suspend the AXIAL POWER IMBALANCE limits during PHYSICS TESTS per LC0 3.1.8,

" PHYSICS TESTS Exceptions-MODE 1." Suspension of these limits is permissible because the reactor protection criteria are maintained by the remaining LC0(s) governing the three dimensional power distribution and by the Surveillance Requirements of LCO 3.1.8.

ACTIONS A.1 and A.2 ,

The AXIAL POWER IMBALANCE operating limits maintain the validity of the assumptions regarding the power distributions in the accident analyses of the LOCA and the loss of flow accident and are provided in the COLR.

Operation within the AXIAL POWER IMBALANCE operating limits given in the COLR is the acceptable region of operation.

O Operation in violation of the AXIAL POWER IMBALANCE limits given in the COLR is the unacceptable region of operation.

Operation with AXIAL POWER IMBALANCE in the unacceptable '

region shown on the AXIAL P0'4ER IMBALANCE figures in the COLR potentially violates the LOCA LHR limits (Fo({} limits) or the loss of flow accident DNB peaking limits (Fan limits) or both. For verification that Fo(Z) and fin are within their specified limits, SR 3.2.5.1 is performed using the Incore Detector System to obtain a three dimensional power distribution map. Verification that Fo(Z) and F5s are within their specified limits ensures that operation with the AXIAL POWER IMBALANCE in the restricted region does not violate the ECCS or 95/95 DNB criteria. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provides reasonable time to obtain a power-distribution map and verify that the power peaking factors are within their specified limits. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months frequency provides reasonable time to ensure that continued verification of the power peaking factors is obtained as core conditions (primarily regulating red insertion and induced xenon redistribution) change. This is considered (continued)

O Crystal River Unit 3 B 3.2-21 Final Draft 10/01/93

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 BASES i

ACTIONS A.1 and A.2 (continued) acceptable because little rod motion occurs in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months due to fuel burnup, the potential for xenon redistribution is limited, and the probability of an event occurring in this short time frame is low.

Since Required Action A.1 only specifies a " perform", a failure of SR 3.2.5.1 acceptance criteria does not result in.

a Required Action not met (Condition B of this Specification). However, when SR 3.2.5.1 is not met, the Required Actions of LC0 3.2.5 are applicable. The conservative power reductions specified by the Required Actions for LCO 3.2.5 ensure the core continues to operate within an acceptable region for the duration of the Completion Time.

Indefinite operation with the AXIAL POWER IMBALANCE in the restricted region is not prudent. Even if power peaking monitoring per Required Action A.I is continued, excessive AXIAL POWER IMBALANCE over an extended period of time may cause a potentially adverse. xenon redistribution to occur.

Therefore, power peaking monitoring is only allowed for a O maximum of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This Completion Time is reasonable based on the low probability of a limiting event occurring simultaneously with the AXIAL POWER IMBALANCE outside the limits of this LC0. In addition, this Completion Time ,

precludes long term depletion of the reactor fuel with excessive AXIAL POWER IMBALANCE and gives the operator sufficient time to reposition the APSRs or regulating rods to reduce the AXIAL POWER IMBALANCE. This is considered acceptable because adverse effects of xenon redistribution and fuel depletion are limited. ;

L_1 If the Required Actions and the associated Completion Times of Condition A cannot be met, the reactor may be operating ,

with a global axial power distribution mismatch. Continued ;

operation in this configuration may induce an axial xenon l oscillation and may result in an increased linear heat generation rate when the xenon redistributes. Reducing THERMAL POWER to s 40% RTP reduces the maximum LHR to a-value that does not exceed the Fo(Z) and FIs initial condition limits assumed in the accident analyses. The (continued)

Crystal River Unit 3 8 3.2-22 Final Draft 10/01/93 ,

i l

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 BASES ACTIONS B_d (continued)

Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is reasonable based on limiting a potentially adverse xenon redistribution, the low probability of an accident occurring in this relatively ,

short time period, and on operating experience regarding the amount of time required to reach 40% RTP from RTP without challenging plant systems. ;

SURVEILLANCE The AXIAL POWER IMBALANCE can be monitored by both the REQUIREMENTS Incore and Excore Detector Systems. The AXIAL POWER IMBALANCE maximum allowable setpoints in the operating procedure are derived from their corresponding measurement system independent limits (in the COLR) by adjusting for both the system observability errors and. instrumentation errors. Although they are based on the same measurement system independent limits, the setpoints for the different systems are not identical because of differences in the >

errors applicable for each of these systems. The uncertainty analysis that defines the required error adjustment to convert the measurement system independent limits to alarm setpoints assumes that 75% of the detectors in each quadrant are OPERABLE. Detectors located on the core major axes are assumed to contribute one half of their output to each quadrant; detectors in the center assembly are assumed to contribute one quarter of their output to each quadrant. For AXIAL POWER IMBALANCE measurements using the Incore Detector System, the Minimum Incore Detector System consists of detectors configured as follows:

a. Nine detectors shall be arranged such that there are three detectors in each of three strings and there are three detectors lying in the same axial plane, with one plane at the core midplane and one plane in each '

axial core half;

b. The axial planes in each core half shall be symmetrical about the core midplane; and

c. The detector strings shall not have radial symmetry.

(continued) ,

Crystal River Unit 3 8 3.2-23 Final Draft 10/01/93

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 O BASES SURVEILLANCE Figure B 3.2.3-1 (Minimum Incore Dccictor System for AXIAL REQUIREMENTS POWER IMBALANCE Measurement) depicts an example of this (continued) configuration. This arrangement is chosen to reduce the uncertainty in the measurement of the AXIAL POWER IMBALANCE by the Minimum Incore Detector System. For example, the requirement for placing one detector of each of the three strings at the core midplane puts three detectors in the central region of the core where the neutron flux tends to be higher. It also helps prevent measuring an AXIAL POWER IMBALANCE that is excessively large when the reactor is operating at low THERMAL POWER levels. The third requirement for placement of detectors (i.e., radial asymmetry) reduces uncertainty by measuring the neutron flux at core locations that are not radially symmetric.

^

SR 3.2.3.1 If the plant computer becomes inoperable, then the Excore System or Minimum Incore Detector System may be used to monitor the AXIAL POWER IMBALANCE. Although these systems do not provide a dirrat calculation and display of the AXIAL POWER IMBALANCE, a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Frequency provides reasonable time O between calculations for detecting any trends in the AXIAL POWER IMBALANCE that may exceed its alarm setpoint and for undertaking corrective action.

When the AXIAL POWER IMBALANCE alarm is OPERABLE, the operator receives an alarm if the AXIAL POWER IMBALANCE increases to its alarm setpoint. Verification of the AXIAL POWER IMBALANCE indication every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that the AXIAL POWER IMBALANCE limits are not violated. This Surveillance Frequency is acceptable because the mechanisms that can cause AXIAL POWER IMBALANCE, such as xenon redistribution or CONTROL R00 drive mechanism malfunctions that cause slow AXIAL POWER IMBALANCE increases, would likely be discovered by the operator before the specified limits are violated.

REFERENCES 1. 10 CFR 50.46.

2. BAW-10143P-A, Rev. 1, "BWC Correlation of Critical Heat Flux", April 1985.

O Crystal River Unit 3 8 3.2-24 Final Draf t 10/01/93

.__ ._ . _ _ . _ __ _ _ _ _ . __ . . _ . ~ . __.

AXIAL POWER IMBALANCE Operating Limits B 3.2.3 O

k i g Lack Radial Symmetry ;

~ ~ "

y ~~**~ ~ .*% .= " ,

E

[e f *',,,e f 3

\

'/

/ Top Axial Core IIalf l

.a

) Q(%Q. . < -==

. /

A

@ "~

i

.h y *'"~~~ '% ,

{ '

~% ,

lg ** Axial Midplane 2

e 8

M m -

- _. -)N y %

7 [4 [

, , , - o

\ N Bottom AxialCore 4, 1 U

( \ / / IIalf

\ ' _~

a ' ,.,,

/ N

/ N,

)

, A/

l

-i 1

figure B 3.2.3-1 (page 1 of 1)

Minimum Incore System for AXIAL POWER IMBALANCE Measurement O

Crystal River Unit 3 B 3.2-25 Final Draft 10/01/93

.l

1 l

QPT B 3.2.4

[ B 3.2 POWER DISTRIBUTION LIMITS ;

B 3.2.4 QUADRANT POWER TILT (QPT)

BASES BACKGROUND This LC0 is required to limit the core power distribution based on accident initial condition criteria.

The power density at any point in the core must be limited to maintain specified acceptable fuel design limits, including limits that preserve the criteria specified in 10 CFR 50.46 (Ref. 1). Together, LC0 3.2.1, " Regulating Rod Insertion Limits," LCO 3.2.2, " AXIAL POWER SHAPING R0D (APSR) Insertion Limits," LC0 3.2.3, " AXIAL POWER IMBALANCE '

Operating Limits," and LCO 3.2.4, " QUADRANT POWER TILT (QPT)," provide limits on control component operation and on monitored process variables to ensure that the core operates within the Fo(Z) and Fls limits given in the COLR.

Operation within the Fo(Z) limits given in the COLR prevents power peaks that exceed the loss of coolant accident (LOCA) limits derived by Emergency Core Cooling Systems (ECCS) analysis. Operation within the F5s limits given in the COLR p prevents departure from nucleate boiling (DNB) during a loss of forced reactor coolant flow accident.

This LCO is required to limit fuel cladding failures that breach the primary fission product barrier and release fission products to the reactor coolant in the event of a LOCA, loss of forced reactor coolant flow, or other accident requiring termination by a Reactor Protection System trip function. This LC0 limits the amount of damage to the fuel cladding during an accident by maintaining the validity of the assumptions used in the safety analysis related to the initial power distribution and reactivity.

Fuel cladding failure during a postulated LOCA is limited by restricting the maximum linear heat rate (LHR) so that the peak cladding temperature does not exceed 2200*F (Ref. 1).

Peak cladding temperatures > 2200*F cause severe cladding failure by oxidation due to a Zircaloy water reaction.

Other criteria must also be met (e.g., maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long term c'ooling). However, peak cladding temperature is usually most limiting.

(continued)

Crystal River Unit 3 B 3.2-26 Final Draft 10/01/93

QPT B 3.2.4 BASES BACKGROUND Proximity to the DNB condition is expressed by the departure (continued) from nucleate boiling ratio (DNBR), defined as the ratio of the cladding surface heat flux required to cause DNB to the actual cladding surface heat flux. The minimum DNBR value during both normal operation and anticipated transients is i limited to the DNBR correlation limit for the particular fuel design in use, and is accepted as an appropriate margin to DNB. The DNBR correlation limit ensures that there is at ;

least 95% probability at the 95% confidence level (the l 95/95 DNB criterion) that the hot fuel rod in the core does ,

not experience DNB. l The measurement system independent limits on QPT are determined directly by the reload safety evaluation analysis without adjustment for measurement system error and uncertainty. Operation beyond these limits could invalidate core power distribution assumptions used in'the accident analysis. The error adjusted maximum allowable alarm setpoints (measurement system dependent limits) for QPT are specified in the COLR.

O APPLICABLE SAFETY ANALYSES The fuel cladding must not sustain damage as a result of normal operation (Condition I) and anticipated operational occurrences (Condition II). The LCOs based on power distribution (LC0 3.2.1, LCO 3.2.2, LC0 3.2.3, and LC0 3.2.4) preclude core power distributions that violate the following fuel design criteria:

a. During a large break LOCA, the peak cladding temperature must not exceed 2200*F (Ref. 1).

b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95%

confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a DNB condition (Ref. 3).

QPT is one of the process variables that characterize and control the three dimensional power distribution of the reactor core.

Fuel cladding damage does not occur when the core is operated outside this LC0 during normal operation. However, fuel cladding damage could result if an accident occurs with (continued)

O Crystal River Unit 3 B 3.2-27 Final Draft 10/01/93 1 1

a QPT B 3.2.4 BASES APPLICABLE simultaneous violation of one or more of the LCOs governing SAFETY ANALYSES the core power distribution. Changes in the power (continued) distribution can cause increased power peaking and correspondingly increased local LHRs.

The dependence of the core power distribution on burnup, regulating rod insertion, APSR position, and spatial xenon distribution is taken into account during the reload safety evaluation analysis. An allowance for QPT is accommodated in the analysis and resultant LC0 limits. The increase in peaking taken for QPT is developed from a database of full-core power distribution calculations (Ref. 2). The calculations consist of simulations of many power distributions with tilt causing mechanisms (e.g., dropped or misaligned CONTROL RODS, broken APSR fingers fully inserted, misloaded assemblies, and burnup gradients). An increase of

< 2% peak power per 1% QPT is supported by the analysis, therefore a value of 2% peak power increase per 1% QPT is used to bound peak power increases due to QPT.

QPT satisfies Criterion 2 of the NRC Policy Statement.

O LC0 The power distribution LC0 limits have been established based on correlations between power peaking and easily ,

measured process variables: regulating rod position, APSR position, AXIAL POWER IMBALANCE, and QPT. The regulating rod insertion limits and the AXIAL POWER IMBALANCE operating limit envelope contained in the COLR represent the measurement system independent limits at which the core power distribution either exceeds the LOCA LHR limits or causes a reduction in DNBR below the safety limit during a loss of flow accident with the allowable QPT present and .

with an APSR position consistent with the limitations on APSR withdrawal determined by the fuel cycle design and specified by LC0 3.2.2.

Operation beyond the power distribution based LC0 limits for the corresponding allowable THERMAL POWER and simultaneous occurrence of one of a LOCA, loss of forced reactor coolant flow accident, or ejected rod accident has an acceptably low probability. Therefore, if these LC0 limits are violated, a short time is allowed for corrective action before a significant power reduction is required.

(continued)

O Crystal River Unit 3 B 3.2-28 Final Draft 10/01/93

QPT B 3.2.4 BASES 1

LCO The maximt.m allowable setpoints for steady state, transient, (continued) and maximum limits for QPT applicable for the full symmetrical Incore Detector System, Minimum Incore Detector System, and Excore Detector System are provided; the l setpoints are given in the COLR. The setpoints.for the three systems are derived by adjustment of the measurement- ',

system independent QPT limits given in the COLR to allow for system observability and instrumentation errors. j Power level-dependent tilt limits are given for 160% RTP .

I and < 60% RTP. This is done to provide greater operational l flexibility and considers LHRs are less restrictive at lower power levels.

Actual alarm setpoints are more restrictive than the maximum :

allowable setpoint values to allow for additional 'l conservatism between the actual alarm setpoint and the measurement system independent limit.

It is desirable for an operator to retain the ability to operate the reactor when a QPT exists. In certain instances, operation of the reactor with a QPT may be helpful or necessary to discover the cause of the QPT. The combination of power level restriction with QPT in the I Required Actions restricts the local LHR to a safe level, allowing movement through the specified applicability conditions in the exception to LCO 3.0.4.

APPLICABILITY In MODE 1, the limits on QPT must be maintained when THERMAL l POWER is > 20% RTP to prevent the core power distribution l from exceeding the design limits. The minimum power level of 20% RTP is large enough to obtain meaningful QPT indications without compromising safety. Operation in MODE I at or below 20% RTP and MODE 2 with QPT > 20% is acceptable because the resulting maximum LHR is not high enough to cause violation of the LOCA LHR limit (Fo(Z) limit) or the initial condition DNB allowable peaking limit (FEa limit) during accidents initiated from this power level. Therefore, applicability in these-plant conditions is not required.

In MODES 3, 4, 5, and 6, this LCO is not applicable, because the reactor is not generating THERMAL POWER and QPT is indeterminate.

l 1

(continued)

Crystal River Unit 3 8 3.2-29 Final Draft 10/01/93 l

QPT.

B 3.2.4 BASES APPLICABILITY In MODE 1, it may be necessary to suspend the QPT limits (continued) during PHYSICS TESTS per LC0 3.1.8, " PHYSICS TESTS Exceptions-MODE 1." Suspension of these limits is permissible because the reactor protection criteria are maintained by the remaining LC0(s) governing the three dimensional power distribution and by the Surveillance Requirements of LCO 3.1.8.

ACTIONS A.1.1. A.1.2.1. A.I.2.2. and A.2 The steady state limit specified in the COLR provides an allowance for QPT that may occur during normal operation. A peaking increase to accommodate QPTs up to the steady state limit is allowed by the regulating rod insertion limits of LC0 3.2.1 and the AXIAL POWER IMSALANCE limits of LC0 3.2.3.

Operation with QPT greater than the steady state limit specified in the COLR potentially violates the LOCA LHR limits (Fg(Z) limits), or loss of flow accident DNB peaking limits Fan limits), or both. For verification that Fo(Z) and FI.,(are within their specified limits, SR 3.2.5.1 is performed using the Incore Detector System to obtain a three dimensional power distribution map. Verification that Fo(Z) andFin are within their limits ensures that operation with QPT greater than the steady state limit does not violate the ECCS or 95/95 DNB criteria. The Completion Time of once per 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is a reasonable amount of time to obtain a power distribution map and to verify the power peaking factors.

Repeating SR 3.2.5.1 every 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is reasonable to ensure that continued verification of the power peaking factors is obtained as core conditions that influence QPT change.

(continued)

Crystal River Unit 3 8 3.2-30 Final Draft 10/01/93

QPT B 3.2.4 BASES ACTIONS A.1.1. A.l.2.1. A.l.2.2. and A.2 (continued)

Since Required Action A.1.1 only specifies a " perform", a failure of SR 3.2.5.1 acceptance criteria does not result in a Required Action not met (Condition C of this Specification). However, when SR 3.2.5.1 is not met, the Required Actions of LCO 3.2.5 are applicable. The conservative power reductions specified by the Required Actions for LC0 3.2.5 ensure the core continues to operate within an acceptable region for the duration of the Completion Time.

With QPT greater than the steady state limit but less than the transient limits, the safety analysis has shown that a conservative corrective action is to reduce THERMAL POWER by 2% RTP or more from the ALLOWABLE THERMAL POWER for each 1%

of QPT in excess of the steady state limit. This action limits the local LHR to a value corresponding to steady state operation, thereby reducing it to a value within the assumed accident initial condition limits. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is reasonable, based on limiting the potential for xenon redistribution, the low probability of 7g an accident occurring, and the steps required to complete tg the Required Action.

If QPT can be reduced to less than or equal to the steady state limit in < 2 '.odrs, the reactor may return to normal operation without undergoing a power reduction. Significant radial xenon redistribution does not occur within this amount of time.

The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after the last performance of SR 3.2.5.1 allows reduction of THERMAL POWER in the event the operators cannot or choose not to continue to perform SR 3.2.5.1 as required by Required Action A.I.1.

Power operation is allowed to continue if THERMAL POWER is reduced in accordance with Required Action A.1.2.1. The !

same reduction (i.e., 2% RTP or more) is also applicable to the nuclear overpower trip setpoint and the nuclear overpower based on Reactor Coolant System (RCS) flow and AXIAL POWER IMBALANCE trip setpoint, for each 1% of QPT in excess of the steady state limit. This reduction maintains both core protection and an operating margin at the reduced THERMAL POWER level similar to that at RTP. The Completion (continued)

Crystal River Unit 3 B 3.2-31 Final Draft 10/01/93 j

1 -- -

QPT B 3.2.4 ,

[))

BASES ACTIONS A.I.l. A.l.2.1. A.l.2.2. and A2 (continued)

Time of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months is reasonable based on the need to limit the potentially adverse xenon redistribution, the low probability of an accident occurring while operating out of specification, and operating experience related to the amount of time needed to complete the Required Action.

The Completion Time of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months after the last performance of SR 3.2.5.1 allows reduction of THERMAL POWEP in the event the operators cannot, or choose not to continue to perform SR 3.2.5.1 as required by Required Action A.I.I.

Although Required Action A.I.2.1 restores margins, if the source of the QPT is not corrected, it is prudent to establish increased margins. A Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to restora QPT to less than the steady state limit is a reasonable time for investigation and corrective measures.

B.1 and B.2 If QPT exceeds the transient limit but is equal to or less O than the maximum limit due to a misaligned CONTROL R0D or APSR, then power operation is allowed to continue if the THERMAL POWER is reduced 2% RTP or morc from the ALLOWABLE THERMAL POWER for each 1% of QPT in excess of the steady state limit. Thus, the maximum limit is the upper bound within which the 2% for 1% power reduction rule may be applied, and then only for QPTs caused by CONTROL R0D or APSR misalignment. The Completion Time of 30 minutes ensures that the operator completes the THERMAL POWER reduction before significant xenon redistribution occurs recognizing that the cause.of the tilt is known.

When a misaligned CONTROL R00 or APSR occurs, a local xenon redistribution may occur. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for restoring QPT to less than or equal to the transient limit allows the operator sufficient time to relatch or realign a CONTROL R00 or APSR, but is short enough to limit xenon redistribution. In this way, large increases in the ;

local LHR do not occur due to xenon redistribution resulting ;

from the QPT.

(continued)

Crystal River Unit 3 B 3.2-32 Final Draft 10/01/93

QPT B 3.2.4 BASES (O) -

ACTIONS C.1 and C.2 (continued)

If the Required Action and associated Completion Time of Condition A or B are not met, a further power reduction is required. Power reduction ~to < 60% RTP provides conservative protection from increased peaking due to xenon redistribution. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is reasonable to allow the operator to reduce THERMAL POWER to

< 60% of ALLOWABLE THERMAL POWER without challenging plant systems.

Reduction of the nuclear overpower trip setpoint to s 65.5%

of ALLOWABLE THERMAL POWER after THERMAL POWER has been reduced to < 60% of ALLOWABLE THERMAL POWER maintains both core protection and an operating margin at reduced power similar to that at full power. The Completion Time of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months allows sufficient time to reset the trip setpoint and is reasonable based on operating experience.

0.1 and D.2 Power reduction to 60% of the ALLOWABLE THERMAL POWER is a conservative method of limiting the maximum core LHR for O' QPTs up to 20%. Although the power reduction is based on the correlation used in Required Actions A.1.2.1 and B.1, the database for a power peaking increase as a function of QPT is less extensive for tilt mechanisms other than misaligned CONTROL RODS and APSRs. Because of this, greater uncertainty exists in the potential power peaking increase for tilt mechanisms other than misaligned CONTROL R005 and APSRs. Therefore, a more conservative action is taken when the tilt is caused by a mechanism other than a misaligned CONTROL R0D or APSR. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months allows the operator to reduce THERMAL POWER to < 60% of the

. ALLOWABLE THERMAL POWER without challenging plant systems.

Reduction of the nuclear overpower trip setpoint to s 65.5%

of the ALLOWABLE THERMAL POWER after THERMAL POWER has been reduced to < 60% of the ALLOWABLE THERMAL POWER maintains both core protection and an operating margin at reduced power similar to that at full power. The Completion Time of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months allows sufficient time to reset the trip setpoint and is reasonable based on operating experience.

i p (cond1ued)

O Crystal River Unit 3 B 3.2-33 Final Draft 10/01/93 I

l l

i l

QPT i B 3.2.4 l l

BASES ACTIONS E.1 (continued)

If the Required Actions for Condition C or D cannot be met within the associated Completion Time, then either the power level has not been reduced to comply with the Required Action or the nuclear overpower trip setpoint has not been reduced within the associated Completion Time. To preclude risk of fuel damage in any of these conditions, THERMAL POWER is reduced further. Operation at 20% RTP allows the operator to investigate the cause of the QPT and to correct it. Local LHRs with a large QPT do not violate the fuel design limits at or below 20% RTP. The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is acceptable based on limiting the potential increase in local LHRs that could occur due to xenon redistribution with the QPT out of specification and ,

operating experience related to the time required to perform the power reduction.

F.1 The maximum limit on QPT is 20% and the upper bound within which power reduction to 60% of ALLOWABLE THERMAL POWER or O, power reduction of 2% for 1% (for misaligned CONTROL RODS and APSRs) applies (Ref. 2). QPT in excess of the maximum limit can be an indication of a severe power distribution anomaly, and a power reduction to 120% RTP ensures local LHRs do not exceed allowable limits while the cause is being determined and corrected.

The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is reasonable to allow the operator to reduce THERMAL POWER to s 20% RTP without challenging plant systems.

4 SURVEILLANCE QPT can be monitored by both the incore and excore detector REQUIREMENTS systems. The QPT setpoints are derived from their corresponding measurement system independent limits by adjustment for system observability errors and i instrumentation errors. Although they are based on the same measurement system independent limit, the setpoints for the different systems are not identical because of differences (continued)

Crystal River Unit 3 B 3.2-34 Final Draft 10/01/93

QPT B 3.2.4 BASES SURVEILLANCE in the errors applicable for these systems. For QPT REQUIREMENTS measurements using the Incore Detector System, the Minimum (continued) Incore Detector System consists of detectors configured as follows: ,

1

a. Two sets of four detectors shall lie in each core hal f. Each set of detectors shall lie'in the same axial plane. The two sets in the same core half may lie in the same axial plane.

b. Detectors in the same plane shall have quarter core !

radial symmetry.

Figure B 3.2.4-1 (Minimum Incore Detector System for QPT Measurement) depicts an example of this configuration. The .

symmetric incore system for QPT uses the Incore Detector System and is configured such that at least 75% of the symmetric detectors in each core quadrant are functional.

SR 3.2.4.1 Should the plant computer be out of service, then the Excore O System or Minimum Incore Detector System may be used to monitor the QPT. Because these systems do not provide a direct calculation and display of the QPT, performing the calculations at a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is sufficient to follow any changes in the QPT that may approach the setpoint. This conclusion was made because with the exception of CONTROL R00 related effects detected by other systems, QPT changes are slow. This Frequency also provides operators sufficient time to undertake corrective actions if QPT approaches the setpoints.

When the QPT alarm is OPERABLE, the operator receives an alarm if QPT increases to the alarm setpoint. When QPT is less than the alarm setpoint, checking the QPT indication every 7 days ensures that the operator can determine whether the plant computer software and Incore Detector System inputs for monitoring QPT are functioning properly, and that the monitoring and alarm system remains functional. This procedure allows QPT mechanisms, such as xenon ,

redistribution, burnup gradients, and CONTROL R00 drive l mechanism malfunctions, which can cause slow development of a QPT, to be detected. Operating experience has confirmed ,

the acceptability of a Surveillance Frequency of 7 days. !

l (continued)

Crystal River Unit 3 B 3.2-35 Final Draft 10/01/93

l QPT B 3.2.4 (O

V BASES l

SURVEILLANCE SR 3.2.4.1 (continued)

REQUIREMENTS After a THERMAL POWER increase following restoration of the QPT to within the steady state limit, QPT must be determined to remain within the steady state limit at the increased THERMAL POWER level. This is accomplished by monitoring QPT for 12 consecutive hourly intervals or until verified acceptable at 2 95% RTP to determine whether the period of any oscillation due to xenon redistribution causes the QPT to exceed the steady state limit again. In case QPT exceeds the steady state limit for more than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or exceeds the ,

transient limit (Condition A, B, or D), the potential for this xenon redistribution is greater.

REFERENCES 1. 10 CFR 50.46.

2. BAW 10122A, Rev.1, " Normal Operating Controls",

May 1984.

3. BAW-10143P-A, Rev. 1, "BWC Correlation of Critical Heat Flux", April 1985.

O 4 O

Crystal River Unit 3 B 3.2-36 Final Draft 10/01/93 i l

QPT B 3.2.4 O

i i

RADIAL

_ _ _ _ _ _ _ _ _ _ _ __ lX4_ core j I l E

"l g / -

g

% RADIAL SYMMETRY

\ (% A IN THIS PLANE g

=

5 mw N ~ lr / ,

r .0

!! / ~" ' N~%

i e (

J

$A V( & -

0)NJ d %

/ e ' C l_-__-+N h h 3 -

j ; RADIAL SYMMETRY

(--_% _g /

/ IN THIS PLANE o --- -

M ,,

- - - - ~ , NN

/ S f

Figure B 3.2.4-1 (page 1 of 1)

Minimurn incore System for QUADRANT POWER TILT Measurement O,

Crystal River Unit 3 B 3.2-37 Final Draft 10/01/93

Power Peaking Factors B 3.2.5 B 3.2 POWER DISTRIBUTION LIMITS s

B 3.2.5 Power Peaking Factors BASES BACKGROUND The purpose of this LC0 is to establish limits that constrain the core power distribution within design limits during normal operation (Condition I) and during anticipated operational occurrences (Condition II) such that accident initial condition protection criteria are preserved. The accident initial condition criteria are preserved by bounding operation at THERMAL POWER within specified acceptable fuel design limits.

Fo(Z) is a specified acceptable fuel design limit that '

preserves the initial conditions for the Emergency Core Cooling Systems (ECCS) analysis. Fo(Z) is defined as the maximum local fuel rod linear power density divided by the average fuel rod linear power density, assuming nominal fuel pellet and rod dimensions. Because Fo(Z) is a ratio of local power densities, it is related to the maximum local (pellet) power density in a fuel rod. Operation within the Fo(Z) limits given in the COLR prevents power peaking that O would exceed the loss of coolant accident (LOCA) linear heat rate (LHR) limits derived from the analysis of the ECCS.

The fin limit is a specified acceptable fuel design limit that preserves the initial conditions for the limiting loss of flow transient. fin is defined as the ratio of the integral of linear power along the fuel rod on which the minimum departure from nucleate boiling ratio (DNBR) occurs to the average fuel rod power. Because fin is a ratio of integrated powers, it is related to the maximum total power produced in a fuel rod. Operation within the fin limits given in the COLR prevents departure from nucleate boiling (DNB) during a postulated loss of forced reactor wolant '

flow accident.

Measurement of the core power peaking factors using the Incore Detector System to obtain a three dimensional power distribution map provides direct confirmation that Fo(Z) and fin are within their limits, and may be used to verify that the power peaking factors remain bounded when one or more normal operating parameters exceed their limits.

(continued)

Crystal River Unit 3 B 3.2-38 Final Draft 10/01/93

Power Peaking Factors B 3.2.5 BASES (continued)

APPLICABLE The limits on Fo(Z) are determined by the ECCS analysis in SAFETY ANALYSES order to limit peak cladding temperatures to 2200*F during a LOCA. The maximum acceptable cladding temperature is specified by 10 CFR 50.46 (Ref. 1). Higher cladding j temperatures could cause severe cladding failure by i oxidation due to a Zircaloy water reaction. Other criteria must also be met (e.g., maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long term cooling). However, peak cladding temperature is usually most limiting.

The limits on FIs provide protection from DNB during a limiting loss of flow transient. Proximity to the DNB condition is expressed by the DNBR, defined as the ratio of the cladding surface heat flux required to cause DNB to the actual cladding surface heat flux. The minimum DNBR value during both normal operation and anticipated transients is limited to the DNBR correlation limit for the particular fuel design in use, and is accepted as an appropriate margin to DNB. The DNBR correlation limit ensures that there is at least 95% probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not .

experience DNB.

This LCO precludes core power distributions that violate the following fuel design criteria:

a. During a large break LOCA, peak cladding temperature must not exceed 2200*F (Ref. 1).

b. During a loss of forced reactor coolant flow accident, there must be at least 95% probability at the 95%

confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a DNB condition (Ref. 2).

The reload safety evaluation" analysis determines limits on global core parameters that characterize the core power distribution. The primary parameters used to monitor and control the core power distribution are the regulating rod position, the APSR position, the AXIAL POWER IMBALANCE, and the QPT. These parameters are normally used to monitor and control the core power distribution because their measurements are continuously observable. Limits are placed on these parameters to ensure that the core power peaking factors remain bounded during operation in MODE 1. Nuclear (continued)

Crystal River Unit 3 8 3.2-39 Final Draft 10/01/93 I

Power Peaking Factors B 3.2.5 O

A_)

BASES APPLICABLE design model calculational uncertainty, manufacturing l SAFETY ANALYSES tolerances (e.g., the engineering hot channel factor),

(continued) effects of fuel densification and rod bow, and modeling t simplifications (such as treatment of the spacer grid effects) are accommodated through use of peaking augmentation factors in the reload safety evaluation analysis.

Fo(Z) and FIs satisfy Criterion 2 of the NRC Policy Statement. .

LC0 This LCO for the power peaking factors Fn(Z) and Fla ensures that the core operates within the bounds assumed for the ECCS and thermal hydraulic analyses. Verification that Fo(Z) and Fis are within the limits of this LCO as specified in the COLR allows continued operation at THERMAL POWER when the Required Actions of LC0 3.1.4, " CONTROL R0D Group i Alignment Limits," LC0 3.2.1, " Regulating Rod Insertion Limits," LC0 3.2.2, " AXIAL POWER SHAPING R00 Insertion Limits," LC0 3.2.3, " AXIAL POWER IMBALANCE Operating Limits," and LC0 3.2.4, " QUADRANT POWER TILT," are entered.

O' Conservative THERMAL POWER reductions are required if the limits on Fp(Z) and fin are exceeded. Verification that Fo(Z) and Fu are within limits is also required during MODE 1 PHYSICS TESTS per LCO 3.1.8, " PHYSICS TESTS Exceptions-MODE 1."

Measurement uncertainties are applied to the analysis values of Fa(Z) and FIs to account for uncertainties in observability and instrument string signal processing.

APPLICABILITY In MODE 1, the limits on Fo(Z) and F5s must be maintained in order to prevent the core power distribution from exceeding the limits assumed in the analyses of the LOCA and loss of flow accidents. In MODES 2, 3, 4, 5, and 6, this LCO is not applicable because the reactor has insufficient stored energy in the fuel or energy being transferred to the coolant to require a limit on the distribution of core power.

(continued)

Crystal River Unit 3 B 3.2-40 Final Draft 10/01/93 l

Power Peaking Factors B 3.2.5 O

U BASES (continued)

ACTIONS The operator must take care in interpreting the relationship of the power peaking factors Fo(Z) and FIs to their limits.

Limit values of Fo(Z) and fin in the COLR may be expresged in either LHR or in peaking units. Because Fo(Z) and Fu are power peaking factors, constant LHR is maintained as THERMAL POWER is reduced, thereby allowing power peaking to be increased in inverse proportion to THERMAL POWER.

Therefore, the Fo(Z) and FIs limits increase as THERMAL POWER decreases (assuming Fo(Z) and fin are expressed in peaking units) so that a constant LHR limit is maintained.

A.l. A.2 and A.3 When Fo(Z) is determined not to be within its specified limit as determined by a three dimensional power distribution map, a THERMAL POWER reduction is taken to reduce the maximum LHR in the core. Design calculations have verified that a conservative THERMAL POWER reduction is 1% RTP or more for each 1% by which Fo(Z) exceeds its limit.

The Completion Time of 15 minutes provides an acceptable time to reduce power in an orderly manner and without O allowing the plant to remain in an unacceptable condition for an extended period of time.

The same reduction in nuclear overpower trip setpoint and nuclear overpower based on the Reactor Coolant System (RCS) ,

flow and the AXIAL POWER IMBALANCE trip setpoint is required for each 1% by which Fo(Z) is in excess of its limit. These reductions maintain both core protection and an operating margin at the reduced THERMAL POWER. The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable based on the low probability of an accident occurring in this short time period and the -

operating experience related to the amount of time required to complete the Required Action. -

Continued operation with Fo(Z) exceeding its limit is not permitted. The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to restore fo(Z) within its limits at the reduced THERMAL POWER level is reasonable based on the low probability of a limiting event occurring simultaneously with Fo(Z) exceeding its limit.

This precludes long term depletion with local LHRs higher than the limiting values, and limits the potential for inducing an adverse perturbation in the axial xenon distribution.

(continued)

Crystal River Unit 3 B 3.2-41 Final Draft 10/01/93 1

Power Peaking Factors l B 3.2.5 BASES l

ACTIONS B.l. B.2 and B.3 '

(continued)

When Fls is determined not to be within its acceptable limit as determined by a three dimensional power distribution map, a THERMAL POWER reduction is taken to reduce the maximum LHR in the core. The parameter RH by which THERMAL POWER is decreasedper1%increaseinFls above the limit has been verified to be conservative by design calculations, and is defined in the COLR. The parameter RH is the inverse of the increaseinFIs allowed as THERMAL POWER decreases by 1% RTP, and is based on an analysis of the DNBR during the limiting loss of forced reactor coolant flow transient from various initial THERMAL POWER levels. The Completion Ti.me of 15 minutes is reasonable for the operator to reduce unit power.

When a decrease in THERMAL POWER is required because FIs has exceeded its limit, Required Action B.2 requires reduction of the nuclear overpower trip setpoint and the nuclear overpower based on RCS flow and AXIAL POWER IMBALANCE trip setpoint. The amount of reduction of these trip setpoints is governed by the same factor (RH(%) for each 1% that FIs exceeds its limit) that determines the THERMAL POWER O reduction. This process maintains core protection by providing margin to the trip setpoints at the reduced THERMAL POWER similar to that at RTP. The parameter RH is specified in the COLR. The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable based on the low probability of an accident occurring in this short time period and the number of steps required to complete this Action.

ContinuedoperationwithFIn exceeding its limit is not permitted. TheCompletionTimeof24hourstorestoreF$a within its limit at the reduced THERMAL POWER level is reasonable based on the low probability of a limiting event occurringsimultaneouslywithFla exceeding its limit. This Completion Time precludes long term depletion with an i unacceptably high local power and limits the potential for inducing an adverse perturbation in the radial xenon distribution. j 1

(continued)

Crystal River Unit 3 8 3.2-42 Final Draft 10/01/93

Power Peaking Factors

, B 3.2.5

( BASES ACTIONS L1 (continued)

If the Required Actions and associated Completion Times for Condition A or B are not met, then THERMAL POWER operation should cease. This is accomplished by placing the plant in at least MODE 2 within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is a reasonable amount of time for the operator to reduce THERMAL POWER in an orderly manner and without challenging plant systems, t

SURVEILLANCE SR 3.2.5.1 REQUIREMENTS Core monitoring is performed using the Incore Detector System to obtain a three dimensional power distribution map.

Maximum values of Fa(Z) and FIs obtained from this map may then be compared with the limits in the COLR to verify that the limits have not been exceeded. Measurement of the core power peaking factors in this manner may oe used to verify that the measured values of Fa(Z) and Fas remain within their specified limits when one or more of the limits n specified by LC0 3.1.4, LC0 3.2.1, LCO 3.2.2, LC0 3.2.3, or LC0 3.2.4 is exceeded, or when LC0 3.1.8 is applicable. If t') Fa(Z) and FL remain within their limits when one or more of these parameters exceed their limits, operation at THERMAL POWER may continue because the true initial conditions (the power peaking factors) remain within their specified limits.

Because the-limits on Fo(Z) and Fls are preserved when the parameters specified by LC0 3.1.4, LCO 3.2.1, LC0 3.2.?,

LC0 3.2.3, and LCO 3.2.4 are within their limits, a Note is provided in the SR to indicate that monitoring of the power peaking factors is required only when complying with the Required Actions of these LCOs and when LC0 3.1.8 is applicable. ,

Frequencies for monitoring of the power peaking factors are '

specified in the ACTIONS of the individual LCOs. These Frequencies are reasonable based on the low probability of a limiting event occurring simultaneously with either Fo(Z) or FL exceeding its limit, and they provide sufficient time to obtain a power distribution map from the Incore Detector System. Indefinite THERMAL POWER operation in a Required Action of LC0 3.1.4, LC0 3.2.1, LC0 3.2.2, LC0 3.2.3, or LCO 3.2.4 is not permitted, in order to limit the potential (continued)

Crystal River Unit 3 B 3.2-43 Final Draft 10/01/93

Power Peaking Factors--

B 3.2.5' BASES

(

SURVEILLANCE SR 3.2.5.1 (continued)

REQUIREMENTS for exceeding both the power peaking factors assumed in the accident analyses due to operation with unanalyzed core power distributions and spatial xenon distributions beyond their analyzed ranges.

The measured value of F is increased by 2.0% to account for manufacturingtoleranceSonthefuelandfuther,increasedby 7.5% to account for measurement uncertainty. Fu is ,

increased by 5% for measurement uncertainity.

REFERENCES 1. 10 CFR 50.46.

2. BAW-10143P-A, Rev.1, "BWC Correlation of Critical Heat Flux", April 1985.

O V .

1 O

Crystal River Unit 3 B 3.2-44 Final Draft 10/01/93 i

RPS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protection System (RPS) Instrumentation '

BASES BACKGROUND The RPS initiates a reactor trip, (i.e., full insertion of all CONTROL RODS) to protect against violating core fuel ;

design limits and the Reactor Coolant System (RCS) pressure boundary during anticipated operational occurrences (A00s).

By tripping the reactor, the RPS also functions in conjunction with the Engineered Safeguards (ES) Systems in mitigating accidents.

The RPS is part of a layered protection scheme designed to assure safe operat:on of the reactor. This defense-in-depth approach is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as providing LCOs on other reactor system parameters and equipment performance. The LSSS, defined in this Specification as the Allowable Value, in conjunction with these other LCOs, establishes the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During A00s, (those events expected to occur one or more times during the plant's life) the RPS serves to automatically protect and maintain the following Safety '

Limits:

a. The departure from nucleate boiling ratio (DNBR) shall be maintained greater than the Safety Limit (SL) value of Specification 2.1.1.2;

b. Fuel centerline melt shall not occur; and

c. The RCS pressure SL of 2750 psig shall not ,be exceeded.

The RPS also assures offsite doses are maintained within 10 CFR 100 limits following accidents.

(continued)

Crystal River Unit 3 8 3.3-1 Final Draft 10/01/93

RPS Instrumentation ,

B 3.3.1 l t

() BASES BACKGROUND RPS Overview i

(continued)

The RPS consists of four separate redundant protection channels that receive inputs of neutron flux, RCS pressure, '

RCS flow, RCS temperature, RC pump status, reactor building (RB) pressure, main feedwater (MFW) pump status, and main turbine status.

FSAR Figure 7-1, (Ref. 1), shows the arrangement of a

, typical RPS protection channel. The channel is composed of ~ '

measurement channels, a manual trip channel, a reactor trip module (RTM), and CONTROL R00 drive (CRD) trip devices.

LC0 3.3.1 provides requirements for the individual measurement channels. These channels encompass- all equipment and electronics from the point at which the measured parameter is sensed through the bistable relay contacts in the trip string. LCO 3.3.2, " Reactor Protection System (RPS) Manual Reactor Trip," LCO 3.3.3, " Reactor Protection System (RPS)--Reactor Trip Module (RTM)," and LC0 3.3.4, " CONTROL R0D Drive (CRD)-Trip Devices," discuss the remaining elements in the RPS protection channel.

An RPS instrumentation channel measures critical plant O parameters (see above) and compares these to pre-determined setpoints. If the setpoint is exceeded, a channel trip signal is generated. The generation of any two trip signals in any of the four RPS channels will result in the full insertion of all CONTROL RODS. Development of the two-out-of-four logic is done in the RTM. Each RPS channel contains an RTM. The RTM receives signals from the associated measurement devices in the same channel that indicates a protection channel trip is required. The RTM transmits this-signal to an internal two-out-of-four trip logic and to similar logic in the RTMs in the other three RPS channels.

The two-out-of-four logic is designed such that whenever any two RPS channels sense and transmit tr.ip signals, the RTM '

logic in aach channel actuates to remove 120 VAC power from its associated CRD trip device (s).

i (continued)

O Crystal River Unit 3 8 3.3-2 Final Draft 10/01/93

RPS Instrumentation B 3.3.1 BASES BACKGROUND The Reactor Trip System (RTS) contains multiple CRD trip (continued) devices. These include two AC trip breakers, and two DC trip breaker pairs that provide a path for power to the CRD Control System (CRDCS) during normal operation.

The reactor is tripped by opening circuit breakers that interrupt the power supply to the CRDCS. Six breakers are installed to increase reliability and allow testing of the trip system. A one-out-of-two taken twice logic is used to interrupt power to the rods. Additionally, the power for the regulating rods (Groups 5, 6, 7), the APSRs (Group 8),

and the hold bus passes through electronic trip assembly (ETA) relays. The CRDCS design is such that there are two separate paths with each path having either two breakers or a breaker and an ETA relay in series. Each path provides independent power to the CRDs and either path can provide sufficient power to operate all CRDs. Two separate power paths to the CRDs are provided to ensure that a single failure that de-energizes one path will not cause an undesired reactor trip.

The RPS has two bypasses: a shutdown bypass and a channel bypass. Shutdown bypass allows the withdrawal of safety rods for rapid negative reactivity insertion during periods O when the plant is shut down. Channel bypass is used for maintenance and testing. Test circuits in the trip strings allow complete testing of all RPS trip Functions.

The RPS receives inputs from the instrumentation channels discussed in the next section. The specific relationship l between measurement channels and protection channels differs I from parameter to parameter. Three basic configurations are used:

a. Four completely redundant measurements (e.g., reactor building pressure) with one channel input to each protection channel;

b. Four channels that provide similar, but not identical, measurements (e.g., power range nuclear instrumentation where each RPS channel monitors a different quadrant), with one channel input to each protection channel; and (continued)

Crystal River Unit 3 8 3.3-3 Final Draft 10/01/93

RPS Instrumentation B 3.3.1 ,

BASES BACKGROUND c. Redundant measurements with combinational trip logic (continued) outside of the protection channels and the combined output provided to each protection channel (e.g., main feedwater pump trip instrumentation). .

In addition to the three basic configurations discussed, the Reactor Coolant Pump Power Monitoring (RCPPM) Function utilizes another relationship. Two RCPPMs on each RCP monitor pump Kw. Each RCPPM provides an indication of a !

tripped RCP to all four RPS channels. When the RPS channel senses less than tnree RCPs in operation, the RPS channel trips. Either RCPPM associated with one RCP is capable of providing the necessary input signal to the RPS, but two RCPPMs are provided for single failure considerations. In essence, the RCPPM Function is a one out-of-two at the sensor, a logic within the RPS that evaluates for less than three pumps in operation, and a two out-of-four in the RPS.

These arrangements and the relationship of instrumentation channels to trip Functions are discussed next to assist in understanding the overall effect of instrumentation channel failure.

Power Ranae Nuclear Instrumentation Power Range Nuclear Instrumentation channels (NI-5, -6, -7 .'

and -8) provide inputs to the following RPS Functions. The numbers associated with each Function correspond to those used in Table 3.3.1-1. i i

1. Nuclear Overpower

a. Nuclear Overpower-High Setpoint;

b. Nuclear Overpower-Low Setpoint;

8. Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE (Power Imbalance F1ow);

9. Main Turbine Trip (Control Oil Pressure); and

10. Loss of Main Feedwater (LOFW) Pumps (Control Oil Pressure).

(continued) t Crystal River Unit 3 8 3.3-4 Final Draft 10/01/93

RPS Instrumentation t B 3.3.1 l BASES BACKGROUND Power Ranae Nuclear Instrumentation (continued)

The power range nuclear instrumentation consists of four .

compensated ion chamber detector channels, one to monitor-each quadrant of the core. Each channel supplies an input to one RPS protection channel. The channel originates in a 1 detector assembly containing two uncompensated ion chambers. '

The ion chambers utilize dual detectors to provide information on neutron power in the top half and bottom half of the core. The individual currents from the chambers are -

fed to individual linear amplifiers. The summation of the ,

top and bottom is the total reactor power. The difference of the top minus the bottom is input into the determination ;

of AXIAL POWER IMBALANCE.

t Reactor Coolant System Outlet Temnerature (T g,1)

The Reactor Coolant System Outlet Temperature provides input to the following RPS Functions:

2. RCS High Outlet Temperature; and

5. RCS Variable Low Pressure.

RCS Outlet Temperature is measured by two resistance temperature detectors (RTDs) in each hot leg. One RTD is associated with each protection channel.

I Reactor Coolant System Pressure ;

The Reactor Coolant System Pressure provides input to the :

following Functions:

3. RCS High Pressure;

4. RCS Low Pressure; ;

I

5. RCS Variable Low Pressure; and

11. Shutdown Bypass RCS High Pressure.

l O (continued)

Crystal River Unit 3 B 3.3-5 Final Draft 10/01/93 !

I

RPS Instrumentation B 3.3.1 BASES BACKGROUND Reactor Coolant System Pressure (continued)

The RPS inputs of reactor coolant pressure are provided by two pressure transmitters in each hot leg, for a total of four. One sensor is associated with each protection channel.

Peactor Buildina Pressure The Reactor Building (RB) Pressure measurements provide input solely to the RB High Pressure trip, Function 6.

There are four RB High Pressure pressure switches, one associated with each protection channel.

Reactor Coolant Pumo Power Monitorina Reactor Coolant Pump Power. Monitors (RCPPMs) are inputs to the Reactor Coolant Pump overpower /underpower trip, Function 7. The operating current and voltage of each RCP is measured by four current transformers and four potential e transformers inputting into two watt transducers to' develop

( pump KW. Each power monitoring channel consists of an overpower relay and an underpower relay. There are two pump power monitor channels provided for each RC pump. Both '

monitoring channels associated with each RCP are needed to ,

meet the single failure criteria.

Reactor Coolant System Flow The Reactor Coolant System Flow measurements are an input to the Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE trip, Function 8. The reactor coolant flow inputs to the RPS are provided by eight high accuracy differential pressure transmitters, four on each RCS loop, which measure flow through calibrated flow tubes. One flow input in each loop is associated with each protection channel.

(continued) l Crystal River Unit 3 B 3.3-6 Final Draft 10/01/93 i

l l

1 RPS Instrumentation B 3.3.1 BASES BACKGROUND Main Turbine Control Oil Pressure (continued)

Main Turbine Control Oil Pressure is an input to the Main Turbine Trip anticipatory reactor trip, Function 9. Each of the four protection channels receives turbine status information from four identical pressure switches monitoring main turbine automatic stop oil pressure. An open indication will be provided to the RPS on a turbine trip. ,

Contact buffers in each protection channel continuously monitor the status of the contact inputs and initiate an RPS trip when a turbine trip is indicated.

Main Feedwater Pumo Control Oil Pressure Main Feedwater Pump Control Oil Pressure is an input to the Loss of Main Feedwater Pumps trip, Function 10. Control oil pressure is measured by four pressure switches on each feedwater pump. One switch on each pump is associated with each protection channel.

RPS Byoasses The RPS is designed with two types of bypasses: channel bypass and shutdown bypass.

Channel bypass provides a method for placing all Functions in one RPS protection channel in a bypassed condition, and shutdown bypass provides a method of leaving the safety rods withdrawn during cooldown and depressurization of the RCS.

Each bypass is discussed in more detail below.

Channel Bvoass A channel bypass provision is provided to allow for maintenance and testing of the RPS. The use of channcl bypass keeps the protection channel trip relay energized regardless of the status of the instrumentation channel or the bistable relay contacts. In order to place an RPS channel in channel bypass, two conditions must be met.

First, the other three channels must not be in channel bypass. This interlock prevents more than one channel at a time being placed in bypass and is ensured by in-series (continued)

Crystal River Unit 3 8 3.3-7 Final Draft 10/01/93 i

RPS Instrumentation B 3.3.1 BASES BACKGROUND Channel Bypass (continued) ,

contacts from the other channels with the channel bypass '

relay. If any contact is open, the second channel cannot be bypassed. The second condition is the closing of the key switch. When the bypass relay is energized, the bypass contact closes, maintaining the channel trip relay in an energized condition. All RPS trip logics are reduced to a two-out-of-three logic in channel bypass.

Shutdown Byoass

During plant cooldown, it is desirable to maintain the safety rods withdrawn to provide shutdown capabilities in the event of unusual positive reactivity additions (moderator dilution, etc.). However, if the safety rods are withdrawn too soon following reactor shutdown as RCS pressure is decreased, an RCS Low Pressure trip will occur at 1800 psig and the rods will re-insert into the core. To avoid this, the protection system allows the operator to bypass the low pressure trip and maintain shutdown capabilities.

During the cooldown and depressurization, the safety rods are inserted prior to the low pressure trip of 1800 psig.

The RCS pressure is decreased to less than 1720 psig, then each RPS channel is placed in shutdown bypass.

In shutdown bypass, a normally closed contact opens and the :

operator closes the shutdown bypass key switch in each RPS channel. This action bypasses the RCS Low Pressure trip, Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE trip, Reactor Coolant Pump overpower /underpower trip, and the RCS Variable Low Pressure trip, and inserts a new RCS High Pressure, 1720 psig trip. The operator can now withdraw the safety rods for additional available reactivity insertion.

The insertion of the new high pressure trip performs two functions. First, with a trip setpoint of 1720 psig, the bistable prevents operation at normal system pressure, 2155 psig, with a portion of the RPS bypassed. The second function is to ensure that the bypass is removed prior to normal operation. When the RCS pressure is increased during (continued)

Crystal River Unit 3 8 3.3-8 Final Draft 10/01/93 i I

i

RPS Instrumentation -

B 3.3.1 ,

BASES BACKGROUND Shutdown Bvoass (continued) a plant heatup, the safety rods are inserted prior to reaching 1720 psig. The shutdown bypass is removed, which returns the RPS to normal, and system pressure is increased to greater than 1B00 psig. The safety rods can then be withdrawn and remain at the full out condition for the rest of the heatup.

In addition to the Shutdown Bypass RCS High Pressure trip, the nuclear overpower high flux trip setpoint is administrative 1y reduced to 5% RTP while the RPS is in shutdown bypass. This provides a backup to the Shutdown Bypass RCS High Pressure trip and allows low temperature physics testing while preventing the generation of any significant amount of power.

Module Interlock and Test / Interlock Trio Relay Each channel and each trip module is capable of being individually tested. When a module is placed into the test mode or is removed from the system, it causes the test /

O, interlock trip relay to de-energize and to indicate an RPS channel trip. Under normal conditions, the channel to be tested is placed in bypass before a module is tested. This ensures the channel trip relay remains energized during testing and the channel does not trip.

APPLICABLE Each of the analyzed accidents and transients can be SAFETY ANALYSES, detected by one or more RPS Functions. The accident LCO, and analysis contained in Chapter 14 of the FSAR takes credit APPLICABILITY for most RPS trip Functions. Functions not specifically credited in the accident analysis were qualitatively

'. credited in the safety evaluation report (SER) written for the CR-3 operating license. Functions not specifically credited include high RB pressure, high RCS temperature, main turbine trip, shutdown bypass-RCS pressure high, and loss of both main feedwater pumps.

The LC0 requires all instrumentation performing an RPS Function to be OPERABLE. Failure of any instrument renders the affected channel (s) inoperable and reduces the (continued)

Crystal River Unit 3 B 3.3-9 Final Draft 10/01/93

RPS Instrumentation B 3.3.1 BASES APPLICABLE reliability of the affected Functions. Four channels of SAFETY ANALYSES, each RPS instrumentation Function listed in Table 3.3.1-1 LCO, and shall be OPERABLE during the MODES and conditions specified APPLICABILITY to ensure that a reactor trip will be actuated if conditions (continued) require. Additionally, during shutdown bypass with any CRD i trip breaker closed and the CRDCS capable of rod withdrawal, i the applicable RPS Functions must also be OPERABLE. This ,

ensures the capability to trip withdrawn CONTROL RODS at all !

times that rod motion is possible. i I

Required Actions allow maintenance (protection channel) l bypass of individual channels, but the bypass activates '

interlocks that ensure only one channel can be bypassed at a time. Bypass effectively places the trip system in a '

two-out-of-three logic configuration that can still initiate a reactor trip, even with a coincident single failure within the system.

Only the Allowable Values are specified in Table 3.3.1-1.

Nominal trip setpoints are specified in the plant specific setpoint calculations and procedures. The nominal setpoints are selected to ensure that the setpoint measured by CHANNEL FUNCTIONAL TESTS does not exceed the Allowable Value if the bistable is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable provided that operation and testing are consistent with the assumptions of specific setpoir.t calculations. Each Allowable Value specified is more conservative than instrument uncertainties appropriate to the trip Function. The Allowable Values for !

bypass removal Functions are stated in the Applicable MODE i or Other Specified Condition column of Table 3.3.1-1. !

The safety analyses applicable to each RPS Function are discussed next.

1. Nuclear Overoower

a. Nuclear Overoower-Hiah Setooint The Nuclear Overpower-High Setpoint trip initiates a reactor trip when the neutron power reaches a pre-defined setpoint corresponding to '

the design overpower limit. Because THERMAL POWER lags neutron power, tripping the reactor (continued)

O Crystal River Unit 3 B 3.3-10 Final Draft 10/01/93

t RPS Instrumentation .

B 3.3.1 BASES APPLICABLE a. Nuclear Overpower - Hiah Setooint (continued)

SAFETY ANALYSES, LCO, and when the neutron power reaches the design APPLICABILITY overpower will limit THERMAL POWER to a maximum value of the design overpower.

Because it serves to limit THERMAL POWER levels the Nuclear Overpower-High Setpoint trip protects against violation of the DNBR and fuel centerline melt SLs. However, the RCS Variable Low Pressure, and Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE, provide more -

direct protection of these Safety Limits. The ,

role of the Nuclear Overpower-High Setpoint trip ,

is to limit reactor THERMAL POWER below the highest power at which the other two trips are known to provide protection. .

The Nuclear Overpower-High Setpoint trip also provides transient protection for rapid positive :

reactivity excursions during power operations.

These events include the rod withdrawal accident, the rod ejection accident, and the steam line g break accident. By providing a trip during these g events, the Nuclear Overpower-High Setpoint trip protects against excessive power levels and also serves to reduce reactor power to prevent .

violation of the RCS pressure SL.

r Rod withdrawal accident analyses cover a large spectrum of reactivity insertion rates (rod worths), including slow and rapid rates of power '

increase. At high reactivity insertion rates, l the Nuclear Overpower-High Setpoint trip .

provides the primary protection. At low reactivity insertion rates, the high RCS pressure trip provides primary protection. The specified Allowable Value is selected to ensure that a trip occurs before reactor power exceeds the highest point at which the RCS Variable Low Pressure and the Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE trips are analyzed to provide protection against DNB and fuel centerline melt.

(continued) v Crystal River Unit 3 8 3.3-11 Final Draft 10/01/93

RPS Instrumentation B 3.3.1 BASES APPLICABLE a. Nuclear Overpower - Hiah Setooint (continued)

SAFETY ANALYSES, LCO, and The Allowable Value does not account for harsh APPLICABILITY environment induced errors, because the trip will actuate prior to degraded environmental conditions being reached.

b. Nuclear Overoower-Low Setooint While'in shutdown bypass, with the Shutdown Bypass RCS High Pressure trip OPERABLE, the Nuclear Overpower setpoint trip must be administratively reset to s 5% RTP. The low power s.etpoint, in conjunction with the 1720 psig Shutdown Bypass RCS High Pressure setpoint, ensure the plant is protected from excessive power conditions when other RPS trips are bypassed. The Allowable Value was chosen to be as low as practical and still lie within the '

range of the power range nuclear instrumentation.

2. RCS Hiah Outlet Temperature The RCS High Outlet Temperature trip, in conjunction with the RCS Low Pressure and RCS Variable Low i Pressure trips, provides protection for the DNBR SL.

A trip is initiated whenever RCS hot leg temperature approaches the conditions necessary for DNB. Portions of each RCS High Outlet Temperature trip channel are common with the RCS Variable Low Pressure trip. The RCS High Outlet Temperature trip provides steady state protection for the DNBR SL. .

The RCS High Outlet Temperature trip limits the maximum RCS temperature to below the highest value fcr which DNB protection by the Variable Low Pressure trip is ensured. The Allowable Value is selected to ensure that a trip occurs before hot leg temperatures reach the point beyond which the RCS Low Pressure and ,

Variable Low Pressure trips are analyzed. The l (continued)

Crystal River Unit 3 B 3.3-12 Final Draft 10/01/93 l I

l I

RPS Instrumentation B 3.3.1 BASES APPLICABLE 2. RCS Hiah Outlet Temperature (continued)

SAFETY ANALYSES, LCO, and Allowable Value does not reflect errors induced by APPLICABILITY harsh environmental conditions that the equipment is expected to experience because the trip is not required to mitigate accidents that create harsh conditions in the RB.

3. RCS Hiah Pressure The RCS High Pressure trip functions in conjunction with the pressurizer and main steam safety valves to prevent RCS overpressurization, thereby protecting the RCS Pressure SL.

The RCS High Pressure trip has been credited in the accident analysis calculations for slow positive ;

reactivity insertion transients (rod withdrawal

~

accidents and moderator dilution) and loss of feedwater accidents. The rod withdrawal accidents cover a large spectrum of reactivity insertion rates and rod worths that exhibit slow and rapid rates of power increases. At high reactivity insertion rates, the Nuclear Overpower-High Setpoint trip LCO, and provides the primary protection. At low reactivity insertion rates, the RCS High Pressure trip provides the primary protection.

The Allowable Value is selected to ensure that the RCS Pressure SL is not challenged during steady state operation or slow power increasing transients. The Allowable Value does not reflect errors induced by harsh environmental conditions because the equipment is not required to mitigate accidents that create harsh conditions in the RB. ,

4. RCS Low Pressure The RCS Low Pressure trip, in conjunction with the RCS l High Outlet Temperature and Variable Lov Pressure trips, provides protection for the P:,BR St. A trip is. i initiated wMnever the system pressure approaches the j l

(continued)

Crystal River Unit 3 B 3.3-13 Final Draft 10/01/93

s . .

RPS Instrumentation I B 3.3.1 BASES ]

APPLICABLE 4. RCS low Pressure (coontinued)

SAFETY ANALYSES, LCO, and conditions necessary for DNB. The RCS Low Pressure APPLICABILITY setpoint Allowable Value is selected to ensure that a' ,

reactor trip occurs before RCS pressure is reduced j below the lowest point at which the RCS Variable Low i Pressure trip is analyzed. The RCS Low Pressure trip l provides protection for primary system I depressurization events and is credited in the i accident analysis calculations for small break loss of l coolant accidents (SBLOCAs). Consequently, harsh RB i conditions created as a result of SBLOCAs can potentially affect performance of the RCS pressure sensors and transmitters. Therefore, degraded environmental conditions are considered in the Allowable Value determination.

5. RCS Variable Low Pressure The RCS Variable Low Pressure trip, in conjunction with the RCS High Outlet Temperature and RCS Low Pressure trips, provide protection for the DNBR SL.

( The Allowable Value is selected such that a trip is initiated whenever RCS pressure and temperature approach the conditions necessary for DNB. The RCS Variable Low Pressure trip provides a varying low pressure trip based on the RCS High Outlet Temperature within the range specified by the RCS High Outlet Temperature and RCS Low Pressure trips.

The RCS Variable Low Pressure trip is not credited in the safety analysis; therefore, determination of'the setpoint Allowable Value does not account for errors induced by a harsh RB environment.

6. Reactor Buildina Hiah Pressure The Reactor Building High Pressure trip provides an early indication of a high energy line break (LELB) inside the RB. By detecting changes in the RB pressure, the RPS can provide a reactor trip before (continued)

O Crystal River Unit 3 8 3.3-14 Final Draft 10/01/93

j RPS Instrumentation-B 3.3.1 BASES

-l APPLICABLE 6. Reactor Buildina Hiah Pressure (continued) I SAFETY ANALYSES, .

LCO, and the other RCS parameters have varied significantly; ;

APPLICABILITY thus, minimizing accident consequences. This trip Function also provides a backup to RPS trip strings ;

exposed to an RB HELB environment.

The Allowable Value for RB High Pressure trip is at the lowest value consistent with avoiding spurious trips during normal operation. The electronic -

components of the RB High Pressure trip are located in an area outside the RB and are not exnosed to high temperature steam environments during a LOCA.

However, the components would be potentially exposed to high radiation levels. Therefore, the determination of the setpoint Allowable Value accounts for errors induced by the high radiation.

7. Reactor Coolant Pumo Power Monitors The Reactor Coolant Pump Power Monitor (RCPPM) trip provides protection for changes in the reactor coolant

( flow due to the loss of multiple RCPs. Because the flow reduction lags loss of power indications due to-the inertia of the RCPs, the trip initiates protective action earlier than a trip bcsed on a measured flow signal.

The trip also prevents single loop operation (operation with both pumps in an RCS loop tripped).

Under these conditions, core flow and core fluid mixing are insufficient for adequate heat transfer.

The RCPPM trip has been credited in the accident analysis calculations for the loss of four RCPs. The-monitors were added as part of the power level upgrade (2452 to 2544 MW 1 greater than 97% TP. h) toAnalyses provide has DNBshown protection at this trip Function is not necessary when conditions are such that THERMAL POWER is less than 2475 MW 13 ad h Ds are in operation (Ref. 8).

(continued)

O Crystal River Unit 3 B 3.3-15 Final Draft 10/01/93

RPS Instrumentation B 3.3.1 BASES

(

APPLICABLE 7. Reactor Coolant Power Pumo Monitors (continued)

SAFETY ANALYSES, LCO, and The Allowable Value for the Reactor Coolant Pump to APPLICABILITY Power trip setpoint is selected to prevent normal (continued) power operation unless at least three RCPs are operating. RCP status is monitored by two power transducers on each pump. These relays indicate a loss of an RCP on overpower with an Allowable Value I of 2 14,400 kW and on underpower with a setpoint of s 1152 kW. The overpower setpoint is selected low enough to cetect locked rotor conditions (although credit is not allowed for this capability) but high enough to avoid a spurious trip due to the current associated with start of an RCP. The underpower Allowable Value is selected to reliably trip on loss ,

of voltage to the RCPs. The RCPPM setpoints do not account for instrumentation errors caused by harsh environments because the trip Function is not required to respond to events that could create harsh environments around the equipment, s There are two pump power monitors provided for each RCP. Both monitors are required to satisfy the O instrumentation channel requirements of this LCO.

k (continued)

Crystal River Unit 3 B 3.3-16 Final Draft 10/01/93 i

RPS Instrumentation-B 3.3.1 BASES APPLICABLE 8. Nuclear Overpower RCS Flow and Measured AXIAL POWER SAFETY ANALYSES, IMBALANCE LCO, and APPLICABILITY The Nuclear Overpower RCS Flow and Measured AXIAL (continued) POWER IMBALANCE trip provides steady state protection for the power imbalance SLs. A reactor trip is initiated when neutron power AXIAL POWER IMBALANCE, and reactor coolant flow conditions indicate an approach to DNB or fuel centerline melt limits.

This trip supplements the protection provided by the Reactor Coolant Pump Power trip, through the power to flow ratio, for loss of reactor coolant flow events.

The power to flow ratio provides direct protection for the DNBR SL for the loss of a single RCP and for locked RCP rotor accidents. The imbalance portion of the trip is credited for steady state protection only.

The power to flow ratio of the Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE trip also provides steady state protection to prevent reactor power from exceeding the allowable power during three pump operation. Thus, the power to flow ratio O prevents _ overpower conditions similar to the Nuclear Overpower trip. This protection ensures that during reduced flow conditions the core power is maintained below that required to initiate DNB.

The Allowable Value is selected to ensure that a trip occurs when the core power, axial power peaking, and reactor coolant flow conditions indicate an approach to DNB or fuel centerline melt limits. By measuring reactor coolant flow and by tripping only when conditions begin to approach an SL, 3 pump operation can be justified. The Allowable Value for this Function is contained in the COLR due to the cycle-specific nature of the limit.

9. Main Turbine Trio (Control Oil Pressure)

The Main Turbine Trip Function provides an early reactor trip in anticipation of the loss of heat sink associated with a turbine trip. The Main Turbine Trip (continued)

Crystal River Unit 3 B 3.3-17 Final Draft 10/01/93

RPS Instrumentation ,

B 3.3.1

.- BASES APPLICABLE 9. Main Turbine Trio (Control Oil Pressure) (continued)

SAFETY ANALYSES, LCO, and Function was added to B&W plants in accordance with APPLICABILITY NUREG-0737 (Ref. 4) following the Three Mile Island Unit 2 accident. The trip lowers the probability of an RCS power operated relief valve (PORV) actuation <

for turbine trip events. This trip is activated at higher power levels, thereby limiting the range through which the Integrated Control System must provide an automatic runback on a turbine trip.

Each of the four turbine oil pressure. switches provides input to an associated RPS channel through buffers that continuously monitor the status of the contacts. Failure of an individual pressure switch affects only the associated RPS channel.

For the Main Turbine Trip (Control 011. Pressure) bistable, the Allowable Value of 45 psig was selected to provide a trip whenever turbine control oil pressure drops below the normal operating range. To ensure that the trip is enabled as required by the

(

s LCO, an automatic bypass at reactor power Allowable Value of 45% RTP is provided. The turbine trip is not required to protect against events that create a harsh environment in the turbine building. Therefore, errors induced by harsh environments are not included in the determination of the setpoint Allowable Value.

I

10. Loss of Main Feedwater Pumns (Control Oil Pressure)

The Loss of Main feedwater Pumps (Control Oil 4 Pressure) trip function provides an early reactor trip in anticipation of the loss of heat sink associated with a LOFW event. This trip was added in accordance with NUREG-0737 (Ref. 4), following the Three Mile Island Unit 2 accident. This trip provides a reactor trip at high power levels following a LOFW to minimize challenges to the PORV.

l 1

i (continued)

Crystal River Unit 3 B 3.3-18 Final Draft 10/01/93 Y

RPS Instrumentation B 3.3.1 BASES APPLICABLE 10. Loss of Main Feedwater Pumns (Control Oil Pressure)

SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY For the feedwater pump control oil pressure bistable, the Allowable Value of 55 psig is selected to provide a trip whenever feedwater pump control oil pressure drops below the normal operating range. To ensure that the trip is enabled as required by the LCO, the reactor power bypass is set with an. Allowable Value of 20% RTP. The loss of Main Feedwater Pumps (Control Oil Pressure) trip is not required to protect against events that can create a harsh environment in the turbine building. Therefore, errors caused by harsh environments are not included in the determination of .

the setpoint Allowable Value.

11. Shutdown Byoass RCS Hiah Pressure The RPS Shutdown Bypass RCS High Pressure TRIP is provided to allow for withdrawing the CONTROL RODS prior to reaching the normal RCS Low Pressure trip-setpoint. The shutdown bypass provides trip Os protection during deboration and RCS heatup by '

allowing the operator to withdraw the safety rod groups. This makes additional negative reactivity readily available to terminate inadvertent reactivity excursions. Use of the shutdown bypass trip requires that the nuclear overpower trip setpoint be administratively reduced to 5. 5% RTP. The Shutdown Bypass D ' High Pressure trip forces a reactor trip to occur enever the plant switches from power operation to shutdown bypass or vice versa. This ensures that all CONTROL RODS are inserted and the flux distribution is known before reactor startup can begin. The operator is required to remove the shutdown bypass, reset the Nuclear Overpower-High >

Power trip setpoint, and again withdraw the safety rod groups before proceeding with startup.

FSAR, Chapter 14, (Ref. 2), accident analysis does not address events that occur during shutdown bypass operation, because the consequences of these events .

are assumed to be enveloped by the MODE 1 events that are presented. ;

(continued) l Crystal River Unit 3 8 3.3-19 Final Draft 10/01/93 i

RPS Instrumentation B 3.3.1 BASES APPLICABLE 11. Shutdown Bvoass RCS Hioh Pressure (continued) i SAFETY ANALYSES, LCO, and During shutdown bypass operation with_the Shutdown APPLICABILITY Bypass RCS High Pressure trip active with a setpoint of s 1720 psig and the Nuclear Overpower-Low Setpoint set at or below 5% RTP, the trips listed below can be bypassed. Under these conditions, the Shutdown Bypass RCS High Pressure trip and the Nuclear Overpower-Low Setpoint trip prevent conditions from reaching a point where actuation of these Functions would be required.

1.a Nuclear Overpower-High Setpoint;

4. RCS Low Pressure;

5. RCS Variable Low Pressure;

7. Reactor Coolant Pump Power Monitors; and

8. Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE.

The Shutdown Bypass RCS High Pressure Function's Allowable Value is selected to ensure a trip occurs before producing THERMAL POWER.

The RPS satisfies Criterion 3 of the NRC Policy Statement. ,

In MODES I and 2, the following trips shall be OPERABLE. These trips are designed to rapidly make the reactor subcritical in order to protect the SLs during A00s and to function along with the ESAS to provide acceptable consequences during accidents, l.a Nuclear Overpower-High Setpoint;

2. RCS High Outlet Temperature;-

3. RCS High Pressure; F

4. RCS Low Pressure;

5. RCS Variable Low Pressure; (continued)

O Crystal River Unit 3 8 3.3-20 Final Draft 10/01/93

nF. instrumentation B 3.3.1 BASES APPLICABLE 11. Shutdown Bvoass RCS Hiah Pressure (continued)

SAFETY ANALYSES, LCO, and 7. Reactor Coolant Pump Over/Under Power; and APPLICABILITY

8. Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE.

Functions 1, 4, 5, 7, and 8 may be bypassed in MODE 2 or below (higher numerical MODE) when RCS pressure is below 1720 psig, provided the Shutdown Bypass RCS High Pressure and the Nuclear Overpower-Low setpoint trip are placed in operation. Under these conditions, the Shutdown Bypass RCS High Pressure trip and the Nuclear Overpower-Low setpoint trip prevent conditions from reaching a point where actuation of these Functions is necessary.

Two other Functions are required to be OPERABLE during portions of MODE 1. These are the Main Turbine Trip (Control Oil Pressure) and the loss of Main Feedwater Pumps (Control Oil Pressure) trip. These Functions are required to be OPERABLE.above 45% RTP and 20% RTP, respectively.

Analyses presented in BAW-1893 (Ref. 5) showed that for operation below these power levels, these trips are not '

O necessary to minimize challenges to the PORVs as required by NUREG-0737 (Ref. 4).

Because the only safety function of the RPS is to interrupt power to the CONTROL RODS, the RPS is not required to be OPERABLE in MODE 3, 4, or 5 if the reactor trip breakers are open, or the CRDCS is incapable of rod withdrawal.

Similarly, the RPS is not required to be OPERABLE in MODE 6 when the CONTROL RODS are decoupled from the CRDs. However, in MODE 2, 3, 4, or 5, the Shutdown Bypass RCS High Pressure and Nuclear Overpower-Low Setpoint trip Functions are required to be OPERABLE if the CRD trip breakers are-closed and the CRDCS is capable of rod withdrawal. Under i these conditions, the Shutdown Bypass RCS High Pressure and -

Nuclear Overpower-Low setpoint trips are sufficient to prevent an approach to conditions that could challenge SLs.

(continued) l 1

Final Draft Crystal River Unit 3 B 3.3-21 10/01/93

RPS Instrumentation ,

B 3.3.1 ,

BASES (continued)

ACTIONS Conditions A, B, and D are applicable to all RPS protection Functions. If a channel's trip setpoint is found nonconservative with respect to the required Allowable Value -

in Table 3.3.1-1, or any individual component in the trip string is found inoperable (with the exception of the RCPPM), the channel must be declared inoperable. Conditions C and E address the appropriate ACTIONS for an inoperable RCPPM from the sensor to the output of the watt transducer. .

Inoperable components downstream of the watt transducers are .

addressed by Conditions A and B. ;

A.1 e If one or more Functions in an RPS channel become inoperable, the affected channel must be placed in bypass or trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . If the channel is bypassed, the RPS is .

placed in a two-out-of-three logic configuration and the bypass of any other channel is prevented. In this configuration, the RPS can still perform its safety function given a single failure of any other channel. Operation in the two-out-of-three configuration may continue indefinitely based on the NRC SER for BAW-10167, Supplement 2 (Ref. 6).

O In this configuration, the RPS is capable of performing its trip Function in the presence of any single random failure. ,

Alternatively, the inoperable channel can be placed in trip.

Tripping the affected protection channel places the RPS in a one-out-of-three configuration.

The I hour Completion Time is of adequate duration to - !

perform Required Action A.I. Thus, the I hour Completion

Time is based on engineering judgment.

i B.1 and B.2 If one or more functions in two channels become inoperable, one of the two inoperable channels must be placed in trip and the other in bypass. These Required Actions place all RPS Functions in a one-out-of-two logic configuration and prevent bypass of a second channel. In this configuration, the RPS can still perform its safety functions in the presence of a single failure of any channel. The I hour Completion Time is of adequate duration to perform Required Action B.1 and Required Action B.2. Thus, the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on engineering judgment.

(continued)

Crystal River Unit 3 8 3.3-22 Final Draft 10/01/93

.. .. .~ - - . . _ - . _ -- -

RPS Instrumentation B 3.3.1 BASES ACTIONS C.1 (continued)

If one or both RCPPMs associated with a single RCP are inoperable, the RCPPM must be placed in the trip condition i within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Placing one of the RCPPMs for the pump in I the tripped condition restores the single failure aspect of i the design of the Function. This ACTION also places the RPS Function in a condition where only one additional RCPPM l associated with another RCP need indicate a loss of its associated RCP to initiate a reactor trip. Since each RCPPM !

provides input to all four RPS channels, care must be exercised when surveillance testing RCPPM coincident with operation in tnis-Condition. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is adequate to perform Required Action C.1 and is acceptable

. based upon engineering judgment. >

0.1 and 0.2 Required Action D.1 directs entry into the appropriate -

Function-dependent Condition referenced in Table 3.3.1-1.

Whenever a Required Action of Condition A or B, and the associated Completion Time are not met, Condition D directs s the operator to the Condition containing the appropriate -

ACTIONS.

E.1.1. E.1.2, and E.2 If the Required Actions and associated Completion Times of !

Condition C are not met, the plant must be placed in a MODE ,

or condition in which the RCPPM are not required to be OPERABLE. To achieve this status, four reactor coolant pumps must be verified to be in operation and THERMAL POWER must be reduced to less than 2475 MW g within one hour. The Required Actions are based upon analysis (Ref. 8) which demonstrates that the Nuclear Overpower RCS Flow and Measured AXIAL POWER IMBALANCE RPS Function provides adequate protection of DNBR limits for loss of coolant flow accidents postulated to occur under these conditions. Thus, the RCPPM Function is not required. Similar analysis for three RCP operation was never approved. The allowed Completion Times of one hour are reasonable, based on operating experience, to perform the specified Required Actions.

(continued)

Crystal River Unit 3 B 3.3-23 Final Draft 10/01/93 ,

i l

RPS Instrumentation B 3.3.1 BASES ACTIONS E.1.1. E.1.2, and E.2 (continued)

As an alternative to Required Action E.1.1 and Required Action E.1.2, Condition F may be entered within one hour.

This results in placing the plant in MODE 3 and opening the CRD trip breakers within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . This is the default Condition in the event the Required Actions for an inoperable RPS RCPPM Function channel. cannot be completed in the specifie6 Completion Time. As such, this ACTION is conservative. Again, the allowed Completion Time of one hour is reasonable, based on engineering judgment, to perform the specified Required Action.

F.1 and F.2 If the Required Action and associated Completion Time of Condition A or B are not met and Table 3.3.1-1 directs entry into Condition F, the plant must be placed in a MODE in which the specified RPS trip Functions are not required to be OPERABLE. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and to open O all CRD trip breakers without challenging plant systems.

G.1 If the Required Action and associated Completion Time of Condition A or B are not met and Table 3.3.1-1 directs entry into Condition G, the plant must be placed in a MODE in which the specified RPS trip Functions are not required to be OPERABLE. lo achieve this status, all CRD trip breakers must be opened. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is ,

reasonable, based on operating experience, to open CRD trip breakers without challenging plant systems. ,

(continued)

Crystal River Unit 3 8 3.3-24 Final Draft 10/01/93 l

k RPS Instrumentation B 3.3.1 BASES ACTIONS !Ll (continued)

If the Required Action and associated Completion Time of Condition A or B are not met and Table 3.3.1-1 directs entry into Condition H, the plant must be placed in a MODE in .

which the specified RPS trip Function is not required to be i OPERABLE. To achieve this status, THERMAL POWER must be reduced < 45% RTP. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach 45% RTP from full power conditions in an orderly manner without challenging plant systems.

l.:1 If the Required Action and associated Completion Time of Condition A or B are not met and Table 3.3.1-1 directs entry-into Condition 1, the plant must be placed in a MODE in which the specified RPS trip Function is not required to be OPERABLE. To achieve this status, THERMAL POWER must be reduced < 20% RTP. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 4 is reasonable, based on operating experience, to reach 20% RTP from full power conditions in an orderly manner- t O without challenging plant systems. !

SURVFILLANCE The SRs are modified by a note indicating the SR required l REQUIREMENTS for each RPS Function are identified by the SRs column of Table 3.3.1-1. Most Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CAllBRATION, with those credited in the accident analysis also requiring RPS i RESPONSE TIME testing.

SR 3.3.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred.

For the majority of RPS functions, the CHANNEL CHECK consists of a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

(continued) l l Crystal River Unit 3 B 3.3-25 Final Draft 10/01/93

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.1 (continued)

I REQUIREMENTS Significant deviations between two instrument channels could i be an indication of excessive instrument drift in one of the channels or of something even more serious. In the case of the Reactor Building High Pressure, Main Turbine Trip, and Loss of Main Feedwater Pumps Trip Functions, the CHANNEL CHECK is more qualitative in nature. For these Functions, the SR cannot be accomplished by comparing indication of the parameter on the individual channels. Instead, the CHANNEL CHECK consists of a verification the channel trip light is not illuminated. While this does not provide the same level of detail as the indication comparison, it does provide some confidence that a channel failure will be detected in the interval between CHANNEL FUNCTIONAL TESTS.

Acceptance criteria for the CHANNEL CHECK are determined by the plant staff and presented in the Surveillance Procedure.

The criteria may consider, but is not limited to channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the acceptance criteria, it may be an indication that the transmitter or the signal processing equipment has excessively' drifted. If O the channels are within the acceptance criteria, it is an indication that the channels are OPERABLE.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is based on operating experience that demonstrates channel failure is an infrequent occurrence.

SR 3.3.1.2 SR 3.3.1.2 is a heat balance calibration for the power range nuclear instrumentation channels. The heat balance is performed once every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months when reactor power is

> 15% RTP and consists of a comparison of the results of the calorimetric with each power range channel output. The outputs of the power range channels are normalized to the calorimetric. If the calorinetric exceeds the NI channel output by > 2% RTP, the NI must be adjusted. In this Condition, the trip Functions which receive an input from the NI are not considered inoperable provided the channel is adjusted to within the limit. A Note clarifies that this (continued)

Crystal River Unit 3 B 3.3-26 Final Draft 10/01/93 i

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.2 (continued)

REQUIREMENTS Surveillance is required only when reactor power is 2 15% RTP and that 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed for performing the first Surveillance after reaching 15% RTP. This SR 3.0.4 type allowance is provided since at lower power levels, calorimetric data tends to be inaccurate.

The power range channel's output must be adjusted consistent with the calorimetric results if the calorimetric exceeds ,

the power range channel's output by > 2% RTP. The value of 2% is consistent with the value assumed in the safety analyses of FSAR, Chapter 14 (Ref. 2) accidents. These checks and, if necessary, the adjustment of the power range channels ensu.re that channel accuracy is maintained within the error margins assumed in the analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is adequate, based on plant operating experience, which demonstrates the change in the difference between the power range indication and the calorimetric results rarely exceeds a small fraction of 2% in any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period.

Furthermore, the control room operators monitor redundant indications and alarms to detect deviations in channel outputs.

O SR 3.3.1.3 A comparison of power range nuclear instrumentation channels (excores) against incore detectors shall be performed at a 31 day Frequency when reactor power is 2 30% RTP. A Note clarifies that 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed for performing the first ;

Surveillance after reaching 15% RTP. If the absolute difference between the power range and incore measurements i is 2 2.5% RTP, the trip Functions which receive an input from the N1 are not considered inoperable, but a CHANNEL CALIBRATION that adjusts the measured imbalance to agree with the incore measurements is necessary, if the power range channel cannot be properly recalibrated, the channel is declared inoperable. The calculation of the Allowable i Value envelope assumes a difference in out of core to incore !

measurements of 2.5%. Additional inaccuracies beyond those that are measured are also included in the setpoint envelope

- calculation. The 31 day Frequency is adequate, considering that long term drift of the excore linear amplifiers is (continued)

Crystal River Unit 3 B 3.3-27 Final Draft 10/01/93 l

l l

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE- SR 3.3.1.3 (continued)

REQUIREMENTS small and depletion of the detectors is slow. Also, the excore readings are a strong function of the power produced in the peripheral fuel bundles, and do not represent an '-

integrated reading across the core. The slow changes in neutron flux during the fuel cycle can also be detected at this interval.

SR 3.3.1.4 A CHANNEL FUNCTIONAL TEST is performed on each required RPS channel to ensure that the entire channel will perform the intended function. Setpoints must be found within the Allowable Values specified in Table 3.3.1-1.

The Frequency of 45 days on a STAGGERED TEST BASIS results in each channel being tested every 6 months and is based on the results of the analysis approved in Reference 7. That analysis indicates the RPS retains a high level of reliability for this test interval.

O SR 3.3.1.5 This SR is the performance of a CHANNEL CALIBRATION of Functions utilizing an NI signal in the trip logic. This CHANNEL CALIBRATION normalizes the power range channel output to the calorimetric coincident with the imbalance output being normalized to the imbalance condition predicted by the incore neutron detector system. 4 The calibration for both imbalance and total power is f integrated in the power imbalance detector calibration i procedure. Operating experience has shown the reliability of the trip string is acceptable when calibrated on a 92 day interval. Thus, the Frequency is based on engineering judgment.

t (continued)

Crystal River Unit 3 8 3.3-28 Final Draft 10/01/93

. .._ _.-_. _ ~- _ - - ._ _ _ _ . . .. _ _

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.5 (continued)

REQUIREMENTS i This Surveillance is modified by two Notes. The first !

clarifies that neutron detectors and RC flow sensors (tubes) ;

are not required to be tested as part of this Surveillance.

In the case of the neutron detectors, there is no adjustment that can be made to the detectors. Furthermore, adjustment of the detectors is unnecessary because they are passive devices with minimal drift. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration and the monthly axial channel ;

calibration. RCS flow detectors are excluded fret :his SR, :'

but are surveilled as part of SR 3.3.1.6 on a refueling basis. This is based on their inaccessibility during power operations. The second note clarifies that the bypass function associated with the test Functions need only be performed once per fuel cycle. This is consistent with the definition of CHANNEL CALIBRATION.

SR 3.3.1.6 The CHANNEL CALIBRATION is a complete check of the O

instrument channel, including the sensor. The test verifies '

that the channel responds to the measured parameter within the necessary range and accuracy CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift )

to ensure that the instrument channel remains operational !

between successive tests. The 18 month Frequency is based on engineering judgment and industry accepted' practice. '

A Note to the Surveillance indicates that neutron detectors and RCPPM current and voltage sensors are excluded from CHANNEL CALIBRATION. In the case of the neutron detectors, this Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response. RCPPM current and voltage sensors are excluded ;

due to the fact no adjustmehts can be made to these sensors.

l l

(continued)

Crystal River Unit 3 8 3.3-29 Final Draft 10/01/93 l

RPS Instrumentation B 3.3.1

() BASES SURVEILLANCE SR 3.3.1.7 REQUIREMENTS (continued) This SR verifies individual channel actuation response times are less than or equal to the maximum values assumed in the accident analysis. Individual component response times are not modeled in the analyses. The analyses model the overall, or total, elapsed time from the point at which the parameter exceeds the analytical limit at the sensor to the point of rod insertion. Response time testing acceptance criteria are included in Reference 1.

A Note to the Surveillance indicates that neutron detectors and RCPPM current and voltage sensors and the watt transducer are excluded from RPS RESPONSE TIME testing.

This Note is necessary because of the difficulty in generating an appropriate detector input signal. Excluding the detectors is acceptable because the principles of detector operation ensure a virtually instantaneous response.

Response time tests are conducted on an 24 month STAGGERED TEST BASIS. This results in testing all four RPS channels every 96 months. The 96 month Frequency is based on O operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

REFERENCES 1. FSAR, Chapter 7.

2. FSAR, Chapter 14. .

3. 10 CFR 50.49.

4. NUREG-0737, November 1979.

5. BAW-1893.

6. NRC SER for BAW-10167, Supplement 2, July 8, 1992.

7. NRC SER for BAW-10167A and Supplement 1, December 5, 1988.

8. Amendment No. 56 to the CR-3 Technical Specifications, dated July 16, 198?.

O Crystal River Unit 3 B 3.3-30 Final Draft 10/01/93

- - . ,, ,. , , , . . -n , , ,- - ,

RPS Manual Reactor Trip l B 3.3.2 l B 3.3 INSTRUMENTATION B 3.3.2 Reactor Protection System (RPS) Manual Reactor Trip j i

l BASES BACKGROUND The RPS Manual Reactor Trip provides the operator with the capability to trip, (i.e., full insertion of all CONTROL RODS), the reactor from the control room in the absence of any other trip condition. Manual trip is provided by a .

single push button on the main control board. This push button operates four electrically independent switches, one for each train. Power for the CONTROL R0D drive (CRD) trip breaker undervoltage coils and contactor coils comes from the reactor trip modules (RTMs). The manual trip switches are located between the RTM output and the breaker ,

undervoltage coils. Opening of the switches de-energiies the lines to the breakers, tripping them. The switches also :

energize the breaker shunt trip mechanisms. There is a separate switch in series, with the output of each of the four RTMs. All switches are actuated through a mechanical linkage from a single push button.

O APPLICABLE The Manual Reactor Trip Function is a backup to the SAFETY ANALYSES automatic trip functions described in the Bases for Specification 3.3.1, "RPS Instrumentation" and allows the operator to shut down the reactor in accordance with operating procedures or whenever plant conditions dictate.

It is not assumed or credited in any accident or safety analysis.

Manual initiation instrumentation functions are included within the ITS even though they do not strictly satisfy any .

Criterion of the NRC Policy Statement. '

LC0 The LC0 on the RPS Manual Reactor Trip requires that the trip be OPERABLE whenever the reactor is critical or any time any CRD trip breaker is closed and rods are capable of being withdrawn, including shutdown bypass. This enables the operator to terminate any plant transient or excursion that in the operator's judgment requires protective action, even if no automatic trip condition exists.

(continued) l Crystal River Unit 3 8 3.3-31 Final Draft 10/01/93 l

RPS Manual Reactor Trip B 3.3.2 BASES LCO The Manual Reactor Trip Function is composed of four '

(continued) electrically independent trip switches sharing a common mechanical push button. i APPLICABILITY The Manuat Reactor Trip Function is required to be OPERABLE in MODES <. and 2. It is also required to be OPERABLE in MODES 3, 4, and 5 if any CRD trip breaker is in.the closed position and the Control Rod Drive Control System (CRDCS) is

. capable of rod withdrawal.. The only safety function of the RPS is to trip the CONTROL RODS; therefore, the Manual Reactor Trip Function is not needed in MODE 3, 4, or 5 if the reactor trip breakers are open or if the CRDCS is incapable of rod withdrawal. Similarly, the RPS Manual Reactor Trip is not needed in MODE 6 since the CONTROL RODS are decoupled from the CRDs.

ACTIONS A.1 With the Manual Reactor Trip Function inoperable, one hour O is allowed to restore the Function to OPERABLE status. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is acceptable since the automatic functions and various alternative manual trip metaods,-such as removing power to the RTMs or power supply to the CRDCS, are still available.

8.1 and B.2 3 If the Manual Reactor Trip function is inoperable and cannot be returned to OPERABLE status within I hour while in '

MODE 1, 2, or 3, the plant must be placed in a MODE in which mannal trip is not required. Required Action B.1 and e i<.cquired Action B.2 place the plant in at least MODE 3 with all CRD trip breakers open within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed '

Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable,-based on operating experience, to reach MODE 3 from full power conditions in an '

orderly manner and without challenging plant systems.

4 (continued)

Crystal River Unit 3 B 3.3-32 Final Draft 10/01/93 .

l 1

RPS Manual Reactor Trip

'B 3.3.2 BASES ACTIONS L1 (continued)

If the Manual Reactor Trip Function is inoperable and cannot be returned to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months while in MODE 4 or 5, the plant must be placed in a MODE in which manual trip is not required. To achieve this status, all CRD trip breakers must be opened. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to open all CRD trip breakers without challenging plant systems.

SURVEILLANCE SR 3.3.2.1 REQUIREMENTS SR 3.3.2.1 is a CHANNEL FUNCTIONAL TEST of the Manual Reactor Trip function. The test verifies OPERABILITY of the Manual Reactor Trip Function by actuation of the CRD trip breakers. The Frequency (once prior to each reactor startup if not performed within the preceding 7 days) ensures the OPERABILITY of the Manual Reactor Trip function prior to achieving criticality. The Frequency was developed considering that the Surveillances can only be performed during an outage.

REFERENCES 1. FSAR, Chapter 7.

O Crystal River Unit 3 B 3 3-33 Final Draft 10/01/93

RPS-RTM B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Reactor Protection System (RPS)-Reactor Trip Module (RTM)

BASES BACKGROUND The RPS consists of four independent protection channels, t each containing an RTM. FSAR Figure 7-1, (Ref. 1), shows a typical RPS protection channel and the relationship of the RTH to the RPS instrumentation, manual trip, and CONTROL R0D .

drive (CRD) trip devices. The RTM receives bistable trip ,

signals from the Functions in its associated channel as well as receiving channel trip signals from the other three RPS-RTMs . The RTM transmits the trip signal to an-internal two-out-of-four trip logic and similar logic in the other three RTMs. The two-out-of-four logic is designed such that whenever any two RPS channels sense and transmit trip signals, the RTM logic in each channel actuates to remove 120 VAC power from its associated CRD trip device (s).

The RPS trip scheme consists of series contacts that are operated by bistables. During normal unit operations, all contacts are closed and the RTM channel trip relay remains energized. However, if any trip parameter exceeds its setpoint, its associated centact opens, which de-energizes the channel trip relay.

A minimum of two out of four RTMs must sense a trip condition to cause a reactor trip. Also, because the bistable relay contacts for each function are in series with the channel trip relays, two channel trips caused by different trip functions will result in a reactor trip.

APPLICABLE Accident analyses credit a reactor trip for providing SAFETY ANALYSES automatic protection against exceeding reactor core and RCS pressure Safety Limits. A reactor trip must occur when conditions dictate in order to prevent accident conditions from exceeding those calculated in the accident analyses.

As the RTMs are part of the success path for assuring reactor trip, the analysis for the need for the trip is applicable to them, as well. More detailed descriptions of these accident analyses is found in the Bases for each of the RPS trip Functions in LCO 3.3.1, " Reactor Protection System (RPS) Instrumentation." l l

(continued)

Crystal River Unit 3 B 3.3-34 Final Draft 10/01/93 l

RPS-RTH B 3.3.3 BASES APPLICABLE The RTMs satisfy Criterion 3 of the NRC Policy Statement.

SAFETY ANALYSES (continued)

LC0 All four RTMs are required to be OPERABLE since failure of any RTM reduces the reliability of the RPS.

RTM OPERABILITY is defined by the capability to receive and interpret trip signals from its associated and other redundant RPS channels and to open its associated trip device when the two-out-of-four logic is satisfied.

The requirement for four channels to be OPERABLE ensures that a minimum of two RPS channels will remain OPERABLE if a single failure has occurred in one channel even with a second channel bypassed for surveillance or maintenance. The two-out-of-four trip logic also ensures that a single RPS channel failure will not cause an unwanted reactor trip.

Violation of this LC0 could result in a failure of the reactor to trip when required.

O APPLICABILITY The RTMs are required to be OPERABLE in MODES I and 2. They are also required to be OPERABLE in MODES 3, 4, and 5 if any CRD trip breaker is in the closed position and the Control Rod Drive Control System (CRDCS) is capable of rod withdrawal. The only safety function of the RPS is to trip the CONTROL RODS; therefore, the RlM is not needed in MODE 3, 4, or 5 if the reactor trip breakers are open or if the CRDCS is incapable of rod withdrawal. Similarly, the RPS-RTM is not needed in MODE 6 since the CONTROL RODS are :

decoupled from the CRDs.

ACTIONS A.l.l. A.l.2. and A.2 t

With an inoperable RTM, the associated CRD trip device (s) must be placed in a condition equivalent to a tripped condition of the RTM. Required Action A.1.1 or Required Action A.I.2 establish this condition by either tripping the (continued)

Crystal River Unit 3 B 3.3-35 Final Draft 10/01/93

RPS-RTM B 3.3.3 BASES ACTIONS A.l.l. A.l.2. and A.2 (continued)

CRD trip device (s) or by removing power (which in turn trips the device). It is necessary to specify trip devices since the inoperable RTM may be part of the "C" or "D" RPS channel. In this case, it is necessary to trip not only the DC breaker pair, but also the ETA relays associated with the channel. Power to hold up CONTROL RODS is still provided via the parallel CRD trip device (s). Therefore, a reactor trip will not occur until another protection channel trips.

To complete the _ function of the inoperable RTH, Required Action A.2 requires that the inoperable RTH be removed from the cabinet. This action, via electrical interlocks, transmits the RTM-tripped indication to the remaining three RTMs placing them in a half-trip (one-out-of-three) configuration. Operation in this condition is allowed indefinitely because the RPS is still capable of performing its safety function given a single failure. The I hour Completion Time is adequate based on engineering judgment considering the time needed to perform the Actions.

B.1. B.2.1. and B.2.2 If the Required Actions of Condition A are not met within the associated Completion Time while in MODE 1, 2, or 3, the plant must be placed in a condition in which the LC0 does not apply. This is done by placing the plant in at least MODE 3 with all CRD trip breakers open or with all power to the CRDCS removed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 If the Required Actions of Condition A are not met within the associated Completion Time while in MODE 4 or 5, the plant must be placed in a condition in which the LC0 does not apply. This is done by opening all CRD trip breakers or removing all power to the CRDCS. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to open all CRD trip breakers or remove all power to the CRDCS.

(continued) l Crystal River Unit 3 B 3.3-36 Final Draft 10/01/93 l I

l

RPS-RTM B 3.3.3 BASES (continued)

SURVEILLANCE .SI 3.3.3.1 '

REQUIREMENTS This SR verifies the OPERABILITY of the RTM by actuation of '

the trip devices. The Frequency of 31 days is based on operating experience, which has demonstrated that failure of more than one channel in any 31 day interval is unlikely.

A Note has been added to indicate entry into the Required Actions of this Specification may be deferred for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for an RTM made inoperable for Surveillance testing.

This allowance consi.:crs the average time required to perform the Surveillance. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months testing allowance does not significantly reduce the probability that the RPS will trip when conditions require a trip.

REFERENCES 1. FSAR, Chapter 7.

O 1

O Crystal River Unit 3 B 3.3-37 Final Draft 10/01/93 l

CRD Trip Devices l B 3.3.4 B 3.3 INSTRUMENTATION B 3.3.4 CONTROL ROD Drive (CRD) Trip Devices BASES BACKGROUND The Reactor Protection System (RPS) provides trip signals to multiple CRD trip devices. These include two AC trip breakers, two DC trip breaker pairs, and 10 electronic trip '

assembly (ETA) relays. The CRD system has two separate paths for maintaining the CRDs energized. Each path has one AC breaker in series with either a pair of DC breakers or five ETA relays in parallel. Each path provides independent power to the CRDs and either can provide sufficient power to operate the entire CRD Control System (CRDCS).

i Two separ' ate power paths to the CRD system ensure that a single failure which opens one path will not cause an unwanted reactor trip. The two paths also allow periodic trip device testing with the reactor at power.

FSAR, figure 7-8, (Ref. 1), illustrates the configuration of CRD trip devices. To trip the reactor, power to the CRDs is removed. This causes the CRD's mechanisms to release the O CONTROL RODS, which then fall by gravity into the core.

The two separate power paths are powered through the AC CR0 trip breakers. The 'A' side receives power from the 480V Reactor Aux Bus 3A while the 'B' side is powered from the 480V Plant Aux Bus. The AC breakers are designated A and B, !

and their undervoltage and shunt trip coils are energized from RPS channels A and B, respectively. From the breakers, the CRD power travels through voltage regulators and stepdown transformers. These devices in turn supply redundant buses that feed the DC power supplies and the regulating rod power supplies.

The DC power supplies rectify the AC input and supply power to hold the safety rods in their fully withdrawn position.

One of the redundant power sources supplies phase A through the C CRD breaker; the other, phase CC through the D breaker. When energized, either phase is capable of holding f

(continued)

Crystal River Unit 3 B 3.3-38 Final Draft 10/01/93

_ _ _ _ . ________m___

CRD Trip Devices B 3.3.4 O BASES V

BACKGROUND the rods. The C and D breakers are actually a breaker pair

-(continued) located on the output of the rectified DC power supply.

Each breaker in the pair feeds one of the four safety rod groups. Each breaker in the pair has an associated undervoltage and shunt trip coil actuated by its RPS channel. The breakers in the "C" breaker pair are opened by RPS Channel C while the "D" breakers are actuated by RPS channel D.

in addition to the DC power supplies, the redundant buses (sides) also supply power to the regulating rods, the AXIAL POWER SHAPING RODS and auxiliary power supply. These power supplies consist of ETAs that are gated on by programming lamps. Programming lamp power is controlled by _

contactors (E and F), which are controlled by RPS power.

The 'E' electronic trip is actuated by RPS channel C; the

'F', by RPS channel D.

The AC breaker and DC breakers are in series in one of the power supplies; whereas, the redundant AC breaker and DC breakers are in series in the other power supply to the CONTROL RODS. The logic required to cause a reactor trip is ,

the opening of a circuit breaker in each of the redundant power supplies. This is known as a one-out-of-two taken twice logic. !

APPLICABLE Accident analyses credit a reactor trip for providing ;

SAFETY ANALYSES automatic protection against exceeding reactor core and RCS .

pressure Safety Limits. A reactor trip must occur when l conditions dictate in order to prevent accident conditions i from exceeding those calculated in the accident analyses.

As the CRDs are part of the success path for assuring ;

reactor trip, the safety analysis for the need for the trip is applicable to them, as well. A more detailed description of this accident analyses is found in the Bases for each of the RPS trip Functions in LCO 3.3.1, " Reactor Protection System (RPS) Instrumentation."

The CRD trip devices satisfy Criterion 3 of the NRC Policy i Statement.

i l

(continued)

Crystal River Unit 3 B 3.3-39 Final Draft 10/01/93 l

i I

CRD Trip Devices !

B 3.3.4 l l

BASES (continued)

LC0 All of the CRD trip devices listed in the LC0 are required to be OPERABLE to ensure the reactor remains capable of being tripped any time it'is critical. OPERABILITY is defined as the capability of the CRD trip device to receive a reactor trip signal and to respond to this trip signal by interrupting power to the CRDs. Both of the breaker's trip '

mechanisms (shunt and UV coil) and the breaker itself must be functioning properly for the breaker to be OPERABLE.

Requiring all breakers and eight ETA relays to be OPERABLE ensures that at least one device in each of the two power paths to all CRDs will remain OPERABLE even with a single failure. The value of eight ETA relays is developed considering two relays per group (one fed from either power path) for rod groups 5, 6, and 7. Additionally, the two ETA relays associated with the auxiliary power supply are also included due to the potential for having a group on the bus when a trip signal is generated. Requiring these devices to be OPERABLE also ensures that a single failure will not cause a spurious reactor trip and subsequent plant transient.

O APPLICABILITY The CRD trip devices are required to be OPERABLE in MODES 1 and 2. They are also required to be OPERABLE in MODES 3, 4, and 5 if any CRD trip breaker is in the closed position and the Control Rod Drive Control System (CRDCS) is capable of i rod withdrawal. The only safety function of the RPS is to trip the CONTROL RODS; therefore, the CRD-trip devices are not reeded in MODE 3, 4, or 5 if the reactor trip breakers are open or if the CRDCS is incapable of rod withdrawal.

Similarly, the CRD Trip devices are not needed in MODE 6 since the CONTROL RODS are decoupled from the CRDs. 't (continued) ,

Crystal River Unit 3 8 3.3-40 Final Draft 10/01/93

CR0 Trip Devices B 3.3.4 BASES (continued)

ACTIONS A Note has been added to the ACTIONS indicating separate Condition entry is allowed for each CRD trip device.

A.1 and A.2 Condition A is applicable when one or more CRD trip breaker (s) has one inoperable trip mechanism. This Condition represents loss of single failure protection / diverse trip capability in the CRD trip mechanism (undervoltage coil or shunt attachment).

If one of the diverse trip mechanisms on a CRD trip breaker or one mechanism on either DC trip breaker in the pair becomes inoperable, action must be taken to restore the inoperable CRD trip breaker to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . If this is not achievable, an alternative action is to ensure CRD trip breaker function is accomplished. This is done by manually tripping the inoperable CRD trip breaker ;

or by removing power from the inoperable CRD trip breaker.

Either of these actions places the affected CRDs in a ;

one-out-of-two trip configuration, which precludes a single (g failure from preventing a trip of the reactor. The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months V Completion Time has been shown to be acceptable through operating experience and is based on the recommendations of NRC Generic Letter 85-10.

B.1 and B.2 Condition B is applicable when one or more CRD trip breaker (s), including either breaker in the DC breaker pair, will not function on either undervoltage or shunt trip or the trip breaker is inoperable for another reason (i.e.,

breaker will not open due to mechanical problem).

Condition B represents a loss of the ability for either trip mechanism to cause a trip of the associated CRD trip device.

(continued)

Ciystal River Unit 3 B 3.3-41 Final Draft 10/01/93

CRD Trip Devices B 3.3.4 BASES ACTIONS B.1 and B.2 (continued)

Required Action B.1 and Required Action B.2 are the same as Required Action A.1 and Required Action A.2, but the Completion Time is shortened. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the breaker's inability to trip. The Completion Time was developed to allow the operator to take.all the' appropriate actions for the inoperable breaker while.

minimizing plant vulnerability to a transient.

C.1 and C.2 Condition C applies when one or more ETA relays are inoperable. If the relay cannot be restored to OP.ERABLE status, one of two Actions is available to eliminate reliance on the failed ETA relay. This first option is to switch the affected control rod group to an alternate power supply with OPERABLE ETA relays (i.e., the auxiliary power supply assuming the ETA relays for it are OPERABLE). This removes the failed ETA relay from the trip sequence, and the plant can operate indefinitely. The second option is to trip the corresponding AC CRD trip breaker. This action O results in the safety function being performed, thereby eliminating the failed ETA relay from the trip sequence.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with those provided j for Condition B and is sufficient to perform the selected Required Action. l

)

D.1. D.2.1. and 0.2,2 l If the Required Actions of Condition A, B, or C are not met within the associated Completion Time while the plant is in !

. MODE 1, 2, or 3, the plant must be placed in a MODE in which <

the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3, with all CRD trip breakers open or with all power to the CRDCS removed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, !

based on operating experience, to reach MODE 3 from full l power conditions in an orderly manner and without l challenging plant systems.

(continued)

Crystal River Unit 3 B 3.3-42 Final Draft 10/01/93 1

j

CRD Trip Devices B 3.3.4 BASES ACTIONS E.1 and E.2 (continued)

If the Required Actions of Condition A, B, or C are not met >

within the associated Completion Time while the plant is in MODE 4 or 5, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, all CRD trip breakers must be opened or all power to the CRDCS removed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to open all CRD trip breakers or remove all power to the CRDCS without challenging plant systems.

SURVEILLANCE SR 3.3.4.1 REQUIREMENTS SR 3.3.4.1 is a CHANNEL FUNCTIONAL TEST to the CRD trip. i devices once every 31 days. This test verifies the OPERABILITY of the trip devices by actuation of the end devices. Also, this test independently verifies the undervoltage and shunt trip mechanisms of the CRD trip breakers. The Frequency of 31 days is based on operating experience, which has demonstrated that failure of more than O one trip device in any 31 day interval is unlikely.

i REFERENCES 1. FSAR, Chapter 7.

i O

Crystal River Unit 3 B 3.3-43 Final Draft 10/01/93

)

i ESAS Instrumentation j B 3.3.5 1 l

l B 3.3 INSTRUMENTATION B 3.3.5 Engineered Safeguards Actuation System (NAS) Instrumentation i

BASES BACKGROUND The ESAS initiates Engineered Safeguards (ES) Systems, based on the values of selected plant parameters, to protect core design and reactor coolant pressure boundary limits and to i mitigate accidents.

ESAS actuates the following:

a. High Pressure Injection (HPI);

b. Low Pressure Injection (LPI);

c. Reactor Building (RB) Isolation and Cooling;

d. RB Spray;

e. Emergency Diesel Generator (EDG) Start; and Control complex nonnal recirculation.

ESAS also provides two signals to the Emergency Feedwater Initiation and Control (EFIC) System. One signal initiates emergency feedwater (EFW) when an actuation of HPI Channel A ,

and HPI Channel B is present. The other functions to trip the motor driven emergency feedwater pump when an RCS Pressure-Low Low initiation coincident with a loss of offsite power is present.

The ESAS operates in a distributed manner to initiate the appropriate systems. The ESAS does this by monitoring RCS pressure actuation parameters in each of three channels and RB. pressure actuation in each of six channels (3 per actuation train). Once the setpoint for actuation is reached, the signal is transmitted to automatic actuation logics, which perform the two-out-of-three logic for actuation of each end device. However, all automatic '

actuation logics receive signals from the same channels for each parameter.

Four parameters are used for actuation:

a. Low Reactcr Coolant System (RCS) Pressure; (continued)

Crystal River Unit 3 B 3.3-44 Final Draft 10/01/93

ESAS Instrumentation B 3.3.5 J BASES 1

BACKGROUND b. Low-low RCS Pressure; i (continued) '

c. High RB Pressure; and

d. High High RB Pressure.

This LC0 covers only the instrumentation channels that >

monitor these parameters. These channels include all intervening equipment from (including) the sensor, to (not including) the actuation logic. LCO 3.3.6, " Engineered l Safeguards Actuation System (ESAS) Manual Initiation," and LCO 3.3.7, " Engineered Safeguards Actuation System (ESAS)

Automatic Actuation Logic," provide requirements on the manual initiation and automatic actuation logic Functions.

The ESAS RCS Pressure Parameters consists of three analog instrumentation channels. The digital portion of the string (from the output of the bistable on) is essentially six

! channels. The ESAS RB Pressure Parameters are six channels of instrumentation throughout the entire trip' string. Each

! channel provides input to logics that initiate equipment with a two-out-of-three logic in each train. Each p protection channel includes bistable inputs from one V instrumentation channel of Low RCS Pressure and Low-Low RCS Pressure and pressure switch inputs from three channels of High RB Pressure and High-High RB Pressure. Automatic actuation logics combine the three protection channel trips in each train to actuate the individual Engineered Safeguards (ES) components needed to initiate each ES System Function. Figure 7-5 of the FSAR, (Ref. 1), illustrates how instrumentation channel trips combine to cause protection channel trips.

The RCS pressure sensors are common to both actuation trains. Separate RB pressure sensors are used for the high and high hish pressure functions in each train, and separate sensors are used for each train.

FSAR Table 7-3 identifies the measurement channels used for ES actuation and the Function actuated by each.

The ES equipment is divided between the two redundant actuation trains A and B. The division of the equipment between the two actuation trains is based on the equipment redundancy and function and is accomplished in such a manner that the failure of one of the actuation channels and the i

1 (continued) l Crystal River Unit 3 B 3.3-45 Final Draft 10/01/93

l ESAS Instrumentation

'B 3.3.5 BASES BACKGROUND related safeguards equipment will not inhibit the overall ES (continued) Functions. Where a motor operated or.a solenoid operated valve is driven by either of two matrices, one is from actuation train A and one from actuation train B. Redundant ES pumps are controlled from separate and independent-actuation channels.

Enaineered Safety Feature Actuation System Bvoasses No provisions are made for maintenance bypass of ESAS instrumentation channels. Operational bypasses are provided, as discussed below, to allow accident recovery actions to continue and, to allow plant cooldown without spurious ESAS actuation.

The ESAS RCS pressure instrumentation channels include permissive bistables that allow manual bypass when reactor pressure is below the point at which the low and low low pressure trips are required to be OPERABLE. Once permissive ,

conditions are sensed, the RCS pressure trips may be manually bypassed. Bypasses are automatically removed when bypass permissive conditions are no longer applicable.

No more than two (of the three) High RB Pressure channels may be manually bypassed after an actuation. The manual i bypass allows operators to take manual control of ES Functions after initiation to allow recovery actions. .

Reactor Coolant System Pressure RCS pressure is monitored by three independent pressure transmitters located in the RB. These transmitters are 4 separate from the transmitters that provide an input to the Reactor Protection System (RPS). Each of the pressure signals generated by these transmitters is monitored by four bistables to provide two trip signals, at 1500 psig and 500 psig, and two bypass permissive signals, at 1700 psig and 900 psig.

(continued)

Crystal River Unit 3 8 3.3-46 Final Draft 10/01/93

ESAS Instrumentation B 3.3.5 BASES BACKGROUND Reactor Coolant System Pressure (continued)

The outputs of the three channels trip bistables, associated ,

with the low RCS pressure (1500 psig) actuate bistable trip auxiliary relays in two sets (actuation trains A and B) of identical and independent trains. The two HPI trains each use three logic channels arranged in two-out-of-three .

coincidence networks. The outputs of the three bistables associated with the Low Low RCS Pressure (500 psig) actuate ,

bistable trip auxiliary relays in two sets (actuation trains A and B) of identical and independent trains. The two LPI trains each use three logic channels arranged in two-out-of-three coincidence networks for LPI Actuation. The outputs of the three Low Low RCS Pressure bistables also trip the automatic actuation relays, via a LPI bistable trip ,

auxiliary relay, in the corresponding HPI train as previously described.

Reactor Buildina Pressure ESAS RB pressure signal information is provided by 12 pressure switches. Six pressure switches are used for O the High RB Pressure Parameter, and six pressure switches are used for the High-High RB Pressure Parameter.

The output contacts of six High RB Pressure switches are used in two sets of identical and independent actuation trains. These two trains each use three logic channels. .

The outputs of these channels are used in two-out-of-three l coincidence networks. The output contacts of the six RB l pressure switches also trip, via a pressure switch trip I auxiliary relay, the automatic actuation relays in the corresponding HPI and LPI trains as previously described.

The output contacts of six High High RB Pressure switches are used in two sets of identical and independent actuation trains. The outputs of the High High RB Pressure switches are used in two-out-of-three coincident networks for RB ,

Spray Actuation. The two-out-of-three logic associated with I each RB Spray train actuates spray pump operation when the High-High RB signal and the HPI signal are coincident in that train.

O (continued)

Crystal River Unit 3 B 3.3-47 Final Draft 10/01/93 I

ESAS Instrumentation B 3.3.5 BASES (continued)

APPLICABLE Accident arealyses rely on automatic ESAS actuation for ,

SAFETY ANALYSES protection of the core temperature and containment pressure limits and for limiting off site dose levels following an accident. These include LOCA, SLB, and feedwater line break events that result in RCS inventory reduction or severe loss of RCS cooling.

The following ESAS Functions are assumed to operate to mitigate design basis accidents. .

Hiah Pressure Iniection The ESAS actuation of HPI has been assumed for core cooling in the small break LOCA analysis and is credited in the SLB analysis for the purposes of adding boron and negative reactivity. HPI is also credited in the Steam Generator Tube Rupture (SGTR) accident analysis.

Low Pressure Iniection ,

The ESAS actuation of LPI has been assumed for large break-LOCAs.

Reactor Buildina Sorav. Reactor Buildina Coolina. and '

Reactor Buildina Isolation ESAS actuation of the RB coolers and RB Spray is credited in~ i RB analysis for LOCAs, both for RB performance and equipment i environmental qualification pressure and temperature envelope definition. Accident dose calculations credit RB Isolation and RB 5 pray.

Emeraency Diesel Generator Start The ESAS initiated EDG Start has been assumed in the LOCA analysis to ensure that emergency power is available throughout the limiting LOCA scenarios.

The small and large break LOCA analyses assume a '

conservative 35 second delay time for the actuation of HPI and LPI in FSAR, Chapter 6, (Ref. 3). This delay time The small and large break LOCA analyses assume a conservative 35 second delay time for the actuation of HPI (continued)

Crystal River Unit 3 8 3.3-48 Final Draft 10/01/93

ESAS Instrumentation B 3.3.5 BASES APPLICABLE Emeroency Diesel Generator Start (continued)

SAFETY ANALYSES and LPI in FSAR, Chapter 6, (Ref. 3). This delay time includes allowances for EDG starting, EDG output breaker closure, EDG voltage recovery, EDG loading, Emergency Core Cooling Systems (ECCS) pump starts, and valve openings.

Similarly, RB 1 solation and Cooling, and RB 3 pray have been analyzed with delays appropriate for the entire system analyzed. Values used in the analysis are 25 seconds for RB Cooling, 60 seconds for RB Isolation, and 71 seconds for RB Spray.

ESAS instrumentation channels satisfy Criterion 3 of the NRC Policy Statement.

LC0 The LC0 requires the specified ESAS instrumentation for each Parameter in Table 3.3.5-1 to be OPERABLE. Failure of any instrument renders the affected channel inoperable and reduces the margin to meeting the single failure criteria for the affected Functions.

The Allowable Values for bypass removal functions are stated in the Applicable MODES or Other Specified Condition column of Table 3.3.5-1.

Three channels of RCS Pressure ESAS instrumentation and two channels of ESAS RB pressure instrumentation in each '

actuation train shall be OPERABLE to ensure that a single failure in one channel will not result in loss of the aiility to automatically actuate the required safety function. ,

The bases for the LCO on ESAS Parameters include the

following.

Reactor Coolant System Pressure Three channels each of RCS Pressure-Low and RCS Pressure-Lew-Low are required to be OPERABLE. Each channel includes a sensor, trip bistable, bypass bistable, bypass relays, and bistable trip auxiliary relays. In addition,

- each RCS Pressure-Low channel also includes time delay auxiliary relays. The analog portion of each pressure channel is common to both trains of both RCS Pressure l

l (continued)

Crystal River Unit 3 B 3.3-49 Final Draft 10/01/93 I

ESAS Instrumentation B 3.3.5 BASES LC0 Reactor Coolant System Pressure (continued)

Parameters. Therefore, failure of one analog channel renders one channel of the low pressure and low low ,

pressureFunctions in each train inoperable. The bistable portions of the channels are Function and train specific.

Therefore, a bistable failure renders only one Function in one train inoperable. Failure of a bypass bistable or bypass circuitry, such that a trip channel'cannot be bypassed, does not render the channel inoperable. Bistable trip auxiliary relays and auxiliary time delay relays are

train specific but may be shared among Parameters.

Therefore, bistable trip auxiliary or auxiliary time delay relay failure has the potential to render all affected Functions in one train inoperable.

1. Reactor Coolant System Pressure-Low Setooint The RCS Pressure-Low Setpoint is based on HPI

actuation for small break LOCAs. The setpoint ensures that the HPI will be actuated at a pressure greater than or equal to the value assumed in accident analyses plus the instrument uncertainties.

To ensure the RCS Pressure-Low trip is not bypassed when required to be OPERABLE by the safety analysis, t each channel's bypass removal bistable must be set with an Allowable Value of s 1700 psig. The bypass removal does not need to function for accidents initiated from RCS Pressures below the bypass removal setpoint.

2. Beactor Coolant System Pressure-Low Low Setooint i The RCS Pressure-Low Low Setpoint LPI actuation occurs in sufficient time to ensure LPI flow prior to the emptying of the core flood tanks during a large break LOCA. The Allowable Value of 2 500 psig ensures sufficient overlap of the core flood tank flow and the LPI flow to keep the reactor vessel downcomer full ,

during a large break LOCA.

To ensure the RCS Pressure-Low Low trip is not bypassed when assumed OPERABLE by the safety analysis, each channel's bypass removal bistable must be set (continued)

Crystal River Unit 3 B 3.3-50 Final Draft 10/01/93 l

l l

a ESAS Instrumentation ,

B 3.3.5 f3 Q BASES LCO 2. Reactor Coolant System Pressure-tow Low Setooint (continued) with an Allowable Value of-s 900 psig. The bypass ,

removal does not need to function for accidents ;

initiated by RCS Pressure below the bypass removal setpoint.

Reactor Buildina Pressure Three channels each of RB Pressure-High and RB Pressure-High High are required to be OPERABLE in each train. Each channel includes a pressure switch, bypass relays, and pressure switch trip auxiliary relays. An inoperable pressure switch renders only one channel in one train inoperable. Pressure switch trip auxiliary relays are train specific but may be shared among Parameters. Therefore, trip relay failure has the potential to render all affected Functions in one train inoperable.

1. Reactor Buildina Pressure-Hiah Setooint The RB Pressure-High Setpoint Allowable Value s 4 psig O. was selected to be low enough to detect a rise in RB Pressure that would occur due to a small break LOCA, thus ensuring that the RB high pressure actuation of ,

the safety systems will occur for a wide spectrum of ,

break sizes. The trip setpoint also causes the RB coolers to shift to low speed (performed as part of

the HPl logic) to prevent damage to the cooler fans due to the increase in the density of the air steam mixture present in the containment following a LOCA.

2. Reactor Buildina Pressure-Hiah Hiah Setooint The RB Pressure-High High Setpoint Allowable Value !

s 30 psig was chosen to be high enough to avoid actuation during an SLB, but also low enough to ensure a timely actuation during a large break LOCA. ,

APPLICABILITY The ESAS instrumentation for each Parameter is required to ';

be OPERABLE during the following MODES and specified conditions.

(continued)

Crystal River Unit 3 B 3.3-51 Final Draft 10/01/93

ESAS Instrumentation

~B 3.3.5 BASES APPLICABILITY 1. Reactor Coolant System Pressure--Low Setooint (continued)

The RCS Pressure-Low Setpoint actuation Parameter shall be OPERABLE during operation above 1700 psig.

This requirement ensures the capability to automatically actuate safety systems and components during conditions indicative of a LOCA or SLB. Below 1700 psig, the low RCS Pressure actuation Parameter-can be bypassed to avoid actuation during normal cooldown when safety system actuations are not required.

The allowance for the bypass is consistent with the plant transition to a lower energy state, providing greater margins to core and containment limits. The ,

response to any event, given that the reactor is already shut down, will be less severe and allows sufficient time for cperator action to provide manual safety system actuations. This is even more appropriate during plant heatup from an outage when i the RCS energy content is low.

2. Reactor Coolant System Pressure-Low low Setooint The RCS Pressure-Low Low Setpoint actuation Parameter shall be OPERABLE during operation above 900 psig.

This requirement ensures the capability to r automatically actuate safety systems and components during conditions indicative of a LOCA. Below 900 psig, the low low RCS Pressure actuation Parameter can be bypassed to avoid actuation during normal plant ;

cooldown. -

The allowance for the bypass is consistent with plant transition to a lower energy state, providing greater margins to core and containment limits. The response to any event, given that the reactor is already tripped, will be less severe and allows sufficient time for operator action to provide manual safety ,

system actuations. This is even more appropriate during heatup from an outage when the RCS energy content is low.

(continued)

Crystal River Unit 3 B 3.3-52 Final Draft 10/01/93 i

ESAS Instrumentation B 3.3.5 l BASES APPLICABILITY 3,4. Reactor Buildina Pressure-Hiah and Reactor Buildina (continued) Pressure-Hiah Hiah Setooints 1 The RB Pressure-High and RB Pressure-High High actuation functions of ESAS shall be OPERABLE in MODES 1, 2, and 3. In MODES 4, 5 and 6, there is insufficient energy in the primary and secondary systems to raise containment pressure to either the RB Pressure-High or RB Pressure-High High Setpoints in the event of a line break. Furthermore, there is adequate time for the operator to evaluate plant conditions and manually respond.

ACTIONS Required Actions A and B apply to all ESAS instrumentation Parameters listed in Table 3.3.5-1.

A Note has been added to the ACTIONS indicating separate Condition entry is allowed for each Parameter.

A.1 Condition A applies when one instrumentation channel in one or more RCS Pressure Parameters becomes inoperable. If one ESAS channel is inoperable, placing it in a tripped condition leaves the system in a one-out-of-two condition for actuation. Thus, if another channel were to fail, the ESAS instrumentation could still perform its actuation functions. For RCS Pressure-Low, this action is completed when all of the affected bistable trip auxiliary relays and time delay auxiliary relays are tripped. For RCS Pressure-Low Low, this action is completed when all of the affected bistable trip auxiliary relays are tripped. This is normally accomplished by tripping the affected bistable.

The I hour Completion Time is based on engineering judgment and is sufficient time to perform the Required Action.

B.1 Condition B applies when one required instrumentation channel in one or more RB Pressure Parameters becomes inoperable. If one required channel is inop.rable, placing it in a tripped Condition leaves the affected actuation (continued)

Crystal River Unit 3 8 3.3-53 Final Draft 10/01/93 l

ESAS Instrumentation B 3.3.5 BASES ACTIONS JL1 (continued) train in one-out-of-one condition for actuation and the other actuation channel in a two-out-of-two condition (making the worst case assumption the third channel in each actuation train is not OPERABLE). In this condition, if another RB Pressure ESAS channel were to fail, the ESAS '

instrumentation could still perform its actuation function.

For RB Pressure Parameters, all affected pressure switch trip auxiliary relays must be tripped to comply with this Required Action. This is normally accomplished by tripping the affected pressure switch test switch.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on engineering judgment and is sufficient time to perform the Required Action.

C.1. C.2. C.3 and C.4 If Required Actions A.1 or B.1 cannot be met within the associated Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within O 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and, for the RCS Pressure-Low Parameter, to

< 1700 psig, for the RCS Pressure-Low Low Parameter, to

< 900 psig, and for the RB Pressure High Parameter and High High Parameter, to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE All ESAS Parameter instrumentation listed in Table 3.3.5-1 REQUIREMENTS are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, CHANNEL CALIBRATION, and response time testing.

SR 3.3.5.1 Performance of the CHANNEL CHECK every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is (continued)

Crystal River Unit 3 B 3.3-54 Final Draft 10/01/93

ESAS Instrumentation l B 3.3.5 BASES l

SURVEILLANCE SR 3.3.5.1 (continued)

REQUIREMENTS based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK >

supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with the LC0's required channels.

Acceptance criteria are determined by the plant staff, and are presented in the Surveillance Procedures. The criteria may consider, but is not limited to channel instrument uncertainties, including isolation, indication, and readability. l SR 3.3.5.2 f A CHANNEL FUNCTIONAL TEST is performed on each required ESAS channel to ensure the entire channel will perform the intended functions.

The Frequency of 31 days is based on plant operating experience, with regard to channel OPERABILITY and drift, which demonstrates that failure of more than one channel of a given function in any 31 day interval is unlikely. l A Note has been added to indicate entry into the Required Actions of this Specification may be deferred for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for a channel inoperable for Surveillance testing provided the remaining two ESAS channels are capable of performing the associated ES Function. This allowance considers the average time required to perform the SR and is based on the inability to perform the Surveillance in the time permitted by the Required Actions or the undesirability of performing those ACTIONS.

(continued) l Crystal River Unit 3 B 3.3-55 Final Draft 10/01/93

ESAS Instrumentation- "

B 3.3.5 BASES i

SURVEILLANCE SR 3.3.5.3 REQUIREMENTS (continued) CHANNEL CALIBRATION is a complete check of the instrument channel, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift to ensure that the instrument channel remains operational between successive tests. ,

The Frequency is based on engineering judgment and industry accepted practice.

SR 3.3.5.4 ;

SR 3.3.5.4 ensures that the ESAS actuation channel response times are less than or equal to the maximum times assumed in the accident analysis. The response time values are the maximum values assumed in the safety analyses. Individual component response times are not modeled in the analyses.

Response time testing acceptance criteria are on a Function basis and are included in Reference 1. The analyses model gO the overall or total elapsed time from the point at which the parameter exceeds the actuation setpoint value at the sensor to the point at which the end device is actuated.

Thus, this SR encompasses the automatic actuation logic components addressed under LC0 3.3.7 and the operation..of the ES end devices.

Response time tests are conducted on an 24 month STAGGERED' TEST BASIS. This results in response time verification of all instrument channels every 72 months. The Frequency is based on plant operating experience, which shows that random failures of instrumentation components causing serious response time degradation but not channel failure are infrequent occurrences.

REFERENCES 1. FSAR, Chapter 7.

2. FSAR, Chapter 14.

3. FSAR, Chapter 6.

O Crystal River Unit 3 B 3.3-56 Final Draft 10/01/93

_ _ - . . . =_. _ . _ _ . _ . . .

ESAS Manual Initiation B 3.3.6 B 3.3 INSTRUMENTATION B 3.3.6 Engineered Safeguards Actuation System (ESAS) Manual Initiation BASES BACKGROUND The ESAS manual initiation capability allows the operator to actuate ESAS Functions from the main control room in the absence of any other initiation condition. Functions capable of being manually actuated include High Pressure Injection, Low Pressure Injection, and Reactor Building (RB)

Isolation and Cooling.

This LC0 covers only the system 'evel manual initiation of these Functions. LC0 3.3.5, " Engineered Safeguards Actuation System (ESAS) Instrumentation," and L00 3.3.7,

" Engineered Safeguards Actuation System (ESAS) Automatic Actuation Logic," provide requirements on the portions of the ESAS that automatically initiate the Functions described ,

earlier.

A manual trip push button is provided on the ES panel of the main control board for each Function for each actuation train. Operation of the push button energizes relays whose O contacts perform a logical "0R" function with the matrices of the automatic actuation logic, except for the matrices which are part of the ES buses loading sequence. Manual actuation of the ES buses loading sequence is made by de-energizing the block timers and the time delay auxiliary relays. The power supply for the manual trip relays is taken from the station batteries. Different batteries are used for the two trains.

The ESAS manual initiation channel is defined as the instrumentation between the console switch and the automatic actuation logic, (not to include the AAL) which actuates the end devices. Other means of manual initiation, such as controls for individual ES devices, may be available in the control room and other plant locations. These alternative means are not required by this LCO, nor are they credited to fulfill the requirements of this LCO.

The most notable example of a manual initiation not i addressed by the Technical Specification is Reactor Building j Spray The manual actuation of the Reactor Building Spray was designed to be done in two steps. The first step is the (continued)

Crystal River Unit 3 B 3.3-57 Final Draft 10/01/93 l i

m--,

ESAS Manual Initiation B 3.3.6'

( BASES

.i BACXGROUND manual actuation of the Reactor Building Isolation and (continued) Cooling to open the valves and the second step is the manual actuation of the Reactor Building Spray pumps Since Reactor Building Spray pumps have individual control switches on the control board, separate ESAS manual actuation switches were not provided. This logic scheme relies on the individual Reactor ruilding Spray pump control switches to meet the requirements of section 4.17 of proposed IEEE-279 dated August 30, 1968 (FSAR section 7.1.1).

APPLICABLE The ESAS manual initiation Function is a backup to automatic SAFETY ANALYSES initiation and allows the operator to initiate ES Systems operation whenever plant conditions dictate. The manual initiation Function is not assumed or credited in any accident or safety analysis.

The ESAS manual initiation instrumentation functions are included in Technical Specifications even though they do not strictly satisfy any Criterion of the NRC Policy Statement.

LC0 Two manual initiation channels of each ESAS Function are required to be OPERABLE whenever conditions exist that could require ES protection of the reactor or RB. Two OPERABLE channels ensure that no single failure will prevent system level manual initiation of at least one train of any ESAS Function. The ESAS manual initiation Function allows the operator to initiate protective action prior to automatic initiation or in the event the automatic initiation does not occur. ,

APPLICABILITY The ESAS manual initiation Functions shall be OPERABLE in MODES 1, 2, and 3, and in MODE 4 when the associated ,

Engineered Safeguard equipment is required to be OPERABLE.

The manual initiation channels are required consistent with the requirements for ES Functions to provide protection in these MODES. In MODES 5 and 6, accidents are slow to develop and would be mitigated by manual operation of individual components. Adequate time is available to evaluate plant conditions and to respond by manually operating the ES components, if required.

(continued)

Crystal River Unit 3 B 3.3-58 Final Draft 10/01/93

ESAS Manual Initiation i B 3.3.6 '

BASES (continued) .

ACTIONS A Note has been added to the ACTIONS indicating separate Condition entry is allowed for each ESAS manual initiation Function. 5 A.1 With one manual initiation channel of one or more ESAS Functions inoperable, the channel must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is based on plant operating experience and administrative controls, which provide alternative means of ESAS Function initiation via individual component controls.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is also consistent with the allowed outage time for a loss of redundancy condition for the safety systems actuated by ESAS. ;

B.1 and B.2 If the manual initiation channel cannot be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the plant must be placed in a MODE in which the LCO does not apply. To achieve this O status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required MODES from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.3,6.1 REQUIREMENTS SR 3.3.6.1 is a CHANNEL FUNCTIONAL TEST of the ESAS manual initiation. The SR verifies manual initiating circuitry is OPERABLE but does not actuate the end device (i.e., pump, valves, etc.). Proper operation of the Function is primarily monitored by ES logic matrix test lights (located on the ES Actuation relay cabinets). The 18 month Frequency is based on the need to perform this Surveillance under the '

conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance is performed with the reactor at power. This Frequency has been demonstrated to be sufficient, based on operating experience, which shows these components usually pass the Surveillance when performed on the 18 month Frequency. :

(continued)

Crystal River Unit 3 8 3.3-59 Final Draft 10/01/93

ESAS Manual Initiation B 3.3.6 BASES (continued)

REFERENCES None.

O l

O Crystal River Unit 3 B 3.3-60 Final Draft 10/01/93

)

ESAS Automatic Actuation Logic B 3.3.7 B 3.3 INSTRUMENTATION B 3.3.7 Engineered Safeguards Actuation System (ESAS) Automatic Actuation Logic BASES BACKGROUND The automatic actuation logic channels of ESAS include the logic between the bistable or pressure switch trip auxiliary relays and the ES equipment. It does not include the manual actuation auxiliary relay contacts which are addressed separately as part of LCO 3.3.6 "ESAS Manual Initiation."

Each of the components actuated by the ESAS Functions has an associated automatic actuation logic matrix. Certain end l devices, primarily valves, are actuated by both A and B train actuation signals and have two associated automatic i actuation logic matrices. If two-out-of-three ESAS instrumentation channels indicate an initiation signal, the automatic actuation logic is activated and the associated component is actuated. The purpose of requiring OPERABILITY of the ESAS automatic actuation logic is to ensure that >

Engineered Safeguards (ES) Functions will automatically initiate in the event of an accident requiring them.

Automatic actuation of some Functions is necessary to

.O prevent exceeding the Emergency Core Cooling Systems (ECCS) acceptance criteria in 10 CFR 50.46 (Ref. 1). It should be noted that OPERABLE automatic actuation logic channels alone will not ensure that each Function can be performed; the instrumentation channels and actuated equipment associated with each Function must also be OPERABLE to ensure that the Functions can be automatically initiated during an accident.

This LCO covers only the automatic actuation logic that initiates the Functions listed. LCO 3.3.5, " Engineered .

Safeguards Actuation System (ESAS) Instrumentation," and LC0 3.3.6, " Engineered Safeguards Actuation System (ESAS)

Manual Ipitiation," address the requirements for the instrumentation and manual initiation channels that input to the automatic actuation logic.

The ESAS, in conjunction with the actuated end-device equipment, provides protective functions necessary to mitigate Design Basis Accidents (DBAs). The ESAS relies on the OPERABILITY of the automatic actuation logic for each -

component to perform the actuation of the required systems.

O (continued)

Crystal River Unit 3 B 3.3-61 Final Draft 10/01/93

l ESAS Automatic Actuation Logic B 3.3.7 BASES (continued)

APPLICABLE Accident analyses rely on automatic ESAS actuation for ;

SAFETY ANALYSES protection of the core and RB and for limiting off-site !

doses following an accident. The accioents postulated include LOCA, SLB, and feedwater line break events that result in Reactor Coolant System (RCS) inventory reduction or severe loss of RCS cooling, ;

As the automatic actuation logic is part of the success path for assuring ES actuation, the safety analysis for the need for ES is applicable to them, as well. A more detailed

- description of this accident analysis is found in the Bases for LC0 3.3.5, "ESAS Instrumentation" and in Chapter 14 of the FSAR (Ref. 2).

The ESAS automatic actuation logics satisfy Criterion 3 of the NRC Policy Statement.

1 LCO The automatic actuation logic matrix for each component actuated by the ESAS is required to be OPERABLE whenever conditions exist that could require ES protection of the reactor or the RB. This ensures ES Systems will be O' automatically initiated as required, to mitigate the consequences of accidents. Matrices not performing a safety function (e.g., alarms and interlocks) are not addressed by this LCO.

APPLICABILITY ESAS automatic actuation logic shall be OPERABLE in MODES 1, 2, and 3, and in MODE 4 when the associated Engineered Safeguard (ES) equipment is required to be OPERABLE, because ES Functions are designed to provide protection in these MODES. Automatic actuation in MODE 5 or 6 is not required because accidents in these MODES are slow to develop and would be mitigated by manual operation of individual components. Adequate time is available to evaluate plant conditions and respond by manually operating the ES components, if required.

ACTIONS A Note has been added to the ACTIONS indicating separate Condition entry is allowed for each ESAS automatic actuation logic matrix.

(continued)

Crystal River Unit 3 B 3.3-62 Final Draft 10/01/93

-v . . - .. . .

ESAS Automatic Actuation Logic B 3.3.7 BASES ACTIONS A.1 and A.2 (continued)

With one or more automatic actuation logic matrices inoperable, the associated component (s) should be placed in the ES configuration. This manual Action essentially fulfills the safety function of the automatic actuation logic. In some circumstances, placing the component in its ES configuration would impose an undue operational restriction. In these cases, Required Action A.2 allows for the component status be left as-is, and the supported system component declared inoperable. Conditions which would i potentially preclude placing of a component in its ES configuration include, but are not limited to, violation of system separation, activation of fluid systems that could lead to thermal shock, or isolation of fluid systems that are normally functioning. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on operating experience and reflects the urgency associated with the inoperability of a safety system component.

SURVEILLANCE 3.3.7.1 O

SR REQUIREMENTS SR 3.3.7.1 is the performance of a CHANNEL FUNCTIONAL TEST on a 31 day STAGGERED TEST BASIS. The CHANNEL FUNCTIONAL TEST of the Automatic Actuation Logic need only demonstrate one combination of the three two-out-of-three logic combinations that are required to be OPERABLE. A different combination is tested at each test interval, such that all three combinations will be confirmed to be OPERABLE by the time the third successive test is completed. The Frequency is based on operating experience that demonstrates the low likelihood of more than one channel failing within the same 31 day interval.

A Note has been added to indicate entry into the Required Actions of this Specification may be deferred for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for a channel inoperable for Surveillance testing provided the remaining two ESAS channels are capable of performing the associated ES Function. This allowance considers the average time required to perform the SR and is based on the inability to perform the Surveillance in the time permitted by the Required Actions or the undesirability of performing those ACTIONS.

(continued)

Crystal River Unit 3 B 3.3-63 Final Draft 10/01/93

ESAS Automatic Actuation Logic B-3.3.7 BASES (continued)

REFERENCES 1. 10 CFR 50.46.

2. FSAR, Chapter 14.

O I

O l t Crystal River Unit 3 8 3.3-64 Final Draft 10/01/93

EDG LOPS B 3.3.8 B 3.3 INSTRUMENTATION B 3.3.8 Emergency Diesel Generator (EDG). Loss of Power Start (LOPS)

BASES BACKGROUND Maintaining the voltage level of the ES buses consistent with the design voltage range of connected equipment is vital to the operation of ES equipment. Marked reductions in bus voltage may result in damage to buses, cables, contactors, and associated loads due to increases in current necessary for the equipment to operate at reduced voltage.

Similarly, low voltage conditions may prevent safety-related motors from developing the torque necessary for starting and

accelerating to design speed, or cause control circuit fuses to blow due to increased current flow.

To protect the ES equipment from damage due to sustained undervoltage conditions, and to provide for rapid re-energization of ES buses in the event of a total loss of voltage, degraded voltage and loss of voltage detection channels are provided. A degraded voltage conditions or a total loss of off 4ite power to the 4160 volt ES Buses 3A and 3B is detected ty degraded and loss of voltage relays within

( the respective switchgear. Two separate sets of relays with independent channels are provided for this purpose, known as first and second level endervoltage relays (FLUR and SLUR),

respectively. The FLORs are designed to detect a complete loss of voltage, and the SLURS detect sustained, degraded voltage conditions.

Three loss of voltage channels are provided for ES bus 3A and three for ES bus 3B. Each channel provides monitoring of voltage on its respective 4160 volt ES bus, and controls starting of the associated train's emergency diesel generator (EDG). Each loss of voltage channel consists of a loss of voltage relay and an associated auxiliary relay.

Additionally, four tripping relays, and one auxiliary relay source monitor are shared among the three channels. The loss of voltage relays (one per electrical phase) are arranged in a two-out-of-three logic scheme, with a maximum ;

trip time of 8.35 seconds at zero volts. These relays control the status of their associated auxiliary relays. l The auxiliary relay contacts are arranged in a two-out-of- !

three logic scheme, such that a loss of voltage actuation l (continued)

Crystal River Unit 3 8 3.3-65 Final Draft 10/01/93 l

EDG LOPS -

B 3.3.8' O BASES kJ BACKGROUND will occur only if at least two of the loss of voltage (continued) relays are tripped. Although not required for OPERABILITY, the auxiliary relay source monitor provides an alarm if any one of the three relays are actuated, indicating a possible failure of one of the potential transformers connecting the undervoltage relays to the respective phase of the' 4160 volt '

ES bus.

Three degraded voltage channels are provided for both ES Bus

. 3A and ES Bus 3B. Each channel monitors the voltage on an electrical phase (A, B, and C) of the associated 4160 volt ES bus, and provides for automatic starting of that train's EDG on a sustained, degraded voltage.

Each degraded voltage channel consists of a degraded voltage relay and an associated initiate time relay. An auxiliary ,

relay is common to the degraded voltage channels. The three degraded voltage relay contacts are arranged in series, such that a three-out-of-three logic scheme is required to initiate a channel actuation in response to a degraded voltage condition. The degraded voltage relays are time delay relays set to trip after S seconds with a sustained ES bus voltage between 3933 and 3970 volts. The degraded voltage relays interface with the loss of voltage channels

' previously described, to control ES bus load shedding' and diesel generator starting. In the event of sustained degraded voltage condition on a bus, the associated EDG is started via the auxiliary relay, and the load strip timing relay is reset and commences load shedding after some delay.

Upon commencement of load shedding, the timing relay is reset and breaker closure occurs within the next 3 seconds.

Providing a 3 second delay assures that the respective bus is completely deenergized, and appropriate loads shed prior to closure of the diesel generator breaker. If an ESAS signal is present, sequential block loading of the EDG will then occur.

APPLICABLE Mitigation of most plant transients or accidents is SAFETY ANALYSES accomplished through the actuation and operation of ES equipment. Operation of this equipment is dependent upon availability of an adequate source of AC power. While the necessary ES bus power would normally be provided from the

(

(continued)

Crystal River Unit 3 8 3.3-66 Final Draft 10/01/93

EDG LOPS B 3.3.8 e BASES APPLICABLE 230 kv offsite transmission system, the safety analysis SAFETY ANALYSES conservatively considered offsite power to be lost (continued) coincident with the initiation of numerous DBAs. The assumptions related to power source OPERABILITY in the ,

accident analyses are based upon maintaining at least one '

train of the onsite AC and DC power sources and associated distribution systems OPERABLE during accident conditions, with (1) an assumed loss of offsite power and (2) and single :

failure which prevents the operation of one EDG.

The ESAS monitors plant parameters such as reactor coolant (RC) system and containment pressure to detect changes which are indicative of accidents such as a LOCA or MSLB. In the event that the monitored variables exceed actuation setpoints, ES actuation signals will be developed by ESAS, automatically starting equipment needed for mitigation of the event detected. One of these output signals is a demand for EDG starting. Thus, the EDGs will be automatically started following an ES actuation in anticipation of the need to provide power to ES equipment following a' loss of the offsite power source, (Ref.1). In this case, operation of neither the ESAS loss of voltage or degraded voltage ,

Function is needed for signaling automatic starting of the 4

(~ EDGs. However, initiation of ES bus shedding, EDG breaker closure, and subsequent block loading of the EDGs in the event of a coincident degradation of offsite power is dependent upon the auxiliary relays of these channels. ,

Therefore, the loss of voltage and degraded voltage Functions are essential to the restoration of power to ES equipment following any event which results in, or occurs with a failure in the offsite power supply to the 4160 volt ES Buses. In addition to supporting operation of the EDGs -

following events which result in ES actuation, degraded voltage channels protect ES equipment from damage due to operation with reduced voltage. Similarly, the loss of voltage channels will ensure availability of power from the AC ES buses to equipment required for normal plant operations.

(continued)

Crystal River Unit 3 B 3.3-67 Final Draft 10/01/93 J

J

- w , -

EDG LOPS B 3.3.8 BASES U

APPLICABLE In the case of degraded voltage or complete loss of voltage SAFETY ANALYSES on the 4160 Volt-ES Buses due to faults affecting the 230 kV-(continued) offsite power supply (no ES signal present), the respective channels will detect the condition and signal automatic starting of the EDG associated with the affected ES bus.

EDG LOPS instrumentation satisfies Criterion 3 of the NRC Policy Statement.

LC0 The LCO for the FLURs and SLURS requires that three channels per bus of each LOPS instrumentation Function shall be

OPERABLE in MODES 1, 2, 3, and 4 when the EDG supports safety systems associated with the ESAS. In MODES 5 and 6, the three channels must be OPERABLE whenever the associated EDG is required to be OPERABLE to ensure that the automatic start of the EDG is available when needed.

Loss of LOPS Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents.

O Sl.URs Voltage: The minimum Allowable Value is chosen to ensure that safety-related end devices at 480V level and 120V level receive adequate voltage. The minimum allowable voltage of 3933V includes an allowance for relay errors, calibration error, and potential transformer error.

The maximum Allowable Value is not based on equipment operability concerns, but rather avoidance of unnecessary EDG starts due to spurious channel trip.

Time Delay: The response time includes 5 seconds for-undervoltage relay actuation following detection of degraded ES bus voltage. The acceptance criteria accounts for the setpoint tolerance of 10% or 1 0.5 seconds.

1 i

I l

(continued)

Crystal River Unit 3 8 3.3-68 Final Draft 10/01/93

EDG LOPS {

B 3.3.8 i

BASES l LCO FLURs (continued)

The FLURs instrumentation associated with each ES 4160 V bus is required to be OPERABLE upon a loss of voltage. For each voltage value, the associated channel response time is based on the physical characteristics of the loss of voltage sensing relays. The loss of voltage channels respond to a complete loss of ES bus voltage, providing automatic starting and loading of the associated EDG. However, their response time is not critical to the overall ES equipment response time following an actuation, since the SLURS instrumentation will also respond to the complete loss of voltage, and will do so earlier than the loss of voltage instrumentation. Upon a complete loss of voltage from full voltage to 0.0V, the loss of voltage relays will respond in 7.8 seconds with a tolerance of 7% or 0.55 seconds.

APPLICABILITY The EDG LOPS actuation Function for each EDG shall be OPERABLE in MODES 1, 2, 3, and 4 to provide protection for equipment powered from the Class 1E AC Electrical Power Distribution System in these MODES. The ability to start O the EDG on a degraded or loss of voltage condition is also required for the EDG required to be OPERABLE by LC0 3.8.2, "AC Sources-Shutdown."

ACTIONS A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each Function. Since the required channels are specified on a per EDG basis, the Condition may be entered separately for each EDG.

4 A.1 If one channel per EDG in one or more Functions is inoperable, it must be tripped within I hour. Since there is no installed trip for the relays, a more liberal reading of the requirements is that the function of the relay must be accomplished and maintained. This involves jumpering the relay or taking other action such that the function is accomplished. With a FLUR channel in trip, the channel is configured in a one-out-of-two logic to initiate an EDG start on loss of offsite power. In trip, one additional (continued) 1 i Crystal River Unit 3 B 3.3-69 Final Draft 10/01/93 j

! i 1

_ __________________________________________________________________o

EDC LOPS l B 3.3.8 l

)

i BASES ACTIONS A.1 (continued) valid actuation will cause a start of the associated EDG.

With a SLUR channel in trip, the Function is configured in a two-out-of-two logic. This configuration precludes the possibility of a single failure initiating the protective function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is reasonable to- -

evaluate and to take action by correcting a degraded condition in an orderly manner and takes into account the low probability of an event requiring this instrumentation occurring during this interval.

B.1 Condition B applies when two or more undervoltage or two or more degraded voltage channels associated with a single ES 4160 V bus are inoperable.

Required Action B.1 requires all but one inoperable channel to be restored to OPERABLE status within I hour. With two or more FLUR channels inoperable, the logic is not capable of providing an automatic EDG LOPS signal for valid loss of O voltage or degraded voltage conditions. Alternately, both channels cannot be placed in the trip condition at the same time or an EDG start would occur. With two SLUR channels inoperable, the channels could be placed in trip and an actuation could not occur (configuration would become one-out-of-one). However, the potential for spurious failure to cause an actuation necessitates action be taken. The I hour Completion Time is reasonable to evaluate and to take action by correcting the degraded condition in an orderly manner and takes into account the low probability of an event requiring this instrumentation occurring during this interval.

(continued)

Crystal River Unit 3 B 3.3-70 Final Draft 10/01/93

EDG LOPS B 3.3.8 O

V BASES ACTIONS C.1 (continued)

Condition C is the default Condition should Required Action A 1 or B.1 not be met within the associated Completion Time.

Required Action C.1 ensures that Required Actions for affected diesel generator inoperabilities are initiated.

Depending on MODE, the Actions specified in LC0 3.8.1, "AC Sources-Operating," or LC0 3.8.2, are required to be entered immediately.

SURVEILLANCE SR 3.3.8.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed on each required EDG LOPS channel to ensure the entire channel will perform the intended function. This test ensures functionality of each channel to output relays.

The Frequency of 31 days is considered reasonable based on the reliability of the components and on operating experience.

A Note has been added to allow performance of the SR without taking the ACTIONS for an inoperable instrumentation channel although during this time period the relay instrumentation cannot initiate a diesel start. This allowance is based on the assumption that 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is the average time required to perform channel Surveillance. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months testing allowance does not significantly reduce the availability of the EDG.

SR 3.3.8.2 A CHANNEL CALIBRATION is a complete check of the instrument channel, including the sensor. The setpoints and the response to a loss of voltage and a degraded voltage test shall include a single point verification that the trip occurs within the required delay time, as shown in Reference 2.

(continued)

Crystal River Unit 3 8 3.3-71 Final Draft 10/01/93

c.

EDG LOPS B 3.3.8 i

' () BASES ,

SURVEILLANCE SR 3.3.8.2 (continued) '

REQUIREMENTS The 18 month Frequency is based on operating experience and -

industry-accepted practice.

A Note has been added indicating the voltage sensing device ,

(bus potential transformer) may be excluded from testing since these transformers are passive, inherently stable '

devices which cannot be calibrated. In the event of transformer failure, the corresponding degraded voltage or loss of voltage relays would trip on low voltage, actuating the associated channel (i.e., the channels fail in the safe condition). In addition, annunciation of failure of a single transformer or associated circuits would be provided via the ,

channel monitor relay, identifying to the operator a failure ,

within the loss of voltage or degraded voltage channels. 1 T

REFERENCES 1. FSAR, Chapter 14.

2. FSAR, Section 8.3.

O 8 i

1 t'

O Crystal River Unit 3 8 3.3-72 Final Draft 10/01/93 i

Source Ra. ige Neutron Flux B 3.3.9 B 3.3 INSTRUMENTATION B 3.3.9 Source Range Neutron Flux BASES BACKGROUND The source range neutron flux channels provide the operator -

with an indication of the approach to criticality at lower neutron power levels than can be monitored by the intermediate range neutron flux instrumentation. These channels also provide the operator indication of changes in reactivity that may occur during other shutdown operations.

The normally relied upon source range instrumentation (NI-1 and -2) consist of two redundant count rata channels originating in two high sensitivity proportional counters.

The two detectors are externally located on opposite sides of the core 180* apart. These channels are used over a neutron count rate range of 0.1 cps to IE6 cps and are displayed on the main control board (MCB) in terms of log count rate. The channels also measure the rate of change of the neutron flux level, which is displayed on the MCB in terms of startup rate from -0.5 decades to +5 decades per minute. An interlock provides a control rod withdraw O " inhibit" on a high startup rate of +2 decades per minute in either channel.

The proportional counters of the source range channels are BF3 chambers. High voltage will be turned off automatically when the flux level on a start-up (count rate increasing) is above IE-9 amp as seen by both intermediate range channels, or 10% RTP in NI-5 or -6 and NI-7 or -8 power range channels. Conversely, the high voltage is turned on automatically when the flux level returns to within approximately one decade of the detectors' maximum useful range.

Although not normally relied upon to perform the source range neutron flux level monitoring function, the post-accident monitoring instrumentation wide range neutron flux (NI-14, -15) have been shown to be functionally equivalent to NI-l and NI-2 and may be used to comply with this LCO.

(continued)

Crystal River Unit 3 B 3.3-73 Final Draft 10/01/93

Source Range Neutron Flux B 3.3.9 BASES (continued)

APPLICABLE The source range neutron flux channels are necessary to SAFETY ANALYSES monitor core reactivity changes. They are also the primary means for. detecting and triggering operator actions to respondd 5 reactivity transients initiated from conditions in which the Reactor Protection System (RPS) is not required to be OPERABLE. However, the monitors are not assuned as part of any accident analysis sequence.

LC0 Two source range neutron flux channels are required to be OPERABLE during MODE 2 with each intermediate range channel s SE-10 amps or NI-5 or NI-6, and NI-7 or NI-8 1 5% RTP; and MODES 3, 4 and 5 since they are the primary indication of core neutron power at low power levels.

Above the neutron power level specified for MODE 2, the source range instrumentation is not the primary neutron power level indication and the high voltage to the detector has been removed. The setpoints are based upon the power levels where the instrumentation is re-energized on decreasing flux levels.

APPLICABILITY Two source range neutron flux channels are required in MODES 2, 3, 4 and 5. In MODE 2, OPERABILITY of the instrumentation ensures redundant indication during an approach to criticality. The intermediate range and power range instrumentation provide sufficient neutron flux level indication with the reactor critical; therefore, source range instrumentation is not required in MODE 1 (the instrumentation is de-energized and cannot function anyway).

In MODES 3, 4, and 5, source range neutron flux instrumentation provide the operator.with a means of j monitoring changes in SDM and provides an indication of reactivity changes. l The requirements for source range neutron flux !

instrumentation during MODE 6 are addressed in LCO 3.9.2, j

" Nuclear Instrumentation." i l

l (continued)

Crystal River Unit 3 B 3.3-74 Final Draft 10/01/93 l

l l

Source Range Neutron Flux j B 3.3.9 l BASES (continued)

ACTIONS A.1 With one channel of the source range neutron flux indication inoperable, any action to increase reactor power must be '

suspended until the channel is restored to OPERABLE status.

This Action restricts THERMAL POWER increases in a range of operation where the source range instrumentation are the i primary means of neutron power level indication.

Furthermore, it ensures that power remains below the point :

where the intermediate range channels come on-scale until ,

both source range channels are available to support the overlap verification required by SR 3.3.9.3. This ensures a transition from one monitoring instrument to another of different range with the reactivity conditions on both sides of the core known. 7 B.I. B.2. B.3 and B.4 With both source range neutron flux channels inoperable, action is required to preclude increases in neutron count rate requiring source range monitoring capability. This is accomplished by immediately suspending positive reactivity O additions and initiating action to insert all CONTROL RODS, aad opening the CONTROL R0D drive trip breakers within I hour. Periodic SDM verification (of 21% Ak/k) is then ,

required to provide a means for detecting any slow reactivity changes that could be caused by mechanisms other than CONTROL R0D withdrawal or positive reactivity insertions. Since the source range instrumentation provides the primary indication of power in this plant operating condition, the verification of SDM must continue every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months until at least one channel of source range instrumentation is returned to OPERABLE status. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time for Required Action B.3 and Required Action B.4 are based upon providing sufficient time to i accomplish the actions. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency for :

performing the SDM verification is considered adequate to detect any reactivity changes which do occur before SDM limits are approached. 5 i

l (continued)

Crystal River Unit 3 B 3.3-75 Final Draft 10/01/93 l

i l

Source Range Neutron Flux j B 3.3.9 l BASES (continued)

SURVEILLANCE SR 3.3.9.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. ,

The CHANNEL CHECK is a comparison of the parameter indicated on one channel to the other channel. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one.

of the channels or of something even more serious.

Acceptance criteria are determined by the plant staff and presented in the Surveillance Procedure, based on a ,

combination of the channel instrument uncertainties.

The Frequency, about once every shift, is based on operating experience. When operating in Required Action A.1, CHANNEL CHECK is still required for the OPERABLE source range instrument. However, in this Condition, a redundant source range may not be available for comparison. In this case, CHANNEL CHECK may still be performed via comparison with other on-scale neutron flux level initiation, if available, and verification that the OPERABLE source range channel is O. energized and indicating a value consistent with current plant status.

SR 3.3.9.2 CHANNEL CALIBRATION is a complete check and readjustment of the channels from the preamplifier input to the panel ,

meters. The calibration verifies the channel responds to measured parameters within the necessary range and accuracy and leaves the channel adjusted to account for instrument drift. This ensures that the instrument channel remains '

operational between successive tests. .

The SR is modified by a Note excluding neutron detectors from CHANNEL CALIBRATION. It is not necessary to test the detectors because generating a meaningful test signal is '

difficult. The detectors are of simple construction, and l (continued)

Crystal River Unit 3 B 3.3-76 Final Draft 10/01/93 l

n Source Range Neutron Flux i B 3.3.9 fI x_s/

BASES t

SURVEILLANCE SR 3.3.9.2 (continued) ,

REQUIREMENTS any failures in the detectors will be apparent.as' change in channel output. The Frequency of 18 months is based on '

operating experience and industry-accepted practice. .

SR 3.3.9.3 SR 3.3.9.3 is the verification of one, decade of overlap

between source and intermediate range neutron flux instrumentation. The SR is-required to be performed prior :

to source range count rate exceeding 310 cps if it has not ?

been performed within-7 days prior to reactor startup.

Failure to verify one decade of overlap on one or more source range channels requires the plant to be maintained in -

subcritical condition until the verification can be made.

This ensures a continuous source of neutron power indication during the approach to criticality. The verification may be omitted if performed within the previous 7 days. The 7 day portion of the Frequency is based on operating experience, which shows that source range and intermediate range. '

instrument overlap does not change appreciably over this O time interval.

REFERENCES None.

i 1

Crystal River Unit 3 B 3.3-77 Final Draft 10/01/93 i

Intermediate Range Neutron Flux B 3.3.10 B 3.3 INSTRUMENTATION B 3.3.10 Intermediate Range Neutron Flux BASES BACKGROUND The intermediate range neutron flux channels provide the operator with an indication of reactor. power at power levels between the source range and power range instrumentation.

The intermediate range instrumentation has two log N channels which monitor neutron power levels by means of electrically identical gamma compensated ion chambers (CIC). The CIC are electrically adjustable with separate adjustable high voltage power supply and an adjustable compensating voltage supply. Each channel provides eight decades of flux level information in terms of the log of ion chamber current from 1E-Il amp to IE-3 amp. The channels also measure the rate of change of the neutron flux level, which is displayed for the operator in terms of startup rate ,

from -0.5 decades to +5 decades per minute. A startup rate of +3 decades per minute in either channel will initiate a-CONTROL R00 withdrawal inhibit.

O APPLICABLE Intermediate range neutron flux channels are necessary to SAFETY ANALYSES monitor core reactivity changes during a reactor startup.

As such, they are the primary indication to trigger operator '

actions in the event of reactivity transients starting from low power conditions. However, the monitors are not assumed as part of any accident analysis sequence. ,

i (continued)

Crystal River Unit 3 8 3.3-78 Final Draft 10/01/93

. -. .- - =- - _ -- -. . - . . - . . -

I 1

! Intermediate Range Neutron Flux B 3.3.10 BASES (continued)

LC0 Two intermediate range neutron flux instrumentation channels '

shall be OPERABLE to provide the operator with redundant neutron flux indication. These enable operators to monitor and control the increase in power and to detect neutron flux !

transients prior to the power range instrumentation coming on scale. Violation of this LCO would limit the ability to "see" reactivity conditions throughout the core and could prevent the operator from detecting and controlling neutron flux transients that could result in reactor trip during power escalation.

APPLICABILITY The intermediate range neutron flux channels shall be OPERABLE in MODE 2 and in MODES 3, 4 and 5 when any CONTROL R0D drive (CRD) trip breaker is in the closed position and the CRD Control System (CRDCS) is capable of rod withdrawal.

The intermediate range instrumentation is designed to detect power changes during initial criticality and power escalation when the power range and source range ;

instrumentation cannot provide indication. Since an approach to criticality could exist in all of these MODES, O the intermediate range instrumentation must be OPERABLE.

ACTIONS A.1 With one intermediate range channel inoperable, the plant is .

exposed to the potential Br a single failure to disable all neutron monitoring instrumentation. To avoid this, the ,

inoperable channel must be repaired prior to increasing THERMAL POWER > 5% RTP. This limits power increases in a range where the operators rely on the instrumentation for power level indication.

The Completion Time is based on engineering judgment. t B.1 and 8.2 With two intermediate range neutron flux channels inoperable, the operators must place the reactor in the next i lowest condition for which the intermediate range l

)

(continued)

Crystal River Unit 3 B 3.3-79 Final Draft 10/01/93

Intermediate Range Neutron Flux B 3.3.10 BASES

(}

ACTIONS B.1 and B.2 (continued) instrumentation is not required. This involves immediately suspending operations involving positive reactivity changes and, within I hour, placing the reactor in the tripped condition with the CRD trip breakers open. The Completion Times are based on operating experience and allow sufficient time to manually insert the CONTROL RODS prior to opening the CRD breakers.

SURVEILLANCE SR 3.3.10.1 REQUIREMENTS The CHANNEL CHECK is a comparison of the parameter indicated on one channel to the other channel. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious.

() When operating in Required Action A.1, CHANNEL CHECK is still required for the OPERABLE intermediate range instrument. However, in this condition, a redundant >

intermediate range may not be available for comparison. In this case, CHANNEL CHECK may still be performed via comparison with other on-scale neutron flux level indication, if available, and verification that the OPERABLE intermediate range channel is energized and indicates a value consistent with current plant status.

SR 3.3.10.2 8

For intermediate range neutron flux channels, CHANNEL CALIBRATION is a complete check and readjustment of the channels, from the preamplifier input to the panel meters.

The calibration verifies the channel responds to a measured parameter within the necessary range and accuracy and leaves the channel adjusted to account for instrument drift. This i ensures that the instrument channel remains operational between successive tests.

(continued)

O ,

Crystal River Unit 3 B 3.3-80 Final Draft 10/01/93 i

l

Intermediate Range Neutron Flux B 3.3.10 BASES SURVEILLANCE SR 3.3.10.2. (continued)

REQUIREMENTS The SR is modified by a Note excluding neutron detectors from CHANNEL CALIBRATION. It is not necessary to test the detectors because generating a meaningful test signal is difficult. In addition, the detectors are of simple construction, and any failures in the detectors will be apparent as a change in channel output. The 18 month Frequency is based on operating experience and industry-accepted practice.

SR 3.3.10.3 SR 3.3.10.3 is the verification of one decade of overlap between intermediate and power range neutron flux instrumentation. The SR is required to be performed prior to intermediate range indication exceeding IE-6 amp if it has not been performed within 7 days prior to reactor startup. Failure to verify one decade of overlap on one or more channels requires the plant to remain in a condition where the intermediate range channels provide adequate indication until the verification can be made. This ensures O a continuous source of power indication during the transition from one range of indication to the next higher one.

The test may be omitted if performed within the previous 7 days. The 7 day portion of the Frequency is based on operating experience, which shows that intermediate range instrument overlap does not change appreciably over this time interval.

REFERENCES None.

)

i l

Crystal River Unit 3 B 3.3-81 Final Draft 10/01/93 l

l EFIC Instrumentation l B 3.3.11 j l

B 3.3 INSTRUMENTATION B 3.3.11 Emergency Feedwater Initiation and Control (EFIC) Instrumentation BASES BACKGROUND The EFIC System instrumentation is designed to provide safety grade means of controlling the secondary system as a heat sink for core decay heat removal. To ensure the secondary system remains a heat sink, EFIC initiates emergency feedwater (EFW) when the primary source of feedwater is lost. The system also isolates functional components following a high energy line break within the secondary system. These actions ensure that a source of -

cooling water is available to a once through steam generator (OTSG) that has a controlled steam pressure, thereby fixing the heat sink temperature at the saturation temperature of the secondary system. The EFIC Functions that are supported by the instrumentation and the parameters that are needed for each of these Functions are described next.

EFIC instrumentation consists of devices and circuitry to generate the following signals when monitored parameters reach pre-set levels.

O a. EFW Initiation;

b. EFW Vector Valve Control;

c. Main Steam Line Isolation; and

d. Main feedwater (MFW) Isolation.

EFW is initiated to restore a source of cooling water to the secondary system when conditions indicate that the normal source of feedwater is insufficient to continue heat removal. The two indications used for ensuring EFW in this ,

condition are the loss of both MFW pumps and a low level in !

the OTSG. EFW is also initiated at the same time EFIC l performs the MFW isolation function. This is done by initiating EFW when 0TSG outlet pressure reaches the low ,

OTSG pressure setpoint for isolation of main steam and MFW, l and EFW vector valve control. EFW is initiated when the Reactor Coolant System experiences a total loss of forced (continued)

O Crystal River Unit 3 8 3.3-82 Final Draft 10/01/93 b

EFIC Instrumentation B 3.3.11

, BASES BACKGROUND circulation. This initiation, utilizing the RPS signal for (continued) reactor coolant pump (RCP) status, ensures EFW is available to automatically raise OTSG levels to natural circulation cooling. Finally, EFIC initiates EFW when an actuation is received on HPI Channel A and B. This ensures EFW is available under the worst-case, small break loss of coolant accident (LOCA) conditions when high OTSG water levels are necessary for primary to secondary heat transfer. If adequate subcooling margin is lost, the operator must manually select the 95% setpoint since EFIC will not automatically raise levels to this point.

EFIC also isolates main steam and MFW to an OTSG that has lost pressure control. With the loss of pressure control, temperature control is also lost and the heat removal rate becomes excessive. Main steam and MFW are isolated to the affected 0TSG when steam pressure reaches a low setpoint, a condition which is well below the normal operating pressure of the secondary system.

EFIC also performs an EFW control function to avoid delivering EFW to a depressurized 0TSG when the other OTSG remains pressurized. This feed-only-the-good-generator (F0GG) logic is consistent with the design goal of isolating Os~

functional components whose pressure cannot be controlled.

F0GG logic precludes delivery of emergency feedwater to a depressurized OTSG, thereby preventing an uncontrolled cooldown as long as the other OTSG remains pressurized.

When both OTSGs are depressurized, the EFIC logic provides EFW flow to both OTSGs until a significant pressure difference develops between the two, thereby ensuring that core cooling is maintained.

Each EFW actuation logic train actuates on a one-out-of-two taken twice combination of trip signals from the instrumentation channels. Each EFIC channel can issue an initiate command, but an EFIC actuation will take place only if at least two channels issue initiate commands. The one-out-of-two taken twice logic combinations are transposed between trains so that failure of two channels prevents actuation of, at most, one train of EFW.

More detail.ed descriptions of tne EFIC instrumentation are '

provided next.

A (continued)

U Crystal River Unit 3 B 3.3-83 Final Draf t 10/01/93 l

EFIC Instrumentation B 3. L 11 BASES BACKGROUND 1. EFW Initiation.

(continued)

Figure 7-26 of the FSAR, Chapter 7 (Ref. 4) illustrates one channel of the EFIC EFW Initiation channel. The individual instrumentation channels that input to the EFIC EFW Initiation Function are '

discussed next. The AMSAC and HPI-based EFW Initiation Functions are not described further in these Bases since they are not addressed by Technical Specifications. ;

a. Loss of MFW Pumos (Control Oil Pressurel Loss of both MFW Pumps is one of the parameters mon!tored by EFIC to automatically initiate EFW.

MFW pump status (and thus the indication of Loss of MFW Pumps) is detected by MFW pump turbine control oil pressure. The MFW pump status instrumentation is a part of the nuclear instrument (NI)/ Reactor Protection System (RPS).

Each RPS channei receives MFW Pump status information from pressure switches (four per pump). If both switches in a single channel O trip, the associated RPS channel trips. Each RPS channel acts as the sensor for this EFIC Function by providing both MFW Pumps tripped signal indication to the associated EFIC channel. The trip Function is bypassed when THERMAL POWER-s 20% RTP and the RPS is placed in shutdown bypass. The bypass is automatically removed when THERMAL POWER increases above 20% RTP. i Loss of both MFW Pumps was chosen as an EFW automatic initiating parameter because it is a direct and immediate indicator of loss of MFW,

b. OTSG Level-Low Four dedicated low range level transmitters on each OTSG are monitored to generate the signals used for an OTSG Level-Low EFW actuation. The output from each transmitter provides a signal to each of the four EFIC channels A, B, C, and D.

(continued)

Crystal River Unit 3 B 3.3-84 Final Draft 10/01/93 l

EFIC Instrumentation B 3.3.11 (h

w BASES BACKGROUND b. OTSG Level-low (continued)

The signals are also used by EFIC after EFW has been actuated to control OTSG level at the low level setpoint of 30 inches when one or more RCPs are operational.

The lower and upper taps for the low range level transmitters are located at 6 inches and 277 inches, respectively, above-the upper face of the OTSG's lower tube sheet. The string is calibrated such that only the first 150 inches of indication are used. OTSG Level-Low was. chosen as an EFW automatic initiation parameter because it represents a condition where feedwater is ,

insufficient to meet the primary heat removal requirements and additional cooling water is necessary,

c. OTSG Pressure-Low Four transmitters associated with each 0TSG.

provide the EFIC System with channels A through D O of OTSG Pressure-Low. These same transmitters provide input signals to EFIC MFW and Main Steam Line Isolation Functions. When OTSG pressure drops below the bistable setpoint of 600 psig on a given channel, an EFW Initiation signal is sent to both trains of automatic actuation logic. The low pressure Function may be manually bypassed when pressure in either OTSG is less than 750 psig. The EFIC channel bypass is automatically removed when both OTSGs outlet pressure increases above 750 psig. The low pressure operational bypass allows for normal cooldown without EFIC actuation.

OTSG Pressure-Low is a primary indication and actuation signal for steam line breaks (SLBs) or- ,

feedwater line breaks. For small breaks, which l do not depressurize the OTSG or take a long time ;

to depressurize, automatic actuation is not required. The operator has time to diagnose the problem and take the appropriate actions. !

(continued)

Crystal River Unit 3 B 3.3-85 Final Draft 10/01/93

EFIC Instrumentation B 3.3.11 I

m BASES BACKGROUND d. RCP Status (continued)

A loss of power to all four RCPs is an immediate indication of a pending loss of forced flow in the Reactor Coolant System. The.RPS acts as the sensor for this EFIC Function by providing a loss of RCP indication for each pump to each EFIC channel.

When a minimum of two EFIC channels recognize the loss of all RCPs, EFIC will automatically actuate EFW and control level to approximately 65% in the OTSG. This higher setpoint provides a thermal center in the OTSG at a higher elevation than that of the reactor to ensure natural circulation as long as adequate subcooling margin-is maintained.

To allow RCS heatup and cooldown without - '

actuation, a bypass permissive of 10% RTP is used. The 10% bypass permissive was chosen because it was an available, qualified Class IE signal at the time the EFIC System was designed.

O When the first RCP is started, the " loss of four RCPs" initiation signal may be manually reset.

If the bypass is not manually reset, it will be automatically reset at 10% RTP. During cooldown, the bypass may be inserted at any time THERMAL POWER has been reduced below 10%. However, for most operating conditions, it is recommended that this trip function remain active until after the Decay Heat Removal System has been placed in operation and just prior to tripping the last

RCP. This trip function must be bypassed prior to stopping the last RCP in order to avoid an EFW actuation.

l (continued)

Crystal River Unit 3 B 3.3-86 Final Draft 10/01/93

EFIC Instrumentation B 3.3.11 P'

BASES

(

?

BACKGROUND 2. EFW Vector Valve Control (continued)

Figure 7-26 of the FSAR, Chapter 7 (Ref. 4)-

illustrates one channel of the EFIC EFW Vector Valve Control logic. The function of the EFW vector logic is to determine whether EFW should be fed to one or the other, or both, OTSG. This EFIC function prevents the continued addition of EFW to a depressurized 0TSG and, thus, minimizes.the overcooling effects (and subsequent positive reactivity addition) due to a high energy line break on the secondary side.

Each set of vector logic receives OTSG pressure information from bistables located in the input logic of the same EFIC channel. The pressure information received is:

a. OTSG A pressure less than 600 psig;

b. OTSG B pressure less than 600 psig;

c. OTSG A pressure 125 psid greater than-0TSG B pressure; and

d. OTSG B pressure 125 psid greater than OTSG A pressure.

Each vector logic also receives a vector / control enable signal from both EFIC actuation channel A and channel B when EFW is initiated. The vector logic develops signals to open or to close OTSG A and B EFW valves. The vector logic outputs are in a neutral state until enabled by the control / vector enable from the channel A or B actuation logics. When enabled, the vector logic can issue open or close commands to the EFW control and block valves per the selected channel assignments. These channel assignments are discussed in FSAR Section 7.2.4.2. This discussion relates the control and block valves to their associated EFIC channel.

Each vector logic may isolate EFW to one OTSG or the other, never both. .

(continued)

Crystal River Unit 3 B 3.3-87 Final Draft 10/01/93

EFIC Instrumentation B 3.3.11 BASES BACKGROUND 2. EFW Vector Valve Control (continued) .

The control and block valve open or close commands are developed based upon the relative values of OTSG ,

pressures as follows: !

VECTOR VALVES PRESSURE STATUS "A" "B" If OTSG "A" & OTSG "B" Open Open

> 600 psig If 0TSG "A" > 600 psig & Open Close OTSG "B" < 600 psig If OTSG "A" < 600 psig & Close Open OTSG "B" > 600 psig If 0TSG "A" & OTSG "B"

< 600 psig AND OTSG "A" & OTSG "B" within Open Open-O 125 psid OTSG "A" 125 psid > OTSG "B" Open Close OTSG "B" 125 psid > OTSG "A" Close Open HyEs_1 One of the four EFIC initiation channels can be put into

" maintenance bypass" at any time. Bypassing an initiation channel blocks that channel's signal from affecting a trip of the functions fed from it but does not bypass the trip logic within the actuation channel. An interlock feature prevents bypassing more than one channel at a time. In addition, since EFIC receives signals from NI/RPS, the maintenance bypass from the NI/RPS is interlocked with the EFIC System. If one channel of the NI/RPS is in maintenance bypass, only the corresponding channel of the EFIC may be bypassed (e.g., channel A, NI/RPS, and channel A, EFIC).

This ensures that only the corresponding channels of the '

EFIC and NI/RPS are placed in maintenance bypass at the same time.

(continued) i Crystal River Unit 3 8 3.3-88 Final Draft 10/01/93

EFIC Instrumentation B 3.3.11

() BASES BACKGROUND Bvoass (continued)

EFIC channel maintenance bypass does not bypass EFW Initiation from Engineered Safeguards Actuation System (ESAS) Channel A and Channel B high pressure injection (HPI) actuation. However, the EFIC initiation on HPI actuation is bypassed when ESAS is bypassed.

The operational bypass provisions were discussed as part of the individual Functions described earlier.

3, 4. Main Steam Line and MFW Isolation FSAR Figure 7-26, (Ref. 3) illustrates one channel of the EFIC Main Steam Line and MFW Isolation logic.

Four pressure transmitters per OTSG provide EFIC with channels A through D of OTSG pressure. The description of the channels was described earlier for EFW Initiation.

Once isolated, manual action is required to defeat the T isolation command if desired. The EFIC System is

) designed to perform its intended function with one channel in maintenance bypass (in effect, inoperable) and a single failure in one of the remaining channels.

This design complies with IEEE-279-1971 (Ref. 4) due- ,

to the redundancy and independence in the EFIC design.

APPLICABLE 1. EFW Initiation SAFETY ANALYSES .

The DBA which forms the basis for initiation of EFW is a loss of MFW transient. In the analysis of.this transient, SG Level--Low is.the parameter assumed to automatically initiate EFW. Although loss of both MFW pumps is a direct and immediate indicator of loss of MFW, there are other scenarios (such as valve closure) that could potentially cause a loss of feedwater.

Therefore, the loss of MFW analysis conservatively assumed EFW actuation on low OTSG level. This assumption yields the minimum OTSG inventory available for heat removal and is, therefore, conservative for (continued) l Crystal River Unit 3 B 3.3-89 Final Draft 10/01/93 ,

l l

EFIC Instrumentation B 3.3.11 BASES APPLICABLE 1. EFW Initiation (continued)

SAFETY ANALYSES evaluation of this event. If the loss of feedwater is a direct result of a loss of the MFW pumps, EFW will be actuated much earlier than assumed in the analysis.This would increase .0TSG heat transfer capability sooner in the event and would lessen the severity of the transient.

OTSG Pressure-Low is a primary indication and provides the actuation signal for SLBs or MFW line breaks.

Only one of the four SLB cases examined in the FSAR assumes normal automatic actuation of EFW. The other three cases assume manual initiation after 15 minutes.

For small breaks, which do not depressurize the OTSG or take a long time to depressurize, automatic actuation is not required. The operator has sufficient time to diagnose the problem and take the appropriate actions.

Loss of four RCPs is a primary indicator of the need for EFW in the safety analyses for loss of electric power and loss of coolant flow. ;

2. EFW Vector Valve Control Most of the FSAR SLB analyses were performed prior to the development of EFIC. Therefore, EFIC vector valve control was not credited in the original licensing basis for a main SLB_ analysis. Instead, operator action was credited with isolating emergency feedwater to the affected 0TSG. However, since isolating the affected 0TSG is a function automatically performed by EFIC, the FSAR analysis remains conservative relative to the inclusion of the vector valve control. )

3, 4. Main Steam Line and MFW Isolation The Chapter 14 FSAR analysis assumed Integrated Control System action for MFW and Main Steam Line Isolation. - The analysis took credit for turbine stop valve closure and feedwater valve isolation on reactor (continued)

Crystal River Unit 3 8 3.3-90 Final Draft 10/01/93

1 EFIC Instrumentation l B 3.3.11 j l

BASES APPLICABLE 3, 4. Main Steam Line and MFW Isolation (continued)

SAFETY ANALYSES trip and following EFIC installation considered the isolation functions occurring on OTSG pressure

< 600 psig as backup. Since these isolation functions would currently be provided by the safety grade EFIC System, use of the EFIC System in the original safety analysis would have been consistent with the licensing position allowing mitigative functions to be performed by safety grade systems in accident analysis. For these reasons, the SLB accident analysis remains conservative with the assumed Integrated Control System actions.

The EFIC System satisfies Criterion 3 of the NRC Policy Statement.

LCO All instrumentation performing an EFIC System Function listed in Table B 3.3.11-1 shall be OPERABLE. Four channels are required OPERABLE for all EFIC instrumentation channels g to ensure that no single failure prevents actuation of a train. Each EFIC instrumentation channel is considered to <

include the sensors and measurement channels for each Function, the operational bypass switches, and permissives.

Failures that disable the capability to place a channel in operational bypass, but which do not disable the trip Function, do not render the protection channel inoperable.

The Bases for the LC0 requirements of each specific EFIC Function are discussed next.

Loss of MFW Pumos Four EFIC channels shall be OPERABLE with MFW pump turbines A and B control oil low pressure actuation ,

setpoints of > 55 psig. The 55 psig setpoint is about half of the normal operating control oil pressure. The.55 psig setpoint Allowable Value appears to have been arbitrarily chosen as a good indication of the Loss of MFW Pumps.

Analysis only assumes Loss of MFW Pumps and a specific value of MFW pump control oil pressure is not used in the analysis. Further, since the setpoint is so much less than (continued)

O _

Crystal River Unit 3 8 3.3-91 Final Draft 10/01/93

EFIC Instrumentation B 3.3.11 BASES LCO Loss of MFW Pumos (continued) operating control oil pressure, instrument error is not a consideration. The Loss of MFW Pumps Function includes a bypass enable and removal function utilif1g the same bistable and auxiliary relay used in the NI/RPS bypass reactor trip on loss of both MFW pumps. However, the EFIC bypass is a logic requiring neutron flux to be < 20% RTP And the RPS to be in shutdown bypass. Practically speaking, the status of the bypass is strictly a function of the RPS shutdown bypass (i.e., required to be OPERABLE down into MODE 3).

OTSG Level-Low Four EFIC dedicated low range level transmitters per OTSG shall be OPERABLE with OTSG Level-Low actuation setpoints of 2 0 inches indicated (6 inches above the top of the bottom tube sheet), to generate the signals used for detection for low level conditions for EFW Initiation.

There is one transmitter for each of the four channels A, B, C, and D. The signals are also used after EFW is actuated O to control at the low level setpoint of 30 inches when one or more RCPs are in operation. In the determination of the low level setpoint, it is desired to place the setpoint as low as possible, considering instrument errors, to give the maximum operating margin between the ICS low load control setpoint and the EFW initiation setpoint. This minimizes spurious or unwanted initiation of EFW. To meet this criteria, a nominal setpoint of 6 inches indicated was selected, adjusted for potential instrument error, and shown to be conservative to the specified Allowable Value. Credit is only taken for low level actuation for those transients which do not involve a degraded environment. Therefore, normal environment errors only are used for determining the OTSG Level-Low Allowable Value.

OTSG Pressure-Low Four OTSG Pressure-Low EFIC channels per OTSG shall be OPERABLE with actuation setpoints of 2 600 psig. The actual plant setpoint is 1 625 psig to account for instrument error. The setpoint is chosen to avoid actuation under (continued)

Crystal River Unit 3 B 3.3-92 Final Draft 10/01/93 l l

1

EFIC Instrumentation B 3.3.11 BASES LC0 OrSG Pressure-low (continued) transient conditions not requiring secondary system isolation, and has been shown to be an appropriate indicator of secondary side breaks for ensuring automatic EFW actuation. The OTSG Pressure-Low function includes a bypass enable and removal function. The bypass removal Allowable Value is chosen to allow sufficient operatir.g margin (time) for the operator to bypass the actuation during plant cooldown prior to reaching the actuation setpoint. The 750 psig setpoint allows at least a 10 minute window to perform the bypass assuming the maximum allowed cooldown rate and instrument error.

OISG Differential Pressure-Hiah Four EFIC channels for OTSG differential pressure shall be OPERABLE with setpoints of s 125 psid. The F0GG Verification Study (Ref. 5) assumed a differential pressure value of 150 psid including a 25 psi margin for instrument error. The setpoint ensures that automatic EFW isolation to a depressurized 0TSG occurs for the range of sizes of SLBs O or feedwater line breaks that require rapid actuation early in the event. The setpoint has also been chosen to avoid spurious isolation of EFW during conditions due to relatively small deviations in OTSG pressures that can be caused by primary system conditions. The OTSG Differential Pressure-High Function is bypassed when the OTSG Pressure-Low Function is bypassed.

RCP Status Four EFIC channels for RCP status are required to be OPERABLE to ensure that upon the loss of all four RCPs, EFW will be automatically initiated. Additionally, EFW will automatically raise and control level to approximately 65%,

providing a higher driving head for establishing and maintaining natural circulation conditions when forced RCS flow is lost. No setpoint is specified since the status indication used by EFIC is binary in nature. The RCP Status Function includes a bypass enable and removal function from the RPS. The Allowable Value for the bypass removal is set high enough to avoid spurious actuations during low power operation.

i (continued)

Crystal River Unit 3 8 3.3-93 Final Draft 10/01/93

I i

EFIC Instrumentation !

B 3.3.11 BASES (continued)

APPLICABII.ITY EFIC instrumentation OPERABILITY requirements are applicable ,

during the MODES and specified conditions listed in 1 j

Table 3.3.11-1. Each Function has its own requirements based on the specific accidents and conditions for which it is designed to provide protection.

The initiation of EFW on the Loss of MFW Pumps is applicable in MODE I and in MODES 2 and 3 when not in. shutdown bypass.

Below these plant conditions, EFW initiation on low OTSG level occurs fast enough to prevent primary system overheating. ,

EFW Initiation on low OTSG level shall be OPERABLE at all times the OTSG is required for heat removal. These conditions include MODES 1, 2, and 3. To avoid automatic actuation of the EFW pumps during heatup and cooldown, the low OTSG pressure Function can be bypassed at or below a secondary pressure of 750 psig. This secondary-side pressure occurs during MODE 3 operation.

EFW initiation on loss of all RCPs is required to be OPERABLE at 2 10% RTP. This power level coincides with the '

bypass permissive signal provided by RPS.

The MFW, Main Steam Line Isolation, and EFW Vector Valve Control Functions shall be OPERABLE in MODES 1, 2, and 3 with OTSG pressure 2 750 psig because OTSG inventory can be high enough to contribute significantly to the peak pressure following a secondary side break. Both the normal feedwater and the EFW must be isolatable on each OTSG to limit overcooling of the primary and mass and energy releases to the RB. Once OTSG pressures decrease below 750 psig, the Main Steam Line and MFW Isolation Functions can be bypassed i to prevent actuation during cooldown. The EFW Vector Valve Control logic will not perform any function when both OTSG pressures are low; thus, the logic is also bypassed at the sTme time the OTSG pressure low Functions is bypassed. In MODES 4, 5, and 6, primary and secondary side energy levels are reduced and the feedwater flow rate is low or i nonexistent. Because of this, EFIC instrumentation is not required to be OPERABLE in these MODES.

(continued) i Crystal River Unit 3 8 3.3-94 Final Draft 10/01/93

EFIC Instrumentation B 3.3.11 BASES (continued)

ACTIONS A Note has been added to the ACTIONS indicating that a separate Condition entry is allowed for each Function.

A.1 and A,2_

Condition A applies to failures of a single EFW Initiation, Main Steam Line Isolation, or MFW Isolation instrumentation channel. This includes failure of a common instrumentation channel in any combination of the Functions.

With one channel inoperable in one or more EFW Initiation, Main Steam Line Isolation, or MFW Isolation Functions listed in Table 3.3.11-1, the channel (s) must be placed in bypass or trip within I hour. This Condition applies to failures that occur in a single channel, e.g., channel A, which when bypassed will remove initiate Functions within the channel from service. Since the RPS and EFIC channels are interlocked, only the corresponding channel in each system may be bypassed at any time. This feature is ensured by an electrical interlock. The Completion Time of I hour is adequate to perform Required Action A.I.

Required Action A.2 provides a limit on the period of time O an EFIC instrumentation channel is allowed to remain in bypass. While this Condition appears to satisfy system single failure considerations, it was not analyzed as part of the plant's original licensing basis and it is possible this configuration would not satisfy all aspects of IEEE 279 single failure criteria. As a result, the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time was added to impose a limit on the period of time the plant is allowed to operate in this Condition. As such, the Completion Time is based on engineering judgment ,

and the IEEE 279 recommendations.

B.l. B.2. and 8.3 ,

Condition B applies to situations where two instrumentation channels for EFW Initiation, Main Steam Line Isolation, or :

MFW Isolation functions are inoperable. For example, -

Condition B applies if channel A and B of the EFW Initiation Function (say, on low OTSG pressure) are inoperable.

Condition B does not apply if one channel of different Functions is inoperable in the same protection channel.

That condition is addressed by condition A.

(continued) ,

Crystal River Unit 3 B 3.3-95 Final Draft 10/01/93 ,

I

EFIC Instrumentation B 3.3.11

^

ACTIONS B,1. B.2. and 8.3 (continued)

With two EFW Initiation, Main Steam Line Isolation, or MFW Isolation protection channels inoperable, one channel must be placed in bypass (Required Action B.1). Bypassing another channel is not possible due to system interlocks.

Therefore, the second channel must be tripped (Required .;

Action B.2) to prevent a single failure from causing loss of the EFIC Function. The I hour Completion Time is adequate '

to perform.the Required Actions and minimizes the period of time the plant is at risk due to this condition.

Required Action B.3 provides a limit on the period of time an EFIC instrumentation channel is allowed to remain in bypass. While this Condition appears to satisfy system -

single failure considerations, it was not analyzed as part of the plant's original licensing basis and it is possible this configuration would not satisfy all aspects sof IEEE 279 single failure criteria. As a result, the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time was added to impose a limit on-the period of time the plant is allowed to operate in this Condition. As such, the Completion Time is based on engineering judgment and the IEEE 279 recommendations.

O f_d The EFW Vector Valve Control Function is required to meet the single-failure criterion for both the function of providing EFW on demand and isolating an OTSG when required.

These conflicting requirements result in the necessity for :

two valves in series, in parallel with two valves in series, and a four channel valve command system. Refer to LC0 3.3.14 " Emergency Feedwater Initiation and Control (EFIC) Emergency feedwater (EFW)--Vector Valve Logic" for a >

discussion of the logic of the system.

With one EFW Vector Valve Control channel inoperable, the system cannot meet the single-failure criterion and still meet the dual functional criteria described above. This Condition is analogous to having one EFW train inoperable.

Therefore, when one vector valve control channel is inoperable, the channel must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Condition and Completion Time combination is consistent with the Completion Time

associated with the loss of one train of EFW.

(continued)

Crystal River Unit 3 8 3.3-96 Final Draft 10/01/93

EFIC Instrumentation B 3.3.11 BASES ACTIONS D.l. D.2.1, D.2.2, E.1, and F.1 (continued)

If the Required Actions cannot be met within the associated Completion Time, the plant must be placed in a MODE or condition in which the requirement for the particular Function does not apply. This requires the operator to open the CRD trip breakers for Function 1.a, MODE 4 for Function 1.b, reduce power to less than 10% RTP for Function 1.d, and reduce OTSG pressure to less than 750 psig for all other Functions. The allowed Completion Times are reasonable, based on operating experience, to reach the specified conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE A Note indicates that the SRs for each EFIC instrumentation REQUIREMENTS Function are identified in the SRs column of Table 3.3.11 '

All Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION. The SG-Low Level Function is the only EFW initiation Function modeled in transient analysis, and thus is the only one subject to response time testing. Response time testing is also O required for Main Steam Line and MFW Isolation. Individual EFIC subgroup relays must also be tested, one at a time, to verify the individual EFIC components will actuate when required. Some components cannot be tested at power since j their actuation might lead to reactor trip or equipment i damage. These are specifically identified and must be l tested when shut down. The various SRs account for !

, individual functional differences and for test frequencies !

applicable specifically to the Functions listed in Table 3.3.11-1. The operational Sypasses associated with ;

each EFIC instrumentation channel are also subject to these ;

SRs to ensure OPERABILITY of the EFIC instrumentation J channel when required.

l l

l SR 3.3.11.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred.

A CHANNEL CHECK is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels (continued)

Crystal River Unit 3 B 3.3-97 Final Draft 10/01/93

EFIC Instrumentation B 3.3.11 BASES SURVEILLANCE SR 3.3.11.1 (continued)

REQUIREMENTS monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious.

Acceptance criteria are determined by plant staff and are presented in the Surveillance Procedure. The criteria are '

based on a combination of the channel instrument uncertainties.

The Frequency, about once every shift, is based on operating experience that demonstrates channel failure is unlikely.

Thus, performance of the CHANNEL CHECK ensures that undetected overt channel failure is limited to time intervals between subsequent performances of the SR.

SR 3.3.11.2 A CHANNEL FUNCTIONAL TEST verifies the function of the required trip, interlock, and alarm functions of the channel. The Frequency of 31 days is based on operating experience and industry accepted practice.

SR 3.3.11.3 CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The test verifies the channel <

responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channels adjusted to account for_ instrument drift to ensure that the instrument channel remains operational between successive tests. The Frequency is based on operating experience and industry-accepted practice.

{ continued)

O Crystal River Unit 3 B 3.3-98 Final Draft 10/01/93

EFIC Instrumentation B 3.3.11 BASES SURVEILLANCE SR 3.3.11.4 REQUIREMENTS (continued) This SR verifies individual channel response times are less than or equal to the maximum value assumed in the accident analysis. Individual component response times are not modeled in the analysis. The analysis models the overall or total elapsed time, from the point at which the parameter exceeds the actuation setpoint value at the sensor, to the point at which the end device is actuated.

EFIC RESPONSE TIME tests are conducted on an 24 month STAGGERED TEST BASIS. Testing of the final actuation devices, which make up the bulk of the EFIC RESPONSE TIME, is included in the testing of each channel. Therefore, staggered testing results in response time verification of these devices every 24 months. The 24 month test Frequency is based on operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences. EFIC RESPONSE TIMES cannot be determined at power since equipment operation, which would induce undesired plant transients, is required.

The SR is modified by a Note indicating the SR is not-required to be performed prior to entry into MODE 2. This is due to the fact that secondary side (Main Steam) supply pressure for the turbine driven pump is not sufficient to perform the test until after entering MODE 3. The SR 3.0.4 type allowance is also applicable to the MFW and Main Steam Line isolation Functions, consistent with the allowances provided for the end devices in their respective Specifications (Specifications 3.7.2 and 3.7.3).

REFERENCES 1. FSAR, Section 14.1. l

2. 10 CFR 50.49.

3. FSAR, Chapter 7.

4. IEEE-279-1971.

5. B&W Document 51-1123786-01, "F0GG Verification Study",

May 4, 1981.

O Crystal River Unit 3 8 3.3-99 Final Draft 10/01/93

l EFIC Manual Initiation B 3.3.12 -

B 3.3 INSTRUMENTATION ,

8 3.3.12 Emergency Feedwater Initiation and Control (EFIC) Manual Initiation i

BASES BACKGROUND The EFIC manual initiation capability provides the operator with the capability to actuate certain EFIC Functions in the absence of an automatic initiation condition. Functions with the capability to be manually actuated include Main -

Feedwater (MFW) Isolation for Once Through Steam Generator (OTSG) A, MFW Isolation for OTSG B, Main Steam Line Isolation for OTSG A, Main Steam Line Isolation for OTSG B, and Emergency Feedwater (EFW) Actuation.

The EFIC manual initiation circuitry satisfies the manual initiation and single-failure criterion requirements of IEEE-279-1971 (Ref. 1). .

Although not part of this LCO, the EFIC functions listed above can also be remotely manually initiated from the EFIC cabinets.

O APPLICABLE EFIC Functions credited in the safety analysis are SAFETY ANALYSES automatic. However, EFIC manual initiation Functions are required by design as backups to the automatic trip Functions. This allows the operator to actuate EFW, Main Steam Line Isolation, or MFW Isolation whenever conditions dictate and one has not already automatically occurred. As such, they are backup Functions to those performed automatically by EFIC.

LC0 Two manual initiation switches per actuation channel (A and B) of each Function (OTSG A and 8 MFW Isolation, OTSG A and B Main Steam Line Isolation, and EFW Actuation) are required to be OPERABLE whenever the OlSGs are relied on to

, remove heat from the primary. Each function (MFW Isolation, Main Steam Line Isola on, and EFW Initiation) has two actuation or " trip" channels, channels A and B. Within each channel A actuation logic there are two manual trip switches. When one manual switch is depressed, a half trip (continued) ;

Crystal River Unit 3 B 3.3-100 Final Draft 10/01/93 ;

i l

l l

l EFIC Manual Initiation !

B 3.3.12 i BASES l

LC0 occurs. When both manual switches are depressed, a full (continued) trip of channel A actuation occurs for that particular Function. Similarly, channel B actuation logic for each Function has two manual trip switches. Both switches per actuation channel must be OPERABLE and must be depressed to get a full manual trip of that channel. The use of two manual trip switches for each channel of actuation logic allows for testing without actuating the end devices and also reduces the possibility of accidental manual actuation.

APPLICABILITY The MFW and Main Steam Line Isolation manual initiation Functions shall be OPERABLE in MODES 1, 2, and 3 because OTSG inventory can be at a sufficiently high energy level to contribute significantly to the peak containment pressure during a secondary side break. In MODES 4, 5, and 6, the primary and secondary side energy levels are reduced and feedwater flow rate is low or noaexistent, and the Function is not required to be OPERABLE.

The EFW manual initiation Function shall be OPERABLE in MODES 1, 2, and 3 because the OTSGs are relied on as a heat O

sink for the Reactor Coolant System and the core itself. In MODES 4, 5, and 6, heat removal requirements are reduced and can be provided by the Decay Heat Removal System.

ACTIONS A Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each EFIC manual initiation Function. l A,1 With one manual initiation switch of one or more EFIC Function (s) inoperable in one actuation channel, the trip module for the associated EFIC Function (s) must be placed in the tripped condition within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With the channel in the tripped condition, the single-failure criterion is met and the operator can still initiate one actuation channel given a single failure in the other channel. Failure to (continued)

Crystal River Unit 3 B 3.3-101 Final Draft 10/01/93 l

EFIC Manual Initiation.

B 3.3.12 -

T BASES ACTIONS A.1 (continued) perform Required Action A.1 could allow a single failure of -

a switch in the other manual initiation channel to prevent '

manual actuation of the Function from the MCB. The Completion Time allotted to trip the trip module allows the operator to take all the appropriate actions for the failed switch and still ensure that the risk involved in operating with the failed switch is acceptable. ,

IL1 With both manual initiation switches of one or more EFIC .

Function (s) . inoperable in one actuation channel, one manual .!

initiation switch must be restored to OPERABLE status within !

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the operator has'the capability to manually initiate the affected EFIC Function from the MCB utilizing the manual initiation switches in-the other actuation channel. However, the systems single failure provisions are no longer provided and must be restored within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The associated Completion Time of .

p 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is acceptable based upon engineering judgment and V is consistent with similar EFW-related Required Actions ,

addressing a loss of redundancy. ;

from a functional perspective, this Condition is equivalent to Condition A since each actuation channel is a two-out-of-two logic (i.e., the actuation channel will not function with one or both switches inoperable). The difference between the two Conditions lies in the specified Required Actions. The trip modules associated with both inoperable '

manual initiation switches in a given actuation channel cannot be simultaneously placed in trip without receiving an EFIC actuation.

Ll With one manual initiation switch of one or more EFIC ,

Function (s) inoperable in both actuation channels, the EFIC trip modules associated with the inoperable manual initiation switch must be placed in trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . In this Condition, the operator does not have the capability to manually initiate the affected EFIC Function from the MCB.

(continued)

Crystal River Unit 3 8 3.3-102 Final Draft 10/01/93

EFIC Manual Initiation B 3.3.12

( BASES ACTIONS C.1 (continued)

The Function can still be manually actuated from the EFIC -

Cabinets (124 ft elevation Control Complex). The associated :

Completion Time of I hour reflects'the immediacy of restoring manual initiation capability at the MCB and is reasonable based on operating experience. .With one actuation channel for the associated EFIC Function restored to OPERABLE status, operation may continue in accordance ..'

with Condition A or Condition.B.

From a functional perspective, this Condition is equivalent '

to Condition D since each actuation channel is a two-out-of-two logic (i.e., neither actuation channel will not function with one switch inoperable). The difference between the two ,

Conditions lies in the specified Required Actions. The trip modules associated with both inoperable manual initiation switches in a given actuation channel cannot be :

simultaneously placed in trip without receiving an EFIC actuation.

O With one or both manual initiation switches of one or more EFIC Function (s) inoperable in both actuation channels, one actuation channel . for each Function must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . With the channel restored, operation may continue in accordance with Condition A or B.

The Completion Time allotted to restore the channel allows the operator to take all the appropriate actions for the failed channel and still ensures that the risk ;nvolved in operating with the failed channel is acceptable. .

L E.1 and E.2 If the Required Actions cannot ba met within the associated Completion Times, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the l plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the ,

required MODES from full power conditions in an orderly '

manner and without challenging plant systems.

(continued)

Crystal River Unit 3 B 3.3-103 Final Draft 10/01/93 '

l

.J

EFIC Manual Initiation B 3.3.12 l

() BASES (continued)

SURVEILLANCE SR 3.3.12.1 REQUIREMENTS This SR requires the performance of a CHANNEL FUNCTIONAL TEST to ensure that the channels can perform their intended functions. This SR, like all other CHANNEL FUNCTIONAL TESTS, does not include actuation of the end device. This is due ,

to the risk of a plant transient caused by the closure of ;

valves associated with MFW and Main Steam Line Isolation or ,

actuating EFW with the reactor at power. The Frequency of 31 days is based on operating experience and industry-accepted practice.

1. IEEE-279-1971, April 1972.

REFERENCES f

O 4

O Crystal River Unit 3 B 3.3-104 Final Draft 10/01/93 1

EFIC Automatic Actuation Logic.

B 3.3.13 B 3.3 INSTRUMENTATION 8 3.3.13 Emergency Feedwater Initiation and Control (EFIC) Automatic i' Actuation Logic BASES l BACKGROUND Main Steam Line and Main Feedwater (MFW) Isolation The four Emergency Feedwater Initiation and Control (EFIC) channels monitoring each Once Through Steam Generator (OTSG) outlet pressure condition input initiate commands to the actuation channels. FSAR Figure 7-26, (Ref. 1) illustrates the Main Steam Line and MFW lsolation Logics. The trip logic modules are physically located in the "A" and "B" EFIC channel cabinets. Channel "A" actuation logic initiates when instrumentation channel "A" or "B" initiates and channel "C" or "D" initiates, which in simplified logic is:

"A" actuation - (A and C) or (A and D) or (B and C) or (B and D)

Channel "B" actuation logic initiates when instrumentation channel "A" or "C" initiates and channel "B" or "D" O initiates, which in simplified logic is:

"B" actuation - (A and B) or (A and D) or (C and B) or (C and 0)

Each of the four Functions (OTSG A Main Feedwater Isolation, OTSG B Main Feedwater Isolation, OTSG A Main Steam Line Isolation, and 0TSG B Main Steam Line Isolation) has a channel "A" and a channel "B" of automatic actuation logic.

Both channels "A" and "B" of the OTSG A Main Feedwater '

Isolation automatic actuation logic send closure signals to the OTSG A main feedwater pump suction valve, the three OTSG A block valves, and the MFW pump discharge cross connect valve. In addition, the instrumentation trips MFW pump "A."

Both channels "A" and "B" of the OTSG A Main Steam Line Isolation automatic actuation logic send closure signals to both of the OTSG A Main Steam Isolation valves.

(continued)

O Crystal River Unit 3 B 3.3-105 Final Draft 10/01/93

EFIC Automatic Actuation Logic B 3.3.13 O

v BASES ,

BACKGROUND Main Steam Line and Main Feedwater 1MFW) Isolation (continued)

OTSG B MFW and Main Steam Line Isolation automatic actuation ,

logics respond similarly for the OTSG B valves and MFW pump "B."

Emeroency Feedwater (EFW) Actuation The four EFIC instrumentation channels for each of the ,

parameters being sensed input their initiate commands to the trip logic modules. FSAR Figure 7-26 (Ref.1) illustrates '

the EFW initiation logic. These trip logic modules are physically located in the "A" and "B" EFIC channel cabinets.

EFW Actuation functions are the same logic combinations as MFW and Main Steam Line Isolation. Although not part of ;

this Specification, EFW initiation also occurs on high pressure injection (HPI) actuation. Both channels of HPI actuation are input into each EFW actuation trip logic channel.

O' Vector Valve Enable Loaic The EFW module logic is responsible for sending open or close signals to the EFW control and block valves. FSAR Figure 7-26, (Ref.1) illustrates the vector valve logic.

The vector module logic outputs are in a neutral state (neither commanding open nor close) until a signal is received from the vector valve enable Logic. The vector valve enable logic monitors the channel A and B EFW Actuation logics. When an EFW Actuation occurs, the vector enable logic enables the vector valve logic to generate open or close signals to the EFW valves depending on the relative values of 0TSG pressures.

APPLICABLE Automatic isolation of MFW and main steam line is assumed SAFETY ANALYSES in the safety analyses to mitigate the consequences of main steam line or MFW line breaks. The fSAR analyses for steam line breaks (SLBs) was generated before the development and installation of the safety grade EFIC Systcm, which '

(continued)

O Crystal River Unit 3 B 3.3-106 Final Draft 10/01/93

EFIC Automatic Actuation Logic B 3.3.13 BASES APPLICABLE currently performs these automatic safety functions. The SAFETY ANALYSES FSAR analysis, for example, assumes main steam line (continued) isolation through turbine stop valve closure based on an Integrated Control System signal . This same function is provided by EFIC via a safety grade signal that closes the Main Steam Line Isolation valves. The analyses'are bounding, and the use of the EFIC System is consistent with the licensing position to take credit for safety grade systems to mitigate the consequences of an accident.

^

Similarly, vector valve control was not credited in the FSAR SLB analysis. Operator action was credited with isolating EFW to the affected OTSG. This function would be automatically performed by EFIC. Therefore, the FSAR analysis remains conservative relative to the inclusion of the vector valve logic.

Automatic initiation of EFW is credited in the loss of main feedwater analysis. The automatic actuation was based on the SG low level function of EFIC, although EFIC would initiate EFW based on the loss of both MFW pumps as well.

EFIC logic satisfies Criterion 3 of the NRC Policy O Statement.

LC0 Two channels each of MFW and Main Steam Line Isolation, Vector Valve Enable, and EFW Actuation logics shall be OPERABLE. There are only two channels of automatic actuation logic per Function. Therefore, failure to. meet this LCO would make the plant susceptible to a single failure in the OPERABLE actuation channel precluding the Function.

APPLICABILITY The MFW and Main Steam Line Isolation automatic actuation logics shall be OPERABLE in MODES 1, 2, and 3 because OTSG invbntory can be at a high energy level and can contribute significantly to the peak containment pressure during a secondary system line break. In MODES 4, 5, and 6, the energy level is low, feedwater flow rate is low or nonexistent, and the Function is not required to be OPERABLE.

(continued)

Crystal River Unit 3 8 3.3-107 Final Draft 10/01/93

l EFIC Automatic Actuation Logic 1 B 3.3.13 '

BASES :

~!

APPLICABILITY The EFW automatic actuation and vector valve enable logics (continued) shall be OPERABLE in MODES -1, 2, and 3 because the OTSGs are relied upon for heat removal from the primary system. .

During these MODES, the core power and heat removal requirements are at their highest. If the normal source of '

feedwater is lost, EFW must be initiated rapidly to minimize i the overheating of.the primary system.

For portions of MODE 4 and for all of MODES 5 and 6, the primary system temperatures are too low to allow the OTSGs to effectively remove energy.

ACTIONS For this LCO, a Note has been added to the ACTIONS indicating that separate Condition entry is allowed for each EFIC Automatic Actuation logic Function.

A_d Condition A applies when one or more EFIC logic Functions in a single channel is inoperable (i.e., all four channel A EFIC logic Functions could be inoperable and Condition A would still be applicable) with all Functions in the other channel OPERABLE.

With one automatic actuation logic channel of one or more EFIC Functions inoperable, the associated EFIC train must be restored to 0PERABLE status. Since there are only two automatic actuation logic channels per EFIC Function, the .

condition of one channel inoperable is analogous to having one train of EFW inoperable. The system safety function can be accomplished; however, a single failure cannot be taken.

Therefore, the failed channel (s) must be restored to OPERABLE status in order to re-establish the system's single-failure tolerance.

, The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months has been chosen to be consistent with Completion Times for restoring an inoperable EFW System train to OPERABLE status.

(continued)

Crystal River Unit 3 B 3.3-108 Final Draft 10/01/93

EFIC Automatic Actuation Logic i B 3.3.13 !

BASES ACTIONS B.1 and B.2 (continued) i If Required Action A.1 cannot be met within the associated ;

Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required MODES from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.3.13.1 REQUIREMENTS This SR requires the performanc'e of a CHANNEL FUNCTIONAL TEST to ensure that the channels can perform their intended ;

functions. This test verifies MFW and Main Steam Line Isolation and EFW initiation automatic actuation logics are functional. This test simulates the required inputs to the logic circuit and verifies successful operation of the automatic actuation logic. The test need not include actuation of the end device. This is due to the risk of a O pb nt transient caused by the closure of valves associated with MFW and Main Steam Line Isolation or actuation of EFW during testing at power. The Frequency of 31 days is based on operating experience, which has demonstrated the failure of more than one channel failing within the same 31 day ir.terval is unlikely.

REFERENCES 1. FSAR, Chapter 7.

O Crystal River Unit 3 B 3.3-109 Final Draft 10/01/93

. ~ . - - - . --

EFIC-EFW-Vector Valve Logic l B 3.3.14 8 3.3 INSTRUMENTATION B 3.3.14 Emergency Feedwater Initiation and Control (EFIC)-

Emergency Feedwater (EFW)-Vector Valve Logic BASES BACKGROUND The function of the EFW vector valve logic is to determine whether EFW should be fed to one or the other steam generator. This logic system precludes the continued addition of EFW to a depressurized Once Through Steam Generator (OTSG) minimizing the overcooling effects of a high energy line break on the secondary side. Each vector logic may isolate EFW to one OTSG or the other, but never i both. ,

There are four channels of vector valve logic; one in each i channel of EFIC. Each channel of vector valve logic receives OTSG pressure information from bistables located in the input logic of the same EFIC channel. The pressure information received is:

a. OTSG "A" pressure less than 600 psig;

b. OTSG "B" pressure less than 600 psig;

c. OTSG "A" pressure 125 psid greater than OTSG "B" pressure; and

d. OTSG "B" pressure 125 psid greater than OTSG "A" !

pressure.

Each vector valve logic also receives a vector / control enable signal from both EFIC channel A and channel B when EFW is actuated.

The vector valve logic develops signals for open and close control of OTSG "A" and "B" EFW block valves and control valves.

The vector valve logic outputs are in a neutral state with the valves open until enabled by the control / vector enable from the channel A or B trip logics. When enabled, the vector valve logic is able to issue open or close commands to the EFW control and block valves per the selected channel assignments.

(continued)

O Crystal River Unit 3 B 3.3-110 Final Draft 10/01/93

EFIC-EFW-Vector Valve L'ogic I B 3.3.14 BASES I

BACKGROUND- The valve open/close commands are determined by the relative 1 (continued) values of OTSG pressures as follows:

VECTOR VALVES PRESSURE STATUS "A" "B" If OTSG "A" & OTSG "B" Open Open

> 600 psig If 0TSG "A" > 600 psig & Open Close OTSG "B" < 600 psig If OTSG "A" < 600 psig & Close Open OTSG "B" > 600 psig If OTSG "A" & OTSG "B"

< 600 psig '

AE OTSG "A" & OTSG "B" within Open Open 125 psid OTSG "A" 125 psid > OTSG "B" Open Close OTSG "B" 125 psid > OTSG "A" Close Open APPLICABLE The FSAR analysis for steam line breaks (SLBs) was generated SAFETY ANALYSES before the development and installation of the safety grade EFIC System, which currently performs these safety functions automatically. As such, vector logic valve control was not credited in the FSAR SLB analysis. Operator action was credited with isolating EFW to the affected 0TSG. With current plant design, this function would be automatically performed by EFIC. Therefore, the FSAR analysis remains conservative relative to the inclusion of the vector valve logic. The analyses are bounding, and the use of the EFIC System is consistent with the licensing position to take credit for safety grade systems in mitigating the consequences of an accident.

EFW vector valve logic response time is included in the response time for each EFW instrumentation Function and is not specified separately.

(continued)

Crystal River Unit 3 8 3.3-111 Final Draft 10/01/93 ;

..- ,. - . _ . . .~ . . . _ . - . . .

EFIC-EFW-Vector Valve Logic B 3.3.14 BASES APPLICABLE The EFIC-EFW-vector valve logic satisfies Criterion 3 of.

SAFETY ANALYSES the NRC Policy Statement.

(continued)

LC0 Four channels .of the EFIC-EFW-vector valve logic are

. required to be OPERABLE in order to provide the dual function of the valves while meeting single failure criteria. Refer to the ACTIONS for further discussion of the two functions. The 600 psig and 125 psid Allowable Values were chosen as discussed in the Bases for Specification 3.3.11 "EFIC System Instrumentation." The feed only good generator verification study assumed a ,

differential pressure vector value of 150 psid. The ,

125 psid setpoint conservatively assumes a 25 psi margin for instrument error. Failure to meet this LC0 results in not being able to meet the single-failure. criterion.

APPLICABILITY EFIC-EFW-vector valve logic is required in MODES 1, 2, and 3 because the OTSGs are relied on in these MODES for RCS

\ heat removal. In MODES 4, 5, and 6, heat removal requirements are reduced and may be provided by the Decay Heat Removal System. Therefore, vector valve logic is not required to be OPERABLE in these MODES.

ACTIONS A_d The function of the EFIC-EFW control / block valves and the vector valve logic is to meet the single-failure criterion while maintaining the capability to:

a. Provide EFW to an intact OTSG on demand; and

b. Isolate a faulted 0TSG when required.

These conflicting requirements result in the necessity for two valves in series, in parallel with two valves in series, and a four channel valve command system.

(continued)

Crystal River Unit 3 B 3.3-112 Final Draft 10/01/93 4

EFIC-EFW-Vector Valve Logic B 3.3.14 BASES ACTIONS A.1 (continued)

With one channel inoperable, the system cannot meet the single-failure criterion and still satisfy the dual functional criteria described above. Therefore, when one vector valve logic channel is inoperable, the channel must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Condition is analogous to having one EFW train inoperable; wherein a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is provided by the Required Actions of LCO 3.7.4, "EFW System." As such, the Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is based on engineering judgment.

B.1 and B.2 If Required Action A.1 cannot be met within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an O orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.3.14.1 REQUIREMENTS SR 3.3.14.1 is the performance of a CHANNEL FUNCTIONAL TEST every 31 days. This test demonstrates that the EFIC-EFW-vector valve logic is capable of performing its intended function. The Frequency is based on operating experience that demonstrates failure of more than one channel within the same 31 day interval is unlikely.

REFERENCES None.

O Crystal River Unit 3 8 3.3-113 Final Draft 10/01/93

.- = .

P RB Purge Isolation-High Radiation B 3.3.15 B 3.3 INSTRUMENTATION B 3.3.15 Reactor Building (RB) Purge Isolation-High Radiation BASES BACKGROUND The RB Purge Isolation-High Radiation Function closes the RB purge and RB mini-purge valves to isolate the RB atmosphere from the environment and minimize releases of radioactivity in the event an accident occurs.

The radiation monitoring system (RMA-1) measures the activity in a representative sample of air drawn in succession through a particulate sampler, an iodine sampler, and a gas sampler. The sensitive volume of the gas sampler is shielded with lead and monitored by a Geiger-Mueller detector. The air sample is taken from the center of the purge exhaust duct through a nozzle installed in the duct.

If a gaseous activity flow rate of approximately lE-2 pCi/sec (Kr-85) is exceeded, the monitor will alarm and initiate closure of the valves. This activity flow rate is selected on the basis of 50,000 scfm flow rate in the purge exhaust and on a gas monitor setpoint of two times the O expected background at the location of the monitor. In this way, the monitor provides fast detection and termination of any release.

The closure of the purge and mini-purge valves' ensures the RB remains as a barrier to fission product release. There is no bypass for this function.

APPLICABLE FSAR Chapter 14 LOCA analysis assumes RB purge and mini-SAFETY ANALYSES purge lines are isolated within 60 seconds following initiation of the event. Since the early 1980's, this isolation time has only been practically applicable to the mini-purge valves since the large purge valves are required to be sealed closed during the MODES of plant operation (1, i 2, 3, and 4) in which LOCAs are postulated to occur. Even 2

(continued)

Crystal River Unit 3 B 3.3-114 Final Draft 10/01/93 l

l

RB Purge Isolation-High Radiation B 3.3.15 BASES APPLICABLE for mini-purge valves, d. sign requirements on these valves SAFETY ANALYSES require closure times on the order of 5 seconds. Thus, the (continued) purge isolation time of the current plant design is conservative to the original safety analysis.

The signal credited for initiating purge isolation in the original safety analysis is the RB Pressure - High ESAS signal and not RB Purge Isolation - High Radiation .

instrumentation. As such, design basis LOCA mitigation is !

not a basis for including this instrumentation.

RB purge isolation on high radiation is only required to maintain 10 CFR 20 limits during normal operations. '

However, this is not a basis for requiring a Technical Specification. Therefore, this Specification is not ;

required in MODES 1, 2, 3 and 4. ;

Closure of the purge valves on high radiation is also not credited as part of the fuel handling accident (FHA) inside containment. The activity from the ruptured fuel assembly is assumed to be instantaneously released to the atmosphere in the form of a " puff" type release. This instrumentation is retained during MODES 5 and 6 in order to allow for other O RB penetrations that communicate with the RB atmosphere to be open during movement of irradiated fuel assemblies within containment. Refer to LC0 3.9.3, " Containment Penetrations" .

for further discussion of this allowance. f LCO One channel of RB Purge Isolation-High Radiation instrumentation is required to be OPERABLE to ensure safety analysis assumptions regarding RB isolation are bounded.

Operability of the instrumentation includes proper operation of the sample pump. This LCO addresses only the gas sampler ;

portion of the System. -

(continued)

Crystal River Unit 3 B 3.3-115 Final Draft 10/01/93

RB Purge Isolation-High Radiation B 3.3.15 BASES (continued)

APPLICABILITY The RB Purge Isolation-411gh Radiation instrumentation shall be OPERABLE whenever required to support OPERABILITY of the purge and mini-purge valves, per LC0 3 M , " Containment Penetrations." These MODES and specified conditions are indicative of those under which the potential for a fuel handling accident; and thus radiation release, is the greatest. While in MODES 5 and 6, when fuel handling in the RB is not in progress, the isolation system does not need to be OPERABLE because the potential for a radioactive release is minimal and operator action is sufficient to ensure post accident offsite doses are maintained within the limits of 10 CFR 100, (Ref. 1).

ACTIONS Ad Condition A applies to failure of the high radiation purge isolation function when the purge and mini-purge valves are required to be OPERABLE in accordance with LC0 3.9.3,

" Containment Penetrations."

With the channel inoperable during this time, the applicable O Conditions and Required Actions of LC0 3.9.3 are required to be entered immediately. The immediate Completion Time is 4

j consistent with the loss of RB isolation capability under '

conditions in which the fuel handling accidents are possible and the high radiation function is required to provide automatic action to terminate the release. i l

l SURVEILLANCE SR 3.3.15.1 REQUIREMENTS This SR is the performance of the CHANNEL CHECK for the RB purge isolation-high radiation instrumentation once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The CHANNEL CHECK is a comparison of the parameter indicated on the radiation monitoring l instrumentation channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between two instrument channels could be an indication of excessive instrument drift in one of the channels or of (continued) l Crystal River Unit 3 B 3.3-116 Final Draft 10/01/93 l

~

RB Purge Isolation-High Radiation B 3.3.15 BASES SURVEILLANCE SR 3.3.15.1 (continued)

REQUIREMENTS .

something even more serious. Internal check sources may also be used to satisfy the CHANNEL CHECK requirement.

Acceptance criteria are determined by plant staff and are presented in the Surveillance Procedures. The criteria are based on a combination of the channel instrument uncertainties. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency, about once every- >

shift, is based on operating experience that demonstrates '

channel failure is an unlikely event. Additionally, control room alarms and annunciators are provided to alert the operator to various 't ouble" conditions associated with the instrument.

SR 3.3.15.2 ,

This SR requires the performance of a CHANNEL FUNCTIONAL TEST once every 92 days to ensure that the channel can perform its intended function. This test verifies the capability of the instrumentation to provide the RB purge and mini-purge valve isolation on a high radiation signal.

O As with any CHANNEL FUNCTIONAL TEST, this SR need not include actuation of the end devices (purge and mini-purge valves). The 92 day frequency is based on the recommendations of NUREG-1366 (Ref. 2).

SR 3.3.15.3 CHANNEL CALIBRATION is a complete check of the instrument string including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for' instrument drift between successive calibrations to ensure that the channel remains OPERABLE between successive tests.

The Allowable Value for the RB Purge Isolation-High Radiation is determined in accordance with the requirements of Appendix "B" Technical Specifications.

(continued)

Crystal River Unit 3 8 3.3-117 Final Draft 10/01/93

RB Purge Isolation-High Radiation -

B 3.3.15

[ BASES SURVEILLANCE SR 3.3.15.3 (continued)

REQUIREMENTS The 18 month Frequency is based on engineering judgment and industry-accepted practice.

REFERENCES 1. 10 CFR 100.

2. NUREG-1366, December 1992.

\

O 1

O Crystal River Unit 3 B 3.3-118 Final Draft 10/01/93 !

i

Control Room Isolation-High Radiation B 3.3.16 B 3.3 INSTRUMENTATION B 3.3.16 Control Room Isolation-High Radiation BASES BACKGROUND The principal function of the Control Room Isolation-High Radiation is to provide an enclosed environment from which the plant can be operated following an uncontrolled release of radioactivity. The high radiation isolation function provides assurance that an isolation signal will be generated when conditions dictate. The radiation monitor is located in the control complex return duct. The control room isolation signal is provided by a single channel containing an iodine monitor with a scintillation detector and a gaseous monitor with a Geiger-Mueller detector. The iodine channel includes a particulate prefilter with a charcoal cartridge. If a radioactivity concentration above normal background level is detected on the iodine channel or if sampling capability is lost, the monitor will initiate a shutdown of the normal duty supply fans and will place the ventilation dampers in their recirculation mode.

.% Although, not included within the scope of Technical

'9 Specifications, the Control Complex is also isolated on an Engineered Safeguards Actuation System (ESAS) RB Pressure-High signal as well as elevated toxic gas levels.

APPLICABLE Following a LOCA, the high radiation function is SAFETY ANALYSES credited with performing the initial Control Complex isolation function and beginning the emergency recirculation mode of operation. This isolation is necessary to limit doses to the Control Room operator to within 10 CFR 50, Appendix A, General Design Criteria (GDC) 19 limits, (Ref.

1). The limiting GDC 19 dose criteria is the 30 Rem limit ,

to the thyroid. The high radiation isolation would also limits dose rates to the Control Room Operator in the event of a Fuel Handling Accident.

The Control Room Isolation-High Radiation satisfies Criterion 3 of the NRC Policy Statement.

i l

(continued)

Crystal River Unit 3 B 3.3-119 Final Draft 10/01/93 l

Control Room Isolation-High Radiation B 3.3.16

BASES (continued)

LC0 One channel of Control Room Isolation-High Radiation is required to be OPERABLE to ensure 10 CFR 50, Appendix A, GDC 19 operator and 10 CFR 100 offsite dose limits are met for design basis transients and accidents. Only the iodine channel is addressed by this LCO. Operability of the instrumentation includes proper operation of the sample pump.

APPLICABILITY The capability to automatically isolate the Control Room on high radiation shall be OPERABLE whenever an accidental release of radioactivity is postulated. This includes ,

MODES 1, 2, 3, 4, and during movement of irradiated fuel assemblies. If a radioactive release were to occur.during any of these conditions, the Control Room would have to remain habitable to ensure reactor shutdown and core cooling is maintained.

ACTIONS Ad Condition A applies to a failure of the Control Room Isolation-High Radiation Function in MODE 1, 2,- 3, or 4.

With the-Control Room Isolation-High Radiation instrumentation inoperable, the Control Room Emergency Ventilation System (CREVS) must be placed in a system configuration that minimizes the impact of the inoperable monitor. To ensure that the ventilation system has been placed in a state equivalent to that which occurs after the high radiation isolation has occurred,.an OPERABLE train of the CREVS is placed in the emergency recirculation mode of operation. The I hour Completion Time is a sufficient amount of time in which to complete the Required Action.

B.1 and B 2 If the CREVS cannot be placed into the emergency recirculation mode or the monitor restored to OPERABLE status within I hour while in MODE 1, 2, 3, or 4, actions must be taken to minimize the plant's vulnerability to an accident that would lead to radiation releases. The plant 1

(continued)

Crystal River Unit 3 8 3.3-120 Final Draft 10/01/93 i

l l

Control Room Isolation-High' Radiation B 3.3.16 l

BASES i

ACTIONS 8.1 and Bd (continued) !

must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in !

MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . These ACTIONS place the reactor and RCS in a low energy state reducing the stresses present in the RCS and allowing more time for operator action if habitation of the control room is precluded. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 Required Action C.1 is the same as discussed above for Condition A, except for Completion Time. If the CREVS cannot be placed into the emergency recirculation mode while moving irradiated fuel assemblies, then Required Action C.2 specifies actions be taken to suspend activities that could lead to release of radioactivity following a fuel handling accident.

Required Action C.2 places the plant in a safe and stable configuration in which it is less likely to experience an '

accident that could result in a release of radioactivity.

This condition must be maintained until the automatic isolation capability is returned to OPERABLE status or when manual action places one train of CREVS into the emergency recirculation mode. The immediate Completion Time is consistent with the urgency of the situation and assumes the high radiation function is the only automatic Control Room Isolation Function capable of responding to radiation release due to a fuel handling accident. The Completion Time does not preclude placing any fuel assembly into a safe position before ceasing any such movement.

Note that in certain circumstances, such as movement of irradiated fuel assemblies in the Spent Fuel Pool during power operation, Condition A, B and C may apply simultaneously in the event of a channel failure.

l l

O 1

l (continued)

Crystal River Unit 3 B 3.3-121 Final Draft 10/01/93

Control Room Isolation-High Radiation B 3.3.16 BASES (continued)

([

SURVEILLANCE SR' 3.3.16,1 REQUIREMENTS This SR is the performance of a CHANNEL CHECK for the Control Room Isolation-High Radiation actuation instrumentation once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The CHANNEL CHECK is a comparison of the parameter indicated on the radiation monitoring instrumentation channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. Internal check sources may also be used to satisfy the CHANNEL CHECK requirement.

Acceptance criteria are determined by the plant staff and are presented in the Surveillance Procedures. The criteria are based on a combination of the channel instrument uncertainties. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency, about once every shift, is based on operating experience that demonstrates channel failure is an unlikely event. Additionally, control room alarms and annunciators are provided to alert the o operator to various " trouble" conditions associated with the instrument.

'Q SR 3.3.16.2 This SR is the performance of a CHANNEL FUNCTIONAL TEST once every 92 days to ensure that the channel is capable of performing its intended function. This test verifies the capability of the instrumentation to provide the automatic Control Room Isolation. The 92 day Frequency is based on the recommendations of NUREG-1366 (Ref. 2).

A Note has been added to this SR indicating the Required Actions of the Specification may be suspended for up to 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months while the channel is bypassed for surveillance l testing. The Note allows channel bypass for testing without

! taking the Actions of the Specification although during this time period the instrumentation cannot actuate a control room isolation. The length of this allowance was developed based on a historic review of the average time required to historically perform this SR.

(continued) i

Crystal River Unit 3 B 3.3-122 Final Draft 10/01/93

Control Room Isolation-High Radiation ,

B 3.3.16 BASES V'

l SURVEILLANCE SR 3.3.16.3 REQUIREMENTS (continued) This SR requires the performance of a CHANNEL CALIBRATION >

with a setpoint Allowable Value of less than or equal to two times the background count rate. .

CHANNEL CALIBRATION is a complete check of the instrument string including and the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations to ensure that the channel remains OPERABLE between successive tests.

The 18 month Frequency is based on engineering judgment and industry-accepted practice.

REFERENCES 1. 10 CFR 50, GDC 19.

2. NUREG-1366, December 1992.

O O

Crystal River Unit 3 B 3.3-123 Final Draft 10/01/93

PAM Instrumentation B 3.3.17 8 3.3 INSTRUMENTATION B 3.3.17 Post Accident Monitoring (PAM) Instrumentation BASES BACKGROUND The function of PAM instrumentation is to display plant process variables that provide information for the operator to take the manual actions assumed for Design Basis Accident (DBA) mitigation. In addition, certain PAM instrumentation '

also provides information to assess the performance and status of selected plant systems following a DBA. These i essential instruments, identified in FSAR, Table 7-12, (Ref.1) address the recommendations of Regulatory Guide 1.97 (Ref. 2) as required by Supplement I to NUREG-0737 (Ref. 3).

The instrument channels required to be OPERABLE by this LC0 are those parameters identified during the CR-3 specific implementation of Regulatory Guide 1.97 as Type A variables and non-Type A, Category 1 variables. Type A variables are included in this LCO because they provide the primary information that permits the control room operator to take -

specific manually controlled actions that are required when O no automatic control is provided and that are required for safety systems to accomplish their safety functions for DBAs, (Ref. 2). Primary information is that required for the direct accomplishment of the specified safety function; it does not include those variables associated with contingency actions. Category 1 variables are the key ,

variables deemed risk significant for CR-3.

APPLICABLE The PAM instrumentation ensures the information is SAFETY ANALYSES available to the control room operating staff:

a. Perform the diagnosis specified in the emergency operating procedures. These variables are restricted to pre-planned actions for the primary success path of l DBAs (e.g., loss of coolant accident (LOCA));

b. Take the specified, preplanned, manually controlled actions, for which no automatic control is provided, which are required for safety systems to accomplish their safety functions; (continued)

Crystal River Unit 3 B 3.3-124 Final Draft 10/01/93

PAM Instrumentation B 3.3.17 BASES ,

APPLICABLE c. Determine whether systems important to safety are SAFETY ANALYSES performing their intended functions; (continued)

d. Determine the potential for a gross breach of the barriers to radioactivity release;

e. Determine if a gross breach of a barrier has occurred; and

f. Initiate action necessary to protect the public and estimate the magnitude of any impending threat.

PAM instrumentation that is determined to display a Regulatory Guide 1.97 Type A variable, satisfies Criterion 3 of the NRC Policy Statement. Category 1, non-Type A, ;

instrumentation does not meet any of the criterion in the NRC Policy Statement. However, it is retained in Technical Specifications because it is considered important to reducing risk to the public.

LC0 3.3.17 requires redundant channels be OPERABLE to ensure O

LCO no single failure prevents the operators from being presented with the information necessary to determine the t status of the unit and to bring the unit to, and maintain it in, a safe condition following that accident. The provision of two channels also allows for relative comparison of the channels (a CHANNEL CHECK type of qualitative assessment) during the post accident phase to confirm the validity of displayed information. ,

The exception to the two channel requirement is containment isolation valve position. In this case, the important information is the status of the containment penetration.

The LC0 requires one position indicator for each automatic containment isolation valve. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the automatic valve and prior knowledge of the passive valve or via system boundary status. If a normally active containment isolation valve is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE.

(continued)

Crystal River Unit 3 8 3.3-125 Final Draft 10/01/93

l PAM Instrumentation B 3.3.17 l

BA5ES LCO The following list is a discussion of the specified (continued) instrument Functions listed in Table 3.3.17-1.

1. Wide Ranoe Neutron Flux Two wide-range neutron flux monitors are provided for post-accident reactivity monitoring over the entire range of expected conditions. Each monitor provides indication over the range of 10~8 to 100% log rated power covering the source, intermediate, and power-ranges. Each monitor utilizes a fission chamber neutron detector to provide redundant main control board indication. A single channel provides recorded information in the control room. The control room indication of neutron flux is considered one of the primary indications used by the operator following an accident. Following an event the neutron flux is monitored for reactivity control. The operator ensures that the reactor trips as necessary and that emergency baration is initiated if required. Since the operator relies upon this indication in order to take specified manual action, the variable is included O in this LCO. Therefore, the LC0 deals specifically with this portion of the string.

2. Reactor Coolant System (RCS) Hot Leo Temoerature Two wide range resistance temperature detectors (RTD's), one per loop, provide indication of reactor coolant system hot leg temperature (T ) over the range of 120' to 920*F. Each T measuremenE provides an input to a control room indicator. Channel B is also recorded in the control room. Since the operator relies on the control room indication following an accident, the LC0 deals specifically with this portion of the string.

Tg is a Type A variable on which the operator bases manual actions required for event mitigation for which no automatic controls are provided. This temperature measurement provides input to the inadequate core cooling instrumentation which is used to verify the (continued)

C Crystal River Unit 3 8 3.3-126 Final Draft 10/01/93

PAM Instrumentation B 3.3.17

./ s Q BASES LC0 2. Reactor Coolant System (RCS) Hot Leo Temoerature (continued) existence of, or to take actions to ensure the restoration of subcooling margin. Specifically, a loss of adequate subcooling margin during a small break LOCA requires the operator to trip the reactor coolant pumps (RCP's), ensure high or low pressure injection, and raise the steam generator levels to the ECC level. Once subcooling margin is restored, the operator is instructed to restart at least one RCP and throttle injection flow to maintain a specified degree of subcooling. Another manual action based on T follows a steam generator tube rupture. The affected steam generator is to be isolated only after Tg fa m '

below the saturation temperature corresponding to the pressure setpoint of the main steam safety valves.

For event monitoring once the RCP's are tripped, T g is used along with the core exit temperatures and RCS cold leg temperature to measure the temperature rise across the core for verification of core cooling.

3. RCS Pressure (Wide Ranael RCS pressure is measured by pressure transmitters with a span of 0-3000 psig. Redundant monitoring capability is provided by two trains of instrumentation. Control room and remote shutdown panel indications are provided. The subcooling margin monitor can also display reactor coolant pressure upon demand. The control room indications are the primary indications used by the operator during an accident.

Therefore, the LC0 deals specifically with this portion of the instrument string.

RCS pressure is a Type A variable because the operator uses this indication to adjust parameters such as steam generator (OTSG) level or pressure in order to monitor and maintain a controlled cooldown of the RCS following a steam generator tube rupture or small ,

break LOCA. In addition, HPI flow is throttled based I

)

(continued)

Crystal River Unit 3 B 3.3-127 Final Draft 10/01/93 1

PAM Instrumentation l B 3.3.17 l BASES LCO 3. RCS Pressure (Wide Rance) (continued) on RCS pressure. Finally, HPI flow is required for some small break LOCAs, where LPI may actuate with j system pressure stabilizing above the shutoff head of the LPI pumps. If this condition exists, the operator is instructed to verify HPI flow and then stop the LPI pumps in order to preclude extended operation against~ ,

a deadhead pressure.

4. Reactor Coolant Inventory Reactor Vessel Water Level instrumentation is provided

. for verification and long term surveillance of core cooling. The reactor vessel level monitoring system provides a direct measurement of the collapsed liquid level above the fuel alignment plate. Th: collapsed level represents the amount of liquid mass that is in ,

the reactor vessel above the core. Measurement of the collapsed water level is selected because it is a i direct indication of the water inventory.

The collapsed level is obtained over the same temperature and pressure range as the saturation measurements, thereby encompassing all operating and accident conditions where it must function. Also, it functions during the recovery interval. Therefore, it is designed to survive the high steam temperature that may occur during the preceding core recovery interval.

The level range extends from the top of the vessel down to the top of the fuel alignment plate. The response time is short enough to track the level during small break LOCA events. The resolution is sufficient to show the initial level drop, the key locations near the hot leg elevation, and the lowest ,

levels just above the alignment plate. This provides i the operator with adequate indication to track the ;

progression of the accident and to detect the consequences of its mitigating actions or the functionality of automatic equipment.

(continued) e Crystal River Unit 3 B 3.3-128 Final Draft 10/01/93

PAM Instrumentation B 3.3.17

'( BASES LCO 5. Borated Water Storace Tank (BWST) level (continued)

BWST inventory is monitored by level instrumentation with a span of 0 to 50 feet. Redundant monitoring capability is provided by three independent level ceasurements. Two level transmitters provide input to control room indicators, and one of these channels is recorded in the control room. The control room indications are the primary indications used by the operator. Therefore, the LC0 deals specifically with this portion of the instrument string.

During a design basis LOCA, the Reactor Building Spray, low Pressure Injection (LPI) and High Pressure Injection (HPI) Systems are automatically aligned to obtain suction from the BWST. As the BWST inventory is pumped into the RCS and containment, coolant will be lost through the break and will accumulate in the reactor building sump. The operator is required to switch LPI and RB Spray suction to the reactor building emergency sump from the BWST when the BWST level reaches a specified level setpoint. At this

~~

same time if the RCS pressure is greater than the LPI pump shutoff head, it will also be necessary to switch '

the suction of the HPI pumps to the discharge of the LPI pumps to ensure the capability to inject flow to the RCS since the HPI pumps do not have the capability of drawing coolant from the sump. BWST level is a Type A variable because it is the primary indication used by the operator to determine when to initiate the switch-over to sump recirculation. This operator action is necessary to satisfy the long-term core cooling requirements specified in 10 CFR 50.46.

6. HPI Flow (Wide and Narrow Ranae)

HPI flow is determined from differential pressure transmitters. Two channels in each of the four injection lines provides this indication. One transmitter is calibrated to a range of 0-500 gpm while another independent transmitter provides 0-200 gpm flow rate information. Each differential pressure measurement provides an input to a control room (continued)

Crystal River Unit 3 8 3.3-129 Final Draft 10/01/93

PAM Instrumentation B 3.3.17 BASES LC0 6. HPI Flow (Wide and Narrow Rance) (continued) indicator. Since the operator relies on the control ,

room indication following an accident, the LCO deals with this portion of the instrument string.

For the wide range flow rate instruments, certain design basis small break LOCAs do not result in a primary system depressurization below the LPI pump shutoff head prior to the depletion of the contents of the BWST by HPI injection. These accidents may require continued HPI during the recirculation phase of the accident. The HPI system does not draw suction directly from the reactor building sump during the recirculation phase. Instead, the HPI system is ;

aligned to the discharge of the LPI pumps. In this mode of operation, referred to as the piggyback mode, there is a possibility that HPI flow would have to be throttled to avoid running out the HPI pump. This could be the case for a small break loss of coolant accident with only one HPI pump available (possibly due to one HPI pump being out of service at the time of the event and a single failure of a diesel O generator). Under these conditions, the RCS pressure could decrease to the point where the injection line -

stop check valves are no longer able to limit the flow ,

from the operating HPI pump due to valve design limitations. In this case, the operator would have to limit flow by manually throttling the appropriate -

valves to avoid running out and damaging the pump, thereby losing all HPI cooling.

For the low range flow rate instrument, break in an HPI injection line requires the operator to throttle flow through the remaining three lines in order to meet LOCA acceptance criteria. The low range ,

instruments provide indication of the required accuracy over the flow rates of interest for this size break.

7. Containment Sumo Water level (Flood Level)

Containment sump water level (Flood) is monitored by two channels of level indication, both of which are (continued)

Crystal River Unit 3 B 3.3-130 Final Draft 10/01/93 l l

l l

PAM Instrumentation-B 3.3.17 BASES LC0 7. Containment Sumo Water level (Flood level)

(continued) displayed in the control room on edgewise level indicators. Channel A and 8 sump flood level indication are recorded in the associated 'A' and 'B' EFIC Rooms. Each instrument encompassu a range of 0-10 feet above the sump and provides information to the operator related to gross leakage in the Reac'.or Building. This leakage may be indication of degradation in the reactor coolant pressure boundary (RCPB) which would require further investigation tnd action. These instruments are not assumed to provide information required by the operator to take a mitigation action specified in the accident analysis.

As such, they are not Type A variables. However, the monitors are deemed risk significant (Category 1) and are included within the LC0 based upon this consideration.

8,9. Containment Pressure (Narrow Ranae and Wide Ranae)

(" The containment pressure variable is monitored by two ranges of pressure indication. Narrow range (-10 to 60 psig) and wide range (0 to 200 psig) pressure indication each provide two channels of pressure indication. Channel A and B wide range containment pressure are recorded in the associated 'A' and 'B' EFIC Rooms. The low range is required in order to ensure instrumentation of the necessary accuracy is available to monitor conditions in the RB during DBAs.

The wide range instrument was required by Regulatory Guide 1.97 to be capable of monitoring pressures over the range of atmospheric to three times containment design pressure (approximately 165 psig). Thus, it was intended to monitor the RB in the event of an accident not bounded by the plant safety analysis (i.e., a Severe Accident).

These instruments are not assumed to provide information required by the operator to take a mitigation action specified in the accident analysis.

(continued)

Crystal River Unit 3 8 3.3-131 Final Draft 10/01/93

PAM Instrumentation B 3.3.17

'"h BASES (O

LCO 8,9 Containment Pressure (Narrow Ranae and Wide Ranae)

(continued)

^ such, they are not Type A variables. However, the monitors are deemed risk significant (Category 1) and are included within the LCO based upon this consideration.

10. Containment Isolation Valve Position Containment Isolation Valve _(CIV) position indication :

instrumentation is provided in order for the operator to verify that RB penetrations are isolated, as-required, following an accident or transient. In this way, the Containment is verified to be functioning as analyzed and as tested (10 CFR 50, Appendix J). The CIV indication consists of open/ closed matrix lights located on the ES Section of the main control board.

CR-3 does not provide position indication for manual CIVs or CIVs utilizing a passive design (check valves). In the case of manual valves, these valve s types are acceptable alternatives to automatic valves for the purposes of providing containment isolation-and require no position indication since they are administratively maintained in the isolated position.

Position indication for check valves is specifically excluded by Table 3 of Regulatory Guide 1.97.

The LC0 requires two position indications per penetration rather than two indications per valve (for those penetrations provided with indication and tne applicable valve configuration). In other words, the LCO requires one position indicator for each of two active CIVs with control room indication. Strictly speaking, this is an exception from Category 1 redundancy requirements. However, this is considered acceptable since redundancy is provided on a per-penetration basis. For penetrations having only one CIV having control room indication, only that one indication is required by this LCO.

A Note has been added to indicate that position indication is not required for isolation valves whose associated penetration is isolated by at least one (continued)

O . .

(

Crystal River Unit 3 B 3.3-132 Final Draft 10/01/93

PAM Instrumentation B 3.3.17 BASES LCO 10. Containment Isolation Valve Position (continued) closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured. This allowance is consistent with the previous discussion on why position indication was excluded for manual valves. >

These instruments are not assumed to provide information required by the operator to take a mitigation action specified in the safety analysis.

As such, they are not Type A variables. However, the monitors are deemed risk significant (Category 1) and are included within the LC0 based upon this consideration.

11. Containment Area Radiation (Hiah Ranael Containment Area Radiation (High Range) instrumentation is provided to monitor the potential for significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans. .

Two channels of indication, each having a range of 1 to 1E8 Rad /hr. are provided in the control room with one channel recorded. These instruments are not assumed to provide information required by the operator to take a mitigation action specified in the accident analysis. As such, they are not Type A variables. However, the monitors are deemed risk significant (Category 1) and are included within the LCO based upon this consideration.

12. Containment Hydroaen Concentration Containment Hydrogen Concentration instrumentation is provided to detect high hydrogen concentration i conditions that represent a potential for containment ,

breach. The operator is expected to initiate hydrogen !

control actions based upon indication provided by this j instrument. These include hydrogen purge or recombiner initiation when hydrogen concentration reaches or exceeds the 4.1 volume percent flammability (continued)

O Crystal River Unit 3 B 3.3-133 Final Draft 10/01/93 1

l

PAM Instrumentation B 3.3.17 BASES LCO 12. Containment Hydroaen Concentration (continued) limit for hydrogen. This variable is also important in verifying the adequacy of mitigating actions since ,

hydrogen concentration is not expected to approach flammability-limits for any Design Basis Accident.

Two channels of indication, each covering a range of 0 to 10% hydrogen concentration are provided in the EFIC Room. Both channels are recorded in the EFIC room as well. These channels are not normally energized and thus are not subject tn the CHANNEL CHECK requirement of SR 3.3.17.1.

These instruments are not assumed to provide information required by the operator to take a.

mitigation action specified in the accident analysis.

As such, they are not Type A variables. The basis for this statement is that in order to generate bulk hydrogen concentrations which meet or exceed the flammability limit, core damage in excess of that allowed by 10 CFR 50.46 must occur. However, this is precluded by all other accident analysis. Thus, although the plant is designed to be capable of performing this function, it is not a requirement of the accident analysis. Be that as it may, the monitors are deemed risk significant (Category 1) and are included within the LC0 based upon this consideration.

13. Pressurizer level Pressurizer level is indicated to provide information :

on proper operation of the_ pressurizer for a variety of anticipated transients. These include decreasing feedwater temperature, excessive main feedwater flow, decreasing steam flow, small steam leaks, loss-of-offsite power (and subsequent natural circulation ensured by pressurizer heater operation), loss of condenser vacuum, as well as several others. For these events, pressurizer level is expected to remain on-scale for the installed indication.

For severe transients or accidents such as a steam line break, steam generator tube rupture, and many (continued)

O Crystal River Unit 3 B 3.3-134 Final Draft 10/01/93

PAM Instrumentation B 3.3.17-BASES bh LC0 13. Pressurizer level (continued) small break LOCAs, the pressurizer will void. For the ,

case of a loss of main feedwater, the pressurizer could potentially be made water-solid. This is undesirable in that RCS pressure control is degraded and the potential for passing liquid through the pressurizer safety valves is increased. Studies have shown the safeties have a higher potential to fail to -

re-seat (creating an unisolable LOCA) if this ,

condition were to occur. ,.

Two channels of pressurizer level, each covering a range of 0 to 320 inches, are indicated and recorded in the control room. These instruments are not assumed to provide information required by the t operator to take a mitigation action specified in the safety analysis. As such, they are not Tyr.e A .

variables. However, the monitors are deemed risk significant (Category 1) and are included within the LCO based upon this consideration. ,

14,15. Steam Generator Water Level (Start-up Ranae and ,

Operatino Ranae The CR-3 Type A/ Category 1 indication of steam :

generator level is the startup range and operating range EFIC level instrumentation. The combined '

instrument ranges cover a span of 6 to 394 inches '

above the lower tubesheet. The measured low range differential pressure is displayed in inches of water.

The low range indicates a range of 0 to 150 inches, i where 0 inches indicates an actual level of 6 inches l above the lower tubesheet. The high range steam generator level instrumentation indicates a span of 0 ;

to 100%, where 0% corresponds to a 102 inch actual ;

level above the lower tubesheet. Redundant monitoring capability is provided by two channels of each range of instrumentation per OTSG.

The level signals are displayed on control room indicators. The steam generator level signals are calculated from differential pressure signals which are pressure compensated by a module in the EFIC (continued)

Crystal River Unit 3 8 3.3-135 Final Draft 10/01/93

PAM Instrumentation B 3.3.17 O

V BASES LC0 14,15. Steam Generator Water level (Start-up Ranae and Operatina Ranae (continued)

System cabinets. Compensation is based on the densities of the water and steam assuming the OTSGs are normally operating at saturation. Each operating ,

range level transmitter also inputs to a recorder in the control room. Since operator action is based on the control room indication, the LCD deals specifically with this portion of the instrument string.

16. Steam Generator Pressure ,

Steam generator pressure is measured at the inlet of each steam line in each OTSG. Redundant monitoring '

capability is provided by two pressure transmitters ,

per OTSG. Each pressure transmitter provides an input signal to pressure indicators and a recorder in the control room. The operator selects one of the two.

pressure signals as input to the Integrated Controls System (ICS). The control room indication of OTSG O pressure is one of the primary indications used by the operator during an accident. Therefore, the LC0 deals specifically with the control room indication portion of the OTSG pressure instrument string. The range of the indication is 0 to 1200 psig.

OTSG pressure decreases rapidly during a design basis steam line break accident. This rapid decrease in pressure is a positive indication of a breach in the secondary system pressure boundary. In order to minimize the primary system cooldown caused by the decreasing secondary system pressure, feedwater flow to the affected 0TSG must be terminated. OTSG pressure is considered a Type A variable because it is the primary indication used by the operator to .

Ei identify and isolate the affected 0TSG. In addition, OTSG pressure is a key parameter used by the operator to evaluate primary-to-secondary heat transfer. For example, the operator may use this indication to control the primary system cooldown following a steam generator tube rupture or a small break loss of -

coolant accident (LOCA).

(continued)

Crystal River Unit 3 B 3.3-136 Final Draft 10/01/03

PAM Instrumentation B 3.3.17 BASES LCO 17. Emeraency Feedwater Tank Level (continued)

The dedicated emergency feedwater (EFW) tank provides the assured, safety grade water supply for the Emergency Feedwater System. The EFW tank inventory is monitored and displayed by 0 to 38 feet control room level indications. The control room indicators and alarms are considered the primary indication used by the operator. Therefore, the LCO deals specifically with this portion of the instrument string.

The design basis accidents which require emergency feedwater are those in which the main feedwater supply and/or the electrical supply to the vital feedwater auxiliaries has been lost, e.g., a feedwater line' ,

break or a loss of offsite power. In the event of such a loss of feedwater, the-EFW tank is the initial source of water for the EFW System. As the EFW tank is depleted, manual operator action is necessary to replenish the EFW tank or to realign the suction to the EFW pumps. Since tank level is required by the operator for manual actions following an event, it has been included in this LCO.

,O

18. Core Exit Temoerature (Backus)

The core exit thermocouples (CETs) provide an indication of the reactor coolant temperature as it exits the active region of the core. The accident monitoring instrumentation provides a display of core exit temperature over a range of 0-2500*F. The display consists of 16 separate temperature measurements from 16 CETs, four from each quadrant.

Each of these 16 core exit temperature measurements is continuously recorded in the control room on three separate recorders. Since the control room display is the primary indication used by the operator, this LC0 deals specifically with this portion of the instrument string.

The CETs are considered the primary indication of the reactor coolant temperature. Core exit temperature is included in this LC0 because the operator uses this indication to monitor the cooldown of the RCS (continued)

Crystal River Unit 3 8 3.3-137 Final Draft 10/01/93

I PAM Instrumentation B 3.3.17

(~ BASES LC0 18. Core Exit Temperature (Backuo) (continued) i following a steam generator tube rupture or small break LOCA. Operator actions to maintain a controlled cooldown, such as adjusting 0TSG level or pressure, would be prompted by this indication. In addition, the core exit thermocouples provide input to the rubcooling margin monitor, which is a Type A variable.

The subcooling margin monitor takes the average of the five highest CETs for each of the ICCM trains. Two channels ensure that a single failure will not disable the ability to determine the representative core exit -

temperature.

19. Emeraency Feedwater Flow EFW Flow instrumentation is provided to monitor operation of decay heat removal via the OTSGs. The EFW injection flow to each OTSG (2 channels per OTSG, one associated with each EFW injection line) is determined from a differential pressure measurement calibrated to a span of 0 gpm to 1000 gpm. Each O- differential pressure transmitter provides an input to a control room indicator and the plant computer.

EFW Flow is used by the operator to determine the need to throttle flow during accident or transient conditions to prevent the EFW pumps from operating in runout conditions or from causing excessive RCS cooldown rates when low decay heat levels are present.

EFW Flow is also used by the operator to verify that the EFW System is delivering the correct flow to each OTSG. However, the primary indication of this function is provided by 0TSG level.

These instruments are not assumed to provide information required by the operator to take a mitigation action specified in the safety analysis. :

As such, they are not Type A variables. However, the monitors are deemed risk significant (Category 1) and are included within the LC0 based upon this consideration.

l (continued) l Crystal River Unit 3 B 3.3-138 Final Draft 10/01/93 l l

C' PAM Instrumentation B 3.3.17 i

BASES (continued)

APPLICABILITY The PAM instrumentation requirements are applicable in MODES 1, 2, and 3. These variables are related to the diagnosis and pre-planned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1, 2, and 3. In MODES 4, 5, and 6, plant operating conditions are such that the likelihood of an event occurring that would require PAM instrumentation is low; therefore, PAM i instrumentation is not required to be OPERABLE in these MODES.

ACTIONS The ACTIONS are modified by two Notes. Note 1 was added to-indicate the restrictions of LC0 3.0.4 are not applicable.

This exception allows entry into an applicable MODE while relying on the ACTIONS even though the ACTIONS would eventually require a shutdown. This exception is acceptable due to the passive function of the instruments, the operator's ability to respond to an accident utilizing alternate instruments and methods, and the low probability of an event requiring these instruments.

Note Two was added to clarify the application of Completion O Time rules to this Specification. The Conditions of_this Specification are entered independently for each Function listed in Table 3.3.17-1. The Completion Time (s) of the inoperable channels of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function. i A.1 i When one or more Functions have one required channel inoperable, the inoperable channel must be restored to OPERABLE status within 30 days. The 30 day Completion Time !

is based on engineering judgment and a variety of I considerations. These considerations include availability :

of the remaining OPERABLE channel, the passive nature of l the instrument (no criticsl automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.

(continued) l Crystal River Unit 3 8 3.3-139 Final Draft 10/01/93 l l

1

. - - . -- . - - .__-__________\

PAM Instrumentation B 3.3.17

_ BASES ACTIONS A.1 (continued)

For penetrations having only one CIV having control room indication, Required Action A.1 is the applicable ACTION to enter when the single indication is determined to be inoperable. This practice is consistent with the philosophy used in the isolation design fe> these types of penetrations.

B.1 When a PAM instrumentation channel cannot be restored to OPERABLE status within 30 days, Required Action B.1 specifies the action described in Specification 5.7.2.a be initiated immediately. This action requires a written report be submitted to the NRC. This report discusses the results of the root cause evaluation of the inoperability and identifies proposed restorative actions. This action is appropriate in lieu of a shutdown requirement since alternative actions are identified and implemented before loss of functional capability occurs. The immediate Completion Time ensures the requirements of Specification 5.7.2.a are initiated without delay, u

When one or more Functions have two required channels inoperable (i.e., two channels inoperable in the same Function), one channel in the Function must be restored to OPERABLE status within 7 days. The Completion Time of 7 days is based on the low probability of an event requiring operator action from the PAM instrumentation and the availability of alternative means for obtaining the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because alternate diverse monitoring indications may not fully satisfy Regulatory Guide 1.97 qualification requirements applicable to the Category 1 instrumentation. '

Therefore, requiring restoration of one channel of the Function to OPELABLE status minimizes the possibility that the PAM Function will be in a degraded condition should an ,

accident occur.

t 1

(continued)

O l Cry'stal River Unit 3 8 3.3-140 Final Draft 10/01/93 l i

i

PAM Instrumentation B 3.3.17 BASES ACTIONS p_d (continued)

Required Action D.1 directs entry into the appropriate Condition referenced in Table 3.3.17-1. The applicable Condition referenced in the Table is Function dependent.

Each time an inoperable channel has not met any Required ,

Action and associated Completion Time of Condition C, Condition D is entered for that Function and the operator is directed to the appropriate subsequent Condition.

Ed If the Required Action and associated Completion Time of Conditions C is not met and Table 3.3.17-1 directs en,try 4 into Condition E, the plant must be placed in a MODE in which the requirements of this LCO do not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

O Ed Alternative means of monitoring containment area radiation and reactor vessel level are available and may be relied upon if the normal PAM channels cannot be restored to 4 OPERABLE status within the associated Completion Time.

Based upon this capability, it is inappropriate to require plant shutdown in this condition. Rather, in conjunction with the alternate monitoring means, the Required Action specifies action be immediately initiated in accordance with Specification 5.7.2.a, "Special Reports," in the Administrative Controls section of the Technical Specifications. The report provided to the NRC should discuss the alternate means of monitoring, describe the degree to which the alternative means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the !

normal PAM channels to 0F.ERABLE status. ,

l (continued)

Crystal River Unit 3 B 3.3-141 Final Draft 10/01/93

PAN Instrumentation B 3.3.17 f

-t} BASES ACTIONS E21 (continued)

In the case of reactor vessel level, Reference 4 demonstrated that from a risk perspective, the appropriate Required Action was not to mandate a plant shutdown, but-rather to follow the actions of Specification 5.7.2.a.

SURVEILLANCE As noted at the beginning of the SRs, the SRs apply-REQUIREMENTS to each PAM instrumentation Function in Table 3.3.17-1, except as noted.

SR 3.3.17.1 Performance of the CHANNEL CHECK once every 31 days for each required instrumentation channel that is normally energized ensures that a gross failure of the instrumentation has not occurred. A CHANNEL CHECK is a comparison of the parameter indicated on one channel with a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

O Significant deviations between the two instrument channels-could be an indication of excessive instrument drift in one of the channels or of something even more serious.

Acceptance criteria are determined by the plant staff, and are presented in the Surveillance Procedures. The criteria may consider, but is not limited to, channel instrument uncertainties, including indication and readability. If a channel is outside the acceptance criteria, it may be an indication that the sensor or the signal processing equipment has excessively drifted. If the channels are within the acceptance criteria, it is an indication that the channels are OPERABLE. If the channels are normally off-scale when the Surveillance is performed, the CHANNEL CHECK will only verify that they are off-scale in the same direction. Off-scale low current loop channels are verified to be reading at the bottom of the range and not-failed downscale.

The Frequency is based on operating experience that demonstrates channel failure is an uncommon event.

1 (continued) i Crystal River Unit 3 B 3.3-142 Final Draft 10/01/93 I

l l

PAM Instrumentation B 3.3.17

, BASES SURVEILLANCE SR 3.3.17.1 (continued)

REQUIREMENTS A note to the Surveillance excludes the performance of a CHANNEL CHECK on Function 4. FPC requested, and was granted, exception from performing a CHANNEL CHECK on this instrumentation as part of Amendment 124, dated October 17, 1989. The basis for not performing this SR is based on the design of the system. The system utilizes differential pressure (dp) measurements across vertical elevations of the hot leg and the reactor vessel when the RCPs are tripped. Performance of the SR with the RCPs in operation provides no meaningful information, such tnat a CHANNEL CHECK of this Function is not required.

SR 3.3.17.2 CHANNEL CALIBRATION is a complete check of the instrument channel, including the sensor, to verify the channel responds to the measured parameter (s) within the necessary range and accuracy.

For the Containment Area Radiation instrumentation, a CHANNEL CALIBRATION consists of an electronic calibration O of the channel, not including the detector, for range decades above 10 R/hr. The calibration also provides a one point check of the detector below 10 R/hr using a gamma test source (Reference NUREG 0737, Table II.F.1-3).

The 18 month Frequency is based on operating experience and was originally selected to be consistent with the typical industry fuel cycle. ,

A Note clarifies that the neutron detectors are not .

required to be tested as part of the CHANNEL CALIBRATION. ;

Adjustment of the detectors is unnecessary because they are passive devices and operating experience has shown them to exhibit minimal drift. Furthermore, there is no adjustment that can be made to the detectors.

( (continued)

Crystal River Unit 3 B 3.3-143 Final Draft 10/01/93

r o PAM Instrumentation ,

B 3.3.17 l BASES (continued) l REFERENCES 1. FSAR, Table 7-12. !

2. Regulatory Guide 1.97, Revision 3.

3. NUREG-0737, 1979.

4. 32-1177256-00, " Technical Basis for Reactor Vessel Level Indication System (RVLIS) Action Statement,"

April 10, 1990.

O t

i O

Crystal River Unit 3 B 3.3-144 Final Draft 10/01/93 I

Remote Shutdown System B 3.3.18 O

B 3.3 INSTRUMENTATION B 3.3.18 Remote Shutdown System BASES BACKGROUND The Remote Shutdown System provides the control room operator with sufficient instrumentation to place and maintain the plant in a safe shutdown condition from outside the control room. This capability is necessary to protect against the possibility that the control room becomes inaccessible. A safe shutdown condition is defined as MODE 3. With the plant in MODE 3, the Emergency Feedwater (EFW) System and the main steam safety valves or the atmospheric dump valves can be used to remove core decay heat and meet all safety requirements. The long term supply of EFW allows extended operation in MODE 3.

In the event that the control room becomes inaccessible, the operators can establish control at the remote shutdown panel and place and maintain the plant in MODE 3. Not all controls and necessary transfer switches are located at the remote shutdown panel. Some controls and transfer switches will have to be operated locally at the switchgear, motor O control panels, or other local stations.

The OPERABILITY of the Remote Shutdown System control and instrumentation Functions ensures that there is sufficient information available on selected plant parameters to place and maintain the plant in MODE 3 should the control room become inaccessible.

APPLICABLE The Remote Shutdown System is required to provide SAFETY ANALYSES equipment at appropriate locations outside the control room with a capability to promptly shut down and maintain the unit in a safe condition in MODE 3.

The design basis for the CR-3 Remote Shutdown System is 10 CFR 50, Appendix A, GDC 19 and 10 CFR 50, Appendix R, Section L, (Ref. I and 2). However, the licensing basis for this LC0 is limited to the manner with which FPC meets the intent of GDC 19 (i.e., FSAR Section 1.4, Criterion 11). -

(continued)

Crystal River Unit 3 B 3.3-145 Final Draft 10/01/93

Remote Shutdown System B 3.3.18 h)

%)

BASES APPLICABLE The Remote Shutdown System was determined by the NRC to be SAFETY ANALYSES a risk significant item required to be retained in the ,

(continued) Technical Specifications.

LC0 The Remote Shutdown System LC0 provides the requirements for the OPERABILITY of the indication instrumentation necessary to place and maintain the plant in MODE 3 from a location other ,than the control room. The instrumentation required are listed in Table 3.3.18-1 in the accompanying LCO.

The instrumentation are those required for:

. Core Reactivity Control;

. RCS Pressure Control;

. RCS Temperature Control (Decay Heat Removal);

. RCS Inventory Control; and

. Support systems for the above Functions.

A Function of a Remote Shutdown System is OPERABLE if all instrument channels needed to support the Function are OPERABLE. Functionality of the control functions supported by the instrumentation included in this Specification is addressed outside Technical Specifications.

The Remote Shutdown System instruments covered by this LCO do not need to be energized to be considered OPERABLE. This LC0 is intended to ensure the Remote Shutdown System instruments will be OPERABLE if plant conditions require that the Remote Shutdown System be placed in operation.

APPLICABILITY The Remote Shutdown System LCO is applicable in MODES 1, 2, and 3 so that the plant can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room.

This LC0 is not applicable in MODE 4, 5, or 6. In these MODES, the plant is initially subcritical and in a condition of reduced RCS energy. Under these conditions, considerable

_ (continued)

Crystal River Unit 3 B 3.3-146 Final Draft 10/01/93

Remote Shutdown System B 3.3.18 BASES l

I APPLICABILITY time is available to restore necessary instrument (continued) functions if it becomes necessary to abandon the control room.

ACTIONS The ACTIONS are modified by two Notes. Note 1 was added to indicate the restrictions of LC0 3.0.4 are not applicable. '

This exception allows entry into an applicable MODE while relying on the ACTIONS, even though the ACTIONS may eventually require a unit shutdown. This exception is acceptable due to the low probability of an event requiring these instruments.

Note 2 was added to clarify the application of Completion Time rules to this Specification. The Conditions of the Specification may be entered independently for each Function listed in Table 3.3.18-1. The Completion Time (s) of the inoperable channel (s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.]

Condition A addresses the situation where one or more required Functions listed in Table 3.3.18-1 of the Remote Shutdown System are inoperable.

With one or more Remote Shutdown System instrumentation Functions inoperable, the Function must be restored to OPERABLE status within 30 days. The Completion Time is '

based on operating experience and takes into account other indication available to provide the required information, and the low probability of an event that would require evacuation of the control room. .

B.1 and B.2 If Required Action A.1 cannot be met within the associated Completion Time, the plant must be placed in a MODE in which ,

the LCO does not apply. To achieve this status, the plant 4 must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in -

MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are (continued)

Crystal River Unit 3 8 3.3-147 Final Draft 10/01/93

Remote Shutdown System B-3.3.18 O

v BASES ACTIONS B.1 and B.2_ (continued) reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

7 SURVEILLANCE SR 3.3.18.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 31 days for each required instrumentation channel that is normally energized ensures that a gross failure of instrumentation has not .

occurred. A CHANNEL CHECK is a comparison of the indicated parameter to a similar parameter on other channels. It is -

based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be in indication of excessive instrument drift in one of the channels or of something even more serious. Acceptance criteria are determined by the plant staff and are presented in the Surveillance Procedure. The criteria may consider, O but is not limited to, channel instrument uncertainties, including indication and readability. If the channel is outside the acceptance criteria, it may be an indication that the sensor or the signal processing equipment has excessively drifted. If the channels are within the acceptance criteria, it is an indication that the channels are OPERABLE. As specified in the Surveillance, a CHANNEL CHECK is only required for those channels that are normally ;

energized. If the channels are normally off-scale when the Surveillance is performed, the CHANNEL CHECK will only verify that they are off-scale in the same direction.

Off-scale low current loop channels are verified to be reading at the bottom of the range and not failed downscale.

The Frequency is based on plant operating experience, which demonstrates that channel failure is an uncommon event.

l l

(continued)

Crystal River Unit 3 B 3.3-148 Final Draft 10/01/93 )

Remote Shutdown System B 3.3.18 i BASES SURVEILLANCE SR 3.3.18.2 REQUIREMENTS (continued) CHANNEL CALIBRATION is a complete check of the instrument loop and sensor. The SR verifies that the channel responds to the measured parameters within the necessary range and' accuracy.

A Note clarifies that Function 1.a., " Reactor Trip Breaker (RTB) Position" is not required to have a CHANNEL CALIBRATION. This indication is mechanical in nature, and thus, not subject to a calibration.

The 18 month Frequency is based on operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an 18 month calibration interval in the determination of the magnitude of equipment drift.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 19.

2. 10 CFR 50, Appendix R, Section L.

O O

Crystal River Unit 3 8 3.3-149 Final Draft 10/01/93 4

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1

(

k B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits BASES BACKGROUND These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within the limits assumed in the safety analyses. The analyses of normal operating conditions, including anticipated operational occurrences assume initial conditions within the normal steady state envelope. The limits placed on DNB related parameters ensure that these parameters will not be less conservative than were assumed in the analyses and thereby provide assurance that the minimum departure from nucleate boiling ratio (DNBR) will meet the required criteria for each of the transients analyzed.

The RCS pressure limit is consistent with operation within the nominal operating envelope and is above the value used as the initial pressure in the analyses. A pressure greater than the minimum specified will produce a higher DNBR. A

, pressure lower than the minimum specified will cause the plant to approach the DNB limit.

The RCS coolant hot leg temperature limit is consistent with full power operation within the nominal operating envelope and is lower than the initial hot leg temperature in the analyses. A hot leg temperature lower than that specified ,

will produce a higher DNBR. A temperature higher than that specified will cause the plant to approach the DNB limit.

The RCS flow rate is a function of the number of RCPs in operation and is not expected to vary during operation. The minimum RCS flow rate limit corresponds to that assumed for the DNBR analyses. A higher RCS flow rate will produce a higher DNBR. A lower RCS flow will cause the plant to approach the DNB limit.

APPLICABLE The requirements of LC0 3.4.1 represent the initial SAFETY ANALYSES conditions for DNB limited transients analyzed in the plant safety analyses (Ref. 1). The safety analyses have shown q (continued) k/

Crystal River Unit 3 B 3.4-1 Final Draft 10/01/93

RCS Pressure, Temperature, and Flow DNB Limits !

B 3.4.1 i BASES i

APPLICABLE that transients initiated from the limits of this LCO will SAFETY ANALYSES meet the event-specific DNBR acceptance criterion. This is (continued) the acceptance limit for the RCS DNBR parameters. The transients analyzed for include loss of coolant flow events and dropped or stuck control rod events. A key assumption.

for the analysis of these events is that the core power distribution is within the limits of LC0 3.2.1, " Regulating Rod Insertion Limits," LC0 3.2.2, "APSR Insertion Limits,"

LC0 3.2.3, " AXIAL POWER IMBALANCE OPERATING LIMITS," and LC0 3.2.4, " QUADRANT POWER TILT."

The core outlet pressure assumed in the safety analyses is 2135 psia. The minimum pressure specified in LCO 3.4.1 is the limit value in the reactor coolant loop as measured at the hot leg pressure tap.

The safety analyses are performed with an assumed RCS coolant average temperature of 581*F (579'F plus 2*F allowance for calculational uncertainty). The corresponding hot leg temperature of 604.6*F is calculated by assuming an RCS core outlet pressure of 2135 psia and an RCS flow rate of 374,880 gpm. The maximum temperature specified is the ,

limit value at the hot leg resistance temperature detector.

The safety analyses are performed with an assumed RCS flow rate of 374,880 gpm. The flow rate specified in SR 3.4.1.3 is the corresponding mass flow rate for full-power conditions.

Analyses have been performed to establish the pressure, temperature, and flow rate requirements for three pump operation as well. The flow limits for three pump operation are approximately 25% lower than the four pump limits. To meet the DNBR criterion, a corresponding maximum power limit of less than the top of the " doghouse" (Power-Imbalance-Flow trip setpoint contained in the COLR) is required in combination with the 3 pump limits'(see Bases for LC0 3.3.1, "RPS Instrumentation").

RCS DNB limits satisfy Criterion 2 of the NRC Policy Statement.

LCO Limits on RCS loop (hot leg) pressure, RCS hot leg temperature, and RCS total flow rate ensure that the core (continued)

O Crystal River Unit 3 8 3.4-2 Final Draft 10/01/93 !

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES LCO operates within the limits assumed for the plant safety (continued) analyses. Operating within these limits ensures DNBR criteria are met in the event of a DNB-limited transient.

The numerical values for pressure, temperature, and flow rate are adjusted for measurement location but have not been adjusted for instrument error.

APPLICABILITY In MODE 1, RCS pressure, RCS hot leg temperature, and RCS flow rate must be maintained within limits during steady state operation. This ensures that DNBR criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient. In all other MODES the power level is low enough so that DNB is not a concern. ;

ACTIONS L.1 l

Loop pressure and hot leg coolant temperature are controllable parameters. With one or both of these parameters not within limits, action must be taken to restore the parameters. RCS flow rate is not a controllable O. parameter and is not expected to vary during steady state four pump or three pump operation. However, if the flow rate is less than the limit, 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is allowed to restore the parameter to within limits. Successful Completion of this action will restore DNBR margin.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for restoring the parameters provides sufficient time to adjust plant parameters, determine the cause for the off-normal condition, and restore the parameters to within limits. The Completion Time is based on operating experience.

B.d If Required Action A.1 is not met within the associated Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . In MODE 2, the reduced power condition eliminates the potential for violation of the accident analysis bounds.

I i

(continued) ]

Crystal River Unit 3 8 3.4-3 Final Draft 10/01/93 i

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES ACTIONS BM (continued)

The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is reasonable, based on operating experience, to reduce power in an orderly manner without challenging systems.

SURVEILLANCE SR 3.4.1.1 REQUIREMENTS Loop (hot leg) pressure must be verified within limits once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to ensure that the pressure is within limits during normal operation, steady state condition following load changes and other expected transient operations. The RCS pressure limit is dependent on the number of reactor coolant pumps in operation and has been adjusted to account for the pressure loss difference between the core exit and the measurement location. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency has been shown by operating experience to be sufficient to detect potential degradation and to verify operation is within safety analysis assumptions.

A Note has been added to indicate the pressure limit is g applicable to the loop with two pumps in operation for the three pump operating condition.

SR 3.4.1.2 Hot leg temperature must be verified within limits once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to ensure that the RCS coolant temperature is within limits during normal operation, steady state condition following load changes and other expected transient operations. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency has been shown by operating experience to be sufficient to regularly assess potential degradation and to verify that operation is within .

safety analysis assumptions.

A Note has been added to indicate the temperature limits are to be applied to the loop with two pumps in operation for the three pump operating condition.

(continued)

Crystal River Unit 3 B 3.4-4 Final Draft 10/01/93

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEILLANCE SR 3.4.1.3 REQUIREMENTS (continued) Verification that RCS total flow rate is within the limit specified in the SR is performed using installed flow instrumentation. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency has been shown by operating experience to be sufficient to regularly assess potential degradation and to verify that operation is within safety analysis assumptions. When starting a fourth RCP in MODE 1, this SR is not required to be performed until the next scheduled performance.

SR 3.4.1.4 Measurement of RCS total flow rate by performance of a precision calorimetric heat balance once every 24 months allows the installed RCS flow instrumentation to be calibrated and verifies that the actual RCS flow is greater than or equal to the minimum required. The intent of the 24 month Frequency is to reflect the importance of verifying flow following a refueling outage when the core has been altered or other RCS flow characteristics may have changed.

The Surveillance is modified by a Note indicating it does not need to be performed until stable thermal conditions are established at power levels > 90% of the ALLOWABLE THERMAL POWER. The Note is necessary to allow measurement of the flow rate in MODE 1 when the plant has reached a stable power level hold point. The surveillance cannot be performed at low power or in MODES other than MODE 1 because the reactor power level is too small to provide meaningful test results.

REFERENCES 1. FSAR, Chapter 14.

O Crystal River Unit 3 8 3.4-5 Final Draft 10/01/93

RCS Minimum Temperature for Criticality B 3.4.2 :

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.2 RCS Minimum Temperature for Criticality BASES BACKGROUND The value for the minimum temperature for reactor criticality was established based upon considerations for:

a. operation within the existing instrumentation ranges and accuracies; The Reactor Protection System (RPS) receives inputs from the narrow range hot leg temperature detectors, which have a range of 520*F to 620*F. The integrated control system (ICS) using controls average instrumentation temperature with the same ra(T,,dg)e.

b. making the reactor critical under " hot" RCS conditions.

c. assuring stable reactivity control when reactivity changes are induced by temperature changes during a beginning of core life start-up.

Nominal T,y for making the reactor critical is 532*F.

APPLICABLE There are no accident analyses that specify a minimum SAFETY ANALYSES temperature for criticality, but all low power safety analyses assume initial temperatures near the 525'F limit.

The reactor coolant moderator temperature coefficient-used in core operating and accident analysis is typically defined for the normal operating temperature range (532'F to 579'F).

RCS minimum temperature for criticality satisfies Criterion 2 of the NRC Policy Statement.

LC0 The purpose of the LC0 is to prevent criticality outside the normal operating range (532*F to 579'F) and to prevent operation in an unanalyzed condition.

(continued)

Crystal River Unit 3 B 3.4-6 Final Draft 10/01/93

RCS Minimum Temperature for Criticality.

B 3.4.2 BASES LCO The LCO limit of 525'F has been selected to be within the (continued) instrument indicating range (520*F to 620*F). The limit is also set slightly below the lowest power range operating temperature (532*F) to allow some margin of operation.

The 525'F limit has not been adjusted for instrument error.

This is considered acceptable since the basis for the value is to maintain the instrumentation on-scale and is not specifically tied to any analysis.

APPLICABILITY The reactor has been designed, analyzed, and licensed to be critical only in MODES 1 and 2. Criticality is not permitted in any other MODE. Therefore, this LCO is applicable in MODE I and MODE 2 when kg 2 1.0.

ACTIONS A.1 below 525*F and the reactor critical, RCS WithT'duremustberestoredtowithinthelimitorthe temper O,. plant must be placed in a MODE in which the LC0 does not apply. Either of these actions must be accomplished within 30 minutes. Rapid reactor shutdown to MODE 3 can be readily and practically achieved in a 30 minute period. The Completion Time reflects the ability to perform this Action and maintain the plant within the analyzed range. Thus, it is based on engineering judgment.

SURVEILLANCE SR 3.4.2.1 REQUIREMENTS T is required to be verified greater than or equal to SE*Fwithin15minutespriortoachievingcriticalityand every 30 minutes thereafter. The 15 minute time period is long enough to allow the operator to adjust temperature or delay reactor start-up, if necessary. The 30 minute time period is frequent enough to prevent inadvertent violation of the LCO. The 30 minute portion of the Frequency has been modified by a Note indicating this portion of the Frequency is only required when T,y < 530*F. While the Surveillance (continued)

Crystal River Unit 3 B 3.4-7 Final Draft 10/01/93

RCS Minimum Temperature for Criticality B 3.4.2 +

BASES SURVEILLANCE SR 3.4.2.1 (continued)

REQUIREMENTS is required whenever the reactor is critical and temperature is less than 530*F, in practice the Surveillanen is most appropriate during the pericd when the reactor is brought critical.

REFERENCES None. ,

l d

O -

t i

O Crystal River Unit 3 8 3.4-8 Final Draft 10/01/93

RCS P/T Limits B 3.4.3

( B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.3 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by planned startup and shutdown evolutions, as well as plant transients. This LC0 limits the pressure and temperature changes during RCS heatup and cooldown, within the desion assumptions and the stress limits for cyclic operation.

The PRESSURE TEMPERATURE LIMIT REPORT (PTLR) contains P/T limit curves for heatup, cooldown, and inservice leak and hydrostatic (ISLH) testing, and limits on the maximum rate of change of reactor coolant temperature. Each P/T limit curve defines an acceptable region for normal operation below and to the right of the limit curve.

The LCO LIMIT establishes operating limits that provide a margin to brittle failure of the reactor vessel and the reactor coolant pressure boundary (RCPB). The vess?1 is the O component most subject to brittle failure due to the fast neutron embrittlement it experiences during power operation, and is the limiting component for establishing P/T limits.

10 CFR 50, Appendix G (Ref.1), requires the establishment of P/T limits for material fracture toughness requirements of the RCPB materials. Reference I requires an adequate margin to brittle failure during norm &l operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME), Boiler and Pressure Vessel Code,Section III, Appendix G (Ref. 2) for developing the t curves.

(continued) l Crystal River Unit 3 B 3.4-9 Final Draft 10/01/93 l

?

RCS P/T Limits B 3.4.3

( BASES BACKGROUND Material toughness properties of the ferritic materials of (continued) the reactor vessel are determined in accordance with the NRC Standard Review Plan (Ref 3), NRC Regulatory Guide 1.99 (Ref. 4), and additional reactor vessel requirements. These properties are then evaluated in accordance with Reference 2.

The actual shift in the nil ductility reference temperature (RT,) of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 5) and Appendix H of 10 CFR 50 (Ref. 6).

The operating P/T limit curves are adjusted, as necessary, based on the evaluation findings and the recommendations of Reference 2.

The P/T limit curves are composite curves established by superimposing limits derived from stress analyses of the reactor vessel, closure head, and steam generators. At any specific pressure, temperature, and temperature rate of change, one location within the RCS will dictate the most restrictive limit. Early in core life, different locations are more restrictive, and, thus, the curves are composites

- of the most restrictive regions. However, after approximately 8 EFPY of neutron embrittlement, the reactor vessel beltline became the limiting component over the entire span of the CR-3 curves.

The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls. The calculation to generate the ISLH testing curve uses a different safety factor on pressure (per Ref. 2) than does the heatup and cooldown curves. The ISLH testing curve also extends to the RCS design pressure of 2500 psia.

The P/T limit curves and associated temperature rate of change limits are developed in conjunction with stress analyses for large numbers of operating cycles and provide conservative margins to nonductile failure. Although created to provide limits for normal operation, the curves also can be used to determine if an evaluation is necessary 1 following an abnormal transient.

l 04 (continued)

Crystal River Unit 3 8 3.4-10 Final Draft 10/01/93

RCS P/T Limits B 3.4.3 BASES (continued)

APPLICABLE The P/T limits are not derived from Design Basis Accident ,

SAFETY ANALYSES (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB.

Reference 8 establishes the methodology for determining the P/T limits. Since the P/T limits are not derived from any DBA analysis, there are no accident analysis acceptance limits related to the P/T limits. Rather, the P/T limits r are acceptance limits themselves since they preclude operation in an unanalyzed condition.

RCS P/T limits satisfy Criterion 2 of the NRC Policy Statement. ,

LCO The two elements of this LCO are:

a. The limit curves for heatup, cooldown, and ISLH testing; and

b. Limits on the rate of change of temperature.

The LCO limits apply to all components of the RCS, except the pressurizer. The limits define allowable P/T operating regions and permit a large number of operating cycles while providing a wide margin to nonductile failure.

The limits for the rate of change of temperature control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and ISLH P/T .

limit curves. Thus, the LCO for the rate of change of l temperature restricts stresses caused by thermal gradients ,

and also ensurer the validity of the P/T limit curves.

l Violating the LCO limits places the reactor vessel outside l of the bounds of the stress analyses and can increase l stresses in other RCPB components. The consequences depend on several factors, as follows:

a. The severity of the departure from the allowable operating P/T regime or the severity of the rate of change of temperature; (continued)

O Crystal River Unit 3 8 3.4-11 Final Draft 10/01/93

RCS P/T Limits

, B 3.4.3 BASES LCO b. The length of time the limits were violated (longer (continued) violations allow the temperature gradient in the thick vessel walls to become more pronounced); and

c. The existences, sizes, and orientations of flaws in the vessel material.

APPLICABILITY The RCS P/T limits Specification provides a definition of acceptable operation for prevention of nonductile failure in accordance with 10 CFR 50, Appendix G (Ref. 1). Although the P/T limits were developed to provide guidance for operation during heatup or cooldown (MODES 3, 4, and 5) or ISLH testing, the limits are applicable at all times.

MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed for normal maneuvering profiles, such as power ascension or descent. The limits do not apply to the pressurizer.

During MODES I and 2, other Technical Specifications provide limits for operation that can be more restrictive than or can supplement these P/T limits. LC0 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB)

~O Limits"; LC0 3.4.2, "RCS Minimum Temperature for Criticality"; and Safety Limit (SL) 2.1, "SLs," also provide operational restrictions on the combination of RCS pressure and temperature as well as maximum pressure.

ACTIONS The Actions of this LCO consider the premise that a violation of the limits occurred during normal plant maneuvering. Severe violations caused by abnormal transients, at times accompanied by equipment failures, may also require additional actions from emergency operating procedures.

A.1 and A.2 Operation outside the P/T limits during MODE 1, 2, 3, or 4 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.

(continuad)

Crystal River Unit 3 B 3.4-12 Final Draft 10/01/93

RCS P/T Limits B 3.4.3

( BASES ACTIONS A.1 and A.2 (continued)

The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the action to restore can be accomplished in this time in a controlled manner.

In addition to restoring operation to within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components. ASME Code,Section XI, Appendix E (Ref. 7) may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline. The evaluation must extend to all components of the RCPB. .

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable to accomplish the evaluation. The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections. A O favorable evaluation must be completed in order to satisfy Required Action A.2.

Condition A is modified by a Note requiring Required Action A.2 to be completed whenever the Condition is entered. The Note emph;s'zes the need to perform the evaluation of the effr. cts of the excursion outside the allowable limits. Per,toration alone per Required Action A.1 is insufficient, ir, and of itself, to justify indefinite continued operation because higher than analyzed stresses may have occurred and may have affected RCPB integrity.

B.1 and B.2 If the Required Actions and associated Completion Times of Condition A are not met, the plant must be placed in a lower MODE. The basis for requiring a cooldown under these circumstances is: (a) the RCS remained in an unacceptable pressure and temperature region for an extended period of

- increased stress, or (b) a sufficiently severe event caused entry into an unacceptable region. Either possibility (continued)

Crystal River Unit 3 8 3.4-13 Final Draft 10/01/93 l

RCS P/T Limits B 3.4.3 BASES ACTIONS B.1 and B.2 (continued) indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. At reduced pressure and temperature ,

conditions, the possibility of propagating an undetected flaw is decreased. Pressure and temperature are reduced by placing the plant in MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 ,

within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are

~

reasonable, based on operating experience, to reach the required MODE from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 Operation outside of the P/T limits in other than MODE 1, 2, 3, or 4, requires action be immediately initiated to restore the parameter (s) to within limit. This is necessary to return the RCPB to a condition that has been verified acceptable by stress analysis.

The immediate Completion Time reflects the urgency of initiating action to restore the parameters to within the analyzed range. Most violations will not be severe, and activity to restore the parameter can be accomplished -

without delay in a controlled manner.

In addition to restoring operation to within limits, an i evaluation is required to determine if operation can continue. The evaluation must verify that the RCPB integrity remains acceptable and must be completed prior to entry into MODE 4. Several methods may be used, including comparison with pre-analyzed transients in the stress analysis, or inspection of the components. ASME Code, !

Section XI, Appendix E (Ref. 7), may also be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.

Condition C is modified by a Note requiring Required Action C.2 to be completed whenever the Condition is -

entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the 2

(continued) )

O !

Crystal River Unit 3 B 3.4-14 Final Draft 10/01/93 I

RCS P/T Limits ,

B 3.4.3 ;

BASES ACTIONS C ,1 an_d_L2 (continued) :

allowable limits. Restoration alone, per Required Action C.1, is insufficient, in and of itself, to justified -

continued oiration because higher than analyzed stresses may have occurred and may have affected RCPB integrity.

SURVEILLANCE SR 3.4.3.1 REQUIREMENTS Verification that operation is within the limits specified in the PTLR is required every 30 minutes when RCS pressure '

and temperature conditions are undergoing planned changes.

These planned evolutions include heatup, cooldown and ISLH testing. As such, this SR is modified by a Note that only requires this SR to be performed during system heatup, cooldown, and ISLH testing. The definition of what constitutes a heat-up or cooldown is defined in the applicable plant procedure.

The 30 minute Frequency is considered reasonable in view of q the control room indication available to monitor RCS status.

Q In addition, since temperature rate of change limits are specified in hourly increments, 30 minutes permits assessment and correction for minor deviations within a reasonable time.

REFERENCES 1. 10 CFR 50, Appendix G.

2. ASME, Boiler and Pressure Vessel Code,Section III, Appendix G.

3. NUREG-0800, Section 5.3.1, Rev. 1, July 1981.

4. Regulatory Guide 1.99, Revision 2, May 1988.

5. ASTM E 185-8T, July 1982.

(continued)

Crystal River Unit 3 8 3.4-15 Final Draft 10/01/93

r-RCS P/T Limits B 3.4.3 ,

BASES REFERENCES 6. 10 CFR 50, Appendix H.

(continued) .

7. ASME, Boiler and Pressure Vessel Code,Section XI, ,

Appendix E. ,

8. BAW-10046A, Rev. 2, April 1986. -

O O

Crystal River Unit 3 B 3.4-16 Final Draft 10/01/93

RCS Loops-MODE 3 '

B 3.4.4 8 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.4 RCS Loops-MODE 3 BASES BACKGROUND The primary function of the reactor coolant in MODE 3 is removal of decay heat from the reactor core and transfer of this heat, via the once-through steam generators (OTSGs), to i the secondary plant fluid. The secondary function of the reactor coolant is to act as a transport medium for soluble neutron poison, boric acid.

In MODE 3, reactor coolant pumps (RCPs) are used to provide forced circulation for heat removal during heatup and cooldown. The number of RCPs in operation wil1 vary depending on operational needs, and the intent of this LC0 '

is to assure forced flow for core heat removal and transport from at least one RCP. The flow provided by one RCP is adequate for heat removal and for boron mixing. However, two RCS loops are required to be OPERABLE to provide redundant paths for heat removal.

Although not normally used, natural circulation at these RCS O conditions provides sufficient core cooling. If entry into natural circulation is required, the reactor coolant at the highest elevation of the hot leg must be maintained subcooled for single phase circulation. When in natural circulation, it is preferable to remove heat using both OTSGs to avoid idle loop stagnation that might occur if only one OTSG was in service. However, one generator will provide adequate heat removal. Boron reduction in natural ,

circulation is prohibited because mixing necessary to obtain a homogeneous concentration in all portions of the RCS cannot be ensured.

APPLICABLE No safety analyses are performed with initial conditions in SAFETY ANALYSES MODE 3. The flow provided by one reactor coolant pump is adequate to prevent baron stratification in the vessel core region during a reduction of boron concentration.

(continued)

Crystal River Unit 3 B 3.4-17 Final Draft 10/01/93 l

l

i RCS Loops-MODE 3 B 3.4.4 I

l BASES APPLICABLE RCS loops-MODE 3 satisfies the requirements of NRC Policy SAFETY ANALYSES Statement. While none of the three criteria directly apply, (continued) this Specification assures that reactivity control is maintained, thus Criterion 2 is the appropriate criterion, because boron dilution and reactivity control in natural circulation are unanalyzed. Potential reactivity increases would be outside the bounds of the safety analysis.

LC0 The purpose of this LCO is to require two RCS loops to be OPERABLE to provide redundant heat removal capability. This includes the intent of requiring both OTSGs to be capable of transferring heat from the reactor coolant at a controlled rate. Forced reactor coolant flow is the preferred method of transporting heat, although natural circulation flow provides adequate heat removal. One or more RCPs in operation meets the LC0 requirement for one loop in operation.

The Note permits a limited period of operation without RCPs in operation. All RCPs may be de-energized for s I hour per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. During this period, core decay heat is O removed by natural circulation. When in natural circulation, boron reduction is prohibited because an even i

concentration distribution throughout the RCS cannot be ,

ensured. Core outlet temperature is to be maintained so as l to assure subcooling throughout the RCS so that no vapor bubble may form and possibly cause a natural circulation flow obstruction. The time period is acceptable because natural circulation is adequate for heat removal, or the reactor coolant temperature can be maintained subcooled and '

boron stratification affecting reactivity control is not expected.

An OPERABLE RCS loop consists of at least one OPERABLE RCP and a flow path for circulating reactor coolant around the loop, An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.

APPLICABILITY In MODE 3, the heat generated is lower than at power; therefore, one RCS loop in operation is adequate for transport and heat removal. A second RCS loop is required (continued)

Crystal River Unit 3 B 3.4-18 Final Draft 10/01/93

RCS Loops-MODE 3 8 3.4.4 BASES APPLICABILITY to be OPERABLE in order to provide redundant heat removal I (continued) capability, but does not have to be in operation. Forced circulation is required in all MODES and is addressed by the following Specifications:

LC0 3.4.5, "RCS Loops-MODE 4";

LCO 3.4.6, "RCS Loops-MODE 5, Loops Filled";

LC0 3.4.7, "RCS Loops-MODE 5, Loops Not Filled";

LC0 3.9.4, " Decay Heat Removal (DHR) and Coolant Circulation-High Water Level" (MODE 6);

and LC0 3.9.5, " Decay Heat Removal (DHR) and Coolant Circulation-Low Water Level" (MODE 6).

Forced circulation is implicitly required in MODES 1 and 2 in order to prevent a Reactor Protection System actuation (Ref. LCO 3.3.1).

ACTIONS The ACTIONS are modified by a Note indicating the provisions of LC0 3.0.4 are not applicable. This allows a MODE change to occur while complying with the Actions of this O Specification.

A_,_1 If one RCS loop is inoperable, redundant forced flow heat removal capability is lost. The RCS loop must be restored to OPERABLE status whin 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Completion Time is a justified period to be without the redundant non-operating loop, and is consistent with allowed outage times for loss of redundancy in other two-train TS systems. Thus, the Completion Time is based on engineering judgment.

ILl If the inoperable RCS loop cannot be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the plant must be placed in MODE 4. '

In MODE 4, additional decay heat removal (DHR) system options are available to satisfy the redundant heat transfer requirements of LC0 3.4.5, "RCS Loops-Mode 4." The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to achieve MODE 4 conditions is reasonable, based on operating experience, to cooldown and (continued)

L CrystC River Unit 3 B 3.4-19 Final Draft 10/01/93

RCS Loops-MODE 3 8 3.4.4

/G BASES U

ACTIONS Ed (continued) depressurize from the existing plant conditions without challenging plant systems. Failure to have redundant heat removal capability necessitates entry into the Required Actions of LCO C.1 and C.2 This Condition is not entered when using the allowance in the Note to the LC0 to de-energize all reactor coolant pumps.

If no RCS loop is OPERABLE or in operation, all operations involving a reduction of RCS boron concentration must be immediately suspended. This is necessary because boron dilution requires forced circulation for proper homogenization. Action to restore one RCS loop to operation shall be immediately initiated and continued until one RCS loop is restored to operation and to OPERABLE status. The immediate Completion Time reflects the importance of maintaining forced reactor coolant circulation for decay heat removal.

SURVEILLANCE SR 3.4.4.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that one RCS loop, with a minimum of one RCP, is in operation.

Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency has been shown by operating practice to be sufficient to regularly assess RCS loop status. In addition, control room indication and alarm:, indicate loop status and will typically alert operations personnel to anomalous flow conditions / loss of flow should this occur.

SR 3.4.4.2 Verification that the required number of RCPs are OPERABLE ensures that redundant heat removal capability is provided (continued)

O Crystal River Unit 3 B 3.4-20 Final Draft 10/01/93

RCS Loops-MODE 3 B 3.4.4 BASES SURVEILLANCE SR 3.4.4.2 (continued)

REQUIREMENTS and that an additional RCS loop can be placed in operation, .

if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying correct breaker alignment and power availability to the required pump that is not in operation. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

REFERENCES None.

t v

Crystal River Unit 3 B 3.4-21 Final Draft 10/01/93 ;

h b

RCS Loops-MODE 4 8 3.4.5 t B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.5 RCS Loops-MODE 4 BASES A

BACKGROUND In MODE 4, the primary function of the reactor coolant is the removal of decay heat and transfer of this heat to the steam generators (OTSGs) or decay heat removal (DHR) heat exchangers. The secondary function of the reactor coolant is to act as a transport medium for soluble neutron poison, boric acid.

In MODE 4, either reactor coolant pumps (RCPs) or DHR pumps can be used for coolant circulation. The number of pumps in operation can vary to suit the operational needs. The intent of this LC0 is to provide forced flow from at least '

one RCP or one DHR pump for decay heat removal and transport. The flow provided by one RCP or one DHR pump is adequate for heat removal . The other intent of this LC0 is to require that two paths (loops) be available to provide redundancy for heat removal.

O APPLICABLE No safety analyses are performed with initial conditions in SAFETY ANALYSES MODE 4. The flow provided by one reactor coolant or one decay heat removal pump is adequate to prevent boron stratification in the vessel core region during a reduction ,

of boron concentration.

RCS loops-MODE 4 satisfies the requirements of NRC Policy Statement. While none of the three criteria directly apply, this Specification assures that reactivity control is -

maintained, thus Criterion 2 is the appropriate criterion, because boron dilution and reactivity control in natural circulation are unanalyzed. Potential reactivity increases would be outside the bounds of the safety analysis. RCS loops-MODE 4 was identified in the NRC Policy Statement as an important contributor to risk reduction.

LC0 The purpose of this LCO is to require that two loops, RCS or DHR, be OPERABLE in MODE 4 and one of these loops be in operation. The LCO allows the two loops that are required to be OPERABLE to consist of any combination of RCS or DHR System loops. Any one loop in operation provides enough (continued)

Crystal River Unit 3 B 3.4-22 Final Draft 10/01/93

l kCS Loops-MODE 4 B 3.4.5 ,

BASES I

LCO flow to remove the decay heat from the core with forced l (continued) circulation. The second loop that is required to be !

OPERABLE provides a redundant path for heat removal. l An OPERABLE RCS loop consists of at least one OPERABLE RCP and a flow path for circulating reactor coolant around the loop. RCPs are OPERABLE if they are capable of being powered and are able to provide flow if required.

Similarly for the DHR System, an OPERABLE DHR loop is comprised of the OPERABLE DHR pump (s) capable of providing forced flow to the DHR heat exchanger (s). DHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required.

The Note permits > 'imited period of operation during which all RCPs may be de-energized for s 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months per 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period for the transition to or from the DHk System. This -

allows the RCPs to be secured prF- to reducing RCS pressure below that needed to place DHP , wrvice. In this pressure range, accelerated RCP seal ation can potentially occur due to inadequate NP w ine Note also permits all DHR and RC pumps to be stopped iar 1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period O for any reason. During this period, natural circulation will provide core decay heat removal. The Note prohibits the reduction of RCS boron concentration when forced flow is stopped because an even concentration distribution cannot be ensured. Core outlet tempercture is to be maintained so as to assure subcooling throughout the RCS so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

APPLICABILITY In MODE 4, the heat generated is lower than at power; therefore, one RCS loop in operation is. adequate for transport and heat removal. A second RCS loop is required to be OPERABLE in order to provide redundant heat removal capability, but does not have to be in operation.

This LC0 allows use of either DHR or RCS loops because it is possible to remove core decay heat and to provide proper boron mixing with either system.

l l

(continued)

I Crystal River Unit 3 B 3.4-23 Final Draft 10/01/93 l i

RCS Loops-MODE 4 B 3.4.5 BASES APPLICABILITY Forced circulation is required in all MODES and is addressed (continued) by the following Specifications:

LC0 3.4.4, "RCS Loops-MODE 3";

LCO 3.4.6, "RCS Loops-MODE 5, Loops Filled";

LC0 3.4.7, "RCS Loops-MODE 5, Loops Not Filled";

LCO 3.9.4, " Decay Heat Removal (DHR) and Coolant Circulation-High Water Level" (MODE 6);

and LC0 3.9.5, " Decay Heat Removal (DHR) and Coolant Circulation-Low Water Level" (MODE 6).

Forced circulation is implicitly required in MODES 1 and 2 '

in order to prevent a Reactor Protection System actuation (Ref. LC0 3.3.1).

ACTIONS Ad If one RCS loop and both DHR loops are inoperable, redundant forced flow heat removal capability is lost. Action must be immediately initiated to restore a second loop to OPERABLE O status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for r

heat removal. In this Condition the OPERABLE RCS loop must be in operation, except as allowed by the Note in the LCO, otherwise Condition C is also applicable.

B.1 and B.2 l If one DHR loop and both RCS loops are inoperable, a second loop must be restored to OPERABLE status to satisfy single failure considerations. Action to restore the loop must be i initiated immediately reflecting the urgency of restoring redundant heat removal capability. One DHR loop is still available for cooldown given the reduced heat loads of this operating MODE.

l If restoration cannot be reasonably accomplished, consideration should be given to placing the plant in MODE 5. Placing the plant in MODE 5 is a conservative action with regard to decay heat removal, but does j necessitate RCS heatup occur to utilize the OTSGs for decay (continued)

Crystal River Unit 3 B 3.4-24 Final Draft 10/01/93 1

RCS Loops-MODE 4 8 3.4.5 BASES ACTIONS B.1 and B.2 (continued) heat removal. With only one DHR loop OPERABLE, redundancy for decay heat removal is lost and, in the event of a loss of the remaining DHR loop, there is more temperature margin to boiling in MODE 5 (s 200*F) than MODE 4 (200*F to 280*F). The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable, based on operating experience, to reach MODE 5 in an orderly manner and without challenging plant systems.

C.1 and C.2 This Condition is not entered when using the allowance in the Note to the LC0 to de-energize all RC and DHR pumps.

If no RCS or DHR loops are OPERABLE or in operation, all operations involving a reduction of RCS boron concentration must be suspended and action to restore one RCS or DHR loop to OPERABLE status and operation must be initiated. Boron dilution requires forced circulation for proper mixing, and the margin to criticality must not be reduced without forced flow. The immediate Completion Times reflect the importance O of maintaining decay heat removal capability and forced circulation. The action to restore a loop to OPERABLE status must continue until one loop is restored to operation.

SURVEILLANCE SR 3.4.5.1 REQUIREMENTS This Surveillance requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that one DHR or RCS loop, with a minimum of one pump, is in ;

operation to ensure forced flow is providing decay heat '

removal. Verification includes flow rate, temperature, or pump status monitoring. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency has been shown by operating practice to be sufficient to regularly assess operating loop status. In addition, control room indication and alarms indicate loop status and will typically alert operations personnel to anomalous flow / loss of flow, should this occur.

(continued)

Crystal River Unit 3 B 3.4-25 Final Draft 10/01/93

-- -- y.

RCS Loops-MODE 4 B 3.4.5 BASES SURVEILLANCE SR 3.4.5.2 REQUIREMENTS (continued) Verification that the required pump that is not in operation is OPERABLE ensures that an additional RCS or DHR loop can be placed in operation if needed to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying correct breaker alignment and power available to the required pumps. The Frequency of 7 days is considered reasonable in view of other administrative controls and has been shown to be acceptable by operating experience.

REFERENCES None.

O O

Crystal River Unit 3 B 3.4-26 Final Draft 10/01/93

RCS Loops-MODE 5, Loops Filled B 3.4.6 ,

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.6 RCS Loops-MODE 5, Loops Filled BASES BACKGROUND In MODE 5 with RCS loops filled, the primary function of the reactor coolant is the removal of decay heat and transfer of this heat to the steam generators (OTSGs) or decay heat removal (DHR) heat exchangers. While the principal means for decay heat removal is via the DHR System, the OTSGs are an acceptable backup means. Although the OTSGs cannot remove heat unless steaming occurs (which is not possible in MODE 5), they are available as a temporary heat sink and can be used by allowing the RCS to heat up into the temperature region of MODE 4 where steaming can be effective for heat removal. The secondary function of the reactor coolant is to act as a transfer medium for the soluble neutron poison, boric acid.

In MODE 5, DHR loops are the preferred means for heat removal. The number of loops in operation can vary to suit the operational needs. The intent of this LC0 is to provide forced flow from at least one DHR loop for decay heat !

O removal and coolant circulation. The flow provided by one DHR loop is adequate for these purposes. The other purpose of this LC0 is to require that a second path be available to provide redundant heat removal capability.

The LC0 provides for either OTSG heat removal or DHR System heat removal as an acceptable backup to the loop in operation. In MODE 5, reactor coolant pump (RCP) operation is restricted because of net positive suction head (NPSH) limitations, and the OTSG will not be able to provide steam for the turbine driven feedwater pumps. Therefore, in order to ensure that a OTSG can be used as a heat sink, a motor driven feed source is needed. A main feedwater booster pump, the auxiliary feedwater pump (FWP-7), or motor driven emergency feedwater pump can be used. Additionally, steam-driven feedwater pumps, with auxiliary steam from Units 1 and 2, are also viable feed sources. The high entry point in the generator should be accessible from the feedwater pumps so that natural circulation can be stimulated.

Additionally, the capability to steam the OTSG, either through the atmospheric dump valves or turbine bypass valves (if the condenser is available) must be available. The OTSGs are primarily a backup to the DHR pumps, which are (continued)

Crystal River Unit 3 B 3.4-27 Final Draft 10/01/93

\

l

l RCS Loops-MODE 5, Loops Filled-

=B 3.4.6

[3 x)

BASES BACKGROUND used for forced flow. When relying upon the OTSGs to be a (continued) backup heat removal path, the option .to increase RCS pressure and temperature for heat removal in MODE 4 is provided.

i APPLICABLE No safety analyses are performed with initial conditions in SAFETY ANALYSES MODE 5. The flow provided by one decay heat removal pump is adequate to prevent boron stratification in the vessel core region during a reduction of boron concentration.

RCS loops-MODE 5 (loops filled) were identified in the NRC Policy Statement as important contributors to risk

. reduction.

LC0 The purpose of this LC0 is to require that at least one of the DHR loops be OPERABLE and in operation. The LCO also requires an additional DHR loop or OTSG to be OPERABLE. One DHR loop provides sufficient forced circulation to perform heat removal and boron mixing functions under these conditions. The second DHR loop is maintained as a backup to the operating DHR loop to provide redundant decay heat removal capability. If the standby DHR loop is not OPERABLE, a sufficient alternate method of providing ,

redundant heat removal paths is to provide an OPERABLE OTSG.

To be considered OPERABLE, the capability to feed and steam the generator through the high nozzles must exist or the secondary side water level must be maintained ;t 95%

(Ref. 1). Should the operating DHR loop fail, the OTSGs can be used to remove the decay heat.

In MODE 5, it is sometimes necessary to stop all RCP or DHR pump forced circulation. Examples of this include swapping from one DHR train to the other, performing surveillance or startup testing, performing the transition to and from the DHR System, or to avoid operation below the RCP minimum NPSH limit.

Note 1 permits the DHR pumps to be stopped for up to I hour

per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period for any reason. Sound operating principles dictate that the circumstances for stopping both DHR trains should be limited to situations where:

(a) Pressure and temperature increases can be maintained (continued)

O Crystal River Unit 3 8 3.4-28 Final Draft 10/01/93

RC5 Loops-MODE 5, Loops Filled B 3.4.6 BASES LC0 well within the allowable pressure and subcooling limits; (continued) or (b) Alternate heat removal paths through an OTSG is in operation. The Note prohibits boron dilution when DHR ,

forced flow is stopped because an even concentration ;

distribution cannot be ensured. Core outlet temperature is to be maintained so as to assure subcooling throughout the RCS so that no vapor bubble would form and possibly cause a natural circulation flow obstruction. In this MODE, the OTSG is a backup for decay heat removal and, the RCS must be maintained subcooled to ensure its availability.

Note 2 allows one DHR loop to be inoperable for a period of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided that the other loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on a DHR loop during the optimum plant ,

conditions.

The time periods for each of these allowances is acceptable because natural circulation is adequate for heat removal, the reactor coolant temperature can be maintained subcooled, and baron stratification affecting reactivity control is not expected. 1 Note 3 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting removal of DHR -

loops from operation provided at least one RCP is in operation. This Note provides for the transition to MODE 4 recognizing an RCS loop is permitted to be in operation and replaces the heat removal function provided by the DHR loops.

An OPERABLE DHR loop is composed of an OPERABLE DHR pump, OPERABLE DHR heat exchanger, and associated flowpath. DHR pumps are OPERABLE if they are-capable of being powered and are able to provide flow if required. An OTSG can perform as a heat sink when it has an adequate water level and an ,

available feed source.

APPLICABILITY In MODE 5, the heat generated is lower than at power; therefore, one RCS loop in operation is adequate for transport and heat removal . A second RCS loop is required to be OPERABLE in order to provide redundant heat removal capability, but does not have to be in operation.

(continued)

Crystal River Unit 3 B 3.4-29 Final Draft 10/01/93

RCS Loops-MODE 5, Loops Filled B 3.4.6 O)

L BASES APPLICABILITY In MODE 5 with loops filled, forced circulation is provided (continued) by this LCO to remove decay heat from the core and to provide proper boron mixing. One loop of DHR provides sufficient circulation for these purposes. With the loops ,

filled, the second DHR loop or an OTSG is a viable heat removal option.

Forced circulation is required in all MODES and is addressed by the following Specifications:

LC0 3.4.4, "RCS Loops-MODE 3";

LC0 3.4.5, "RCS Loops-MODE 4";

LCO 3.4.7, "RCS Loops-MODE 5, Loops Not Filled";

LCO 3.9.4, " Decay Heat Removal (DHR) and Coolant ;

Circulation-High Water Level" (MODE 6); ,

and LC0 3.9.5, " Decay Heat Removal (DHR) and Coolant Circulation-Low Water Level" (MODE 6).

Forced circulation is implicitly required in MODES I and 2 in order to prevent a Reactor Protection System actuation (Ref. LC0 3.3.1).

/N O

ACTIONS A.1 and A.2 If one DHR loop is inoperable and neither OTSG is OPERABLE, redundant heat removal capability is lost. Action must be initiated to restore a second DHR loop or OTSG to OPERABLE status. Either Required Action A.1 or Required Action A.2 will restore redundant decay heat removal paths. The immediate Completion Time reflects the importance of :

maintaining the availability of two heat removal paths.

B.1 and B.2 This Condition is not entered when using the allowance in the Note to th'e LC0 to de-energize all DHR pumps.

If no DHR loop is OPERABLE or in operation, all operations involving the reduction of RCS boron concentration must be suspended and action to restore a DHR loop to OPERABLE status and operation must be initiated immediately. Boron dilution requires forced circulation for proper mixing, and (continued)

Crystal River Unit 3 8 3.4-30 Final Draft 10/01/93

RCS Loops-MODE 5, Loops Filled B 3.4.6 BASES ACTIONS B.1 and B.2 (continued) the margin to criticality must not be reduced in this type t of operation. The immediate Completion Time reflects the importance of maintaining operation for decay heat removal. ,

SURVEILLANCE SR 3.4.6.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that one DHR loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, and ensures that forced flow is providing heat removal. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency has been shown by operating practice to be sufficient to regularly assess degradation. In addition, control room indication and alarms indicate loop status and will typically alert operations personnel to anomalous flow / loss of flow should this occur.

SR 3,4.6.2 Verifying an OTSG is OPERABLE ensures that redundant heat removal paths are available if the second DHR loop is not OPERABLE. This SR is accomplished by verifying the capability of the OTSG to act as a viable decay heat sink.

This requires the flow paths for feeding the OTSG through the high nozzles and steaming the generator are aligned. A minimal level is recommended but is not required in this condition. Conversely, a secondary side water level of 95%

and the capability to feed via the low (MFW) nozzles will

ensure adequate decay heat removal and natural circulation.

The 7 day Frequency has been shown by operating practice to be sufficient to regularly assess degradation. If both DHR loops are OPERABLE, this Surveillance is not required.

However, either SR 3.4.6.2 or SR 3.4.6.3 must be performed within the specified Frequency in order to verify availability /0PERABILITY of the back-up heat removal path.

SR 3.4.6.3 Verification that the second DHR pump is OPERABLE ensures that redundant paths for heat removal are available. The requirement also ensures that the additional loop can be (continued)

Crystal River Unit 3 B 3.4-31 Final Draft 10/01/93

RCS Loops--MODE 5, Loops Filled i B 3.4.6 j

() BASES SURVEILLANCE SR 3.4.6.3 (continued)

REQUIREMENTS placed in operation if needed to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying correct breaker alignment and power available to the required pumps. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience. If an OTSG is OPERABLE, this Surveillance is not required. However, either SR 3.4.6.2 or SR 3.4.6.3 must be performed within the specified Frequency to verify availability /0PERABILITY of the back-up heat removal path.

REFERENCES 1. B&W Document 51-1223370-01, " Minimum OTSG Level for Natural Circulation."

1 O i I

l l

O Crystal River Unit 3 8 3.4-32 Final Draft 10/01/93 l

)

RCS Loops-MODE 5, Loops Not Filled B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.7 RCS Loops-MODE 5, Loops Not Filled BASES BACKGROUND In MODE 5 with loops not filled, the primary function of the reactor coolant is the removal of decay heat and transfer of this heat to the decay heat removal (DHR) heat exchangers.

The steam generators (OTSGs) are not available as a heat sink when the loops are not filled. The secondary function of the reactor coolant is to act as a transport medium for the soluble neutron poison, boric acid.

The RCS Loops are considered not filled when reactor coolant water level is drained down as might be the case for refueling or maintenance on the Reactor Coolant System.

Reductions in RCS inventory (<132 ft) are termed reduced reactor vessel inventory operations and result in additional concerns. NRC Generic Letter 88-17 (Ref. 1) described several loss of decay heat removal events initiated from !

these operating conditions, emphasizing the potential for core damage under the following scenario. With water at this low level, the margin above the decay heat suction O piping connection to the hot leg is small. The possibility of loss of level or inlet vortexing exists such that the operating DHR pump could become air bound and fail resulting in a loss of forced flow for heat removal. As a consequence the water in the core will heat up and could boil with the possibility of the core uncovering due to boil off. Because containment OPERABILITY and containment closure are not required at this time, a fission product release pathway to the environment exists if core damage were to occur.

In MODE 5 with the loops not filled, only DHR pumps can be used for coolant circulation. The number of pumps in operation can vary to suit the operational needs, but at least one DHR pump is required to be in operation for decay heat removal and circulation. Requiring two loops to be OPERABLE ensures redundancy for heat removal.

APPLICABLE No safety analyses are performed with initial conditions in SAFETY ANALYSES MODE 5 with loops not filled. The flow provided by one DHR pump is adequate for heat removal and for boron mixing. l (continued)

Crystal River Unit 3 B 3.4-33 Final Draft 10/01/93

1 RCS Loops-MODE 5, Loops Not Filled l B 3.4.7 BASES i

APPLICABLE RCS loops-MODE 5 (loops not filled) was identified in the l SAFETY ANALYSIS NRC Policy Statemtnt as important contributors to risk (continued) reduction.

LC0 This LC0 ensures redundant heat removal capability and forced coolant circulation by requiring two DHR loops to be OPERABLE and that one of these loops be in operation. An OPERABLE DHR loop is composed of an OPERABLE DHR pump capable of providing forced flow to an OPERABLE DHR heat exchanger. DHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. A minimum of one running decay heat removal pump meets the LC0 requirement for one loop in operation. An additional DHR loop is required to be OPERABLE to provide redundancy for heat removal.

Note 1 permits the DHR pumps to be de-energized for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ' per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. Sound operating principles dictate that the circumstances for stopping both DHR pumps be limited to situations where the outage time is short and core outlet s temperature can be maintained so as to assure subcooling

,] throughout the RCS. The Note also prohibits boron dilution or draining operations when DHR forced flow is stopped.

Note 2 allows one DHR loop to be inoperable for a period of '

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided that the other loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the loop during the optimum plant condition.

. e APPLICABILITY In MODE 5 with loops not filled, this LC0 requires redundant core heat removal capability and forced coolant circulation.

Due to the equipment availability in these plant cor.ditions, two DHR loops are specified.

Forced circulation is required in all MODES and is addressed by the following Specifications: '

LC0 3.4.<, "RCS Loops-MODE 3";

LC0 3.4.5, "RCS Loops-MODE 4";

LCO 3.4.6, "RCS Loops-MODE 5, Loops Filled";

LC0 3.9.4, " Decay Heat Removal (DHR) and Coolant (continued)

Crystal River Unit 3 B 3.4-34 Final Draft 10/01/93

RCS Loops-MODE 5, Loops Not Filled B 3.4.7 BASES APPLICABILITY Circulation-High Water Level" (h30E 6);

(continued) and LCO 3.9.5, " Decay Heat Removal (DHR) and Coolant Circulation-Low Water Level" (MODE 6).

Forced circulation is implicitly required in MODES I and 2 in order to prevent a Reactor Protection System actuation (Ref. LC0 3.3.1). .

ACTIONS Ad If one or more DHR loops are inoperable, adequate heat removal capability is lost. Action must be initiated immediately to restore the inoperable DHR loop (s) to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two heat removal paths.

B.1 and B.2 This Condition is not entered when using the allowance in the Note to the LC0 to de-energize all DHR pumps.

If no DHR loop is not in operation, the Required Actions require immediate suspension of all operations involving a reduction in RCS boron concentration and initiation of action to restore one DHR loop to operation. The immediate Completion Time reflects the importance of maintaining -

operations for decay heat removal. The action to restore must continue until one loop is restored.

SURVEILLANCE SR 3.4.7.1 REQUIREMENTS Thi, Surveillance requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that at least one loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal. T? e 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency has been shown by operating practice to be sufficient to regularly assess degradation. In addition, control room indication and alarms indicate loop status and (continued)

Crystal River Unit 3 8 3.4-35 Final Draft 10/01/93

24 RCS Loops-MODE 5, Loops _ Not Filled B 3.4.7 BASES SURVEILLANCE SR 3.4.7.1 (continued)

REQUIREMENTS will typically alert the operator to anomalous flow / loss of flow should this occur.

SR 3.4.7.2 ,

Verification that the second DHR pump is 00ERABLE ensures that redundant heat removal capability is provided. The-requirement ensures that an additional loop can be placed in operation if needed to maintain decay heat removal.and reactor coolant circulation. Verification is performed by verifying correct breaker alignment and power is available ,

to the required pumps. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

REFERENCES 1. NRC Generic Letter 88-17, October 1988.

O I

O Crystal River Unit 3 8 3.4-36 Final Draft 10/01/93

J Pressurizer B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.8 Pressurizer BASES BACKGROUND The pressurizer maintains primary system pressure during steady state operation and limits the pressure changes caused by reactor coolant thermal expansion and contraction during normal load transients.

The design features of the pressurizer addressed by this LC0 include pressurizer water level and required post-accident heater capability. Other RCS components associated with the pressurizer are addressed elsewhere in the Technical ,

Specifications. Pressurizer safety valves and the power operated relief valve (PORV) are addressed by LCO 3.4.9,

" Pressurizer Safety Valves," and LC0 3.4.10, " Pressurizer Power Operated Relief Valve (PORV)," respectively.

The maximum water level limit permits pressure control equipment to function as designed. The limit preserves the steam space during normal operation, thus both sprays and heaters can operate to maintain the design operating O pressure. The level limit also prevents filling the pressurizer (water solid) for anticipated design basis transients, thus ensuring that pressure relief devices (PORV or code safety valves) can control pressure by steam relief rather than water relief. If the level limits were exceeded prior to a transient that creates a large pressurizer insurge volume leading to water relief, the maximum RCS pressure might exceed the Safety Limit of 2750 psig (SL 2.1.2) or damage may occur to the PORV or pressurizer code safety valves.

The pressurizer heaters are used to maintain pressure in the RCS so reactor coolant in the loops is subcooled and thus in the preferred state for heat transport to the steam generators (OTSGs). In accordance with NUREG 0578 (Ref. 1),

this function must be initiated within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following loss of offsite power. Consequently, the emphasis of this LC0 is to ensure that the essential power supplies and the associated heater capability is adequate to maintain pressure for RCS loop subcooling with an extended loss of offsite power.

1 I

(continued)

Crystal River Unit 3 B 3.4-37 Final Draft 10/01/93

Pressurizer B 3.4.8 O

V BASES BACKGROUND A minimum required available capacity of 252 kW is based on (continued) total heat loss through the pressurizer insulation and ensures that the RCS can be maintained at hot standby conditions. Inability to control the system pressure and maintain subcooling under conditions of natural circulation flow in the primary system could lead to loss of single phase natural circulation and decreased capability to remove core decay heat.

The 252 kW value is based, in part, on CR-3 pre-operational test data of measured pressurizer heat losses with the RCS at hot standby conditions, a subsequent performance test to validate heat losses, plus some margin for heater and insulation degradation over time. The 252 kW was also selected based upon the grouping of the heaters (126 kW of heater capacity is assigned to each group).

Pressurizer heater power supply design provides the capability to supply, from either the offsite power source +

or the emergency power source (when offsite power is not available), sufficient heater capacity and associated controls. The minimum heater capacity and associated controls are connected to the emergency buses in a manner to O provide redundant power supply capability.

APPLICABLE In MODES I and 2, the LC0 requirement for a steam te le is SAFETY ANALYSES reflected implicitly in the accident analyses. All analyses performed from a critical reactor condition assume the existence of a steam bubble and saturated conditions in the pressurizer, in making this assumption, the analyses neglect the small fraction of noncondensible gases normally present.

Safety analyses presented in the FSAR do not take credit for pressurizer heater operation, however, an implicit initial condition assumption of the safety analyses is that the RCS .

is operating at normal pressure.

Conservative safety analyses assumptions for the loss of main feedwater (LMFW) event indicate that it produces the largest increase of pressurizer level of any moderate ;

frequency event. Thus, this event has been selected to

^

establish the pressurizer water level upper limit. Assuming proper emergency system response, the level limit prevents !

(continued) !

Crystal River Unit 3 8 3.4-38 Final Draft 10/01/93 I

Pressurizer l B 3.4.8 !

1 BASES l

APPLICABLE water relief through the pressurizer safety valves. Since SAFETY ANALYSIS prevention of water relief is a goal for abnormal transient ;

(continued) operation, rather than an acceptance criteria, the value for pressurizer level is nominal and is not adjusted for instrument error. The analysis performed to substantiate the 290" as the upper limit (Ref. 3) assumed the reactor tripped on high RCS pressure (consistent with historical assumptions for this event). Had the anticipatory reactor trip (ART) on loss of both feedwater pumps been modeled, the ,

reactor would have tripped much sooner in the event, terminating the nuclear chain reaction sooner, thereby limiting RCS heatup (and insurge). Thus, there is a margin in the analysis to substantiate the use of the nominal value as an acceptance criteria.

Evaluations performed for the design basis large break loss of coolant accident (LOCA), also assume the maximum level assumed for the LMFW event. The pressurizer level assumed for the LOCA is the partial basis for the volume of reactor coolant released to the containment following the accident.

The containment analysis performed using the mass and energy release demonstrated that the maximum resulting containment

/ pressure was within design limits. Parametric evaluations of this analysis indicate the sensitivity to pressurizer volume is small.

The requirement for emergency power supplies is based on NUREG-0737 (Ref. 2). The intent is to allow maintaining the reactor coolant in a subcooled condition with natural circulation at hot, high pressure conditions for an undefined, but extended, time period after a loss of offsite power. While loss of offsite power is an initial condition or coincident event assumed in many accident analyses, ,

maintaining hot, high pressure conditions over an extended >

time period is not evaluated as part of FSAR accident analyses.

The maximum pressurizer water level limit satisfies Criterion 2 of the NRC Policy Statement. Although the ,

heaters are not specifically used in accident analysis, the need to maintain subcooling in the long term during loss of :

offsite power, as indicated in NUREG-0737 (Ref. 2), is the '

reason for providing a limit on this feature.

5 (continued)

Crystal River Unit 3 B 3.4-39 Final Draft 10/01/93 l

Pressurizer B 3.4.8 BASES (continued)

LC0 For the pressurizer to be OPERABLE, water level must be maintained s 290 inches and a minimum of 252 kW of pressurizer heaters are to be capable of being powered from each emergency power supply. Limiting the maximum operating water level preserves the steam space for pressure control and ensures the capability tr, establish and maintain pressure control for steadv state operation and to minimize ,

the consequences of potential overpressure transients.

The minimum heater capacity required is sufficient to maintain the system near normal operating pressure when accounting for heat losses through the pressurizer insulation. By maintaining the pressure near the operating conditions, a wide margin to subcooling can be obtained in the loops.

APPLICABILITY The need for pressure control is most pertinent when core heat can cause the greatest effect on RCS temperature, resulting in the greatest effect on pressurizer level and RCS pressure control. Thus, the Applicability has been designated for MODES 1 and 2. For additional conservatism,

( the Applicability is also extended down to include MODE 3.

In MODES 1, 2, and 3, there is the need to maintain the availability of pressurizer heaters capable of being powered from an emergency power supply. In the event of a loss of offsite power, the initial conditions of these MODES give the greatest demand for maintaining the RCS in a hot pressurized condition with loop subcooling for an extended period. For MODE 4, 5, or 6, it is not necessary to control pressure (by heaters) to ensure loop subcooling for heat transfer when the Decay Heat Removal System is in service. Therefore the LC0 is not applicable in the MODES.

ACTIONS A,1 With pressurizer water level in excess of the maximum limit, action must be taken to restore pressurizer level to within the bounds assumed in the analysis. The I hour Completion Time is considered reasonable for adjusting makeup and letdown or taking level control to hand and decreasing level to within limit.

(continued)

Crystal River Unit 3 B 3.4-40 Final Draft 10/01/93 !

1 l

Pressurizer B 3.4.8 l l

BASES I ACTIONS 8.1 (continued)

If there is s 252 kW of heaters capable of being powered from either emergency power supply, restoration is required in 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is reasonable considering the low probability of a loss of offsite power '

during this period. Pressure control will be maintained during this time using normal non-lE powered heaters.

C.1 and C.2 If pressurizer heater capability or water level cannot be restored within the allowed Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Times are reasonable, based on operating experience,'to reach the specified MODES from full power conditions in an orderly manner and without challenging plant systems.

In the case of water level, reducing THERMAL POWER and RCS O Tave will tend to restore level and also reduce the thermal energy of the reactor coolant mass for potential LOCA mass and energy releases.

SURVEILLANCE SR 3.4.8.1 REQUIREMENTS This SR requires that pressurizer water level be monitored every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months in order to verify operation is maintained below the nominal upper limit. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency has been shown by operating experience to be sufficient to regularly assess the level for deviations and trends, and verify that operation is within safety analyses assumptions.

Alarms are also available for early detection of abnormal level indications. ,

(continued)

Crystal River Unit 3 8 3.4-41 Final Draft 10/01/93

Pressurizer B 3.4.8 BASES :

SURVEILLANCE SR 3.4.8.2 REQUIREMENTS (continued) This SR verifies minimum redundant pressurizer heater capacity is capable of being powered from its associated emergency power supply. (This may be done by testing the power supply output and by performing an electrical check on heater element continuity and resistance.) The Frequency of 24 months is considered adequate to detect heater degradation and has been shown by operating experience to be acceptable.

REFERENCES 1. NUREG-0578, July 1979, "THI-2 Lessons Learned Task Force Status Report and Short Term Recommendations."

2. NUREG 0737, " Clarification of THI Action Plan Requirements", November, 1980.

3. B&W Topical Report 51-1200406-00, January 1991.

O -

O Crystal River Unit 3 B 3.4-42 Final Draft 10/01/93 l

Pressurizer Safety Valves B 3.4.9 8 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.9 Pressurizer Safety Valves BASES BACKGROUND The purpose of the two spring loaded pressurizer safety valves is to provide RCS overpressure protection. Operating in conjunction with the Reactor Protection System (RPS), two valves are used to ensure that the Safety Limit (SL) of 2750 psig is not exceeded for analyzed transients during operation in MODES 1, 2, and 3. For MODE 4, MODE 5, and MODE 6 with the reactor head not completely detensioned, overpressure protection is provided by operating procedures and Low Temperature Overpressure Protection (LTOP) administrative controls. For these conditions, the American Society of Mechanical Engineers (ASME) requirements are satisfied with one safety valve.

The self actuated pressurizer safety valves are designed in accordance with the requirements set forth in the ASME Boiler and Pressure Vessel Code,Section III (Ref. 1). The required lift pressure is 2500 psig i 2%. The safety valves discharge steam from the pressurizer to the reactor coolant O drain tank (RCDT) located in the containment. The discharge flow is indicated by acoustic monitor.s downstream of the safety valves and by an increase in RCDT pressure and level.

The upper and lower pressure limits were originally based on the i 1% tolerance requirement for lifting pressures above 1000 psig. However, later versions of the ASME Code allow for tolerances of up to 3%, and the use of 2% was justified in Reference 2. The lift setting is for the ambient conditions associated with MODES 1, 2, and 3. This requires either that the valves be set hot or that a correlation between hot and cold settings be established. l The pressurizer safety valves are part of the primary success path and mitigate the effects of postulated 1 accidents. OPERABILITY of the safety valves ensures that i the RCS pressure will be limited to le'ss than 110% of design ;

pressure. l l

(continued)

Crystal River Unit 3 8 3.4-43 Final Draft 10/01/93 i

Pressurizer Safety Valves B 3.4.9 BASES (continued)

APPLICABLE All accident analyses in the FSAR that require safety valve SAFETY ANALYSES actuation assume operation of both pressurizer safety valves to limit increasing reactor coolant pressure. The overpressure protection analysis (Ref. 3) is also based on operation of both safety valves and assumes that the valves open at the high range of the setting (2500 psig system design pressure plus 2%). These valves must accommodate pressurizer insurges that could occur during a startup, rod withdrawal, ejected rod, loss of main feedwater, or main feedwater line break accident. The startup accident establishes the limiting design basis safety valve capacity.

The startup accident is assumed to occur at < 15% power and both values are assumed to lift to relieve RCS pressure.

Single failure of a safety valve is neither assumed in the accident analysis nor required to be addressed by the ASME Code. Compliance with this Specification is required to ensure that the accident analysis and design basis calculations remain valid.

Pressurizer safety valves satisfy Criterion 2 of the NRC Policy Statement.

O LC0 The two pressurizer safety valves are set to open at the RCS design pressure (2500 psig) and within the ASME specified tolerance to avoid exceeding the maximum RCS design pressure SL, to maintain accident analysis assumptions and to comply with ASME Code requirements. The upper and lower pressure tolerance iimi d are based on a i 2% tolerance. The limit protectea by this Soecification is the reactor coolant pressurt SL of 110% of design pressure. Inoperability of one or both valves could result in exceeding the SL if a transient were to eccur.

The consequences of exceeding the ASME pressure limit could include damage to one or more RCS components, increased leakage, or additional stress analysis being required prior to resumption of reactor operation.

1 APPLICABILITY In MODES 1, 2, and 3, OPERABILITY of two valves is required i because the combined capacity is necessary to maintain O (continued)

Crystal River Unit 3 B 3.4-44 Final Draft 10/01/93 J I

Pressurizer Safety Valves B 3.4.9 BASES APPLICABILITY reactor coolant pressure less than 110% of its design value (continued) during certain accidents.

The LCO is not applicable in MODES 4 and 5 because LTOP administrative controls provide overpressure protection.

Overpressure protection is not required in MODE 6 with the reactor vessel head detensioned.

ACTIONS A.1 With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS overpressure protection system. An inoperable safety valve ,

coincident with a design basis overpressure event could challenge the integrity of the RCS, B.1 and B.2 If the Required Action cannot be met within the associated O Completion Time or if both pressurizer safety valves are inoperable, the plant must be placed in a MODE in which the requirement does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The specified Completion Times are reasonable, based on operating experience, to reach the required MODES from full power conditions in an orderly manner and without challenging plant systems. In MODE 4 and below, overpressure protection is provided by LTOP. Placing the plant in a lower MODE (3 and 4) reduces the RCS energy (thermal and pressure), lowers the potential for large pressurizer insurges, and thereby removes the need for overpressure protection by two pressurizer safety valves.

SURVLiLLANCE SR 3.4.9.1 oEQUIREMENTS The requirement to verify lift setpoint 2 2450 psig and 12550 psig is implemented in the Inservice Testing Program.

(continued)

Crystal River Unit 3 B 3.4-45 Final Draft 10/01/93

Pressur_izer Safety Valves B 3.4.9 BASES SURVEILLANCE SR 3.4.9.1 (continued)

REQUIREMENTS .

To meet the Code requirements, CR-3 typically removes the valves and ships them to the vendor to be bench tested.

Alternately, the valves may be tested in-place. If tested in-place, pressurizer safety valves are to be tested one at ;

a time and in accordance with the requirements of Section XI of the ASME Code (Ref. 4), which provides the activities and the Frequency necessary to satisfy the SRs. No additional-requirements are specified.

The pressurizer safety valve setpoint is i 2% for OPERABILITY; however, valves removed for testing or maintenance are required to be reset to i 1% as part of the Surveillance to allow for drift.

The Note allows entry into MODE 3 with the lift settings outside the SR limits. This permits testing and examination of the safety valves at pressures and temperatures near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design condition. Only one valve at a time will be removed from O, service for testing. The 36 hour4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months exception is based on an 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months outage time for each valve. The 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months period is derived from operating experience that hot testing can be performed in this timeframe. As mentioned earlier, this allowance is not utilized at the present time since current practice is to remove the valves and send them to the vendor ,

for testing and lift setting adjustment. l REFERENCES 1. ASME, Boiler and Pressure Vessel Code,Section III. 3 l

2. B&W Report 85-1200382-00, November 1990.

3. B&W Topical Report BAW-10043, " Overpressure Protection for B&W's Pres.Jrized Water Reactors." ;

1

4. ASME, Boiler and Pressure Vessel Code,Section XI.

1 i

O Crystal River Unit 3 B 3.4-46 Final Draft 10/01/93 l

E Pressurizer-PORV B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.10 Pressurizer Power Operated Relief Valve (PORV)

BASES BACKGROUND The PORV is an electromagnetic pilot operated valve that is automatically opened when RCS pressure increases to a specific set pressure and is automatically closed on decreasing pressure. The PORV may also be manually cycled from the control room.

An electric motor-operated, normally open, block valve is installed between the pressurizer and the PORV. The function of the block valve is to provide the capability to isolate the PORV. Block valve closure is accomplished manually using controls in the control room and may be used to isolate an inoperable or leaking PORV to permit continued ,

power operation. Most importantly, the block valve is used to isolate a stuck open PORV to isolate the resulting small break loss of coolant accident (LOCA). Closure terminates the RCS depressurization and coolant inventory loss.

The PORV, its block valve, and their controls are powered O from normal power supplies but are also capable of being powered from emergency supplies. Power supplies for the PORV are separate from those for the block valve. Power supply requirements are defined in NUREG-0737 Paragraph III, G.1 (Ref. 1).

The PORV setpoint is above the high pres & e reactor trip setpoint and below the opening setpoint for the pressurizer ,

safety valve as required by IE Bulletin 79-05B (Ref. 2).

The purpose of the relationship of these setpoints is to limit the number of transient pressure increase challenges that might open the PORV, which, if opened, could fail in

. the open position. A pressure increase transient would cause a reactor trip, reducing core energy, and for many expected transients, prevent the pressure increase from reaching the PORV setpoint. The PORV setpoint thus limits the frequency of challenges from transients and limits the possibility of a small break LOCA from a failed open PORV.

l 1

(continued)

Crystal River Unit 3 8 3.4-47 Final Draft 10/01/93

Pressurizer PORV I B 3.4.10 l l

BASES BACKGROUND Placing the high setpoint below the pressurizer safety valve (continued) opening setpoint reduces the frequency of challenges to the I safety valves, which, unlike the PORV, cannot be isolated if they were to fail open. The high PORV setpoint is therefore i important for limiting the possibility of a small break i LOCA. However, the setpoint is not included within the scope of this Specification.

The following functions can be accomplished by the PORV, but are not assumed in the CR-3 accident analysis and therefore, are not included within the scope of Technical Specifications.

The PORV may be manually operated to depressurize the RCS as deemed necessary by the operator in response to normal or <

abnormal transients. The PORV may be used for depressurization when the pressurizer spray is not available; a condition that would be encountered during loss of offsite power. Steam generator tube rupture (SGTR) is one event that may require use of the PORV if the sprays are unavailable. The PORV may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total O loss of feedwater. The PORV functions as an automatic overpressure device and limits challenges to the safety valves. Although the PORV acts as an overpressure device for operational purposes, safety analyses do not take credit for PORV actuation, but do take credit for the safety valves.

APPLICABLE The PORV small break LOCA is not a design basis event for SAFETY ANALYSIS CR-3. However, a small break LOCA corresponding to a stuck-open PORV is bounded by the spectrum of piping breaks analyzed for plant licensing. Because the PORV small break LOCA is located at the top of the pressurizer, the RCS response characteristics are different from RCS loop piping breaks and analyses have been performed to investigate these characteristics.

The PORV and its block vali'e do not satisfy any specific Criterion of the NRC Policy Statement. This Specification was evaluated using insight: gained from reviewing (continued)

Crystal River Unit 3 8 3.4-48 Final Draft 10/01/93

)

Pressurizer PORV B 3.4.10 BASES APPLICABLE representative probabilistic risk assessments. The PORV and SAFETY ANALYSIS its block valve are deemed important to risk; specifically (continued) the ability to isolate the flowpath to mitigate a stuck-open PORV.

LCO The LC0 requires the PORV and its associated block valve to be OPERABLE. The block valve is required to be OPERABLE so it may be used to isolate the flow path if the PORV is not 4 OPERABLE. If the block valve is not OPERABLE, the PORV may be used for isolation.

The primary purpose of this LC0 is to ensure that the PORV and the block valve are operating correctly so the potential for a small break LOCA through the PORV pathway is minimized, or if a small break LOCA were to occur through a failed open PORV, the block valve could be closed to isolate the flow path.

APPLICABILITY In MODES 1, 2, and 3, the PORV and its block valve are O required to be OPERABLE to limit the potential for a small break LOCA through the flow path. The most likely scenario for a PORV LOCA is a pressure increase transient that causes the PORV to open followed by its failure to re-seat.

Pressure increase transients can occur any time the steam generators are used for heat removal. The most rapid increases will occur at higher operating power and pressure conditions of MODES 1 and 2. Pressure increases are less prominent in MODE 3 because the core input energy is reduced, but the RCS pressure is still potentially elevated.

The LC0 is not applicable in the lower MODES when both pressure and core energy are decreased and the potential pressure surges become much less significant.

1 i

(continued)

Crystal River Unit 3 B 3.4-49 Final Draft 10/01/93 1

l l

Pressurizer PORV B 3.4.10 BASES (continued)

ACTIONS A.1 and A.2 With the PORV inoperable, the PORV must be restored or the flow path isolated within I hour. The block valve should be closed and power must be removed from the block valve to eliminate the potential for inadvertent PORV opening and depressurization.

B.1.1. B.I.2. B.2.1. and B.2.2 If the block valve is inoperable, it must be restored to OPERABLE status or the flowpath isolated within I hour The prime importance for the capability to close the block valve is to isolate a stuck open PORV. Therefore, if the block-valve cannot be restored to OPERABLE status, the Required Action is'to close the block valve and remove power or close the PORV and remove power to its associated solenoid valve.

Either of the two Required Actions will render the PORV isolated. The I hour Completion Times are consistent with an allowance of some time for correcting minor problems, restoring the valve to operation, and establishing correct valve positions and restricting the time without adequate O protection against RCS depressurization.

C.1 and C.2 If the Required Action and associated Completion Time cannot be met, the plant must be placed in MODE in which the requirement does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Completion Times are reasonable, based on operating experience, to reach the specified MODES and conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.10.1 REQUIREMENTS Block valve cycling verifies that it can be closed if needed. The Frequency of 92 days is based on ASME Code,Section XI (Ref. 3) requirements. Block valve cycling, as stated in the Note, is not required to be performed when it (continued)

O Crystal River Unit 3 8 3.4-50 Final Draft 10/01/93

Pressurizer PORV B 3.4.10 l/~y g BASES SURVEILLANCE SR 3.4.10.1 (continued)

REQUIREMENTS is closed for isolation since cycling could increase the hazard of an existing degraded flow path.

SR 3.4.10.2 This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This allows delaying testing until MODE 3 in order to establish plant conditions most representative of those under which the valve is expected to operate and is consistent with the recommendations of NRC Generic letter 90-06.

PORV cycling demonstrates its function. The Frequency of 24 months is based on a typical refueling cycle and industry accepted practice.

REFERENCES 1. NUREG-0737, November 1980.

2. NRC IE Bulletin 79-05B, April 1979.

3. ASME, Boiler and Pressure Vessel Code,Section XI.

O Crystal River Unit 3 B 3.4-51 Final Draft 10/01/93

Not Used B 3.4.11

_l B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.11 Not Used O

O Crystal River Unit 3 B 3.4-52 Final Draft 10/01/93 l

__ _ _4 - _ _ _ _ m- ____

RCS Operational LEAKAGE B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12 RCS Operational LEAKAGE BASES BACKGROUND During the life of the plant, the joint and valve interfaces contained in the RCS can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the RCS Operational LEAKAGE LC0 is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LC0 specifies the types and amounts of LEAKAGE.

10 CFR 50, Appendix A, GDC 30 (Ref. 1), requires means for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems. OPERABILITY of the leakage detection systems is addressed in LC0 3.4.14, "RCS Leakage Detection Instrumentation."

% The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting, monitoring, and quantifying reactor coolant LEAKAGE is critical. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur.

A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight.

Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS leakage detection.

APPLICABLE Except for primary to secondary LEAKAGE, the safety analyses SAFETY ANALYSES do not address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for a LOCA in that the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes 1 gpm primary to secondary LEAKAGE as the initial condition.

(continued)

Crystal River Unit 3 8 3.4-53 Final Draft 10/01/93 l

RCS Operational LEAKAGE 4 B 3.4.12 ;

BASES APPLICABLE The FSAR (Ref. 3) analysis for (SGTR) assumes the SAFETY ANALYSES contaminated secondary fluid is only briefly released via (continued) safety valves and the majority is steamed to the condenser.

The 1 gpm primary to secondary LEAKAGE is relatively inconsequential in terms of offsite dose.

The FSAR steam line break (SLB) analysis (Ref. 4) is more limiting for site radiation releases. The safety analysis for the SLB accident assumes I gpm primary to secondary LEAKAGE in one generator as an initial condition. The dose consequences resulting from the SLB accident meet the acceptance criteria defined in 10 CFR 100.

RCS operational LEAKAGE satisfies Criterion 2 of the NRC

. Policy Statement, ,

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being O. indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE.

Violation of this LCO could result in continued degradation of the RCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

b. Unidentified LEAKAGE One gallon per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that >

the containment atmosphere and sump level monitoring equipment can detect within a reasonable time period.

Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.

c. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with the detection of unidentified (continued)

C Crystal River Unit 3 8 3.4-54 Final Draft 10/01/93

RCS Operational LEAKAGE B 3.4.12 BASES LC0 c. Identified LEAKAGE (continued)

LEAKAGE and is well within the capability of the RCS makeup system. Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include pressure boundary LEAKAGE or controlled reactor coolant pump (RCP) seal leakoff (a normal function not considered LEAKAGE).

Violation of this LC0 could result in continued degradation of a component or system.

d. Primary to Secondary LEAKAGE throuah All Steam Generators (OTSGs)

Total primary to secondary LEAKAGE amounting to 5 1 gpm through both OTSGs produces acceptable offsite doses in the SLB accident analysis. Violation of this LC0 could exceed the offsite dose limits for this accident. Primary to secondary LEAKAGE must be included in the total allowable limit for identified LEAKAGE.

A Two OTSGs are also required to be OPERABLE. This

'V requirement is met by satisfying the augmented inservice inspection requirements of the Steam Generator Tube Surveillance Program (Specification 5.6.2.10).

APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE or an event that challenges OTSG tube integrity is greatest since the RCS is pressurized. In MODES 5 and 6, LEAKAGE limits and 0TSG OPERABILITY are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE or failure.

LC0 3.4.13, "RCS Pressure Isolation Valve (PIV) Leakage,"

measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leaktight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the determination of allowable identified LEAKAGE.

O (continued)

Crystal River Unit 3 8 3.4-55 Final Draft 10/01/93

RCS Operational LEAKAGE ,

B 3.4.12 BASES (continued)

ACTIONS Ad ;

If unidentified LEAKAGE, identified LEAKAGE, or primary to secondary LEAKAGE are in excess of the LC0 limits, the LEAKAGE must be reduced to within limits within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This-action is necessary to prevent further deterioration of the RCPB.

B.1 and B.2 If any pressure boundary LEAKAGE exists or if unidentified, identified, or primary to secondary LEAKAGE cannot be reduced to within limits within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the reactor must be placed in a lower pressure condition to reduce the severity of the LEAKAGE and its potential consequences. The reactor must be placed in MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This action reduces the LEAKAGE and also reduces the stresses that tend to degrade the pressure boundary.

The Completion Times allowed are reasonable, based on operating experience, to reach the required conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 5, the pressure stresses acting on the RCPB are much lower and further deterioration is much less likely.

SURVEILLANCE SR 3.4.12.1 REQUIREMENTS Verifying RCS LEAKAGE within the F: limits ensures that the integrity of the RCPB is maintaine- Pressure boundary LEAKAGE would at first appear as un.dentified LEAKAGE and can only be positively identified by inspection.

Unidentified LEAKAGE and identified-LEAKAGE are determined by performance of an RCS water inventory balance. Primary to secondary LEAKAGE is also measured by performance of an RCS water inventory balance in conjunction.with effluent l monitoring within the secondary steam and condensate systems.

1 (continued)

Crystal River Unit 3 B 3.4-56 Final Draft 10/01/93

RCS Operational LEAKAGE '

B 3.4.12 BASES SURVEILLANCE SR 3.4.12.1 (continued)

REQUIREMENTS The RCS water inventory balance must be performed with the reactor at steady state operating conditions and near ;

operating temperature and pressure. Therefore, this SR is not required to be performed in MODE 4 or in-MODE 3 until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of steady state operation.near RCS operating pressure and temperature (>400*F) have been-established. .

Steady state operation is required to perform a meaningful ;

water inventory balance; calculations during maneuvering are not useful. For RCS operational LEAKAGE determination by ,

water inventory balance, steady state is defined 'as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP pump seal injection and return flows.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Frequency is a reasonable to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents, i SR 3.4.12.2 This SR provides the means necessory to determine OTSG' OPERABILITY in an operational MODE. The requirement to demonstrate OTSG tube integrity in accordance with the Steam Generator Tube Surveillance Program emphasizes the importance of OTSG tube integrity, even though this Surveillance cannot be performed at normal operating conditions.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 30,

2. Regulatory Guide 1.45, May 1973.

3. FSAR, Section 14.2.2.2. '

4. FSAR, Section 14.2.2.1.

O Crystal River Unit 3 8 3.4-57 Final Draft 10/01/93 l

RCS PIV Leakage B 3.4.13 8 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.13 RCS Pressure Isolation Valve (PIV) Leakage BASES BACKGROUND For the purposes of this Technical Specification, RCS PIVs are defined as any two in-series check valves within the RCS pressure boundary that separate the high pressure RCS from an attached low pressure system, a failure of which, would cause overpressurization of the low pressure system and a LOCA that bypasses containment. The only valves addressed by this Specification are DHV-1, DHV-2, CFV-1, and CFV-3.

During the valves operating life time,' varying amounts of reactor coolant leakage past the valve occurs through either normal operational wear or mechanical deterioration. The RCS PIV Leakage LC0 allows RCS high pressure operation when leakage through these valves exists in amounts that do not compromise safety.

The PIV leakage limit applies to each individual valve.

Leakage through both series PIVs in a line must be included as part of the identified LEAKAGE, governed by LCO 3.4.12, p "RCS Operational LEAKAGE." This is true during operation only when the loss of RCS mass through two series valves is determined by a water inventory balance (SR 3.4.12.1). A known component of the identified LEAKAGE before operation begins is the least of the two individual leakage rates determined for leaking series PIVs during the required surveillance testing; leakage measured through one PIV in a line is not RCS operational LEAKAGE if the other is leaktight.

Although this Specification provides a limit on allowable PIV leakage rate, its main purpose is to prevent overpressure failure of the low pressure portions of connecting systems. The leakage limit is an indication that the PIVs between the RCS and the connected systems are degraded or degrading. PIV leakage could lead to overpressure of the low pressure piping or components.

Failure consequences could be a loss of coolant accident (LOCA) outside of containment, an unanalyzed accident.

The basis for this LC0 is the 1975 NRC " Reactor Safety Study" (Ref. 1). This study identified potential intersystem LOCAs as a significant contributor to the risk (continued)

Crystal River Unit 3 B 3.4-58 Final Draft 10/01/93

RCS PIV Leakage. :(

B 3.4.13 BASES BACKGROUND of core melt. A subsequent study (Ref. 2) evaluated various' (continued) PIV configurations to determine the probability of intersystem LOCAs. i i

The Automatic Closure and Interlock System (ACIS) function- ll protects the low pressure piping in the DHR System from overpressurization in the event the DHR drop line is open, :

or attempted to be opened, with RCS pressure in excess of the design pressure of the suction side of the.DHR System- ,

, pumps. The interlock portion will' prevent opening and the ;

isolation portion of the circuitry will automatically close -

isolation valves in the DH drop line (DHV-3 and DHV-4) when '

RCS pressure is above the nominal 284 psig setpoint.

Excessive pressures in the DH system potentially could '

result in a loss of coolant accident outside the containment. The interlock setpoint is based on preventing pressure in excess of design from being exerted on the DH/LPI system from the RCS. Refer to FSAR Section 9.4.2.7 ;

for a more detailed description of ACIS design. !

l APPLICABLE Reference 1 identified potential intersystem LOCAs as a O SAFETY ANALYSES significant contributor to the risk of core melt. The dominant accident sequence.in the intersystem LOCA category j is the failure of the low pressure portion of the DHR System i outside of containment. The accident is the result of a !

postulated failure of the PIVs, which are part of the ;

reactor coolant pressure boundary (RCPB), and the subsequent pressurization of the DHR System downstream of the Plis from :

the RCS. Because the low pressure portion of the DHR System ;

(suction side of pump) is only designed for 330 psig, ;

overpressurization failure of the DHR low pressure line i would result in a LOCA outside containment and-subsequent ;

risk of core melt.

Reference 2 evaluated various PIV configurations, leakage. l testing of the valves, and operational changes to determine ;

the effect of these items on the probability of intersystem :

LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce the probability of an :

intersystem LOCA.. As a result of this study, on April 20, l 1981, FPC received an NRC Order for Modification of the CR-3 ;

Operating License to include this Technical Specification.. l RCS PIV leakage satisfies Criterion 2 of the NRC Policy l Statement.

(continued)

Crystal River Unit 3 8 3.4-59 Final Draft 10/01/93 i

. - .. _ _ . . _ . . _. . . . ,. . . - . - - . ~~

I RCS PIV Leakage B 3.4.13 BASES (continued)

J l l

LC0 The LCO PIV leakage limit of 5 gpm is based on 0.5 gpm per I nominal inch of valve size with a maximum 1 Nit of 5 gpm. l Since the valves included within the scope oi this Specification are located on 10 and 14 inch lines, respectively, the 5 gpm limit is appropriate. The previous criterion of 1 gpm for all valve sizes imposed an unjustified penalty on the larger valves without providing information on potential valve degradation and resulted in higher personnel radiatior. exposures.

Violation of this LC0 could result in continued degradation of a PIV, which could lead to overpressurization of a low pressure system and the loss of the integrity of a fission product barrier.

Requiring the ACIS to be OPERABLE ensures the DHR system, via the drop line, is protected against design system overpressurization. Both channels of ACIS are required to be OPERABLE to provide redundant diverse means of isolating the decay heat drop line.

O APPLICABILITY In MODES 1, 2, 3, and 4, the PIV leakage potential and the need for ACIS is greatest with the RCS pressurized in excess of the limiting DHR System design pressure. In MODE 4, valves in the DHR flow path are not required to meet the requirements of this LCO when in the DHR mode of operation, or during the transition to or from this means of core cooling. This allows the DHR System to be put in service in ;

the lower portions of MODE 4, eliminating the need to ,

operate an RCS loop and reactor coolant pumps all the way down into MODE 5.

In MODES 5 and 6, leakage limits are not required because the lower reactor coolant pressure results in a reduced potential for leakage and for a LOCA outside the containment. In MODES 5 and 6, the reactor coolant system is less likely to experience rapid pressure increases and the magnitude of these increases is less. Thus, ACIS-is not required in these MODES.

(continued)

Crystal River Unit 3 B 3.4-60 Final Draft 10/01/93 k

1

i RCS PIV Leakage B 3.4.13 BASES (continued)

ACTIONS The ACTIONS are modified by two Notes. Note 1 is added to provide clarification that the Conditions of this Specification are entered separately for each flow path.

This is allowed based upon the relative independence of the flow paths as leakage pathways. Note 2 requires that Conditions and Required Actions of systems rendered inoperable as a result of this Specification be entered.

This is required since isolation of a leaking flow path in accordance with the Required Actions could result in the .

inoperability of the Low Pressure Injection System. If this is the case, the appropriate Actions of Specification 3.5.2, "ECCS-Operating" should be taken. Without the note, LCO 3.0.6 would direct that the LPI System Actions not be taken.

Thus, the plant could operate indefinitely in accordance with this Specification, with one LPI subsystem inoperable.

This is not the intent.

A.1 and A.2 With one or more flowpaths with leakage from one or more PIV in excess of the 5 gpm limit, the affected flow path must be isolated by two valves in order to continue power operation.

(- Required Actions A.1 and A.2 are modified by a Note that the valves used for isolation must meet the same leakage requirements as the PIVs and must be on the high pressure portion of the DHR system.

Required Action A.1 requires that the isolation with one valve must be performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Four hours provides time to reduce leakage in excess of the allowable limit or to isolate the affected system if leakage cannot be reduced.

The action to isolate the high pressure portion from the low pressure portion does not apply to the piping leading to the CFTs. This position is consistent with the intent of this LC0 to minimize the potential for a LOCA that bypasses containment. Thus, the affected DHR System flow paths are the only ones required to be isolated.

Required Action A.2 specifies that the two valve isolation barrier be restored by closing some other valve qualified for isolation or restoring one leaking PIV. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (continued)

Crystal River Unit 3 8 3.4-61 Final Draft 10/01/93 l

l RCS PIV Leakage i B 3.4.13 .{d n)

I BASES ACTIONS A.1 and A.2 (continued)

Completion Time considers the time required to complete the Action and the low probability of a second valve failing during this time period. Closing and de-activating the second valve will render the associated LPI subsystem ,

inoperable.

B.1 and B.2 If leakage cannot be restored, or the Required Actions accomplished, the plant must be placed in a MODE in which the requirement does not apply. .

t To achieve this status, the plant must be placed in MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . These Required Actions will tend to reduce'the leakage and also the potential for a LOCA outside the containment. The ,

allowed Completion Times are reasonable based on operating experience, to reach the required plant conditions from full ;

power conditions in an orderly manner and without challenging plant systems.

l C1 \

Inoperability of one or more channels of ACIS renders DHV-3 or DHV-4 incapable of automatically isolating in response to !

a high pressure condition and preventing inadvertent opening !

of the valves at RCS pressures in excess of the DHR system i design pressure. If the ACIS is inoperable, operation may '

l continue as long as the DHR suction penetration is isolated by at least one closed manual or deactivated automatic valve within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . This action in effect accomplishes the i purpose of the autoclosure function.

SURVEILLANCE SR 3.4.13.1 REQUIREMENTS l Performance of leakage testing on each RCS PIV'is required i to verify that leakage is below the specified limit and to '

identify each leaking valve. The leakage limit of 5 gpm applies to each valve. ,

I (continued) i Crystal River Unit 3 8 3.4-62 Final Draft 10/01/93 i

RCS PIV Loakage B 3.4.13 BASES SURVEILLANCE SR 3.4.13.1 (continued)

REQUIREMENTS For the two PIVs in series, the leakage requirement applies to each valve individually and not to the combined leakage across both valves. If the PIVs were not individually leakage tested, one valve could have failed completely and not detected provided the other valve in series met the leakage requirement. In this situation, the protection-provided by redundant valves would be lost.

ASME,Section XI (Ref. 3) pe'rmits leakage testing at a lower pressure differential than between the specified maximum RCS pressure and the normal pressure of the connected system during RCS operation (the maximum pressure differential).

Reference 3 allows this reduced pressure testing for those types of valves in which the higher service pressure will tend to diminish the overall leakage channel opening, e.g.,

check valves. In such cases, the observed rate should be adjusted to the maximum pressure differential by assuming leakage is directly proportional to the pressure differential to the one half power.

The Frequency of testing is a combination of ASME Code and O PIV Order requirements.

The Inservice Testing Program implements the American Society of Mechanical Engineers (ASME) Code,Section XI (Ref. 5), cold shutdown performance requirement. This requirement is based on the need to perform this Surveillance under conditions that apply during an outage and the potential for an unplanned transient if the Surveillance were performed with the plant at power.

The Frequency of prior to entering MODE 2 whenever the plant has been in MODE 5 for 7 days or more, if leakage testing I

has not been performed in the previous 9 months was contained in the April 21, 1980 PIV Order. It was intended to provide confidence the valves re-seated following any period of extended operation with flow through the valves.

The 7 day value is based on NUREG 1366 recommendations :

(Ref. 4). l Entry into MODES 3 and 4 is allowed to establish the necessary differential pressures and stable RCS conditions to allow for performance of this Surveillance. The Note (continued) l Crystal River Unit 3 8 3.4-63 Final Draft 10/01/93 l

l

RCS PIV Leakage-B 3.4.13 I')

G BASES F

SURVEILLANCE SR 3.4.13.1 (continued)

REQUIREMENTS that allows this provision is complimentary to the Frequency of prior to entry into MODE 2 whenever the unit has been in MODE 5 for 7 days or more, if leakage testing has not been performed in the previous 9 months.

SR 3.4.13.2 and SR 3.4.13.3 Verifying ACIS is OPERABLE ensures that RCS pressure will not pressurize the DHR system beyond its design pressure of .

330 psig on the suction side and 450 psig on the discharge side of the pump. The setpoint is adjusted to account for elevation differences between the pressure instrument and the drop line and is set so RCS hot leg pressure must be

< 284 psig to open the valves. This setpoint ensures the DHR design pressure will not be exceeded and the DHR relief valves will not lift. The 24 month Frequency is based on the need to perform this Surveillaace under the conditions that apply during a plant outage. The 24 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the

) equipment.

REFERENCES 1. NUREG-75/014, Appendix V, October 1975.

2. NUREG-0677, NRC, Mai 1980. 1

3. ASME, Boiler and Pressure Vessel Code,Section XI, Article IWV-3423(c).

4. NUREG-1366, December 1992. ;

I

5. ASME, Boiler and Pressure Vessel Code,Section XI, l Article IWV-3422.

l

~

.l

. I

\

4 Crystal River Unit 3 B 3.4-64 Final Draft 10/01/93 l l

1

4 RCS Leakage Detection Instrumentation

. B 3.4.14 8 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.14 RCS Leakage Detection Instrumentation BASES BACKGROUND 10 CFR 50, Appendix A, GDC 30, (Ref. 1) requires means be provided for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE.

Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting leakage detection systems.

Leakage detection systems must have the capability to detect reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE. :

The containment sump collects unidentified LEAKAGE and is instrumented to alarm on increasing level and has the capability to detect a leakage rate of I gpm in less than I hour. This sensitivity is acceptable for detecting increases in unidentified LEAKAGE.

The reactor coolant contains radioactivity that, when released to the containment, can be detected by radiation monitoring instrumentation. Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects. Instrument sensitivities of 10 pCi/cc radioactivity for particulate monitoring and of 10' pCi/cc radioactivity for gaseous monitoring are adequate for these leakage detection systems.

The detector is capable of detecting a 1 gpm leak rate within 15 minutes with the design basis corrosion products in the reactor coolant on both particulate and gaseous radioactivity monitoring systems because of their sensitivities and rapid responses to RCS LEAKAGE. This is well in excess of the Regulatory Guide criteria at I gpm within I hour and accounts for the presence of elevated background radiation levels due to pre-existing LEAKAGE.

Other installed instrumentation such as RB pressure and Containment Cooling Fan condensate flow also indicate leakage into containment. These are potentially valuable (continued)

Crystal River Unit 3 B 3.4-65 Final Draft 10/01/93

RCS Leakage Detection Instrumentation B 3.4.14

( BASES BACKGROUND diagnostic tools but they are not capable of accurately (continued) detecting leak rates of I gpm and below. As such, they are not acceptable leakage detection systems for the purposes of satisfying this LCO.

APPLICABLE The safety significance of RCS LEAKAGE varies widely SAFETY ANALYSES depending on its source, rate, and duration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is very important. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides '

quantitative information to the operators, allowing them to '

take corrective action should a leak occur.

Leakage detection capability is also a fundamental aspect of the " leak before break" concept of piping design. This concept is based on the premise that main loop RCS piping will not fail catastrophically, but will leak prior to the failure. Demonstrating this to be true (shown probabilistically) and that this leakage can be detected, allows the dynamic effects associated with RCS pipe breaks to be excluded from the design basis of the RCS (Ref. 3).

~~

RCS leakage detection instrumentation satisfies Criterion 1 ,

of the NRC Policy Statement.

LCO One method of protecting against large RCS LEAKAGE derives from the instruments ability to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be OPERABLE'to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition when RCS LEAKAGE indicates possible RCPB degradation. OPERABILITY of the atmospheric radiation monitors include the proper operation of the sample pump'.

This pump is common to both monitors such that its failure can affect the plant's capability to monitor the containment atmosphere.

(continued)

Crystal River Unit 3 8 3.4-66 Final Draft 10/01/93

RCS Leakage Detection Instrumentation B 3.4.14 i BASES LC0 The requirements of.the LCO are met when monitors of diverse (continued) measurement means are available. Thus, the containment sump monitor (narrow range), in combination with a particulate or gaseous radioactivity monitor, provides an acceptable minimum.

APPLICABILITY RCS leakage detection instrumentation is required to be OPERABLE in MODES 1, 2, 3 and 4 due to the elevated RCS ,

temperature and pressure.

In MODE 5 or 6, the temperature is s 200'F and pressure is low or at atmospheric pressure. Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation is much smaller. Additionally, below 200*F leakage from the RCS will likely be liquid and the atmospheric monitors are less effective. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.

ACTIONS A.1 and A.2 With the narrow range containment sump monitor inoperable, no other form of sampling will provide equivalent information (range and sensitivity). However, the containment atmosphere activity monitor will provide an indication of chang'es in leakage. Together with the atmosphere monitor, the periodic RCS water inventory balance, (SR 3.4.12.1), must be performed at an increased Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to provide information adequate to detect leakage.

Since Required Action A.1 only specifies " perform", a failure of SR 3.4.12.1 does not result in a Required Action not met (Condition C). However, if the failure of SR 3.4.12.1 is valid and not due to the inability to establish s'teady state conditions, the ACTIONS of Specification 3.4.12 must be entered immediately. .

Restoring the sump monitor to OPERABLE status within 30 days is required to regain the function provided by the instrument. This Completion Time is acceptable considering 1 (continued)

C Crystal River Unit 3 B 3.4-67 Final Draft 10/01/93

1 RCS Leakage Detection Instrumentation B 3.4.14?

BASES q

ACTIONS A.1 and A.2 (continued) j 1

the frequency and adequacy of the RCS water inventory balance required.by Required Action t.1.

Required Action A.1 and Required Action A.2 are modified by a Note indicating that the provisions of LC0 3.0.4 do not apply. As a result, a MODE change is allowed when the sump. !

monitor is inoperable. This allowance is provided because '

other instrumentation is available to monitor RCS LEAKAGE :

and the Completion Time for restoring the monitor ~ to OPERABLE status is lengthy. ,

B.1.1. B.l.2. and B.2 .

With the required gaseous or particulate containment atmosphere radioactivity monitoring instrumentation channel-inoperable, grab samples of the containment atmosphere must ;

be taken and analyzed or water inventory balances must be performed to provide alternate periodic information. With a sample obtained and analyzed or a water inventory balance- ;

performed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , operation may continue-for up to- i 30 days to allow restoration of at least one of the '

radioactivity. monitors.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months interval provides periodic information that'is ,

adequate to detect leakage. The 30 day Completion Time.is based on having at least one other form of lealdetection (sump level) available. -

Since Required Action B.I.2 only specifies " perform", a failure of SR 3.4.12.1 does not result in a Required Action !

not met (Condition C). However, if the failure of SR

3.4.12.1 is valid and not due to the inability to establish ;

steady state conditions, the ACTIONS of Specification 3.4.12 i must be entered immediately. ;

Required Actions B.1.1, B.1.2, and B.2 are modified by a ;

Note indicating that the provisions of LC0 3.0.4 do not apply. As a result, a MODE change is allowed when the r

. containment atmosphere radioactivity monitor is inoperable. l This allowance is provided because other instrumentation is available to monitor RCS LEAKAGE and the Completion Time for restoring the monitor to OPERABLE status is lengthy.

(continued) ;

O Crystal River Unit 3 8 3.4-68 Final Draft 10/01/93

RCS Leakage Detection Instrumentation B 3.4.14 BASES ACTIONS C.1 and C.2 (continued)

If the Required Actions of Condition A or B are not met within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D_d With both required monitors inoperable, no Regulatory Guide >

1.45 qualified means of monitoring leakage are available, and immediate entry into LC0 3.0.3 is required.

SURVEILLANCE SR 3.4.14.1 O REQUIREMENTS SR 3.4.14.1 requires the performance of a CHANNEL CHECK of the required containment atmosphere radioactivity monitor.

The check provides reasonable confidence that each channel is operating properly. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on instrument reliability and is reasonable for detecting off normal conditions.

SR 3.4.14.2 SR 3.4.14.2 requires the performance of a CHANNEL FUNCTIONAL TEST of the required containment atmosphere radioactivity monitor. The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string.

The Frequency of 92 days considers instrument reliability and operating experience, and is based on the recommendations of NUREG 1366 (Ref. 4).

f (continued)

Crystal River Unit 3 B 3.4-69 Final Draft 10/01/93

RCS Leakage Detection Instrumentation B 3.4.14

BASES SURVEILLANCE SR 3.4.14.3'and SR 3.4.14.4 REQUIREMENTS (continued) These SRs require the performance of a CHANNEL CALIBRATION .

for each of the required RCS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Frequency of.18 months is a typical refueling cycle and considers channel reliability.

Operating experience has proven this Frequency acceptable.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 30.

2. Regulatory Guide 1.45.

3. 10 CFR 50, Appendix A, GDC 4.

4. NUREG 1366, December 1992.

O l

l O

Crystal River Unit 3 B 3.4-70 Final Draft 10/01/93 l

'I l

l RCS Specific Activity j B 3.4.lc i B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.15 RCS Specific Activity BASES ]

1 BACKGROUND 10 CFR 100 (Ref.1), specifies the maximum whole body and thyroid dose to an individual at the site boundary for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during an accident. The limits on specific activity ensure that the doses are held to a small fraction of the 10 CFR 100 limits during analyzed transients and accidents.

This LC0 limits the allowable concentration level of radionuclides in the reactor coolant. The limits are established to minimize the offsite dose consequences in the event of a steam generator tube rupture (SGTR) accident.

The LCO contains specific activity limits for both DOSE EQUIVALENT I-131 and gross specific activity. The allowable levels are intended to limit the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose at the site boundary to a small fraction of the 10 CFR 100 dose guideline limits. The limits in the LC0 are standardized based on parametric evaluations of offsite radioactivity dose consequences for typical site locations. They are not :

O plant-specific.

The parametric evaluations showed the potential offsite dose levels for an SGTR accident were an appropriately small fraction of the 10 CFR 100 dose guideline limits (Ref. 1).

Erch evaluation assumes a broad range of site applicable atmospheric dispersion factors in a parametric evaluation.

APPLICABLE The LC0 limits on the specific activity of the reactor SAFETY ANALYSES coolant ensure that the resulting 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months doses at the site boundary will not exceed a small fraction of the 10 CFR 100 dose guideline limits following an SGTR accident. These values represent a reasonable operating capability rather than a specific analytical result. The CR-3 specific SG1R safety analysis (Ref. 2) assumes the speciftc activity of the reactor coolant is representative of 1% defective fuel and a primary to secondary leak rate of 1 gpm through steam generators. The analysis also assumes a reactor trip and a turbine trip at the same time as the SGTR event.

I (continued)

Crystal River Unit 3 8 3.4-71 Final Draft 10/01/93

RCS Specific Activity B 3.4.15 BASES APPLICABLE The rise in pressure in the ruptured 0TSG causes SAFETY ANALYSES radioactively contaminated steam to discharge to the (continued) atmosphere through the atmospheric dump valves or the main-steam safety valves.

RCS Specific Activity satisfies Criterion 2 of the NRC Policy Statement. ,

LC0 The specific iodine' activity is limited to 1.0 gC1/gm DOSE EQUIVALENT I-131, and the gross specific activity in the primary coolant is limited to the number of pCi/gm equal to 100 divided by E (average disintegration energy of the sum of the average beta and gamma energies of the coolant nuclides in terms of MeV). These values represent a reasonable operating capability rather than a specific analytical result. The limit on DOSE EQUIVALENT I-131 ensures the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thyroid dose to an individual at the site boundary during the Design Basis Accident (DBA) will be a small fraction of the acceptable thyroid dose specified in' Reference 1. The limit on gross specific activity ensures the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months whole body dose to an individual at the site boundary during the DBA will be a small fraction of the allowed whole body dose.

Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SGTR, lead to site boundary doses that exceed the generically applicable dose limits.

APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS average temperature ,

t 5-00*F, the energy in the RCS is sufficient to lift secondary side relief valves in the event of a SGTR. !

For operation in MODE 3 with RCS average temperature

< 500*F, and in MODES 4 and 5, the release of radioactivity in the event of an SGTR is unlikely since the saturation <

pressure of the reactor coolant is below the lift pressure l settings of the atmospheric dump valves and main steam i safety valves.

I i

I (continued)

Crystal River Unit 3 8 3.4-72 Final Draft 10/01/93

_. ~ . .

s RC.S Specific' Activity ]

B'3.4.15' .l i

BASES (continued) 1 ACTIONS A.1 and A.2 l With the DOSE EQUIVALENT I-131 greater than the LCO limit,.

samples at intervals of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months must be taken to demonstrate .l the limits of Figure 3.4.15-1 are not exceeded. The !

Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is required to obtain and analyze !

a sample. Sampling must continue for trending purposes, i The DOSE EQUIVALENT I-131 must ce restored to limits within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months limits operation i in the Condition, but provides a reasonable time for temporary coolant activity increases (iodine spiking or crud bursts) to be cleaned up with processing systems. As such, '

the Completion Time is based on engineering judgment.

The Required Actions of Condition A are modified by 'a Note indicating LCO 3.0.4 is not applicable. As a result, a MODE ;

change is allowed when RCS specific activity exceeds 1.0 yCi/gm but is less than Figure 3.4.15-1. This allowance is provided because coolant cleanup activities can proceed in.

parallel with plant start-up.

O u .

, If either Required Action and associated Completion Time of Condition A is not met or if the DOSE EQUIVALENT I-131 is in the unacceptable region of Figure 3.4.15-1, the reactor must ,

be placed in MODE 3 with RCS average temperature < 500*F within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is required to get to MODE 3 below 500*F without challenging plant systems.

C.1 and C.2

~

With gross specific activity in excess of the allowed limit,. .

an analysis must be performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to determine '

DOSE EQUIVALENT I-131. The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is required to obtain and analyze a sample.

i i

(continued) l Crystal River Unit 3 B 3.4-73 Final Draft 10/01/93 l

RCS Specific Activity B 3.4.15 BASES s ,

ACTIONS C.1 and C.2 -(continued)

In addition, the plant must be placed in MODE 3 with RCS average temperature less than 500*F within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months action to place the plant in MODE 3 with RCS average temperature < 500'F lowers the saturation pressure of the reactor coolant below the setpoints of the main steam safety valves and the atmospheric dump valves, and prevents venting the OTSG to the environment in an SGTR event. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is required to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.15_.1 REQUIREMENTS SR 3.4.15.1 requires performing a gamma isotopic analysis as a measure of the gross specific activity of the reactor coolant at least once per 7 days. While basically a quantitative measure of radionuclides with half lives longer than 15 minutes, excluding iodines, this measurement is the O sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in gross specific activity.

The 7 day Frequency considers the unlikelihood of a gross fuel failure during that time period end is adequate based on operating history.

SR 3.4.15.2 This Surveillance is only required to be performed in MODE 1 since this is when iodine production mechanisms are large enough to yield meaningful Surveillance results. This ensures the iodine remains within limit during normal operation and following fast power changes when the stresses on the nuclear fuel are the greatest. The 14 day Frequency is adequate to trend changes in the iodine activity level considering gross specific activity is monitored every 7 days. The Frequency of between 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after a (continued)

O Crystal River Unit 3 B 3.4-74 Final Draft 10/01/93

^

i RCS Specific Activity R B 3.4.15 l

BASES )

SURVETLLANCE SR 3.4.15.2 (continued) !

REQUIREMENTS change of 215% RTP within a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months period is established because the iodine levels in the core peak during this time.

If fuel failure were to occur, this period of time would be the most conservative time (levels would be highest) to measure iodine concentration.

SR 3.4.15.3 ;

SR 3.4.15.3 requires radiochemical analysis for E every 184 days (6 months) with the )lant operating in MODE 1 equilibrium conditions. The E determination directly relates to the LCO and is required to verify plant operation within the specific gross activity LCO limit. The analysis for E is a measurement of the average energies per disintegration for isotopes with half lives longer than i 15 minutes, excluding iodines. The Frequency of 184 days )

recognizes E does not change rapidly, i

This SR has been modified by a Note that indicates the SR is -l only required to be performed 31 days after a minimum of l O 2 EFPD and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for at least 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

I This SR 3.0.4 type exception ensures the radioactive materials are at equilibrium so the analysis for E is representative and not skewed by a crud burst or other similar abnormal event.

REFERENCES 1. 10 CFR 100.

2. FSAR, Section 14.2.2.2.

O Crystal River Unit 3 B 3.4-75 Final Draft 10/01/93

CFTs !

B 3.5.1 ;

B 3.5 EMERGENCY CORE C)0 LING SYSTEMS (ECCS)

(

B 3.5.1 Core Flood Tanks (CFTs) ;

BASES BACKGROUND The function of the ECCS CFTs is to supply water to the reactor vessel during the blowdown phase of a loss of coolant accident (LOCA), to provide inventory to help accomplish the refill phase that follows thereafter, and to provide Reactor Coolant System (RCS) makeup for a small break LOCA. In addition to LOCA analyses, the CFTs have been assumed to operate to provide borated water for reactivity control for severe overcooling events such as a large steam line break (SLB). Two CFTs (CFT-1A and CFT-1B) are provided for these functions.

The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.

In the refill phase of a LOCA, which follows immediately after the blowdown phase, reactor coolant inventory has vacated the core through steam flashing and ejection through the break. The core is essentially in adiabatic heatup.

The balance of CFT inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer so as to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of safety injection water.

The CFTs are ASME Code,Section III, Class "C" pren are vessels partially filled with borated water and pressurized with nitrogen gas. The CFTs are passive components, since no operator or control actions are required for them to perform their function. Internal tank pressure will cause a discharge of the contents of the CFTs to the RCS if RCS pressure decreases below the CFT pressure. Each CFT is piped separately into the reactor vessel downcomer. The CFT injection lines are also utilized by the Low Pressure Injection (LPI) System. Each CFT is isolated from the RCS by a motor operated isolation valve and two check valves in series.

l (continued)

Crystal River Unit 3 8 3.5-1 Final Draft 10/01/93

CFTs B 3.5.1 I BASES BACKGROUND The motor operated isolation valves (CFV-5 and CFV-6) are (continued) required to be open, with power removed from the valve motor to prevent inadvertent closure prior to or during an accident.

The CFTs thus form a passive system for injection directly into the reactor vessel. Except for the core flood line break LOCA, a unique accident that also disables a portion of the injection system, both tanks are assumed to operate in the safety analyses for Design Basis Events.

Because injection is directly into the reactor vessel downcomer, and because it is a passive system not subject to the single active failure criterion, all fluid injection is credited for core cooling.

The CFT gas / water volumes, gas pressure, and outlet pipe size are selected to provide core cooling for a large break LOCA prior to the injection of coolant by the LPI System.

APPLICABLE Credit is taken for the CFTs in both the large and small SAFETY ANALYSES break LOCA analyses at full power (Ref.1). These Design O Basis Accident (DBA) analyses establish the acceptance limits for the CFTs. In performing the LOCA calculations, conservative assumptions are made concerning the availability of emergency injection flow including the assumption of the loss of offsite power (required by regul ations) . In the early stages of a LOCA with the loss of offsite power, the CFTs provide the sole source of makeup water to the RCS, since the LPI pumps and high pressure injection (HPI) pumps cannot deliver flow until the emergency diesel generators (EDGs) start, come to rated speed, and go through their timed loading sequence.

.The limiting large break LOCA for purposes of determining CFT parametric limits is a double ended guillotine cold leg break at the discharge of the reactor coolant pump.

! During this event, the CFTs begin to discharge to the RCS as '

soon as RCS pressure decreases below CFT pressure. As a conservative estimate, no credit is taken for HPI for large break LOCAs. LPI is not assumed to begin until 35 seconds after the RCS pressure decreases to the Engineered Safeguards Actuation System (ESAS) actuation pressure.

A (continued)

V Crystal River Unit 3 B 3.5-2 Final Draft 10/01/93 l

i 1

l

CFTs B 3.5.1 6 BASES APPLICABLE No operator action is assumed during the blowdown stage of SAFETY ANALYSIS a large break LOCA.

(continued)

The small break LOCA analysis also assumes a time delay after ESAS actuation before pumped flow reaches the cope.

For thp larger range of small breaks (between - 0.2 ft and 0.S ft'), the rate of blowdown is such that the increase in fuel clad temperature is terminated by the CFTs, with pumped flow then providing pontinued cooling. As break size decreases (- 0.02 ft and 0.2 ft ), the CFTs and HPI pumps 2

both play a part in terminating the rise in clad temperature. As break size continues to decrease, the role of the CFTs continues to decrease until the tanks are not required and the HPI pumps become responsible for terminating the temperature increase.

This LCO helps to ensure that the following acceptance criteria for the ECCS established by 10 CFR 50.46 (Ref. 2) will be met following a LOCA:

a. Maximum fuel element cladding temperature of 2200*F;

b. Maximum cladding oxidation of s 0.17 times the total O cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction of s 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and

d. Core maintained in a coolable geometry.

Since the CFTs discharge during the blowdown and reflood phases of a LOCA, they do not contribute to the long term cooling requirements of 10 CFR 50.46.

The limits for operation with a CFT that is inoperable for any reason other than the boron concentration not being within limits minimize the time that the plant is exposed to a LOCA event occurring coincident with inoperability of a CFT, which might result in unacceptable peak cladding temperatures. If a closed isolation valve cannot be opened, (continued)

Crystal River Unit 3 8 3.5-3 Final Draft 10/01/93

CFTs B 3.5.1 BASES APPLICABLE or the proper water volume or nitrogen cover pressure cannot SAFETY ANALYSIS be restored, the full capability of one CFT is not available (continued) and prompt action is required to place the reactor in a MODE in which this capability is not required.

The minimum volume requirement for the CFTs ensures that both CFTs can provide adequate inventory to reflood the core and downcomer following a LOCA. The downcomer then remains flooded until the HPI and LPI systems start to deliver flow.

The maximum volume limit is based upon the need to maintain adequate gas volume to ensure proper injection, ensure the ability of the CFTs to fully discharge, and limit the maximum amount of boron inventory in the CFTs. Values of 7255 gallons and 8005 gallons are specified. -

The minimum nitrogen cover pressure requirement of 577 psia ensures that the contained gas volume will generate discharge flow rates during injection that are consistent with those assumed in the safety analysis. The maximum nitrogen cover pressure limit of 653 psia ensures that the amount of CFT inventory that is discharged while the RCS depressurize:,, and is therefore lost through the break, will not be larger than that predicted by the safety analysis.

The minimum boron requirement of 2270 ppm is selected to ensure that the reactor will remain subcritical during the reflood stage of a large break LOCA. The maximum allowable boron concentration of 3500 ppm in the CFTs ensures that the sump pH will be maintained between 7.0 and 11.0 following a LOCA.

The numerical values of the parameters stated in the LC0 are analysis values and do not include a specific allowance for instrument error. However, the nitrogen cover pressure and tank volume limits were subsequently re-analyzed to address the issue These re-analyses were performed in order to error-adjust the surveillance procedure acceptance criteria while maintaining an acceptable operating band for the parameter. The nitrogen cover pressure analysis limits include approximately 12 psig allowance for instrument error. Tank volume analysis (Ref. 4) opened up the operating band by approximately 300 gallons, although the upper limit was unchanged. -

(continued)

Crystal River Unit 3 B 3.5-4 Final Draft 10/01/93

CFTs B 3.5.1 O

a BASES

-APPLICABLE The CFT isolation valves are not single failure proof; SAFETY ANALYSIS therefore, whenever these valves are open, power shall be (continued) removed from them. This precaution ensures that both CFTs are available during an accident. With power supplied to the valves, a single active failure could result in a valve closure, which would render one CFT unavailable for injection. Both CFTs are required to function in the event of a large break LOCA.

The CFTs are part of the primary success path that functions or actuates to mitigate a DBA that either assumes the failure of or presents a challenge to the integrity of a fission product barrier. As such, the CFTs satisfy Criterion 3 of the NRC Policy Statement.

LC0 The LC0 establishes the minimum conditions required to ensure that the CFTs are available to accomplish their core cooling safety function following a LOCA. Both CFTs are required to function in the event of a large break LOCA. If the entire contents of both tanks are not injected during n the blowdown phase of a large break LOCA, the ECCS acceptance criteria of 10 CFR 50.46 (Ref. 2) could be

() violated. For a CFT to be considered OPERABLE, the isolation valve must be fully open, with power removed, and the limits established in the SR for contained volume, boron concentration, and nitrogen cover pressure must be met.

APPLICABILITY In MODES I and 2, and in MODE 3 with RCS pressure 2 750 psig, the CFT OPERABILITY requirements are based on full power operation. Although cooling requirements decrease as power decreases, the CFTs are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.

This LC0 is only applicable at RCS pressures 2 750 psig.

Below 750 psig, the rate of RCS blowdown is such that the safety injection pumps can provide adequate injection to ensure that peak clad temperature remains below the 10 CFR 50.46 (Ref. 2) limit of 2200*F.

(continued)

Crystal River Unit 3 8 3.5-5 Final Draft 10/01/93

CFTs <

B 3.5.1-BASES APPLICABILITY In MODE 3 s 750 psig,.and in MODES 4,-'5, and 6, the' CFT' (continued) motor operated isolation valves are typically closed to ,

isolate the CFTs from the RCS. This allows RCS cooldown and -

depressurization without discharging the CFTs into the RCS or requiring depressurization of_the CFTs.

ACTIONS M If the boron concentration of one CFT is not-within limits, it must be returned to within the limits within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . '

In this' condition, ability to maintain subcriticality may be reduced, but the effects of reduced boron concentration on core subcriticality during reflood are minor. Boiling of !

the ECCS water in the core during reflood concentrates the :

boron in the saturated liquid that remains in the core. In-addition, the volume of the CFT is still available for injection (otherwise, plant operation is limited in y accordance with the Required' Actions of. Condition B). Since the boron requirements-are based on the average boron concentration of .the total volume of two'CFTs,' the 1 consequences are less-severe than they would-be if the O contents of a CFT were not available for injection. .Thus, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to return the boron concentration to within limits.

M '

If one CFT is inoperable for a -reason other than boron concentration, or two CFTs are inoperable, the CFT(s) must i be returned to OPERABLE status within I hour. In this condition, it cannot be assumed that the CFT will perform +

its required function during a LOCA. Due to the severity of the consequences should a LOCA occur in these conditions,

'the I hour Completion Time to open the valve, remove power to the valve, or restore the proper water volume or nitrogen cover pressure ensures that prompt action will be taken to- '

return the inoperable CFT to OPERABLE status. The Completion Time minimizes the time the plant is potentially exposed to a LOCA in these conditions.

1

~

(continued)

Crystal River Unit 3 8 3.5-6 Final Draft 10/01/93 t

r CFTs B 3.5.1 BASES ACTIONS C.1 and C.2 (continued)

If the CFT cannot be returned to OPERABLE status within the associated Completion Time of Condition A or B, the plant must be placed in a MODE in which the LC0 does not apply.

To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and RCS pressure reduced to s 750 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. .

SURVEILLANCE SR 3.5.1.1 REQUIREMENTS Verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that each CFT isolation valve is fully open, as indicated in the control room, ensures that the CFTs are available for injection and ensures timely i discovery if a valve should be less than fully open. If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve position should not change with power removed, a closed valve could result in accident analysis assumptions not Os being met. A 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered reasonable in ,

view of administrative controls that ensure that a mispositioned isolation valve is unlikely.

SR 3.5.1.2 and SR 3.5.1.3 Verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of each CFT's nitrogen cover pressure and the borated water volume is sufficient to ensure adequate injection during a LOCA. Due to the static design of the CFTs, a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency usually allows the operator to identify changes before the limits are reached.

Operating experience has shown that this Frequency is appropriate for early detection and correction of off normal trends.

SR 3.5.1.4 Surveillance once every 31 days is reasonable to verify that the CFT boron concentration is within the required limits because the static design of the CFT limits the ways in (continued)

Crystal River Unit 3 8 3.5-7 Final Draft 10/01/93

CFTs B 3.5.1

'v(9 BASES SURVEILLANCE SR 3.5.1.4 (continued)

REQUIREMENTS which the concentration can be changed. The Frequency is adequate to identify changes that could occur from mechanisms such as stratification or in-leakage. Sampling within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after an 80 gallon volume increase will identify whether inleakage from the RCS or addition from another source has caused the boron concentration to be outside the required limit. It is not necessary to verify boron concentration if the added water inventory is from the borated _ water storage tank (BWST), because the water contained in the BWST is within CFT boron concentration requirements. This is consistent with the recommendations of NUREG-1366 (Ref. 3).

SR 3.5.1.5 Verification every 31 days that power is removed from each CFT isolation valve operator ensures that an active failure could not result in the undetected closure of a CFT motor operated isolation valve coincident with a LOCA. If this closure were to occur, this would result in a loss of CFT safety function. Since power is removed under O'

g administrative control, the 31 day Frequency will provide adequate assurance that the power is removed.

REFERENCES 1. FSAR, Section 6.1.2.1.3.

2. 10 CFR 50.46.

3. NUREG-1366, December 1992.

4. B&W Document 51-1223368-00. ,

t O

Crystal River Unit 3 B 3.5-8 Final Draft 10/01/93

ECCS-Operating B 3.5.2

( B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 ECCS-Operating BASES BACKGROUND The function of the ECCS is to provide core cooling to ensure that the reactor core is protected after any of the following accidents:

1. Loss of coolant accident (LOCA);

2. Steam generator tube rupture (SGTR); and

3. Steam lina break (SLB).

There are two modes of ECCS operation: injection and recirculation. In the injection phase, all injection is initially added to the Reactor Coolant System (RCS) from the borated water storage tank (BWST). This injection flow is added via the RCS cold legs and core flood nozzles to the reactor vessel. After the BWST has been depleted to 1 5 feet, the ECCS recirculation phase is entered as the ECCS suction is manually transferred to the reactor building O emergency sump.

Two redundant, 100% capacity trains are provided. Each train consists of high pressure injection (HPI) and low pressure injection (LPI) subsystems. In MODES 1, 2, and 3, both trains must be OPERABLE. This ensures that 100% of the core cooling requirements can be provided even in the event of a single active failure.

A suction header supplies water from the BWST or the reactor building emergency sump to the ECCS pumps. Separate piping supplies each train. Each HPI subsystem discharges into each of the four RCS cold legs between the reactor coolant pump and the reactor vessel. Each LPI subsystem discharges into its associated core flood nozzle on the reactor vessel and discharges into the vessel downcomer area. Control valves are set to balance the HPI flow to the RCS. This ;

flow balance directs sufficient flow to the core to meet the analysis assumptions following a small break LOCA in one of the RCS cold legs near an HPI nozzie.

The HPI pumps are capable of discnarging to the RCS at an RCS pressure above the opening setpoint of the pressurizer (continued)

Crystal River Unit 3 B 3.5-9 Final Draft 10/01/93

ECCS-Operating ,

B 3.5.2 BASES BACKGROUND safety valves. The LPI pumps are capable of discharging to (continued) the RCS at an RCS pressure of approximately 200 psia. When the BWST has been nearly emptied, the suction for the LPI pumps is manually transferred to the reactor building <

emergency sump. The HPI pumps cannot take suction directly from the sump. If HPI is still needed, a cross connect from the discharge side of the LPI pump to the suction of the HPI pumps would be' opened. This is known as " piggy backing" HPI to LPI, and enables continued HPI to the RCS, if needed, after the BWST is emptied to the switchover point.

In the long term cooling period, flow paths in the LPI System are established to preclude the possibility of boric acid in the core region reaching an unacceptably high concentration. One flow path is from the hot leg through the decay heat suction line from the hot leg and then in a reverse direction through the reactor building emergency sump suction line into the sump. The other flow path is through the pressurizer auxiliary spray line from one LPI train into the pressurizer and through the hot leg into the top region of the core. Either flow path is capable of providing the required flow rates to ensure boron precipitation is not a concern.

O HPI also functions to supply borated water to the reactor core following increased heat removal events, such as large SLBs.

During low temperature conditions in the RCS, limitations are placed on the maximum number of HPI/Hakeup pumps that are capable of injecting into the RCS. These limitations are part of the plants Low Temperature Overpressure Protection (LTOP) administrative controls.

During a large break LOCA, RCS pressure will decrease to

< 200 psia in < 20 secondc Tha ECCS is actuated upon receipt of an Engineered Safeguaro; Actuation System (ESAS) signal. The actuation of safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start immediately (in the programmed sequence). If offsite power is net available, the engineered safety feature (ESF) buses shed normal operating loads and are connected to the diesel generators. Safeguard loads are then actuated in the programmed time sequence. !

The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required l

l (continued) _j O

Crystal River Unit 3 B 3.5-10 Final Draft 10/01/93

1 ECCS-Operating B 3.5.2 O

G BASES BACKGROUND before pumped flow is available to the core following a (continued) LOCA.

The active ECCS components, along with the passive core flood tanks (CFTs) and the BWST covered in LCO 3.5.1, " Core Flood Tanks (CFTs)," and LCO 3.5.4, " Borated Water Storage-Tank (BWST)," provide the cooling water necessary to meet 10 CFR 50.46 (Ref. 1).

APPLICABLE The LC0 helps to ensure that the following acceptance SAFETY ANALYSES criteria for the ECCS, established by 10 CFR 50.46 (Ref. 1),

will be met following a LOCA:

a. Maximum fuel element cladding temperature is s 2200*F;

b. Maximum cladding oxidation is s 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is s 0.01 times the hypothetical amount generated if all of the metal in the cladding O, cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; l

d. Core is maintained in a coolable geometry; and

e. Adequate long term core cooling capability is maintained.

Both HPI and LPI subsystems are assumed to be OPERABLE in the large break LOCA analysis at full power (Ref. 2). This analysis establishes a minimum required flow for the HPI and ,

LPI pumps, as well as the minimum required response time for their actuation. The HPI pump is credited in the small break LOCA analysis. This analysis establishes the flow and discharge head requirements at the design point for the HPI pump. The SGTR and SLB analyses also credit the HPI pump but are not limiting in their design.

The large break LOCA event with a coincident (with reactor trip) loss of offsite power and a single failure (disabling one ECCS train) establishes the majority of OPERABILITY requirements for the ECCS. During the blowdown phase of a p (continued)

V Crystal River Unit 3 B 3.5-11 Final Draft 10/01/93

ECCS-Operating B 3.5.2 BASES APPLICABLE LOCA, the RCS depressurizes as primary coolant is ejected SAFETY ANALYSIS through the break into the containment. The nuclear (continued) reaction is terminated either by moderator voiding during large breaks or CONTROL ROD assembly insertion for small breaks. Following depressurization, emergency cooling water is injected into the reactor vessel core flood nozzles, then flows into the downcomer, fills the lower plenum, and refloods the core.

The LCO ensures that an ECCS train will deliver sufficient water to match decay heat boiloff rates soon enough to minimize core uncovery for a large break LOCA. It also ensures that the HPI pump will deliver sufficient water for a small break LOCA and provide sufficient boron to maintain the core subcritical following the small break LOCA or an SLB.

In the LOCA analyses, HPI and LPI are not credited until 35 seconds af ter actuation of the ESAS signal. This is based on a loss of offsite power and the associated time delays in startup and loading of the emergency diesel generator (EDG). Further, LPI flow is not credited until RCS pressure drops below the pump's shutoff head. For a O,

large break LOCA, HPI is not credited at all.

The ECCS trains satisfy Criterion 3 of the NRC Policy Statement.

LC0 In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are required to ensure that at least one is available, assuming a single active failure in the other train. For example, the design of the HPI injection valves (MUV-23, MUV-24, MUV-25, and MUV-26) allows power to the motor operators to be selected between a normal or backup power supply. Powering one set of HPI valves from the alternate power supply eliminates the independence and aligns both trains of HPI valves to receive power from the same ES bus. In this condition, the system is still capable of mitigating an event, providing a concurrent single failure does not occur. Hence, the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ACTION addressing a loss of redundancy is appropriate.

(continued)

Crystal River Unit 3 B 3.5-12 Final Draft 10/01/93

-~ .. . - - .-

ECCS -Operating B 3.5.2 BASES i

LCO Conversely, not all portions of the HPI System satisfy the (continued) independence criteria discussed above. Specifically, the :

HPI System downstream of the HPI/ Makeup pumps is not separable into two distinct trains, and is therefore, not independent. This conclusion is based upon analysis which shows injection flow is required through a minimum of three (3) injection legs in the event of a postulated break in the HPI injection piping. When considering the impact of inoperabilities in this portion of the system, the same concept of maintaining single active failure protection must be applied. When components become inoperable, an assessment of the HPI systems ability to perform its safety function must be performed. If the system can continue to ,

perform its safety function, without assuming a single active failure, then the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months loss of redundancy ACTION ,

is appropriate. If the inoperability renders the system, as !

is, incapable of performing its safety function, without postulating a single active failure, then the plant is in a condition outside the safety analysis and must enter LC0 l 3.0.3 immediately, i In MODES 1, 2, and 3, an ECCS train consists of an HPI subsystem and an LPI subsystem. Each train includes the O piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST upon an ESAS !

signal and manually transferring suction to the reactor '

building emergency sump.

During an event requiring ECCS actuation, a flow path is provided to ensure an abundant supply of water from the BWST to the RCS via the HPI and LPI pumps and their respective discharge flow paths to each of the four cold leg injection nozzles and the reactor vessel. In the long term, this flow path may be manually transferred to take its supply from the reactor building emergency sump and to supply its flow to the RCS via two paths, as described in the' Background section.

The flow path for each train must maintain its designed degree of independence to ensure that no single active failure can disable both ECCS trains.

i i

O (continued)

Crystal River Unit 3 B 3.5-13 Final Draft 10/01/93 ,

ECCS-Operating B 3.5.2 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, the ECCS train OPERABILITY requirements for the limiting Design Basis Accident, a large break LOCA, are based on full power operation.

Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES. The HPI pump performance is based on the small break LOCA, which establishes the pump performance curve and is less dependent on power. MODES 2 and 3 requirements are bounded by the MODE 1 analysis.

In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LC0 3.4.6, "RCS Loops-MODE 5, Loops Filled,"

and LCO 3.4.7, "RCS Loops-MODE 5, Loops Not filled."

MODE 6 core cooling requirements are addressed by LC0 3.9.4,

" Decay Heat Removal and Coolant Circulation-High Water Level," and LCO 3.9.5, " Decay Heat Removal and Coolant Circulation-Low Water Level."

O 9

(continued)

Crystal River Unit 3 B 3.5-14 Final Draft 10/01/93

ECCS-Operating B 3.5.2 BASES (continued)

ACTIONS A_d With one or more ECCS trains inoperable and at least 100% of the flow equivalent to a single OPERABLE ECCS train available, the inoperable components must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 3) that are based on a risk evaluation and is a reasonable time for many repairs.

An ECCS train is inoperable if it is not capable of delivering the design flow to the RCS. '

The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the '

diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS. The intent of this Condition is to maintain a combination of equipment such that the safety injection (SI) flow equivalent to 100% .

of a single train remains available. This allows increased O flexibility in plant operations under circumstances when components in opposite trains are inoperable.

An event accompanied by a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref. 3) has shown the risk of having one full ECCS train inoperable to be sufficiently low to justify continued operation for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

With one or more components inoperable such that the flow equivalent to a single OPERABLE ECCS train is not available, the facility is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be immediately entered.

This Condition does not apply to HPI subsystem components which are deactivated for the purposes of complying with low Temperature Overpressure Protection (LTOP) administrative ,

cortrol commitments. With these components deactivated, the HPI subsystem is still considered OPERABLE based upon guidance in NRC Generic Letter 91-18. This guidance allows substitution of manual operator action for otherwise (continued)

Crystal River Unit 3 B 3.5-15 Final Draft 10/01/93 j i

ECCS-Operating B 3.5.2 O

U BASES i

ACTIONS automatic functions for the purposes of determining (continued) OPERABILITY. The substitutions are lia ed ind must be evaluated against the assumptions in the accident analysis.

l In the case of deactivating HPI for LTOP at RCS temperature 1283*F, the components are available for injection following manual operator action to restore the system to OPERABLE status and this action can be accomplished within the time frame required to respond to the transient / accident.

B.1 and B.2 l If the inoperable components cannot be returned to OPERABLE l status within the associated Completion Times, the plant ,

must be placed in a MODE in whico the LC0 does not apply.

To achieve this status, the plant must be placed in at least-MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and at least MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on !

operating experience, to reach the required plant conditions l from full power conditions in an orderly manner and without challenging plant systems. I O SURVEILLANCE SR 3.5.2.1 1

REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. These valves include valves in the main flow paths and the first normally closed valve in a branch line. There are several exceptions for valve position verification due to the low potential for-these types of valves to be mispositioned. The valve types which are not verified as part of this SR include vent or drain valves (both inside and outside the RB), rr. lief valves outside the RB, instrumentation valves (both inside and outside the RB), check valves (both inside and outside the RB), and sample line valves (inside and outside the RB). A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This Surveillance does not require any testing or valve manipulation; rather, (continued)

O Crystal River Unit 3 8 3.5-16 Final Draft 10/01/93

- ECCS-Operating B 3.5.2 BASES

' SURVEILLANCE SR 3.5.2.1 (continued)

REQUIREMENTS it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control, and an inoperable valve position would only affect a single train. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.2.2 Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural uamage or other hydraulic component probleins is required >y Section XI of the American Society of Mechanical Engi".eers (ASME) Code (Ref. 4). This type of testing may be accomplished by '

measuring the pump's developed head at only one point of the pump's characteristic curve and this point may be anywhere_

on the curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that- the performance at the test flow is greater than or equal to the performance assumed in the plant accident analysis. SRs are specified in the Inservice Testing Program, which encompassesSection XI of the ASME Code.Section XI of the ASME Code provides the activities and Frequencies necessary to satisfy the requirements.

SR 3.5.2.3 and SR 3.5.2.4 These SRs demonstrate that each automatic ECCS valve that is not locked, sealed, or otherwise secured in position, actuates to its required position on an actual or simulated ESAS signal and that each ECCS pump starts on receipt of an actual or simulated ESAS signal. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 24 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part cf the ESAS testing, and equipment performance is monitored as part of the Inservice Testing Program.

(continued)

Crystal River Unit 3 B 3.5-17 Final Draft 10/01/93

ECCS-Operating B 3.5.2-P BASES SURVEILLANCE LR 3.5.2.5 REQUIREMENTS (continued) This Surveillance ensures that these valves are in the proper position to prevent the HPI pump from exceeding its runout limit. This 24 month Frequency is acceptable based ,

on consideration of the design reliability (and confirming operating experience) of the equipment.

SR 3.5.2.6 This Surveillance ensures that the flow controllers for the LPI throttle valves will automatically control the LPI train flow rate in the desired range and prevent LPI pump runout as RCS pressure decreases after a LOCA. The 24 month Frequency is acceptable based on consideration of the design i reliability (and confirming operating experience) of the equipment. ,

SR 3.5.2.7 Periodic inspections of the reactor building emergency sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and to preserve i access to the location. This Frequency has been found to be sufficient to detect abnormal degradation and has been confirmed by operating experience.

8 REFERENCES 1. 10 CFR 50.46.

2. FSAR, Section 6.1.

3. NRC Memorandum to ". Stelle, Jr., from R.L. Baer,

" Recommended Interim Revisions to LCOs for ECCS Components," December 1,.1975.

4. American Society of Mechanical Engineers, Boiler and ,

Pressure Vessel Code,Section XI, Inservice Inspection, Article IWP-3000.

O Crystal River Unit 3 8 3.5-18 Final Draft 10/01/93 i

1 l

ECCS--Shutdown B 3.5.3

() B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.3 ECCS--Shutdown i

BASES BACKGROUND The Background section for Bases B 3.5.2 is applicable to !

these Bases, with the following modification.

The ECCS flow paths consist of piping, valves, heat exchangers, and pumps, such that water from the borated water storage tank (BWST) can be injected into the Reactor Coolant System (RCS) following the accidents described in Bases 3.5.2.

APPLICABLE The Applicable Safety Analyses section of Bases 3.5.2 is ,

SAFETY ANALYSES applicable to these Bases.

Due to the stable conditions associated with operation in MODE 4 and the reduced probability of occurrence of a Design ;

Basis Accident (DBA), the ECCS operational requirements are reduced. Included in these reductions is that certain O automatic Engineered Safeguards Actuation System (ESAS) actuation is not available. In this MODE sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA.

Only one ECCS train is required for MODE 4. This requirement dictates that single failures are not considered during this MODE.

LC0 In MODE 4, one ECCS train is required to ensure sufficient ECCS flow is available to the core followi19 a DBA. -

In MODE 4, an ECCS train consists of an HPI subsystem and an LPI subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST upon an ESAS signal and manually transferring suction to the reactor building emergency sump.

1

)

/ (continued)

Crystal River Unit 3 8 3.5-19 Final Draft 10/01/93 ,

ECCS-Shutdown B 3.5.3 BASES LC0 During an event requiring ECCS actuation, a flow path is (continued) required to provide an abundant supply of water from the BWST to the RCS, via the ECCS pumps and their respective discharge flow paths, to each of the four cold. leg injection nozzles and the reactor vessel. In the long term, this flow path may be switched to take its supply from the reactor building emergency sump and to supply its flow to the RCS hot and cold legs.

This LC0 is modified by a Note which states that HPI may be deactivated in accordance with Low Temperature Overpressure Protection (LTOP) administrative controls. Operator action is then required to initiate HPI. In the event of a loss of coolant accident (LOCA) requiring HPI actuation, the time required for operator action has been shown by analysis to be acceptable. ,

APPLICABILITY In MODES 1, 2, and 3, the OPERABILITY requirements for the ECCS are covered by LCO 3.5.2, "ECCS-Operating." ;

In MODE 4 with the RCS temperature below 280*F, one.

O OPERABLE ECCS train is acceptable without single failure consideration, on the basis of the stable reactivity condition of the reactor and the limited core cooling .

requirements. ,

In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LC0 3.4.6, "RCS Loops-MODE 5, Loops Filled,"

and LC0 3.4.7, "RCS Loops-MODE 5, Loops Not Filled."

'0DE 6 core cooling requirements are addressed by LC0 3.9.4,

' ecay Heat Removal ' and Coolant Circulation-High Water Level," and LC0 3.9.5, " Decay Heat Removal and Coolant Circulation-Low Water Level ."

b (continued)

Crystal River Unit 3 B 3.5-20 Final Draft 10/01/93 l

l

ECCS-Shutdown B 3.5.3 BASES (continued)

ACTIONS M If no LPI subsystem is OPERABLE, the unit is not prepared to respond to a LOCA or to continue cooldown using the DHR/LPI pumps and decay-heat heat exchangers. The immediate Completion Time ensures that prompt action is initiated to restore the required cooling capacity. Normally, in MODE 4, reactor decay heat must be removed by a DHR/LPI train operating with suction frcm the RCS. If no DHR/LPI train is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generator (s) (OTSG). The alternate means of heat removal must continue until the inoperable ECCS LPI subsystem can be restored to operation so that continuation of decay heat removal (DHR) is provided.

M If no ECCS HPI subsystem is OPERABLE, due to the inoperability of the HPI pump or flow path from the BWST, the plant is not prepared to provide high pressure response to Design Basis Events requiring ECCS response. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to restore at least one ECCS HPI subsystem O to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity or to initiate actions to place the plant in MODE 5, where an ECCS train is not required.

This Condition does not apply to HPI subsystem components which are deactivated for the purposes of complying with Low Temperature Overpressure Protection (LTOP) administrative control commitments. With these components deactivated, the HPI subsystem is still considered OPERABLE based upon guidance in NRC Generic Letter 91-18. This guidance allows substitution of manual operator action for otherwise automatic functions for the purposes of determining 0PERABILITY. The substitutions are limited and must be evaluated against the assumptions in the accident analysis.

In the case of deactivating HPI in MODE 4, the components are available for injection following manual operator action to restore the system to OPERABLE status and this action can be accomplished within the time frame required to respond to the transient / accident.

(continued)

Crystal River Unit 3 8 3.5-21 Final Draft 10/01/93

ECCS-Shutdown B 3.5.3 BASES ACTIONS L1 (continued)

If the Required Actions and associated Completion Times are

-not met, the plant must be placed in a MODE in which the Specification does not apply. When the Required Actions of Condition B cannot be completed within the associated Completion Time, a controlled shutdown should be initiated, provided adequate decay heat removal capability exists. The allowed Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable, based on operating experience, to reach MODE 5 from MODE 4 conditions

, in an orderly manner and without challenging plant systems.

Should adequate decay heat removal capability not exist, or-Required Action A.1 not be completed within its associated Completion Time, consideration should be given to pursuing Discretionary Enforcement from the NRC on the requirement to proceed to MODE 5.

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The applicable Surveillance descriptions from Bases 3.5.2

"""~

O This SR is modified by a Note which allows a DHR train to be considered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows operation in the DHR mode during MODE 4, if necessary.

REFERENCES The applicable references from Bases 3.5.2 apply.

O Crystal River Unit 3 8 3.5-22 Final Draft 10/01/93

BWST B 3.5.4 8 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.4 Borated Water Storage Tank (BWST)

BASES BACKGROUND The BWST supports the ECCS and the Reactor Building (RB)

Spray System by providing a source of borated water for ECCS '

and RB spray pump operation. In addition, the BWST supplies borated water to the refueling canal for refueling operations.

The BWST supplies both ECCS trains, each by a separate, redundant supply header. Each header also supplies one train of the RB Spray System. Normally closed, motor operated isolation valves (OHV-34, DHV-35) are .

provided in the headers. They allow the operator to isolate the BWST from the Low Pressure Injection (LPI) and RB spray pumps after the pump suction has been transferred to the reactor building emergency sump following depletion of the BWST during a loss of coolant accident (LOCA). Two motor operated isolation valves (MUV-58, MUV-73) provide this same isolation capability for the High Pressure Injection (HPI) system. One of these valves is normally maintained open O dependent upon which Makeup /HPI pumps are ES selected.

practice is dictated by the widely-differing response times This of the pumps and valves and ensures an immediate suction source to these pumps in the event of an ESFAS actuation.

Use of a single BWST to supply both ECCS trains is acceptable because the BWST is a passive component and passive failures are not assumed in the analysis of Design Basis Events (DBEs) to occur coincidentally with the Design Basis Accidant (DBA).

This LCO ensures that:

. a. The BWST contains sufficient borated water to support the ECCS during the injection phase;

b. Sufficient water volume exists in the containment sump to support continued operation of the ECCS and RB spray pumps at the time of transfer to the recirculation mode of cooling; and (continued)

Crystal River Unit 3 8 3.5-23 Final Draft 10/01/93

BWST B 3.5.4 BASES l

BACKGROUND c. The reactor remains subcritical following a LOCA or l (continued) Steam Line Break (SLB).

Insufficient water inventory in the BWST could result in insufficient cooling capacity of the ECCS, inadequate NPSH' for ECCS and RB Spray pumps, insufficient RB heat removal / pressure control and insufficient iodine removal capability when the transfer to the recirculation mode occurs.

Improper boron concentrations could result in a reduction of SHUTDOWN MARGIN or excessive boric acid precipitation in the core following a LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside containment.

APPLICABLE During accident conditions, the BWST is the source of SAFETY ANALYSES borated water to the high pressure injection (HPI), low pressure injection (LPI), and RB spray pumps. As such, it provides core cooling and replacement inventory, containment p cooling and depressurization, and is a source of negative Q reactivity for reactor shutdown. The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of Specifications B 3.5.2, ,

"ECCS-Operating," and B 3.6.6, " Reactor Building Spray and Containment Cooling Systems."

The limits on volume of 2 415,200 gallons and s 449,000 gallons are based on several factors. Sufficient deliverable volume must be available to provide at least 20 minutes of full flow of all ECCS pumps prior to the transfer to the reactor building emergency sump for recirculation. Twenty minutes gives the operator adequate time to prepare for switchover to reactor building emergency sump recirculation.

A second factor that aff;. cts the minimum required BWST volume is the ability to support continued ECCS pump operation after the manual transfer to recirculation occurs.

When ECCS pump suction is transferred to the sump, there ,

must be sufficient water in the sump to ensure adequate net '

(continued)

Crystal River Unit 3 8 3.5-24 Final Draft 10/01/93

BWST B 3.5.4 BASES APPLICABLE positive suction head (NPSH) for the LPI and RB spray pumps.

SAFETY ANALYSIS This NPSH calculation is described in the FSAR (Ref.1), and (continued) the amount of water that enters the sump from the BWST and other sources is one of the input assumption::. Since the BWST is the main source that contributes to the amount of water in the sump following a LOCA, the calculation does not take credit for more than the minimum volume of usable water from the BWST.

The third factor is that the volume of water in the BWST must be within a range that will ensure the solution in the sump following a LOCA is within a specified pH range (7.0 to 11.0) that will minimize the evolution of iodine and the effect of chloride and caustic stress corrosion cracking on the mechanical systems and components.

Although not related to ECCS, the volume range also ensures that refueling requirements are met and that the capacity of the BWST is not exceeded. Note that the volume limits refer to total, rather than usable, volume required to be in the BWST; a certain amount of water is unusable because of tank discharge line location or other physical characteristics.

The 2270 ppm limit for minimum boron concentration was cstablished to ensure that, following a LOCA, with a minimum BWST level, the reactor will remain subcritical in the cold condition following mixing of the BWST and Reactor Coolant System (RCS) water volumes. Large break LOCAs assume that all control rods remain withdrawn from the core during the initial phases of the event, particularly blowdown. Long- ]

term shutdown does require the negative reactivity from half i or more (cycle-specific) of the rods.

The minimum and maximum concentration limits both ensure l that the solution in the sump following a LOCA is within a j specified pH range (7.0 to 11.0) that will minimize the ;

evolution of iodine and the effect of chloride and caustic stress corrosion cracking on the mechanical systems and l components. <

l The 3000 ppm maximum limit for boron concentration in the !

BWST is also based on the potential for boron precipitation in the core during the long term cooling period following a LOCA. For a cold leg break, the core dissipates heat by pool nucleate boiling. Because of this boiling phenomenon in the core, the boric acid concentration will increase in-i (continued)

Crystal River Unit 3 B 3.5-25 Final Draft 10/01/93

BWST B 3.5.4

( BASES APPLICABLE this region. If allowed to proceed in this manner, a SAFETY ANALYSIS point may be reached where boron precipitation will occur in (continued) the core. Post LOCA emergency procedures direct the operator to establish dilution flow paths in the LPI System to prevent this condition by establishing a forced flow path through the core regardless of break location. These procedures are based on the minimum time in which precipitation could occur, assuming that maximum boron concentrations exist in the borated water sources used for injection following a LOCA. Boron concentrations in the BWST in excess of the limit could result in precipitation earlier than assumed in the analysis.

The 40*F lower limit on the temperature of the solution in the BWST was established to ensure that the solution will not freeze. This temperature also helps prevent boron precipitation and ensures that water injection in the reactor vessel will not be colder than the lowest temperature assumed in reactor vessel stress analysis. The 100*F upper limit on the temperature of the BWST contents is consistent with the maximum injection water temperature assumed in the Containment Structural analyses. An evaluation of the impact of raising BWST temperature from O 90*F to 100*F on calculated peak containment internal DBA pressure (P,) resulted in an increase in P, from 53.3 to 53.9 psig. The upper temperature limit also ensures the BWST temperature assumed in the LOCA analysis is preserved.

A BWST temperature of 120'F has been qualified for core '

cooling (Ref. 2).

The numerical values of the parameters stated in the SRs are analysis values and do not include allowance for instrument errors.

The BWST satisfies Criterion 3 of the NRC Policy Statement.

LC0 OPERABILITY of the BWST ensures that an adequate supply of borated water is available to cool and depressurize the containment in the event of a DBA; to cool and cover the core in the event of a LOCA, to ensure the reactor remains subtritical following a small break LOCA and Steam Line Break; and to ensure an adequate level exists in the containment sump to support ECCS and RB spray pump operation in the recirculation mode. To be considered OPERABLE, the (continued)

O .

Crystal River Unit 3 8 3.5-26 Final Draft 10/01/93

BWST B 3.5.4 BASES LC0 BWST must meet the limits for water volume, boron (continued) concentration, and temperature established in the SRs.

APPLICABILITY In MODES 1, 2, 3, and 4, the BWST OPERABILITY requirements are dictated by the ECCS and RB Spray System OPERABILITY requirements. Since both the ECCS and RB Spray System must be OPERABLE in MODES 1, 2, 3, and 4, the BWST must be OPERABLE to support their operation. Core cooling requirements in MODE 5 are addressed by LC0 3.4.6, "RCS Loops-MODE 5, Loops Filled," and LCO 3.4.7, "RCS Loops-MODE 5, Loops Not Filled," respectively. MODE 6 core cooling requirements are addressed by LCO 3.9.4, " Decay Heat Removal and Coolant Circulation-High Water Level," and

LC0 3.9.5, " Decay Heat Removal and Coolant Circulation--Low Water Level ."

ACTIONS A.1 With either the BWST boron concentration or borated water temperature not within limits, the condition must be O corrected within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this condition, neither the ECCS nor the Reae. tor Building Spray System can perform its design functions. Therefore, prompt action must be taken to restore the tank to OPERABLE status, or to place the plant in a MODE in which these systems are not required. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months limit to restore the temperature or boron concentration to within limits is based on engineering judgment considering 1) the time required to change boron concentration or temperature, recirculate the tank, and perform a confirmatory measurement, and 2) the contents of .

the tank are still available for injection.

fL1 With the BWST inoperable for reasons other than Condition A (e.g., water volume) levels must be restored to within required limits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . In this condition, neither the ECCS nor the Reactor Building Spray System can perform 1 (continued)

Crystal River Unit 3 B 3.5-27 Final Draft 10/01/93

l 1

.BWST B 3.5.4 l

( BASES l

I ACTIONS IL1 (continued) its design functions. Therefore, prompt action must be taken to restore the tank to OPERABLE status, or to place the plant in a MODE in which the BWST is not required. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to restore the BWST to OPERABLE status is based on this condition simultaneously affecting multiple redundant trains.

C.1 and C.2 If the BWST cannot be restored to OPERABLE status within the associated Completion Time, the plant must.be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. -

O SURVEILLANCE SR 3.5.4.1 REQUIREMENTS Verification every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months that the BWST water temperature is within the specified temperature band ensures that the boron will not precipitate; the fluid will not freeze; the fluid temperature entering the reactor vessel will not be ciiuer than assumed in the reactor vessel stress analysis; and the fluid temperature entering the reactor vessel will not be hotter than assumed in the LOCA and Containment analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is frequent enough to identify a temperature change that would approach either temperature limit and has been shown to be acceptable through operating experience.

The SR is modified by a Note that requires the Surveillance to be performed only when the ambient air temperatures are outside the operating temperature limits of the BWST. With ambient temperatures within this band, the BWST temperature should not exceed the limits.

(continued)

O Crystal River Unit 3 8 3.5-28 Final Draft 10/01/93

BWST.

B 3.5.4 l l

BASES SURVEILLANCE SR 3.5.4.2 REQUIREMENTS (continued) Verification every 7 days that the BWST contained volume is within the required range ensures that a sufficient initial supply is available for injection and to support continued :

ECCS pump operation on recirculation. Since the BWST volume is normally stable and provided with a low Level alarm, a 7 day Frequency has been shown to be appropriate through operating experience.

SR 3.5.4.3 Verification every 31 days that the boron concentration of the BWST fluid is within the required band ensures that the reactor will remain subcritical following a small break LOCA or SLB. Since the BWST volume is normally static, mechanisms which would cause a change in concentration are limited and a 31 day sampling Frequency is appropriate.

The Frequency is. adequate to identify changes that occur from mechanisms such as stratification or in-leakage.

Sampling within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months following a 4003 gallon volume

( increase allows time to recirculate the tank volume and will identify whether in-leakage or addition from another source has caused the boron concentration to be outside the required limit.

REFERENCES 1. FSAR, Section 6.4.2 and Table 6-12.

2. Decay Heat Removal System Design Basis Document, Revision 3, May 14, 1990, 1

O Crystal River Unit 3 8 3.5-29 Final Draft 10/01/93 e

-r -

w- = y --e,m ,-

Containment 1 B 3.6.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1 Containment BASES BACKGROUND The containment consists of the concrete reactor building (RB), its steel liner, and the penetrations through this structure. The structure is designed to contain water and steam, as well as radioactive material that may be released from the reactor core following a Design Basis Accident (DBA). Additionally, this structure provides shielding from the fission products that may be present in the containment atmosphere following accident conditions.

The containment is a reinforced concrete structure with a

' cylindrical wall, a flat foundation mat, and a shallow dome roof. The cylinder wall is prestressed with a post tensioning system in the vertical and horizontal directions, and the dome roof is prestressed using a three way post tensioning system. The inside surface of the containment has a carbon steel liner to ensure a high degree of leak tightness during operating and accident conditions.

The concrete RB is required for structural integrity of the containment under DBA conditions. The steel liner and its penetrations establish the leakage limiting boundary of the containment. Maintaining the containment OPERABLE limits the leakage of fission product radioactivity from the containment to the environment. SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, Appendix J (Ref. 1), as modified by approved exemptions.

The isolation devices for the penetrations in the containment boundary are a part of the containment leak tight barrier. To maintain this leak tight barrier:

a. All penetrations required to be closed during accident conditions are either:

1. capable of being closed by an OPERABLE automatic containment isolation system, or

2. closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LC0 3.6.3, " Containment Isolation Valves";

(continued)

Crystal River Unit 3 8 3.6-1 Final Draft 10/01/93

Containment B 3.6.1 BASES BACKGROUND b. Each air lock is OPERABLE, except as provided in (continued) LCO 3.6.2, " Containment Air Locks".

APPLICABLE The safety design basis for the containment is that the SAFETY ANALYSES containment must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate.

The DBAs that result in a challenge to containment from high pressures and temperatures are a loss of coolant accident (LOCA), a steam line break, and a rod ejection accident (REA) (Ref. 2). In addition, release of significant fission product radioactivity within containment can occur from a LOCA or REA. In the analyses of DBAs involving release of fission product radioactivity, it is assumed that the containment is OPERABLE so that the release to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.25% of containment air weight per day (Ref. 3). This leakage rate, used in the evaluation of offsite doses resulting from accidents, is defined in 10 CFR 50, Appendix J (Ref.1), as L.: the maximum O allowable leakage rate at the calculated maximum peak containment pressure (P.) resulting from the limiting DBA.

The allowable leakage rate represented by L. forms the basis for the acceptance criteria imposed on all containment leakage rate testing. L. is assumed to be 0.25% of containment air weight per day in the safety analysis at P. - 53.9 psig (Ref. 3).

The acceptance criteria applied to accidental releases of radioactive material to the environment are given in terms of total radiation dose received by a hypothetical member of the general public who is assumed to remain at the exclusion area boundary for two hours following onset of the postulated fission product release. The limits established in 10 CFR 100 (Ref. 5) are a whole body dose of 25 Rem or a 300 Rem dose to the thyroid from iodine exposure.

The containment satisfies Criterion 3 of the NRC Policy Statement.

(continued)

Crystal River Unit 3 8 3.6-2 Final Draft 10/01/93

Containment B 3.6.1 BASES (continued)

LCO Containment OPERABILITY is maintained by limiting leakage to less than the acceptance criteria of 10 CFR 50, Appendix J (Ref. 1). Compliance with this LC0 will ensure a containment configuration, including equipment hatches, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis.

Individual leakage rates specified for the containment air lock (LC0 3.6.2) and purge valves with resilient seals -

(LC0 3.6.3) are not specifically part of the acceptance criteria of SR 3.6.1.1. Therefore, leakage rates exceeding these individual limits only result in the containment being inoperable when the total leakage exceeds the acceptance criteria of Appendix J.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material into containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, containment is not required to be OPERABLE in MODE 5. The requirements for containment during O MODE 6 are addressed in LC0 3.9.3, " Containment Penetrations."

ACTIONS M In the event containment is inoperable for reasons other than Condition B or C, containment must be restored to OPERABLE status within I hour. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining containment during MODES 1, 2, 3, and 4. This time period also ensures the probability of an accident (requiring containment OPERABILITY) occurring during periods when containment is inoperable is minimal, M

With the average of the prestress forces in a group of tendons below the minimum required by the Containment Tendon Surveillance Program, the containment must be restored to (continued)

Crystal River Unit 3 8 3.6-3 Final Draft 10/01/93 l

- , -n , . , .- . . , .

Containment B 3.6.1 BASES I

ACTIONS ILL (continued) j i

its required level of structural integrity within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

In this degraded condition, the containment may still be OPERABLE, however this cannot be positively determined unless all tendons in the group (dome, vertical, and hoop) are tested and the containment is re-evaluated with consideration of the test results. Rather than focus efforts on performing this testing, the preferred action is to correct the problem. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time provides i a reasonable period of time to restore the containment to l the required level of structural integrity and is reasonable l considering the existing level of structural integrity !

provided by the tendons and the low probability of an !

accident occurring during the period of time the prestress i forces are not within limits. j L.1 With the containment tendons found to exhibit abnormal degradation, as described in the Containment Tendon Surveillance Program, the containment must be restored to its required level of structural integrity within 15 days.

O Tendons found to exhibit abnormal degradation as described in the Program, are not necessarily indicative that the l

required level of structural integrity does not exist. If action is not taken, there is an increased possibility subsequent degradation may occur which would render the containment inoperable at some time over the plant lifetime.

The 15 day Completion Time provides a reasonable period of time to evaluate the degradation for immediate impact on containment structural integrity and to restore the containment, if required, to the required level of structural integrity. This is considered acceptable considering the existing level of structural integrity provided by the tendons and the low probabil.ity of an accident occurring during this period of time.

(continued)

Crystal River Unit 3 8 3.6-4 Final Draft 10/01/93

Containment B 3.6.1 BASES ACTIONS D.1 and D.2 (continued)

If containment cannot be restored to OPERABLE status, or tendon degradation cannot be corrected within the required Completion Time, the plant must be placed in a MODE in which the LC0 does not apply. To achieve this status, the plant ,

must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in .

MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.1 REQUIREMENTS Maintaining the containment OPERABLE requires compliance with the visual examinations and leakage rate test. >

requirements of 10 CFR 50, Appendix J (Ref. 1), as modified by approved exemptions. Failure to meet air lock and purge valve with resilient seal leakage limits for SR 3.6.2.1 and 3.6.3.6 does not constitute a failure of this Surveillance unless the contribution from these penetrations causes O overall Type A, B, and C leakage to exceed limits. SR Frequencies are as required by Appendix J, as modified by ;

approved exemptions. Thus, SR 3.0.2 (which allows Frequency extensions) does not apply. These periodic testing requirements verify that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis.

SR 3.6.1.2 This 3R ensures that the structural integrity of the containment will be maintained in accordance with the provisions of the Containment Tendon Surveillance Program.

Testing and Frequency are consistent with the recommendations of NRC Regulatory Guide 1.35, Revision 3.

(continued)

Crystal River Unit 3 8 3.6-5 Final Draft 10/01/93 I

Containment

'B 3.6.1 BASES (continued)

REFERENCES 1. 10 CFR 50, Appendix J.

2. FSAR, Sections 14.2.2.

3. FSAR, Table 14-57.

4. Regulatory uuide 1.35, Rev.3, 1989.

5. 10 CFR 100.

O l

l l

)

O !

Crystal River Unit 3 B 3.6-6 Final Draft 10/01/93

1 Containment Air Locks B 3.6.2 83.6 CONTAINMENT SYSTEMS B 3.6.2 Containment Air Locks BASES BACKGROUND Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of operation.

Each air lock is nominally a right circular cylinder,10 ft in diameter, with a door at each end. The doors are interlocked to prevent simultaneous opening. During periods when containment is not required to be OPERABLE, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary. Each air lock door has been designed and is tested to verify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment. Therefore, closure of a single door supports containment OPERABILITY. Each of the doors contain two gasketed seals and local leakage rate testing capability to ensure pressure integrity. To effect a leak tight seal, the O air lock design uses pressure seated doors (i.e., an increase in containment internal pressure results in increased sealing force on each door).

Each personnel air lock door is provided with limit switches that provide control room indication of door position.

Additionally, control room indication is provided to alert the operator whenever an air lock door interlock mechanism is defeated.

The containment air locks form part of the containment pressure boundary. Their integrity and leak tightness is essential for maintaining the containment leakage rate within limit in the event of a DBA. Not maintaining air lock integrity or leak tightrm may result in a leakage rate in excess of that assumed in the unit safety analysis.

All leakage rate requirements are in conformance with 10 CFR 50, Appendix J (Ref.1), as modified by approved exemptions.

(continued)

Crystal River Unit 3 B 3.6-7 Final Draft 10/01/93

Containment Air Locks B 3.6.2 BASES (continued)

APPLICABLE The DBAs that result in a release of radioactive material SAFETY ANALYSES. within containment are a loss of coolant accident (LOCA), a steam line break, and a rod ejection accident (Ref. 2). In the analysis of each of these accidents, it is assumed that containment is OPERABLE so that release of fission products to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.25% of containment air weight per day (Ref. 3). This leakage rate is defined in 10 CFR 50, Appendix J (Ref.1), as L.: the maximum allowable containment leakage rate at the calculated maximum peak containment pressure (P.) following a DBA. This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air lock. L. i s ,

0.25% of containment air weight per day and P. is 53.9 psig, resulting from the limiting design basis LOCA.

The acceptance criteria applied to DBA releases of radioactive material to the environment are given in terms of total radiation dose received by a member of the general public who remains at the exclusion area boundary for two hours following onset of the postulated fission product release. The limits established in 10 CFR 100 (Ref. 4) are a whole body dose of 25 Rem or a 300 Rem dose to the thyroid from iodine exposure.

The containment air locks satisfy Criterion 3 of the NRC Policy Statement.

l l

LC0 Each containment air lock forms part of the containment pressure boundary. As a part of containment, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

(continued)

Crystal River Unit 3 B 3.6-8 Final Draft 10/01/93 l

l l

Containment Air Locks B 3.6.2 BASES LC0 Each air lock is required to be OPERABLE. For the air lock (continued) to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in ccmpliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of containment does not exist when containment is required to be OPERABLE.

Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events.

Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into and exit from containment.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES.

Therefore, the containment air locks are not required in MODE 5 to prevent leakage of radioactive material from s containment. The requirements for the containment air locks during MODE 6 are addressed in LCO 3.9.3, " Containment Penetrations."

ACTIONS The ACTIONS are modified by a Note that allows entry and ;

exit to perform repairs on the affected air lock component i or for emergencies involving personnel safety. If the outer door is inoperable, then it may be easily accessed to repair. If the inner door is the one that is inoperable, however, then a short time exists when the containment boundary is not intact (during access through the outer door). In this context, repairs include follow-up actions to an initial failure of the air lock door seal SR in order to determine which air lock door (s) is faulty. There are circumstances where an at-power containment entry would be required during the period of time that one air lock was ;

inoperable. In this case, entry would be made through the OPERABLE air lock if ALARA conditions permit. However, the l

1 (continued)

Crystal River Unit 3 B 3.6-9 Final Draft 10/01/93

Containment Air Locks B 3.6.2 BASES ACTIONS containment is a harsh environment with bulk average (continued) temperatures typically in excess of 120 F and self-contained breathing apparatus may be required with the reactor at power. In the event something was to happen to the individual who had entered containment, plant personnel would proceed through the most expeditious rescue path in order to get that individual out and provide medical care.

Thus, the Note allows entry and exit through the inoperable door for personnel safety reasons when the quickest path to the person happens to be through the inoperable door. The ability to open the OPERABLE door, even if it means the containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit the OPERABLE door must be immediately closed. If ALARA conditions permit, entry and exit should be via an OPERABLE air lock.

A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each air lock.

In the event the air lock leakage results in exceeding the overall containment leakage rate, Note 3 directs entry into the applicable Conditions and Required Actions of LC0 3.6.1,

" Containment."

A.I. A.2. and A.3 With one air lock door inoperable in one or more containment air locks, the OPERABLE door must be verified closed (Required Action A.1) in each affected containment air lock.

This ensures that a leak tight containment barrier is maintained by the use of an OPERABLE air lock dc tr. This action must be completed within I hour. This ~.:cified time period is consistent with the ACTIONS of LC0 3.6.1, which requires containment be restored to OPERABLE status within I hour.

(continued)

Crystal River Unit 3 B 3.6-10 Final Draft 10/01/93

Containment Air Locks B 3.6.2 BASES ACTIONS A.l. A.2 and A.3 (continued)

In addition, the affected air lock penetration must be isolated by locking closed the remaining OPERABLE air lock door within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is considered reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed.

Required Action A.3 verifies that an air lock with an inoperable door has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an

acceptable containment leakage boundary is maintained. The

3F1093-12, Proposed Tech Specs Reflecting Results of Numerous Meetings Re Improved TS

Text

Navigation menu

Search